summaryrefslogtreecommitdiffstats
path: root/compiler-rt/lib/fuzzer
diff options
context:
space:
mode:
Diffstat (limited to 'compiler-rt/lib/fuzzer')
-rw-r--r--compiler-rt/lib/fuzzer/FuzzerLoop.cpp81
1 files changed, 44 insertions, 37 deletions
diff --git a/compiler-rt/lib/fuzzer/FuzzerLoop.cpp b/compiler-rt/lib/fuzzer/FuzzerLoop.cpp
index 58e8168d16b..d3ac4ce7ee9 100644
--- a/compiler-rt/lib/fuzzer/FuzzerLoop.cpp
+++ b/compiler-rt/lib/fuzzer/FuzzerLoop.cpp
@@ -135,10 +135,11 @@ Fuzzer::Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD,
memset(BaseSha1, 0, sizeof(BaseSha1));
}
-Fuzzer::~Fuzzer() { }
+Fuzzer::~Fuzzer() {}
void Fuzzer::AllocateCurrentUnitData() {
- if (CurrentUnitData || MaxInputLen == 0) return;
+ if (CurrentUnitData || MaxInputLen == 0)
+ return;
CurrentUnitData = new uint8_t[MaxInputLen];
}
@@ -148,7 +149,8 @@ void Fuzzer::StaticDeathCallback() {
}
void Fuzzer::DumpCurrentUnit(const char *Prefix) {
- if (!CurrentUnitData) return; // Happens when running individual inputs.
+ if (!CurrentUnitData)
+ return; // Happens when running individual inputs.
MD.PrintMutationSequence();
Printf("; base unit: %s\n", Sha1ToString(BaseSha1).c_str());
size_t UnitSize = CurrentUnitSize;
@@ -201,7 +203,7 @@ void Fuzzer::CrashCallback() {
Printf("SUMMARY: libFuzzer: deadly signal\n");
DumpCurrentUnit("crash-");
PrintFinalStats();
- _Exit(Options.ErrorExitCode); // Stop right now.
+ _Exit(Options.ErrorExitCode); // Stop right now.
}
void Fuzzer::ExitCallback() {
@@ -216,11 +218,10 @@ void Fuzzer::ExitCallback() {
_Exit(Options.ErrorExitCode);
}
-
void Fuzzer::InterruptCallback() {
Printf("==%lu== libFuzzer: run interrupted; exiting\n", GetPid());
PrintFinalStats();
- _Exit(0); // Stop right now, don't perform any at-exit actions.
+ _Exit(0); // Stop right now, don't perform any at-exit actions.
}
NO_SANITIZE_MEMORY
@@ -228,7 +229,8 @@ void Fuzzer::AlarmCallback() {
assert(Options.UnitTimeoutSec > 0);
// In Windows Alarm callback is executed by a different thread.
#if !LIBFUZZER_WINDOWS
- if (!InFuzzingThread()) return;
+ if (!InFuzzingThread())
+ return;
#endif
if (!RunningCB)
return; // We have not started running units yet.
@@ -274,11 +276,11 @@ void Fuzzer::PrintStats(const char *Where, const char *End, size_t Units) {
if (size_t N = TPC.GetTotalPCCoverage())
Printf(" cov: %zd", N);
if (size_t N = Corpus.NumFeatures())
- Printf( " ft: %zd", N);
+ Printf(" ft: %zd", N);
if (!Corpus.empty()) {
Printf(" corp: %zd", Corpus.NumActiveUnits());
if (size_t N = Corpus.SizeInBytes()) {
- if (N < (1<<14))
+ if (N < (1 << 14))
Printf("/%zdb", N);
else if (N < (1 << 24))
Printf("/%zdKb", N >> 10);
@@ -301,7 +303,8 @@ void Fuzzer::PrintFinalStats() {
TPC.DumpCoverage();
if (Options.PrintCorpusStats)
Corpus.PrintStats();
- if (!Options.PrintFinalStats) return;
+ if (!Options.PrintFinalStats)
+ return;
size_t ExecPerSec = execPerSec();
Printf("stat::number_of_executed_units: %zd\n", TotalNumberOfRuns);
Printf("stat::average_exec_per_sec: %zd\n", ExecPerSec);
@@ -330,7 +333,8 @@ void Fuzzer::CheckExitOnSrcPosOrItem() {
if (!Options.ExitOnSrcPos.empty()) {
static auto *PCsSet = new Set<uintptr_t>;
auto HandlePC = [&](uintptr_t PC) {
- if (!PCsSet->insert(PC).second) return;
+ if (!PCsSet->insert(PC).second)
+ return;
std::string Descr = DescribePC("%F %L", PC + 1);
if (Descr.find(Options.ExitOnSrcPos) != std::string::npos) {
Printf("INFO: found line matching '%s', exiting.\n",
@@ -350,7 +354,8 @@ void Fuzzer::CheckExitOnSrcPosOrItem() {
}
void Fuzzer::RereadOutputCorpus(size_t MaxSize) {
- if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec) return;
+ if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec)
+ return;
Vector<Unit> AdditionalCorpus;
ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus,
&EpochOfLastReadOfOutputCorpus, MaxSize,
@@ -388,7 +393,8 @@ void Fuzzer::PrintPulseAndReportSlowInput(const uint8_t *Data, size_t Size) {
bool Fuzzer::RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile,
InputInfo *II) {
- if (!Size) return false;
+ if (!Size)
+ return false;
ExecuteCallback(Data, Size);
@@ -512,11 +518,10 @@ void Fuzzer::PrintStatusForNewUnit(const Unit &U, const char *Text) {
void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) {
II->NumSuccessfullMutations++;
MD.RecordSuccessfulMutationSequence();
- PrintStatusForNewUnit(U, II->Reduced ? "REDUCE" :
- "NEW ");
+ PrintStatusForNewUnit(U, II->Reduced ? "REDUCE" : "NEW ");
WriteToOutputCorpus(U);
NumberOfNewUnitsAdded++;
- CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus.
+ CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus.
LastCorpusUpdateRun = TotalNumberOfRuns;
LastCorpusUpdateTime = system_clock::now();
}
@@ -525,19 +530,23 @@ void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) {
// executed before calling this function.
void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
bool DuringInitialCorpusExecution) {
- if (!HasMoreMallocsThanFrees) return; // mallocs==frees, a leak is unlikely.
- if (!Options.DetectLeaks) return;
+ if (!HasMoreMallocsThanFrees)
+ return; // mallocs==frees, a leak is unlikely.
+ if (!Options.DetectLeaks)
+ return;
if (!DuringInitialCorpusExecution &&
- TotalNumberOfRuns >= Options.MaxNumberOfRuns) return;
+ TotalNumberOfRuns >= Options.MaxNumberOfRuns)
+ return;
if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) ||
!(EF->__lsan_do_recoverable_leak_check))
- return; // No lsan.
+ return; // No lsan.
// Run the target once again, but with lsan disabled so that if there is
// a real leak we do not report it twice.
EF->__lsan_disable();
ExecuteCallback(Data, Size);
EF->__lsan_enable();
- if (!HasMoreMallocsThanFrees) return; // a leak is unlikely.
+ if (!HasMoreMallocsThanFrees)
+ return; // a leak is unlikely.
if (NumberOfLeakDetectionAttempts++ > 1000) {
Options.DetectLeaks = false;
Printf("INFO: libFuzzer disabled leak detection after every mutation.\n"
@@ -558,7 +567,7 @@ void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
CurrentUnitSize = Size;
DumpCurrentUnit("leak-");
PrintFinalStats();
- _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on.
+ _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on.
}
}
@@ -599,20 +608,16 @@ void Fuzzer::MutateAndTestOne() {
}
void Fuzzer::PurgeAllocator() {
- if (Options.PurgeAllocatorIntervalSec < 0 ||
- !EF->__sanitizer_purge_allocator) {
+ if (Options.PurgeAllocatorIntervalSec < 0 || !EF->__sanitizer_purge_allocator)
return;
- }
if (duration_cast<seconds>(system_clock::now() -
- LastAllocatorPurgeAttemptTime).count() <
- Options.PurgeAllocatorIntervalSec) {
+ LastAllocatorPurgeAttemptTime)
+ .count() < Options.PurgeAllocatorIntervalSec)
return;
- }
if (Options.RssLimitMb <= 0 ||
- GetPeakRSSMb() > static_cast<size_t>(Options.RssLimitMb) / 2) {
+ GetPeakRSSMb() > static_cast<size_t>(Options.RssLimitMb) / 2)
EF->__sanitizer_purge_allocator();
- }
LastAllocatorPurgeAttemptTime = system_clock::now();
}
@@ -671,7 +676,6 @@ void Fuzzer::ReadAndExecuteSeedCorpora(const Vector<std::string> &CorpusDirs) {
}
}
-
PrintStats("INITED");
if (Corpus.empty()) {
Printf("ERROR: no interesting inputs were found. "
@@ -696,13 +700,14 @@ void Fuzzer::Loop(const Vector<std::string> &CorpusDirs) {
}
if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
break;
- if (TimedOut()) break;
+ if (TimedOut())
+ break;
// Update TmpMaxMutationLen
if (Options.ExperimentalLenControl) {
if (TmpMaxMutationLen < MaxMutationLen &&
- (TotalNumberOfRuns - LastCorpusUpdateRun > 1000 &&
- duration_cast<seconds>(Now - LastCorpusUpdateTime).count() >= 1)) {
+ (TotalNumberOfRuns - LastCorpusUpdateRun > 1000 &&
+ duration_cast<seconds>(Now - LastCorpusUpdateTime).count() >= 1)) {
LastCorpusUpdateRun = TotalNumberOfRuns;
LastCorpusUpdateTime = Now;
TmpMaxMutationLen =
@@ -727,7 +732,8 @@ void Fuzzer::Loop(const Vector<std::string> &CorpusDirs) {
}
void Fuzzer::MinimizeCrashLoop(const Unit &U) {
- if (U.size() <= 1) return;
+ if (U.size() <= 1)
+ return;
while (!TimedOut() && TotalNumberOfRuns < Options.MaxNumberOfRuns) {
MD.StartMutationSequence();
memcpy(CurrentUnitData, U.data(), U.size());
@@ -756,7 +762,8 @@ void Fuzzer::AnnounceOutput(const uint8_t *Data, size_t Size) {
if (Data[i] != OtherData[i])
break;
Printf("==%lu== ERROR: libFuzzer: equivalence-mismatch. Sizes: %zd %zd; "
- "offset %zd\n", GetPid(), Size, OtherSize, i);
+ "offset %zd\n",
+ GetPid(), Size, OtherSize, i);
DumpCurrentUnit("mismatch-");
Printf("SUMMARY: libFuzzer: equivalence-mismatch\n");
PrintFinalStats();
@@ -779,4 +786,4 @@ void LLVMFuzzerAnnounceOutput(const uint8_t *Data, size_t Size) {
assert(fuzzer::F);
fuzzer::F->AnnounceOutput(Data, Size);
}
-} // extern "C"
+} // extern "C"
OpenPOWER on IntegriCloud