1 //===- FuzzerLoop.cpp - Fuzzer's main loop --------------------------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 //===----------------------------------------------------------------------===//
12 #include "FuzzerInternal.h"
13 #include <sanitizer/asan_interface.h>
19 // This function should be defined by the user.
20 extern "C" void TestOneInput(const uint8_t *Data, size_t Size);
25 Unit Fuzzer::CurrentUnit;
26 system_clock::time_point Fuzzer::UnitStartTime;
28 void Fuzzer::SetDeathCallback() {
29 __sanitizer_set_death_callback(DeathCallback);
32 void Fuzzer::DeathCallback() {
33 std::cerr << "DEATH: " << std::endl;
34 Print(CurrentUnit, "\n");
35 PrintASCII(CurrentUnit, "\n");
36 WriteToCrash(CurrentUnit, "crash-");
39 void Fuzzer::AlarmCallback() {
41 duration_cast<seconds>(system_clock::now() - UnitStartTime).count();
42 std::cerr << "ALARM: working on the last Unit for " << Seconds << " seconds"
45 Print(CurrentUnit, "\n");
46 PrintASCII(CurrentUnit, "\n");
47 WriteToCrash(CurrentUnit, "timeout-");
52 void Fuzzer::ShuffleAndMinimize() {
53 if (Options.Verbosity)
54 std::cerr << "Shuffle: " << Corpus.size() << "\n";
55 std::vector<Unit> NewCorpus;
56 random_shuffle(Corpus.begin(), Corpus.end());
58 Unit &U = CurrentUnit;
59 for (const auto &C : Corpus) {
60 for (size_t First = 0; First < 1; First++) {
62 size_t Last = std::min(First + Options.MaxLen, C.size());
63 U.insert(U.begin(), C.begin() + First, C.begin() + Last);
64 size_t NewCoverage = RunOne(U);
67 NewCorpus.push_back(U);
68 if (Options.Verbosity >= 2)
69 std::cerr << "NEW0: " << NewCoverage << "\n";
74 if (Options.Verbosity)
75 std::cerr << "Shuffle done: " << Corpus.size() << " IC: " << MaxCov << "\n";
78 size_t Fuzzer::RunOne(const Unit &U) {
79 UnitStartTime = system_clock::now();
81 size_t OldCoverage = __sanitizer_get_total_unique_coverage();
82 TestOneInput(U.data(), U.size());
83 size_t NewCoverage = __sanitizer_get_total_unique_coverage();
84 if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) && Options.Verbosity) {
86 duration_cast<seconds>(system_clock::now() - ProcessStartTime).count();
88 << "#" << TotalNumberOfRuns
89 << "\tcov: " << NewCoverage
90 << "\texec/s: " << (Seconds ? TotalNumberOfRuns / Seconds : 0) << "\n";
92 if (NewCoverage > OldCoverage)
97 void Fuzzer::WriteToOutputCorpus(const Unit &U) {
98 if (Options.OutputCorpus.empty()) return;
99 std::string Path = Options.OutputCorpus + "/" + Hash(U);
100 WriteToFile(U, Path);
101 if (Options.Verbosity >= 2)
102 std::cerr << "Written to " << Path << std::endl;
105 void Fuzzer::WriteToCrash(const Unit &U, const char *Prefix) {
106 std::string Path = Prefix + Hash(U);
107 WriteToFile(U, Path);
108 std::cerr << "CRASHED; file written to " << Path << std::endl;
111 size_t Fuzzer::MutateAndTestOne(Unit *U) {
113 for (size_t i = 0; i < Options.MutateDepth; i++) {
114 Mutate(U, Options.MaxLen);
115 if (U->empty()) continue;
116 size_t NewCoverage = RunOne(*U);
118 Corpus.push_back(*U);
120 if (Options.Verbosity) {
121 std::cerr << "#" << TotalNumberOfRuns
122 << "\tNEW: " << NewCoverage
123 << " L: " << U->size()
125 if (U->size() < 30) {
132 WriteToOutputCorpus(*U);
133 if (Options.ExitOnFirst)
140 size_t Fuzzer::Loop(size_t NumIterations) {
142 for (size_t i = 1; i <= NumIterations; i++) {
143 if (Options.DoCrossOver) {
144 for (size_t J1 = 0; J1 < Corpus.size(); J1++) {
145 for (size_t J2 = 0; J2 < Corpus.size(); J2++) {
147 CrossOver(Corpus[J1], Corpus[J2], &CurrentUnit, Options.MaxLen);
148 NewUnits += MutateAndTestOne(&CurrentUnit);
151 } else { // No CrossOver
152 for (size_t J = 0; J < Corpus.size(); J++) {
153 CurrentUnit = Corpus[J];
154 NewUnits += MutateAndTestOne(&CurrentUnit);
161 } // namespace fuzzer