summaryrefslogtreecommitdiffstats
path: root/compiler-rt/lib/fuzzer
Commit message (Collapse)AuthorAgeFilesLines
* [compiler-rt] [fuzzer] Include stdarg.h for va_listKamil Rytarowski2019-12-191-0/+1
| | | | Fixes build on NetBSD after 139e216e6610091b7ee3c30bc11114f5d73cbd3e.
* [compiler-rt] libFuzzer: update -merge_control_file= help message.Max Moroz2019-12-121-1/+2
| | | | | | | | | | | | | | | | Summary: The motivation for this change is to have a distinguisher in libFuzzer that would let the runner know whether multistep merge is supported or not by a particular fuzz target binary. Otherwise, multistep merge fails to execute with older version of libFuzzer, and there is no way to verify that easily. Reviewers: kcc Subscribers: dberris, #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D71423
* [fuzzer] Add basic support for emscripten.Jonathan Metzman2019-12-126-7/+29
| | | | | | | | | | | | | | | | | | | | | | | Summary: Add basic support for emscripten. This enables libFuzzer to build (using build.sh) for emscripten and fuzz a target compiled with -fsanitize-coverage=inline-8bit-counters. Basic fuzzing and bug finding work with this commit. RSS limit and timeouts will not work because they depend on system functions that are not implemented/widely supported in emscripten. Reviewers: kcc, vitalybuka, hctim Reviewed By: hctim Subscribers: #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D71285
* [libFuzzer] don't use /dev/null for DiscardOuput in Fuchsia.Marco Vanotti2019-11-218-18/+42
| | | | | | | | | | | | | | | | | | | | | | | | Summary: This commit moves the `DiscardOutput` function in FuzzerIO to FuzzerUtil, so fuchsia can have its own specialized version. In fuchsia, accessing `/dev/null` is not supported, and there's nothing similar to a file that discards everything that is written to it. The way of doing something similar in fuchsia is by using `fdio_null_create` and binding that to a file descriptor with `fdio_bind_to_fd`. This change should fix one of the issues with the `-close_fd_mask` flag in libfuzzer, in which closing stdout was not working due to `fopen("/dev/null", "w")` returning `NULL`. Reviewers: kcc, aarongreen Subscribers: #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D69593
* [libFuzzer] Fix unwinding for FuchsiaMarco Vanotti2019-11-211-16/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This commit fixes part of the issues with stack unwinding in fuchsia for arm64 and x86_64. It consists of multiple fixes: (1) The cfa_offset calculation was wrong, instead of pointing to the previous stack pointer, it was pointing to the current one. It worked in most of the cases because the crashing functions already had a prologue and had their cfa information relative to another register. The fix consists on adding a constant that can be used to calculate the crashing function's stack pointer, and base all the cfi information relative to that offset. (2) (arm64) Due to errors with the syntax for the dwarf information, most of the `OP_NUM` macros were not working. The problem was that they were referred to as `r##NUM` (like `r14`), when it should have been `x##num` (like `x14`), or even without the x. (3) (arm64) The link register was being considered a part of the main registers (`r30`), when in the real struct it has its own field. Given that the link register is in the same spot in the struct as r[30] would be, and that C++ doesn't care about anything, the calculation was still correct. (4) (x86_64) The stack doesn't need to be aligned to 16 bytes when we jump to the trampoline function, but it needs to be before performing call instructions. Encoding that logic in cfi information was tricky, so we decided to make the cfa information relative to `rbp` and align `rsp`. Note that this could have been done using another register directly, but it seems cleaner to make a new fake stack frame. There are some other minor changes like adding a `brk 1` instruction in arm64 to make sure that we never return to the crash trampoline (similar to what we do in x86_64). Sadly this commit does not fix unwinding for all use cases for arm64. Crashing functions that do not add information related to the return column in their cfi information will fail to unwind due to a bug in libunwinder. Reviewers: mcgrathr, jakehehrlich, phosek, kcc, aarongreen Subscribers: aprantl, kristof.beyls, #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D69579
* [libFuzzer] Fix fd check in DupAndCloseStderr.Marco Vanotti2019-11-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This commit fixes the check in the return value from the `DuplicateFile` function, which returns a new file descriptor. `DuplicateFile` can return 0 if that file descriptor is available (for example, if stdin has already been closed). In particular, this could cause a bug with the `-close_fd_mask` flag in some platforms: just call the fuzzer with stdin closed and the `-close_fd_mask=2` flag, and stderr will not be muted. Example fuzzer: ``` extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) { fprintf(stderr, "STDERR\n"); fprintf(stdout, "STDOUT\n"); return 0; } ``` Invocation (muting both stderr and stdout): ``` ./test -close_fd_mask=3 -runs=1 0<&- INFO: Seed: 1155116940 INFO: Loaded 1 modules (1 inline 8-bit counters): 1 [0x48b020, 0x48b021), INFO: Loaded 1 PC tables (1 PCs): 1 [0x478dc8,0x478dd8), INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes STDERR INFO: A corpus is not provided, starting from an empty corpus STDERR Done 2 runs in 0 second(s) ``` Reviewers: mcgrathr, jakehehrlich, phosek, kcc, aarongreen Subscribers: #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D68775
* Disable exceptions in libfuzzer's copy of libcxxabi.Evgenii Stepanov2019-11-011-0/+1
| | | | | External project configuration for libcxxabi now has exceptions on by default, but this is not needed for libfuzzer.
* [libc++] Force the ABI namespace to be a reserved identifierLouis Dionne2019-10-291-1/+1
| | | | | | | | | | | | | | | | Summary: When the ABI namespace isn't a reserved identifier, we were issuing a warning, but this should have been an error since the beginning. This commit enforces that the ABI namespace is a reserved identifier, and changes the ABI namespace used by LibFuzzer. Reviewers: phosek, EricWF Subscribers: mgorny, christof, jkorous, dexonsmith, #sanitizers, libcxx-commits, llvm-commits Tags: #sanitizers, #libc, #llvm Differential Revision: https://reviews.llvm.org/D69408
* [libFuzzer] Enable extra counters for Fuchsia.Matt Morehouse2019-10-251-1/+1
|
* [libFuzzer] Don't prefix absolute paths in fuchsia.Jake Ehrlich2019-10-111-5/+6
| | | | | | | | | | | | | | | | | | | | | | | The ExecuteCommand function in fuchsia used to prefix the getOutputFile for each command run with the artifact_prefix flag if it was available, because fuchsia components don't have a writable working directory. However, if a file with a global path is provided, fuchsia should honor that. An example of this is using the global /tmp directory to store stuff. In fuchsia it ended up being translated to data///tmp, whereas we want to make sure it is using /tmp (which is available to components using the isolated-temp feature). To test this I made the change, compiled fuchsia with this toolchain and ran a fuzzer with the -fork=1 flag (that mode makes use of the /tmp directory). I also tested that normal fuzzing workflow was not affected by this. Author: charco (Marco Vanotti) Differential Revision: https://reviews.llvm.org/D68774 llvm-svn: 374612
* [libFuzzer] Fix Alarm callback in fuchsia.Jake Ehrlich2019-10-091-2/+2
| | | | | | | | | | | | | | | | This patch adds an #if macro to skip the InFuzzingThread() comparison for fuchsia, similar to what it is done for Windows and NetBSD. In fuchsia, the alarm callback runs in a separate thread[0], making it fail the comparison InFuzzingThread(), breaking the -timeout flag. [0]: https://github.com/llvm/llvm-project/blob/master/compiler-rt/lib/fuzzer/FuzzerUtilFuchsia.cpp#L323 Author: charco (aka Marco Vanotti) Differential Revision: https://reviews.llvm.org/D68166 llvm-svn: 374228
* [libFuzzer] Remove lazy counters.Matt Morehouse2019-10-0110-67/+0
| | | | | | | | | | | | | | | | Summary: Lazy counters haven't improved performance for large fuzz targets. Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits Tags: #llvm Differential Revision: https://reviews.llvm.org/D67476 llvm-svn: 373403
* [libFuzzer] Dump trace and provide correct msg for overwritten input.Mitch Phillips2019-09-271-1/+3
| | | | | | | | | | | | | | | | | | Summary: Now crashes with a stacktrace and uses 'overwrites-const-input' as the error message instead of 'out-of-memory'. Reviewers: morehouse, Dor1s Reviewed By: morehouse, Dor1s Subscribers: #sanitizers, llvm-commits, metzman, Dor1s Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D68067 llvm-svn: 373130
* [libFuzzer] [NFC] Fix grammar error with "it's"Mitch Phillips2019-09-261-1/+1
| | | | llvm-svn: 372937
* [libFuzzer] Always print DSO map on Fuchsia libFuzzer launchJake Ehrlich2019-09-172-0/+12
| | | | | | | | | | | | | | | | Fuchsia doesn't have /proc/id/maps, so it relies on the kernel logging system to provide the DSO map to be able to symbolize in the context of ASLR. The DSO map is logged automatically on Fuchsia when encountering a crash or writing to the sanitizer log for the first time in a process. There are several cases where libFuzzer doesn't encounter a crash, e.g. on timeouts, OOMs, and when configured to print new PCs as they become covered, to name a few. Therefore, this change always writes to the sanitizer log on startup to ensure the DSO map is available in the log. Author: aarongreen Differential Revision: https://reviews.llvm.org/D66233 llvm-svn: 372056
* [libFuzzer] Remove unused version of FuzzedDataProvider.h.Max Moroz2019-09-161-247/+0
| | | | | | | | | | | | | | | | Summary: The actual version lives in compiler-rt/include/fuzzer/. Reviewers: Dor1s Reviewed By: Dor1s Subscribers: delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D67623 llvm-svn: 371997
* [libFuzzer] Make -merge=1 to reuse coverage information from the control file.Max Moroz2019-09-112-21/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This change allows to perform corpus merging in two steps. This is useful when the user wants to address the following two points simultaneously: 1) Get trustworthy incremental stats for the coverage and corpus size changes when adding new corpus units. 2) Make sure the shorter units will be preferred when two or more units give the same unique signal (equivalent to the `REDUCE` logic). This solution was brainstormed together with @kcc, hopefully it looks good to the other people too. The proposed use case scenario: 1) We have a `fuzz_target` binary and `existing_corpus` directory. 2) We do fuzzing and write new units into the `new_corpus` directory. 3) We want to merge the new corpus into the existing corpus and satisfy the points mentioned above. 4) We create an empty directory `merged_corpus` and run the first merge step: ` ./fuzz_target -merge=1 -merge_control_file=MCF ./merged_corpus ./existing_corpus ` this provides the initial stats for `existing_corpus`, e.g. from the output: ` MERGE-OUTER: 3 new files with 11 new features added; 11 new coverage edges ` 5) We recreate `merged_corpus` directory and run the second merge step: ` ./fuzz_target -merge=1 -merge_control_file=MCF ./merged_corpus ./existing_corpus ./new_corpus ` this provides the final stats for the merged corpus, e.g. from the output: ` MERGE-OUTER: 6 new files with 14 new features added; 14 new coverage edges ` Alternative solutions to this approach are: A) Store precise coverage information for every unit (not only unique signal). B) Execute the same two steps without reusing the control file. Either of these would be suboptimal as it would impose an extra disk or CPU load respectively, which is bad given the quadratic complexity in the worst case. Tested on Linux, Mac, Windows. Reviewers: morehouse, metzman, hctim, kcc Reviewed By: morehouse Subscribers: JDevlieghere, delcypher, mgrang, #sanitizers, llvm-commits, kcc Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D66107 llvm-svn: 371620
* LibFuzzer support for 32bit MSVCMatthew G McGovern2019-08-221-4/+18
| | | | | | | | | This fixes the two build errors when trying to compile LibFuzzer for 32bit with MSVC. - authored by Max Shavrick (mxms at microsoft) llvm-svn: 369704
* reland [gtest] Fix printing of StringRef and SmallString in assert messages.Sam McCall2019-08-211-2/+2
| | | | | | | | | Renames GTEST_NO_LLVM_RAW_OSTREAM -> GTEST_NO_LLVM_SUPPORT and guards the new features behind it. This reverts commit a063bcf3ef5a879adbe9639a3c187d876eee0e66. llvm-svn: 369527
* [libFuzzer] Merge: print feature coverage number as well.Max Moroz2019-08-123-6/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: feature coverage is a useful signal that is available during the merge process, but was not printed previously. Output example: ``` $ ./fuzzer -use_value_profile=1 -merge=1 new_corpus/ seed_corpus/ INFO: Seed: 1676551929 INFO: Loaded 1 modules (2380 inline 8-bit counters): 2380 [0x90d180, 0x90dacc), INFO: Loaded 1 PC tables (2380 PCs): 2380 [0x684018,0x68d4d8), MERGE-OUTER: 180 files, 78 in the initial corpus MERGE-OUTER: attempt 1 INFO: Seed: 1676574577 INFO: Loaded 1 modules (2380 inline 8-bit counters): 2380 [0x90d180, 0x90dacc), INFO: Loaded 1 PC tables (2380 PCs): 2380 [0x684018,0x68d4d8), INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 1048576 bytes MERGE-INNER: using the control file '/tmp/libFuzzerTemp.111754.txt' MERGE-INNER: 180 total files; 0 processed earlier; will process 180 files now #1 pulse cov: 134 ft: 330 exec/s: 0 rss: 37Mb #2 pulse cov: 142 ft: 462 exec/s: 0 rss: 38Mb #4 pulse cov: 152 ft: 651 exec/s: 0 rss: 38Mb #8 pulse cov: 152 ft: 943 exec/s: 0 rss: 38Mb #16 pulse cov: 520 ft: 2783 exec/s: 0 rss: 39Mb #32 pulse cov: 552 ft: 3280 exec/s: 0 rss: 41Mb #64 pulse cov: 576 ft: 3641 exec/s: 0 rss: 50Mb #78 LOADED cov: 602 ft: 3936 exec/s: 0 rss: 88Mb #128 pulse cov: 611 ft: 3996 exec/s: 0 rss: 93Mb #180 DONE cov: 611 ft: 4016 exec/s: 0 rss: 155Mb MERGE-OUTER: succesfull in 1 attempt(s) MERGE-OUTER: the control file has 39741 bytes MERGE-OUTER: consumed 0Mb (37Mb rss) to parse the control file MERGE-OUTER: 9 new files with 80 new features added; 9 new coverage edges ``` Reviewers: hctim, morehouse Reviewed By: morehouse Subscribers: delcypher, #sanitizers, llvm-commits, kcc Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D66030 llvm-svn: 368617
* [libFuzzer] Merge: print stats after reading the output corpus dir.Max Moroz2019-08-091-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | Summary: The purpose is to be able to extract the number of new edges added to the original (i.e. output) corpus directory after doing the merge. Use case example: in ClusterFuzz, we do merge after every fuzzing session, to avoid uploading too many corpus files, and we also record coverage stats at that point. Having a separate line indicating stats after reading the initial output corpus directory would make the stats extraction easier for both humans and parsing scripts. Context: https://github.com/google/clusterfuzz/issues/802. Reviewers: morehouse, hctim Reviewed By: hctim Subscribers: delcypher, #sanitizers, llvm-commits, kcc Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D66020 llvm-svn: 368461
* [compiler-rt] Add ConsumeProbability and ConsumeFloatingPoint methods to FDP.Max Moroz2019-08-083-3/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: Also slightly cleaned up the comments and changed the header's extension back to `.h` as per comments on https://reviews.llvm.org/D65812. New methods added: * `ConsumeProbability` returns [0.0, 1.0] by consuming an unsigned integer value from the input data and dividing that value by the integer's max value. * `ConsumeFloatingPointInRange` returns a floating point value in the given range. Relies on `ConsumeProbability` method. This method does not have the limitation of `std::uniform_real_distribution` that requires the given range to be <= the floating point type's max. If the range is too large, this implementation will additionally call `ConsumeBool` to decide whether the result will be in the first or the second half of the range. * `ConsumeFloatingPoint` returns a floating point value in the range `[std::numeric_limits<T>::lowest(), std::numeric_limits<T>::min()]`. Tested on Linux, Mac, Windows. Reviewers: morehouse Reviewed By: morehouse Subscribers: kubamracek, mgorny, dberris, delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D65905 llvm-svn: 368331
* [compiler-rt] Rename FuzzedDataProvider.h to .hpp and other minor changes.Max Moroz2019-08-062-1/+3
| | | | | | | | | | | | | | | | | | Summary: .hpp makes more sense for this header as it's C++ only, plus it contains the actual implementation. Reviewers: Dor1s Reviewed By: Dor1s Subscribers: kubamracek, dberris, mgorny, delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D65812 llvm-svn: 368054
* Build libfuzzer libcxx-static with PICYi Kong2019-08-051-0/+1
| | | | | | | | | | r356153 changed default build option of static libcxx to no PIC. We now need to explicitly specify CMAKE_POSITION_INDEPENDENT_CODE to get PIC libcxx. Differential Revision: https://reviews.llvm.org/D65773 llvm-svn: 367943
* [compiler-rt] Move FDP to include/fuzzer/FuzzedDataProvider.h for easier use.Max Moroz2019-08-054-9/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: FuzzedDataProvider is a helper class for writing fuzz targets that fuzz multple inputs simultaneously. The header is supposed to be used for fuzzing engine agnostic fuzz targets (i.e. the same target can be used with libFuzzer, AFL, honggfuzz, and other engines). The common thing though is that fuzz targets are typically compiled with clang, as it provides all sanitizers as well as different coverage instrumentation modes. Therefore, making this FDP class a part of the compiler-rt installation package would make it easier to develop and distribute fuzz targets across different projects, build systems, etc. Some context also available in https://github.com/google/oss-fuzz/pull/2547. This CL does not delete the header from `lib/fuzzer/utils` directory in order to provide the downstream users some time for a smooth migration to the new header location. Reviewers: kcc, morehouse Reviewed By: morehouse Subscribers: lebedev.ri, kubamracek, dberris, mgorny, delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D65661 llvm-svn: 367917
* compiler-rt: Rename .cc file in lib/sanitizer_common to .cppNico Weber2019-07-311-1/+1
| | | | | | | | | | | See https://reviews.llvm.org/D58620 for discussion, and for the commands I ran. In addition I also ran for f in $(svn diff | diffstat | grep .cc | cut -f 2 -d ' '); do rg $f . ; done and manually updated (many) references to renamed files found by that. llvm-svn: 367463
* [libFuzzer] Fix __sanitizer_print_memory_profile return type in ExtFunctions.defMax Moroz2019-07-231-1/+1
| | | | | | | | | | | | | | | | | | Summary: Looks like a typo, as that function actually returns void and is used as such in libFuzzer code as well. Reviewers: kcc, Dor1s Reviewed By: Dor1s Subscribers: delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D65160 llvm-svn: 366834
* [libFuzzer] Include FuzzedDataProvider.h in the test without "utils" subdir.Max Moroz2019-07-092-1/+3
| | | | | | | | | | | | | | | | | | Summary: This way the test would better match the intended usage of the header, plus it makes some additional testing (e.g. in CI) a bit easier to set up. Reviewers: morehouse Reviewed By: morehouse Subscribers: mgorny, delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D64440 llvm-svn: 365544
* [libFuzzer] Migrate to the new exception syscalls on FuchsiaPetr Hosek2019-06-271-26/+28
| | | | | | | | | This is part of the transition to the new Fuchsia exception syscalls signature. Differential Revision: https://reviews.llvm.org/D63897 llvm-svn: 364594
* [libFuzzer] split DataFlow.cpp into two .cpp files, one of which can be ↵Kostya Serebryany2019-06-213-100/+147
| | | | | | compiled w/o dfsan to speed things up (~25% speedup) llvm-svn: 364002
* [libFuzzer] ensure that DFT and autofocus works for C++ (mangled) functionsKostya Serebryany2019-06-201-1/+3
| | | | llvm-svn: 363905
* [libFuzzer] Remove too aggressive static_assert in FuzzedDataProvider.Max Moroz2019-06-191-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: http://lab.llvm.org:8011/builders/clang-cmake-aarch64-full/builds/31 error: static_assert failed due to requirement 'std::numeric_limits<char>::is_signed' "Destination type must be signed." static_assert(std::numeric_limits<TS>::is_signed, ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /home/buildslave/buildslave/clang-cmake-aarch64-full/llvm/projects/compiler-rt/lib/fuzzer/utils/FuzzedDataProvider.h:126:19: note: in instantiation of function template specialization 'FuzzedDataProvider::ConvertUnsignedToSigned<char, unsigned char>' requested here char next = ConvertUnsignedToSigned<char>(data_ptr_[0]); ^ 1 error generated. Reviewers: Dor1s Reviewed By: Dor1s Subscribers: javed.absar, kristof.beyls, delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D63553 llvm-svn: 363805
* [libFuzzer] Improve FuzzedDataProvider helper.Max Moroz2019-06-182-65/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: The following changes are made based on the feedback from Tim King: - Removed default template parameters, to have less assumptions. - Implemented `ConsumeBytesWithTerminator` method. - Made `PickValueInArray` method work with `initializer_list` argument. - Got rid of `data_type` type alias, that was redundant. - Refactored `ConsumeBytes` logic into a private method for better code reuse. - Replaced implementation defined unsigned to signed conversion. - Fixed `ConsumeRandomLengthString` to always call `shrink_to_fit`. - Clarified and fixed some commments. - Applied clang-format to both the library and the unittest source. Tested on Linux, Mac, Windows. Reviewers: morehouse, metzman Reviewed By: morehouse Subscribers: delcypher, #sanitizers, llvm-commits, kcc Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D63348 llvm-svn: 363735
* [libFuzzer] in autofocus mode, give more weight to functions with DFTKostya Serebryany2019-06-143-5/+21
| | | | llvm-svn: 363473
* [libFuzzer] implement a better queue for the fork mode. Add an internal flag ↵Kostya Serebryany2019-06-145-34/+57
| | | | | | -stop_file to allow graceful shutdown of fuzzing. Enhance the logging in the fork mode llvm-svn: 363470
* [libFuzzer] fix -Werror buildKostya Serebryany2019-06-141-1/+1
| | | | llvm-svn: 363469
* [libFuzzer] simplify the DFT trace collection using the new faster DFSan ↵Kostya Serebryany2019-06-143-136/+76
| | | | | | mode that traces up to 16 labels at a time and never runs out of labels. Second attempt. This time with a fix for windows (putenv instead of setenv)) llvm-svn: 363445
* [libFuzzer] Disable len_control by default if LLVMFuzzerCustomMutator is used.Max Moroz2019-06-142-3/+9
| | | | | | | | | | | | | | | | | | | | | | Summary: Some custom mutators may not peform well when size restriction is enforced by len_control. Because of that, it's safer to disable len_control by default in such cases, but still allow users to enable it manually. Bug example: https://bugs.chromium.org/p/chromium/issues/detail?id=919530. Tested manually with LPM-based and regular fuzz targets. Reviewers: kcc, vitalybuka, metzman Reviewed By: kcc, metzman Subscribers: delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D63334 llvm-svn: 363443
* Revert r363326 "[libFuzzer] simplify the DFT trace collection using the new ↵Hans Wennborg2019-06-143-75/+136
| | | | | | | | | | | | faster DFSan mode that traces up to 16 labels at a time and never runs out of labels." It broke the Windows build: C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\fuzzer\FuzzerDataFlowTrace.cpp(243): error C3861: 'setenv': identifier not found This also reverts the follow-up r363327. llvm-svn: 363358
* [libFuzzer] simplify the DFT trace collection using the new faster DFSan ↵Kostya Serebryany2019-06-133-136/+75
| | | | | | mode that traces up to 16 labels at a time and never runs out of labels. llvm-svn: 363326
* Add FuzzedDataProvider helper class / single header library.Max Moroz2019-06-113-2/+543
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This class is useful for writing fuzz target that have multiple inputs. Current CL imports the existing `FuzzedDataProvider` from Chromium without any modifications. Feel free to review it thoroughly, if you're interested, but I'd prefer changing the class in a follow up CL. The CL also introduces an exhaustive test for the library, as the behavior of `FuzzedDataProvider` must not change over time. In follow up CLs I'm planning on changing some implementation details (I can share a doc with some comments to be addressed). After that, we will document how `FuzzedDataProvider` should be used. I have tested this on Linux, Windows and Mac platforms. Reviewers: morehouse, metzman, kcc Reviewed By: morehouse Subscribers: metzman, thakis, rnk, mgorny, ormris, delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D62733 llvm-svn: 363071
* [libFuzzer] when using data-flow-trace (DFT) only load the DFT for the files ↵Kostya Serebryany2019-05-243-10/+17
| | | | | | present in the corpus llvm-svn: 361579
* [libFuzzer] remove the data-flow-trace (DFT) python scripts; their ↵Kostya Serebryany2019-05-233-143/+8
| | | | | | functionality is now part of libFuzzer proper; also write functions.txt to the disk only if this file doesn't exist yet llvm-svn: 361452
* [libFuzzer] automatically collect the data flow trace (DFT) in the fork mode ↵Kostya Serebryany2019-05-235-3/+41
| | | | | | if -collect_data_flow= is given llvm-svn: 361448
* [libFuzzer] Ignore synthetic exceptions on FuchsiaPetr Hosek2019-05-221-42/+58
| | | | | | | | | | | | | Fuchsia has several exceptions which are merely informational and should not be treated as crashes. This patch puts logic that read from the exception port and handled the exception in a loop, and ignores non-exceptions and informational exceptions. Patch By: aarongreen Differential Revision: https://reviews.llvm.org/D62226 llvm-svn: 361407
* [libFuzzer] replace string_view with string to fix the bots. This is NFC, ↵Kostya Serebryany2019-05-141-6/+7
| | | | | | just slower. llvm-svn: 360717
* [libFuzzer] #include <string_view>, hopefully should fix the windows build Kostya Serebryany2019-05-141-0/+1
| | | | llvm-svn: 360715
* [libFuzzer] reimplement DFT's collect_data_flow inside libFuzzer so that we ↵Kostya Serebryany2019-05-142-35/+146
| | | | | | don't need external python scripts llvm-svn: 360712
* [libFuzzer] code refactoring; NFCKostya Serebryany2019-05-105-45/+45
| | | | llvm-svn: 360400
* [libFuzzer] small refactoring in the driver; dummy implementation of ↵Kostya Serebryany2019-05-104-21/+44
| | | | | | collect_data_flow; attempt to fix the windows bot llvm-svn: 360399
OpenPOWER on IntegriCloud