blob: f1a98f2a6488fe7979fd9a6f6ed659ce3c572ddf [file] [log] [blame]
Aaron Ballmanef116982015-01-29 16:58:29 +00001//===- FuzzerInternal.h - Internal header for the Fuzzer --------*- C++ -* ===//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9// Define the main class fuzzer::Fuzzer and most functions.
10//===----------------------------------------------------------------------===//
Yaron Keren347663b2015-08-10 16:37:40 +000011
12#ifndef LLVM_FUZZER_INTERNAL_H
13#define LLVM_FUZZER_INTERNAL_H
14
Kostya Serebryany292cf032016-02-13 03:37:24 +000015#include <algorithm>
Kostya Serebryany0edb5632016-05-27 00:54:15 +000016#include <atomic>
Aaron Ballmanef116982015-01-29 16:58:29 +000017#include <cassert>
18#include <chrono>
Ivan Krasindf919102016-01-22 22:28:27 +000019#include <climits>
Aaron Ballmanef116982015-01-29 16:58:29 +000020#include <cstddef>
21#include <cstdlib>
Ivan Krasindf919102016-01-22 22:28:27 +000022#include <random>
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000023#include <string.h>
Ivan Krasindf919102016-01-22 22:28:27 +000024#include <string>
Kostya Serebryany2c1b33b2015-01-29 23:01:07 +000025#include <unordered_set>
Ivan Krasindf919102016-01-22 22:28:27 +000026#include <vector>
Aaron Ballmanef116982015-01-29 16:58:29 +000027
Dan Liewd3c33112016-06-02 05:48:02 +000028#include "FuzzerExtFunctions.h"
Kostya Serebryany016852c2015-02-19 18:45:37 +000029#include "FuzzerInterface.h"
Mike Aizatsky1aa501e2016-05-10 23:43:15 +000030#include "FuzzerTracePC.h"
Kostya Serebryany016852c2015-02-19 18:45:37 +000031
Dan Liew3868e462016-05-19 22:00:33 +000032// Platform detection.
33#ifdef __linux__
34#define LIBFUZZER_LINUX 1
35#define LIBFUZZER_APPLE 0
36#elif __APPLE__
37#define LIBFUZZER_LINUX 0
38#define LIBFUZZER_APPLE 1
39#else
40#error "Support for your platform has not been implemented"
41#endif
42
Aaron Ballmanef116982015-01-29 16:58:29 +000043namespace fuzzer {
Kostya Serebryany8b0d90a2016-05-13 18:04:35 +000044
45typedef int (*UserCallback)(const uint8_t *Data, size_t Size);
Dan Liewd3c33112016-06-02 05:48:02 +000046int FuzzerDriver(int *argc, char ***argv, UserCallback Callback);
Kostya Serebryany8b0d90a2016-05-13 18:04:35 +000047
Aaron Ballmanef116982015-01-29 16:58:29 +000048using namespace std::chrono;
Kostya Serebryanyaca76962016-01-16 01:23:12 +000049typedef std::vector<uint8_t> Unit;
Kostya Serebryany945761b2016-03-18 00:23:29 +000050typedef std::vector<Unit> UnitVector;
Aaron Ballmanef116982015-01-29 16:58:29 +000051
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000052// A simple POD sized array of bytes.
Ivan Krasindf919102016-01-22 22:28:27 +000053template <size_t kMaxSize> class FixedWord {
54public:
Kostya Serebryany160dcba2016-01-22 23:55:14 +000055 FixedWord() {}
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000056 FixedWord(const uint8_t *B, uint8_t S) { Set(B, S); }
57
58 void Set(const uint8_t *B, uint8_t S) {
59 assert(S <= kMaxSize);
60 memcpy(Data, B, S);
61 Size = S;
62 }
63
Ivan Krasindf919102016-01-22 22:28:27 +000064 bool operator==(const FixedWord<kMaxSize> &w) const {
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000065 return Size == w.Size && 0 == memcmp(Data, w.Data, Size);
66 }
67
Ivan Krasindf919102016-01-22 22:28:27 +000068 bool operator<(const FixedWord<kMaxSize> &w) const {
69 if (Size != w.Size)
70 return Size < w.Size;
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000071 return memcmp(Data, w.Data, Size) < 0;
72 }
73
74 static size_t GetMaxSize() { return kMaxSize; }
75 const uint8_t *data() const { return Data; }
76 uint8_t size() const { return Size; }
77
Ivan Krasindf919102016-01-22 22:28:27 +000078private:
Kostya Serebryany160dcba2016-01-22 23:55:14 +000079 uint8_t Size = 0;
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000080 uint8_t Data[kMaxSize];
81};
82
Ivan Krasindf919102016-01-22 22:28:27 +000083typedef FixedWord<27> Word; // 28 bytes.
Kostya Serebryany476f0ce2016-01-16 03:53:32 +000084
Kostya Serebryanybfbe7fc2016-02-02 03:03:47 +000085bool IsFile(const std::string &Path);
Kostya Serebryany52a788e2015-03-31 20:13:20 +000086std::string FileToString(const std::string &Path);
Kostya Serebryanya35f7d32016-02-18 21:49:10 +000087Unit FileToVector(const std::string &Path, size_t MaxSize = 0);
Kostya Serebryany1ac80552015-05-08 21:30:55 +000088void ReadDirToVectorOfUnits(const char *Path, std::vector<Unit> *V,
Kostya Serebryanya35f7d32016-02-18 21:49:10 +000089 long *Epoch, size_t MaxSize);
Aaron Ballmanef116982015-01-29 16:58:29 +000090void WriteToFile(const Unit &U, const std::string &Path);
Kostya Serebryany5b266a82015-02-04 19:10:20 +000091void CopyFileToErr(const std::string &Path);
Aaron Ballmanef116982015-01-29 16:58:29 +000092// Returns "Dir/FileName" or equivalent for the current OS.
93std::string DirPlusFile(const std::string &DirPath,
94 const std::string &FileName);
95
Kostya Serebryany49e40902016-03-18 20:58:29 +000096void DupAndCloseStderr();
97void CloseStdout();
Kostya Serebryany20e9bcb2015-05-23 01:07:46 +000098void Printf(const char *Fmt, ...);
Kostya Serebryany98abb2c2016-01-13 23:46:01 +000099void PrintHexArray(const Unit &U, const char *PrintAfter = "");
100void PrintHexArray(const uint8_t *Data, size_t Size,
101 const char *PrintAfter = "");
Kostya Serebryany41740052016-01-12 02:36:59 +0000102void PrintASCII(const uint8_t *Data, size_t Size, const char *PrintAfter = "");
Aaron Ballmanef116982015-01-29 16:58:29 +0000103void PrintASCII(const Unit &U, const char *PrintAfter = "");
Kostya Serebryany476f0ce2016-01-16 03:53:32 +0000104void PrintASCII(const Word &W, const char *PrintAfter = "");
Aaron Ballmanef116982015-01-29 16:58:29 +0000105std::string Hash(const Unit &U);
106void SetTimer(int Seconds);
Kostya Serebryany228d5b12016-03-01 22:19:21 +0000107void SetSigSegvHandler();
108void SetSigBusHandler();
109void SetSigAbrtHandler();
110void SetSigIllHandler();
111void SetSigFpeHandler();
112void SetSigIntHandler();
Kostya Serebryanyf389ae12016-03-24 21:03:58 +0000113void SetSigTermHandler();
Kostya Serebryany9e48cda2015-12-04 22:29:39 +0000114std::string Base64(const Unit &U);
Kostya Serebryanydc3135d2015-11-12 01:02:01 +0000115int ExecuteCommand(const std::string &Command);
Kostya Serebryany66ff0752016-02-26 22:42:23 +0000116size_t GetPeakRSSMb();
Aaron Ballmanef116982015-01-29 16:58:29 +0000117
Kostya Serebryany96eab652015-05-14 22:41:49 +0000118// Private copy of SHA1 implementation.
119static const int kSHA1NumBytes = 20;
120// Computes SHA1 hash of 'Len' bytes in 'Data', writes kSHA1NumBytes to 'Out'.
121void ComputeSHA1(const uint8_t *Data, size_t Len, uint8_t *Out);
122
Kostya Serebryanybc7c0ad2015-08-11 01:44:42 +0000123// Changes U to contain only ASCII (isprint+isspace) characters.
124// Returns true iff U has been changed.
Kostya Serebryany8a5bef02016-02-13 17:56:51 +0000125bool ToASCII(uint8_t *Data, size_t Size);
Kostya Serebryanya9346c22015-09-02 19:08:08 +0000126bool IsASCII(const Unit &U);
Kostya Serebryanyf1f3f932016-05-26 20:03:02 +0000127bool IsASCII(const uint8_t *Data, size_t Size);
Kostya Serebryanybc7c0ad2015-08-11 01:44:42 +0000128
Kostya Serebryany9690fcf2015-05-12 18:51:57 +0000129int NumberOfCpuCores();
Kostya Serebryanyd6edce92015-10-16 23:04:31 +0000130int GetPid();
Kostya Serebryany8b8f7a32016-05-06 23:38:07 +0000131void SleepSeconds(int Seconds);
Kostya Serebryany9690fcf2015-05-12 18:51:57 +0000132
Kostya Serebryanya3992212016-02-13 03:00:53 +0000133class Random {
Kostya Serebryanyecab57b2016-02-13 02:39:30 +0000134 public:
Kostya Serebryanya3992212016-02-13 03:00:53 +0000135 Random(unsigned int seed) : R(seed) {}
136 size_t Rand() { return R(); }
137 size_t RandBool() { return Rand() % 2; }
Kostya Serebryanyecab57b2016-02-13 02:39:30 +0000138 size_t operator()(size_t n) { return n ? Rand() % n : 0; }
Kostya Serebryany7ec0c562016-02-13 03:25:16 +0000139 std::mt19937 &Get_mt19937() { return R; }
Kostya Serebryanyecab57b2016-02-13 02:39:30 +0000140 private:
Kostya Serebryanya3992212016-02-13 03:00:53 +0000141 std::mt19937 R;
Kostya Serebryanyecab57b2016-02-13 02:39:30 +0000142};
143
Kostya Serebryany9838b2b2015-09-03 20:23:46 +0000144// Dictionary.
145
146// Parses one dictionary entry.
147// If successfull, write the enty to Unit and returns true,
148// otherwise returns false.
149bool ParseOneDictionaryEntry(const std::string &Str, Unit *U);
150// Parses the dictionary file, fills Units, returns true iff all lines
151// were parsed succesfully.
152bool ParseDictionaryFile(const std::string &Text, std::vector<Unit> *Units);
153
Kostya Serebryany292cf032016-02-13 03:37:24 +0000154class DictionaryEntry {
155 public:
156 DictionaryEntry() {}
157 DictionaryEntry(Word W) : W(W) {}
158 DictionaryEntry(Word W, size_t PositionHint) : W(W), PositionHint(PositionHint) {}
159 const Word &GetW() const { return W; }
160
161 bool HasPositionHint() const { return PositionHint != std::numeric_limits<size_t>::max(); }
162 size_t GetPositionHint() const {
163 assert(HasPositionHint());
164 return PositionHint;
165 }
166 void IncUseCount() { UseCount++; }
167 void IncSuccessCount() { SuccessCount++; }
168 size_t GetUseCount() const { return UseCount; }
169 size_t GetSuccessCount() const {return SuccessCount; }
170
171private:
172 Word W;
173 size_t PositionHint = std::numeric_limits<size_t>::max();
174 size_t UseCount = 0;
175 size_t SuccessCount = 0;
176};
177
178class Dictionary {
179 public:
180 static const size_t kMaxDictSize = 1 << 14;
181
182 bool ContainsWord(const Word &W) const {
183 return std::any_of(begin(), end(), [&](const DictionaryEntry &DE) {
184 return DE.GetW() == W;
185 });
186 }
187 const DictionaryEntry *begin() const { return &DE[0]; }
188 const DictionaryEntry *end() const { return begin() + Size; }
189 DictionaryEntry & operator[] (size_t Idx) {
190 assert(Idx < Size);
191 return DE[Idx];
192 }
193 void push_back(DictionaryEntry DE) {
194 if (Size < kMaxDictSize)
195 this->DE[Size++] = DE;
196 }
197 void clear() { Size = 0; }
198 bool empty() const { return Size == 0; }
199 size_t size() const { return Size; }
200
201private:
202 DictionaryEntry DE[kMaxDictSize];
203 size_t Size = 0;
204};
205
Kostya Serebryany628bc3e2016-01-16 00:04:36 +0000206class MutationDispatcher {
Ivan Krasindf919102016-01-22 22:28:27 +0000207public:
Kostya Serebryany23194962016-02-13 03:46:26 +0000208 MutationDispatcher(Random &Rand) : Rand(Rand) {}
Kostya Serebryany292cf032016-02-13 03:37:24 +0000209 ~MutationDispatcher() {}
Kostya Serebryany628bc3e2016-01-16 00:04:36 +0000210 /// Indicate that we are about to start a new sequence of mutations.
211 void StartMutationSequence();
212 /// Print the current sequence of mutations.
213 void PrintMutationSequence();
214 /// Indicate that the current sequence of mutations was successfull.
215 void RecordSuccessfulMutationSequence();
216 /// Mutates data by shuffling bytes.
217 size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize);
218 /// Mutates data by erasing a byte.
219 size_t Mutate_EraseByte(uint8_t *Data, size_t Size, size_t MaxSize);
220 /// Mutates data by inserting a byte.
221 size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize);
222 /// Mutates data by chanding one byte.
223 size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize);
224 /// Mutates data by chanding one bit.
225 size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize);
226
227 /// Mutates data by adding a word from the manual dictionary.
228 size_t Mutate_AddWordFromManualDictionary(uint8_t *Data, size_t Size,
229 size_t MaxSize);
230
231 /// Mutates data by adding a word from the temporary automatic dictionary.
232 size_t Mutate_AddWordFromTemporaryAutoDictionary(uint8_t *Data, size_t Size,
233 size_t MaxSize);
234
235 /// Mutates data by adding a word from the persistent automatic dictionary.
236 size_t Mutate_AddWordFromPersistentAutoDictionary(uint8_t *Data, size_t Size,
237 size_t MaxSize);
238
239 /// Tries to find an ASCII integer in Data, changes it to another ASCII int.
240 size_t Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MaxSize);
241
242 /// CrossOver Data with some other element of the corpus.
243 size_t Mutate_CrossOver(uint8_t *Data, size_t Size, size_t MaxSize);
244
245 /// Applies one of the above mutations.
246 /// Returns the new size of data which could be up to MaxSize.
247 size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize);
248
249 /// Creates a cross-over of two pieces of Data, returns its size.
250 size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2,
251 size_t Size2, uint8_t *Out, size_t MaxOutSize);
252
Kostya Serebryany476f0ce2016-01-16 03:53:32 +0000253 void AddWordToManualDictionary(const Word &W);
Kostya Serebryany628bc3e2016-01-16 00:04:36 +0000254
Kostya Serebryany476f0ce2016-01-16 03:53:32 +0000255 void AddWordToAutoDictionary(const Word &W, size_t PositionHint);
Kostya Serebryany628bc3e2016-01-16 00:04:36 +0000256 void ClearAutoDictionary();
257 void PrintRecommendedDictionary();
258
Kostya Serebryany292cf032016-02-13 03:37:24 +0000259 void SetCorpus(const std::vector<Unit> *Corpus) { this->Corpus = Corpus; }
Kostya Serebryany628bc3e2016-01-16 00:04:36 +0000260
Kostya Serebryany7ec0c562016-02-13 03:25:16 +0000261 Random &GetRand() { return Rand; }
262
Ivan Krasindf919102016-01-22 22:28:27 +0000263private:
Kostya Serebryany292cf032016-02-13 03:37:24 +0000264
265 struct Mutator {
266 size_t (MutationDispatcher::*Fn)(uint8_t *Data, size_t Size, size_t Max);
267 const char *Name;
268 };
269
Kostya Serebryany292cf032016-02-13 03:37:24 +0000270 size_t AddWordFromDictionary(Dictionary &D, uint8_t *Data, size_t Size,
271 size_t MaxSize);
272
Kostya Serebryanya3992212016-02-13 03:00:53 +0000273 Random &Rand;
Kostya Serebryany292cf032016-02-13 03:37:24 +0000274 // Dictionary provided by the user via -dict=DICT_FILE.
275 Dictionary ManualDictionary;
276 // Temporary dictionary modified by the fuzzer itself,
277 // recreated periodically.
278 Dictionary TempAutoDictionary;
279 // Persistent dictionary modified by the fuzzer, consists of
280 // entries that led to successfull discoveries in the past mutations.
281 Dictionary PersistentAutoDictionary;
Kostya Serebryany292cf032016-02-13 03:37:24 +0000282 std::vector<Mutator> CurrentMutatorSequence;
283 std::vector<DictionaryEntry *> CurrentDictionaryEntrySequence;
284 const std::vector<Unit> *Corpus = nullptr;
Kostya Serebryany8a5bef02016-02-13 17:56:51 +0000285 std::vector<uint8_t> MutateInPlaceHere;
Kostya Serebryany23194962016-02-13 03:46:26 +0000286
287 static Mutator Mutators[];
Kostya Serebryany628bc3e2016-01-16 00:04:36 +0000288};
289
Aaron Ballmanef116982015-01-29 16:58:29 +0000290class Fuzzer {
Ivan Krasindf919102016-01-22 22:28:27 +0000291public:
Aaron Ballmanef116982015-01-29 16:58:29 +0000292 struct FuzzingOptions {
293 int Verbosity = 1;
Kostya Serebryany64d24572016-03-12 01:57:04 +0000294 size_t MaxLen = 0;
Kostya Serebryany490bbd62015-05-19 22:12:57 +0000295 int UnitTimeoutSec = 300;
Kostya Serebryany54a63632016-01-29 23:30:07 +0000296 int TimeoutExitCode = 77;
Kostya Serebryany228d5b12016-03-01 22:19:21 +0000297 int ErrorExitCode = 77;
Kostya Serebryanyb85db172015-10-02 20:47:55 +0000298 int MaxTotalTimeSec = 0;
Kostya Serebryany8b8f7a32016-05-06 23:38:07 +0000299 int RssLimitMb = 0;
Aaron Ballmanef116982015-01-29 16:58:29 +0000300 bool DoCrossOver = true;
Ivan Krasindf919102016-01-22 22:28:27 +0000301 int MutateDepth = 5;
Kostya Serebryanybe5e0ed2015-03-03 23:27:02 +0000302 bool UseCounters = false;
Kostya Serebryany2e9fca92015-10-22 23:55:39 +0000303 bool UseIndirCalls = true;
Kostya Serebryany5a99ecb2015-05-11 20:51:19 +0000304 bool UseTraces = false;
Kostya Serebryanyae5b9562016-01-15 06:24:05 +0000305 bool UseMemcmp = true;
Ivan Krasindf919102016-01-22 22:28:27 +0000306 bool UseFullCoverageSet = false;
Kostya Serebryany1ac80552015-05-08 21:30:55 +0000307 bool Reload = true;
Kostya Serebryanyfed509e2015-10-17 04:38:26 +0000308 bool ShuffleAtStartUp = true;
Kostya Serebryany945761b2016-03-18 00:23:29 +0000309 bool PreferSmall = true;
Kostya Serebryany33f86692015-02-04 22:20:09 +0000310 size_t MaxNumberOfRuns = ULONG_MAX;
Kostya Serebryany70926ae2015-08-05 21:43:48 +0000311 int ReportSlowUnits = 10;
Kostya Serebryanybc7c0ad2015-08-11 01:44:42 +0000312 bool OnlyASCII = false;
Aaron Ballmanef116982015-01-29 16:58:29 +0000313 std::string OutputCorpus;
Kostya Serebryanybd5d1cd2015-10-09 03:57:59 +0000314 std::string ArtifactPrefix = "./";
Kostya Serebryany2d0ef142015-11-25 21:40:46 +0000315 std::string ExactArtifactPath;
Kostya Serebryanyb91c62b2015-10-16 22:41:47 +0000316 bool SaveArtifacts = true;
Ivan Krasindf919102016-01-22 22:28:27 +0000317 bool PrintNEW = true; // Print a status line when new units are found;
Mike Aizatskya9c23872015-11-12 04:38:40 +0000318 bool OutputCSV = false;
Mike Aizatsky8b11f872016-01-06 00:21:22 +0000319 bool PrintNewCovPcs = false;
Kostya Serebryany66ff0752016-02-26 22:42:23 +0000320 bool PrintFinalStats = false;
Kostya Serebryany2fe93042016-04-29 18:49:55 +0000321 bool DetectLeaks = true;
Mike Aizatskyaf432a42016-05-24 23:14:29 +0000322 bool TruncateUnits = false;
Aaron Ballmanef116982015-01-29 16:58:29 +0000323 };
Mike Aizatsky1aa501e2016-05-10 23:43:15 +0000324
325 // Aggregates all available coverage measurements.
326 struct Coverage {
327 Coverage() { Reset(); }
328
329 void Reset() {
330 BlockCoverage = 0;
331 CallerCalleeCoverage = 0;
332 PcMapBits = 0;
333 CounterBitmapBits = 0;
334 PcBufferLen = 0;
335 CounterBitmap.clear();
336 PCMap.Reset();
337 }
338
339 std::string DebugString() const;
340
341 size_t BlockCoverage;
342 size_t CallerCalleeCoverage;
343
344 size_t PcBufferLen;
345 // Precalculated number of bits in CounterBitmap.
346 size_t CounterBitmapBits;
347 std::vector<uint8_t> CounterBitmap;
348 // Precalculated number of bits in PCMap.
349 size_t PcMapBits;
350 PcCoverageMap PCMap;
351 };
352
Kostya Serebryany7ec0c562016-02-13 03:25:16 +0000353 Fuzzer(UserCallback CB, MutationDispatcher &MD, FuzzingOptions Options);
Ivan Krasindf919102016-01-22 22:28:27 +0000354 void AddToCorpus(const Unit &U) {
355 Corpus.push_back(U);
356 UpdateCorpusDistribution();
357 }
Kostya Serebryanydc3135d2015-11-12 01:02:01 +0000358 size_t ChooseUnitIdxToMutate();
359 const Unit &ChooseUnitToMutate() { return Corpus[ChooseUnitIdxToMutate()]; };
Mike Aizatskyaf432a42016-05-24 23:14:29 +0000360 void TruncateUnits(std::vector<Unit> *NewCorpus);
Kostya Serebryany468ed782015-09-08 17:30:35 +0000361 void Loop();
Kostya Serebryanydc3135d2015-11-12 01:02:01 +0000362 void Drill();
Aaron Ballmanef116982015-01-29 16:58:29 +0000363 void ShuffleAndMinimize();
Kostya Serebryany22526252015-05-11 21:16:27 +0000364 void InitializeTraceState();
Kostya Serebryanyd50a3ee2016-01-13 23:02:30 +0000365 void AssignTaintLabels(uint8_t *Data, size_t Size);
Aaron Ballmanef116982015-01-29 16:58:29 +0000366 size_t CorpusSize() const { return Corpus.size(); }
Kostya Serebryany64d24572016-03-12 01:57:04 +0000367 size_t MaxUnitSizeInCorpus() const;
Kostya Serebryanya35f7d32016-02-18 21:49:10 +0000368 void ReadDir(const std::string &Path, long *Epoch, size_t MaxSize) {
Kostya Serebryany9cc3b0d2015-10-24 01:16:40 +0000369 Printf("Loading corpus: %s\n", Path.c_str());
Kostya Serebryanya35f7d32016-02-18 21:49:10 +0000370 ReadDirToVectorOfUnits(Path.c_str(), &Corpus, Epoch, MaxSize);
Aaron Ballmanef116982015-01-29 16:58:29 +0000371 }
Kostya Serebryany64d24572016-03-12 01:57:04 +0000372 void RereadOutputCorpus(size_t MaxSize);
Aaron Ballmanef116982015-01-29 16:58:29 +0000373 // Save the current corpus to OutputCorpus.
374 void SaveCorpus();
375
Kostya Serebryany92e04762015-02-04 23:42:42 +0000376 size_t secondsSinceProcessStartUp() {
377 return duration_cast<seconds>(system_clock::now() - ProcessStartTime)
378 .count();
379 }
Kostya Serebryany66ff0752016-02-26 22:42:23 +0000380 size_t execPerSec() {
381 size_t Seconds = secondsSinceProcessStartUp();
382 return Seconds ? TotalNumberOfRuns / Seconds : 0;
383 }
Kostya Serebryany92e04762015-02-04 23:42:42 +0000384
385 size_t getTotalNumberOfRuns() { return TotalNumberOfRuns; }
386
Kostya Serebryany52a788e2015-03-31 20:13:20 +0000387 static void StaticAlarmCallback();
Kostya Serebryany228d5b12016-03-01 22:19:21 +0000388 static void StaticCrashSignalCallback();
389 static void StaticInterruptCallback();
Kostya Serebryany52a788e2015-03-31 20:13:20 +0000390
Kostya Serebryany8a5bef02016-02-13 17:56:51 +0000391 void ExecuteCallback(const uint8_t *Data, size_t Size);
Kostya Serebryanybaf7fd02016-05-04 20:44:50 +0000392 bool RunOne(const uint8_t *Data, size_t Size);
Aaron Ballmanef116982015-01-29 16:58:29 +0000393
Kostya Serebryany9cc3b0d2015-10-24 01:16:40 +0000394 // Merge Corpora[1:] into Corpora[0].
395 void Merge(const std::vector<std::string> &Corpora);
Kostya Serebryany945761b2016-03-18 00:23:29 +0000396 // Returns a subset of 'Extra' that adds coverage to 'Initial'.
397 UnitVector FindExtraUnits(const UnitVector &Initial, const UnitVector &Extra);
Kostya Serebryany1deb0492016-02-13 06:24:18 +0000398 MutationDispatcher &GetMD() { return MD; }
Kostya Serebryany66ff0752016-02-26 22:42:23 +0000399 void PrintFinalStats();
Kostya Serebryany64d24572016-03-12 01:57:04 +0000400 void SetMaxLen(size_t MaxLen);
Kostya Serebryany8b8f7a32016-05-06 23:38:07 +0000401 void RssLimitCallback();
Kostya Serebryany9cc3b0d2015-10-24 01:16:40 +0000402
Mike Aizatskyaf432a42016-05-24 23:14:29 +0000403 // Public for tests.
404 void ResetCoverage();
405
Kostya Serebryanyf26017b2016-05-26 21:32:30 +0000406 bool InFuzzingThread() const { return IsMyThread; }
Kostya Serebryanyd8384122016-05-26 22:17:32 +0000407 size_t GetCurrentUnitInFuzzingThead(const uint8_t **Data) const;
Kostya Serebryanyf26017b2016-05-26 21:32:30 +0000408
Ivan Krasindf919102016-01-22 22:28:27 +0000409private:
Kostya Serebryany52a788e2015-03-31 20:13:20 +0000410 void AlarmCallback();
Kostya Serebryany228d5b12016-03-01 22:19:21 +0000411 void CrashCallback();
412 void InterruptCallback();
Kostya Serebryany27ab2d72015-12-19 02:49:09 +0000413 void MutateAndTestOne();
Kostya Serebryany007c9b22015-10-22 22:50:47 +0000414 void ReportNewCoverage(const Unit &U);
Kostya Serebryany8a5bef02016-02-13 17:56:51 +0000415 bool RunOne(const Unit &U) { return RunOne(U.data(), U.size()); }
Kostya Serebryanyf1f3f932016-05-26 20:03:02 +0000416 void RunOneAndUpdateCorpus(const uint8_t *Data, size_t Size);
Aaron Ballmanef116982015-01-29 16:58:29 +0000417 void WriteToOutputCorpus(const Unit &U);
Kostya Serebryany2b7d2e92015-07-23 18:37:22 +0000418 void WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix);
Kostya Serebryany09d2a5f2015-10-22 22:56:45 +0000419 void PrintStats(const char *Where, const char *End = "\n");
Kostya Serebryanydc3135d2015-11-12 01:02:01 +0000420 void PrintStatusForNewUnit(const Unit &U);
Kostya Serebryany945761b2016-03-18 00:23:29 +0000421 void ShuffleCorpus(UnitVector *V);
Kostya Serebryany4b923262016-05-26 20:25:49 +0000422 void TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
423 bool DuringInitialCorpusExecution);
Kostya Serebryany945761b2016-03-18 00:23:29 +0000424
Ivan Krasindf919102016-01-22 22:28:27 +0000425 // Updates the probability distribution for the units in the corpus.
426 // Must be called whenever the corpus or unit weights are changed.
427 void UpdateCorpusDistribution();
Aaron Ballmanef116982015-01-29 16:58:29 +0000428
Mike Aizatsky1aa501e2016-05-10 23:43:15 +0000429 bool UpdateMaxCoverage();
Kostya Serebryany007c9b22015-10-22 22:50:47 +0000430
Kostya Serebryanybeb24c32015-05-07 21:02:11 +0000431 // Trace-based fuzzing: we run a unit with some kind of tracing
432 // enabled and record potentially useful mutations. Then
433 // We apply these mutations one by one to the unit and run it again.
434
435 // Start tracing; forget all previously proposed mutations.
436 void StartTraceRecording();
Kostya Serebryanyb65805a2016-01-09 03:08:58 +0000437 // Stop tracing.
438 void StopTraceRecording();
Kostya Serebryanybeb24c32015-05-07 21:02:11 +0000439
Aaron Ballmanef116982015-01-29 16:58:29 +0000440 void SetDeathCallback();
Kostya Serebryany52a788e2015-03-31 20:13:20 +0000441 static void StaticDeathCallback();
Kostya Serebryany228d5b12016-03-01 22:19:21 +0000442 void DumpCurrentUnit(const char *Prefix);
Kostya Serebryany52a788e2015-03-31 20:13:20 +0000443 void DeathCallback();
Kostya Serebryany98abb2c2016-01-13 23:46:01 +0000444
Kostya Serebryany8fc3a272016-05-27 00:21:33 +0000445 void LazyAllocateCurrentUnitData();
446 uint8_t *CurrentUnitData = nullptr;
Kostya Serebryany0edb5632016-05-27 00:54:15 +0000447 std::atomic<size_t> CurrentUnitSize;
Aaron Ballmanef116982015-01-29 16:58:29 +0000448
449 size_t TotalNumberOfRuns = 0;
Kostya Serebryany66ff0752016-02-26 22:42:23 +0000450 size_t NumberOfNewUnitsAdded = 0;
Aaron Ballmanef116982015-01-29 16:58:29 +0000451
Kostya Serebryany1bfd5832016-04-20 00:24:21 +0000452 bool HasMoreMallocsThanFrees = false;
Kostya Serebryany7018a1a2016-04-27 19:52:34 +0000453 size_t NumberOfLeakDetectionAttempts = 0;
Kostya Serebryany1bfd5832016-04-20 00:24:21 +0000454
Aaron Ballmanef116982015-01-29 16:58:29 +0000455 std::vector<Unit> Corpus;
Kostya Serebryanycbb23342015-05-19 01:06:07 +0000456 std::unordered_set<std::string> UnitHashesAddedToCorpus;
Kostya Serebryany8a5bef02016-02-13 17:56:51 +0000457
Ivan Krasindf919102016-01-22 22:28:27 +0000458 std::piecewise_constant_distribution<double> CorpusDistribution;
Kostya Serebryany7ec0c562016-02-13 03:25:16 +0000459 UserCallback CB;
460 MutationDispatcher &MD;
Aaron Ballmanef116982015-01-29 16:58:29 +0000461 FuzzingOptions Options;
462 system_clock::time_point ProcessStartTime = system_clock::now();
Kostya Serebryany52a788e2015-03-31 20:13:20 +0000463 system_clock::time_point UnitStartTime;
Kostya Serebryany16901a92015-03-30 23:04:35 +0000464 long TimeOfLongestUnitInSeconds = 0;
Kostya Serebryany1ac80552015-05-08 21:30:55 +0000465 long EpochOfLastReadOfOutputCorpus = 0;
Mike Aizatsky1aa501e2016-05-10 23:43:15 +0000466
467 // Maximum recorded coverage.
468 Coverage MaxCoverage;
Kostya Serebryanyf26017b2016-05-26 21:32:30 +0000469
470 // Need to know our own thread.
471 static thread_local bool IsMyThread;
Dan Liewd3c33112016-06-02 05:48:02 +0000472
473 // Interface to functions that may or may not be available.
474 ExternalFunctions EF;
Aaron Ballmanef116982015-01-29 16:58:29 +0000475};
476
Ivan Krasindf919102016-01-22 22:28:27 +0000477}; // namespace fuzzer
Yaron Keren347663b2015-08-10 16:37:40 +0000478
479#endif // LLVM_FUZZER_INTERNAL_H