blob: a323a7a465bd1a4e21bc1dce56eb4da123afb5a2 [file] [log] [blame]
George Karpenkov10ab2ac2017-08-21 23:25:501//===- FuzzerLoop.cpp - Fuzzer's main loop --------------------------------===//
2//
Chandler Carruth2946cd72019-01-19 08:50:563// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
George Karpenkov10ab2ac2017-08-21 23:25:506//
7//===----------------------------------------------------------------------===//
8// Fuzzer's main loop.
9//===----------------------------------------------------------------------===//
10
11#include "FuzzerCorpus.h"
12#include "FuzzerIO.h"
13#include "FuzzerInternal.h"
14#include "FuzzerMutate.h"
15#include "FuzzerRandom.h"
George Karpenkov10ab2ac2017-08-21 23:25:5016#include "FuzzerTracePC.h"
17#include <algorithm>
18#include <cstring>
19#include <memory>
Vitaly Buka7dbc1d82017-11-01 03:02:5920#include <mutex>
George Karpenkov10ab2ac2017-08-21 23:25:5021#include <set>
22
23#if defined(__has_include)
24#if __has_include(<sanitizer / lsan_interface.h>)
25#include <sanitizer/lsan_interface.h>
26#endif
27#endif
28
29#define NO_SANITIZE_MEMORY
30#if defined(__has_feature)
31#if __has_feature(memory_sanitizer)
32#undef NO_SANITIZE_MEMORY
33#define NO_SANITIZE_MEMORY __attribute__((no_sanitize_memory))
34#endif
35#endif
36
37namespace fuzzer {
38static const size_t kMaxUnitSizeToPrint = 256;
39
40thread_local bool Fuzzer::IsMyThread;
41
Matt Morehouse43a22962018-07-17 16:12:0042bool RunningUserCallback = false;
43
George Karpenkov10ab2ac2017-08-21 23:25:5044// Only one Fuzzer per process.
45static Fuzzer *F;
46
47// Leak detection is expensive, so we first check if there were more mallocs
48// than frees (using the sanitizer malloc hooks) and only then try to call lsan.
49struct MallocFreeTracer {
50 void Start(int TraceLevel) {
51 this->TraceLevel = TraceLevel;
52 if (TraceLevel)
53 Printf("MallocFreeTracer: START\n");
54 Mallocs = 0;
55 Frees = 0;
56 }
57 // Returns true if there were more mallocs than frees.
58 bool Stop() {
59 if (TraceLevel)
60 Printf("MallocFreeTracer: STOP %zd %zd (%s)\n", Mallocs.load(),
61 Frees.load(), Mallocs == Frees ? "same" : "DIFFERENT");
62 bool Result = Mallocs > Frees;
63 Mallocs = 0;
64 Frees = 0;
65 TraceLevel = 0;
66 return Result;
67 }
68 std::atomic<size_t> Mallocs;
69 std::atomic<size_t> Frees;
70 int TraceLevel = 0;
Vitaly Buka7d223242017-11-02 04:12:1071
72 std::recursive_mutex TraceMutex;
73 bool TraceDisabled = false;
George Karpenkov10ab2ac2017-08-21 23:25:5074};
75
76static MallocFreeTracer AllocTracer;
77
Vitaly Buka7d223242017-11-02 04:12:1078// Locks printing and avoids nested hooks triggered from mallocs/frees in
79// sanitizer.
80class TraceLock {
81public:
82 TraceLock() : Lock(AllocTracer.TraceMutex) {
83 AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled;
84 }
85 ~TraceLock() { AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled; }
86
87 bool IsDisabled() const {
88 // This is already inverted value.
89 return !AllocTracer.TraceDisabled;
90 }
91
92private:
93 std::lock_guard<std::recursive_mutex> Lock;
94};
Vitaly Buka7dbc1d82017-11-01 03:02:5995
George Karpenkov10ab2ac2017-08-21 23:25:5096ATTRIBUTE_NO_SANITIZE_MEMORY
97void MallocHook(const volatile void *ptr, size_t size) {
98 size_t N = AllocTracer.Mallocs++;
99 F->HandleMalloc(size);
100 if (int TraceLevel = AllocTracer.TraceLevel) {
Vitaly Buka7d223242017-11-02 04:12:10101 TraceLock Lock;
102 if (Lock.IsDisabled())
103 return;
George Karpenkov10ab2ac2017-08-21 23:25:50104 Printf("MALLOC[%zd] %p %zd\n", N, ptr, size);
105 if (TraceLevel >= 2 && EF)
Matt Morehouse14cf71a2018-05-08 23:45:05106 PrintStackTrace();
George Karpenkov10ab2ac2017-08-21 23:25:50107 }
108}
109
110ATTRIBUTE_NO_SANITIZE_MEMORY
111void FreeHook(const volatile void *ptr) {
112 size_t N = AllocTracer.Frees++;
113 if (int TraceLevel = AllocTracer.TraceLevel) {
Vitaly Buka7d223242017-11-02 04:12:10114 TraceLock Lock;
115 if (Lock.IsDisabled())
116 return;
George Karpenkov10ab2ac2017-08-21 23:25:50117 Printf("FREE[%zd] %p\n", N, ptr);
118 if (TraceLevel >= 2 && EF)
Matt Morehouse14cf71a2018-05-08 23:45:05119 PrintStackTrace();
George Karpenkov10ab2ac2017-08-21 23:25:50120 }
121}
122
123// Crash on a single malloc that exceeds the rss limit.
124void Fuzzer::HandleMalloc(size_t Size) {
Kostya Serebryanyde9bafb2017-12-01 22:12:04125 if (!Options.MallocLimitMb || (Size >> 20) < (size_t)Options.MallocLimitMb)
George Karpenkov10ab2ac2017-08-21 23:25:50126 return;
127 Printf("==%d== ERROR: libFuzzer: out-of-memory (malloc(%zd))\n", GetPid(),
128 Size);
129 Printf(" To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
Matt Morehouse14cf71a2018-05-08 23:45:05130 PrintStackTrace();
George Karpenkov10ab2ac2017-08-21 23:25:50131 DumpCurrentUnit("oom-");
132 Printf("SUMMARY: libFuzzer: out-of-memory\n");
133 PrintFinalStats();
Kostya Serebryany0fda9dc2019-02-09 00:16:21134 _Exit(Options.OOMExitCode); // Stop right now.
George Karpenkov10ab2ac2017-08-21 23:25:50135}
136
137Fuzzer::Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD,
138 FuzzingOptions Options)
139 : CB(CB), Corpus(Corpus), MD(MD), Options(Options) {
140 if (EF->__sanitizer_set_death_callback)
141 EF->__sanitizer_set_death_callback(StaticDeathCallback);
142 assert(!F);
143 F = this;
144 TPC.ResetMaps();
145 IsMyThread = true;
146 if (Options.DetectLeaks && EF->__sanitizer_install_malloc_and_free_hooks)
147 EF->__sanitizer_install_malloc_and_free_hooks(MallocHook, FreeHook);
148 TPC.SetUseCounters(Options.UseCounters);
Kostya Serebryany51ddb882018-07-03 22:33:09149 TPC.SetUseValueProfileMask(Options.UseValueProfile);
George Karpenkov10ab2ac2017-08-21 23:25:50150
151 if (Options.Verbosity)
152 TPC.PrintModuleInfo();
153 if (!Options.OutputCorpus.empty() && Options.ReloadIntervalSec)
154 EpochOfLastReadOfOutputCorpus = GetEpoch(Options.OutputCorpus);
155 MaxInputLen = MaxMutationLen = Options.MaxLen;
Kostya Serebryanyb6ca1e72019-02-16 01:23:41156 TmpMaxMutationLen = 0; // Will be set once we load the corpus.
George Karpenkov10ab2ac2017-08-21 23:25:50157 AllocateCurrentUnitData();
158 CurrentUnitSize = 0;
159 memset(BaseSha1, 0, sizeof(BaseSha1));
Kostya Serebryanye9c6f062018-05-16 23:26:37160 TPC.SetFocusFunction(Options.FocusFunction);
Kostya Serebryany1fd005f2018-06-06 01:23:29161 DFT.Init(Options.DataFlowTrace, Options.FocusFunction);
George Karpenkov10ab2ac2017-08-21 23:25:50162}
163
Alex Shlyapnikov5ded0702017-10-23 23:24:33164Fuzzer::~Fuzzer() {}
George Karpenkov10ab2ac2017-08-21 23:25:50165
166void Fuzzer::AllocateCurrentUnitData() {
Alex Shlyapnikov5ded0702017-10-23 23:24:33167 if (CurrentUnitData || MaxInputLen == 0)
168 return;
George Karpenkov10ab2ac2017-08-21 23:25:50169 CurrentUnitData = new uint8_t[MaxInputLen];
170}
171
172void Fuzzer::StaticDeathCallback() {
173 assert(F);
174 F->DeathCallback();
175}
176
177void Fuzzer::DumpCurrentUnit(const char *Prefix) {
Alex Shlyapnikov5ded0702017-10-23 23:24:33178 if (!CurrentUnitData)
179 return; // Happens when running individual inputs.
Matt Morehousea34c65e2018-07-09 23:51:08180 ScopedDisableMsanInterceptorChecks S;
George Karpenkov10ab2ac2017-08-21 23:25:50181 MD.PrintMutationSequence();
182 Printf("; base unit: %s\n", Sha1ToString(BaseSha1).c_str());
183 size_t UnitSize = CurrentUnitSize;
184 if (UnitSize <= kMaxUnitSizeToPrint) {
185 PrintHexArray(CurrentUnitData, UnitSize, "\n");
186 PrintASCII(CurrentUnitData, UnitSize, "\n");
187 }
188 WriteUnitToFileWithPrefix({CurrentUnitData, CurrentUnitData + UnitSize},
189 Prefix);
190}
191
192NO_SANITIZE_MEMORY
193void Fuzzer::DeathCallback() {
194 DumpCurrentUnit("crash-");
195 PrintFinalStats();
196}
197
198void Fuzzer::StaticAlarmCallback() {
199 assert(F);
200 F->AlarmCallback();
201}
202
203void Fuzzer::StaticCrashSignalCallback() {
204 assert(F);
205 F->CrashCallback();
206}
207
George Karpenkov10ab2ac2017-08-21 23:25:50208void Fuzzer::StaticExitCallback() {
209 assert(F);
210 F->ExitCallback();
211}
212
213void Fuzzer::StaticInterruptCallback() {
214 assert(F);
215 F->InterruptCallback();
216}
217
Kostya Serebryanya2ca2dc2017-11-09 20:30:19218void Fuzzer::StaticGracefulExitCallback() {
219 assert(F);
220 F->GracefulExitRequested = true;
221 Printf("INFO: signal received, trying to exit gracefully\n");
222}
223
George Karpenkov10ab2ac2017-08-21 23:25:50224void Fuzzer::StaticFileSizeExceedCallback() {
225 Printf("==%lu== ERROR: libFuzzer: file size exceeded\n", GetPid());
226 exit(1);
227}
228
229void Fuzzer::CrashCallback() {
Julian Lettner15df2732019-01-31 01:24:01230 if (EF->__sanitizer_acquire_crash_state &&
231 !EF->__sanitizer_acquire_crash_state())
232 return;
George Karpenkov10ab2ac2017-08-21 23:25:50233 Printf("==%lu== ERROR: libFuzzer: deadly signal\n", GetPid());
Matt Morehouse14cf71a2018-05-08 23:45:05234 PrintStackTrace();
George Karpenkov10ab2ac2017-08-21 23:25:50235 Printf("NOTE: libFuzzer has rudimentary signal handlers.\n"
236 " Combine libFuzzer with AddressSanitizer or similar for better "
237 "crash reports.\n");
238 Printf("SUMMARY: libFuzzer: deadly signal\n");
239 DumpCurrentUnit("crash-");
240 PrintFinalStats();
Alex Shlyapnikov5ded0702017-10-23 23:24:33241 _Exit(Options.ErrorExitCode); // Stop right now.
George Karpenkov10ab2ac2017-08-21 23:25:50242}
243
244void Fuzzer::ExitCallback() {
Matt Morehouse43a22962018-07-17 16:12:00245 if (!RunningUserCallback)
George Karpenkov10ab2ac2017-08-21 23:25:50246 return; // This exit did not come from the user callback
Matt Morehouse52fd1692018-05-01 21:01:53247 if (EF->__sanitizer_acquire_crash_state &&
248 !EF->__sanitizer_acquire_crash_state())
249 return;
George Karpenkov10ab2ac2017-08-21 23:25:50250 Printf("==%lu== ERROR: libFuzzer: fuzz target exited\n", GetPid());
Matt Morehouse14cf71a2018-05-08 23:45:05251 PrintStackTrace();
George Karpenkov10ab2ac2017-08-21 23:25:50252 Printf("SUMMARY: libFuzzer: fuzz target exited\n");
253 DumpCurrentUnit("crash-");
254 PrintFinalStats();
255 _Exit(Options.ErrorExitCode);
256}
257
Kostya Serebryanya2ca2dc2017-11-09 20:30:19258void Fuzzer::MaybeExitGracefully() {
Kostya Serebryanyf762a112019-02-08 21:27:23259 if (!F->GracefulExitRequested) return;
Kostya Serebryanya2ca2dc2017-11-09 20:30:19260 Printf("==%lu== INFO: libFuzzer: exiting as requested\n", GetPid());
Kostya Serebryany312af152019-02-16 00:14:16261 RmDirRecursive(TempPath(".dir"));
Kostya Serebryanyf762a112019-02-08 21:27:23262 F->PrintFinalStats();
Kostya Serebryanya2ca2dc2017-11-09 20:30:19263 _Exit(0);
264}
265
George Karpenkov10ab2ac2017-08-21 23:25:50266void Fuzzer::InterruptCallback() {
267 Printf("==%lu== libFuzzer: run interrupted; exiting\n", GetPid());
268 PrintFinalStats();
Kostya Serebryany312af152019-02-16 00:14:16269 RmDirRecursive(TempPath(".dir"));
Kostya Serebryany0fda9dc2019-02-09 00:16:21270 // Stop right now, don't perform any at-exit actions.
271 _Exit(Options.InterruptExitCode);
George Karpenkov10ab2ac2017-08-21 23:25:50272}
273
274NO_SANITIZE_MEMORY
275void Fuzzer::AlarmCallback() {
276 assert(Options.UnitTimeoutSec > 0);
277 // In Windows Alarm callback is executed by a different thread.
Kamil Rytarowski2e611862018-11-06 01:28:01278 // NetBSD's current behavior needs this change too.
279#if !LIBFUZZER_WINDOWS && !LIBFUZZER_NETBSD
Alex Shlyapnikov5ded0702017-10-23 23:24:33280 if (!InFuzzingThread())
281 return;
George Karpenkov10ab2ac2017-08-21 23:25:50282#endif
Matt Morehouse43a22962018-07-17 16:12:00283 if (!RunningUserCallback)
George Karpenkov10ab2ac2017-08-21 23:25:50284 return; // We have not started running units yet.
285 size_t Seconds =
286 duration_cast<seconds>(system_clock::now() - UnitStartTime).count();
287 if (Seconds == 0)
288 return;
289 if (Options.Verbosity >= 2)
290 Printf("AlarmCallback %zd\n", Seconds);
291 if (Seconds >= (size_t)Options.UnitTimeoutSec) {
Matt Morehouse52fd1692018-05-01 21:01:53292 if (EF->__sanitizer_acquire_crash_state &&
293 !EF->__sanitizer_acquire_crash_state())
294 return;
George Karpenkov10ab2ac2017-08-21 23:25:50295 Printf("ALARM: working on the last Unit for %zd seconds\n", Seconds);
296 Printf(" and the timeout value is %d (use -timeout=N to change)\n",
297 Options.UnitTimeoutSec);
298 DumpCurrentUnit("timeout-");
299 Printf("==%lu== ERROR: libFuzzer: timeout after %d seconds\n", GetPid(),
300 Seconds);
Matt Morehouse14cf71a2018-05-08 23:45:05301 PrintStackTrace();
George Karpenkov10ab2ac2017-08-21 23:25:50302 Printf("SUMMARY: libFuzzer: timeout\n");
303 PrintFinalStats();
304 _Exit(Options.TimeoutExitCode); // Stop right now.
305 }
306}
307
308void Fuzzer::RssLimitCallback() {
Matt Morehouse52fd1692018-05-01 21:01:53309 if (EF->__sanitizer_acquire_crash_state &&
310 !EF->__sanitizer_acquire_crash_state())
311 return;
George Karpenkov10ab2ac2017-08-21 23:25:50312 Printf(
313 "==%lu== ERROR: libFuzzer: out-of-memory (used: %zdMb; limit: %zdMb)\n",
314 GetPid(), GetPeakRSSMb(), Options.RssLimitMb);
315 Printf(" To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
Matt Morehouse14cf71a2018-05-08 23:45:05316 PrintMemoryProfile();
George Karpenkov10ab2ac2017-08-21 23:25:50317 DumpCurrentUnit("oom-");
318 Printf("SUMMARY: libFuzzer: out-of-memory\n");
319 PrintFinalStats();
Kostya Serebryany0fda9dc2019-02-09 00:16:21320 _Exit(Options.OOMExitCode); // Stop right now.
George Karpenkov10ab2ac2017-08-21 23:25:50321}
322
323void Fuzzer::PrintStats(const char *Where, const char *End, size_t Units) {
324 size_t ExecPerSec = execPerSec();
325 if (!Options.Verbosity)
326 return;
327 Printf("#%zd\t%s", TotalNumberOfRuns, Where);
328 if (size_t N = TPC.GetTotalPCCoverage())
329 Printf(" cov: %zd", N);
330 if (size_t N = Corpus.NumFeatures())
Alex Shlyapnikov5ded0702017-10-23 23:24:33331 Printf(" ft: %zd", N);
George Karpenkov10ab2ac2017-08-21 23:25:50332 if (!Corpus.empty()) {
333 Printf(" corp: %zd", Corpus.NumActiveUnits());
334 if (size_t N = Corpus.SizeInBytes()) {
Alex Shlyapnikov5ded0702017-10-23 23:24:33335 if (N < (1 << 14))
George Karpenkov10ab2ac2017-08-21 23:25:50336 Printf("/%zdb", N);
337 else if (N < (1 << 24))
338 Printf("/%zdKb", N >> 10);
339 else
340 Printf("/%zdMb", N >> 20);
341 }
Kostya Serebryanye9c6f062018-05-16 23:26:37342 if (size_t FF = Corpus.NumInputsThatTouchFocusFunction())
343 Printf(" focus: %zd", FF);
George Karpenkov10ab2ac2017-08-21 23:25:50344 }
Matt Morehouseddf352b2018-02-22 19:00:17345 if (TmpMaxMutationLen)
346 Printf(" lim: %zd", TmpMaxMutationLen);
George Karpenkov10ab2ac2017-08-21 23:25:50347 if (Units)
348 Printf(" units: %zd", Units);
349
350 Printf(" exec/s: %zd", ExecPerSec);
351 Printf(" rss: %zdMb", GetPeakRSSMb());
352 Printf("%s", End);
353}
354
355void Fuzzer::PrintFinalStats() {
356 if (Options.PrintCoverage)
357 TPC.PrintCoverage();
George Karpenkov10ab2ac2017-08-21 23:25:50358 if (Options.PrintCorpusStats)
359 Corpus.PrintStats();
Alex Shlyapnikov5ded0702017-10-23 23:24:33360 if (!Options.PrintFinalStats)
361 return;
George Karpenkov10ab2ac2017-08-21 23:25:50362 size_t ExecPerSec = execPerSec();
363 Printf("stat::number_of_executed_units: %zd\n", TotalNumberOfRuns);
364 Printf("stat::average_exec_per_sec: %zd\n", ExecPerSec);
365 Printf("stat::new_units_added: %zd\n", NumberOfNewUnitsAdded);
366 Printf("stat::slowest_unit_time_sec: %zd\n", TimeOfLongestUnitInSeconds);
367 Printf("stat::peak_rss_mb: %zd\n", GetPeakRSSMb());
368}
369
370void Fuzzer::SetMaxInputLen(size_t MaxInputLen) {
371 assert(this->MaxInputLen == 0); // Can only reset MaxInputLen from 0 to non-0.
372 assert(MaxInputLen);
373 this->MaxInputLen = MaxInputLen;
374 this->MaxMutationLen = MaxInputLen;
375 AllocateCurrentUnitData();
376 Printf("INFO: -max_len is not provided; "
377 "libFuzzer will not generate inputs larger than %zd bytes\n",
378 MaxInputLen);
379}
380
381void Fuzzer::SetMaxMutationLen(size_t MaxMutationLen) {
382 assert(MaxMutationLen && MaxMutationLen <= MaxInputLen);
383 this->MaxMutationLen = MaxMutationLen;
384}
385
386void Fuzzer::CheckExitOnSrcPosOrItem() {
387 if (!Options.ExitOnSrcPos.empty()) {
George Karpenkovbebcbfb2017-08-27 23:20:09388 static auto *PCsSet = new Set<uintptr_t>;
Kostya Serebryany96f81bc2019-02-14 23:12:33389 auto HandlePC = [&](const TracePC::PCTableEntry *TE) {
390 if (!PCsSet->insert(TE->PC).second)
Alex Shlyapnikov5ded0702017-10-23 23:24:33391 return;
Kostya Serebryany96f81bc2019-02-14 23:12:33392 std::string Descr = DescribePC("%F %L", TE->PC + 1);
George Karpenkov10ab2ac2017-08-21 23:25:50393 if (Descr.find(Options.ExitOnSrcPos) != std::string::npos) {
394 Printf("INFO: found line matching '%s', exiting.\n",
395 Options.ExitOnSrcPos.c_str());
396 _Exit(0);
397 }
398 };
399 TPC.ForEachObservedPC(HandlePC);
400 }
401 if (!Options.ExitOnItem.empty()) {
402 if (Corpus.HasUnit(Options.ExitOnItem)) {
403 Printf("INFO: found item with checksum '%s', exiting.\n",
404 Options.ExitOnItem.c_str());
405 _Exit(0);
406 }
407 }
408}
409
410void Fuzzer::RereadOutputCorpus(size_t MaxSize) {
Alex Shlyapnikov5ded0702017-10-23 23:24:33411 if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec)
412 return;
George Karpenkovbebcbfb2017-08-27 23:20:09413 Vector<Unit> AdditionalCorpus;
George Karpenkov10ab2ac2017-08-21 23:25:50414 ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus,
415 &EpochOfLastReadOfOutputCorpus, MaxSize,
416 /*ExitOnError*/ false);
417 if (Options.Verbosity >= 2)
418 Printf("Reload: read %zd new units.\n", AdditionalCorpus.size());
419 bool Reloaded = false;
420 for (auto &U : AdditionalCorpus) {
421 if (U.size() > MaxSize)
422 U.resize(MaxSize);
423 if (!Corpus.HasUnit(U)) {
424 if (RunOne(U.data(), U.size())) {
425 CheckExitOnSrcPosOrItem();
426 Reloaded = true;
427 }
428 }
429 }
430 if (Reloaded)
431 PrintStats("RELOAD");
432}
433
George Karpenkov10ab2ac2017-08-21 23:25:50434void Fuzzer::PrintPulseAndReportSlowInput(const uint8_t *Data, size_t Size) {
435 auto TimeOfUnit =
436 duration_cast<seconds>(UnitStopTime - UnitStartTime).count();
437 if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) &&
438 secondsSinceProcessStartUp() >= 2)
439 PrintStats("pulse ");
440 if (TimeOfUnit > TimeOfLongestUnitInSeconds * 1.1 &&
441 TimeOfUnit >= Options.ReportSlowUnits) {
442 TimeOfLongestUnitInSeconds = TimeOfUnit;
443 Printf("Slowest unit: %zd s:\n", TimeOfLongestUnitInSeconds);
444 WriteUnitToFileWithPrefix({Data, Data + Size}, "slow-unit-");
445 }
446}
447
Kostya Serebryany4614cc32019-04-13 00:20:31448static void WriteFeatureSetToFile(const std::string &FeaturesDir,
Kostya Serebryany5e67abd2019-04-13 01:57:33449 const std::string &FileName,
Kostya Serebryany4614cc32019-04-13 00:20:31450 const Vector<uint32_t> &FeatureSet) {
451 if (FeaturesDir.empty() || FeatureSet.empty()) return;
452 WriteToFile(reinterpret_cast<const uint8_t *>(FeatureSet.data()),
453 FeatureSet.size() * sizeof(FeatureSet[0]),
Kostya Serebryany5e67abd2019-04-13 01:57:33454 DirPlusFile(FeaturesDir, FileName));
Kostya Serebryany4614cc32019-04-13 00:20:31455}
456
457static void RenameFeatureSetFile(const std::string &FeaturesDir,
458 const std::string &OldFile,
459 const std::string &NewFile) {
460 if (FeaturesDir.empty()) return;
461 RenameFile(DirPlusFile(FeaturesDir, OldFile),
462 DirPlusFile(FeaturesDir, NewFile));
463}
464
George Karpenkov10ab2ac2017-08-21 23:25:50465bool Fuzzer::RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile,
Kostya Serebryanyad05ee02017-12-01 19:18:38466 InputInfo *II, bool *FoundUniqFeatures) {
Alex Shlyapnikov5ded0702017-10-23 23:24:33467 if (!Size)
468 return false;
George Karpenkov10ab2ac2017-08-21 23:25:50469
470 ExecuteCallback(Data, Size);
471
472 UniqFeatureSetTmp.clear();
473 size_t FoundUniqFeaturesOfII = 0;
474 size_t NumUpdatesBefore = Corpus.NumFeatureUpdates();
475 TPC.CollectFeatures([&](size_t Feature) {
George Karpenkov10ab2ac2017-08-21 23:25:50476 if (Corpus.AddFeature(Feature, Size, Options.Shrink))
477 UniqFeatureSetTmp.push_back(Feature);
478 if (Options.ReduceInputs && II)
479 if (std::binary_search(II->UniqFeatureSet.begin(),
480 II->UniqFeatureSet.end(), Feature))
481 FoundUniqFeaturesOfII++;
482 });
Kostya Serebryanyad05ee02017-12-01 19:18:38483 if (FoundUniqFeatures)
484 *FoundUniqFeatures = FoundUniqFeaturesOfII;
George Karpenkov10ab2ac2017-08-21 23:25:50485 PrintPulseAndReportSlowInput(Data, Size);
486 size_t NumNewFeatures = Corpus.NumFeatureUpdates() - NumUpdatesBefore;
487 if (NumNewFeatures) {
488 TPC.UpdateObservedPCs();
Kostya Serebryany4614cc32019-04-13 00:20:31489 auto NewII = Corpus.AddToCorpus({Data, Data + Size}, NumNewFeatures,
490 MayDeleteFile, TPC.ObservedFocusFunction(),
491 UniqFeatureSetTmp, DFT, II);
Kostya Serebryany5e67abd2019-04-13 01:57:33492 WriteFeatureSetToFile(Options.FeaturesDir, Sha1ToString(NewII->Sha1),
Kostya Serebryany4614cc32019-04-13 00:20:31493 NewII->UniqFeatureSet);
George Karpenkov10ab2ac2017-08-21 23:25:50494 return true;
495 }
496 if (II && FoundUniqFeaturesOfII &&
Kostya Serebryany67af9922018-06-07 01:40:20497 II->DataFlowTraceForFocusFunction.empty() &&
George Karpenkov10ab2ac2017-08-21 23:25:50498 FoundUniqFeaturesOfII == II->UniqFeatureSet.size() &&
499 II->U.size() > Size) {
Kostya Serebryany4614cc32019-04-13 00:20:31500 auto OldFeaturesFile = Sha1ToString(II->Sha1);
George Karpenkov10ab2ac2017-08-21 23:25:50501 Corpus.Replace(II, {Data, Data + Size});
Kostya Serebryany4614cc32019-04-13 00:20:31502 RenameFeatureSetFile(Options.FeaturesDir, OldFeaturesFile,
503 Sha1ToString(II->Sha1));
George Karpenkov10ab2ac2017-08-21 23:25:50504 return true;
505 }
506 return false;
507}
508
509size_t Fuzzer::GetCurrentUnitInFuzzingThead(const uint8_t **Data) const {
510 assert(InFuzzingThread());
511 *Data = CurrentUnitData;
512 return CurrentUnitSize;
513}
514
515void Fuzzer::CrashOnOverwrittenData() {
516 Printf("==%d== ERROR: libFuzzer: fuzz target overwrites it's const input\n",
517 GetPid());
518 DumpCurrentUnit("crash-");
519 Printf("SUMMARY: libFuzzer: out-of-memory\n");
520 _Exit(Options.ErrorExitCode); // Stop right now.
521}
522
523// Compare two arrays, but not all bytes if the arrays are large.
524static bool LooseMemeq(const uint8_t *A, const uint8_t *B, size_t Size) {
525 const size_t Limit = 64;
526 if (Size <= 64)
527 return !memcmp(A, B, Size);
528 // Compare first and last Limit/2 bytes.
529 return !memcmp(A, B, Limit / 2) &&
530 !memcmp(A + Size - Limit / 2, B + Size - Limit / 2, Limit / 2);
531}
532
533void Fuzzer::ExecuteCallback(const uint8_t *Data, size_t Size) {
534 TPC.RecordInitialStack();
535 TotalNumberOfRuns++;
536 assert(InFuzzingThread());
George Karpenkov10ab2ac2017-08-21 23:25:50537 // We copy the contents of Unit into a separate heap buffer
538 // so that we reliably find buffer overflows in it.
539 uint8_t *DataCopy = new uint8_t[Size];
540 memcpy(DataCopy, Data, Size);
Matt Morehousea34c65e2018-07-09 23:51:08541 if (EF->__msan_unpoison)
542 EF->__msan_unpoison(DataCopy, Size);
George Karpenkov10ab2ac2017-08-21 23:25:50543 if (CurrentUnitData && CurrentUnitData != Data)
544 memcpy(CurrentUnitData, Data, Size);
545 CurrentUnitSize = Size;
Matt Morehousea34c65e2018-07-09 23:51:08546 {
547 ScopedEnableMsanInterceptorChecks S;
548 AllocTracer.Start(Options.TraceMalloc);
549 UnitStartTime = system_clock::now();
550 TPC.ResetMaps();
Matt Morehouse43a22962018-07-17 16:12:00551 RunningUserCallback = true;
Matt Morehousea34c65e2018-07-09 23:51:08552 int Res = CB(DataCopy, Size);
Matt Morehouse43a22962018-07-17 16:12:00553 RunningUserCallback = false;
Matt Morehousea34c65e2018-07-09 23:51:08554 UnitStopTime = system_clock::now();
555 (void)Res;
556 assert(Res == 0);
557 HasMoreMallocsThanFrees = AllocTracer.Stop();
558 }
George Karpenkov10ab2ac2017-08-21 23:25:50559 if (!LooseMemeq(DataCopy, Data, Size))
560 CrashOnOverwrittenData();
561 CurrentUnitSize = 0;
562 delete[] DataCopy;
563}
564
Kostya Serebryany63f48712019-02-12 00:12:33565std::string Fuzzer::WriteToOutputCorpus(const Unit &U) {
George Karpenkov10ab2ac2017-08-21 23:25:50566 if (Options.OnlyASCII)
567 assert(IsASCII(U));
568 if (Options.OutputCorpus.empty())
Kostya Serebryany63f48712019-02-12 00:12:33569 return "";
George Karpenkov10ab2ac2017-08-21 23:25:50570 std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U));
571 WriteToFile(U, Path);
572 if (Options.Verbosity >= 2)
573 Printf("Written %zd bytes to %s\n", U.size(), Path.c_str());
Kostya Serebryany63f48712019-02-12 00:12:33574 return Path;
George Karpenkov10ab2ac2017-08-21 23:25:50575}
576
577void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) {
578 if (!Options.SaveArtifacts)
579 return;
580 std::string Path = Options.ArtifactPrefix + Prefix + Hash(U);
581 if (!Options.ExactArtifactPath.empty())
582 Path = Options.ExactArtifactPath; // Overrides ArtifactPrefix.
583 WriteToFile(U, Path);
584 Printf("artifact_prefix='%s'; Test unit written to %s\n",
585 Options.ArtifactPrefix.c_str(), Path.c_str());
586 if (U.size() <= kMaxUnitSizeToPrint)
587 Printf("Base64: %s\n", Base64(U).c_str());
588}
589
590void Fuzzer::PrintStatusForNewUnit(const Unit &U, const char *Text) {
591 if (!Options.PrintNEW)
592 return;
593 PrintStats(Text, "");
594 if (Options.Verbosity) {
595 Printf(" L: %zd/%zd ", U.size(), Corpus.MaxInputSize());
596 MD.PrintMutationSequence();
597 Printf("\n");
598 }
599}
600
601void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) {
602 II->NumSuccessfullMutations++;
603 MD.RecordSuccessfulMutationSequence();
Alex Shlyapnikov5ded0702017-10-23 23:24:33604 PrintStatusForNewUnit(U, II->Reduced ? "REDUCE" : "NEW ");
George Karpenkov10ab2ac2017-08-21 23:25:50605 WriteToOutputCorpus(U);
606 NumberOfNewUnitsAdded++;
Alex Shlyapnikov5ded0702017-10-23 23:24:33607 CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus.
George Karpenkov10ab2ac2017-08-21 23:25:50608 LastCorpusUpdateRun = TotalNumberOfRuns;
George Karpenkov10ab2ac2017-08-21 23:25:50609}
610
611// Tries detecting a memory leak on the particular input that we have just
612// executed before calling this function.
613void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
614 bool DuringInitialCorpusExecution) {
Alex Shlyapnikov5ded0702017-10-23 23:24:33615 if (!HasMoreMallocsThanFrees)
616 return; // mallocs==frees, a leak is unlikely.
617 if (!Options.DetectLeaks)
618 return;
Max Moroz3f26dac2017-09-12 02:01:54619 if (!DuringInitialCorpusExecution &&
Alex Shlyapnikov5ded0702017-10-23 23:24:33620 TotalNumberOfRuns >= Options.MaxNumberOfRuns)
621 return;
George Karpenkov10ab2ac2017-08-21 23:25:50622 if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) ||
623 !(EF->__lsan_do_recoverable_leak_check))
Alex Shlyapnikov5ded0702017-10-23 23:24:33624 return; // No lsan.
George Karpenkov10ab2ac2017-08-21 23:25:50625 // Run the target once again, but with lsan disabled so that if there is
626 // a real leak we do not report it twice.
627 EF->__lsan_disable();
628 ExecuteCallback(Data, Size);
629 EF->__lsan_enable();
Alex Shlyapnikov5ded0702017-10-23 23:24:33630 if (!HasMoreMallocsThanFrees)
631 return; // a leak is unlikely.
George Karpenkov10ab2ac2017-08-21 23:25:50632 if (NumberOfLeakDetectionAttempts++ > 1000) {
633 Options.DetectLeaks = false;
634 Printf("INFO: libFuzzer disabled leak detection after every mutation.\n"
635 " Most likely the target function accumulates allocated\n"
636 " memory in a global state w/o actually leaking it.\n"
637 " You may try running this binary with -trace_malloc=[12]"
638 " to get a trace of mallocs and frees.\n"
639 " If LeakSanitizer is enabled in this process it will still\n"
640 " run on the process shutdown.\n");
641 return;
642 }
643 // Now perform the actual lsan pass. This is expensive and we must ensure
644 // we don't call it too often.
645 if (EF->__lsan_do_recoverable_leak_check()) { // Leak is found, report it.
646 if (DuringInitialCorpusExecution)
647 Printf("\nINFO: a leak has been found in the initial corpus.\n\n");
648 Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n");
649 CurrentUnitSize = Size;
650 DumpCurrentUnit("leak-");
651 PrintFinalStats();
Alex Shlyapnikov5ded0702017-10-23 23:24:33652 _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on.
George Karpenkov10ab2ac2017-08-21 23:25:50653 }
654}
655
656void Fuzzer::MutateAndTestOne() {
657 MD.StartMutationSequence();
658
659 auto &II = Corpus.ChooseUnitToMutate(MD.GetRand());
Kostya Serebryany0719b352019-02-08 01:20:54660 if (Options.DoCrossOver)
661 MD.SetCrossOverWith(&Corpus.ChooseUnitToMutate(MD.GetRand()).U);
George Karpenkov10ab2ac2017-08-21 23:25:50662 const auto &U = II.U;
663 memcpy(BaseSha1, II.Sha1, sizeof(BaseSha1));
664 assert(CurrentUnitData);
665 size_t Size = U.size();
666 assert(Size <= MaxInputLen && "Oversized Unit");
667 memcpy(CurrentUnitData, U.data(), Size);
668
669 assert(MaxMutationLen > 0);
670
671 size_t CurrentMaxMutationLen =
672 Min(MaxMutationLen, Max(U.size(), TmpMaxMutationLen));
673 assert(CurrentMaxMutationLen > 0);
674
675 for (int i = 0; i < Options.MutateDepth; i++) {
676 if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
677 break;
Kostya Serebryanya2ca2dc2017-11-09 20:30:19678 MaybeExitGracefully();
George Karpenkov10ab2ac2017-08-21 23:25:50679 size_t NewSize = 0;
Kostya Serebryany6b87e0c2018-07-19 01:23:32680 if (II.HasFocusFunction && !II.DataFlowTraceForFocusFunction.empty() &&
681 Size <= CurrentMaxMutationLen)
682 NewSize = MD.MutateWithMask(CurrentUnitData, Size, Size,
683 II.DataFlowTraceForFocusFunction);
Max Moroz9d5e7ee2019-04-11 16:24:53684
685 // If MutateWithMask either failed or wasn't called, call default Mutate.
686 if (!NewSize)
Kostya Serebryany6b87e0c2018-07-19 01:23:32687 NewSize = MD.Mutate(CurrentUnitData, Size, CurrentMaxMutationLen);
George Karpenkov10ab2ac2017-08-21 23:25:50688 assert(NewSize > 0 && "Mutator returned empty unit");
Alex Shlyapnikov6f1c26f2017-10-23 22:04:30689 assert(NewSize <= CurrentMaxMutationLen && "Mutator return oversized unit");
George Karpenkov10ab2ac2017-08-21 23:25:50690 Size = NewSize;
691 II.NumExecutedMutations++;
George Karpenkov10ab2ac2017-08-21 23:25:50692
Kostya Serebryanyad05ee02017-12-01 19:18:38693 bool FoundUniqFeatures = false;
694 bool NewCov = RunOne(CurrentUnitData, Size, /*MayDeleteFile=*/true, &II,
695 &FoundUniqFeatures);
George Karpenkov10ab2ac2017-08-21 23:25:50696 TryDetectingAMemoryLeak(CurrentUnitData, Size,
697 /*DuringInitialCorpusExecution*/ false);
Kostya Serebryanyad05ee02017-12-01 19:18:38698 if (NewCov) {
Matt Morehouse947838c2017-11-09 20:44:08699 ReportNewCoverage(&II, {CurrentUnitData, CurrentUnitData + Size});
Kostya Serebryanyad05ee02017-12-01 19:18:38700 break; // We will mutate this input more in the next rounds.
701 }
702 if (Options.ReduceDepth && !FoundUniqFeatures)
Max Moroz1d369a52018-07-16 15:15:34703 break;
George Karpenkov10ab2ac2017-08-21 23:25:50704 }
705}
706
Alex Shlyapnikov6f1c26f2017-10-23 22:04:30707void Fuzzer::PurgeAllocator() {
Alex Shlyapnikov5ded0702017-10-23 23:24:33708 if (Options.PurgeAllocatorIntervalSec < 0 || !EF->__sanitizer_purge_allocator)
Alex Shlyapnikov6f1c26f2017-10-23 22:04:30709 return;
Alex Shlyapnikov6f1c26f2017-10-23 22:04:30710 if (duration_cast<seconds>(system_clock::now() -
Alex Shlyapnikov5ded0702017-10-23 23:24:33711 LastAllocatorPurgeAttemptTime)
712 .count() < Options.PurgeAllocatorIntervalSec)
Alex Shlyapnikov6f1c26f2017-10-23 22:04:30713 return;
Alex Shlyapnikov6f1c26f2017-10-23 22:04:30714
715 if (Options.RssLimitMb <= 0 ||
Alex Shlyapnikov5ded0702017-10-23 23:24:33716 GetPeakRSSMb() > static_cast<size_t>(Options.RssLimitMb) / 2)
Alex Shlyapnikov6f1c26f2017-10-23 22:04:30717 EF->__sanitizer_purge_allocator();
Alex Shlyapnikov6f1c26f2017-10-23 22:04:30718
719 LastAllocatorPurgeAttemptTime = system_clock::now();
720}
721
Kostya Serebryany0719b352019-02-08 01:20:54722void Fuzzer::ReadAndExecuteSeedCorpora(
723 const Vector<std::string> &CorpusDirs,
724 const Vector<std::string> &ExtraSeedFiles) {
Kostya Serebryany3a8e3c82017-08-29 02:05:01725 const size_t kMaxSaneLen = 1 << 20;
726 const size_t kMinDefaultLen = 4096;
Kostya Serebryany4faeb872017-08-29 20:51:24727 Vector<SizedFile> SizedFiles;
728 size_t MaxSize = 0;
729 size_t MinSize = -1;
730 size_t TotalSize = 0;
Kostya Serebryany93679be2017-09-12 21:58:07731 size_t LastNumFiles = 0;
Kostya Serebryany4faeb872017-08-29 20:51:24732 for (auto &Dir : CorpusDirs) {
Kostya Serebryany93679be2017-09-12 21:58:07733 GetSizedFilesFromDir(Dir, &SizedFiles);
734 Printf("INFO: % 8zd files found in %s\n", SizedFiles.size() - LastNumFiles,
735 Dir.c_str());
736 LastNumFiles = SizedFiles.size();
737 }
Kostya Serebryany0719b352019-02-08 01:20:54738 // Add files from -seed_inputs.
739 for (auto &File : ExtraSeedFiles)
740 if (auto Size = FileSize(File))
741 SizedFiles.push_back({File, Size});
742
Kostya Serebryany93679be2017-09-12 21:58:07743 for (auto &File : SizedFiles) {
744 MaxSize = Max(File.Size, MaxSize);
745 MinSize = Min(File.Size, MinSize);
746 TotalSize += File.Size;
Kostya Serebryany3a8e3c82017-08-29 02:05:01747 }
Kostya Serebryany4faeb872017-08-29 20:51:24748 if (Options.MaxLen == 0)
749 SetMaxInputLen(std::min(std::max(kMinDefaultLen, MaxSize), kMaxSaneLen));
750 assert(MaxInputLen > 0);
751
Kostya Serebryany51823d32017-10-13 01:12:23752 // Test the callback with empty input and never try it again.
753 uint8_t dummy = 0;
754 ExecuteCallback(&dummy, 0);
755
Kostya Serebryany23482e12019-01-31 01:40:14756 // Protect lazy counters here, after the once-init code has been executed.
757 if (Options.LazyCounters)
758 TPC.ProtectLazyCounters();
759
Kostya Serebryany4faeb872017-08-29 20:51:24760 if (SizedFiles.empty()) {
761 Printf("INFO: A corpus is not provided, starting from an empty corpus\n");
762 Unit U({'\n'}); // Valid ASCII input.
763 RunOne(U.data(), U.size());
764 } else {
765 Printf("INFO: seed corpus: files: %zd min: %zdb max: %zdb total: %zdb"
766 " rss: %zdMb\n",
767 SizedFiles.size(), MinSize, MaxSize, TotalSize, GetPeakRSSMb());
768 if (Options.ShuffleAtStartUp)
769 std::shuffle(SizedFiles.begin(), SizedFiles.end(), MD.GetRand());
770
Kostya Serebryany93679be2017-09-12 21:58:07771 if (Options.PreferSmall) {
772 std::stable_sort(SizedFiles.begin(), SizedFiles.end());
773 assert(SizedFiles.front().Size <= SizedFiles.back().Size);
774 }
Kostya Serebryany4faeb872017-08-29 20:51:24775
776 // Load and execute inputs one by one.
777 for (auto &SF : SizedFiles) {
Kostya Serebryany082e9a72017-08-31 19:17:15778 auto U = FileToVector(SF.File, MaxInputLen, /*ExitOnError=*/false);
Kostya Serebryany4faeb872017-08-29 20:51:24779 assert(U.size() <= MaxInputLen);
780 RunOne(U.data(), U.size());
781 CheckExitOnSrcPosOrItem();
782 TryDetectingAMemoryLeak(U.data(), U.size(),
783 /*DuringInitialCorpusExecution*/ true);
784 }
Kostya Serebryany3a8e3c82017-08-29 02:05:01785 }
786
Kostya Serebryany4faeb872017-08-29 20:51:24787 PrintStats("INITED");
Kostya Serebryanye9c6f062018-05-16 23:26:37788 if (!Options.FocusFunction.empty())
789 Printf("INFO: %zd/%zd inputs touch the focus function\n",
790 Corpus.NumInputsThatTouchFocusFunction(), Corpus.size());
Kostya Serebryany67af9922018-06-07 01:40:20791 if (!Options.DataFlowTrace.empty())
792 Printf("INFO: %zd/%zd inputs have the Data Flow Trace\n",
793 Corpus.NumInputsWithDataFlowTrace(), Corpus.size());
Kostya Serebryanye9c6f062018-05-16 23:26:37794
Max Morozfe974412018-05-23 19:42:30795 if (Corpus.empty() && Options.MaxNumberOfRuns) {
Kostya Serebryany4faeb872017-08-29 20:51:24796 Printf("ERROR: no interesting inputs were found. "
797 "Is the code instrumented for coverage? Exiting.\n");
798 exit(1);
Kostya Serebryany3a8e3c82017-08-29 02:05:01799 }
Kostya Serebryany3a8e3c82017-08-29 02:05:01800}
801
Kostya Serebryany0719b352019-02-08 01:20:54802void Fuzzer::Loop(const Vector<std::string> &CorpusDirs,
803 const Vector<std::string> &ExtraSeedFiles) {
804 ReadAndExecuteSeedCorpora(CorpusDirs, ExtraSeedFiles);
Kostya Serebryany67af9922018-06-07 01:40:20805 DFT.Clear(); // No need for DFT any more.
George Karpenkov10ab2ac2017-08-21 23:25:50806 TPC.SetPrintNewPCs(Options.PrintNewCovPcs);
Kostya Serebryany2eef8162017-08-25 20:09:25807 TPC.SetPrintNewFuncs(Options.PrintNewCovFuncs);
George Karpenkov10ab2ac2017-08-21 23:25:50808 system_clock::time_point LastCorpusReload = system_clock::now();
Kostya Serebryanyb6ca1e72019-02-16 01:23:41809
810 TmpMaxMutationLen =
811 Min(MaxMutationLen, Max(size_t(4), Corpus.MaxInputSize()));
812
George Karpenkov10ab2ac2017-08-21 23:25:50813 while (true) {
814 auto Now = system_clock::now();
815 if (duration_cast<seconds>(Now - LastCorpusReload).count() >=
816 Options.ReloadIntervalSec) {
817 RereadOutputCorpus(MaxInputLen);
818 LastCorpusReload = system_clock::now();
819 }
820 if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
821 break;
Alex Shlyapnikov5ded0702017-10-23 23:24:33822 if (TimedOut())
823 break;
George Karpenkov10ab2ac2017-08-21 23:25:50824
825 // Update TmpMaxMutationLen
Matt Morehouse36c89b32018-02-13 20:52:15826 if (Options.LenControl) {
George Karpenkov10ab2ac2017-08-21 23:25:50827 if (TmpMaxMutationLen < MaxMutationLen &&
Kostya Serebryanye9ed2322017-12-12 23:11:28828 TotalNumberOfRuns - LastCorpusUpdateRun >
Matt Morehouse36c89b32018-02-13 20:52:15829 Options.LenControl * Log(TmpMaxMutationLen)) {
George Karpenkov10ab2ac2017-08-21 23:25:50830 TmpMaxMutationLen =
Kostya Serebryanye9ed2322017-12-12 23:11:28831 Min(MaxMutationLen, TmpMaxMutationLen + Log(TmpMaxMutationLen));
Kostya Serebryanye9ed2322017-12-12 23:11:28832 LastCorpusUpdateRun = TotalNumberOfRuns;
George Karpenkov10ab2ac2017-08-21 23:25:50833 }
834 } else {
835 TmpMaxMutationLen = MaxMutationLen;
836 }
837
838 // Perform several mutations and runs.
839 MutateAndTestOne();
Alex Shlyapnikov6f1c26f2017-10-23 22:04:30840
841 PurgeAllocator();
George Karpenkov10ab2ac2017-08-21 23:25:50842 }
843
844 PrintStats("DONE ", "\n");
845 MD.PrintRecommendedDictionary();
846}
847
848void Fuzzer::MinimizeCrashLoop(const Unit &U) {
Alex Shlyapnikov5ded0702017-10-23 23:24:33849 if (U.size() <= 1)
850 return;
George Karpenkov10ab2ac2017-08-21 23:25:50851 while (!TimedOut() && TotalNumberOfRuns < Options.MaxNumberOfRuns) {
852 MD.StartMutationSequence();
853 memcpy(CurrentUnitData, U.data(), U.size());
854 for (int i = 0; i < Options.MutateDepth; i++) {
855 size_t NewSize = MD.Mutate(CurrentUnitData, U.size(), MaxMutationLen);
856 assert(NewSize > 0 && NewSize <= MaxMutationLen);
857 ExecuteCallback(CurrentUnitData, NewSize);
858 PrintPulseAndReportSlowInput(CurrentUnitData, NewSize);
859 TryDetectingAMemoryLeak(CurrentUnitData, NewSize,
860 /*DuringInitialCorpusExecution*/ false);
861 }
862 }
863}
864
George Karpenkov10ab2ac2017-08-21 23:25:50865} // namespace fuzzer
866
867extern "C" {
868
Jonathan Metzmanb795c312019-01-17 16:36:05869ATTRIBUTE_INTERFACE size_t
Petr Hosekeac2b472018-01-17 20:39:14870LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
George Karpenkov10ab2ac2017-08-21 23:25:50871 assert(fuzzer::F);
872 return fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize);
873}
874
Alex Shlyapnikov5ded0702017-10-23 23:24:33875} // extern "C"