blob: 2ff131902b4ed428f68bf4cca6b55665d1d6b71d [file] [log] [blame]
Aaron Ballmanef116982015-01-29 16:58:29 +00001//===- FuzzerInternal.h - Internal header for the Fuzzer --------*- C++ -* ===//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9// Define the main class fuzzer::Fuzzer and most functions.
10//===----------------------------------------------------------------------===//
Yaron Keren347663b2015-08-10 16:37:40 +000011
12#ifndef LLVM_FUZZER_INTERNAL_H
13#define LLVM_FUZZER_INTERNAL_H
14
Kostya Serebryany292cf032016-02-13 03:37:24 +000015#include <algorithm>
Aaron Ballmanef116982015-01-29 16:58:29 +000016#include <cassert>
17#include <chrono>
Ivan Krasindf919102016-01-22 22:28:27 +000018#include <climits>
Aaron Ballmanef116982015-01-29 16:58:29 +000019#include <cstddef>
20#include <cstdlib>
Ivan Krasindf919102016-01-22 22:28:27 +000021#include <random>
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000022#include <string.h>
Ivan Krasindf919102016-01-22 22:28:27 +000023#include <string>
Kostya Serebryany2c1b33b2015-01-29 23:01:07 +000024#include <unordered_set>
Ivan Krasindf919102016-01-22 22:28:27 +000025#include <vector>
Aaron Ballmanef116982015-01-29 16:58:29 +000026
Kostya Serebryany016852c2015-02-19 18:45:37 +000027#include "FuzzerInterface.h"
28
Aaron Ballmanef116982015-01-29 16:58:29 +000029namespace fuzzer {
Aaron Ballmanef116982015-01-29 16:58:29 +000030using namespace std::chrono;
Kostya Serebryanyaca76962016-01-16 01:23:12 +000031typedef std::vector<uint8_t> Unit;
Kostya Serebryany945761b2016-03-18 00:23:29 +000032typedef std::vector<Unit> UnitVector;
Aaron Ballmanef116982015-01-29 16:58:29 +000033
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000034// A simple POD sized array of bytes.
Ivan Krasindf919102016-01-22 22:28:27 +000035template <size_t kMaxSize> class FixedWord {
36public:
Kostya Serebryany160dcba2016-01-22 23:55:14 +000037 FixedWord() {}
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000038 FixedWord(const uint8_t *B, uint8_t S) { Set(B, S); }
39
40 void Set(const uint8_t *B, uint8_t S) {
41 assert(S <= kMaxSize);
42 memcpy(Data, B, S);
43 Size = S;
44 }
45
Ivan Krasindf919102016-01-22 22:28:27 +000046 bool operator==(const FixedWord<kMaxSize> &w) const {
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000047 return Size == w.Size && 0 == memcmp(Data, w.Data, Size);
48 }
49
Ivan Krasindf919102016-01-22 22:28:27 +000050 bool operator<(const FixedWord<kMaxSize> &w) const {
51 if (Size != w.Size)
52 return Size < w.Size;
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000053 return memcmp(Data, w.Data, Size) < 0;
54 }
55
56 static size_t GetMaxSize() { return kMaxSize; }
57 const uint8_t *data() const { return Data; }
58 uint8_t size() const { return Size; }
59
Ivan Krasindf919102016-01-22 22:28:27 +000060private:
Kostya Serebryany160dcba2016-01-22 23:55:14 +000061 uint8_t Size = 0;
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000062 uint8_t Data[kMaxSize];
63};
64
Ivan Krasindf919102016-01-22 22:28:27 +000065typedef FixedWord<27> Word; // 28 bytes.
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000066
Kostya Serebryanybfbe7fc2016-02-02 03:03:47 +000067bool IsFile(const std::string &Path);
Kostya Serebryany52a788e2015-03-31 20:13:20 +000068std::string FileToString(const std::string &Path);
Kostya Serebryanya35f7d32016-02-18 21:49:10 +000069Unit FileToVector(const std::string &Path, size_t MaxSize = 0);
Kostya Serebryany1ac80552015-05-08 21:30:55 +000070void ReadDirToVectorOfUnits(const char *Path, std::vector<Unit> *V,
Kostya Serebryanya35f7d32016-02-18 21:49:10 +000071 long *Epoch, size_t MaxSize);
Aaron Ballmanef116982015-01-29 16:58:29 +000072void WriteToFile(const Unit &U, const std::string &Path);
Kostya Serebryany5b266a82015-02-04 19:10:20 +000073void CopyFileToErr(const std::string &Path);
Aaron Ballmanef116982015-01-29 16:58:29 +000074// Returns "Dir/FileName" or equivalent for the current OS.
75std::string DirPlusFile(const std::string &DirPath,
76 const std::string &FileName);
77
Kostya Serebryany49e40902016-03-18 20:58:29 +000078void DupAndCloseStderr();
79void CloseStdout();
Kostya Serebryany20e9bcb2015-05-23 01:07:46 +000080void Printf(const char *Fmt, ...);
Kostya Serebryany98abb2c2016-01-13 23:46:01 +000081void PrintHexArray(const Unit &U, const char *PrintAfter = "");
82void PrintHexArray(const uint8_t *Data, size_t Size,
83 const char *PrintAfter = "");
Kostya Serebryany41740052016-01-12 02:36:59 +000084void PrintASCII(const uint8_t *Data, size_t Size, const char *PrintAfter = "");
Aaron Ballmanef116982015-01-29 16:58:29 +000085void PrintASCII(const Unit &U, const char *PrintAfter = "");
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000086void PrintASCII(const Word &W, const char *PrintAfter = "");
Aaron Ballmanef116982015-01-29 16:58:29 +000087std::string Hash(const Unit &U);
88void SetTimer(int Seconds);
Kostya Serebryany228d5b12016-03-01 22:19:21 +000089void SetSigSegvHandler();
90void SetSigBusHandler();
91void SetSigAbrtHandler();
92void SetSigIllHandler();
93void SetSigFpeHandler();
94void SetSigIntHandler();
Kostya Serebryany9e48cda2015-12-04 22:29:39 +000095std::string Base64(const Unit &U);
Kostya Serebryanydc3135d2015-11-12 01:02:01 +000096int ExecuteCommand(const std::string &Command);
Kostya Serebryany66ff0752016-02-26 22:42:23 +000097size_t GetPeakRSSMb();
Aaron Ballmanef116982015-01-29 16:58:29 +000098
Kostya Serebryany96eab652015-05-14 22:41:49 +000099// Private copy of SHA1 implementation.
100static const int kSHA1NumBytes = 20;
101// Computes SHA1 hash of 'Len' bytes in 'Data', writes kSHA1NumBytes to 'Out'.
102void ComputeSHA1(const uint8_t *Data, size_t Len, uint8_t *Out);
103
Kostya Serebryanybc7c0ad2015-08-11 01:44:42 +0000104// Changes U to contain only ASCII (isprint+isspace) characters.
105// Returns true iff U has been changed.
Kostya Serebryany8a5bef02016-02-13 17:56:51 +0000106bool ToASCII(uint8_t *Data, size_t Size);
Kostya Serebryanya9346c22015-09-02 19:08:08 +0000107bool IsASCII(const Unit &U);
Kostya Serebryanybc7c0ad2015-08-11 01:44:42 +0000108
Kostya Serebryany9690fcf2015-05-12 18:51:57 +0000109int NumberOfCpuCores();
Kostya Serebryanyd6edce92015-10-16 23:04:31 +0000110int GetPid();
Kostya Serebryany9690fcf2015-05-12 18:51:57 +0000111
Kostya Serebryanyda63c1d2016-02-26 21:33:56 +0000112// Clears the current PC Map.
113void PcMapResetCurrent();
114// Merges the current PC Map into the combined one, and clears the former.
115void PcMapMergeCurrentToCombined();
116// Returns the size of the combined PC Map.
117size_t PcMapCombinedSize();
118
Kostya Serebryanya3992212016-02-13 03:00:53 +0000119class Random {
Kostya Serebryanyecab57b2016-02-13 02:39:30 +0000120 public:
Kostya Serebryanya3992212016-02-13 03:00:53 +0000121 Random(unsigned int seed) : R(seed) {}
122 size_t Rand() { return R(); }
123 size_t RandBool() { return Rand() % 2; }
Kostya Serebryanyecab57b2016-02-13 02:39:30 +0000124 size_t operator()(size_t n) { return n ? Rand() % n : 0; }
Kostya Serebryany7ec0c562016-02-13 03:25:16 +0000125 std::mt19937 &Get_mt19937() { return R; }
Kostya Serebryanyecab57b2016-02-13 02:39:30 +0000126 private:
Kostya Serebryanya3992212016-02-13 03:00:53 +0000127 std::mt19937 R;
Kostya Serebryanyecab57b2016-02-13 02:39:30 +0000128};
129
Kostya Serebryany9838b2b2015-09-03 20:23:46 +0000130// Dictionary.
131
132// Parses one dictionary entry.
133// If successfull, write the enty to Unit and returns true,
134// otherwise returns false.
135bool ParseOneDictionaryEntry(const std::string &Str, Unit *U);
136// Parses the dictionary file, fills Units, returns true iff all lines
137// were parsed succesfully.
138bool ParseDictionaryFile(const std::string &Text, std::vector<Unit> *Units);
139
Kostya Serebryany292cf032016-02-13 03:37:24 +0000140class DictionaryEntry {
141 public:
142 DictionaryEntry() {}
143 DictionaryEntry(Word W) : W(W) {}
144 DictionaryEntry(Word W, size_t PositionHint) : W(W), PositionHint(PositionHint) {}
145 const Word &GetW() const { return W; }
146
147 bool HasPositionHint() const { return PositionHint != std::numeric_limits<size_t>::max(); }
148 size_t GetPositionHint() const {
149 assert(HasPositionHint());
150 return PositionHint;
151 }
152 void IncUseCount() { UseCount++; }
153 void IncSuccessCount() { SuccessCount++; }
154 size_t GetUseCount() const { return UseCount; }
155 size_t GetSuccessCount() const {return SuccessCount; }
156
157private:
158 Word W;
159 size_t PositionHint = std::numeric_limits<size_t>::max();
160 size_t UseCount = 0;
161 size_t SuccessCount = 0;
162};
163
164class Dictionary {
165 public:
166 static const size_t kMaxDictSize = 1 << 14;
167
168 bool ContainsWord(const Word &W) const {
169 return std::any_of(begin(), end(), [&](const DictionaryEntry &DE) {
170 return DE.GetW() == W;
171 });
172 }
173 const DictionaryEntry *begin() const { return &DE[0]; }
174 const DictionaryEntry *end() const { return begin() + Size; }
175 DictionaryEntry & operator[] (size_t Idx) {
176 assert(Idx < Size);
177 return DE[Idx];
178 }
179 void push_back(DictionaryEntry DE) {
180 if (Size < kMaxDictSize)
181 this->DE[Size++] = DE;
182 }
183 void clear() { Size = 0; }
184 bool empty() const { return Size == 0; }
185 size_t size() const { return Size; }
186
187private:
188 DictionaryEntry DE[kMaxDictSize];
189 size_t Size = 0;
190};
191
Kostya Serebryany628bc3e2016-01-16 00:04:36 +0000192class MutationDispatcher {
Ivan Krasindf919102016-01-22 22:28:27 +0000193public:
Kostya Serebryany23194962016-02-13 03:46:26 +0000194 MutationDispatcher(Random &Rand) : Rand(Rand) {}
Kostya Serebryany292cf032016-02-13 03:37:24 +0000195 ~MutationDispatcher() {}
Kostya Serebryany628bc3e2016-01-16 00:04:36 +0000196 /// Indicate that we are about to start a new sequence of mutations.
197 void StartMutationSequence();
198 /// Print the current sequence of mutations.
199 void PrintMutationSequence();
200 /// Indicate that the current sequence of mutations was successfull.
201 void RecordSuccessfulMutationSequence();
202 /// Mutates data by shuffling bytes.
203 size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize);
204 /// Mutates data by erasing a byte.
205 size_t Mutate_EraseByte(uint8_t *Data, size_t Size, size_t MaxSize);
206 /// Mutates data by inserting a byte.
207 size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize);
208 /// Mutates data by chanding one byte.
209 size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize);
210 /// Mutates data by chanding one bit.
211 size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize);
212
213 /// Mutates data by adding a word from the manual dictionary.
214 size_t Mutate_AddWordFromManualDictionary(uint8_t *Data, size_t Size,
215 size_t MaxSize);
216
217 /// Mutates data by adding a word from the temporary automatic dictionary.
218 size_t Mutate_AddWordFromTemporaryAutoDictionary(uint8_t *Data, size_t Size,
219 size_t MaxSize);
220
221 /// Mutates data by adding a word from the persistent automatic dictionary.
222 size_t Mutate_AddWordFromPersistentAutoDictionary(uint8_t *Data, size_t Size,
223 size_t MaxSize);
224
225 /// Tries to find an ASCII integer in Data, changes it to another ASCII int.
226 size_t Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MaxSize);
227
228 /// CrossOver Data with some other element of the corpus.
229 size_t Mutate_CrossOver(uint8_t *Data, size_t Size, size_t MaxSize);
230
231 /// Applies one of the above mutations.
232 /// Returns the new size of data which could be up to MaxSize.
233 size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize);
234
235 /// Creates a cross-over of two pieces of Data, returns its size.
236 size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2,
237 size_t Size2, uint8_t *Out, size_t MaxOutSize);
238
Kostya Serebryany476f0ce2016-01-16 03:53:32 +0000239 void AddWordToManualDictionary(const Word &W);
Kostya Serebryany628bc3e2016-01-16 00:04:36 +0000240
Kostya Serebryany476f0ce2016-01-16 03:53:32 +0000241 void AddWordToAutoDictionary(const Word &W, size_t PositionHint);
Kostya Serebryany628bc3e2016-01-16 00:04:36 +0000242 void ClearAutoDictionary();
243 void PrintRecommendedDictionary();
244
Kostya Serebryany292cf032016-02-13 03:37:24 +0000245 void SetCorpus(const std::vector<Unit> *Corpus) { this->Corpus = Corpus; }
Kostya Serebryany628bc3e2016-01-16 00:04:36 +0000246
Kostya Serebryany7ec0c562016-02-13 03:25:16 +0000247 Random &GetRand() { return Rand; }
248
Ivan Krasindf919102016-01-22 22:28:27 +0000249private:
Kostya Serebryany292cf032016-02-13 03:37:24 +0000250
251 struct Mutator {
252 size_t (MutationDispatcher::*Fn)(uint8_t *Data, size_t Size, size_t Max);
253 const char *Name;
254 };
255
Kostya Serebryany292cf032016-02-13 03:37:24 +0000256 size_t AddWordFromDictionary(Dictionary &D, uint8_t *Data, size_t Size,
257 size_t MaxSize);
258
Kostya Serebryanya3992212016-02-13 03:00:53 +0000259 Random &Rand;
Kostya Serebryany292cf032016-02-13 03:37:24 +0000260 // Dictionary provided by the user via -dict=DICT_FILE.
261 Dictionary ManualDictionary;
262 // Temporary dictionary modified by the fuzzer itself,
263 // recreated periodically.
264 Dictionary TempAutoDictionary;
265 // Persistent dictionary modified by the fuzzer, consists of
266 // entries that led to successfull discoveries in the past mutations.
267 Dictionary PersistentAutoDictionary;
Kostya Serebryany292cf032016-02-13 03:37:24 +0000268 std::vector<Mutator> CurrentMutatorSequence;
269 std::vector<DictionaryEntry *> CurrentDictionaryEntrySequence;
270 const std::vector<Unit> *Corpus = nullptr;
Kostya Serebryany8a5bef02016-02-13 17:56:51 +0000271 std::vector<uint8_t> MutateInPlaceHere;
Kostya Serebryany23194962016-02-13 03:46:26 +0000272
273 static Mutator Mutators[];
Kostya Serebryany628bc3e2016-01-16 00:04:36 +0000274};
275
Aaron Ballmanef116982015-01-29 16:58:29 +0000276class Fuzzer {
Ivan Krasindf919102016-01-22 22:28:27 +0000277public:
Aaron Ballmanef116982015-01-29 16:58:29 +0000278 struct FuzzingOptions {
279 int Verbosity = 1;
Kostya Serebryany64d24572016-03-12 01:57:04 +0000280 size_t MaxLen = 0;
Kostya Serebryany490bbd62015-05-19 22:12:57 +0000281 int UnitTimeoutSec = 300;
Kostya Serebryany54a63632016-01-29 23:30:07 +0000282 int TimeoutExitCode = 77;
Kostya Serebryany228d5b12016-03-01 22:19:21 +0000283 int ErrorExitCode = 77;
Kostya Serebryanyb85db172015-10-02 20:47:55 +0000284 int MaxTotalTimeSec = 0;
Aaron Ballmanef116982015-01-29 16:58:29 +0000285 bool DoCrossOver = true;
Ivan Krasindf919102016-01-22 22:28:27 +0000286 int MutateDepth = 5;
Kostya Serebryanybe5e0ed2015-03-03 23:27:02 +0000287 bool UseCounters = false;
Kostya Serebryany2e9fca92015-10-22 23:55:39 +0000288 bool UseIndirCalls = true;
Kostya Serebryany5a99ecb2015-05-11 20:51:19 +0000289 bool UseTraces = false;
Kostya Serebryanyae5b9562016-01-15 06:24:05 +0000290 bool UseMemcmp = true;
Ivan Krasindf919102016-01-22 22:28:27 +0000291 bool UseFullCoverageSet = false;
Kostya Serebryany1ac80552015-05-08 21:30:55 +0000292 bool Reload = true;
Kostya Serebryanyfed509e2015-10-17 04:38:26 +0000293 bool ShuffleAtStartUp = true;
Kostya Serebryany945761b2016-03-18 00:23:29 +0000294 bool PreferSmall = true;
Kostya Serebryany33f86692015-02-04 22:20:09 +0000295 size_t MaxNumberOfRuns = ULONG_MAX;
Kostya Serebryany70926ae2015-08-05 21:43:48 +0000296 int ReportSlowUnits = 10;
Kostya Serebryanybc7c0ad2015-08-11 01:44:42 +0000297 bool OnlyASCII = false;
Aaron Ballmanef116982015-01-29 16:58:29 +0000298 std::string OutputCorpus;
Kostya Serebryanybd5d1cd2015-10-09 03:57:59 +0000299 std::string ArtifactPrefix = "./";
Kostya Serebryany2d0ef142015-11-25 21:40:46 +0000300 std::string ExactArtifactPath;
Kostya Serebryanyb91c62b2015-10-16 22:41:47 +0000301 bool SaveArtifacts = true;
Ivan Krasindf919102016-01-22 22:28:27 +0000302 bool PrintNEW = true; // Print a status line when new units are found;
Mike Aizatskya9c23872015-11-12 04:38:40 +0000303 bool OutputCSV = false;
Mike Aizatsky8b11f872016-01-06 00:21:22 +0000304 bool PrintNewCovPcs = false;
Kostya Serebryany66ff0752016-02-26 22:42:23 +0000305 bool PrintFinalStats = false;
Aaron Ballmanef116982015-01-29 16:58:29 +0000306 };
Kostya Serebryany7ec0c562016-02-13 03:25:16 +0000307 Fuzzer(UserCallback CB, MutationDispatcher &MD, FuzzingOptions Options);
Ivan Krasindf919102016-01-22 22:28:27 +0000308 void AddToCorpus(const Unit &U) {
309 Corpus.push_back(U);
310 UpdateCorpusDistribution();
311 }
Kostya Serebryanydc3135d2015-11-12 01:02:01 +0000312 size_t ChooseUnitIdxToMutate();
313 const Unit &ChooseUnitToMutate() { return Corpus[ChooseUnitIdxToMutate()]; };
Kostya Serebryany468ed782015-09-08 17:30:35 +0000314 void Loop();
Kostya Serebryanydc3135d2015-11-12 01:02:01 +0000315 void Drill();
Aaron Ballmanef116982015-01-29 16:58:29 +0000316 void ShuffleAndMinimize();
Kostya Serebryany22526252015-05-11 21:16:27 +0000317 void InitializeTraceState();
Kostya Serebryanyd50a3ee2016-01-13 23:02:30 +0000318 void AssignTaintLabels(uint8_t *Data, size_t Size);
Aaron Ballmanef116982015-01-29 16:58:29 +0000319 size_t CorpusSize() const { return Corpus.size(); }
Kostya Serebryany64d24572016-03-12 01:57:04 +0000320 size_t MaxUnitSizeInCorpus() const;
Kostya Serebryanya35f7d32016-02-18 21:49:10 +0000321 void ReadDir(const std::string &Path, long *Epoch, size_t MaxSize) {
Kostya Serebryany9cc3b0d2015-10-24 01:16:40 +0000322 Printf("Loading corpus: %s\n", Path.c_str());
Kostya Serebryanya35f7d32016-02-18 21:49:10 +0000323 ReadDirToVectorOfUnits(Path.c_str(), &Corpus, Epoch, MaxSize);
Aaron Ballmanef116982015-01-29 16:58:29 +0000324 }
Kostya Serebryany64d24572016-03-12 01:57:04 +0000325 void RereadOutputCorpus(size_t MaxSize);
Aaron Ballmanef116982015-01-29 16:58:29 +0000326 // Save the current corpus to OutputCorpus.
327 void SaveCorpus();
328
Kostya Serebryany92e04762015-02-04 23:42:42 +0000329 size_t secondsSinceProcessStartUp() {
330 return duration_cast<seconds>(system_clock::now() - ProcessStartTime)
331 .count();
332 }
Kostya Serebryany66ff0752016-02-26 22:42:23 +0000333 size_t execPerSec() {
334 size_t Seconds = secondsSinceProcessStartUp();
335 return Seconds ? TotalNumberOfRuns / Seconds : 0;
336 }
Kostya Serebryany92e04762015-02-04 23:42:42 +0000337
338 size_t getTotalNumberOfRuns() { return TotalNumberOfRuns; }
339
Kostya Serebryany52a788e2015-03-31 20:13:20 +0000340 static void StaticAlarmCallback();
Kostya Serebryany228d5b12016-03-01 22:19:21 +0000341 static void StaticCrashSignalCallback();
342 static void StaticInterruptCallback();
Kostya Serebryany52a788e2015-03-31 20:13:20 +0000343
Kostya Serebryany8a5bef02016-02-13 17:56:51 +0000344 void ExecuteCallback(const uint8_t *Data, size_t Size);
Aaron Ballmanef116982015-01-29 16:58:29 +0000345
Kostya Serebryany9cc3b0d2015-10-24 01:16:40 +0000346 // Merge Corpora[1:] into Corpora[0].
347 void Merge(const std::vector<std::string> &Corpora);
Kostya Serebryany945761b2016-03-18 00:23:29 +0000348 // Returns a subset of 'Extra' that adds coverage to 'Initial'.
349 UnitVector FindExtraUnits(const UnitVector &Initial, const UnitVector &Extra);
Kostya Serebryany1deb0492016-02-13 06:24:18 +0000350 MutationDispatcher &GetMD() { return MD; }
Kostya Serebryany66ff0752016-02-26 22:42:23 +0000351 void PrintFinalStats();
Kostya Serebryany64d24572016-03-12 01:57:04 +0000352 void SetMaxLen(size_t MaxLen);
Kostya Serebryany9cc3b0d2015-10-24 01:16:40 +0000353
Ivan Krasindf919102016-01-22 22:28:27 +0000354private:
Kostya Serebryany52a788e2015-03-31 20:13:20 +0000355 void AlarmCallback();
Kostya Serebryany228d5b12016-03-01 22:19:21 +0000356 void CrashCallback();
357 void InterruptCallback();
Kostya Serebryany27ab2d72015-12-19 02:49:09 +0000358 void MutateAndTestOne();
Kostya Serebryany007c9b22015-10-22 22:50:47 +0000359 void ReportNewCoverage(const Unit &U);
Kostya Serebryany8a5bef02016-02-13 17:56:51 +0000360 bool RunOne(const uint8_t *Data, size_t Size);
361 bool RunOne(const Unit &U) { return RunOne(U.data(), U.size()); }
362 void RunOneAndUpdateCorpus(uint8_t *Data, size_t Size);
Aaron Ballmanef116982015-01-29 16:58:29 +0000363 void WriteToOutputCorpus(const Unit &U);
Kostya Serebryany2b7d2e92015-07-23 18:37:22 +0000364 void WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix);
Kostya Serebryany09d2a5f2015-10-22 22:56:45 +0000365 void PrintStats(const char *Where, const char *End = "\n");
Kostya Serebryanydc3135d2015-11-12 01:02:01 +0000366 void PrintStatusForNewUnit(const Unit &U);
Kostya Serebryany945761b2016-03-18 00:23:29 +0000367 void ShuffleCorpus(UnitVector *V);
368
Ivan Krasindf919102016-01-22 22:28:27 +0000369 // Updates the probability distribution for the units in the corpus.
370 // Must be called whenever the corpus or unit weights are changed.
371 void UpdateCorpusDistribution();
Aaron Ballmanef116982015-01-29 16:58:29 +0000372
Kostya Serebryany007c9b22015-10-22 22:50:47 +0000373 size_t RecordBlockCoverage();
Kostya Serebryany2e9fca92015-10-22 23:55:39 +0000374 size_t RecordCallerCalleeCoverage();
Kostya Serebryany007c9b22015-10-22 22:50:47 +0000375 void PrepareCoverageBeforeRun();
376 bool CheckCoverageAfterRun();
Kostya Serebryany945761b2016-03-18 00:23:29 +0000377 void ResetCoverage();
Kostya Serebryany007c9b22015-10-22 22:50:47 +0000378
Kostya Serebryanybeb24c32015-05-07 21:02:11 +0000379 // Trace-based fuzzing: we run a unit with some kind of tracing
380 // enabled and record potentially useful mutations. Then
381 // We apply these mutations one by one to the unit and run it again.
382
383 // Start tracing; forget all previously proposed mutations.
384 void StartTraceRecording();
Kostya Serebryanyb65805a2016-01-09 03:08:58 +0000385 // Stop tracing.
386 void StopTraceRecording();
Kostya Serebryanybeb24c32015-05-07 21:02:11 +0000387
Aaron Ballmanef116982015-01-29 16:58:29 +0000388 void SetDeathCallback();
Kostya Serebryany52a788e2015-03-31 20:13:20 +0000389 static void StaticDeathCallback();
Kostya Serebryany228d5b12016-03-01 22:19:21 +0000390 void DumpCurrentUnit(const char *Prefix);
Kostya Serebryany52a788e2015-03-31 20:13:20 +0000391 void DeathCallback();
Kostya Serebryany98abb2c2016-01-13 23:46:01 +0000392
393 uint8_t *CurrentUnitData;
394 size_t CurrentUnitSize;
Aaron Ballmanef116982015-01-29 16:58:29 +0000395
396 size_t TotalNumberOfRuns = 0;
Kostya Serebryany12c78372015-08-12 01:55:37 +0000397 size_t TotalNumberOfExecutedTraceBasedMutations = 0;
Kostya Serebryany66ff0752016-02-26 22:42:23 +0000398 size_t NumberOfNewUnitsAdded = 0;
Aaron Ballmanef116982015-01-29 16:58:29 +0000399
400 std::vector<Unit> Corpus;
Kostya Serebryanycbb23342015-05-19 01:06:07 +0000401 std::unordered_set<std::string> UnitHashesAddedToCorpus;
Kostya Serebryanybe5e0ed2015-03-03 23:27:02 +0000402
403 // For UseCounters
404 std::vector<uint8_t> CounterBitmap;
Ivan Krasindf919102016-01-22 22:28:27 +0000405 size_t TotalBits() { // Slow. Call it only for printing stats.
Kostya Serebryanybe5e0ed2015-03-03 23:27:02 +0000406 size_t Res = 0;
Ivan Krasindf919102016-01-22 22:28:27 +0000407 for (auto x : CounterBitmap)
408 Res += __builtin_popcount(x);
Kostya Serebryanybe5e0ed2015-03-03 23:27:02 +0000409 return Res;
410 }
411
Kostya Serebryany8a5bef02016-02-13 17:56:51 +0000412 std::vector<uint8_t> MutateInPlaceHere;
413
Ivan Krasindf919102016-01-22 22:28:27 +0000414 std::piecewise_constant_distribution<double> CorpusDistribution;
Kostya Serebryany7ec0c562016-02-13 03:25:16 +0000415 UserCallback CB;
416 MutationDispatcher &MD;
Aaron Ballmanef116982015-01-29 16:58:29 +0000417 FuzzingOptions Options;
418 system_clock::time_point ProcessStartTime = system_clock::now();
Kostya Serebryany52a788e2015-03-31 20:13:20 +0000419 system_clock::time_point UnitStartTime;
Kostya Serebryany16901a92015-03-30 23:04:35 +0000420 long TimeOfLongestUnitInSeconds = 0;
Kostya Serebryany1ac80552015-05-08 21:30:55 +0000421 long EpochOfLastReadOfOutputCorpus = 0;
Kostya Serebryany007c9b22015-10-22 22:50:47 +0000422 size_t LastRecordedBlockCoverage = 0;
Kostya Serebryanyda63c1d2016-02-26 21:33:56 +0000423 size_t LastRecordedPcMapSize = 0;
Kostya Serebryany2e9fca92015-10-22 23:55:39 +0000424 size_t LastRecordedCallerCalleeCoverage = 0;
Mike Aizatsky8b11f872016-01-06 00:21:22 +0000425 size_t LastCoveragePcBufferLen = 0;
Aaron Ballmanef116982015-01-29 16:58:29 +0000426};
427
Ivan Krasindf919102016-01-22 22:28:27 +0000428}; // namespace fuzzer
Yaron Keren347663b2015-08-10 16:37:40 +0000429
430#endif // LLVM_FUZZER_INTERNAL_H