RPCS3/llvm
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm.git synced 2025-04-17 21:42:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
139,884 Commits 39 Branches 10 Tags
Commit Graph

49 Commits

Author SHA1 Message Date
Kostya Serebryany
ce6100541e [libFuzzer] swap bytes in integers when handling CMP traces 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@284301 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-10-15 04:00:07 +00:00
Kostya Serebryany
3af68729f8 [libFuzzer] add -trace_cmp=1 (guiding mutations based on the observed CMP instructions). This is a reincarnation of the previously deleted -use_traces, but using a different approach for collecting traces. Still a toy, but at least it scales well. Also fix -merge in trace-pc-guard mode 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@284273 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-10-14 20:20:33 +00:00
Kostya Serebryany
e9b850b5c5 [libFuzzer] add 'features' to the corpus elements, allow mutations with Size > MaxSize, fix sha1 in corpus stats; various refactorings 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282129 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-22 01:34:58 +00:00
Kostya Serebryany
e4977b2b7e [libFuzzer] add stats to the corpus; more refactoring 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282121 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-21 22:42:17 +00:00
Kostya Serebryany
77ab75a9d6 [libFuzzer] more refactoring; NFC 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282047 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-21 02:05:39 +00:00
Kostya Serebryany
2a546868cb [libFuzzer] refactoring: split the large header into many; NFC 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282044 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-09-21 01:50:50 +00:00
Kostya Serebryany
47b194388e [libFuzzer] fix the non-debug build warnings 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@279321 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-19 20:57:09 +00:00
Kostya Serebryany
e65e275cf2 [libFuzzer] given 0 and 255 more preference when inserting repeated bytes 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@278986 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-17 21:50:54 +00:00
Kostya Serebryany
9744bb48e4 [libFuzzer] one more mutation: ChangeBinaryInteger; also fix the breakage from r278970 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@278982 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-17 21:30:30 +00:00
Justin Bogner
7d7a23e700 Replace a few more "fall through" comments with LLVM_FALLTHROUGH 
Follow up to r278902. I had missed "fall through", with a space.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@278970 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-17 20:30:52 +00:00
Kostya Serebryany
79d100891f [libFuzzer] more mutations 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@278950 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-17 18:10:42 +00:00
Kostya Serebryany
137c3957ed [libFuzzer] add InsertRepeatedBytes and EraseBytes. 
New mutation: InsertRepeatedBytes.
Updated mutation: EraseByte => EraseBytes.

This helps https://github.com/google/sanitizers/issues/710
where libFuzzer was not able to find a known bug.
Now it finds it in minutes.

Hopefully, the change is general enough to help other targets.



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@278687 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-08-15 17:48:28 +00:00
Kostya Serebryany
730992dc3b [libFuzzer] add hooks for strstr, strcasestr, strcasecmp, strncasecmp 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@275648 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-07-15 23:27:19 +00:00
Mike Aizatsky
8bbe924637 [libfuzzer] moving is_ascii handler inside mutation dispatcher. 
Summary: It also fixes a bug, when first random might not be ascii.

Differential Revision: http://reviews.llvm.org/D21573

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@273611 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-06-23 20:44:48 +00:00
Dan Liew
1a1c8bea2d [LibFuzzer] Declare and use sanitizer functions in `fuzzer::ExternalFunctions` 
This fixes linking problems on OSX.

Unfortunately it turns out we need to use an instance of the
``fuzzer::ExternalFunctions`` object in several places so this
commit also replaces all instances with a single global instance.

It also turns out initializing a global ``fuzzer::ExternalFunctions``
before main is entered (i.e. letting the object be initialised by the
global initializers) is not safe (on OSX the call to ``Printf()`` in the
CTOR crashes if it is called from a global initializer) so we instead
have a global ``fuzzer::ExternalFunctions*`` and initialize it inside
``FuzzerDriver()``.

Multiple unit tests depend also depend on the
``fuzzer::ExternalFunctions*`` global so a ``main()`` function has been
added that initializes it before running any tests.

Differential Revision: http://reviews.llvm.org/D20943

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@272072 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-06-07 23:32:50 +00:00
Mike Aizatsky
b1953d8c1b [libfuzzer] custom crossover interface function. 
Differential Revision: http://reviews.llvm.org/D21089

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@272054 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-06-07 20:22:15 +00:00
Mike Aizatsky
664513feca [libfuzzer] hiding custom mutator handling in MutationDispatcher. 
Summary: Refactoring, no functional changes.

Differential Revision: http://reviews.llvm.org/D20975

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@271740 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-06-03 21:34:29 +00:00
Kostya Serebryany
2d7392fe48 [libFuzzer] remove std::vector operations from hot paths, NFC 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@260829 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-02-13 17:56:51 +00:00
Kostya Serebryany
49429cee7f [libFuzzer] don't require seed in fuzzer::Mutate, instead use the global Fuzzer object for fuzzer::Mutate. This makes custom mutators fast 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@260810 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-02-13 06:24:18 +00:00
Kostya Serebryany
d1eacb8ffc [libFuzzer] simplify CTOR of MutationDispatcher 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@260800 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-02-13 03:46:26 +00:00
Kostya Serebryany
1d35d47455 [libFuzzer] get rid of MutationDispatcher::Impl (simplify the code; NFC) 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@260799 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-02-13 03:37:24 +00:00
Kostya Serebryany
efb0cc7640 [libFuzzer] get rid of UserSuppliedFuzzer; NFC 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@260798 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-02-13 03:25:16 +00:00
Kostya Serebryany
728ca1266f [libFuzzer] simplify the code around Random. NFC 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@260797 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-02-13 03:00:53 +00:00
Kostya Serebryany
21a169fad1 [libFuzzer] add more fields to DictionaryEntry to count the number of uses and successes 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@258589 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-01-22 23:55:14 +00:00
Kostya Serebryany
7e85cfa5be [libFuzzer] don't use std::vector in one more hot path 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@258380 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-01-21 01:52:14 +00:00
Kostya Serebryany
429a7edf9b [libFuzzer] use std::mt19937 for generating random numbers by default. Fix MyStoll to handle negative values. Use std::any_of instead of std::find_if 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@258178 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-01-19 20:33:57 +00:00
Kostya Serebryany
baa00e52a5 [libFuzzer] replace vector with a simpler data structure in the Dictionaries to avoid memory allocations on hot path 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@257985 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-01-16 03:53:32 +00:00
Kostya Serebryany
a416b73b12 [libFuzzer] suggest a dictionary to the user of some of the trace-based dictionary entries were successful 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@257736 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-01-14 02:36:44 +00:00
Kostya Serebryany
7b0624d17e [libFuzzer] when a new unit is discovered using a dictionary, print all used dictionary entries 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@257435 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-01-12 02:36:59 +00:00
Kostya Serebryany
7fddde9543 [libFuzzer] change the way trace-based mutations are applied. Instead of a custom code just rely on the automatically created dictionary 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@257248 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-01-09 03:08:58 +00:00
Kostya Serebryany
ab240104f0 [libFuzzer] add a position hint to the dictionary-based mutator 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@257013 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-01-07 01:49:35 +00:00
Kostya Serebryany
92ec084eaf [libFuzzer] extend the dictionary mutator to optionally overwrite data with the dict entry 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@256900 91177308-0d34-0410-b5e6-96231b3b80d8
 2016-01-06 02:13:04 +00:00
Kostya Serebryany
a1e5f35b02 [libFuzzer] make CrossOver just one of the other mutations 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@256081 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-12-19 02:49:09 +00:00
Kostya Serebryany
7ed616c150 [libFuzzer] print successfull mutations sequences 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@256071 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-12-19 01:09:49 +00:00
Kostya Serebryany
5cacd53f76 [libFuzzer] fix 32-bit build 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@249646 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-10-08 00:59:25 +00:00
Kostya Serebryany
872c556fa8 [libFuzzer] add one more mutator: Mutate_ChangeASCIIInteger 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@247027 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-09-08 17:19:31 +00:00
Kostya Serebryany
c18fae603d [libFuzzer] when a single mutation fails try a few more times with other mutations before returning un-mutated data 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@246828 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-09-04 00:40:29 +00:00
Kostya Serebryany
6cc3ed7cdd [libFuzzer] actually make the dictionaries work (+docs) 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@246825 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-09-04 00:12:11 +00:00
Kostya Serebryany
bf6bd487d5 [libFuzzer] refactor the mutation functions so that they are now methods of a class. NFC 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@246808 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-09-03 21:24:19 +00:00
Kostya Serebryany
596885b016 [libFuzzer] add one more mutation strategy: byte shuffling 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244188 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-08-06 01:29:13 +00:00
Kostya Serebryany
0dd9ec77d1 [libFuzzer] more refactoring of the Mutator and adding tests to it 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243818 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-08-01 02:23:06 +00:00
Kostya Serebryany
8d4c8061c9 [libFuzzer] start refactoring the Mutator and adding tests to it 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243817 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-08-01 01:42:51 +00:00
Kostya Serebryany
33a9a09cd7 [libFuzzer] allow users to supply their own implementation of rand 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243078 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-07-24 01:06:40 +00:00
Kostya Serebryany
ebada2c2bc [lib/Fuzzer] extend the fuzzer interface to allow user-supplied mutators 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@238059 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-05-22 22:35:31 +00:00
Kostya Serebryany
0b1ec08b77 [fuzzer] properly annotate fallthrough, add one more entry to FAQ 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@229880 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-19 18:21:12 +00:00
Kostya Serebryany
eb884daa38 [fuzzer] make multi-process execution more verbose; fix mutation to actually respect mutation depth and to never produce empty units 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228170 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-04 19:10:20 +00:00
Aaron Ballman
94879c0134 Reverting r227452, which adds back the fuzzer library. Now excluding the fuzzer library based on LLVM_USE_SANITIZE_COVERAGE being set or unset. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227464 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-29 16:58:29 +00:00
Aaron Ballman
f316f2ea52 Temporarily reverting the fuzzer library as it causes too many build issues for MSVC users. This reverts: 227445, 227395, 227389, 227357, 227254, 227252 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227452 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-29 15:49:22 +00:00
Kostya Serebryany
c9baf3befb Add a Fuzzer library 
Summary:
A simple genetic in-process coverage-guided fuzz testing library.

I've used this fuzzer to test clang-format
(it found 12+ bugs, thanks djasper@ for the fixes!)
and it may also help us test other parts of LLVM.
So why not keep it in the LLVM repository?

I plan to add the cmake build rules later (in a separate patch, if that's ok)
and also add a clang-format-fuzzer target.

See README.txt for details.

Test Plan: Tests will follow separately.

Reviewers: djasper, chandlerc, rnk

Reviewed By: rnk

Subscribers: majnemer, ygribov, dblaikie, llvm-commits

Differential Revision: http://reviews.llvm.org/D7184

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227252 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-27 22:08:41 +00:00