clang -fPIC -c -g -O2 -std=c++11 Fuzzer*.cpp
clang++ -O0 -std=c++11 -fsanitize-coverage=edge,trace-cmp \
-fsanitize=dataflow \
- test/dfsan/DFSanSimpleCmpTest.cpp Fuzzer*.o
- ./a.out
+ test/SimpleCmpTest.cpp Fuzzer*.o
+ ./a.out -use_traces=1
)
*/
+#include "FuzzerDFSan.h"
#include "FuzzerInternal.h"
-#include <sanitizer/dfsan_interface.h>
#include <algorithm>
#include <cstring>
-#include <iostream>
#include <unordered_map>
+#if !LLVM_FUZZER_SUPPORTS_DFSAN
+// Stubs for dfsan for platforms where dfsan does not exist and weak
+// functions don't work.
extern "C" {
-__attribute__((weak))
-dfsan_label dfsan_create_label(const char *desc, void *userdata);
-__attribute__((weak))
-void dfsan_set_label(dfsan_label label, void *addr, size_t size);
-__attribute__((weak))
-void dfsan_add_label(dfsan_label label, void *addr, size_t size);
-__attribute__((weak))
-const struct dfsan_label_info *dfsan_get_label_info(dfsan_label label);
-__attribute__((weak))
-dfsan_label dfsan_read_label(const void *addr, size_t size);
+dfsan_label dfsan_create_label(const char *desc, void *userdata) { return 0; }
+void dfsan_set_label(dfsan_label label, void *addr, size_t size) {}
+void dfsan_add_label(dfsan_label label, void *addr, size_t size) {}
+const struct dfsan_label_info *dfsan_get_label_info(dfsan_label label) {
+ return nullptr;
+}
+dfsan_label dfsan_read_label(const void *addr, size_t size) { return 0; }
} // extern "C"
+#endif // !LLVM_FUZZER_SUPPORTS_DFSAN
namespace fuzzer {
-static bool ReallyHaveDFSan() {
- return &dfsan_create_label != nullptr;
-}
-
// These values are copied from include/llvm/IR/InstrTypes.h.
// We do not include the LLVM headers here to remain independent.
// If these values ever change, an assertion in ComputeCmp will fail.
if (CmpSize == 4) return ComputeCmp<uint32_t, int32_t>(CmpType, Arg1, Arg2);
if (CmpSize == 2) return ComputeCmp<uint16_t, int16_t>(CmpType, Arg1, Arg2);
if (CmpSize == 1) return ComputeCmp<uint8_t, int8_t>(CmpType, Arg1, Arg2);
- assert(0 && "unsupported type size");
+ // Other size, ==
+ if (CmpType == ICMP_EQ) return Arg1 == Arg2;
+ // assert(0 && "unsupported cmp and type size combination");
return true;
}
}
};
-std::ostream &operator<<(std::ostream &os, const LabelRange &LR) {
- return os << "[" << LR.Beg << "," << LR.End << ")";
-}
-
// For now, very simple: put Size bytes of Data at position Pos.
struct TraceBasedMutation {
size_t Pos;
void DFSanCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType,
uint64_t Arg1, uint64_t Arg2, dfsan_label L1,
dfsan_label L2);
- void TraceCmpCallback(size_t CmpSize, size_t CmpType, uint64_t Arg1,
- uint64_t Arg2);
+ void DFSanSwitchCallback(uint64_t PC, size_t ValSizeInBits, uint64_t Val,
+ size_t NumCases, uint64_t *Cases, dfsan_label L);
+ void TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType,
+ uint64_t Arg1, uint64_t Arg2);
+
+ void TraceSwitchCallback(uintptr_t PC, size_t ValSizeInBits, uint64_t Val,
+ size_t NumCases, uint64_t *Cases);
int TryToAddDesiredData(uint64_t PresentData, uint64_t DesiredData,
size_t DataSize);
Mutations.clear();
}
- size_t StopTraceRecording() {
+ size_t StopTraceRecording(FuzzerRandomBase &Rand) {
RecordingTraces = false;
- std::random_shuffle(Mutations.begin(), Mutations.end());
return Mutations.size();
}
assert(Idx < Mutations.size());
auto &M = Mutations[Idx];
if (Options.Verbosity >= 3)
- std::cerr << "TBM " << M.Pos << " " << M.Size << " " << M.Data << "\n";
+ Printf("TBM %zd %zd %zd\n", M.Pos, M.Size, M.Data);
if (M.Pos + M.Size > U->size()) return;
memcpy(U->data() + M.Pos, &M.Data, M.Size);
}
if (Options.Verbosity >= 3)
- std::cerr << "DFSAN:"
- << " PC " << std::hex << PC << std::dec
- << " S " << CmpSize
- << " T " << CmpType
- << " A1 " << Arg1 << " A2 " << Arg2 << " R " << Res
- << " L" << L1
- << " L" << L2
- << " R" << LR
- << " MU " << Mutations.size()
- << "\n";
+ Printf("DFSanCmpCallback: PC %lx S %zd T %zd A1 %llx A2 %llx R %d L1 %d L2 "
+ "%d MU %zd\n",
+ PC, CmpSize, CmpType, Arg1, Arg2, Res, L1, L2, Mutations.size());
+}
+
+void TraceState::DFSanSwitchCallback(uint64_t PC, size_t ValSizeInBits,
+ uint64_t Val, size_t NumCases,
+ uint64_t *Cases, dfsan_label L) {
+ assert(ReallyHaveDFSan());
+ if (!RecordingTraces) return;
+ if (!L) return; // Not actionable.
+ LabelRange LR = GetLabelRange(L);
+ size_t ValSize = ValSizeInBits / 8;
+ bool TryShort = IsTwoByteData(Val);
+ for (size_t i = 0; i < NumCases; i++)
+ TryShort &= IsTwoByteData(Cases[i]);
+
+ for (size_t Pos = LR.Beg; Pos + ValSize <= LR.End; Pos++)
+ for (size_t i = 0; i < NumCases; i++)
+ Mutations.push_back({Pos, ValSize, Cases[i]});
+
+ if (TryShort)
+ for (size_t Pos = LR.Beg; Pos + 2 <= LR.End; Pos++)
+ for (size_t i = 0; i < NumCases; i++)
+ Mutations.push_back({Pos, 2, Cases[i]});
+
+ if (Options.Verbosity >= 3)
+ Printf("DFSanSwitchCallback: PC %lx Val %zd SZ %zd # %zd L %d: {%d, %d} "
+ "TryShort %d\n",
+ PC, Val, ValSize, NumCases, L, LR.Beg, LR.End, TryShort);
}
int TraceState::TryToAddDesiredData(uint64_t PresentData, uint64_t DesiredData,
int Res = 0;
const uint8_t *Beg = CurrentUnit.data();
const uint8_t *End = Beg + CurrentUnit.size();
- for (const uint8_t *Cur = Beg; Cur < End; Cur += DataSize) {
+ for (const uint8_t *Cur = Beg; Cur < End; Cur++) {
Cur = (uint8_t *)memmem(Cur, End - Cur, &PresentData, DataSize);
if (!Cur)
break;
- // std::cerr << "Cur " << (void*)Cur << "\n";
size_t Pos = Cur - Beg;
assert(Pos < CurrentUnit.size());
+ if (Mutations.size() > 100000U) return Res; // Just in case.
Mutations.push_back({Pos, DataSize, DesiredData});
Mutations.push_back({Pos, DataSize, DesiredData + 1});
Mutations.push_back({Pos, DataSize, DesiredData - 1});
- Cur += DataSize;
Res++;
}
return Res;
}
-void TraceState::TraceCmpCallback(size_t CmpSize, size_t CmpType, uint64_t Arg1,
- uint64_t Arg2) {
+void TraceState::TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType,
+ uint64_t Arg1, uint64_t Arg2) {
if (!RecordingTraces) return;
int Added = 0;
if (Options.Verbosity >= 3)
- std::cerr << "TraceCmp: " << Arg1 << " " << Arg2 << "\n";
+ Printf("TraceCmp %zd/%zd: %p %zd %zd\n", CmpSize, CmpType, PC, Arg1, Arg2);
Added += TryToAddDesiredData(Arg1, Arg2, CmpSize);
Added += TryToAddDesiredData(Arg2, Arg1, CmpSize);
if (!Added && CmpSize == 4 && IsTwoByteData(Arg1) && IsTwoByteData(Arg2)) {
}
}
+void TraceState::TraceSwitchCallback(uintptr_t PC, size_t ValSizeInBits,
+ uint64_t Val, size_t NumCases,
+ uint64_t *Cases) {
+ if (!RecordingTraces) return;
+ size_t ValSize = ValSizeInBits / 8;
+ bool TryShort = IsTwoByteData(Val);
+ for (size_t i = 0; i < NumCases; i++)
+ TryShort &= IsTwoByteData(Cases[i]);
+
+ if (Options.Verbosity >= 3)
+ Printf("TraceSwitch: %p %zd # %zd; TryShort %d\n", PC, Val, NumCases,
+ TryShort);
+
+ for (size_t i = 0; i < NumCases; i++) {
+ TryToAddDesiredData(Val, Cases[i], ValSize);
+ if (TryShort)
+ TryToAddDesiredData(Val, Cases[i], 2);
+ }
+
+}
+
static TraceState *TS;
void Fuzzer::StartTraceRecording() {
if (!TS) return;
+ if (ReallyHaveDFSan())
+ for (size_t i = 0; i < static_cast<size_t>(Options.MaxLen); i++)
+ dfsan_set_label(i + 1, &CurrentUnit[i], 1);
TS->StartTraceRecording();
}
size_t Fuzzer::StopTraceRecording() {
if (!TS) return 0;
- return TS->StopTraceRecording();
+ return TS->StopTraceRecording(USF.GetRand());
}
void Fuzzer::ApplyTraceBasedMutation(size_t Idx, Unit *U) {
for (size_t i = 0; i < static_cast<size_t>(Options.MaxLen); i++) {
dfsan_label L = dfsan_create_label("input", (void*)(i + 1));
// We assume that no one else has called dfsan_create_label before.
- assert(L == i + 1);
- dfsan_set_label(L, &CurrentUnit[i], 1);
+ if (L != i + 1) {
+ Printf("DFSan labels are not starting from 1, exiting\n");
+ exit(1);
+ }
}
}
+static size_t InternalStrnlen(const char *S, size_t MaxLen) {
+ size_t Len = 0;
+ for (; Len < MaxLen && S[Len]; Len++) {}
+ return Len;
+}
+
} // namespace fuzzer
using fuzzer::TS;
void __dfsw___sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1,
uint64_t Arg2, dfsan_label L0,
dfsan_label L1, dfsan_label L2) {
- assert(TS);
+ if (!TS) return;
assert(L0 == 0);
uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
uint64_t CmpSize = (SizeAndType >> 32) / 8;
TS->DFSanCmpCallback(PC, CmpSize, Type, Arg1, Arg2, L1, L2);
}
+void __dfsw___sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases,
+ dfsan_label L1, dfsan_label L2) {
+ if (!TS) return;
+ uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+ TS->DFSanSwitchCallback(PC, Cases[1], Val, Cases[0], Cases+2, L1);
+}
+
void dfsan_weak_hook_memcmp(void *caller_pc, const void *s1, const void *s2,
size_t n, dfsan_label s1_label,
dfsan_label s2_label, dfsan_label n_label) {
- assert(TS);
+ if (!TS) return;
uintptr_t PC = reinterpret_cast<uintptr_t>(caller_pc);
uint64_t S1 = 0, S2 = 0;
// Simplification: handle only first 8 bytes.
TS->DFSanCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2, L1, L2);
}
+void dfsan_weak_hook_strncmp(void *caller_pc, const char *s1, const char *s2,
+ size_t n, dfsan_label s1_label,
+ dfsan_label s2_label, dfsan_label n_label) {
+ if (!TS) return;
+ uintptr_t PC = reinterpret_cast<uintptr_t>(caller_pc);
+ uint64_t S1 = 0, S2 = 0;
+ n = std::min(n, fuzzer::InternalStrnlen(s1, n));
+ n = std::min(n, fuzzer::InternalStrnlen(s2, n));
+ // Simplification: handle only first 8 bytes.
+ memcpy(&S1, s1, std::min(n, sizeof(S1)));
+ memcpy(&S2, s2, std::min(n, sizeof(S2)));
+ dfsan_label L1 = dfsan_read_label(s1, n);
+ dfsan_label L2 = dfsan_read_label(s2, n);
+ TS->DFSanCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2, L1, L2);
+}
+
+void dfsan_weak_hook_strcmp(void *caller_pc, const char *s1, const char *s2,
+ dfsan_label s1_label, dfsan_label s2_label) {
+ if (!TS) return;
+ uintptr_t PC = reinterpret_cast<uintptr_t>(caller_pc);
+ uint64_t S1 = 0, S2 = 0;
+ size_t Len1 = strlen(s1);
+ size_t Len2 = strlen(s2);
+ size_t N = std::min(Len1, Len2);
+ if (N <= 1) return; // Not interesting.
+ // Simplification: handle only first 8 bytes.
+ memcpy(&S1, s1, std::min(N, sizeof(S1)));
+ memcpy(&S2, s2, std::min(N, sizeof(S2)));
+ dfsan_label L1 = dfsan_read_label(s1, Len1);
+ dfsan_label L2 = dfsan_read_label(s2, Len2);
+ TS->DFSanCmpCallback(PC, N, fuzzer::ICMP_EQ, S1, S2, L1, L2);
+}
+
+void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1,
+ const void *s2, size_t n) {
+ if (!TS) return;
+ uintptr_t PC = reinterpret_cast<uintptr_t>(caller_pc);
+ uint64_t S1 = 0, S2 = 0;
+ // Simplification: handle only first 8 bytes.
+ memcpy(&S1, s1, std::min(n, sizeof(S1)));
+ memcpy(&S2, s2, std::min(n, sizeof(S2)));
+ TS->TraceCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2);
+}
+
+void __sanitizer_weak_hook_strncmp(void *caller_pc, const char *s1,
+ const char *s2, size_t n) {
+ if (!TS) return;
+ uintptr_t PC = reinterpret_cast<uintptr_t>(caller_pc);
+ uint64_t S1 = 0, S2 = 0;
+ size_t Len1 = fuzzer::InternalStrnlen(s1, n);
+ size_t Len2 = fuzzer::InternalStrnlen(s2, n);
+ n = std::min(n, Len1);
+ n = std::min(n, Len2);
+ if (n <= 1) return; // Not interesting.
+ // Simplification: handle only first 8 bytes.
+ memcpy(&S1, s1, std::min(n, sizeof(S1)));
+ memcpy(&S2, s2, std::min(n, sizeof(S2)));
+ TS->TraceCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2);
+}
+
+void __sanitizer_weak_hook_strcmp(void *caller_pc, const char *s1,
+ const char *s2) {
+ if (!TS) return;
+ uintptr_t PC = reinterpret_cast<uintptr_t>(caller_pc);
+ uint64_t S1 = 0, S2 = 0;
+ size_t Len1 = strlen(s1);
+ size_t Len2 = strlen(s2);
+ size_t N = std::min(Len1, Len2);
+ if (N <= 1) return; // Not interesting.
+ // Simplification: handle only first 8 bytes.
+ memcpy(&S1, s1, std::min(N, sizeof(S1)));
+ memcpy(&S2, s2, std::min(N, sizeof(S2)));
+ TS->TraceCmpCallback(PC, N, fuzzer::ICMP_EQ, S1, S2);
+}
+
+
void __sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1,
uint64_t Arg2) {
if (!TS) return;
+ uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
uint64_t CmpSize = (SizeAndType >> 32) / 8;
uint64_t Type = (SizeAndType << 32) >> 32;
- TS->TraceCmpCallback(CmpSize, Type, Arg1, Arg2);
+ TS->TraceCmpCallback(PC, CmpSize, Type, Arg1, Arg2);
+}
+
+void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases) {
+ if (!TS) return;
+ uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+ TS->TraceSwitchCallback(PC, Cases[1], Val, Cases[0], Cases + 2);
}
} // extern "C"
projects / oota-llvm.git / blobdiff