[libFuzzer] more accurate logic for traces, 80-char fix

[oota-llvm.git] / lib / Fuzzer / FuzzerTraceState.cpp

diff --git a/lib/Fuzzer/FuzzerTraceState.cpp b/lib/Fuzzer/FuzzerTraceState.cpp
index f0537c005800bb3476789eb0a22f67c67ecdbcb0..b7ed66fdfc676de23d1b31632331e34b3417818d 100644 (file)
--- a/lib/Fuzzer/FuzzerTraceState.cpp
+++ b/lib/Fuzzer/FuzzerTraceState.cpp
@@ -140,7 +140,7 @@ static bool ComputeCmp(size_t CmpSize, size_t CmpType, uint64_t Arg1,
   if (CmpSize == 1) return ComputeCmp<uint8_t, int8_t>(CmpType, Arg1, Arg2);
   // Other size, ==
   if (CmpType == ICMP_EQ) return Arg1 == Arg2;
-  assert(0 && "unsupported cmp and type size combination");
+  // assert(0 && "unsupported cmp and type size combination");
   return true;
 }
 
@@ -216,8 +216,8 @@ class TraceState {
                         dfsan_label L2);
   void DFSanSwitchCallback(uint64_t PC, size_t ValSizeInBits, uint64_t Val,
                            size_t NumCases, uint64_t *Cases, dfsan_label L);
-  void TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, uint64_t Arg1,
-                        uint64_t Arg2);
+  void TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType,
+                        uint64_t Arg1, uint64_t Arg2);
 
   void TraceSwitchCallback(uintptr_t PC, size_t ValSizeInBits, uint64_t Val,
                            size_t NumCases, uint64_t *Cases);
@@ -232,8 +232,7 @@ class TraceState {
 
   size_t StopTraceRecording(FuzzerRandomBase &Rand) {
     RecordingTraces = false;
-    std::random_shuffle(Mutations.begin(), Mutations.end(), Rand);
-    return std::min(Mutations.size(), 128UL);
+    return Mutations.size();
   }
 
   void ApplyTraceBasedMutation(size_t Idx, fuzzer::Unit *U);
@@ -331,7 +330,7 @@ int TraceState::TryToAddDesiredData(uint64_t PresentData, uint64_t DesiredData,
   int Res = 0;
   const uint8_t *Beg = CurrentUnit.data();
   const uint8_t *End = Beg + CurrentUnit.size();
-  for (const uint8_t *Cur = Beg; Cur < End; Cur += DataSize) {
+  for (const uint8_t *Cur = Beg; Cur < End; Cur++) {
     Cur = (uint8_t *)memmem(Cur, End - Cur, &PresentData, DataSize);
     if (!Cur)
       break;
@@ -341,14 +340,13 @@ int TraceState::TryToAddDesiredData(uint64_t PresentData, uint64_t DesiredData,
     Mutations.push_back({Pos, DataSize, DesiredData});
     Mutations.push_back({Pos, DataSize, DesiredData + 1});
     Mutations.push_back({Pos, DataSize, DesiredData - 1});
-    Cur += DataSize;
     Res++;
   }
   return Res;
 }
 
-void TraceState::TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, uint64_t Arg1,
-                        uint64_t Arg2) {
+void TraceState::TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType,
+                                  uint64_t Arg1, uint64_t Arg2) {
   if (!RecordingTraces) return;
   int Added = 0;
   CmpSitePassport *CSP = CSPTable.GetPassport(PC);
@@ -356,8 +354,9 @@ void TraceState::TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType,
   CSP->Counter[ComputeCmp(CmpSize, CmpType, Arg1, Arg2)]++;
   size_t C0 = CSP->Counter[0];
   size_t C1 = CSP->Counter[1];
-  if (!CSP->IsInterestingCmpTarget())
-    return;
+  // FIXME: is this a good idea or a bad?
+  // if (!CSP->IsInterestingCmpTarget())
+  //  return;
   if (Options.Verbosity >= 3)
     Printf("TraceCmp: %p %zd/%zd; %zd %zd\n", CSP->PC, C0, C1, Arg1, Arg2);
   Added += TryToAddDesiredData(Arg1, Arg2, CmpSize);
@@ -393,6 +392,9 @@ static TraceState *TS;
 
 void Fuzzer::StartTraceRecording() {
   if (!TS) return;
+  if (ReallyHaveDFSan())
+    for (size_t i = 0; i < static_cast<size_t>(Options.MaxLen); i++)
+      dfsan_set_label(i + 1, &CurrentUnit[i], 1);
   TS->StartTraceRecording();
 }
 
@@ -415,8 +417,10 @@ void Fuzzer::InitializeTraceState() {
   for (size_t i = 0; i < static_cast<size_t>(Options.MaxLen); i++) {
     dfsan_label L = dfsan_create_label("input", (void*)(i + 1));
     // We assume that no one else has called dfsan_create_label before.
-    assert(L == i + 1);
-    dfsan_set_label(L, &CurrentUnit[i], 1);
+    if (L != i + 1) {
+      Printf("DFSan labels are not starting from 1, exiting\n");
+      exit(1);
+    }
   }
 }
 
@@ -479,6 +483,23 @@ void dfsan_weak_hook_strncmp(void *caller_pc, const char *s1, const char *s2,
   TS->DFSanCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2, L1, L2);
 }
 
+void dfsan_weak_hook_strcmp(void *caller_pc, const char *s1, const char *s2,
+                            dfsan_label s1_label, dfsan_label s2_label) {
+  if (!TS) return;
+  uintptr_t PC = reinterpret_cast<uintptr_t>(caller_pc);
+  uint64_t S1 = 0, S2 = 0;
+  size_t Len1 = strlen(s1);
+  size_t Len2 = strlen(s2);
+  size_t N = std::min(Len1, Len2);
+  if (N <= 1) return;  // Not interesting.
+  // Simplification: handle only first 8 bytes.
+  memcpy(&S1, s1, std::min(N, sizeof(S1)));
+  memcpy(&S2, s2, std::min(N, sizeof(S2)));
+  dfsan_label L1 = dfsan_read_label(s1, Len1);
+  dfsan_label L2 = dfsan_read_label(s2, Len2);
+  TS->DFSanCmpCallback(PC, N, fuzzer::ICMP_EQ, S1, S2, L1, L2);
+}
+
 void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1,
                                   const void *s2, size_t n) {
   if (!TS) return;
@@ -506,6 +527,22 @@ void __sanitizer_weak_hook_strncmp(void *caller_pc, const char *s1,
   TS->TraceCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2);
 }
 
+void __sanitizer_weak_hook_strcmp(void *caller_pc, const char *s1,
+                                   const char *s2) {
+  if (!TS) return;
+  uintptr_t PC = reinterpret_cast<uintptr_t>(caller_pc);
+  uint64_t S1 = 0, S2 = 0;
+  size_t Len1 = strlen(s1);
+  size_t Len2 = strlen(s2);
+  size_t N = std::min(Len1, Len2);
+  if (N <= 1) return;  // Not interesting.
+  // Simplification: handle only first 8 bytes.
+  memcpy(&S1, s1, std::min(N, sizeof(S1)));
+  memcpy(&S2, s2, std::min(N, sizeof(S2)));
+  TS->TraceCmpCallback(PC, N, fuzzer::ICMP_EQ, S1, S2);
+}
+
+
 void __sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1,
                                uint64_t Arg2) {
   if (!TS) return;