X-Git-Url: http://plrg.eecs.uci.edu/git/?a=blobdiff_plain;f=lib%2FFuzzer%2FFuzzerInternal.h;h=0fa0b90b8034fe033181305f63e7d9688a36655a;hb=f41e3780b34ee80e2186bbd9fac2e57039c70ab2;hp=c387fe7a7c6094f91810b60ce381278bf74cffe2;hpb=4ea4cb31974720364c440bba63f255c5990c7316;p=oota-llvm.git diff --git a/lib/Fuzzer/FuzzerInternal.h b/lib/Fuzzer/FuzzerInternal.h index c387fe7a7c6..0fa0b90b803 100644 --- a/lib/Fuzzer/FuzzerInternal.h +++ b/lib/Fuzzer/FuzzerInternal.h @@ -8,6 +8,10 @@ //===----------------------------------------------------------------------===// // Define the main class fuzzer::Fuzzer and most functions. //===----------------------------------------------------------------------===// + +#ifndef LLVM_FUZZER_INTERNAL_H +#define LLVM_FUZZER_INTERNAL_H + #include #include #include @@ -33,11 +37,6 @@ void CopyFileToErr(const std::string &Path); std::string DirPlusFile(const std::string &DirPath, const std::string &FileName); -size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize); - -size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2, - size_t Size2, uint8_t *Out, size_t MaxOutSize); - void Printf(const char *Fmt, ...); void Print(const Unit &U, const char *PrintAfter = ""); void PrintASCII(const Unit &U, const char *PrintAfter = ""); @@ -51,7 +50,23 @@ static const int kSHA1NumBytes = 20; // Computes SHA1 hash of 'Len' bytes in 'Data', writes kSHA1NumBytes to 'Out'. void ComputeSHA1(const uint8_t *Data, size_t Len, uint8_t *Out); +// Changes U to contain only ASCII (isprint+isspace) characters. +// Returns true iff U has been changed. +bool ToASCII(Unit &U); +bool IsASCII(const Unit &U); + int NumberOfCpuCores(); +int GetPid(); + +// Dictionary. + +// Parses one dictionary entry. +// If successfull, write the enty to Unit and returns true, +// otherwise returns false. +bool ParseOneDictionaryEntry(const std::string &Str, Unit *U); +// Parses the dictionary file, fills Units, returns true iff all lines +// were parsed succesfully. +bool ParseDictionaryFile(const std::string &Text, std::vector *Units); class Fuzzer { public: @@ -59,27 +74,38 @@ class Fuzzer { int Verbosity = 1; int MaxLen = 0; int UnitTimeoutSec = 300; + int MaxTotalTimeSec = 0; bool DoCrossOver = true; int MutateDepth = 5; bool ExitOnFirst = false; bool UseCounters = false; + bool UseIndirCalls = true; bool UseTraces = false; bool UseFullCoverageSet = false; bool Reload = true; + bool ShuffleAtStartUp = true; int PreferSmallDuringInitialShuffle = -1; size_t MaxNumberOfRuns = ULONG_MAX; int SyncTimeout = 600; + int ReportSlowUnits = 10; + bool OnlyASCII = false; + int TBMDepth = 10; + int TBMWidth = 10; std::string OutputCorpus; std::string SyncCommand; - std::vector Tokens; + std::string ArtifactPrefix = "./"; + std::vector Dictionary; + bool SaveArtifacts = true; }; Fuzzer(UserSuppliedFuzzer &USF, FuzzingOptions Options); void AddToCorpus(const Unit &U) { Corpus.push_back(U); } - void Loop(size_t NumIterations); + size_t ChooseUnitToMutate(); + void Loop(); void ShuffleAndMinimize(); void InitializeTraceState(); size_t CorpusSize() const { return Corpus.size(); } void ReadDir(const std::string &Path, long *Epoch) { + Printf("Loading corpus: %s\n", Path.c_str()); ReadDirToVectorOfUnits(Path.c_str(), &Corpus, Epoch); } void RereadOutputCorpus(); @@ -95,25 +121,30 @@ class Fuzzer { static void StaticAlarmCallback(); - Unit SubstituteTokens(const Unit &U) const; + void ExecuteCallback(const Unit &U); + + // Merge Corpora[1:] into Corpora[0]. + void Merge(const std::vector &Corpora); private: void AlarmCallback(); - void ExecuteCallback(const Unit &U); void MutateAndTestOne(Unit *U); - void ReportNewCoverage(size_t NewCoverage, const Unit &U); - size_t RunOne(const Unit &U); - void RunOneAndUpdateCorpus(const Unit &U); - size_t RunOneMaximizeTotalCoverage(const Unit &U); - size_t RunOneMaximizeFullCoverageSet(const Unit &U); - size_t RunOneMaximizeCoveragePairs(const Unit &U); + void ReportNewCoverage(const Unit &U); + bool RunOne(const Unit &U); + void RunOneAndUpdateCorpus(Unit &U); void WriteToOutputCorpus(const Unit &U); - void WriteToCrash(const Unit &U, const char *Prefix); - void PrintStats(const char *Where, size_t Cov, const char *End = "\n"); - void PrintUnitInASCIIOrTokens(const Unit &U, const char *PrintAfter = ""); + void WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix); + void PrintStats(const char *Where, const char *End = "\n"); + void PrintUnitInASCII(const Unit &U, const char *PrintAfter = ""); void SyncCorpus(); + size_t RecordBlockCoverage(); + size_t RecordCallerCalleeCoverage(); + void PrepareCoverageBeforeRun(); + bool CheckCoverageAfterRun(); + + // Trace-based fuzzing: we run a unit with some kind of tracing // enabled and record potentially useful mutations. Then // We apply these mutations one by one to the unit and run it again. @@ -131,10 +162,10 @@ class Fuzzer { Unit CurrentUnit; size_t TotalNumberOfRuns = 0; + size_t TotalNumberOfExecutedTraceBasedMutations = 0; std::vector Corpus; std::unordered_set UnitHashesAddedToCorpus; - std::unordered_set FullCoverageSets; // For UseCounters std::vector CounterBitmap; @@ -151,17 +182,23 @@ class Fuzzer { system_clock::time_point UnitStartTime; long TimeOfLongestUnitInSeconds = 0; long EpochOfLastReadOfOutputCorpus = 0; + size_t LastRecordedBlockCoverage = 0; + size_t LastRecordedCallerCalleeCoverage = 0; }; class SimpleUserSuppliedFuzzer: public UserSuppliedFuzzer { public: - SimpleUserSuppliedFuzzer(UserCallback Callback) : Callback(Callback) {} - virtual void TargetFunction(const uint8_t *Data, size_t Size) { + SimpleUserSuppliedFuzzer(FuzzerRandomBase *Rand, UserCallback Callback) + : UserSuppliedFuzzer(Rand), Callback(Callback) {} + + virtual int TargetFunction(const uint8_t *Data, size_t Size) override { return Callback(Data, Size); } private: - UserCallback Callback; + UserCallback Callback = nullptr; }; }; // namespace fuzzer + +#endif // LLVM_FUZZER_INTERNAL_H