1 //===- FuzzerInternal.h - Internal header for the Fuzzer --------*- C++ -* ===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
9 // Define the main class fuzzer::Fuzzer and most functions.
10 //===----------------------------------------------------------------------===//
18 #include <unordered_set>
21 typedef std::vector<uint8_t> Unit;
22 using namespace std::chrono;
24 Unit ReadFile(const char *Path);
25 void ReadDirToVectorOfUnits(const char *Path, std::vector<Unit> *V);
26 void WriteToFile(const Unit &U, const std::string &Path);
27 void CopyFileToErr(const std::string &Path);
28 // Returns "Dir/FileName" or equivalent for the current OS.
29 std::string DirPlusFile(const std::string &DirPath,
30 const std::string &FileName);
32 void Mutate(Unit *U, size_t MaxLen);
34 void CrossOver(const Unit &A, const Unit &B, Unit *U, size_t MaxLen);
36 void Print(const Unit &U, const char *PrintAfter = "");
37 void PrintASCII(const Unit &U, const char *PrintAfter = "");
38 std::string Hash(const Unit &U);
39 void SetTimer(int Seconds);
43 struct FuzzingOptions {
46 bool DoCrossOver = true;
48 bool ExitOnFirst = false;
49 bool UseFullCoverageSet = false;
50 size_t MaxNumberOfRuns = ULONG_MAX;
51 std::string OutputCorpus;
53 Fuzzer(FuzzingOptions Options) : Options(Options) {
56 void AddToCorpus(const Unit &U) { Corpus.push_back(U); }
57 size_t Loop(size_t NumIterations);
58 void ShuffleAndMinimize();
59 size_t CorpusSize() const { return Corpus.size(); }
60 void ReadDir(const std::string &Path) {
61 ReadDirToVectorOfUnits(Path.c_str(), &Corpus);
63 // Save the current corpus to OutputCorpus.
66 static void AlarmCallback();
69 size_t MutateAndTestOne(Unit *U);
70 size_t RunOne(const Unit &U);
71 size_t RunOneMaximizeTotalCoverage(const Unit &U);
72 size_t RunOneMaximizeFullCoverageSet(const Unit &U);
73 void WriteToOutputCorpus(const Unit &U);
74 static void WriteToCrash(const Unit &U, const char *Prefix);
76 void SetDeathCallback();
77 static void DeathCallback();
78 static Unit CurrentUnit;
80 size_t TotalNumberOfRuns = 0;
82 std::vector<Unit> Corpus;
83 std::unordered_set<uintptr_t> FullCoverageSets;
84 FuzzingOptions Options;
85 system_clock::time_point ProcessStartTime = system_clock::now();
86 static system_clock::time_point UnitStartTime;
89 }; // namespace fuzzer