summaryrefslogtreecommitdiffstats
path: root/llvm/lib/Fuzzer
Commit message (Collapse)AuthorAgeFilesLines
* [libFuzzer] add 'weak' back to __sanitizer_malloc_hook and __sanitizer_free_hookKostya Serebryany2016-06-081-0/+2
| | | | llvm-svn: 272116
* [libFuzzer] add a test that is built w/o coverage instrumentation but has ↵Kostya Serebryany2016-06-085-1/+27
| | | | | | the coverage rt (it should now fail with a descriptive message) llvm-svn: 272090
* [LibFuzzer] Declare and use sanitizer functions in ``fuzzer::ExternalFunctions``Dan Liew2016-06-078-73/+84
| | | | | | | | | | | | | | | | | | | | | | | This fixes linking problems on OSX. Unfortunately it turns out we need to use an instance of the ``fuzzer::ExternalFunctions`` object in several places so this commit also replaces all instances with a single global instance. It also turns out initializing a global ``fuzzer::ExternalFunctions`` before main is entered (i.e. letting the object be initialised by the global initializers) is not safe (on OSX the call to ``Printf()`` in the CTOR crashes if it is called from a global initializer) so we instead have a global ``fuzzer::ExternalFunctions*`` and initialize it inside ``FuzzerDriver()``. Multiple unit tests depend also depend on the ``fuzzer::ExternalFunctions*`` global so a ``main()`` function has been added that initializes it before running any tests. Differential Revision: http://reviews.llvm.org/D20943 llvm-svn: 272072
* [LibFuzzer] Split the fuzzer-oom.test into two tests.Dan Liew2016-06-073-1/+14
| | | | | | | | | | This is necessary because the existing fuzzer-oom.test was Linux specific due to its use of __sanitizer_print_memory_profile() which is only available on Linux right now and so the test would fail on OSX. Differential Revision: http://reviews.llvm.org/D20977 llvm-svn: 272061
* [libfuzzer] custom crossover interface function.Mike Aizatsky2016-06-077-0/+107
| | | | | | Differential Revision: http://reviews.llvm.org/D21089 llvm-svn: 272054
* [libfuzzer] prune_corpus option for disabling pruning during the load.Mike Aizatsky2016-06-075-1/+19
| | | | | | | | | | Summary: The option is very useful for testing, plus I intend to measure its effect on fuzzer effectiveness. Differential Revision: http://reviews.llvm.org/D21084 llvm-svn: 272035
* [LibFuzzer] s/dataflow sanitizer/DataflowSanitizer/Dan Liew2016-06-071-2/+2
| | | | llvm-svn: 271980
* [LibFuzzer] Disable building and running LSan tests on Apple platforms ↵Dan Liew2016-06-074-0/+18
| | | | | | | | because LSan is not currently supported. Differential Revision: http://reviews.llvm.org/D20947 llvm-svn: 271979
* [LibFuzzer] Provide stub implementation of __sanitizer_cov_trace_pc_indirDan Liew2016-06-061-1/+9
| | | | | | | | | | | | | Calls to this function are currently injected by the ``SanitizerCoverageModule`` pass when the both the ``indirect-calls`` and ``trace-pc`` sanitizer coverage options are enabled and the code being instrumented has indirect calls. Previously because LibFuzzer did not define this function this would lead to link errors when building some of the tests on OSX. Differential Revision: http://reviews.llvm.org/D20946 llvm-svn: 271938
* [libfuzzer] hiding custom mutator handling in MutationDispatcher.Mike Aizatsky2016-06-033-29/+60
| | | | | | | | Summary: Refactoring, no functional changes. Differential Revision: http://reviews.llvm.org/D20975 llvm-svn: 271740
* [libfuzzer] splitting fuzzer.testMike Aizatsky2016-06-0311-97/+99
| | | | llvm-svn: 271697
* [LibFuzzer] Disable compiling and running the LibFuzzer dataflow sanitizer ↵Dan Liew2016-06-024-1/+19
| | | | | | | | | | | tests on Apple platforms. This fixes a broken part of the build on OSX as the dataflow sanitizer is not supported on OSX yet. Differential Revision: http://reviews.llvm.org/D20894 llvm-svn: 271492
* [LibFuzzer] Reimplement how the optional user functions are called.Dan Liew2016-06-029-20/+171
| | | | | | | | | | | | | | | | | | | | | | | | | | The motivation for this change is to fix linking issues on OSX. However this only partially fixes linking issues (the uninstrumented tests and a few others won't succesfully link yet). This change introduces a struct of function pointers (``fuzzer::ExternalFuntions``) which when initialised will point to the optional functions if they are available. Currently these ``LLVMFuzzerInitialize`` and ``LLVMFuzzerCustomMutator`` functions. Two implementations of ``fuzzer::ExternalFunctions`` constructor are provided one for Linux and one for OSX. The OSX implementation uses ``dlsym()`` because the prior implementation using weak symbols does not work unless the additional flags are passed to the linker. The Linux implementation continues to use weak symbols because the ``dlsym()`` approach does not work unless additional flags are passed to the linker. Differential Revision: http://reviews.llvm.org/D20741 llvm-svn: 271491
* [libFuzzer] use __sanitizer_print_memory_profile to print the memory profile ↵Kostya Serebryany2016-06-022-1/+5
| | | | | | on OOM llvm-svn: 271465
* [libFuzzer] when an invalid flag is given, warn, but don't crashKostya Serebryany2016-06-012-2/+7
| | | | llvm-svn: 271404
* [libFuzzer] fix a use-after-free (!) in libFuzzer caused by r270905: that CL ↵Kostya Serebryany2016-05-292-5/+8
| | | | | | caused a push_back in the main corpus invalidating the vector<> iterators in rare cases. llvm-svn: 271186
* [libFuzzer] fix a failure that occurs when running individual inputsKostya Serebryany2016-05-281-0/+1
| | | | llvm-svn: 271095
* [libFuzzer] use __sanitizer_set_report_fd with -close_fd_mask. This allows ↵Kostya Serebryany2016-05-272-1/+9
| | | | | | us to keep asan reports when closing target's stderr llvm-svn: 271053
* Fix compilation with GCC, which treats this as a constructor name not a typeRichard Smith2016-05-271-1/+1
| | | | | | name. (GCC is correct here per the latest language DRs.) llvm-svn: 271044
* [LibFuzzer] Refactor declaration of tests in CMake.Dan Liew2016-05-276-115/+104
| | | | | | | | | | | | | | | | | | Add a new CMake function (``add_libfuzzer_test()``) to simplify declaration of executables for testing LibFuzzer and use it to reorganise how tests are declared. Note that configuration of the lit configuration files has been moved as late as possible because we are going to need to disable some tests for some platforms and we will need to propagate this information into the lit configuration. Note the code for custom mains was removed because no tests are currently written for this and Kostya seems happy to remove this. Differential Revision: http://reviews.llvm.org/D20706 llvm-svn: 270958
* [libFuzzer] make check-fuzzer a bit fasterKostya Serebryany2016-05-271-3/+2
| | | | llvm-svn: 270947
* [libFuzzer] make OOM-handling more portable. Instead of sending a signal to ↵Kostya Serebryany2016-05-273-55/+21
| | | | | | the main fuzzing thread, print the message in the getrusage thread and exit. llvm-svn: 270945
* [libFuzzer] more refactoring: make sure CurrentUnitData is awlays a valid ↵Kostya Serebryany2016-05-273-15/+26
| | | | | | pointer to read from llvm-svn: 270942
* [libFuzzer] more refactoring around CurrentUnit. Also add a threading test ↵Kostya Serebryany2016-05-265-25/+63
| | | | | | on which we currently have a race (when reporting bugs from multiple threads) llvm-svn: 270929
* [LibFuzzer] Add missing #include<string>Dan Liew2016-05-261-0/+1
| | | | | | | This partially fixes the compilation of the LibFuzzer unit test on OSX using AppleClang. llvm-svn: 270926
* [libFuzzer] refactor: hide CurrentUnitData inside an interface function. NFCKostya Serebryany2016-05-263-28/+37
| | | | llvm-svn: 270922
* [LibFuzzer] Emit error if LLVM_USE_SANITIZER is not correctly set.Dan Liew2016-05-261-0/+6
| | | | | | | | | | Previously CMake would successfully configure and compile (with warnings about ``-fsanitize-coverage=...`` being unused) but the tests LibFuzzer tests would fail. Differential Revision: http://reviews.llvm.org/D20662 llvm-svn: 270913
* [LibFuzzer] Allow LibFuzzer to be built in modes other than RELEASE.Dan Liew2016-05-267-14/+37
| | | | | | | | | | | | Previously the flags were only being set correctly when the build type was "Release". Now the build should work properly for all the supported build types. When building libFuzzer the optimization level respects whatever is used for the rest of LLVM but for the LibFuzzer tests we force -O0. Differential Revision: http://reviews.llvm.org/D20558 llvm-svn: 270912
* [libFuzzer] when there is a leak in the existing corpus report the ↵Kostya Serebryany2016-05-263-23/+12
| | | | | | reproducer properly llvm-svn: 270905
* [libFuzzer] reimplement the way we do -only_ascii to allow more 'const' in ↵Kostya Serebryany2016-05-265-13/+20
| | | | | | function declarations. Add a test for -only_ascii. NFC intended llvm-svn: 270900
* [libfuzzer] replacing unittest for truncate_units with functional test.Mike Aizatsky2016-05-254-22/+22
| | | | | | Differential Revision: http://reviews.llvm.org/D20641 llvm-svn: 270755
* [libFuzzer] print stats if we crash on empty inputKostya Serebryany2016-05-254-3/+27
| | | | llvm-svn: 270639
* [libfuzzer] Trying random unit prefixes during corpus load.Mike Aizatsky2016-05-245-1/+72
| | | | | | Differential Revision: http://reviews.llvm.org/D20301 llvm-svn: 270632
* [libFuzzer] add a license header to afl/afl_driver.cppKostya Serebryany2016-05-241-0/+8
| | | | llvm-svn: 270598
* [LibFuzzer] Fix implementation of ``GetPeakRSSMb()`` on Mac OSX.Dan Liew2016-05-201-1/+9
| | | | | | | | On Linux ``rusage.ru_maxrss`` is in KiB but on Mac OSX it is in bytes. Differential Revision: http://reviews.llvm.org/D20410 llvm-svn: 270173
* [LibFuzzer] Fix ``NumberOfCpuCores()`` on Mac OSX.Dan Liew2016-05-201-4/+29
| | | | | | | | | | | | | | | The ``nprocs`` command does not exist under Mac OSX so use ``sysctl`` instead on that platform. Whilst I'm here * Use ``pclose()`` instead of ``fclose()`` which the ``popen()`` documentation says should be used. * Check for errors that were previously unhandled. Differential Revision: http://reviews.llvm.org/D20409 llvm-svn: 270172
* [LibFuzzer]Dan Liew2016-05-192-2/+23
| | | | | | | | | | | | | | | | | | Work around crashes in ``__sanitizer_malloc_hook()`` under Mac OSX. Under Mac OSX we intercept calls to malloc before thread local storage is initialised leading to a crash when accessing ``AllocTracer``. To workaround this ``AllocTracer`` is only accessed in the hook under Linux. For symmetry ``__sanitizer_free_hook()`` is also modified in the same way. To support this change a set of new macros LIBFUZZER_LINUX and LIBFUZZER_APPLE has been defined which can be used to check the target being compiled for. Differential Revision: http://reviews.llvm.org/D20402 llvm-svn: 270145
* [libFuzzer] do the merge faster and a bit less preciseKostya Serebryany2016-05-131-1/+2
| | | | llvm-svn: 269497
* [libFuzzer] print the file name before executing the input so that if there ↵Kostya Serebryany2016-05-132-3/+4
| | | | | | is a crash we know which files has caused it llvm-svn: 269450
* [libFuzzer] simplify FuzzerInterface.hKostya Serebryany2016-05-136-79/+43
| | | | llvm-svn: 269448
* [libFuzzer] add a driver file to use AFL on LLVMFuzzerTestOneInputKostya Serebryany2016-05-101-0/+82
| | | | llvm-svn: 269141
* [libfuzzer] Refactoring coverage state-management code.Mike Aizatsky2016-05-104-116/+206
| | | | | | | | | It is now less state-dependent and will allow easier comparing of coverages of different units. Differential Revision: http://reviews.llvm.org/D20085 llvm-svn: 269140
* [libFuzzer] add a test for libFuzzer+ubsan, extend the docs on using ↵Kostya Serebryany2016-05-094-0/+56
| | | | | | libFuzzer+ubsan llvm-svn: 268968
* [libFuzzer] better document the -merge=1 flagKostya Serebryany2016-05-091-1/+2
| | | | llvm-svn: 268957
* [libFuzzer] enhance -rss_limit_mb and enable by default. Now it will print ↵Kostya Serebryany2016-05-068-15/+82
| | | | | | the OOM reproducer. llvm-svn: 268821
* [libFuzzer] add exeprimental -rss_limit_mb flag to fight against OOMsKostya Serebryany2016-05-064-0/+31
| | | | llvm-svn: 268807
* [libFuzzer] print stats after running individual inputsKostya Serebryany2016-05-043-2/+7
| | | | llvm-svn: 268547
* [libFuzzer] enable detect_leaks=1, add proper docsKostya Serebryany2016-04-293-3/+3
| | | | llvm-svn: 268088
* [libFuzzer] disable leak detection if we have tried it for 1000 times w/o ↵Kostya Serebryany2016-04-271-1/+2
| | | | | | finding a leak [part 2] llvm-svn: 267771
* [libFuzzer] disable leak detection if we have tried it for 1000 times w/o ↵Kostya Serebryany2016-04-274-0/+28
| | | | | | finding a leak llvm-svn: 267770
OpenPOWER on IntegriCloud