Commit Graph

235 Commits

Author SHA1 Message Date
Kostya Serebryany
1b05ee2bf2 [libFuzzer] try to use less RAM while processing the initial corpus
llvm-svn: 310881
2017-08-14 20:34:35 +00:00
Kostya Serebryany
611872e92b [libFuzzer] use the in-binary pc table (instead of PCs captured at run-time) to implement -exit_on_src_pos
llvm-svn: 310151
2017-08-04 23:49:53 +00:00
Kostya Serebryany
8a7d3f0c48 [libFuzzer] print PCs using the in-binary PC-table instead of relying on PCs captured at run-time
llvm-svn: 310148
2017-08-04 23:13:58 +00:00
Kostya Serebryany
2634a37d75 [libFuzzer] reimplement experimental_len_control=1: bump the temporary max_len every time we failed to find new coverage during the last 1000 runs and 1 second. Also fix FileToVector to not load unfinished files
llvm-svn: 308811
2017-07-22 00:10:29 +00:00
Matt Morehouse
8883497952 Generate error reports when a fuzz target exits.
Summary:
Implements https://github.com/google/sanitizers/issues/835.

Flush stdout before exiting in test cases.

Since the atexit hook is used for exit reports, pending prints to
stdout can be lost if they aren't flushed before calling exit().

Expect tests to have non-zero exit code if exit() is called.

Reviewers: vitalybuka, kcc

Reviewed By: kcc

Subscribers: eraman, llvm-commits, hiraditya

Differential Revision: https://reviews.llvm.org/D35602

llvm-svn: 308669
2017-07-20 20:43:39 +00:00
Kostya Serebryany
bbaa26af71 [libFuzzer] make sure CheckExitOnSrcPosOrItem is called after the new input is saved to the corpus
llvm-svn: 308653
2017-07-20 18:53:25 +00:00
Kostya Serebryany
de5f18254f [libFuzzer] prototype implementation of recursion-depth coverage features (commented out; real implementation needs to use inlined instrumentation)
llvm-svn: 308577
2017-07-20 01:35:17 +00:00
Kostya Serebryany
942eea9a0e [libFuzzer] when adding a reduced input print REDUCED instead of NEW
llvm-svn: 308336
2017-07-18 18:47:36 +00:00
Kostya Serebryany
1dbfa6accb [libFuzzer] improve -reduce_inputs=1: now only consider the unique features of very input (seems to work much better)
llvm-svn: 308253
2017-07-18 01:36:50 +00:00
Kostya Serebryany
feac4ad640 [libFuzzer] simplify the handling of memmem/strstr
llvm-svn: 307977
2017-07-14 00:06:27 +00:00
Kostya Serebryany
25dc7da1a2 [libFuzzer] experimental feature -reduce_inputs (off by default) that tries to replace elements in the corpus with smaller ones that have the same feature set. Still needs tuning
llvm-svn: 307873
2017-07-13 01:08:53 +00:00
Kostya Serebryany
5fd8b48f81 [libFuzzer] remove include <sanitizer/coverage_interface.h>, not needed any more
llvm-svn: 307858
2017-07-12 22:22:36 +00:00
Kostya Serebryany
b43c07ef34 [libFuzzer] refactoring in preparation for -reduce_inputs; NFC intended
llvm-svn: 307857
2017-07-12 22:20:04 +00:00
Kostya Serebryany
7ae6cd32d6 [libFuzzer] change the default max_len from 64 to 4096. This will affect cases where libFuzzer is run w/o initial corpus or with a corpus of very small items.
llvm-svn: 305521
2017-06-15 22:43:40 +00:00
Chandler Carruth
eb66b33867 Sort the remaining #include lines in include/... and lib/....
I did this a long time ago with a janky python script, but now
clang-format has built-in support for this. I fed clang-format every
line with a #include and let it re-sort things according to the precise
LLVM rules for include ordering baked into clang-format these days.

I've reverted a number of files where the results of sorting includes
isn't healthy. Either places where we have legacy code relying on
particular include ordering (where possible, I'll fix these separately)
or where we have particular formatting around #include lines that
I didn't want to disturb in this patch.

This patch is *entirely* mechanical. If you get merge conflicts or
anything, just ignore the changes in this patch and run clang-format
over your #include lines in the files.

Sorry for any noise here, but it is important to keep these things
stable. I was seeing an increasing number of patches with irrelevant
re-ordering of #include lines because clang-format was used. This patch
at least isolates that churn, makes it easy to skip when resolving
conflicts, and gets us to a clean baseline (again).

llvm-svn: 304787
2017-06-06 11:49:48 +00:00
Kostya Serebryany
ef5f540cec [libFuzzer] make sure the input data is not overwritten in the fuzz target (if it is -- report an error)
llvm-svn: 302494
2017-05-09 01:17:29 +00:00
Vitaly Buka
a4f5ab971b [libFuzzer] exit without running atexit handlers in libfuzzer's crash handler
Summary:
It's not safe to assume that atexit handlers can be run once the app crashed.

Patch by Jochen Eisinger.

Reviewers: kcc, vitalybuka

Subscribers: llvm-commits

Differential Revision: https://reviews.llvm.org/D32640

llvm-svn: 302076
2017-05-03 20:31:19 +00:00
Kostya Serebryany
a48070b1b0 [libFuzzer] remove -output_csv option. It duplicates the default output and got out of sync
llvm-svn: 300768
2017-04-19 21:34:58 +00:00
Kostya Serebryany
a4fa40e3fc [libFuzzer] simplify the code a bit
llvm-svn: 299180
2017-03-31 04:17:45 +00:00
Kostya Serebryany
6644fe3b16 [libFuzzer] call __sanitizer_print_memory_profile with two params
llvm-svn: 297916
2017-03-15 23:27:53 +00:00
Kostya Serebryany
488199d6cf [libFuzzer] remove even more stale code
llvm-svn: 297797
2017-03-15 00:39:06 +00:00
Kostya Serebryany
5b7352b9bb [libFuzzer] simplify code a bit
llvm-svn: 297796
2017-03-15 00:34:25 +00:00
Kostya Serebryany
ffd7bbf928 [libFuzzer] remove more stale code
llvm-svn: 297785
2017-03-14 21:47:52 +00:00
Kostya Serebryany
6845637d3c [libFuzzer] remove stale code
llvm-svn: 297781
2017-03-14 21:30:14 +00:00
Kostya Serebryany
77dcee447a [libFuzzer] remove usage of the old coverage instrumentation
llvm-svn: 296536
2017-02-28 23:23:48 +00:00
Kostya Serebryany
46cf1b2be5 [libFuzzer] replace std::random_shuffle with std::shuffle as std::random_shuffle is being deprecated in C++17. Also simplify fuzzer::Random. NFC
llvm-svn: 294366
2017-02-07 22:37:34 +00:00
Kostya Serebryany
b0dd98aa0e [libFuzzer] remove a bit of stale code
llvm-svn: 293129
2017-01-26 01:45:54 +00:00
Marcos Pividori
90f98229d3 [libFuzzer] AlrmHandler is executed in a different thread for Windows.
Don't check for InFuzzingThread() on Windows, since the AlarmHandler() is
always executed by a different thread from a thread pool.
If we don't add these changes, the alarm handler will never execute.
Note that we decided to ignore possible problem in the synchronization.

Differential Revision: https://reviews.llvm.org/D28723

llvm-svn: 292746
2017-01-22 01:58:59 +00:00
Kostya Serebryany
ed0ebff1b3 [libFuzzer] experimental support for 'equivalance fuzzing'
llvm-svn: 292646
2017-01-20 20:57:07 +00:00
Kostya Serebryany
51f50e3dd0 [libFuzzer] improve -minimize_crash: honor -artifact_prefix= and don't special case 2-byte inputs
llvm-svn: 292511
2017-01-19 19:38:12 +00:00
Kostya Serebryany
337c115b86 [libFuzzer] add two tests for experimenting with equivalence fuzzing
llvm-svn: 292509
2017-01-19 19:07:26 +00:00
Kostya Serebryany
c20413dd67 [libFuzzer] improve error handling during the merge (handle various IO failures)
llvm-svn: 291182
2017-01-05 22:05:47 +00:00
Kostya Serebryany
8bf798611b [libFuzzer] cleaner implementation of -print_pcs=1
llvm-svn: 290739
2016-12-30 01:13:07 +00:00
Kostya Serebryany
d6593db5e1 [libFuzzer] add an experimental flag -experimental_len_control=1 that sets max_len to 1M and tries to increases the actual max sizes of mutations very gradually (second attempt)
llvm-svn: 290637
2016-12-27 23:24:55 +00:00
Mike Aizatsky
3faabcae1c [libfuzzer] dump_coverage command line flag
Reviewers: kcc, vitalybuka

Differential Revision: https://reviews.llvm.org/D27942

llvm-svn: 290138
2016-12-19 22:18:08 +00:00
Daniel Jasper
fe054c8df9 Revert "[libFuzzer] add an experimental flag -experimental_len_control=1 that sets max_len to 1M and tries to increases the actual max sizes of mutations very gradually. Also remove a bit of dead code"
This reverts commit r289998.

See comment:
https://reviews.llvm.org/rL289998

llvm-svn: 290043
2016-12-17 12:27:49 +00:00
Kostya Serebryany
bb23977e57 [libFuzzer] avoid msan false positives in more cases
llvm-svn: 289999
2016-12-16 22:45:25 +00:00
Kostya Serebryany
b37a7bd1f0 [libFuzzer] add an experimental flag -experimental_len_control=1 that sets max_len to 1M and tries to increases the actual max sizes of mutations very gradually. Also remove a bit of dead code
llvm-svn: 289998
2016-12-16 22:42:05 +00:00
Marcos Pividori
501df0bc6c [libFuzzer] Fix bug in detecting timeouts when input string is empty.
I added a new flag RunningCB to know if the Fuzzer's main thread is
running the CB function, instead of using (!CurrentUnitSize).
(!CurrentUnitSize) doesn't work properly. For example, in FuzzerLoop.cpp,
inside ShuffleAndMinimize() function, we execute the callback with an
empty string (size=0). Previous implementation failed to detect timeouts
in that execution.
Also, I add a regression test for that case.

Differential Revision: https://reviews.llvm.org/D27433

llvm-svn: 289561
2016-12-13 17:46:25 +00:00
Marcos Pividori
750e7046bb [libFuzzer] Clean up headers and file formatting of LibFuzzer files.
Reorganize #includes to follow LLVM Coding Standards.
Include some missing headers. Required to use `Printf()`.

Aside from that, this patch contains no functional change.
It is purely a re-organization.

Differential Revision: https://reviews.llvm.org/D27363

llvm-svn: 289560
2016-12-13 17:46:11 +00:00
Marcos Pividori
f6db228eaa [libFuzzer] Properly use unsigned for Process ID.
Use unsigned for PID instead of signed int. GetCurrentProcessId() returns
an unsigned (DWORD) so we must be sure we can deal with all possible values.
I use a long unsigned to be sure it can hold a 32 bit unsigned (DWORD).

Differential Revision: https://reviews.llvm.org/D27281

llvm-svn: 289558
2016-12-13 17:45:44 +00:00
Kostya Serebryany
8c3dbf94d4 [libFuzzer] respect -max_len during merge
llvm-svn: 289467
2016-12-12 20:39:35 +00:00
Kostya Serebryany
b73586a495 [libFuzzer] refactor the code to allow collecting features in different ways. Also initialize a couple of Fuzzer:: members that might have been used uninitialized :(
llvm-svn: 288731
2016-12-05 23:35:22 +00:00
Kostya Serebryany
e52101ae48 [libFuzzer] treat -rss_limit_mb=0 as no limit
llvm-svn: 288389
2016-12-01 17:56:15 +00:00
Kostya Serebryany
b04db0498e [libFuzzer] extend -rss_limit_mb to crash instantly on a single malloc that exceeds the limit
llvm-svn: 288281
2016-11-30 22:39:35 +00:00
Zachary Turner
03329c2c8b [LibFuzzer] Split up some functions among different headers.
In an effort to get libfuzzer working on Windows, we need to make
a distinction between what functions require platform specific
code (e.g. different code on Windows vs Linux) and what code
doesn't.  IO functions, for example, tend to be platform
specific.

This patch separates out some of the functions which will need
to have platform specific implementations into different headers,
so that we can then provide different implementations for each
platform.

Aside from that, this patch contains no functional change.  It
is purely a re-organization.

Patch by Marcos Pividori
Differential Revision: https://reviews.llvm.org/D27230

llvm-svn: 288264
2016-11-30 19:06:14 +00:00
Kostya Serebryany
f4f60661d6 [libFuzzer] simplify TracePC::HandleTrace even further. Also, when dealing with -exit_on_src_pos, symbolize every PC only once
llvm-svn: 285223
2016-10-26 18:52:04 +00:00
Kostya Serebryany
6c3749c78b [libFuzzer] simplify the code in TracePC::HandleTrace a bit more
llvm-svn: 285147
2016-10-26 00:42:52 +00:00
Kostya Serebryany
e2a231e776 [libFuzzer] simplify the code to print new PCs
llvm-svn: 285145
2016-10-26 00:20:51 +00:00
Kostya Serebryany
d64a9f9f9d [libFuzzer] simplify the code in TracePC::HandleTrace
llvm-svn: 285142
2016-10-25 23:52:25 +00:00