Commit Graph

120 Commits

Author SHA1 Message Date
George Karpenkov b0c2bb572d [libFuzzer tests] Only enable libFuzzer tests if
-DLIBFUZZER_ENABLE_TESTS=ON is set.

llvm-svn: 310100
2017-08-04 19:29:16 +00:00
George Karpenkov 96d6008145 Fixing buildbots: do not register check-fuzzer if clang or asan are not
present.

llvm-svn: 310077
2017-08-04 17:43:29 +00:00
George Karpenkov a5de052362 Drop Windows support from libFuzzer tests.
Differential Revision: https://reviews.llvm.org/D36205

llvm-svn: 310076
2017-08-04 17:43:28 +00:00
George Karpenkov 8ecdd7be15 Port libFuzzer tests to LIT. Do not require two-stage build for check-fuzzer.
This revision ports all libFuzzer tests apart from the unittest to LIT.
The advantages of doing so include:

 - Tests being self-contained
 - Much easier debugging of a single test
 - No need for using a two-stage compilation

The unit-test is still compiled using CMake, but it does not need a
freshly built compiler.

NOTE: The previous two-stage bot configuration will NOT work, as in the
second stage build LLVM_USE_SANITIZER is set, which disables ASAN from
being built.
Thus bots will be reconfigured in the next few commits.

Differential Revision: https://reviews.llvm.org/D36295

llvm-svn: 310075
2017-08-04 17:19:45 +00:00
Kostya Serebryany 0fc5ee2db0 [libFuzzer] temporarty remove pc-tables and disable test/fuzzer-printcovpcs.test until this can be fixed on Windows
llvm-svn: 309716
2017-08-01 18:02:19 +00:00
Kostya Serebryany 4f2970037a [libFuzzer] enable -fsanitize-coverage=pc-table for all tests
llvm-svn: 309646
2017-08-01 00:48:44 +00:00
George Karpenkov 9bc64acf90 Revert "Revert "[libFuzzer] Add a dependency on symbolizer from libFuzzer tests""
This reverts commit 15425f2bc6eac6249ee957a2a280511306c07547.

Should work now that atos is a default symbolizer on Darwin.

llvm-svn: 308910
2017-07-24 18:38:14 +00:00
Kostya Serebryany 15cc3713d3 [libFuzzer] add DeepRecursionTest, inspired by https://guidovranken.wordpress.com/2017/07/08/libfuzzer-gv-new-techniques-for-dramatically-faster-fuzzing/ (Stack-depth-guided fuzzing). libFuzzer does not solve it yet.
llvm-svn: 308571
2017-07-20 00:37:08 +00:00
Reid Kleckner b3283b740f Fix fuzzer-flags.test on Windows
The optional external function callbacks have to be exported in order
for them to be called. The test was failing because libFuzzer wasn't
calling LLVMFuzzerInitialize.

We can reconsider if this is the best way to mark these optional
callbacks exported later.

llvm-svn: 308548
2017-07-19 23:22:06 +00:00
George Karpenkov 00727af610 Revert "[libFuzzer] Add a dependency on symbolizer from libFuzzer tests"
This reverts commit 546e006a023cccd0fd32afd442ab992d3515d4b8.

Reverting until I can figure out llvm-symbolizer breakages on mac os.

llvm-svn: 308202
2017-07-17 18:18:03 +00:00
Justin Bogner c27a70d048 [libFuzzer] Allow non-fuzzer args after -ignore_remaining_args=1
With this change, libFuzzer will ignore any arguments after a sigil
argument, but it will preserve these arguments at the end of the
command line when launching subprocesses. Using this, its possible to
handle positional and single-dash arguments to the program under test
by discarding everything up to -ignore_remaining_args=1 in
LLVMFuzzerInitialize.

llvm-svn: 308069
2017-07-14 23:33:04 +00:00
Kostya Serebryany 1ca738809a [libFuzzer] experimental feature -reduce_inputs (off by default) that tries to replace elements in the corpus with smaller ones that have the same feature set. Still needs tuning
llvm-svn: 307873
2017-07-13 01:08:53 +00:00
George Karpenkov 52b2dbb673 [libFuzzer] Add a dependency on symbolizer from libFuzzer tests
Some libFuzzer tests on Linux would fail with bizarre error messages
unless llvm-symbolizer binary is present.

Differential Revision: https://reviews.llvm.org/D35313

llvm-svn: 307826
2017-07-12 18:17:34 +00:00
George Karpenkov 406c113103 Fixing section name for Darwin platforms for sanitizer coverage
On Darwin, section names have a 16char length limit.

llvm-svn: 305429
2017-06-14 23:40:25 +00:00
Kostya Serebryany 546a286cef [libFuzzer] really restrict the new test to Linux (fails on Mac/Windows currently)
llvm-svn: 305346
2017-06-14 00:34:42 +00:00
Kostya Serebryany f2d4dcb888 [libFuzzer] initial support of -fsanitize-coverage=inline-8bit-counters in libFuzzer. This is not fully functional yet, but simple tests work
llvm-svn: 305331
2017-06-13 22:31:21 +00:00
Kostya Serebryany fe4ed9bd85 [libFuzzer] make sure the input data is not overwritten in the fuzz target (if it is -- report an error)
llvm-svn: 302494
2017-05-09 01:17:29 +00:00
Kostya Serebryany ac7a9eae0b [libFuzzer] experimental option -cleanse_crash: tries to replace all bytes in a crash reproducer with garbage, while still preserving the crash
llvm-svn: 300498
2017-04-17 20:58:21 +00:00
Kostya Serebryany d7d1d517ee [libFuzzer] best effort support for -fsanitize-coverage=trace-pc instrumentation. It is less efficient and precise than -fsanitize-coverage=trace-pc-guard, but still works
llvm-svn: 299046
2017-03-30 01:27:20 +00:00
Kostya Serebryany c58982d6fa [libFuzzer] be more careful when calling strlen of strcmp parameters, PR32357
llvm-svn: 298746
2017-03-24 22:19:52 +00:00
Kostya Serebryany 6ca44f9161 [libFuzzer] create experimental support for user-provided coverage signal
llvm-svn: 298654
2017-03-23 22:43:12 +00:00
Kostya Serebryany a52c8d0daf [libFuzzer] add a test with two different bugs
llvm-svn: 298030
2017-03-17 01:33:16 +00:00
Vitaly Buka 91266b4752 [fuzzer] Don't crash if LLVMFuzzerMutate was called by CustomCrossOver
Reviewers: kcc

Subscribers: llvm-commits, mgorny

Differential Revision: https://reviews.llvm.org/D30682

llvm-svn: 297202
2017-03-07 20:37:38 +00:00
Kostya Serebryany 32c5004cf5 [libFuzzer] increase the size of FixedWord from 27 to 64, see PR31950
llvm-svn: 295117
2017-02-14 23:02:37 +00:00
Marcos Pividori a0b23b8e63 [libFuzzer] Export external functions on tests.
We need to export external functions so they are found when calling
GetProcAddress() on Windows. But we can't use `__declspec(dllexport)` because
we want the targets to be completely independent from the fuzz engines and don't
depend on other header files. Also, we don't want to include platform specific
code managed with conditional macros.
So, the solution is to add the exported symbols with linker flags in cmake.

Differential revision: https://reviews.llvm.org/D29752

llvm-svn: 294688
2017-02-10 01:40:28 +00:00
Marcos Pividori 2a318a18db [libFuzzer] Use custom target instead of list of binaries for tests.
Update cmake to use a custom target TestBinaries instead of a list of targets.
This simplifies cmake, and fix some errors. This way, we don't have to propagate
the values into parents directories. We only need to use add_dependencies.

Differential Revision: https://reviews.llvm.org/D29593

llvm-svn: 294389
2017-02-08 00:03:26 +00:00
Marcos Pividori 9c0244c1eb [libFuzzer] Add features `windows` and `posix` for lit tests.
Add 2 features: posix and windows.
Sometimes we want some specific tests only for posix and we use:
 REQUIRES: posix
Sometimes we want some specific tests only for windows and we use:
 REQUIRES: windows

Differential Revision: https://reviews.llvm.org/D29418

llvm-svn: 293827
2017-02-01 22:40:34 +00:00
Kostya Serebryany 6bdd8fc5b6 [libFuzzer] make sure we use the feedback from std::string operator ==
llvm-svn: 292835
2017-01-23 22:11:04 +00:00
Marcos Pividori 0f84c7aef6 [libFuzzer] Add missing dependency for tests.
Dependency on TestBinaries was erroneously removed on r292735.

llvm-svn: 292765
2017-01-22 21:55:46 +00:00
Marcos Pividori 76c58b4413 [libFuzzer] Specify the CRT considered (MT or MD) for tests on Windows.
Differential Revision: https://reviews.llvm.org/D28439

llvm-svn: 292749
2017-01-22 02:28:12 +00:00
Marcos Pividori 0a4aeceb90 [libFuzzer] Fix test with shared libraries on Windows.
We need to set BINARY_DIR to: ${CMAKE_BINARY_DIR}/lib/Fuzzer/test , so the dll
is placed in the same directory than the test LLVMFuzzer-DSOTest, and is found
when executing that test.
As we are using CMAKE_CXX_CREATE_SHARED_LIBRARY to link the dll, we can't modify
the output directory for the import library. It will be created in the same
directory than the dll (in BINARY_DIR), no matter which value we set to
LIBRARY_DIR. So, if we set LIBRARY_DIR to a different directory than BINARY_DIR,
when linking LLVMFuzzer-DSOTest, cmake will look for the import library
LLVMFuzzer-DSO1.lib in LIBRARY_DIR, and won't find it, since it was created in
BINARY_DIR. So, for Windows, we need that LIBRARY_DIR and BINARY_DIR are the
same directory.

Differential Revision: https://reviews.llvm.org/D27870

llvm-svn: 292748
2017-01-22 02:28:08 +00:00
Marcos Pividori 5bd35b4d3d [libFuzzer] Leak Sanitizer is not supported for Windows.
Differential Revision: https://reviews.llvm.org/D28709

llvm-svn: 292745
2017-01-22 01:58:55 +00:00
Marcos Pividori 403007e3c1 [libFuzzer] Remove optimization flags for tests.
We need to build all the tests with -O0, otherwise optimizations may merge some
basic blocks and the tests will fail.
In this diff, I simplify the cmake implementation and I remove the flags for
Windows too (/O[123s]).

Differential Revision: https://reviews.llvm.org/D28632

llvm-svn: 292737
2017-01-22 01:27:42 +00:00
Marcos Pividori fb24f2257d [libFuzzer] Remove dependencies for tests on Windows.
Remove dependency on FileCheck, sancov and not for tests on Windows.
If LLVM_USE_SANITIZER=Address and LLVM_USE_SANITIZE_COVERAGE=YES, this will
trigger the building of dependencies with sanitizer instrumentation.
This will fail in Windows, since cmake will use link.exe for linking and won't
include compiler-rt libraries.

Differential Revision: https://reviews.llvm.org/D27993

llvm-svn: 292735
2017-01-22 01:27:34 +00:00
Marcos Pividori 3984eb4ad0 [libFuzzer] Use clang as linker on Windows, to properly include sanitizer libraries.
In order to use sanitizers on Windows, we need to link against many runtime
libraries which will depend on the target being created (executable or dll) and
the c runtime library used (MT/MD).
By default, cmake uses link.exe for linking, which fails because we don't
specify the appropiate dependencies. As we don't want to consider all of that
possible situations which depends on the implementation of the compiler-rt, the
simplest option is to change the rules for linking executables and shared
libraries, using the compiler instead of link.exe.
Clang driver will consider the sanitizer flags, and automatically provide the
required libraries to the linker.

Differential Revision: https://reviews.llvm.org/D27869

llvm-svn: 292669
2017-01-20 22:49:08 +00:00
Marcos Pividori d41720267e [libFuzzer] Properly use compiler options supported on Windows.
Replace "-g" by "-gline-tables-only". "-g" is not supported by clang-cl.

Differential Revision: https://reviews.llvm.org/D27868

llvm-svn: 292668
2017-01-20 22:48:47 +00:00
Kostya Serebryany 87a3811d32 [libFuzzer] add an assert to protect against LLVMFuzzerInitialize changing argv[0]
llvm-svn: 292652
2017-01-20 21:34:24 +00:00
Kostya Serebryany 38b5d3ca54 [libFuzzer] improve -minimize_crash: honor -artifact_prefix= and don't special case 2-byte inputs
llvm-svn: 292511
2017-01-19 19:38:12 +00:00
Kostya Serebryany 6e47a10ec7 [libFuzzer] add two tests for experimenting with equivalence fuzzing
llvm-svn: 292509
2017-01-19 19:07:26 +00:00
Mike Aizatsky 0e37f8e41d [libfuzzer] fixing collected pc addresses for coverage
Summary: The causes google/ossfuzz#84

Reviewers: kcc

Subscribers: mgorny

Differential Revision: https://reviews.llvm.org/D28827

llvm-svn: 292289
2017-01-17 23:11:32 +00:00
Mike Aizatsky a5c7efc6d4 [libfuzzer] removing experimental FuzzerFnAdapter
Summary: This is superceded by protobuf mutation work.

Reviewers: kcc

Subscribers: mgorny

Differential Revision: https://reviews.llvm.org/D27865

llvm-svn: 290018
2016-12-17 00:12:13 +00:00
Marcos Pividori 64d4147396 [libFuzzer] Fix bug in detecting timeouts when input string is empty.
I added a new flag RunningCB to know if the Fuzzer's main thread is
running the CB function, instead of using (!CurrentUnitSize).
(!CurrentUnitSize) doesn't work properly. For example, in FuzzerLoop.cpp,
inside ShuffleAndMinimize() function, we execute the callback with an
empty string (size=0). Previous implementation failed to detect timeouts
in that execution.
Also, I add a regression test for that case.

Differential Revision: https://reviews.llvm.org/D27433

llvm-svn: 289561
2016-12-13 17:46:25 +00:00
Kostya Serebryany 035af9b346 [libFuzzer] build libFuzzer itself with asan
llvm-svn: 289469
2016-12-12 20:58:10 +00:00
Kostya Serebryany c05cb60369 [libFuzzer] test cleanup (3)
llvm-svn: 289314
2016-12-10 02:48:42 +00:00
Kostya Serebryany 2f962fe5f7 [libFuzzer] test cleanup
llvm-svn: 289312
2016-12-10 02:45:56 +00:00
Kostya Serebryany 61be0f947d [libFuzzer] switch all libFuzzer tests to use -fsanitize-coverage=trace-pc-guard. Support for the previosly used instrumentation will be removed in the following changes
llvm-svn: 289311
2016-12-10 02:26:23 +00:00
Kostya Serebryany 05f7791fbf [libFuzzer] extend -rss_limit_mb to crash instantly on a single malloc that exceeds the limit
llvm-svn: 288281
2016-11-30 22:39:35 +00:00
Kostya Serebryany 117976818e [libFuzzer] add StandaloneFuzzTargetMain.c and a test for it
llvm-svn: 285135
2016-10-25 22:30:34 +00:00
Kostya Serebryany 2bfff021ad [libFuzzer] add a test for asan's strict_string_checks=1
llvm-svn: 284902
2016-10-22 00:05:44 +00:00
Kostya Serebryany 9a4b10a56f [libFuzzer] swap bytes in integers when handling CMP traces
llvm-svn: 284301
2016-10-15 04:00:07 +00:00