[libFuzzer] experimental support for 'equivalance fuzzing'

llvm-svn: 292646

3 files changed, 14 insertions, 6 deletions

diff --git a/llvm/lib/Fuzzer/test/EquivalenceATest.cpp b/llvm/lib/Fuzzer/test/EquivalenceATest.cpp
index 101fe127f5d..7d1ebb0f6a4 100644
--- a/llvm/lib/Fuzzer/test/EquivalenceATest.cpp
+++ b/llvm/lib/Fuzzer/test/EquivalenceATest.cpp
@@ -2,12 +2,14 @@
 // License. See LICENSE.TXT for details.
 #include <stddef.h>
 #include <stdint.h>
+#include <stdio.h>
 
 // Test for libFuzzer's "equivalence" fuzzing, part A.
 extern "C" void LLVMFuzzerAnnounceOutput(const uint8_t *Data, size_t Size);
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
-  if (Size > 100) return 0;
-  uint8_t Result[100];
+  // fprintf(stderr, "A %zd\n", Size);
+  uint8_t Result[50];
+  if (Size > 50) Size = 50;
   for (size_t i = 0; i < Size; i++)
     Result[Size - i - 1] = Data[i];
   LLVMFuzzerAnnounceOutput(Result, Size);
diff --git a/llvm/lib/Fuzzer/test/EquivalenceBTest.cpp b/llvm/lib/Fuzzer/test/EquivalenceBTest.cpp
index 175eed1394f..b1de208b57f 100644
--- a/llvm/lib/Fuzzer/test/EquivalenceBTest.cpp
+++ b/llvm/lib/Fuzzer/test/EquivalenceBTest.cpp
@@ -7,18 +7,19 @@
 // Test for libFuzzer's "equivalence" fuzzing, part B.
 extern "C" void LLVMFuzzerAnnounceOutput(const uint8_t *Data, size_t Size);
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
-  if (Size > 100) return 0;
-  uint8_t Result[100];
+  // fprintf(stderr, "B %zd\n", Size);
+  uint8_t Result[50];
+  if (Size > 50) Size = 50;
   for (size_t i = 0; i < Size; i++)
     Result[Size - i - 1] = Data[i];
 
   // Be a bit different from EquivalenceATest
-  if (Size > 42 && Data[10] == 'B') {
+  if (Size > 10 && Data[5] == 'B' && Data[6] == 'C' && Data[7] == 'D') {
     static int c;
     if (!c)
       fprintf(stderr, "ZZZZZZZ\n");
     c = 1;
-    Result[42]++;
+    Result[2]++;
   }
 
   LLVMFuzzerAnnounceOutput(Result, Size);
diff --git a/llvm/lib/Fuzzer/test/equivalence.test b/llvm/lib/Fuzzer/test/equivalence.test
new file mode 100644
index 00000000000..26d75a35ae0
--- /dev/null
+++ b/llvm/lib/Fuzzer/test/equivalence.test
@@ -0,0 +1,5 @@
+RUN: LLVMFuzzer-EquivalenceATest -run_equivalence_server=EQUIV_TEST & export APID=$!
+RUN: not LLVMFuzzer-EquivalenceBTest -use_equivalence_server=EQUIV_TEST 2>&1 | FileCheck %s
+CHECK: ERROR: libFuzzer: equivalence-mismatch. Sizes: {{.*}}; offset 2
+CHECK: SUMMARY: libFuzzer: equivalence-mismatch
+RUN: kill -9 $APID