9c21c1e832
[libFuzzer] when adding a reduced input print REDUCED instead of NEW
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@308336 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-18 18:47:36 +00:00
0bc92aded8
[libFuzzer] improve -reduce_inputs=1: now only consider the unique features of very input (seems to work much better)
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@308253 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-18 01:36:50 +00:00
06e0ac200b
[libFuzzer] simplify the handling of memmem/strstr
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@307977 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-14 00:06:27 +00:00
bb9605f1d6
[libFuzzer] experimental feature -reduce_inputs (off by default) that tries to replace elements in the corpus with smaller ones that have the same feature set. Still needs tuning
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@307873 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-13 01:08:53 +00:00
73136ba7e5
[libFuzzer] remove include <sanitizer/coverage_interface.h>, not needed any more
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@307858 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-12 22:22:36 +00:00
8848feb6a9
[libFuzzer] refactoring in preparation for -reduce_inputs; NFC intended
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@307857 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-12 22:20:04 +00:00
93a987eb3e
[libFuzzer] change the default max_len from 64 to 4096. This will affect cases where libFuzzer is run w/o initial corpus or with a corpus of very small items.
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@305521 91177308-0d34-0410-b5e6-96231b3b80d8
2017-06-15 22:43:40 +00:00
e3e43d9d57
Sort the remaining #include lines in include/... and lib/....
...
I did this a long time ago with a janky python script, but now
clang-format has built-in support for this. I fed clang-format every
line with a #include and let it re-sort things according to the precise
LLVM rules for include ordering baked into clang-format these days.
I've reverted a number of files where the results of sorting includes
isn't healthy. Either places where we have legacy code relying on
particular include ordering (where possible, I'll fix these separately)
or where we have particular formatting around #include lines that
I didn't want to disturb in this patch.
This patch is *entirely* mechanical. If you get merge conflicts or
anything, just ignore the changes in this patch and run clang-format
over your #include lines in the files.
Sorry for any noise here, but it is important to keep these things
stable. I was seeing an increasing number of patches with irrelevant
re-ordering of #include lines because clang-format was used. This patch
at least isolates that churn, makes it easy to skip when resolving
conflicts, and gets us to a clean baseline (again).
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@304787 91177308-0d34-0410-b5e6-96231b3b80d8
2017-06-06 11:49:48 +00:00
de20a5381a
[libFuzzer] make sure the input data is not overwritten in the fuzz target (if it is -- report an error)
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@302494 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-09 01:17:29 +00:00
0a73805541
[libFuzzer] exit without running atexit handlers in libfuzzer's crash handler
...
Summary:
It's not safe to assume that atexit handlers can be run once the app crashed.
Patch by Jochen Eisinger.
Reviewers: kcc, vitalybuka
Subscribers: llvm-commits
Differential Revision: https://reviews.llvm.org/D32640
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@302076 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-03 20:31:19 +00:00
47ba2c1622
[libFuzzer] remove -output_csv option. It duplicates the default output and got out of sync
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300768 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-19 21:34:58 +00:00
b6a531620b
[libFuzzer] simplify the code a bit
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299180 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-31 04:17:45 +00:00
e6224abb77
[libFuzzer] call __sanitizer_print_memory_profile with two params
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297916 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-15 23:27:53 +00:00
3785710791
[libFuzzer] remove even more stale code
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297797 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-15 00:39:06 +00:00
59249af18d
[libFuzzer] simplify code a bit
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297796 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-15 00:34:25 +00:00
ae8f1d8b85
[libFuzzer] remove more stale code
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297785 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-14 21:47:52 +00:00
d18970b6b1
[libFuzzer] remove stale code
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@297781 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-14 21:30:14 +00:00
27a5a29184
[libFuzzer] remove usage of the old coverage instrumentation
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@296536 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-28 23:23:48 +00:00
ffcfd0c3bc
[libFuzzer] replace std::random_shuffle with std::shuffle as std::random_shuffle is being deprecated in C++17. Also simplify fuzzer::Random. NFC
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@294366 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-07 22:37:34 +00:00
6c2c7c89da
[libFuzzer] remove a bit of stale code
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293129 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-26 01:45:54 +00:00
61d2c04941
[libFuzzer] AlrmHandler is executed in a different thread for Windows.
...
Don't check for InFuzzingThread() on Windows, since the AlarmHandler() is
always executed by a different thread from a thread pool.
If we don't add these changes, the alarm handler will never execute.
Note that we decided to ignore possible problem in the synchronization.
Differential Revision: https://reviews.llvm.org/D28723
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292746 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-22 01:58:59 +00:00
74041145bc
[libFuzzer] experimental support for 'equivalance fuzzing'
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292646 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-20 20:57:07 +00:00
6610ca1b8f
[libFuzzer] improve -minimize_crash: honor -artifact_prefix= and don't special case 2-byte inputs
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292511 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-19 19:38:12 +00:00
e1feb39408
[libFuzzer] add two tests for experimenting with equivalence fuzzing
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292509 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-19 19:07:26 +00:00
93bacfd838
[libFuzzer] improve error handling during the merge (handle various IO failures)
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@291182 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-05 22:05:47 +00:00
f178652c93
[libFuzzer] cleaner implementation of -print_pcs=1
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290739 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-30 01:13:07 +00:00
d31ce373a9
[libFuzzer] add an experimental flag -experimental_len_control=1 that sets max_len to 1M and tries to increases the actual max sizes of mutations very gradually (second attempt)
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290637 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-27 23:24:55 +00:00
d576930959
[libfuzzer] dump_coverage command line flag
...
Reviewers: kcc, vitalybuka
Differential Revision: https://reviews.llvm.org/D27942
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290138 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-19 22:18:08 +00:00
a21e8a0091
Revert "[libFuzzer] add an experimental flag -experimental_len_control=1 that sets max_len to 1M and tries to increases the actual max sizes of mutations very gradually. Also remove a bit of dead code"
...
This reverts commit r289998.
See comment:
https://reviews.llvm.org/rL289998
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290043 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-17 12:27:49 +00:00
c7ab3c7402
[libFuzzer] avoid msan false positives in more cases
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289999 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-16 22:45:25 +00:00
eb30028464
[libFuzzer] add an experimental flag -experimental_len_control=1 that sets max_len to 1M and tries to increases the actual max sizes of mutations very gradually. Also remove a bit of dead code
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289998 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-16 22:42:05 +00:00
f2c03c3bb0
[libFuzzer] Fix bug in detecting timeouts when input string is empty.
...
I added a new flag RunningCB to know if the Fuzzer's main thread is
running the CB function, instead of using (!CurrentUnitSize).
(!CurrentUnitSize) doesn't work properly. For example, in FuzzerLoop.cpp,
inside ShuffleAndMinimize() function, we execute the callback with an
empty string (size=0). Previous implementation failed to detect timeouts
in that execution.
Also, I add a regression test for that case.
Differential Revision: https://reviews.llvm.org/D27433
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289561 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-13 17:46:25 +00:00
f51c50474c
[libFuzzer] Clean up headers and file formatting of LibFuzzer files.
...
Reorganize #includes to follow LLVM Coding Standards.
Include some missing headers. Required to use `Printf()`.
Aside from that, this patch contains no functional change.
It is purely a re-organization.
Differential Revision: https://reviews.llvm.org/D27363
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289560 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-13 17:46:11 +00:00
0ca1e73f19
[libFuzzer] Properly use unsigned for Process ID.
...
Use unsigned for PID instead of signed int. GetCurrentProcessId() returns
an unsigned (DWORD) so we must be sure we can deal with all possible values.
I use a long unsigned to be sure it can hold a 32 bit unsigned (DWORD).
Differential Revision: https://reviews.llvm.org/D27281
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289558 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-13 17:45:44 +00:00
3937d703a6
[libFuzzer] respect -max_len during merge
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@289467 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-12 20:39:35 +00:00
fe3cc4d2c5
[libFuzzer] refactor the code to allow collecting features in different ways. Also initialize a couple of Fuzzer:: members that might have been used uninitialized :(
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@288731 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-05 23:35:22 +00:00
d0c8980196
[libFuzzer] treat -rss_limit_mb=0 as no limit
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@288389 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-01 17:56:15 +00:00
b89fb12b58
[libFuzzer] extend -rss_limit_mb to crash instantly on a single malloc that exceeds the limit
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@288281 91177308-0d34-0410-b5e6-96231b3b80d8
2016-11-30 22:39:35 +00:00
1a3900e81e
[LibFuzzer] Split up some functions among different headers.
...
In an effort to get libfuzzer working on Windows, we need to make
a distinction between what functions require platform specific
code (e.g. different code on Windows vs Linux) and what code
doesn't. IO functions, for example, tend to be platform
specific.
This patch separates out some of the functions which will need
to have platform specific implementations into different headers,
so that we can then provide different implementations for each
platform.
Aside from that, this patch contains no functional change. It
is purely a re-organization.
Patch by Marcos Pividori
Differential Revision: https://reviews.llvm.org/D27230
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@288264 91177308-0d34-0410-b5e6-96231b3b80d8
2016-11-30 19:06:14 +00:00
3c0deb17ec
[libFuzzer] simplify TracePC::HandleTrace even further. Also, when dealing with -exit_on_src_pos, symbolize every PC only once
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285223 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-26 18:52:04 +00:00
7f59a4b62d
[libFuzzer] simplify the code in TracePC::HandleTrace a bit more
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285147 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-26 00:42:52 +00:00
9c904557f1
[libFuzzer] simplify the code to print new PCs
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285145 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-26 00:20:51 +00:00
cbe5db8703
[libFuzzer] simplify the code in TracePC::HandleTrace
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285142 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-25 23:52:25 +00:00
d2c91bff2f
[libFuzzer] simplify the code for use_cmp, also use the position hint when available, add a test
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@285049 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-25 02:04:43 +00:00
57a3dc5d8b
Fix -Wunused-variable warning in libFuzzer
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@284838 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-21 16:26:27 +00:00
db740ff84a
[libFuzzer] reshuffle the code for -exit_on_src_pos and -exit_on_item
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@284508 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-18 18:06:05 +00:00
75281e6436
[libFuzzer] better algorithm for -minimize_crash
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@284299 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-15 01:00:24 +00:00
3af68729f8
[libFuzzer] add -trace_cmp=1 (guiding mutations based on the observed CMP instructions). This is a reincarnation of the previously deleted -use_traces, but using a different approach for collecting traces. Still a toy, but at least it scales well. Also fix -merge in trace-pc-guard mode
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@284273 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-14 20:20:33 +00:00
76edd8d153
[libFuzzer] more detailed message for disabled leak detection
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@284169 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-13 22:24:10 +00:00
f980fc0b37
[libFuzzer] add -trace_malloc= flag
...
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@284149 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-13 19:06:46 +00:00
Kostya Serebryany