1 //===- FuzzerLoop.cpp - Fuzzer's main loop --------------------------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 //===----------------------------------------------------------------------===//
12 #include "FuzzerInternal.h"
13 #include <sanitizer/asan_interface.h>
19 // This function should be defined by the user.
20 extern "C" void TestOneInput(const uint8_t *Data, size_t Size);
25 Unit Fuzzer::CurrentUnit;
26 system_clock::time_point Fuzzer::UnitStartTime;
28 void Fuzzer::SetDeathCallback() {
29 __sanitizer_set_death_callback(DeathCallback);
32 void Fuzzer::DeathCallback() {
33 std::cerr << "DEATH: " << std::endl;
34 Print(CurrentUnit, "\n");
35 PrintASCII(CurrentUnit, "\n");
36 WriteToCrash(CurrentUnit, "crash-");
39 void Fuzzer::AlarmCallback() {
41 duration_cast<seconds>(system_clock::now() - UnitStartTime).count();
42 std::cerr << "ALARM: working on the last Unit for " << Seconds << " seconds"
45 Print(CurrentUnit, "\n");
46 PrintASCII(CurrentUnit, "\n");
47 WriteToCrash(CurrentUnit, "timeout-");
52 void Fuzzer::ShuffleAndMinimize() {
53 if (Options.Verbosity)
54 std::cerr << "Shuffle: " << Corpus.size() << "\n";
55 std::vector<Unit> NewCorpus;
56 random_shuffle(Corpus.begin(), Corpus.end());
58 Unit &U = CurrentUnit;
59 for (const auto &C : Corpus) {
60 for (size_t First = 0; First < 1; First++) {
62 size_t Last = std::min(First + Options.MaxLen, C.size());
63 U.insert(U.begin(), C.begin() + First, C.begin() + Last);
64 size_t NewCoverage = RunOne(U);
67 NewCorpus.push_back(U);
68 if (Options.Verbosity >= 2)
69 std::cerr << "NEW0: " << NewCoverage << "\n";
74 if (Options.Verbosity)
75 std::cerr << "Shuffle done: " << Corpus.size() << " IC: " << MaxCov << "\n";
78 size_t Fuzzer::RunOne(const Unit &U) {
79 UnitStartTime = system_clock::now();
81 size_t OldCoverage = __sanitizer_get_total_unique_coverage();
82 TestOneInput(U.data(), U.size());
83 size_t NewCoverage = __sanitizer_get_total_unique_coverage();
84 if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) && Options.Verbosity) {
86 duration_cast<seconds>(system_clock::now() - ProcessStartTime).count();
88 << "#" << TotalNumberOfRuns
89 << "\tcov: " << NewCoverage
90 << "\texec/s: " << (Seconds ? TotalNumberOfRuns / Seconds : 0) << "\n";
92 if (NewCoverage > OldCoverage)
97 void Fuzzer::WriteToOutputCorpus(const Unit &U) {
98 if (Options.OutputCorpus.empty()) return;
99 std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U));
100 WriteToFile(U, Path);
101 if (Options.Verbosity >= 2)
102 std::cerr << "Written to " << Path << std::endl;
105 void Fuzzer::WriteToCrash(const Unit &U, const char *Prefix) {
106 std::string Path = Prefix + Hash(U);
107 WriteToFile(U, Path);
108 std::cerr << "CRASHED; file written to " << Path << std::endl;
111 void Fuzzer::SaveCorpus() {
112 if (Options.OutputCorpus.empty()) return;
113 for (const auto &U : Corpus)
114 WriteToFile(U, DirPlusFile(Options.OutputCorpus, Hash(U)));
115 if (Options.Verbosity)
116 std::cerr << "Written corpus of " << Corpus.size() << " files to "
117 << Options.OutputCorpus << "\n";
120 size_t Fuzzer::MutateAndTestOne(Unit *U) {
122 for (size_t i = 0; i < Options.MutateDepth; i++) {
123 Mutate(U, Options.MaxLen);
124 if (U->empty()) continue;
125 size_t NewCoverage = RunOne(*U);
127 Corpus.push_back(*U);
129 if (Options.Verbosity) {
130 std::cerr << "#" << TotalNumberOfRuns
131 << "\tNEW: " << NewCoverage
132 << " L: " << U->size()
134 if (U->size() < 30) {
141 WriteToOutputCorpus(*U);
142 if (Options.ExitOnFirst)
149 size_t Fuzzer::Loop(size_t NumIterations) {
151 for (size_t i = 1; i <= NumIterations; i++) {
152 if (Options.DoCrossOver) {
153 for (size_t J1 = 0; J1 < Corpus.size(); J1++) {
154 for (size_t J2 = 0; J2 < Corpus.size(); J2++) {
156 CrossOver(Corpus[J1], Corpus[J2], &CurrentUnit, Options.MaxLen);
157 NewUnits += MutateAndTestOne(&CurrentUnit);
160 } else { // No CrossOver
161 for (size_t J = 0; J < Corpus.size(); J++) {
162 CurrentUnit = Corpus[J];
163 NewUnits += MutateAndTestOne(&CurrentUnit);
170 } // namespace fuzzer