Commit Graph

100 Commits

Author SHA1 Message Date
Dan Liew d15c106c9b [LibFuzzer] s/dataflow sanitizer/DataflowSanitizer/
llvm-svn: 271980
2016-06-07 04:44:49 +00:00
Dan Liew 0d09f14554 [LibFuzzer] Disable building and running LSan tests on Apple platforms because LSan is not currently supported.
Differential Revision: http://reviews.llvm.org/D20947

llvm-svn: 271979
2016-06-07 04:44:39 +00:00
Dan Liew fba4a67a32 [LibFuzzer] Disable compiling and running the LibFuzzer dataflow sanitizer tests on Apple platforms.
This fixes a broken part of the build on OSX as the dataflow sanitizer is not supported
on OSX yet.

Differential Revision: http://reviews.llvm.org/D20894

llvm-svn: 271492
2016-06-02 05:48:09 +00:00
Dan Liew 8c11fce707 [LibFuzzer] Refactor declaration of tests in CMake.
Add a new CMake function (``add_libfuzzer_test()``) to simplify
declaration of executables for testing LibFuzzer and use it to
reorganise how tests are declared.

Note that configuration of the lit configuration files has been moved
as late as possible because we are going to need to disable some tests
for some platforms and we will need to propagate this information into
the lit configuration.

Note the code for custom mains was removed because no tests are
currently written for this and Kostya seems happy to remove this.

Differential Revision: http://reviews.llvm.org/D20706

llvm-svn: 270958
2016-05-27 03:14:40 +00:00
Kostya Serebryany d8384122a3 [libFuzzer] more refactoring around CurrentUnit. Also add a threading test on which we currently have a race (when reporting bugs from multiple threads)
llvm-svn: 270929
2016-05-26 22:17:32 +00:00
Dan Liew 676892a5d5 [LibFuzzer] Allow LibFuzzer to be built in modes other than RELEASE.
Previously the flags were only being set correctly when the
build type was "Release". Now the build should work properly
for all the supported build types. When building libFuzzer
the optimization level respects whatever is used for the
rest of LLVM but for the LibFuzzer tests we force -O0.

Differential Revision: http://reviews.llvm.org/D20558

llvm-svn: 270912
2016-05-26 20:55:05 +00:00
Mike Aizatsky e66846ab32 [libfuzzer] replacing unittest for truncate_units with functional test.
Differential Revision: http://reviews.llvm.org/D20641

llvm-svn: 270755
2016-05-25 21:00:17 +00:00
Kostya Serebryany ff2e6badbd [libFuzzer] print stats if we crash on empty input
llvm-svn: 270639
2016-05-25 00:15:36 +00:00
Kostya Serebryany ca9694ba2c [libFuzzer] add a test for libFuzzer+ubsan, extend the docs on using libFuzzer+ubsan
llvm-svn: 268968
2016-05-09 21:02:36 +00:00
Kostya Serebryany 8b8f7a3cda [libFuzzer] enhance -rss_limit_mb and enable by default. Now it will print the OOM reproducer.
llvm-svn: 268821
2016-05-06 23:38:07 +00:00
Kostya Serebryany 7018a1aaa4 [libFuzzer] disable leak detection if we have tried it for 1000 times w/o finding a leak
llvm-svn: 267770
2016-04-27 19:52:34 +00:00
Kostya Serebryany 315167339e [libFuzzer] don't report memory leaks if we are dying due to a timeout (just use _Exit instead of exit in the timeout callback)
llvm-svn: 264237
2016-03-24 01:32:08 +00:00
Kostya Serebryany 49e409068a [libFuzzer] add a flag close_fd_mask so that we can silence spammy targets by closing stderr/stdout
llvm-svn: 263831
2016-03-18 20:58:29 +00:00
Mike Aizatsky b8627a89a6 [libfuzzer] arbitrary function adapter.
The adapter automates converting sequence of bytes into arbitrary
arguments.

Differential Revision: http://reviews.llvm.org/D17829

llvm-svn: 262673
2016-03-03 23:45:29 +00:00
Kostya Serebryany da63c1d09a [libFuzzer] initial implementation of path coverage based on -fsanitize-coverage=trace-pc. This does not scale well yet, but already cracks FullCoverageSetTest in seconds
llvm-svn: 262073
2016-02-26 21:33:56 +00:00
Kostya Serebryany ecab57b3ce [libFuzzer] remove UserSuppliedFuzzer from the interface (it was a bad idea).
llvm-svn: 260796
2016-02-13 02:39:30 +00:00
Kostya Serebryany 22cc5e2375 [libFuzzer] provide a plain C interface for custom mutators (experimental)
llvm-svn: 260794
2016-02-13 02:29:38 +00:00
Kostya Serebryany 9d14e4bb15 [libFuzzer] make -runs=N flag also affect the simple runner (will execute every input N times)
llvm-svn: 260649
2016-02-12 02:32:03 +00:00
Kostya Serebryany b92602ada0 [libFuzzer] don't write the test unit when a leak is detected (since we don't know which unit causes the leak)
llvm-svn: 259731
2016-02-04 00:02:17 +00:00
Kostya Serebryany aca7696f4d [libFuzzer] introduce LLVMFuzzerInitialize
llvm-svn: 257980
2016-01-16 01:23:12 +00:00
Kostya Serebryany 4b35874b2a [libFuzzer] suggest a dictionary to the user of some of the trace-based dictionary entries were successful
llvm-svn: 257736
2016-01-14 02:36:44 +00:00
Kostya Serebryany d50a3eedb4 [libFuzzer] make sure we find buffer overflow in the input buffer. Previously, re-using the same vector object was hiding buffer overflows (unless we used annotated vector)
llvm-svn: 257701
2016-01-13 23:02:30 +00:00
Kostya Serebryany 226b734d73 [libFuzzer] make trace-based fuzzing not crash in presence of threads
llvm-svn: 256876
2016-01-06 00:03:35 +00:00
Kostya Serebryany bf65644c97 [libFuzzer] split the tests to run them in parallel, remove one redundant test
llvm-svn: 256085
2015-12-19 03:35:30 +00:00
Kostya Serebryany fba04273b7 [libFuzzer] add a test that is built with -fsanitize-coverage=trace-bb
llvm-svn: 254484
2015-12-02 02:49:37 +00:00
Kostya Serebryany 5eab74e9bc [libFuzzer] make libFuzzer link if there is no sanitizer coverage instrumentation (it will fail at start-up time)
llvm-svn: 252533
2015-11-09 23:17:45 +00:00
Kostya Serebryany 2e9fca9f88 [libFuzzer] use the indirect caller-callee counter as an independent search heuristic
llvm-svn: 251078
2015-10-22 23:55:39 +00:00
Kostya Serebryany b36025619c [libFuzzer] remove the deprecated 'tokens' feature
llvm-svn: 251069
2015-10-22 21:48:09 +00:00
Ivan Krasin a610cb5ba0 [libFuzzer]Add a test for defeating a hash sum.
Summary:
Add a test for a data followed by 4-byte hash value.
I use a slightly modified Jenkins hash function,
as described in https://en.wikipedia.org/wiki/Jenkins_hash_function

The modification is to ensure that hash(zeros) != 0.

Reviewers: kcc

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D12648

llvm-svn: 247076
2015-09-08 21:22:52 +00:00
Kostya Serebryany 7d21166218 [libFuzzer] actually make the dictionaries work (+docs)
llvm-svn: 246825
2015-09-04 00:12:11 +00:00
Kostya Serebryany 7f4227d59a [libFuzzer] use data-flow feedback from strcmp
llvm-svn: 244084
2015-08-05 18:23:01 +00:00
Kostya Serebryany cd6a4665e0 [libFuzzer] support switch interception in dfsan mode
llvm-svn: 243760
2015-07-31 17:05:05 +00:00
Kostya Serebryany fb7d8d9d06 [libFuzzer] trace switch statements and apply mutations based on the expected case values
llvm-svn: 243726
2015-07-31 01:33:06 +00:00
Kostya Serebryany b74ba421fc [libFuzzer] implement strncmp hook for data-flow-guided fuzzing (w/ and w/o dfsan), add a test
llvm-svn: 243611
2015-07-30 02:33:45 +00:00
Kostya Serebryany 0e776a2250 [libFuzzer] implement memcmp hook for data-flow-guided fuzzing (w/o dfsan), extend the memcmp fuzzer test
llvm-svn: 243603
2015-07-30 01:34:58 +00:00
Alexey Samsonov dc324e1644 [Fuzzer] Clearly separate regular and DFSan tests. NFC.
llvm-svn: 242850
2015-07-21 22:51:49 +00:00
Kostya Serebryany f342459aa4 [lib/Fuzzer] extend the fuzzer interface to allow user-supplied mutators
llvm-svn: 238059
2015-05-22 22:35:31 +00:00
Kostya Serebryany f3f3ed323a [lib/Fuzzer] build tests that work well with dfsan also w/o dfsan
llvm-svn: 236909
2015-05-08 21:45:19 +00:00
Alexey Samsonov 21a3381a38 Update CMake flags, LibFuzzer comments and docs for new -fsanitize-coverage= flags.
llvm-svn: 236797
2015-05-07 23:33:24 +00:00
Kostya Serebryany 754f55d6f5 [lib/Fuzzer] add a fuzzer test for memcmp (does not work yet)
llvm-svn: 236656
2015-05-06 22:36:00 +00:00
Kostya Serebryany 52a788e503 [fuzzer] Add support for token-based fuzzing (e.g. for C++). Allow string flags.
llvm-svn: 233745
2015-03-31 20:13:20 +00:00
Kostya Serebryany 16d03bd051 DFSan-based fuzzer (proof of concept).
Summary:
This adds a simple DFSan-based (i.e. taint-guided) fuzzer mutator,
see the comments for details.

Test Plan: a test added

Reviewers: samsonov, pcc

Reviewed By: samsonov, pcc

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D8669

llvm-svn: 233613
2015-03-30 22:09:51 +00:00
Kostya Serebryany be5e0ed919 [sanitizer/coverage] Add AFL-style coverage counters (search heuristic for fuzzing).
Introduce -mllvm -sanitizer-coverage-8bit-counters=1
which adds imprecise thread-unfriendly 8-bit coverage counters.

The run-time library maps these 8-bit counters to 8-bit bitsets in the same way
AFL (http://lcamtuf.coredump.cx/afl/technical_details.txt) does:
counter values are divided into 8 ranges and based on the counter
value one of the bits in the bitset is set.
The AFL ranges are used here: 1, 2, 3, 4-7, 8-15, 16-31, 32-127, 128+.

These counters provide a search heuristic for single-threaded
coverage-guided fuzzers, we do not expect them to be useful for other purposes.

Depending on the value of -fsanitize-coverage=[123] flag,
these counters will be added to the function entry blocks (=1),
every basic block (=2), or every edge (=3).

Use these counters as an optional search heuristic in the Fuzzer library.
Add a test where this heuristic is critical.

llvm-svn: 231166
2015-03-03 23:27:02 +00:00
Kostya Serebryany 2e3622bddd [fuzzer] one more experimental search mode: -use_coverage_pairs=1
llvm-svn: 229957
2015-02-20 03:02:37 +00:00
Kostya Serebryany cf9fdd5876 [fuzzer] Add proper dependensices to the fuzzer tests
Summary: Make sure that FileCheck is built when running check-fuzzer

Test Plan:
run on bot:
lab.llvm.org:8011/builders/sanitizer-x86_64-linux-fuzzer

Reviewers: samsonov

Reviewed By: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7387

llvm-svn: 228045
2015-02-03 21:57:32 +00:00
Kostya Serebryany 71672552db [fuzzer] Add a gtest-style test
Summary: Add one gtest-style test.

Test Plan: run on bot

Reviewers: samsonov

Reviewed By: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7287

llvm-svn: 227639
2015-01-30 23:26:57 +00:00
Kostya Serebryany 2c1b33b897 [fuzzer] add -use_full_coverage_set=1 which solves FullCoverageSetTest. This does not scale very well yet, but might be a good start.
llvm-svn: 227507
2015-01-29 23:01:07 +00:00
Aaron Ballman ef11698cac Reverting r227452, which adds back the fuzzer library. Now excluding the fuzzer library based on LLVM_USE_SANITIZE_COVERAGE being set or unset.
llvm-svn: 227464
2015-01-29 16:58:29 +00:00
Aaron Ballman 7b54ed221a Temporarily reverting the fuzzer library as it causes too many build issues for MSVC users. This reverts: 227445, 227395, 227389, 227357, 227254, 227252
llvm-svn: 227452
2015-01-29 15:49:22 +00:00
Kostya Serebryany a8fbcf0c1f Add lit-style tests for the Fuzzer library
Summary: Add test targets and the lit-style runner.

Test Plan: Run the tests on bot.

Reviewers: samsonov

Reviewed By: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7217

llvm-svn: 227389
2015-01-28 22:49:25 +00:00