dfsan_label L2);
void TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, uint64_t Arg1,
uint64_t Arg2);
+
+ void TraceSwitchCallback(uintptr_t PC, size_t ValSizeInBits, uint64_t Val,
+ size_t NumCases, uint64_t *Cases);
int TryToAddDesiredData(uint64_t PresentData, uint64_t DesiredData,
size_t DataSize);
break;
size_t Pos = Cur - Beg;
assert(Pos < CurrentUnit.size());
+ if (Mutations.size() > 100000U) return Res; // Just in case.
Mutations.push_back({Pos, DataSize, DesiredData});
Mutations.push_back({Pos, DataSize, DesiredData + 1});
Mutations.push_back({Pos, DataSize, DesiredData - 1});
}
}
+void TraceState::TraceSwitchCallback(uintptr_t PC, size_t ValSizeInBits,
+ uint64_t Val, size_t NumCases,
+ uint64_t *Cases) {
+ for (size_t i = 0; i < NumCases; i++)
+ TryToAddDesiredData(Val, Cases[i], ValSizeInBits / 8);
+}
+
static TraceState *TS;
void Fuzzer::StartTraceRecording() {
}
}
+static size_t InternalStrnlen(const char *S, size_t MaxLen) {
+ size_t Len = 0;
+ for (; Len < MaxLen && S[Len]; Len++) {}
+ return Len;
+}
+
} // namespace fuzzer
using fuzzer::TS;
void dfsan_weak_hook_strncmp(void *caller_pc, const char *s1, const char *s2,
size_t n, dfsan_label s1_label,
dfsan_label s2_label, dfsan_label n_label) {
- dfsan_weak_hook_memcmp(caller_pc, s1, s2, n, s1_label, s2_label, n_label);
+ if (!TS) return;
+ uintptr_t PC = reinterpret_cast<uintptr_t>(caller_pc);
+ uint64_t S1 = 0, S2 = 0;
+ n = std::min(n, fuzzer::InternalStrnlen(s1, n));
+ n = std::min(n, fuzzer::InternalStrnlen(s2, n));
+ // Simplification: handle only first 8 bytes.
+ memcpy(&S1, s1, std::min(n, sizeof(S1)));
+ memcpy(&S2, s2, std::min(n, sizeof(S2)));
+ dfsan_label L1 = dfsan_read_label(s1, n);
+ dfsan_label L2 = dfsan_read_label(s2, n);
+ TS->DFSanCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2, L1, L2);
}
void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1,
void __sanitizer_weak_hook_strncmp(void *caller_pc, const char *s1,
const char *s2, size_t n) {
- __sanitizer_weak_hook_memcmp(caller_pc, s1, s2, n);
+ if (!TS) return;
+ uintptr_t PC = reinterpret_cast<uintptr_t>(caller_pc);
+ uint64_t S1 = 0, S2 = 0;
+ n = std::min(n, fuzzer::InternalStrnlen(s1, n));
+ n = std::min(n, fuzzer::InternalStrnlen(s2, n));
+ // Simplification: handle only first 8 bytes.
+ memcpy(&S1, s1, std::min(n, sizeof(S1)));
+ memcpy(&S2, s2, std::min(n, sizeof(S2)));
+ TS->TraceCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2);
}
void __sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1,
TS->TraceCmpCallback(PC, CmpSize, Type, Arg1, Arg2);
}
+void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases) {
+ if (!TS) return;
+ uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+ TS->TraceSwitchCallback(PC, Cases[1], Val, Cases[0], Cases + 2);
+}
+
} // extern "C"