Commit Graph

235 Commits

Author SHA1 Message Date
Kostya Serebryany
70284788c6 [libFuzzer] try to use less RAM while processing the initial corpus
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@310881 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-14 20:34:35 +00:00
Kostya Serebryany
dea6df7765 [libFuzzer] use the in-binary pc table (instead of PCs captured at run-time) to implement -exit_on_src_pos
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@310151 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-04 23:49:53 +00:00
Kostya Serebryany
0b67c739d8 [libFuzzer] print PCs using the in-binary PC-table instead of relying on PCs captured at run-time
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@310148 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-04 23:13:58 +00:00
Kostya Serebryany
5ae0dfe6b2 [libFuzzer] reimplement experimental_len_control=1: bump the temporary max_len every time we failed to find new coverage during the last 1000 runs and 1 second. Also fix FileToVector to not load unfinished files
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@308811 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-22 00:10:29 +00:00
Matt Morehouse
5187ebbe87 Generate error reports when a fuzz target exits.
Summary:
Implements https://github.com/google/sanitizers/issues/835.

Flush stdout before exiting in test cases.

Since the atexit hook is used for exit reports, pending prints to
stdout can be lost if they aren't flushed before calling exit().

Expect tests to have non-zero exit code if exit() is called.

Reviewers: vitalybuka, kcc

Reviewed By: kcc

Subscribers: eraman, llvm-commits, hiraditya

Differential Revision: https://reviews.llvm.org/D35602

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@308669 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-20 20:43:39 +00:00
Kostya Serebryany
9dbc448fd9 [libFuzzer] make sure CheckExitOnSrcPosOrItem is called after the new input is saved to the corpus
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@308653 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-20 18:53:25 +00:00
Kostya Serebryany
e531917082 [libFuzzer] prototype implementation of recursion-depth coverage features (commented out; real implementation needs to use inlined instrumentation)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@308577 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-20 01:35:17 +00:00
Kostya Serebryany
9c21c1e832 [libFuzzer] when adding a reduced input print REDUCED instead of NEW
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@308336 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-18 18:47:36 +00:00
Kostya Serebryany
0bc92aded8 [libFuzzer] improve -reduce_inputs=1: now only consider the unique features of very input (seems to work much better)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@308253 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-18 01:36:50 +00:00
Kostya Serebryany
06e0ac200b [libFuzzer] simplify the handling of memmem/strstr
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@307977 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-14 00:06:27 +00:00
Kostya Serebryany
bb9605f1d6 [libFuzzer] experimental feature -reduce_inputs (off by default) that tries to replace elements in the corpus with smaller ones that have the same feature set. Still needs tuning
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@307873 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-13 01:08:53 +00:00
Kostya Serebryany
73136ba7e5 [libFuzzer] remove include <sanitizer/coverage_interface.h>, not needed any more
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@307858 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-12 22:22:36 +00:00
Kostya Serebryany
8848feb6a9 [libFuzzer] refactoring in preparation for -reduce_inputs; NFC intended
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@307857 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-12 22:20:04 +00:00
Kostya Serebryany
93a987eb3e [libFuzzer] change the default max_len from 64 to 4096. This will affect cases where libFuzzer is run w/o initial corpus or with a corpus of very small items.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@305521 91177308-0d34-0410-b5e6-96231b3b80d8
2017-06-15 22:43:40 +00:00
Chandler Carruth
e3e43d9d57 Sort the remaining #include lines in include/... and lib/....
I did this a long time ago with a janky python script, but now
clang-format has built-in support for this. I fed clang-format every
line with a #include and let it re-sort things according to the precise
LLVM rules for include ordering baked into clang-format these days.

I've reverted a number of files where the results of sorting includes
isn't healthy. Either places where we have legacy code relying on
particular include ordering (where possible, I'll fix these separately)
or where we have particular formatting around #include lines that
I didn't want to disturb in this patch.

This patch is *entirely* mechanical. If you get merge conflicts or
anything, just ignore the changes in this patch and run clang-format
over your #include lines in the files.

Sorry for any noise here, but it is important to keep these things
stable. I was seeing an increasing number of patches with irrelevant
re-ordering of #include lines because clang-format was used. This patch
at least isolates that churn, makes it easy to skip when resolving
conflicts, and gets us to a clean baseline (again).

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@304787 91177308-0d34-0410-b5e6-96231b3b80d8
2017-06-06 11:49:48 +00:00
Kostya Serebryany
de20a5381a [libFuzzer] make sure the input data is not overwritten in the fuzz target (if it is -- report an error)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@302494 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-09 01:17:29 +00:00
Vitaly Buka
0a73805541 [libFuzzer] exit without running atexit handlers in libfuzzer's crash handler
Summary:
It's not safe to assume that atexit handlers can be run once the app crashed.

Patch by Jochen Eisinger.

Reviewers: kcc, vitalybuka

Subscribers: llvm-commits

Differential Revision: https://reviews.llvm.org/D32640

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@302076 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-03 20:31:19 +00:00
Kostya Serebryany
47ba2c1622 [libFuzzer] remove -output_csv option. It duplicates the default output and got out of sync
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300768 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-19 21:34:58 +00:00
Kostya Serebryany
b6a531620b [libFuzzer] simplify the code a bit
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299180 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-31 04:17:45 +00:00
Kostya Serebryany
e6224abb77 [libFuzzer] call __sanitizer_print_memory_profile with two params
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297916 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-15 23:27:53 +00:00
Kostya Serebryany
3785710791 [libFuzzer] remove even more stale code
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297797 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-15 00:39:06 +00:00
Kostya Serebryany
59249af18d [libFuzzer] simplify code a bit
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297796 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-15 00:34:25 +00:00
Kostya Serebryany
ae8f1d8b85 [libFuzzer] remove more stale code
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297785 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-14 21:47:52 +00:00
Kostya Serebryany
d18970b6b1 [libFuzzer] remove stale code
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297781 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-14 21:30:14 +00:00
Kostya Serebryany
27a5a29184 [libFuzzer] remove usage of the old coverage instrumentation
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@296536 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-28 23:23:48 +00:00
Kostya Serebryany
ffcfd0c3bc [libFuzzer] replace std::random_shuffle with std::shuffle as std::random_shuffle is being deprecated in C++17. Also simplify fuzzer::Random. NFC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@294366 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-07 22:37:34 +00:00
Kostya Serebryany
6c2c7c89da [libFuzzer] remove a bit of stale code
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293129 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-26 01:45:54 +00:00
Marcos Pividori
61d2c04941 [libFuzzer] AlrmHandler is executed in a different thread for Windows.
Don't check for InFuzzingThread() on Windows, since the AlarmHandler() is
always executed by a different thread from a thread pool.
If we don't add these changes, the alarm handler will never execute.
Note that we decided to ignore possible problem in the synchronization.

Differential Revision: https://reviews.llvm.org/D28723

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292746 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-22 01:58:59 +00:00
Kostya Serebryany
74041145bc [libFuzzer] experimental support for 'equivalance fuzzing'
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292646 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-20 20:57:07 +00:00
Kostya Serebryany
6610ca1b8f [libFuzzer] improve -minimize_crash: honor -artifact_prefix= and don't special case 2-byte inputs
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292511 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-19 19:38:12 +00:00
Kostya Serebryany
e1feb39408 [libFuzzer] add two tests for experimenting with equivalence fuzzing
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292509 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-19 19:07:26 +00:00
Kostya Serebryany
93bacfd838 [libFuzzer] improve error handling during the merge (handle various IO failures)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@291182 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-05 22:05:47 +00:00
Kostya Serebryany
f178652c93 [libFuzzer] cleaner implementation of -print_pcs=1
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290739 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-30 01:13:07 +00:00
Kostya Serebryany
d31ce373a9 [libFuzzer] add an experimental flag -experimental_len_control=1 that sets max_len to 1M and tries to increases the actual max sizes of mutations very gradually (second attempt)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290637 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-27 23:24:55 +00:00
Mike Aizatsky
d576930959 [libfuzzer] dump_coverage command line flag
Reviewers: kcc, vitalybuka

Differential Revision: https://reviews.llvm.org/D27942

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290138 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-19 22:18:08 +00:00
Daniel Jasper
a21e8a0091 Revert "[libFuzzer] add an experimental flag -experimental_len_control=1 that sets max_len to 1M and tries to increases the actual max sizes of mutations very gradually. Also remove a bit of dead code"
This reverts commit r289998.

See comment:
https://reviews.llvm.org/rL289998

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290043 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-17 12:27:49 +00:00
Kostya Serebryany
c7ab3c7402 [libFuzzer] avoid msan false positives in more cases
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289999 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-16 22:45:25 +00:00
Kostya Serebryany
eb30028464 [libFuzzer] add an experimental flag -experimental_len_control=1 that sets max_len to 1M and tries to increases the actual max sizes of mutations very gradually. Also remove a bit of dead code
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289998 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-16 22:42:05 +00:00
Marcos Pividori
f2c03c3bb0 [libFuzzer] Fix bug in detecting timeouts when input string is empty.
I added a new flag RunningCB to know if the Fuzzer's main thread is
running the CB function, instead of using (!CurrentUnitSize).
(!CurrentUnitSize) doesn't work properly. For example, in FuzzerLoop.cpp,
inside ShuffleAndMinimize() function, we execute the callback with an
empty string (size=0). Previous implementation failed to detect timeouts
in that execution.
Also, I add a regression test for that case.

Differential Revision: https://reviews.llvm.org/D27433

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289561 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-13 17:46:25 +00:00
Marcos Pividori
f51c50474c [libFuzzer] Clean up headers and file formatting of LibFuzzer files.
Reorganize #includes to follow LLVM Coding Standards.
Include some missing headers. Required to use `Printf()`.

Aside from that, this patch contains no functional change.
It is purely a re-organization.

Differential Revision: https://reviews.llvm.org/D27363

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289560 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-13 17:46:11 +00:00
Marcos Pividori
0ca1e73f19 [libFuzzer] Properly use unsigned for Process ID.
Use unsigned for PID instead of signed int. GetCurrentProcessId() returns
an unsigned (DWORD) so we must be sure we can deal with all possible values.
I use a long unsigned to be sure it can hold a 32 bit unsigned (DWORD).

Differential Revision: https://reviews.llvm.org/D27281

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289558 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-13 17:45:44 +00:00
Kostya Serebryany
3937d703a6 [libFuzzer] respect -max_len during merge
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289467 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-12 20:39:35 +00:00
Kostya Serebryany
fe3cc4d2c5 [libFuzzer] refactor the code to allow collecting features in different ways. Also initialize a couple of Fuzzer:: members that might have been used uninitialized :(
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@288731 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-05 23:35:22 +00:00
Kostya Serebryany
d0c8980196 [libFuzzer] treat -rss_limit_mb=0 as no limit
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@288389 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-01 17:56:15 +00:00
Kostya Serebryany
b89fb12b58 [libFuzzer] extend -rss_limit_mb to crash instantly on a single malloc that exceeds the limit
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@288281 91177308-0d34-0410-b5e6-96231b3b80d8
2016-11-30 22:39:35 +00:00
Zachary Turner
1a3900e81e [LibFuzzer] Split up some functions among different headers.
In an effort to get libfuzzer working on Windows, we need to make
a distinction between what functions require platform specific
code (e.g. different code on Windows vs Linux) and what code
doesn't.  IO functions, for example, tend to be platform
specific.

This patch separates out some of the functions which will need
to have platform specific implementations into different headers,
so that we can then provide different implementations for each
platform.

Aside from that, this patch contains no functional change.  It
is purely a re-organization.

Patch by Marcos Pividori
Differential Revision: https://reviews.llvm.org/D27230

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@288264 91177308-0d34-0410-b5e6-96231b3b80d8
2016-11-30 19:06:14 +00:00
Kostya Serebryany
3c0deb17ec [libFuzzer] simplify TracePC::HandleTrace even further. Also, when dealing with -exit_on_src_pos, symbolize every PC only once
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285223 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-26 18:52:04 +00:00
Kostya Serebryany
7f59a4b62d [libFuzzer] simplify the code in TracePC::HandleTrace a bit more
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285147 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-26 00:42:52 +00:00
Kostya Serebryany
9c904557f1 [libFuzzer] simplify the code to print new PCs
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285145 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-26 00:20:51 +00:00
Kostya Serebryany
cbe5db8703 [libFuzzer] simplify the code in TracePC::HandleTrace
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285142 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-25 23:52:25 +00:00