maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity
221,157 Commits 23 Branches 0 Tags 2.2 GiB
Commit Graph

190 Commits

Author SHA1 Message Date
Kostya Serebryany b8d0da1386 [libFuzzer] print a bit fewer lines 
llvm-svn: 252123
 2015-11-05 01:19:42 +00:00
Kostya Serebryany e692621a9d [libFuzzer] when choosing the next unit to mutate, give some preference to the most recent units (they are more likely to be interesting) 
llvm-svn: 252097
 2015-11-04 23:22:25 +00:00
Kostya Serebryany 856b7afe60 [libFuzzer] make -test_single_input more reliable: make sure the input's size is equal to it's capacity 
llvm-svn: 251961
 2015-11-03 18:57:25 +00:00
Kostya Serebryany 9cc3b0ddb6 [libFuzzer] add -merge flag to merge corpora 
llvm-svn: 251168
 2015-10-24 01:16:40 +00:00
Kostya Serebryany 94660b3c36 [libFuzzer] remove some old code; also make __sanitizer_get_total_unique_caller_callee_pairs weak so that newer libFuzzer works with older asan 
llvm-svn: 251133
 2015-10-23 18:37:58 +00:00
Kostya Serebryany 2e9fca9f88 [libFuzzer] use the indirect caller-callee counter as an independent search heuristic 
llvm-svn: 251078
 2015-10-22 23:55:39 +00:00
Kostya Serebryany 09d2a5f6e1 [libFuzzer] more refactoring the code that checks the coverage. NFC 
llvm-svn: 251075
 2015-10-22 22:56:45 +00:00
Kostya Serebryany 007c9b25f4 [libFuzzer] refactoring the code that checks the coverage. NFC 
llvm-svn: 251074
 2015-10-22 22:50:47 +00:00
Kostya Serebryany b36025619c [libFuzzer] remove the deprecated 'tokens' feature 
llvm-svn: 251069
 2015-10-22 21:48:09 +00:00
Craig Topper 2626094fa1 Make a bunch of static arrays const. 
llvm-svn: 250642
 2015-10-18 05:15:34 +00:00
Kostya Serebryany fed509e73d [libFuzzer] add -shuffle flag 
llvm-svn: 250603
 2015-10-17 04:38:26 +00:00
Kostya Serebryany d6edce97fb [libFuzzer] print a stack trace on timeout 
llvm-svn: 250571
 2015-10-16 23:04:31 +00:00
Kostya Serebryany a9da9b48ef [libFuzzer] reduce the size of artifacts printed on the screen 
llvm-svn: 250565
 2015-10-16 22:47:20 +00:00
Kostya Serebryany b91c62b1f3 [libFuzzer] When -test_single_input crashes the test it is not necessary to write crash-file because input is already known to the user. Patch by Mike Aizatsky 
llvm-svn: 250564
 2015-10-16 22:41:47 +00:00
Kostya Serebryany e95022ac14 [libFuzzer] don't print large artifacts to stderr 
llvm-svn: 249808
 2015-10-09 04:03:14 +00:00
Kostya Serebryany bd5d1cdbb9 [libFuzzer] add -artifact_prefix flag 
llvm-svn: 249807
 2015-10-09 03:57:59 +00:00
Kostya Serebryany 3b804877fd [libFuzzer] fix 32-bit build 
llvm-svn: 249646
 2015-10-08 00:59:25 +00:00
Kostya Serebryany c8cd29fb7e [libFuzzer] trying to fix at-exit hang 
llvm-svn: 249231
 2015-10-03 07:02:05 +00:00
Kostya Serebryany 20bb5e71b2 [libFuzzer] make LLVMFuzzerTestOneInput (the fuzzer target function) return int instead of void. The actual return value is not *yet* used (and expected to be 0). This change is API breaking, so the fuzzers will need to be updated. 
llvm-svn: 249214
 2015-10-02 23:34:06 +00:00
Kostya Serebryany 65d0a1458f [libFuzzer] remove experimental flag and functionality 
llvm-svn: 249194
 2015-10-02 22:00:32 +00:00
Kostya Serebryany b85db178a0 [libFuzzer] add a flag -max_total_time 
llvm-svn: 249181
 2015-10-02 20:47:55 +00:00
Ivan Krasin 95e82d5b48 [LibFuzzer] test_single_input option to run a single test case. 
-test_single_input flag specifies a file name with test data.

Review URL: http://reviews.llvm.org/D13359

Patch by Mike Aizatsky!

llvm-svn: 249096
 2015-10-01 23:23:06 +00:00
Kostya Serebryany 3287d7a6ed [libFuzzer] Marking exported symbols as visible. Patch by Mike Aizatsky 
llvm-svn: 248954
 2015-09-30 22:22:37 +00:00
Kostya Serebryany dd02f1f8ab [libFuzzer] perform fewer crossover operations compared to plain mutations 
llvm-svn: 247364
 2015-09-11 00:20:58 +00:00
Kostya Serebryany 65f50868e5 [libFuzzer] refactor the code to allow building libFuzzer on platforms that don't have dfsan and don't support weak functions 
llvm-svn: 247321
 2015-09-10 18:48:38 +00:00
Kostya Serebryany a938bcb89a [libFuzzer] add two more variants of FuzzerDriver for convenience 
llvm-svn: 247300
 2015-09-10 16:57:57 +00:00
Ivan Krasin a610cb5ba0 [libFuzzer]Add a test for defeating a hash sum. 
Summary:
Add a test for a data followed by 4-byte hash value.
I use a slightly modified Jenkins hash function,
as described in https://en.wikipedia.org/wiki/Jenkins_hash_function

The modification is to ensure that hash(zeros) != 0.

Reviewers: kcc

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D12648

llvm-svn: 247076
 2015-09-08 21:22:52 +00:00
Kostya Serebryany 4b82de2e47 [libFuzzer] remove a piece of stale code 
llvm-svn: 247067
 2015-09-08 20:40:10 +00:00
Kostya Serebryany 9cdea94f66 [libFuzzer] be more robust when dealing with files on disk (e.g. don't crash if a file was there but disappeared) 
llvm-svn: 247066
 2015-09-08 20:36:33 +00:00
Kostya Serebryany b06fae5ede [libFuzzer] better documentatio for -save_minimized_corpus=1 
llvm-svn: 247033
 2015-09-08 17:43:51 +00:00
Kostya Serebryany 468ed78434 [libFuzzer] remove -iterations as redundant (there is also -num_runs) 
llvm-svn: 247030
 2015-09-08 17:30:35 +00:00
Kostya Serebryany 25425ad920 [libFuzzer] add one more mutator: Mutate_ChangeASCIIInteger 
llvm-svn: 247027
 2015-09-08 17:19:31 +00:00
Kostya Serebryany e641dd6479 [libFuzzer] more accurate logic for traces, 80-char fix 
llvm-svn: 246888
 2015-09-04 22:32:25 +00:00
Kostya Serebryany b2e9897644 [libFuzzer] when a single mutation fails try a few more times with other mutations before returning un-mutated data 
llvm-svn: 246828
 2015-09-04 00:40:29 +00:00
Kostya Serebryany 7d21166218 [libFuzzer] actually make the dictionaries work (+docs) 
llvm-svn: 246825
 2015-09-04 00:12:11 +00:00
Kostya Serebryany ec2dcb1d91 [libFuzzer] refactor the mutation functions so that they are now methods of a class. NFC 
llvm-svn: 246808
 2015-09-03 21:24:19 +00:00
Kostya Serebryany 9838b2be87 [libFuzzer] adding a parser for AFL-style dictionaries + tests. 
llvm-svn: 246800
 2015-09-03 20:23:46 +00:00
Kostya Serebryany 6ea1b69fcf [libFuzzer] deprecate the -tokens flag. This was a bad idea because the corpus with this flag contains encrypted inputs, not the real inputs, which complicates interoperation with other fuzzers. Instead we'll need to implement AFL dictionary support 
llvm-svn: 246734
 2015-09-02 23:27:39 +00:00
Kostya Serebryany a9346c2e65 [libFuzzer] honour -only_ascii=1 when reading the initial corpus. Also, remove ugly #ifdef 
llvm-svn: 246689
 2015-09-02 19:08:08 +00:00
Kostya Serebryany 06c199ac9d [libFuzzer] fix minor inefficiency, PR24584 
llvm-svn: 246087
 2015-08-26 21:55:19 +00:00
Lenny Maiorani 1230a54970 Fix missing space in libfuzzer's help text. 
llvm-svn: 244800
 2015-08-12 20:00:10 +00:00
Kostya Serebryany 12c7837381 [libFuzzer] add two flags, -tbm_depth and -tbm_width to control how the trace-based-mutations are applied 
llvm-svn: 244712
 2015-08-12 01:55:37 +00:00
Kostya Serebryany 1688098cb5 [libFuzzer] add colons to the stats output to avoid confusion 
llvm-svn: 244708
 2015-08-12 01:04:27 +00:00
Kostya Serebryany ac25eeba76 [libFuzzer] use raw C IO to reduce the risk of a deadlock in a signal handler. 
llvm-svn: 244707
 2015-08-12 00:55:09 +00:00
Nick Lewycky 69ab31a3fa Fix unused variable 'X' in release builds. 
llvm-svn: 244571
 2015-08-11 05:57:10 +00:00
Kostya Serebryany bc7c0ad24d [libFuzzer] add -only_ascii flag 
llvm-svn: 244559
 2015-08-11 01:44:42 +00:00
Yaron Keren 347663b214 Add missing include guard to FuzzerInternal.h, NFC. 
llvm-svn: 244457
 2015-08-10 16:37:40 +00:00
Kostya Serebryany 242ca930e8 [libFuzzer] move the mutators to public interface so that custom mutators may reuse these functions directly 
llvm-svn: 244250
 2015-08-06 19:19:55 +00:00
Kostya Serebryany bf29ff2fa5 [libFuzzer] add one more mutation strategy: byte shuffling 
llvm-svn: 244188
 2015-08-06 01:29:13 +00:00
Kostya Serebryany d46369d8b3 [libFuzzer] avoid build warnings in non-assert build (useful warning in this case) 
llvm-svn: 244177
 2015-08-05 23:44:42 +00:00
Kostya Serebryany 4cc10d432a [libFuzzer] in dfsan mode, set labels every time we start recording traces as opposed to doing it at process startup. This ensures that the labels are fresh. 
llvm-svn: 244165
 2015-08-05 23:02:57 +00:00
Kostya Serebryany 70926aed6b [libFuzzer] add option -report_slow_units=Nsec to control when slow units are printed 
llvm-svn: 244152
 2015-08-05 21:43:48 +00:00
Kostya Serebryany 1ce0035bf0 [libFuzzer] add a missing test file 
llvm-svn: 244151
 2015-08-05 21:32:13 +00:00
Kostya Serebryany 7f4227d59a [libFuzzer] use data-flow feedback from strcmp 
llvm-svn: 244084
 2015-08-05 18:23:01 +00:00
Kostya Serebryany 86a5fba71d [libFuzzer] more refactoring of the Mutator and adding tests to it 
llvm-svn: 243818
 2015-08-01 02:23:06 +00:00
Kostya Serebryany 8ce7424e9c [libFuzzer] start refactoring the Mutator and adding tests to it 
llvm-svn: 243817
 2015-08-01 01:42:51 +00:00
Kostya Serebryany 1165efdbf9 [libFuzzer] limit the size of the inputs printed to stderr 
llvm-svn: 243795
 2015-07-31 22:07:17 +00:00
Kostya Serebryany fe7e41e8f5 [libFuzzer] make sure that 2-byte arguments of switch() are handled properly 
llvm-svn: 243781
 2015-07-31 20:58:55 +00:00
Kostya Serebryany 73932e5fe3 [libFuzzer] record traces from the switch statements only when told to do so 
llvm-svn: 243768
 2015-07-31 18:09:08 +00:00
Kostya Serebryany cd6a4665e0 [libFuzzer] support switch interception in dfsan mode 
llvm-svn: 243760
 2015-07-31 17:05:05 +00:00
Kostya Serebryany fb7d8d9d06 [libFuzzer] trace switch statements and apply mutations based on the expected case values 
llvm-svn: 243726
 2015-07-31 01:33:06 +00:00
Kostya Serebryany c9dc96bfc6 [libFuzzer] fix the strncmp interceptor -- it should respect short strings. 
llvm-svn: 243691
 2015-07-30 21:22:22 +00:00
Kostya Serebryany b74ba421fc [libFuzzer] implement strncmp hook for data-flow-guided fuzzing (w/ and w/o dfsan), add a test 
llvm-svn: 243611
 2015-07-30 02:33:45 +00:00
Kostya Serebryany 0e776a2250 [libFuzzer] implement memcmp hook for data-flow-guided fuzzing (w/o dfsan), extend the memcmp fuzzer test 
llvm-svn: 243603
 2015-07-30 01:34:58 +00:00
Kostya Serebryany ae7df1ca4d [libFuzzer] ensure that the dfsan tracing hooks actually run (using -verbosity=3 in tests) 
llvm-svn: 243365
 2015-07-28 01:25:00 +00:00
Kostya Serebryany 35959592a3 [libFuzzer] when using cmp traces, first check that the CMP is evaluated to one value much more frequently than to the other value (heuristic) 
llvm-svn: 243363
 2015-07-28 00:59:53 +00:00
Kostya Serebryany 404c69f2c8 [libFuzzer] allow users to supply their own implementation of rand 
llvm-svn: 243078
 2015-07-24 01:06:40 +00:00
Kostya Serebryany 2b7d2e91cc [libFuzzer] dump long running units to disk 
llvm-svn: 243031
 2015-07-23 18:37:22 +00:00
Alexey Samsonov 4800c2de28 [Fuzzer] Rely on $PATH expansion instead of hardcoding paths in tests. NFC. 
llvm-svn: 242851
 2015-07-21 22:51:55 +00:00
Alexey Samsonov dc324e1644 [Fuzzer] Clearly separate regular and DFSan tests. NFC. 
llvm-svn: 242850
 2015-07-21 22:51:49 +00:00
Kostya Serebryany 86e4a3e0a3 [libFuzzer] require the files and directories passed to the fuzzer to exist 
llvm-svn: 242596
 2015-07-18 00:03:37 +00:00
Kostya Serebryany 2ea204e645 [lib/Fuzzer] make assertions more informative and update comments for the user-supplied mutator 
llvm-svn: 238658
 2015-05-30 17:33:13 +00:00
Kostya Serebryany 3fe7682fb0 [lib/Fuzzer] relax an assertion 
llvm-svn: 238608
 2015-05-29 20:31:17 +00:00
Kostya Serebryany 316b571007 [lib/Fuzzer] make the fuzzing timeout 1200 seconds by default (was: infinity) 
llvm-svn: 238251
 2015-05-26 20:57:47 +00:00
Kostya Serebryany c5f905cceb [lib/Fuzzer] fix docs 
llvm-svn: 238236
 2015-05-26 19:32:52 +00:00
Kostya Serebryany c8228dd9fb [lib/Fuzzer] fix build with assertions 
llvm-svn: 238235
 2015-05-26 19:29:33 +00:00
Kostya Serebryany e0d60ba876 [lib/Fuzzer] doxygen-ify the comments for the user interface 
llvm-svn: 238086
 2015-05-23 02:12:05 +00:00
Kostya Serebryany 7c180eafc1 [lib/Fuzzer] fully get rid of std::cerr in libFuzzer 
llvm-svn: 238081
 2015-05-23 01:22:35 +00:00
Kostya Serebryany 20e9bcbfc8 [lib/Fuzzer] start getting rid of std::cerr. Sadly, these parts of C++ library used in libFuzzer badly interract with the same code used in the target function and also with dfsan. It's easier to just not use std::cerr than to defeat these issues. 
llvm-svn: 238078
 2015-05-23 01:07:46 +00:00
Kostya Serebryany f3c7cb464e [lib/Fuzzer] remove -use_coverage_pairs=1, an experimental feature that is unlikely to ever scale 
llvm-svn: 238063
 2015-05-22 22:47:03 +00:00
Kostya Serebryany f342459aa4 [lib/Fuzzer] extend the fuzzer interface to allow user-supplied mutators 
llvm-svn: 238059
 2015-05-22 22:35:31 +00:00
Kostya Serebryany 71e0feb1ac [lib/Fuzzer] ignore flags that start with --; use git pull --rebase instead of just git pull 
llvm-svn: 237950
 2015-05-21 20:39:13 +00:00
Kostya Serebryany 490bbd6fa4 [lib/Fuzzer] change the meaning of -timeout flag: now timeout is applied to every unit of work separately 
llvm-svn: 237735
 2015-05-19 22:12:57 +00:00
Kostya Serebryany cbb2334b7a [lib/Fuzzer] more efficient reload logic; also don't spam git too much 
llvm-svn: 237649
 2015-05-19 01:06:07 +00:00
Kostya Serebryany 2da7b84852 [lib/Fuzzer] when -sync_command=<CMD> is given, periodically execute 'CMD CORPUS' to synchronize with other processes 
llvm-svn: 237617
 2015-05-18 21:34:20 +00:00
Logan Chien a8f01bc8e1 Code cleanup: Reindent Fuzzer::MutateAndTestOne. 
llvm-svn: 237533
 2015-05-17 02:44:31 +00:00
Kostya Serebryany 96eab65d81 [lib/Fuzzer] Add SHA1 implementation from public domain. 
Summary:
This adds a SHA1 implementation taken from public domain code.
The change is trivial, but as it involves third-party code I'd like
a second pair of eyes before commit.

LibFuzzer can not use SHA1 from openssl because openssl may not be available
and because we may be fuzzing openssl itself.
Using sha1sum via a pipe is too slow.

Test Plan: n/a

Reviewers: chandlerc

Reviewed By: chandlerc

Subscribers: majnemer, llvm-commits

Differential Revision: http://reviews.llvm.org/D9733

llvm-svn: 237400
 2015-05-14 22:41:49 +00:00
Kostya Serebryany 1ce4ebf7d6 [lib/Fuzzer] enable -use_counters=1 by default 
llvm-svn: 237272
 2015-05-13 18:31:46 +00:00
Kostya Serebryany 80ec5a11b5 [lib/Fuzzer] A simple script to synchronise a fuzz test corpus with an external git repository. 
llvm-svn: 237208
 2015-05-12 23:19:12 +00:00
Kostya Serebryany f47198aa36 [lib/Fuzzer] use sha1sum for the file hash 
llvm-svn: 237198
 2015-05-12 22:03:34 +00:00
Kostya Serebryany 9690fcf12e [lib/Fuzzer] guess the right number of workers if -jobs=N is given but -workers=M is not. Update the docs. 
llvm-svn: 237163
 2015-05-12 18:51:57 +00:00
Kostya Serebryany d8c54724a8 [lib/Fuzzer] remove the -dfsan=1 flag, just use -use_traces=1 (w/ or w/o dfsan) 
llvm-svn: 237083
 2015-05-12 01:58:34 +00:00
Kostya Serebryany cd7629caec [lib/Fuzzer] detach the pulse thread instad of joining it 
llvm-svn: 237082
 2015-05-12 01:43:20 +00:00
Kostya Serebryany 8817e86efd [lib/Fuzzer] don't record traces when trace collection is off 
llvm-svn: 237067
 2015-05-11 23:25:28 +00:00
Kostya Serebryany 83fd486ff4 [lib/Fuzzer] when running multiple fuzzing processes, print something every 10 minutes to avoid buildbot timeouts 
llvm-svn: 237054
 2015-05-11 21:31:51 +00:00
Kostya Serebryany 225262562f [lib/Fuzzer] rename FuzzerDFSan.cpp to FuzzerTraceState.cpp; update comments. NFC expected 
llvm-svn: 237050
 2015-05-11 21:16:27 +00:00
Kostya Serebryany 5a99ecbbb3 [lib/Fuzzer] add a trace-based mutatation logic. Same idea as with DFSan-based mutator, but instead of relying on taint tracking, try to find the data directly in the input. More (logic and comments) to go. 
llvm-svn: 237043
 2015-05-11 20:51:19 +00:00
Kostya Serebryany f3f3ed323a [lib/Fuzzer] build tests that work well with dfsan also w/o dfsan 
llvm-svn: 236909
 2015-05-08 21:45:19 +00:00
Kostya Serebryany 1ac8055bc7 [lib/Fuzzer] use -fsanitize-coverage=trace-cmp when building LLVM with LLVM_USE_SANITIZE_COVERAGE; in lib/Fuzzer try to reload the corpus to pick up new units from other processes 
llvm-svn: 236906
 2015-05-08 21:30:55 +00:00
Alexey Samsonov 21a3381a38 Update CMake flags, LibFuzzer comments and docs for new -fsanitize-coverage= flags. 
llvm-svn: 236797
 2015-05-07 23:33:24 +00:00