X-Git-Url: http://plrg.eecs.uci.edu/git/?a=blobdiff_plain;f=lib%2FFuzzer%2FFuzzerLoop.cpp;h=6ac8997df78109f784d90261b3accced807b51ae;hb=41180c6ebaf1cadfc5085f6c5766822852c9a35a;hp=4c8b247a72ed6cde7c8d234b6ba2edfc0fc4af72;hpb=ea8a3963b4098f0f87fba384747bc32b15243f03;p=oota-llvm.git diff --git a/lib/Fuzzer/FuzzerLoop.cpp b/lib/Fuzzer/FuzzerLoop.cpp index 4c8b247a72e..6ac8997df78 100644 --- a/lib/Fuzzer/FuzzerLoop.cpp +++ b/lib/Fuzzer/FuzzerLoop.cpp @@ -13,7 +13,12 @@ #include #include +extern "C" { +__attribute__((weak)) void __sanitizer_print_stack_trace(); +} + namespace fuzzer { +static const size_t kMaxUnitSizeToPrint = 256; // Only one Fuzzer per process. static Fuzzer *F; @@ -30,14 +35,8 @@ void Fuzzer::SetDeathCallback() { __sanitizer_set_death_callback(StaticDeathCallback); } -void Fuzzer::PrintUnitInASCIIOrTokens(const Unit &U, const char *PrintAfter) { - if (Options.Tokens.empty()) { - PrintASCII(U, PrintAfter); - } else { - auto T = SubstituteTokens(U); - T.push_back(0); - Printf("%s%s", T.data(), PrintAfter); - } +void Fuzzer::PrintUnitInASCII(const Unit &U, const char *PrintAfter) { + PrintASCII(U, PrintAfter); } void Fuzzer::StaticDeathCallback() { @@ -47,9 +46,11 @@ void Fuzzer::StaticDeathCallback() { void Fuzzer::DeathCallback() { Printf("DEATH:\n"); - Print(CurrentUnit, "\n"); - PrintUnitInASCIIOrTokens(CurrentUnit, "\n"); - WriteToCrash(CurrentUnit, "crash-"); + if (CurrentUnit.size() <= kMaxUnitSizeToPrint) { + Print(CurrentUnit, "\n"); + PrintUnitInASCII(CurrentUnit, "\n"); + } + WriteUnitToFileWithPrefix(CurrentUnit, "crash-"); } void Fuzzer::StaticAlarmCallback() { @@ -68,19 +69,33 @@ void Fuzzer::AlarmCallback() { Printf("ALARM: working on the last Unit for %zd seconds\n", Seconds); Printf(" and the timeout value is %d (use -timeout=N to change)\n", Options.UnitTimeoutSec); - Print(CurrentUnit, "\n"); - PrintUnitInASCIIOrTokens(CurrentUnit, "\n"); - WriteToCrash(CurrentUnit, "timeout-"); + if (CurrentUnit.size() <= kMaxUnitSizeToPrint) { + Print(CurrentUnit, "\n"); + PrintUnitInASCII(CurrentUnit, "\n"); + } + WriteUnitToFileWithPrefix(CurrentUnit, "timeout-"); + Printf("==%d== ERROR: libFuzzer: timeout after %d seconds\n", GetPid(), + Seconds); + if (__sanitizer_print_stack_trace) + __sanitizer_print_stack_trace(); + Printf("SUMMARY: libFuzzer: timeout\n"); exit(1); } } -void Fuzzer::PrintStats(const char *Where, size_t Cov, const char *End) { +void Fuzzer::PrintStats(const char *Where, const char *End) { if (!Options.Verbosity) return; size_t Seconds = secondsSinceProcessStartUp(); size_t ExecPerSec = (Seconds ? TotalNumberOfRuns / Seconds : 0); - Printf("#%zd\t%s cov %zd bits %zd units %zd exec/s %zd %s", TotalNumberOfRuns, - Where, Cov, TotalBits(), Corpus.size(), ExecPerSec, End); + Printf("#%zd\t%s", TotalNumberOfRuns, Where); + if (LastRecordedBlockCoverage) + Printf(" cov: %zd", LastRecordedBlockCoverage); + if (auto TB = TotalBits()) + Printf(" bits: %zd", TB); + Printf(" units: %zd exec/s: %zd", Corpus.size(), ExecPerSec); + if (TotalNumberOfExecutedTraceBasedMutations) + Printf(" tbm: %zd", TotalNumberOfExecutedTraceBasedMutations); + Printf("%s", End); } void Fuzzer::RereadOutputCorpus() { @@ -101,143 +116,109 @@ void Fuzzer::RereadOutputCorpus() { if (UnitHashesAddedToCorpus.insert(Hash(X)).second) { CurrentUnit.clear(); CurrentUnit.insert(CurrentUnit.begin(), X.begin(), X.end()); - size_t NewCoverage = RunOne(CurrentUnit); - if (NewCoverage) { + if (RunOne(CurrentUnit)) { Corpus.push_back(X); if (Options.Verbosity >= 1) - PrintStats("RELOAD", NewCoverage); + PrintStats("RELOAD"); } } } } void Fuzzer::ShuffleAndMinimize() { - size_t MaxCov = 0; - bool PreferSmall = - (Options.PreferSmallDuringInitialShuffle == 1 || - (Options.PreferSmallDuringInitialShuffle == -1 && rand() % 2)); + bool PreferSmall = (Options.PreferSmallDuringInitialShuffle == 1 || + (Options.PreferSmallDuringInitialShuffle == -1 && + USF.GetRand().RandBool())); if (Options.Verbosity) Printf("PreferSmall: %d\n", PreferSmall); - PrintStats("READ ", 0); + PrintStats("READ "); std::vector NewCorpus; - std::random_shuffle(Corpus.begin(), Corpus.end()); - if (PreferSmall) - std::stable_sort( - Corpus.begin(), Corpus.end(), - [](const Unit &A, const Unit &B) { return A.size() < B.size(); }); + if (Options.ShuffleAtStartUp) { + std::random_shuffle(Corpus.begin(), Corpus.end(), USF.GetRand()); + if (PreferSmall) + std::stable_sort( + Corpus.begin(), Corpus.end(), + [](const Unit &A, const Unit &B) { return A.size() < B.size(); }); + } Unit &U = CurrentUnit; for (const auto &C : Corpus) { for (size_t First = 0; First < 1; First++) { U.clear(); size_t Last = std::min(First + Options.MaxLen, C.size()); U.insert(U.begin(), C.begin() + First, C.begin() + Last); - size_t NewCoverage = RunOne(U); - if (NewCoverage) { - MaxCov = NewCoverage; + if (Options.OnlyASCII) + ToASCII(U); + if (RunOne(U)) { NewCorpus.push_back(U); if (Options.Verbosity >= 2) - Printf("NEW0: %zd L %zd\n", NewCoverage, U.size()); + Printf("NEW0: %zd L %zd\n", LastRecordedBlockCoverage, U.size()); } } } Corpus = NewCorpus; for (auto &X : Corpus) UnitHashesAddedToCorpus.insert(Hash(X)); - PrintStats("INITED", MaxCov); + PrintStats("INITED"); } -size_t Fuzzer::RunOne(const Unit &U) { +bool Fuzzer::RunOne(const Unit &U) { UnitStartTime = system_clock::now(); TotalNumberOfRuns++; - size_t Res = 0; - if (Options.UseFullCoverageSet) - Res = RunOneMaximizeFullCoverageSet(U); - else - Res = RunOneMaximizeTotalCoverage(U); + + PrepareCoverageBeforeRun(); + ExecuteCallback(U); + bool Res = CheckCoverageAfterRun(); + auto UnitStopTime = system_clock::now(); auto TimeOfUnit = duration_cast(UnitStopTime - UnitStartTime).count(); - if (TimeOfUnit > TimeOfLongestUnitInSeconds) { + if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) && Options.Verbosity) + PrintStats("pulse "); + if (TimeOfUnit > TimeOfLongestUnitInSeconds && + TimeOfUnit >= Options.ReportSlowUnits) { TimeOfLongestUnitInSeconds = TimeOfUnit; - Printf("Longest unit: %zd s:\n", TimeOfLongestUnitInSeconds); - Print(U, "\n"); + Printf("Slowest unit: %zd s:\n", TimeOfLongestUnitInSeconds); + WriteUnitToFileWithPrefix(U, "slow-unit-"); } return Res; } -void Fuzzer::RunOneAndUpdateCorpus(const Unit &U) { +void Fuzzer::RunOneAndUpdateCorpus(Unit &U) { if (TotalNumberOfRuns >= Options.MaxNumberOfRuns) return; - ReportNewCoverage(RunOne(U), U); -} - -static uintptr_t HashOfArrayOfPCs(uintptr_t *PCs, uintptr_t NumPCs) { - uintptr_t Res = 0; - for (uintptr_t i = 0; i < NumPCs; i++) { - Res = (Res + PCs[i]) * 7; - } - return Res; -} - -Unit Fuzzer::SubstituteTokens(const Unit &U) const { - Unit Res; - for (auto Idx : U) { - if (Idx < Options.Tokens.size()) { - std::string Token = Options.Tokens[Idx]; - Res.insert(Res.end(), Token.begin(), Token.end()); - } else { - Res.push_back(' '); - } - } - // FIXME: Apply DFSan labels. - return Res; + if (Options.OnlyASCII) + ToASCII(U); + if (RunOne(U)) + ReportNewCoverage(U); } void Fuzzer::ExecuteCallback(const Unit &U) { - if (Options.Tokens.empty()) { - USF.TargetFunction(U.data(), U.size()); - } else { - auto T = SubstituteTokens(U); - USF.TargetFunction(T.data(), T.size()); - } + int Res = USF.TargetFunction(U.data(), U.size()); + (void)Res; + assert(Res == 0); } -// Experimental. -// Fuly reset the current coverage state, run a single unit, -// compute a hash function from the full coverage set, -// return non-zero if the hash value is new. -// This produces tons of new units and as is it's only suitable for small tests, -// e.g. test/FullCoverageSetTest.cpp. FIXME: make it scale. -size_t Fuzzer::RunOneMaximizeFullCoverageSet(const Unit &U) { - __sanitizer_reset_coverage(); - ExecuteCallback(U); - uintptr_t *PCs; - uintptr_t NumPCs =__sanitizer_get_coverage_guards(&PCs); - if (FullCoverageSets.insert(HashOfArrayOfPCs(PCs, NumPCs)).second) - return FullCoverageSets.size(); - return 0; +size_t Fuzzer::RecordBlockCoverage() { + return LastRecordedBlockCoverage = __sanitizer_get_total_unique_coverage(); } -size_t Fuzzer::RunOneMaximizeTotalCoverage(const Unit &U) { - size_t NumCounters = __sanitizer_get_number_of_counters(); +void Fuzzer::PrepareCoverageBeforeRun() { if (Options.UseCounters) { + size_t NumCounters = __sanitizer_get_number_of_counters(); CounterBitmap.resize(NumCounters); __sanitizer_update_counter_bitset_and_clear_counters(0); } - size_t OldCoverage = __sanitizer_get_total_unique_coverage(); - ExecuteCallback(U); - size_t NewCoverage = __sanitizer_get_total_unique_coverage(); + RecordBlockCoverage(); +} + +bool Fuzzer::CheckCoverageAfterRun() { + size_t OldCoverage = LastRecordedBlockCoverage; + size_t NewCoverage = RecordBlockCoverage(); size_t NumNewBits = 0; if (Options.UseCounters) NumNewBits = __sanitizer_update_counter_bitset_and_clear_counters( CounterBitmap.data()); - - if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) && Options.Verbosity) - PrintStats("pulse ", NewCoverage); - - if (NewCoverage > OldCoverage || NumNewBits) - return NewCoverage; - return 0; + return NewCoverage > OldCoverage || NumNewBits; } void Fuzzer::WriteToOutputCorpus(const Unit &U) { @@ -246,13 +227,20 @@ void Fuzzer::WriteToOutputCorpus(const Unit &U) { WriteToFile(U, Path); if (Options.Verbosity >= 2) Printf("Written to %s\n", Path.c_str()); + assert(!Options.OnlyASCII || IsASCII(U)); } -void Fuzzer::WriteToCrash(const Unit &U, const char *Prefix) { - std::string Path = Prefix + Hash(U); +void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) { + if (!Options.SaveArtifacts) + return; + std::string Path = Options.ArtifactPrefix + Prefix + Hash(U); WriteToFile(U, Path); - Printf("CRASHED; file written to %s\nBase64: ", Path.c_str()); - PrintFileAsBase64(Path); + Printf("artifact_prefix='%s'; Test unit written to %s\n", + Options.ArtifactPrefix.c_str(), Path.c_str()); + if (U.size() <= kMaxUnitSizeToPrint) { + Printf("Base64: "); + PrintFileAsBase64(Path); + } } void Fuzzer::SaveCorpus() { @@ -264,16 +252,15 @@ void Fuzzer::SaveCorpus() { Options.OutputCorpus.c_str()); } -void Fuzzer::ReportNewCoverage(size_t NewCoverage, const Unit &U) { - if (!NewCoverage) return; +void Fuzzer::ReportNewCoverage(const Unit &U) { Corpus.push_back(U); UnitHashesAddedToCorpus.insert(Hash(U)); - PrintStats("NEW ", NewCoverage, ""); + PrintStats("NEW ", ""); if (Options.Verbosity) { Printf(" L: %zd", U.size()); if (U.size() < 30) { Printf(" "); - PrintUnitInASCIIOrTokens(U, "\t"); + PrintUnitInASCII(U, "\t"); Print(U); } Printf("\n"); @@ -289,39 +276,60 @@ void Fuzzer::MutateAndTestOne(Unit *U) { size_t Size = U->size(); U->resize(Options.MaxLen); size_t NewSize = USF.Mutate(U->data(), Size, U->size()); - assert(NewSize > 0 && NewSize <= (size_t)Options.MaxLen); + assert(NewSize > 0 && "Mutator returned empty unit"); + assert(NewSize <= (size_t)Options.MaxLen && + "Mutator return overisized unit"); U->resize(NewSize); RunOneAndUpdateCorpus(*U); size_t NumTraceBasedMutations = StopTraceRecording(); - for (size_t j = 0; j < NumTraceBasedMutations; j++) { - ApplyTraceBasedMutation(j, U); - RunOneAndUpdateCorpus(*U); + size_t TBMWidth = + std::min((size_t)Options.TBMWidth, NumTraceBasedMutations); + size_t TBMDepth = + std::min((size_t)Options.TBMDepth, NumTraceBasedMutations); + Unit BackUp = *U; + for (size_t w = 0; w < TBMWidth; w++) { + *U = BackUp; + for (size_t d = 0; d < TBMDepth; d++) { + TotalNumberOfExecutedTraceBasedMutations++; + ApplyTraceBasedMutation(USF.GetRand()(NumTraceBasedMutations), U); + RunOneAndUpdateCorpus(*U); + } } } } -void Fuzzer::Loop(size_t NumIterations) { - for (size_t i = 1; i <= NumIterations; i++) { +void Fuzzer::Loop() { + for (auto &U: Options.Dictionary) + USF.GetMD().AddWordToDictionary(U.data(), U.size()); + + while (true) { for (size_t J1 = 0; J1 < Corpus.size(); J1++) { SyncCorpus(); RereadOutputCorpus(); if (TotalNumberOfRuns >= Options.MaxNumberOfRuns) return; - // First, simply mutate the unit w/o doing crosses. + if (Options.MaxTotalTimeSec > 0 && + secondsSinceProcessStartUp() > + static_cast(Options.MaxTotalTimeSec)) + return; CurrentUnit = Corpus[J1]; - MutateAndTestOne(&CurrentUnit); - // Now, cross with others. - if (Options.DoCrossOver && !Corpus[J1].empty()) { - for (size_t J2 = 0; J2 < Corpus.size(); J2++) { + // Optionally, cross with another unit. + if (Options.DoCrossOver && USF.GetRand().RandBool()) { + size_t J2 = USF.GetRand()(Corpus.size()); + if (!Corpus[J1].empty() && !Corpus[J2].empty()) { + assert(!Corpus[J2].empty()); CurrentUnit.resize(Options.MaxLen); size_t NewSize = USF.CrossOver( Corpus[J1].data(), Corpus[J1].size(), Corpus[J2].data(), Corpus[J2].size(), CurrentUnit.data(), CurrentUnit.size()); - assert(NewSize > 0 && NewSize <= (size_t)Options.MaxLen); + assert(NewSize > 0 && "CrossOver returned empty unit"); + assert(NewSize <= (size_t)Options.MaxLen && + "CrossOver returned overisized unit"); CurrentUnit.resize(NewSize); - MutateAndTestOne(&CurrentUnit); } } + // Perform several mutations and runs. + MutateAndTestOne(&CurrentUnit); } } }