clang -fPIC -c -g -O2 -std=c++11 Fuzzer*.cpp
clang++ -O0 -std=c++11 -fsanitize-coverage=edge,trace-cmp \
-fsanitize=dataflow \
- test/dfsan/DFSanSimpleCmpTest.cpp Fuzzer*.o
- ./a.out
+ test/SimpleCmpTest.cpp Fuzzer*.o
+ ./a.out -use_traces=1
)
*/
+#include "FuzzerDFSan.h"
#include "FuzzerInternal.h"
-#include <sanitizer/dfsan_interface.h>
#include <algorithm>
#include <cstring>
#include <unordered_map>
+#if !LLVM_FUZZER_SUPPORTS_DFSAN
+// Stubs for dfsan for platforms where dfsan does not exist and weak
+// functions don't work.
extern "C" {
-__attribute__((weak))
-dfsan_label dfsan_create_label(const char *desc, void *userdata);
-__attribute__((weak))
-void dfsan_set_label(dfsan_label label, void *addr, size_t size);
-__attribute__((weak))
-void dfsan_add_label(dfsan_label label, void *addr, size_t size);
-__attribute__((weak))
-const struct dfsan_label_info *dfsan_get_label_info(dfsan_label label);
-__attribute__((weak))
-dfsan_label dfsan_read_label(const void *addr, size_t size);
+dfsan_label dfsan_create_label(const char *desc, void *userdata) { return 0; }
+void dfsan_set_label(dfsan_label label, void *addr, size_t size) {}
+void dfsan_add_label(dfsan_label label, void *addr, size_t size) {}
+const struct dfsan_label_info *dfsan_get_label_info(dfsan_label label) {
+ return nullptr;
+}
+dfsan_label dfsan_read_label(const void *addr, size_t size) { return 0; }
} // extern "C"
+#endif // !LLVM_FUZZER_SUPPORTS_DFSAN
namespace fuzzer {
-static bool ReallyHaveDFSan() {
- return &dfsan_create_label != nullptr;
-}
-
// These values are copied from include/llvm/IR/InstrTypes.h.
// We do not include the LLVM headers here to remain independent.
// If these values ever change, an assertion in ComputeCmp will fail.
}
};
-// A passport for a CMP site. We want to keep track of where the given CMP is
-// and how many times it is evaluated to true or false.
-struct CmpSitePassport {
- uintptr_t PC;
- size_t Counter[2];
-
- bool IsInterestingCmpTarget() {
- static const size_t kRareEnough = 50;
- size_t C0 = Counter[0];
- size_t C1 = Counter[1];
- return C0 > kRareEnough * (C1 + 1) || C1 > kRareEnough * (C0 + 1);
- }
-};
-
-// For now, just keep a simple imprecise hash table PC => CmpSitePassport.
-// Potentially, will need to have a compiler support to have a precise mapping
-// and also thread-safety.
-struct CmpSitePassportTable {
- static const size_t kSize = 99991; // Prime.
- CmpSitePassport Passports[kSize];
-
- CmpSitePassport *GetPassport(uintptr_t PC) {
- uintptr_t Idx = PC & kSize;
- CmpSitePassport *Res = &Passports[Idx];
- if (Res->PC == 0) // Not thread safe.
- Res->PC = PC;
- return Res->PC == PC ? Res : nullptr;
- }
-};
-
-static CmpSitePassportTable CSPTable; // Zero initialized.
-
// For now, very simple: put Size bytes of Data at position Pos.
struct TraceBasedMutation {
size_t Pos;
dfsan_label L2);
void DFSanSwitchCallback(uint64_t PC, size_t ValSizeInBits, uint64_t Val,
size_t NumCases, uint64_t *Cases, dfsan_label L);
- void TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, uint64_t Arg1,
- uint64_t Arg2);
+ void TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType,
+ uint64_t Arg1, uint64_t Arg2);
void TraceSwitchCallback(uintptr_t PC, size_t ValSizeInBits, uint64_t Val,
size_t NumCases, uint64_t *Cases);
size_t StopTraceRecording(FuzzerRandomBase &Rand) {
RecordingTraces = false;
- std::random_shuffle(Mutations.begin(), Mutations.end(), Rand);
- return std::min(Mutations.size(), 128UL);
+ return Mutations.size();
}
void ApplyTraceBasedMutation(size_t Idx, fuzzer::Unit *U);
int Res = 0;
const uint8_t *Beg = CurrentUnit.data();
const uint8_t *End = Beg + CurrentUnit.size();
- for (const uint8_t *Cur = Beg; Cur < End; Cur += DataSize) {
+ for (const uint8_t *Cur = Beg; Cur < End; Cur++) {
Cur = (uint8_t *)memmem(Cur, End - Cur, &PresentData, DataSize);
if (!Cur)
break;
Mutations.push_back({Pos, DataSize, DesiredData});
Mutations.push_back({Pos, DataSize, DesiredData + 1});
Mutations.push_back({Pos, DataSize, DesiredData - 1});
- Cur += DataSize;
Res++;
}
return Res;
}
-void TraceState::TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, uint64_t Arg1,
- uint64_t Arg2) {
+void TraceState::TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType,
+ uint64_t Arg1, uint64_t Arg2) {
if (!RecordingTraces) return;
int Added = 0;
- CmpSitePassport *CSP = CSPTable.GetPassport(PC);
- if (!CSP) return;
- CSP->Counter[ComputeCmp(CmpSize, CmpType, Arg1, Arg2)]++;
- size_t C0 = CSP->Counter[0];
- size_t C1 = CSP->Counter[1];
- // FIXME: is this a good idea or a bad?
- // if (!CSP->IsInterestingCmpTarget())
- // return;
if (Options.Verbosity >= 3)
- Printf("TraceCmp: %p %zd/%zd; %zd %zd\n", CSP->PC, C0, C1, Arg1, Arg2);
+ Printf("TraceCmp %zd/%zd: %p %zd %zd\n", CmpSize, CmpType, PC, Arg1, Arg2);
Added += TryToAddDesiredData(Arg1, Arg2, CmpSize);
Added += TryToAddDesiredData(Arg2, Arg1, CmpSize);
if (!Added && CmpSize == 4 && IsTwoByteData(Arg1) && IsTwoByteData(Arg2)) {
TS->TraceCmpCallback(PC, N, fuzzer::ICMP_EQ, S1, S2);
}
-
+__attribute__((visibility("default")))
void __sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1,
uint64_t Arg2) {
if (!TS) return;
TS->TraceCmpCallback(PC, CmpSize, Type, Arg1, Arg2);
}
+__attribute__((visibility("default")))
void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases) {
if (!TS) return;
uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
projects / oota-llvm.git / blobdiff