summaryrefslogtreecommitdiffstats
path: root/compiler-rt/lib/fuzzer/FuzzerDefs.h
Commit message (Collapse)AuthorAgeFilesLines
* [fuzzer] Add basic support for emscripten.Jonathan Metzman2019-12-121-1/+17
| | | | | | | | | | | | | | | | | | | | | | | Summary: Add basic support for emscripten. This enables libFuzzer to build (using build.sh) for emscripten and fuzz a target compiled with -fsanitize-coverage=inline-8bit-counters. Basic fuzzing and bug finding work with this commit. RSS limit and timeouts will not work because they depend on system functions that are not implemented/widely supported in emscripten. Reviewers: kcc, vitalybuka, hctim Reviewed By: hctim Subscribers: #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D71285
* [libFuzzer] Make -merge=1 to reuse coverage information from the control file.Max Moroz2019-09-111-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This change allows to perform corpus merging in two steps. This is useful when the user wants to address the following two points simultaneously: 1) Get trustworthy incremental stats for the coverage and corpus size changes when adding new corpus units. 2) Make sure the shorter units will be preferred when two or more units give the same unique signal (equivalent to the `REDUCE` logic). This solution was brainstormed together with @kcc, hopefully it looks good to the other people too. The proposed use case scenario: 1) We have a `fuzz_target` binary and `existing_corpus` directory. 2) We do fuzzing and write new units into the `new_corpus` directory. 3) We want to merge the new corpus into the existing corpus and satisfy the points mentioned above. 4) We create an empty directory `merged_corpus` and run the first merge step: ` ./fuzz_target -merge=1 -merge_control_file=MCF ./merged_corpus ./existing_corpus ` this provides the initial stats for `existing_corpus`, e.g. from the output: ` MERGE-OUTER: 3 new files with 11 new features added; 11 new coverage edges ` 5) We recreate `merged_corpus` directory and run the second merge step: ` ./fuzz_target -merge=1 -merge_control_file=MCF ./merged_corpus ./existing_corpus ./new_corpus ` this provides the final stats for the merged corpus, e.g. from the output: ` MERGE-OUTER: 6 new files with 14 new features added; 14 new coverage edges ` Alternative solutions to this approach are: A) Store precise coverage information for every unit (not only unique signal). B) Execute the same two steps without reusing the control file. Either of these would be suboptimal as it would impose an extra disk or CPU load respectively, which is bad given the quadratic complexity in the worst case. Tested on Linux, Mac, Windows. Reviewers: morehouse, metzman, hctim, kcc Reviewed By: morehouse Subscribers: JDevlieghere, delcypher, mgrang, #sanitizers, llvm-commits, kcc Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D66107 llvm-svn: 371620
* Update the file headers across all of the LLVM projects in the monorepoChandler Carruth2019-01-191-4/+3
| | | | | | | | | | | | | | | | | to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636
* [libFuzzer][MSVC] Make attribute-use compatible with MSVCJonathan Metzman2019-01-171-13/+21
| | | | | | | | | | | | | | Summary: Replace attributes with macros that use equivalent declspecs for MSVC. Reviewers: vitalybuka Reviewed By: vitalybuka Differential Revision: https://reviews.llvm.org/D56512 llvm-svn: 351456
* [libfuzzer][MSVC] Make calls to builtin functions work with MSVCJonathan Metzman2019-01-091-5/+7
| | | | | | | | | | | | | | | | | | Summary: Replace calls to builtin functions with macros or functions that call the Windows-equivalents when targeting windows and call the original builtin functions everywhere else. This change makes more parts of libFuzzer buildable with MSVC. Reviewers: vitalybuka Reviewed By: vitalybuka Subscribers: mgorny, rnk, thakis Differential Revision: https://reviews.llvm.org/D56439 llvm-svn: 350766
* [libFuzzer] Port to WindowsMatt Morehouse2018-08-301-0/+7
| | | | | | | | | | | | | | | | | | | | Summary: Port libFuzzer to windows-msvc. This patch allows libFuzzer targets to be built and run on Windows, using -fsanitize=fuzzer and/or fsanitize=fuzzer-no-link. It allows these forms of coverage instrumentation to work on Windows as well. It does not fix all issues, such as those with -fsanitize-coverage=stack-depth, which is not usable on Windows as of this patch. It also does not fix any libFuzzer integration tests. Nearly all of them fail to compile, fixing them will come in a later patch, so libFuzzer tests are disabled on Windows until them. Patch By: metzman Reviewers: morehouse, rnk Reviewed By: morehouse, rnk Subscribers: #sanitizers, delcypher, morehouse, kcc, eraman Differential Revision: https://reviews.llvm.org/D51022 llvm-svn: 341082
* Revert "[libFuzzer] Port to Windows"Matt Morehouse2018-08-291-7/+0
| | | | | | This reverts r340949 due to bot breakage again. llvm-svn: 340954
* [libFuzzer] Port to WindowsMatt Morehouse2018-08-291-0/+7
| | | | | | | | | | | | | | | | | | Summary: Port libFuzzer to windows-msvc. This patch allows libFuzzer targets to be built and run on Windows, using -fsanitize=fuzzer and/or fsanitize=fuzzer-no-link. It allows these forms of coverage instrumentation to work on Windows as well. It does not fix all issues, such as those with -fsanitize-coverage=stack-depth, which is not usable on Windows as of this patch. It also does not fix any libFuzzer integration tests. Nearly all of them fail to compile, fixing them will come in a later patch, so libFuzzer tests are disabled on Windows until them. Reviewers: morehouse, rnk Reviewed By: morehouse, rnk Subscribers: #sanitizers, delcypher, morehouse, kcc, eraman Differential Revision: https://reviews.llvm.org/D51022 llvm-svn: 340949
* Revert "[libFuzzer] Port to Windows"Matt Morehouse2018-08-281-7/+0
| | | | | | This reverts commit r340860 due to failing tests. llvm-svn: 340867
* [libFuzzer] Port to WindowsMatt Morehouse2018-08-281-0/+7
| | | | | | | | | | | | | | | | | | | | Summary: Port libFuzzer to windows-msvc. This patch allows libFuzzer targets to be built and run on Windows, using -fsanitize=fuzzer and/or fsanitize=fuzzer-no-link. It allows these forms of coverage instrumentation to work on Windows as well. It does not fix all issues, such as those with -fsanitize-coverage=stack-depth, which is not usable on Windows as of this patch. It also does not fix any libFuzzer integration tests. Nearly all of them fail to compile, fixing them will come in a later patch, so libFuzzer tests are disabled on Windows until them. Patch By: metzman Reviewers: morehouse, rnk Reviewed By: morehouse, rnk Subscribers: morehouse, kcc, eraman Differential Revision: https://reviews.llvm.org/D51022 llvm-svn: 340860
* libFuzzer: prevent irrelevant strings from leaking into auto-dictionaryMatt Morehouse2018-07-171-6/+2
| | | | | | | | | | | | | | | | This is a fix for bug 37047. https://bugs.llvm.org/show_bug.cgi?id=37047 Implemented by basically reversing the logic. Previously all strings were considered, with some operations excluded. Now strings are excluded by default, and only strings during the CB considered. Patch By: pdknsk Differential Revision: https://reviews.llvm.org/D48800 llvm-svn: 337296
* Fix compile error with libstdc++.Ilya Biryukov2018-06-061-0/+5
| | | | | | | | | | By adding a ctor to create fuzzer_allocator<T> from fuzzer_allocator<U>. This mimics construcotrs of std::allocator<T>. Without the constructors, some versions of libstdc++ can't compile `vector<bool, fuzzer_allocator<bool>>`. llvm-svn: 334077
* [libFuzzer] remove the experimental support for clang coverage ↵Kostya Serebryany2018-05-101-4/+0
| | | | | | instrumentation. This mode has not been used and our experiments with https://github.com/google/fuzzer-test-suite show that this signal is weaker than the SanitizerCoverage llvm-svn: 332034
* libFuzzer, OpenBSD supportVitaly Buka2018-04-091-1/+17
| | | | | | | | | | | | | | | | | | Summary: - Enabling libfuzzer on OpenBSD - OpenBSD can t support asan, msan ... the tests can t be run. Patch by David CARLIER Reviewers: eugenis, phosek, vitalybuka Reviewed By: vitalybuka Subscribers: srhines, mgorny, krytarowski, llvm-commits, #sanitizers Differential Revision: https://reviews.llvm.org/D44877 llvm-svn: 329631
* lib Fuzzer FreeBSD supportKamil Rytarowski2018-01-121-1/+13
| | | | | | | | | | | | | | Summary: Patch by David CARLIER Reviewers: vitalybuka, kcc, dim, emaste, davide, morehouse, george.karpenkov Reviewed By: morehouse Subscribers: george.karpenkov, kubamracek, srhines, mgorny, emaste, krytarowski Differential Revision: https://reviews.llvm.org/D41642 llvm-svn: 322380
* [libFuzzer] Add support for Fuchsia OS.Matt Morehouse2017-12-081-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This patch adds the initial support for Fuchsia. - LIBFUZZER_FUCHSIA is added as an OS type in FuzzerDefs.h - Fuchsia is, by design, not POSIX compliant. However, it does use ELF and supports common POSIX I/O functions. Thus, FuzzerExtFunctions.h and FuzzerIO.h are implemented by extending the header guards in FuzzerExtFunctionsWeak.cpp and FuzzerIOPosix.cpp to include LIBFUZZER_FUCHSIA. - The platform-specific portions of FuzzerUtil.h are implemented by FuzzerUtilFuchsia.cpp, which makes use of exception ports, syscalls, and the launchpad library. - The experimental equivalence server is not currently supported, so FuzzerShmem.h is implemented by stub methods in FuzzerShmemFuchsia.cpp. Any future implementation will likely involve VMOs. Tested with ASAN/SanCov on Fuchsia/x86-64 with the canonical toy fuzzer. Patch By: aarongreen Reviewers: kcc, morehouse, flowerhack, phosek Reviewed By: kcc, phosek, Eugene.Zelenko Subscribers: srhines, mgorny, Eugene.Zelenko Differential Revision: https://reviews.llvm.org/D40974 llvm-svn: 320210
* Add preliminary NetBSD support in libfuzzerKamil Rytarowski2017-08-301-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | Summary: This code already works and passes some number of tests. There is need to finish remaining sanitizers to get better coverage. Many tests fail due to overly long file names of executables (>31). This is a current shortcoming of the NetBSD 8(beta) kernel, as certain functions can fail (like retrieving file name of executable). Sponsored by <The NetBSD Foundation> Reviewers: joerg, kcc, vitalybuka, george.karpenkov Reviewed By: kcc Subscribers: mgorny, llvm-commits, #sanitizers Tags: #sanitizers Differential Revision: https://reviews.llvm.org/D37304 llvm-svn: 312183
* [libFuzzer] Use custom allocators for STL containers in libFuzzer.George Karpenkov2017-08-271-2/+19
| | | | | | | | Avoids ODR violations causing spurious ASAN warnings. Differential Revision: https://reviews.llvm.org/D37086 llvm-svn: 311866
* Revert "[libFuzzer] Use custom allocators for STL containers in libFuzzer"George Karpenkov2017-08-261-15/+2
| | | | | | This reverts commit 3539efc2f2218dba2bcbd645d0fe276f2b5cf588. llvm-svn: 311831
* [libFuzzer] Use custom allocators for STL containers in libFuzzerGeorge Karpenkov2017-08-261-2/+15
| | | | | | | | Avoids ODR violations causing spurious ASAN container overflow warnings. Differential Revision: https://reviews.llvm.org/D37086 llvm-svn: 311830
* [libFuzzer] apply changes lost during the migration to compiler-rtKostya Serebryany2017-08-221-0/+4
| | | | llvm-svn: 311420
* Move libFuzzer to compiler_rt.George Karpenkov2017-08-211-0/+128
Resulting library binaries will be named libclang_rt.fuzzer*, and will be placed in Clang toolchain, allowing redistribution. Differential Revision: https://reviews.llvm.org/D36908 llvm-svn: 311407
OpenPOWER on IntegriCloud