Commit Graph

353 Commits

Author SHA1 Message Date
Kostya Serebryany 589eae515e [libFuzzer] change the default max_len from 64 to 4096. This will affect cases where libFuzzer is run w/o initial corpus or with a corpus of very small items.
llvm-svn: 305521
2017-06-15 22:43:40 +00:00
George Karpenkov 406c113103 Fixing section name for Darwin platforms for sanitizer coverage
On Darwin, section names have a 16char length limit.

llvm-svn: 305429
2017-06-14 23:40:25 +00:00
Kostya Serebryany 546a286cef [libFuzzer] really restrict the new test to Linux (fails on Mac/Windows currently)
llvm-svn: 305346
2017-06-14 00:34:42 +00:00
Kostya Serebryany d0fb427862 [libFuzzer] restrict the new test to Linux (fails on Mac currently)
llvm-svn: 305335
2017-06-13 23:09:11 +00:00
Kostya Serebryany f2d4dcb888 [libFuzzer] initial support of -fsanitize-coverage=inline-8bit-counters in libFuzzer. This is not fully functional yet, but simple tests work
llvm-svn: 305331
2017-06-13 22:31:21 +00:00
Chandler Carruth 6bda14b313 Sort the remaining #include lines in include/... and lib/....
I did this a long time ago with a janky python script, but now
clang-format has built-in support for this. I fed clang-format every
line with a #include and let it re-sort things according to the precise
LLVM rules for include ordering baked into clang-format these days.

I've reverted a number of files where the results of sorting includes
isn't healthy. Either places where we have legacy code relying on
particular include ordering (where possible, I'll fix these separately)
or where we have particular formatting around #include lines that
I didn't want to disturb in this patch.

This patch is *entirely* mechanical. If you get merge conflicts or
anything, just ignore the changes in this patch and run clang-format
over your #include lines in the files.

Sorry for any noise here, but it is important to keep these things
stable. I was seeing an increasing number of patches with irrelevant
re-ordering of #include lines because clang-format was used. This patch
at least isolates that churn, makes it easy to skip when resolving
conflicts, and gets us to a clean baseline (again).

llvm-svn: 304787
2017-06-06 11:49:48 +00:00
Kostya Serebryany 2e98c045cb [libFuzzer] fix a test to match the new sanitizer run-time
llvm-svn: 304333
2017-05-31 19:47:11 +00:00
Vitaly Buka bf40f1b6dd [libFuzzer] Don't replace custom signal handlers.
Summary:
This allows to keep handlers installed by sanitizers.
In other cases third-party code can replace handlers after libFuzzer
initialization anyway.

Reviewers: kcc

Subscribers: llvm-commits

Differential Revision: https://reviews.llvm.org/D33522

llvm-svn: 303828
2017-05-25 01:43:13 +00:00
Kostya Serebryany cf50d43be9 [libFuzzer] fix tests on Windows
llvm-svn: 303128
2017-05-15 22:55:00 +00:00
Kostya Serebryany 87813b1bf8 [libFuzzer] improve the afl driver and it's tests. Make it possible to run individual inputs with afl driver
llvm-svn: 303125
2017-05-15 22:38:29 +00:00
Kostya Serebryany fe4ed9bd85 [libFuzzer] make sure the input data is not overwritten in the fuzz target (if it is -- report an error)
llvm-svn: 302494
2017-05-09 01:17:29 +00:00
Duncan P. N. Exon Smith 05531ca19b Fuzzer: Mark test/cxxstring.test UNSUPPORTED: windows
This has been mysteriously failing since r301593, which cleaned up the
types of things like size_t and SIZE_MAX for freestanding targets.  Reid
and Kostya suggested marking it as UNSUPPORTED on windows, given that no
one has been able to reproduce locally.

llvm-svn: 301719
2017-04-28 23:59:53 +00:00
Ahmed Bougacha db2c16aebb Revert "[libFuzzer] XFAIL fuzzer-oom.test on Darwin."
This reverts commit r300127.

r300759 implemented StopTheWorld for Darwin, so the test passes again.

llvm-svn: 300801
2017-04-20 00:16:13 +00:00
Kostya Serebryany ac7a9eae0b [libFuzzer] experimental option -cleanse_crash: tries to replace all bytes in a crash reproducer with garbage, while still preserving the crash
llvm-svn: 300498
2017-04-17 20:58:21 +00:00
Akira Hatanaka 48b1dee7b4 [libFuzzer] XFAIL fuzzer-oom.test on Darwin.
The test fails on Darwin because Fuzzer::DeathCallback (which calls
DumpCurrentUnit("crash-")) is called before DumpCurrentUnit("oom-") is
called in Fuzzer::RssLimitCallback. DeathCallback is transitively called
from __sanitizer_print_memory_profile.

This should fix the fuzzer bot that has been failing for a while:

http://lab.llvm.org:8080/green/job/libFuzzer/

llvm-svn: 300127
2017-04-12 23:15:10 +00:00
Reid Kleckner 67cecd1e1c [Fuzzer] Flush std::cout before aborting in CxxStringEqTest
On Windows, abort() does not appear to flush std::cout. Should fix red
sanitizer-windows bot.

llvm-svn: 299398
2017-04-03 23:00:25 +00:00
Kostya Serebryany 7de1f1a826 [libFuzzer] tests: don't test 64-bit comparison on 32-bit builds
llvm-svn: 299179
2017-03-31 03:51:40 +00:00
Kostya Serebryany b1f802cf80 [libFuzzer] ensure that strncmp is not inlined in a test
llvm-svn: 299177
2017-03-31 03:34:33 +00:00
Kostya Serebryany 3033065df9 [libFuzzer] try to fix value-profile-strncmp on the Mac bot
llvm-svn: 299145
2017-03-31 00:52:39 +00:00
Kostya Serebryany 01ddc1cfd5 [libFuzzer] remove a stale flag from tests, run value-profile-strncmp.test longer (hopefully, will fix the OSX bot)
llvm-svn: 299051
2017-03-30 04:22:20 +00:00
Kostya Serebryany d7d1d517ee [libFuzzer] best effort support for -fsanitize-coverage=trace-pc instrumentation. It is less efficient and precise than -fsanitize-coverage=trace-pc-guard, but still works
llvm-svn: 299046
2017-03-30 01:27:20 +00:00
Juergen Ributzka dea6379421 [libfuzzer] Remove XFAIL for OutOfMemory test.
This test is now passing on Darwin.

See rdar://problem/31282257.

llvm-svn: 298886
2017-03-27 22:33:05 +00:00
Vitaly Buka 72b8acfb70 [libFuzzer] Fix test on Windows.
llvm-svn: 298757
2017-03-25 01:19:45 +00:00
Kostya Serebryany 86e630b857 [libFuzzer] read asan's dedup_token while minimizing a crash and stop minimization if another bug was found during minimization (https://github.com/google/oss-fuzz/issues/452)
llvm-svn: 298755
2017-03-25 00:56:08 +00:00
Kostya Serebryany c58982d6fa [libFuzzer] be more careful when calling strlen of strcmp parameters, PR32357
llvm-svn: 298746
2017-03-24 22:19:52 +00:00
Kostya Serebryany dba9ded61f [libFuzzer] honor -exact_artifact_path for all intermediate files during crash minimization (https://github.com/google/oss-fuzz/issues/250)
llvm-svn: 298740
2017-03-24 21:09:16 +00:00
Kostya Serebryany e54785c6e9 [libFuzzer] split two tests to get more parallelism in test runs
llvm-svn: 298673
2017-03-24 00:51:18 +00:00
Kostya Serebryany 382730ab23 [libFuzzer] increase kFeatureSetSize to 2^21 and make InputCorpus scale to that size. This will potentially make libFuzzer more sensitive on targets with lots of signals
llvm-svn: 298671
2017-03-24 00:45:15 +00:00
Kostya Serebryany 5f25495c4d [libFuzzer] fix non-linux build
llvm-svn: 298666
2017-03-23 23:48:47 +00:00
Kostya Serebryany 6ca44f9161 [libFuzzer] create experimental support for user-provided coverage signal
llvm-svn: 298654
2017-03-23 22:43:12 +00:00
Kostya Serebryany 4fc6dd7f8f [libFuzzer] add two experimental flags to make corpus merging more scalable: -save_coverage_summary/-load_coverage_summary. This is still WIP, the documentation will come later if these flags survive
llvm-svn: 298548
2017-03-22 20:32:44 +00:00
Kostya Serebryany a52c8d0daf [libFuzzer] add a test with two different bugs
llvm-svn: 298030
2017-03-17 01:33:16 +00:00
Kostya Serebryany a43a299382 [libFuzzer] remove stale code
llvm-svn: 297781
2017-03-14 21:30:14 +00:00
Vitaly Buka 0c736d8b36 [libFuzzer] Reorder includes in test
llvm-svn: 297692
2017-03-13 23:49:00 +00:00
Vitaly Buka 27441e5c47 [libFuzzer] Fix compilation of CustomCrossOverAndMutateTest on Windows
llvm-svn: 297690
2017-03-13 23:46:30 +00:00
Kostya Serebryany d481e1c361 [libFuzzer] add more iterations to LLVMFuzzer-Memcmp64BytesTest
llvm-svn: 297554
2017-03-11 05:14:49 +00:00
Kostya Serebryany b6b2f18ea8 [libFuzzer] add test/LargeTest.cpp, mostly for manual experiments with large number of edges, not yet suitable for unit testing
llvm-svn: 297544
2017-03-11 01:54:06 +00:00
Kostya Serebryany 7939ee4d51 [libFuzzer] remove fuzzer-jobs.test which is flaky and not very useful
llvm-svn: 297543
2017-03-11 01:48:54 +00:00
Vitaly Buka 91266b4752 [fuzzer] Don't crash if LLVMFuzzerMutate was called by CustomCrossOver
Reviewers: kcc

Subscribers: llvm-commits, mgorny

Differential Revision: https://reviews.llvm.org/D30682

llvm-svn: 297202
2017-03-07 20:37:38 +00:00
Kuba Mracek 00c7592a6b Un-XFAIL Fuzzer/test/dump_coverage.test. This now passes on Darwin (after r297094).
llvm-svn: 297110
2017-03-07 01:01:38 +00:00
Mike Aizatsky 15492af547 [libfuzzer] do not use xargs for shell expansion
Summary:
After https://reviews.llvm.org/rL296904 xargs shouldn't be necesssary.

Differential Revision: https://reviews.llvm.org/D30371

llvm-svn: 297094
2017-03-06 23:42:14 +00:00
Mehdi Amini 6dabadab78 un-Xfail Fuzzer test that decided to pass on Green Dragon
It may be flacky, I'll turn it into unsupported if it fails again.

llvm-svn: 296913
2017-03-03 21:28:05 +00:00
Mehdi Amini 1d9f3fe77c Mark some libFuzzer tests as XFAIL'd on Darwin
We're bringing up a bot on Green Dragon right now:

http://green.lab.llvm.org/green/view/Experimental/job/libFuzzer

llvm-svn: 296526
2017-02-28 21:45:59 +00:00
Justin Bogner d519a92a27 [libFuzzer] Update traces hooks test after r293741
This test now passes on darwin.

llvm-svn: 295902
2017-02-22 23:12:36 +00:00
Justin Bogner 59c8420018 [libFuzzer] Mark a test that infinite loops as unsupported
We need to investigate this, but for now it just causes too much
headache when trying to run these tests.

llvm-svn: 295900
2017-02-22 23:05:17 +00:00
Kostya Serebryany 32c5004cf5 [libFuzzer] increase the size of FixedWord from 27 to 64, see PR31950
llvm-svn: 295117
2017-02-14 23:02:37 +00:00
Marcos Pividori a0b23b8e63 [libFuzzer] Export external functions on tests.
We need to export external functions so they are found when calling
GetProcAddress() on Windows. But we can't use `__declspec(dllexport)` because
we want the targets to be completely independent from the fuzz engines and don't
depend on other header files. Also, we don't want to include platform specific
code managed with conditional macros.
So, the solution is to add the exported symbols with linker flags in cmake.

Differential revision: https://reviews.llvm.org/D29752

llvm-svn: 294688
2017-02-10 01:40:28 +00:00
Marcos Pividori 5a53567620 [libFuzzer] Use long long to ensure 64 bits.
We should always use unsigned long long to ensure 64 bits. On Windows, unsigned
long is 4 bytes. This was the reason why value-profile-cmp4.test was failing on
Windows.

Differential Revision: https://reviews.llvm.org/D29617

llvm-svn: 294390
2017-02-08 00:03:31 +00:00
Marcos Pividori 2a318a18db [libFuzzer] Use custom target instead of list of binaries for tests.
Update cmake to use a custom target TestBinaries instead of a list of targets.
This simplifies cmake, and fix some errors. This way, we don't have to propagate
the values into parents directories. We only need to use add_dependencies.

Differential Revision: https://reviews.llvm.org/D29593

llvm-svn: 294389
2017-02-08 00:03:26 +00:00
Marcos Pividori e219d40191 [libFuzzer] Change Uninstrumented test name.
On Windows, executables with the word "uninst" included in their names are
associated with administrator privileges.

Differential Revision: https://reviews.llvm.org/D29549

llvm-svn: 294387
2017-02-08 00:03:13 +00:00