Commit Graph

37 Commits

Author SHA1 Message Date
Kostya Serebryany 5ff481fd9e [libFuzzer] add -exit_on_src_pos to test libFuzzer itself, add a test script for RE2 that uses this flag
llvm-svn: 282458
2016-09-27 00:10:20 +00:00
Kostya Serebryany 29bb664075 [libFuzzer] add stats to the corpus; more refactoring
llvm-svn: 282121
2016-09-21 22:42:17 +00:00
Kostya Serebryany 6f5a804cdb [libFuzzer] refactoring: split the large header into many; NFC
llvm-svn: 282044
2016-09-21 01:50:50 +00:00
Kostya Serebryany 3750c04f7e [libFuzzer] use sleep() instead of std::this_thread::sleep_for to avoid coverage from instrumented libc++
llvm-svn: 281933
2016-09-19 20:32:34 +00:00
Kostya Serebryany b706b481ba [libFuzzer] add -print_coverage=1 flag to print coverage directly from libFuzzer
llvm-svn: 281866
2016-09-18 21:47:08 +00:00
Kostya Serebryany a9a548049a [libFuzzer] when printing the reproducer input, also print the base input and the mutation sequence
llvm-svn: 278975
2016-08-17 20:45:23 +00:00
Dan Liew ed3c9cae49 [LibFuzzer] Fix `-jobs=<N>` where <N> > 1 and the number of workers is > 1 on macOS.
The original `ExecuteCommand()` called `system()` from the C library.
The C library implementation of this on macOS contains a mutex which
serializes calls to `system()`. This prevented the `-jobs=` flag
from running copies of the fuzzing binary in parallel which is
the opposite of what is intended.

To fix this on macOS an alternative implementation of `ExecuteCommand()`
is provided that can be used concurrently. This is provided in
`FuzzerUtilDarwin.cpp` which is guarded to only compile code on Apple
platforms. The existing implementation has been moved to a new file
`FuzzerUtilLinux.cpp` which is guarded to only compile code on Linux.

This commit includes a simple test to check that LibFuzzer is being
executed in parallel when requested.

Differential Revision: https://reviews.llvm.org/D22742

llvm-svn: 278544
2016-08-12 18:29:36 +00:00
Kostya Serebryany 0edb563f27 [libFuzzer] make OOM-handling more portable. Instead of sending a signal to the main fuzzing thread, print the message in the getrusage thread and exit.
llvm-svn: 270945
2016-05-27 00:54:15 +00:00
Kostya Serebryany f1f3f93c9e [libFuzzer] reimplement the way we do -only_ascii to allow more 'const' in function declarations. Add a test for -only_ascii. NFC intended
llvm-svn: 270900
2016-05-26 20:03:02 +00:00
Dan Liew 11565444ca [LibFuzzer] Fix implementation of ``GetPeakRSSMb()`` on Mac OSX.
On Linux ``rusage.ru_maxrss`` is in KiB but on Mac OSX it is in bytes.

Differential Revision: http://reviews.llvm.org/D20410

llvm-svn: 270173
2016-05-20 01:37:54 +00:00
Dan Liew e6ac1fd089 [LibFuzzer] Fix ``NumberOfCpuCores()`` on Mac OSX.
The ``nprocs`` command does not exist under Mac OSX so use
``sysctl`` instead on that platform.

Whilst I'm here

* Use ``pclose()`` instead of ``fclose()`` which the ``popen()``
  documentation says should be used.
* Check for errors that were previously unhandled.

Differential Revision: http://reviews.llvm.org/D20409

llvm-svn: 270172
2016-05-20 01:30:36 +00:00
Kostya Serebryany 8b8f7a3cda [libFuzzer] enhance -rss_limit_mb and enable by default. Now it will print the OOM reproducer.
llvm-svn: 268821
2016-05-06 23:38:07 +00:00
Kostya Serebryany f389ae12c1 [libFuzzer] handle SIGTERM
llvm-svn: 264338
2016-03-24 21:03:58 +00:00
Dmitry Vyukov 2eed1218e5 libfuzzer: fix compiler warnings
- unused sigaction/setitimer result (used in assert)
- unchecked fscanf return value
- signed/unsigned comparison

llvm-svn: 262472
2016-03-02 09:54:40 +00:00
Kostya Serebryany 228d5b1ce4 [libFuzzer] add generic signal handlers so that libFuzzer can report at least something if ASan is not handlig the signals for us. Remove abort_on_timeout flag.
llvm-svn: 262415
2016-03-01 22:19:21 +00:00
Kostya Serebryany 66ff0756e4 [libFuzzer] add -print_final_stats=1 flag
llvm-svn: 262084
2016-02-26 22:42:23 +00:00
Kostya Serebryany 8a5bef0fcf [libFuzzer] remove std::vector operations from hot paths, NFC
llvm-svn: 260829
2016-02-13 17:56:51 +00:00
Kostya Serebryany 476f0ce31a [libFuzzer] replace vector with a simpler data structure in the Dictionaries to avoid memory allocations on hot path
llvm-svn: 257985
2016-01-16 03:53:32 +00:00
Kostya Serebryany 98abb2c90a [libFuzzer] make CurrentUnit a POD object instead of vector to avoid extra allocations
llvm-svn: 257713
2016-01-13 23:46:01 +00:00
Kostya Serebryany 4174005622 [libFuzzer] when a new unit is discovered using a dictionary, print all used dictionary entries
llvm-svn: 257435
2016-01-12 02:36:59 +00:00
Kostya Serebryany 9e48cda9bc [libFuzzer] compute base64 in-process instead of using an external lib. Since libFuzzer should not depend on anything, just re-implement base64 encoder. PR25746
llvm-svn: 254784
2015-12-04 22:29:39 +00:00
Kostya Serebryany dc3135db05 [libFuzzer] experimental flag -drill (another search heuristic; Mike Aizatsky's idea)
llvm-svn: 252838
2015-11-12 01:02:01 +00:00
Kostya Serebryany b8d0da1386 [libFuzzer] print a bit fewer lines
llvm-svn: 252123
2015-11-05 01:19:42 +00:00
Kostya Serebryany d6edce97fb [libFuzzer] print a stack trace on timeout
llvm-svn: 250571
2015-10-16 23:04:31 +00:00
Kostya Serebryany 9838b2be87 [libFuzzer] adding a parser for AFL-style dictionaries + tests.
llvm-svn: 246800
2015-09-03 20:23:46 +00:00
Kostya Serebryany a9346c2e65 [libFuzzer] honour -only_ascii=1 when reading the initial corpus. Also, remove ugly #ifdef
llvm-svn: 246689
2015-09-02 19:08:08 +00:00
Kostya Serebryany bc7c0ad24d [libFuzzer] add -only_ascii flag
llvm-svn: 244559
2015-08-11 01:44:42 +00:00
Kostya Serebryany 7c180eafc1 [lib/Fuzzer] fully get rid of std::cerr in libFuzzer
llvm-svn: 238081
2015-05-23 01:22:35 +00:00
Kostya Serebryany 2da7b84852 [lib/Fuzzer] when -sync_command=<CMD> is given, periodically execute 'CMD CORPUS' to synchronize with other processes
llvm-svn: 237617
2015-05-18 21:34:20 +00:00
Kostya Serebryany 96eab65d81 [lib/Fuzzer] Add SHA1 implementation from public domain.
Summary:
This adds a SHA1 implementation taken from public domain code.
The change is trivial, but as it involves third-party code I'd like
a second pair of eyes before commit.

LibFuzzer can not use SHA1 from openssl because openssl may not be available
and because we may be fuzzing openssl itself.
Using sha1sum via a pipe is too slow.

Test Plan: n/a

Reviewers: chandlerc

Reviewed By: chandlerc

Subscribers: majnemer, llvm-commits

Differential Revision: http://reviews.llvm.org/D9733

llvm-svn: 237400
2015-05-14 22:41:49 +00:00
Kostya Serebryany f47198aa36 [lib/Fuzzer] use sha1sum for the file hash
llvm-svn: 237198
2015-05-12 22:03:34 +00:00
Kostya Serebryany 9690fcf12e [lib/Fuzzer] guess the right number of workers if -jobs=N is given but -workers=M is not. Update the docs.
llvm-svn: 237163
2015-05-12 18:51:57 +00:00
Kostya Serebryany 043ab1c8a7 [fuzzer] document the -tokens flag. Also change the diagnostic output
llvm-svn: 233842
2015-04-01 21:33:20 +00:00
Kostya Serebryany 52a788e503 [fuzzer] Add support for token-based fuzzing (e.g. for C++). Allow string flags.
llvm-svn: 233745
2015-03-31 20:13:20 +00:00
Aaron Ballman ef11698cac Reverting r227452, which adds back the fuzzer library. Now excluding the fuzzer library based on LLVM_USE_SANITIZE_COVERAGE being set or unset.
llvm-svn: 227464
2015-01-29 16:58:29 +00:00
Aaron Ballman 7b54ed221a Temporarily reverting the fuzzer library as it causes too many build issues for MSVC users. This reverts: 227445, 227395, 227389, 227357, 227254, 227252
llvm-svn: 227452
2015-01-29 15:49:22 +00:00
Kostya Serebryany d53b43fe11 Add a Fuzzer library
Summary:
A simple genetic in-process coverage-guided fuzz testing library.

I've used this fuzzer to test clang-format
(it found 12+ bugs, thanks djasper@ for the fixes!)
and it may also help us test other parts of LLVM.
So why not keep it in the LLVM repository?

I plan to add the cmake build rules later (in a separate patch, if that's ok)
and also add a clang-format-fuzzer target.

See README.txt for details.

Test Plan: Tests will follow separately.

Reviewers: djasper, chandlerc, rnk

Reviewed By: rnk

Subscribers: majnemer, ygribov, dblaikie, llvm-commits

Differential Revision: http://reviews.llvm.org/D7184

llvm-svn: 227252
2015-01-27 22:08:41 +00:00