Commit Graph

48 Commits

Author SHA1 Message Date
Kostya Serebryany f2d4dcb888 [libFuzzer] initial support of -fsanitize-coverage=inline-8bit-counters in libFuzzer. This is not fully functional yet, but simple tests work
llvm-svn: 305331
2017-06-13 22:31:21 +00:00
Chandler Carruth 6bda14b313 Sort the remaining #include lines in include/... and lib/....
I did this a long time ago with a janky python script, but now
clang-format has built-in support for this. I fed clang-format every
line with a #include and let it re-sort things according to the precise
LLVM rules for include ordering baked into clang-format these days.

I've reverted a number of files where the results of sorting includes
isn't healthy. Either places where we have legacy code relying on
particular include ordering (where possible, I'll fix these separately)
or where we have particular formatting around #include lines that
I didn't want to disturb in this patch.

This patch is *entirely* mechanical. If you get merge conflicts or
anything, just ignore the changes in this patch and run clang-format
over your #include lines in the files.

Sorry for any noise here, but it is important to keep these things
stable. I was seeing an increasing number of patches with irrelevant
re-ordering of #include lines because clang-format was used. This patch
at least isolates that churn, makes it easy to skip when resolving
conflicts, and gets us to a clean baseline (again).

llvm-svn: 304787
2017-06-06 11:49:48 +00:00
Kostya Serebryany 382730ab23 [libFuzzer] increase kFeatureSetSize to 2^21 and make InputCorpus scale to that size. This will potentially make libFuzzer more sensitive on targets with lots of signals
llvm-svn: 298671
2017-03-24 00:45:15 +00:00
Kostya Serebryany 6ca44f9161 [libFuzzer] create experimental support for user-provided coverage signal
llvm-svn: 298654
2017-03-23 22:43:12 +00:00
Kostya Serebryany 4fc6dd7f8f [libFuzzer] add two experimental flags to make corpus merging more scalable: -save_coverage_summary/-load_coverage_summary. This is still WIP, the documentation will come later if these flags survive
llvm-svn: 298548
2017-03-22 20:32:44 +00:00
Kostya Serebryany 1e438a1dba [libFuzzer] use less memory for merge
llvm-svn: 290039
2016-12-17 08:20:24 +00:00
Kostya Serebryany 111e1d69e3 [libFuzzer] implement crash-resistant merge (https://github.com/google/sanitizers/issues/722). This is a first experimental variant that needs some more testing, thus not yet adding a lit test (but there are unit tests).
llvm-svn: 289166
2016-12-09 01:17:24 +00:00
Kostya Serebryany 65f102d4d2 [libFuzzer] mutation: insert the size of the input in bytes as one of the ways to mutate a binary integer
llvm-svn: 284909
2016-10-22 03:48:53 +00:00
Kostya Serebryany c5325ed29d [libFuzzer] when shrinking the corpus, delete evicted files previously created by the current process
llvm-svn: 283682
2016-10-08 23:24:45 +00:00
Kostya Serebryany 1c73f1bf27 [libFuzzer] refactoring to make -shrink=1 work for value profile, added a test.
llvm-svn: 283409
2016-10-05 22:56:21 +00:00
Kostya Serebryany 16a145fd0f [libFuzzer] fix merging with trace-pc-guard
llvm-svn: 282224
2016-09-23 01:58:51 +00:00
Kostya Serebryany 624f59f4d8 [libFuzzer] add 'features' to the corpus elements, allow mutations with Size > MaxSize, fix sha1 in corpus stats; various refactorings
llvm-svn: 282129
2016-09-22 01:34:58 +00:00
Kostya Serebryany 29bb664075 [libFuzzer] add stats to the corpus; more refactoring
llvm-svn: 282121
2016-09-21 22:42:17 +00:00
Kostya Serebryany 20801e1b8a [libFuzzer] more refactoring; don't compute sha1sum every time we mutate a unit from the corpus, use the stored one.
llvm-svn: 282115
2016-09-21 21:41:48 +00:00
Kostya Serebryany 6f5a804cdb [libFuzzer] refactoring: split the large header into many; NFC
llvm-svn: 282044
2016-09-21 01:50:50 +00:00
Kostya Serebryany 0c537b124c [libFuzzer] one more mutation: ChangeBinaryInteger; also fix the breakage from r278970
llvm-svn: 278982
2016-08-17 21:30:30 +00:00
Kostya Serebryany a7398ba024 [libFuzzer] more mutations
llvm-svn: 278950
2016-08-17 18:10:42 +00:00
Kostya Serebryany dfbe59b03d [libFuzzer] add InsertRepeatedBytes and EraseBytes.
New mutation: InsertRepeatedBytes.
Updated mutation: EraseByte => EraseBytes.

This helps https://github.com/google/sanitizers/issues/710
where libFuzzer was not able to find a known bug.
Now it finds it in minutes.

Hopefully, the change is general enough to help other targets.

llvm-svn: 278687
2016-08-15 17:48:28 +00:00
Kostya Serebryany c135b55ae0 [libFuzzer] add hooks for strstr, strcasestr, strcasecmp, strncasecmp
llvm-svn: 275648
2016-07-15 23:27:19 +00:00
Mike Aizatsky f0b3e85f4e [libfuzzer] moving is_ascii handler inside mutation dispatcher.
Summary: It also fixes a bug, when first random might not be ascii.

Differential Revision: http://reviews.llvm.org/D21573

llvm-svn: 273611
2016-06-23 20:44:48 +00:00
Dan Liew c4989d27b5 [LibFuzzer] Fix ``FuzzerMutate.ShuffleBytes2`` unit test on OSX.
The ``FuzzerMutate.ShuffleBytes2`` unit test was failing on
OSX due to the implementation of ``std::random_shuffle()``
being different between libcxx and libstdc++.

@kcc has decided (see http://reviews.llvm.org/D21218) it is acceptable
for there to be different mutation behavior on different platforms so
this commit just adjusts the test to perform the minimum number of
iterations (that is a power of 2) to see all the mutations the unit test
is looking for.

Differential Revision: http://reviews.llvm.org/D21359

llvm-svn: 272743
2016-06-15 01:40:02 +00:00
Dan Liew 0617f15897 [LibFuzzer] Fix some unit test crashes on OSX.
This fixes the following unit tests:

FuzzerDictionary.ParseOneDictionaryEntry
FuzzerDictionary.ParseDictionaryFile

The issue appears to be mixing non-ASan-ified code (LibFuzzer) and
ASan-ified code (the unittest) as the tests would pass fine if
everything was built with ASan enabled.

I believe the issue is that different implementations of std::vector<>
are being used in LibFuzzer and outside LibFuzzer (in the unittests).
For Libcxx (I've not seen the issue manifest for libstdc++) we can disable
the ASanified std::vector<> by definining the ``_LIBCPP_HAS_NO_ASAN`` macro.
Doing this fixes the tests on OSX.

Differential Revision: http://reviews.llvm.org/D21049

llvm-svn: 272374
2016-06-10 05:33:07 +00:00
Dan Liew 1873a496e2 [LibFuzzer] Declare and use sanitizer functions in ``fuzzer::ExternalFunctions``
This fixes linking problems on OSX.

Unfortunately it turns out we need to use an instance of the
``fuzzer::ExternalFunctions`` object in several places so this
commit also replaces all instances with a single global instance.

It also turns out initializing a global ``fuzzer::ExternalFunctions``
before main is entered (i.e. letting the object be initialised by the
global initializers) is not safe (on OSX the call to ``Printf()`` in the
CTOR crashes if it is called from a global initializer) so we instead
have a global ``fuzzer::ExternalFunctions*`` and initialize it inside
``FuzzerDriver()``.

Multiple unit tests depend also depend on the
``fuzzer::ExternalFunctions*`` global so a ``main()`` function has been
added that initializes it before running any tests.

Differential Revision: http://reviews.llvm.org/D20943

llvm-svn: 272072
2016-06-07 23:32:50 +00:00
Mike Aizatsky e66846ab32 [libfuzzer] replacing unittest for truncate_units with functional test.
Differential Revision: http://reviews.llvm.org/D20641

llvm-svn: 270755
2016-05-25 21:00:17 +00:00
Mike Aizatsky af432a45e3 [libfuzzer] Trying random unit prefixes during corpus load.
Differential Revision: http://reviews.llvm.org/D20301

llvm-svn: 270632
2016-05-24 23:14:29 +00:00
Mike Aizatsky f13cbee12e [libfuzzer] adding license headers to cpp files
Differential Revision: http://reviews.llvm.org/D18705

llvm-svn: 265174
2016-04-01 18:38:58 +00:00
Kostya Serebryany 7ec0c56e07 [libFuzzer] get rid of UserSuppliedFuzzer; NFC
llvm-svn: 260798
2016-02-13 03:25:16 +00:00
Kostya Serebryany a399221c32 [libFuzzer] simplify the code around Random. NFC
llvm-svn: 260797
2016-02-13 03:00:53 +00:00
Ivan Krasin df91910bd4 Use std::piecewise_constant_distribution instead of ad-hoc binary search.
Summary:
Fix the issue with the most recently discovered unit receiving much less attention.

Note: this is the second attempt (prev: r258473). Now, libc++ build is fixed.

Reviewers: aizatsky, kcc

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D16487

llvm-svn: 258571
2016-01-22 22:28:27 +00:00
Ivan Krasin d84f74cab7 Revert r258473 as it's breaking the build with libc++
Reviewers: kcc

Differential Revision: http://reviews.llvm.org/D16441

llvm-svn: 258479
2016-01-22 03:21:52 +00:00
Ivan Krasin b008fd4d89 Use std::piecewise_constant_distribution instead of ad-hoc binary search.
Summary:
Fix the issue with the most recently discovered unit receiving much less attention.

Note: I had to change the seed for one test to make it pass. Alternatively,
the number of runs could be increased. I believe that the average time of
'foo' discovery is not increased, just seed=1 was particularly convenient
for the previous PRNG scheme used.

Reviewers: aizatsky, kcc

Subscribers: llvm-commits, kcc

Differential Revision: http://reviews.llvm.org/D16419

llvm-svn: 258473
2016-01-22 01:32:34 +00:00
Kostya Serebryany 476f0ce31a [libFuzzer] replace vector with a simpler data structure in the Dictionaries to avoid memory allocations on hot path
llvm-svn: 257985
2016-01-16 03:53:32 +00:00
Kostya Serebryany 4b35874b2a [libFuzzer] suggest a dictionary to the user of some of the trace-based dictionary entries were successful
llvm-svn: 257736
2016-01-14 02:36:44 +00:00
Kostya Serebryany 152ac7ad70 [libFuzzer] add a position hint to the dictionary-based mutator
llvm-svn: 257013
2016-01-07 01:49:35 +00:00
Kostya Serebryany 27ab2d759f [libFuzzer] make CrossOver just one of the other mutations
llvm-svn: 256081
2015-12-19 02:49:09 +00:00
Kostya Serebryany 9e48cda9bc [libFuzzer] compute base64 in-process instead of using an external lib. Since libFuzzer should not depend on anything, just re-implement base64 encoder. PR25746
llvm-svn: 254784
2015-12-04 22:29:39 +00:00
Kostya Serebryany 25425ad920 [libFuzzer] add one more mutator: Mutate_ChangeASCIIInteger
llvm-svn: 247027
2015-09-08 17:19:31 +00:00
Kostya Serebryany 7d21166218 [libFuzzer] actually make the dictionaries work (+docs)
llvm-svn: 246825
2015-09-04 00:12:11 +00:00
Kostya Serebryany ec2dcb1d91 [libFuzzer] refactor the mutation functions so that they are now methods of a class. NFC
llvm-svn: 246808
2015-09-03 21:24:19 +00:00
Kostya Serebryany 9838b2be87 [libFuzzer] adding a parser for AFL-style dictionaries + tests.
llvm-svn: 246800
2015-09-03 20:23:46 +00:00
Kostya Serebryany bf29ff2fa5 [libFuzzer] add one more mutation strategy: byte shuffling
llvm-svn: 244188
2015-08-06 01:29:13 +00:00
Kostya Serebryany 86a5fba71d [libFuzzer] more refactoring of the Mutator and adding tests to it
llvm-svn: 243818
2015-08-01 02:23:06 +00:00
Kostya Serebryany 8ce7424e9c [libFuzzer] start refactoring the Mutator and adding tests to it
llvm-svn: 243817
2015-08-01 01:42:51 +00:00
Kostya Serebryany 404c69f2c8 [libFuzzer] allow users to supply their own implementation of rand
llvm-svn: 243078
2015-07-24 01:06:40 +00:00
Kostya Serebryany f342459aa4 [lib/Fuzzer] extend the fuzzer interface to allow user-supplied mutators
llvm-svn: 238059
2015-05-22 22:35:31 +00:00
Kostya Serebryany 96eab65d81 [lib/Fuzzer] Add SHA1 implementation from public domain.
Summary:
This adds a SHA1 implementation taken from public domain code.
The change is trivial, but as it involves third-party code I'd like
a second pair of eyes before commit.

LibFuzzer can not use SHA1 from openssl because openssl may not be available
and because we may be fuzzing openssl itself.
Using sha1sum via a pipe is too slow.

Test Plan: n/a

Reviewers: chandlerc

Reviewed By: chandlerc

Subscribers: majnemer, llvm-commits

Differential Revision: http://reviews.llvm.org/D9733

llvm-svn: 237400
2015-05-14 22:41:49 +00:00
Kostya Serebryany 566bc5aa8a [lib/Fuzzer] rename TestOneInput to LLVMFuzzerTestOneInput to make it more unique
llvm-svn: 236652
2015-05-06 22:19:00 +00:00
Kostya Serebryany 71672552db [fuzzer] Add a gtest-style test
Summary: Add one gtest-style test.

Test Plan: run on bot

Reviewers: samsonov

Reviewed By: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7287

llvm-svn: 227639
2015-01-30 23:26:57 +00:00