Commit Graph

506 Commits

Author SHA1 Message Date
Mike Aizatsky 9b415be1bf [libfuzzer] dump_coverage command line flag
Reviewers: kcc, vitalybuka

Differential Revision: https://reviews.llvm.org/D27942

llvm-svn: 290138
2016-12-19 22:18:08 +00:00
Daniel Jasper fa1030e40b Revert "[libFuzzer] add an experimental flag -experimental_len_control=1 that sets max_len to 1M and tries to increases the actual max sizes of mutations very gradually. Also remove a bit of dead code"
This reverts commit r289998.

See comment:
https://reviews.llvm.org/rL289998

llvm-svn: 290043
2016-12-17 12:27:49 +00:00
Kostya Serebryany 1e438a1dba [libFuzzer] use less memory for merge
llvm-svn: 290039
2016-12-17 08:20:24 +00:00
Kostya Serebryany 01c82f50f7 [libFuzzer] speed up __sanitizer_cov_trace_switch a bit more (remove DIV)
llvm-svn: 290034
2016-12-17 02:23:35 +00:00
Kostya Serebryany 2c36a30770 [libFuzzer] remove stale test
llvm-svn: 290033
2016-12-17 02:18:59 +00:00
Kostya Serebryany 00e638e642 [libFuzzer] when tracing switch statements, handle only one case at a time (to make things faster). Also ensure that the signals from value profile do not intersect with the regular coverage
llvm-svn: 290031
2016-12-17 02:03:34 +00:00
Mike Aizatsky a5c7efc6d4 [libfuzzer] removing experimental FuzzerFnAdapter
Summary: This is superceded by protobuf mutation work.

Reviewers: kcc

Subscribers: mgorny

Differential Revision: https://reviews.llvm.org/D27865

llvm-svn: 290018
2016-12-17 00:12:13 +00:00
Kostya Serebryany 3a4e2dd92f [libFuzzer] avoid msan false positives in more cases
llvm-svn: 289999
2016-12-16 22:45:25 +00:00
Kostya Serebryany be7003f99c [libFuzzer] add an experimental flag -experimental_len_control=1 that sets max_len to 1M and tries to increases the actual max sizes of mutations very gradually. Also remove a bit of dead code
llvm-svn: 289998
2016-12-16 22:42:05 +00:00
Marcos Pividori 566cf67e7c [libFuzzer] Fix index error in SearchMemory() implementation for Windows.
Differential Revision: https://reviews.llvm.org/D27731

llvm-svn: 289966
2016-12-16 17:35:25 +00:00
Marcos Pividori 3b04af2420 [libFuzzer] Remove unnecessary includes of posix headers.
Remove includes of "unistd.h" header, which is missing in non posix
systems.

Differential Revision: https://reviews.llvm.org/D277300

llvm-svn: 289965
2016-12-16 17:35:21 +00:00
Marcos Pividori 6a7e4c2e20 [libFuzzer] Update tests to use more general functions instead of posix specific.
Replace sleep() posix function by a more portable sleep_for() function
from std. Also, ignore memmem() and strcasestr() on Windows.

Differential Revision: https://reviews.llvm.org/D27729

llvm-svn: 289964
2016-12-16 17:35:13 +00:00
Kostya Serebryany 628b43aab6 [libFuzzer] enable the failure-resistant merge by default (with trace-pc-guard only)
llvm-svn: 289772
2016-12-15 06:21:21 +00:00
Kostya Serebryany d9d9a54511 [libFuzzer] disable msan for one more hook that reads target's data that might be uninitialized
llvm-svn: 289680
2016-12-14 18:13:02 +00:00
Kostya Serebryany f6f82c2cc8 [libFuzzer] fix an UB (invalid shift) spotted by ubsan. The code worked fine by luck, because the way shifts actually work on clang+x86
llvm-svn: 289607
2016-12-13 22:49:14 +00:00
Marcos Pividori c21b3c949d [libFuzzer] Add missing header needed for Windows.
llvm-svn: 289564
2016-12-13 17:46:48 +00:00
Marcos Pividori 7c1defd738 [libFuzzer] Avoid name collision with Windows API.
Windows uses some macros to replace DeleteFile() by DeleteFileA() or
DeleteFileW(). This was causing an error at link time.
DeleteFile was renamed to RemoveFile().

Differential Revision: https://reviews.llvm.org/D27577

llvm-svn: 289563
2016-12-13 17:46:40 +00:00
Marcos Pividori 67dfacdd80 [libFuzzer] Implement DirName() for Windows.
Implement DirName from scratch to avoid dependencies on external libraries.
It's based on MSDN documentation for Naming Files, Paths, and Namespaces.

The algorithm can't simply start from the end and look backwards for the
first separator, because we need to preserve the prefix that represent
the root location. We shouldn't remove anything there. In Windows we
have many different options, like:
 \\Server\Share\ , \ , C: , C:\ , \\?\C:\ , \\?\UNC\Server\Share\
We remove the last separator in the rest of the path, if it exists.

It was implemented to have a similar behaviour to dirname() in linux,
removing trailing separators, returning "." when the path doesn't
contain separators, etc.

Differential Revision: https://reviews.llvm.org/D27579

llvm-svn: 289562
2016-12-13 17:46:32 +00:00
Marcos Pividori 64d4147396 [libFuzzer] Fix bug in detecting timeouts when input string is empty.
I added a new flag RunningCB to know if the Fuzzer's main thread is
running the CB function, instead of using (!CurrentUnitSize).
(!CurrentUnitSize) doesn't work properly. For example, in FuzzerLoop.cpp,
inside ShuffleAndMinimize() function, we execute the callback with an
empty string (size=0). Previous implementation failed to detect timeouts
in that execution.
Also, I add a regression test for that case.

Differential Revision: https://reviews.llvm.org/D27433

llvm-svn: 289561
2016-12-13 17:46:25 +00:00
Marcos Pividori 178fe58745 [libFuzzer] Clean up headers and file formatting of LibFuzzer files.
Reorganize #includes to follow LLVM Coding Standards.
Include some missing headers. Required to use `Printf()`.

Aside from that, this patch contains no functional change.
It is purely a re-organization.

Differential Revision: https://reviews.llvm.org/D27363

llvm-svn: 289560
2016-12-13 17:46:11 +00:00
Marcos Pividori 6e3d885c79 [libFuzzer] Properly use unsigned for workers, jobs and NumberOfCpuCores.
std:🧵:hardware_concurrency() returns an unsigned, so I modify
NumberOfCpuCores() to return unsigned too.
The number of cpus is used to define the number of workers, so I decided
to update the worker and jobs flags to be declared as unsigned too.

Differential Revision: https://reviews.llvm.org/D27685

llvm-svn: 289559
2016-12-13 17:45:53 +00:00
Marcos Pividori 463f8bdd0b [libFuzzer] Properly use unsigned for Process ID.
Use unsigned for PID instead of signed int. GetCurrentProcessId() returns
an unsigned (DWORD) so we must be sure we can deal with all possible values.
I use a long unsigned to be sure it can hold a 32 bit unsigned (DWORD).

Differential Revision: https://reviews.llvm.org/D27281

llvm-svn: 289558
2016-12-13 17:45:44 +00:00
Marcos Pividori c59b692c85 [libFuzzer] Improve Signal Handler interface.
Add new flags to FuzzingOptions to represent the different conditions
on the signal handling. These options are passed when calling
SetSignalHandler().
This changes simplify the implementation of Windows's exception
handling. Now we can define a unique handler for all the exceptions.

Differential Revision: https://reviews.llvm.org/D27238

llvm-svn: 289557
2016-12-13 17:45:20 +00:00
Kostya Serebryany a31300e789 [libFuzzer] don't require extra flags with -minimize_crash=1 (default to -max_total_time=600). Also respect exact_artifact_path when outputting the end result
llvm-svn: 289506
2016-12-13 00:40:47 +00:00
Marcos Pividori 681e904419 [libFuzzer] Implement Timers for Windows.
Implemented timeouts for Windows using TimerQueueTimers.
Timers are used to supervise the time of execution of the
callback function that is being fuzzed.

Differential Revision: https://reviews.llvm.org/D27237

llvm-svn: 289495
2016-12-12 23:25:11 +00:00
Kostya Serebryany 092d5764a1 [libFuzzer] split one slow test into several, for more parallel testing
llvm-svn: 289481
2016-12-12 22:55:25 +00:00
Kostya Serebryany a4b43bf8e8 [libFuzzer] make SimpleCmpTest a bit simpler to crack and more verbose
llvm-svn: 289477
2016-12-12 22:39:33 +00:00
Kostya Serebryany 035af9b346 [libFuzzer] build libFuzzer itself with asan
llvm-svn: 289469
2016-12-12 20:58:10 +00:00
Kostya Serebryany d4be88913e [libFuzzer] respect -max_len during merge
llvm-svn: 289467
2016-12-12 20:39:35 +00:00
Kostya Serebryany 441e6310ae [libFuzzer] don't depend on time in a test
llvm-svn: 289368
2016-12-11 06:28:09 +00:00
Kostya Serebryany c05cb60369 [libFuzzer] test cleanup (3)
llvm-svn: 289314
2016-12-10 02:48:42 +00:00
Kostya Serebryany 832d39e9cc [libFuzzer] test cleanup (2)
llvm-svn: 289313
2016-12-10 02:47:00 +00:00
Kostya Serebryany 2f962fe5f7 [libFuzzer] test cleanup
llvm-svn: 289312
2016-12-10 02:45:56 +00:00
Kostya Serebryany 61be0f947d [libFuzzer] switch all libFuzzer tests to use -fsanitize-coverage=trace-pc-guard. Support for the previosly used instrumentation will be removed in the following changes
llvm-svn: 289311
2016-12-10 02:26:23 +00:00
Kostya Serebryany 1394ce2aa2 [libFuzzer] use __sanitizer_get_module_and_offset_for_pc to get the module name while printing the coverage
llvm-svn: 289310
2016-12-10 01:19:35 +00:00
Kostya Serebryany 111e1d69e3 [libFuzzer] implement crash-resistant merge (https://github.com/google/sanitizers/issues/722). This is a first experimental variant that needs some more testing, thus not yet adding a lit test (but there are unit tests).
llvm-svn: 289166
2016-12-09 01:17:24 +00:00
Kostya Serebryany 64a055549a [libFuzzer] include FuzzerIO.h and hopefully fix the Mac build. reported by Dejan Mircevski
llvm-svn: 288979
2016-12-07 21:02:48 +00:00
Kostya Serebryany fe1094b811 [libFuzzer] refactor the code to allow collecting features in different ways. Also initialize a couple of Fuzzer:: members that might have been used uninitialized :(
llvm-svn: 288731
2016-12-05 23:35:22 +00:00
Zachary Turner 6fa57ad9bd Resubmit "[LibFuzzer] Split FuzzerUtil for Posix and Windows."
This resubmits r288529, which was resubmitted because it broke a
fuzzer bot.  According to kcc@ the test that broke was flakey
and it is unlikely to be a result of this patch.

llvm-svn: 288549
2016-12-02 23:02:01 +00:00
Zachary Turner 3cfeab7059 Revert "[LibFuzzer] Split FuzzerUtil for Posix and Windows."
This reverts commit r288529, as it seems to introduce some
problems on the Linux bots.

llvm-svn: 288533
2016-12-02 20:54:56 +00:00
Zachary Turner d755e4f587 [LibFuzzer] Introduce a portable WeakAlias implementation.
Windows doesn't really support weak aliases, but with some
linker magic we can get something that's pretty close on
Windows.  This introduces an interface to accessing weakly
aliased symbols that will work on any platform.  Linker
magic changes to come in a separate patch.

Patch by Marcos Pividori
Differential Revision: https://reviews.llvm.org/D27235

llvm-svn: 288530
2016-12-02 19:41:17 +00:00
Zachary Turner 34dcfb9294 [LibFuzzer] Split FuzzerUtil for Posix and Windows.
Pave the way for separating out platform specific
utility functions into separate files.

Patch by Marcos Pividori
Differential Revision: https://reviews.llvm.org/D27234

llvm-svn: 288529
2016-12-02 19:38:19 +00:00
Kostya Serebryany 09f4fa5200 [libFuzzer] add a test for r288389 (-rss_limit_mb=0 means no limit).
llvm-svn: 288392
2016-12-01 18:02:07 +00:00
Kostya Serebryany dc6b8ca879 [libFuzzer] treat -rss_limit_mb=0 as no limit
llvm-svn: 288389
2016-12-01 17:56:15 +00:00
Kostya Serebryany b66cb88c2e revert r288283 as it causes debug info (line numbers) to be lost in instrumented code. also revert r288299 which was a workaround for the problem.
llvm-svn: 288300
2016-12-01 02:06:56 +00:00
Kostya Serebryany 73f438ef9a [libFuzzer] temporary disable a part of the test broken by r288283
llvm-svn: 288299
2016-12-01 01:33:44 +00:00
Kostya Serebryany 05f7791fbf [libFuzzer] extend -rss_limit_mb to crash instantly on a single malloc that exceeds the limit
llvm-svn: 288281
2016-11-30 22:39:35 +00:00
Kostya Serebryany 1cba0a96e7 [libFuzzer] extend -print_coverage to print the comma-separated list of covered dirs. Note: the Windows stub for DirName is left unimplemented
llvm-svn: 288276
2016-11-30 21:53:32 +00:00
Zachary Turner 5abac1769f [LibFuzzer] Add Windows implementations of some IO functions.
This patch moves some posix specific file i/o code into a new
file, FuzzerIOPosix.cpp, and provides implementations for these
functions on Windows in FuzzerIOWindows.cpp.  This is another
incremental step towards getting libfuzzer working on Windows,
although it still should not be expected to be fully working.

Patch by Marcos Pividori
Differential Revision: https://reviews.llvm.org/D27233

llvm-svn: 288275
2016-11-30 21:44:26 +00:00
Zachary Turner 24a148b1d4 [LibFuzzer] Split up some functions among different headers.
In an effort to get libfuzzer working on Windows, we need to make
a distinction between what functions require platform specific
code (e.g. different code on Windows vs Linux) and what code
doesn't.  IO functions, for example, tend to be platform
specific.

This patch separates out some of the functions which will need
to have platform specific implementations into different headers,
so that we can then provide different implementations for each
platform.

Aside from that, this patch contains no functional change.  It
is purely a re-organization.

Patch by Marcos Pividori
Differential Revision: https://reviews.llvm.org/D27230

llvm-svn: 288264
2016-11-30 19:06:14 +00:00