1 //===- FuzzerLoop.cpp - Fuzzer's main loop --------------------------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 //===----------------------------------------------------------------------===//
12 #include "FuzzerInternal.h"
13 #include <sanitizer/asan_interface.h>
17 // This function should be defined by the user.
18 extern "C" void TestOneInput(const uint8_t *Data, size_t Size);
23 Unit Fuzzer::CurrentUnit;
24 system_clock::time_point Fuzzer::UnitStartTime;
26 void Fuzzer::SetDeathCallback() {
27 __sanitizer_set_death_callback(DeathCallback);
30 void Fuzzer::DeathCallback() {
31 std::cerr << "DEATH: " << std::endl;
32 Print(CurrentUnit, "\n");
33 PrintASCII(CurrentUnit, "\n");
34 WriteToCrash(CurrentUnit, "crash-");
37 void Fuzzer::AlarmCallback() {
39 duration_cast<seconds>(system_clock::now() - UnitStartTime).count();
40 std::cerr << "ALARM: working on the last Unit for " << Seconds << " seconds"
43 Print(CurrentUnit, "\n");
44 PrintASCII(CurrentUnit, "\n");
45 WriteToCrash(CurrentUnit, "timeout-");
50 void Fuzzer::ShuffleAndMinimize() {
51 if (Options.Verbosity)
52 std::cerr << "Shuffle: " << Corpus.size() << "\n";
53 std::vector<Unit> NewCorpus;
54 random_shuffle(Corpus.begin(), Corpus.end());
56 Unit &U = CurrentUnit;
57 for (const auto &C : Corpus) {
58 for (size_t First = 0; First < 1; First++) {
60 size_t Last = std::min(First + Options.MaxLen, C.size());
61 U.insert(U.begin(), C.begin() + First, C.begin() + Last);
62 size_t NewCoverage = RunOne(U);
65 NewCorpus.push_back(U);
66 if (Options.Verbosity >= 2)
67 std::cerr << "NEW0: " << NewCoverage << "\n";
72 if (Options.Verbosity)
73 std::cerr << "Shuffle done: " << Corpus.size() << " IC: " << MaxCov << "\n";
76 size_t Fuzzer::RunOne(const Unit &U) {
77 UnitStartTime = system_clock::now();
79 if (Options.UseFullCoverageSet)
80 return RunOneMaximizeFullCoverageSet(U);
81 return RunOneMaximizeTotalCoverage(U);
84 static uintptr_t HashOfArrayOfPCs(uintptr_t *PCs, uintptr_t NumPCs) {
86 for (uintptr_t i = 0; i < NumPCs; i++) {
87 Res = (Res + PCs[i]) * 7;
92 // Fuly reset the current coverage state, run a single unit,
93 // compute a hash function from the full coverage set,
94 // return non-zero if the hash value is new.
95 // This produces tons of new units and as is it's only suitable for small tests,
96 // e.g. test/FullCoverageSetTest.cpp. FIXME: make it scale.
97 size_t Fuzzer::RunOneMaximizeFullCoverageSet(const Unit &U) {
98 __sanitizer_reset_coverage();
99 TestOneInput(U.data(), U.size());
101 uintptr_t NumPCs =__sanitizer_get_coverage_guards(&PCs);
102 if (FullCoverageSets.insert(HashOfArrayOfPCs(PCs, NumPCs)).second)
103 return FullCoverageSets.size();
107 size_t Fuzzer::RunOneMaximizeTotalCoverage(const Unit &U) {
108 size_t OldCoverage = __sanitizer_get_total_unique_coverage();
109 TestOneInput(U.data(), U.size());
110 size_t NewCoverage = __sanitizer_get_total_unique_coverage();
111 if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) && Options.Verbosity) {
113 duration_cast<seconds>(system_clock::now() - ProcessStartTime).count();
115 << "#" << TotalNumberOfRuns
116 << "\tcov: " << NewCoverage
117 << "\texec/s: " << (Seconds ? TotalNumberOfRuns / Seconds : 0) << "\n";
119 if (NewCoverage > OldCoverage)
124 void Fuzzer::WriteToOutputCorpus(const Unit &U) {
125 if (Options.OutputCorpus.empty()) return;
126 std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U));
127 WriteToFile(U, Path);
128 if (Options.Verbosity >= 2)
129 std::cerr << "Written to " << Path << std::endl;
132 void Fuzzer::WriteToCrash(const Unit &U, const char *Prefix) {
133 std::string Path = Prefix + Hash(U);
134 WriteToFile(U, Path);
135 std::cerr << "CRASHED; file written to " << Path << std::endl;
138 void Fuzzer::SaveCorpus() {
139 if (Options.OutputCorpus.empty()) return;
140 for (const auto &U : Corpus)
141 WriteToFile(U, DirPlusFile(Options.OutputCorpus, Hash(U)));
142 if (Options.Verbosity)
143 std::cerr << "Written corpus of " << Corpus.size() << " files to "
144 << Options.OutputCorpus << "\n";
147 size_t Fuzzer::MutateAndTestOne(Unit *U) {
149 for (size_t i = 0; i < Options.MutateDepth; i++) {
150 Mutate(U, Options.MaxLen);
151 if (U->empty()) continue;
152 size_t NewCoverage = RunOne(*U);
154 Corpus.push_back(*U);
156 if (Options.Verbosity) {
157 std::cerr << "#" << TotalNumberOfRuns
158 << "\tNEW: " << NewCoverage
159 << " L: " << U->size()
161 if (U->size() < 30) {
168 WriteToOutputCorpus(*U);
169 if (Options.ExitOnFirst)
176 size_t Fuzzer::Loop(size_t NumIterations) {
178 for (size_t i = 1; i <= NumIterations; i++) {
179 if (Options.DoCrossOver) {
180 for (size_t J1 = 0; J1 < Corpus.size(); J1++) {
181 for (size_t J2 = 0; J2 < Corpus.size(); J2++) {
183 CrossOver(Corpus[J1], Corpus[J2], &CurrentUnit, Options.MaxLen);
184 NewUnits += MutateAndTestOne(&CurrentUnit);
187 } else { // No CrossOver
188 for (size_t J = 0; J < Corpus.size(); J++) {
189 CurrentUnit = Corpus[J];
190 NewUnits += MutateAndTestOne(&CurrentUnit);
197 } // namespace fuzzer