Commit Graph

99 Commits

Author SHA1 Message Date
Kostya Serebryany
234cfada18 [libFuzzer] add two flags, -tbm_depth and -tbm_width to control how the trace-based-mutations are applied
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244712 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-12 01:55:37 +00:00
Kostya Serebryany
e0b167c66c [libFuzzer] add colons to the stats output to avoid confusion
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244708 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-12 01:04:27 +00:00
Kostya Serebryany
75a2674466 [libFuzzer] use raw C IO to reduce the risk of a deadlock in a signal handler.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244707 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-12 00:55:09 +00:00
Nick Lewycky
eacc53d67e Fix unused variable 'X' in release builds.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244571 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-11 05:57:10 +00:00
Kostya Serebryany
89f52ac188 [libFuzzer] add -only_ascii flag
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244559 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-11 01:44:42 +00:00
Yaron Keren
b80a26544b Add missing include guard to FuzzerInternal.h, NFC.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244457 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-10 16:37:40 +00:00
Kostya Serebryany
397ed3e704 [libFuzzer] move the mutators to public interface so that custom mutators may reuse these functions directly
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244250 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-06 19:19:55 +00:00
Kostya Serebryany
596885b016 [libFuzzer] add one more mutation strategy: byte shuffling
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244188 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-06 01:29:13 +00:00
Kostya Serebryany
c2f74a9478 [libFuzzer] avoid build warnings in non-assert build (useful warning in this case)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244177 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-05 23:44:42 +00:00
Kostya Serebryany
5707219e94 [libFuzzer] in dfsan mode, set labels every time we start recording traces as opposed to doing it at process startup. This ensures that the labels are fresh.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244165 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-05 23:02:57 +00:00
Kostya Serebryany
7141424447 [libFuzzer] add option -report_slow_units=Nsec to control when slow units are printed
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244152 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-05 21:43:48 +00:00
Kostya Serebryany
764fea6d11 [libFuzzer] add a missing test file
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244151 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-05 21:32:13 +00:00
Kostya Serebryany
d2f9ac2486 [libFuzzer] use data-flow feedback from strcmp
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244084 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-05 18:23:01 +00:00
Kostya Serebryany
0dd9ec77d1 [libFuzzer] more refactoring of the Mutator and adding tests to it
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243818 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-01 02:23:06 +00:00
Kostya Serebryany
8d4c8061c9 [libFuzzer] start refactoring the Mutator and adding tests to it
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243817 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-01 01:42:51 +00:00
Kostya Serebryany
427b5a50cf [libFuzzer] limit the size of the inputs printed to stderr
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243795 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-31 22:07:17 +00:00
Kostya Serebryany
f7aa7e6f49 [libFuzzer] make sure that 2-byte arguments of switch() are handled properly
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243781 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-31 20:58:55 +00:00
Kostya Serebryany
207cfe14a9 [libFuzzer] record traces from the switch statements only when told to do so
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243768 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-31 18:09:08 +00:00
Kostya Serebryany
26e09e2da5 [libFuzzer] support switch interception in dfsan mode
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243760 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-31 17:05:05 +00:00
Kostya Serebryany
02c18f4db9 [libFuzzer] trace switch statements and apply mutations based on the expected case values
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243726 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-31 01:33:06 +00:00
Kostya Serebryany
dd6dcb6cee [libFuzzer] fix the strncmp interceptor -- it should respect short strings.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243691 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-30 21:22:22 +00:00
Kostya Serebryany
11186e1752 [libFuzzer] implement strncmp hook for data-flow-guided fuzzing (w/ and w/o dfsan), add a test
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243611 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-30 02:33:45 +00:00
Kostya Serebryany
c01d39e6b8 [libFuzzer] implement memcmp hook for data-flow-guided fuzzing (w/o dfsan), extend the memcmp fuzzer test
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243603 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-30 01:34:58 +00:00
Kostya Serebryany
c830cebe1f [libFuzzer] ensure that the dfsan tracing hooks actually run (using -verbosity=3 in tests)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243365 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-28 01:25:00 +00:00
Kostya Serebryany
322fda4b3e [libFuzzer] when using cmp traces, first check that the CMP is evaluated to one value much more frequently than to the other value (heuristic)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243363 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-28 00:59:53 +00:00
Kostya Serebryany
33a9a09cd7 [libFuzzer] allow users to supply their own implementation of rand
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243078 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-24 01:06:40 +00:00
Kostya Serebryany
6cbc095f13 [libFuzzer] dump long running units to disk
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243031 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-23 18:37:22 +00:00
Alexey Samsonov
3dee92c907 [Fuzzer] Rely on $PATH expansion instead of hardcoding paths in tests. NFC.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@242851 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-21 22:51:55 +00:00
Alexey Samsonov
bb577748c0 [Fuzzer] Clearly separate regular and DFSan tests. NFC.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@242850 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-21 22:51:49 +00:00
Kostya Serebryany
f69bb85171 [libFuzzer] require the files and directories passed to the fuzzer to exist
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@242596 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-18 00:03:37 +00:00
Kostya Serebryany
63da212749 [lib/Fuzzer] make assertions more informative and update comments for the user-supplied mutator
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238658 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-30 17:33:13 +00:00
Kostya Serebryany
873d4e200d [lib/Fuzzer] relax an assertion
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238608 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-29 20:31:17 +00:00
Kostya Serebryany
ea8a3963b4 [lib/Fuzzer] make the fuzzing timeout 1200 seconds by default (was: infinity)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238251 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-26 20:57:47 +00:00
Kostya Serebryany
e4af3b4160 [lib/Fuzzer] fix docs
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238236 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-26 19:32:52 +00:00
Kostya Serebryany
f580f3683c [lib/Fuzzer] fix build with assertions
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238235 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-26 19:29:33 +00:00
Kostya Serebryany
762dbd0574 [lib/Fuzzer] doxygen-ify the comments for the user interface
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238086 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-23 02:12:05 +00:00
Kostya Serebryany
d434a0a1b2 [lib/Fuzzer] fully get rid of std::cerr in libFuzzer
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238081 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-23 01:22:35 +00:00
Kostya Serebryany
4ea4cb3197 [lib/Fuzzer] start getting rid of std::cerr. Sadly, these parts of C++ library used in libFuzzer badly interract with the same code used in the target function and also with dfsan. It's easier to just not use std::cerr than to defeat these issues.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238078 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-23 01:07:46 +00:00
Kostya Serebryany
464deacf05 [lib/Fuzzer] remove -use_coverage_pairs=1, an experimental feature that is unlikely to ever scale
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238063 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-22 22:47:03 +00:00
Kostya Serebryany
ebada2c2bc [lib/Fuzzer] extend the fuzzer interface to allow user-supplied mutators
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238059 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-22 22:35:31 +00:00
Kostya Serebryany
c9389db422 [lib/Fuzzer] ignore flags that start with --; use git pull --rebase instead of just git pull
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237950 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-21 20:39:13 +00:00
Kostya Serebryany
556425f9a9 [lib/Fuzzer] change the meaning of -timeout flag: now timeout is applied to every unit of work separately
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237735 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-19 22:12:57 +00:00
Kostya Serebryany
3b3cbed1b0 [lib/Fuzzer] more efficient reload logic; also don't spam git too much
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237649 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-19 01:06:07 +00:00
Kostya Serebryany
05ef67b6b9 [lib/Fuzzer] when -sync_command=<CMD> is given, periodically execute 'CMD CORPUS' to synchronize with other processes
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237617 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-18 21:34:20 +00:00
Logan Chien
9380329c4e Code cleanup: Reindent Fuzzer::MutateAndTestOne.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237533 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-17 02:44:31 +00:00
Kostya Serebryany
6f1b9541ba [lib/Fuzzer] Add SHA1 implementation from public domain.
Summary:
This adds a SHA1 implementation taken from public domain code.
The change is trivial, but as it involves third-party code I'd like
a second pair of eyes before commit.

LibFuzzer can not use SHA1 from openssl because openssl may not be available
and because we may be fuzzing openssl itself.
Using sha1sum via a pipe is too slow.

Test Plan: n/a

Reviewers: chandlerc

Reviewed By: chandlerc

Subscribers: majnemer, llvm-commits

Differential Revision: http://reviews.llvm.org/D9733

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237400 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-14 22:41:49 +00:00
Kostya Serebryany
2727b58c88 [lib/Fuzzer] enable -use_counters=1 by default
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237272 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-13 18:31:46 +00:00
Kostya Serebryany
a5a1b190d8 [lib/Fuzzer] A simple script to synchronise a fuzz test corpus with an external git repository.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237208 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-12 23:19:12 +00:00
Kostya Serebryany
b8a0c0ecb3 [lib/Fuzzer] use sha1sum for the file hash
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237198 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-12 22:03:34 +00:00
Kostya Serebryany
eaba2dd2f1 [lib/Fuzzer] guess the right number of workers if -jobs=N is given but -workers=M is not. Update the docs.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237163 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-12 18:51:57 +00:00