google/honggfuzz
1
0
Fork 0
mirror of https://github.com/google/honggfuzz.git synced 2026-10-12 02:14:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

New directives in .clang-format

Browse Source
This commit is contained in:
Robert Swiecki
2020-04-29 16:14:09 +02:00
parent ee4db66497
commit bbb476eec9
48 changed files with 894 additions and 886 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.clang-format
+10 -2
View File
@@ -1,6 +1,14 @@
BasedOnStyle: Google
IndentWidth: 4
ColumnLimit: 100
AlignAfterOpenBracket: DontAlign
AlignConsecutiveAssignments: true
AlignConsecutiveDeclarations: true
AlignConsecutiveMacros: true
AlignEscapedNewlines: false
AlignOperands: true
AllowShortFunctionsOnASingleLine: false
AlwaysBreakBeforeMultilineStrings: false
ColumnLimit: 100
ForEachMacros:
- TAILQ_FOREACH_HF
IndentWidth: 4
SpacesBeforeTrailingComments: 4
cmdline.c
+104 -104
View File
@@ -49,7 +49,7 @@
struct custom_option {
struct option opt;
const char* descr;
const char* descr;
};
static bool checkFor_FILE_PLACEHOLDER(const char* const* args) {
@@ -62,8 +62,8 @@ static bool checkFor_FILE_PLACEHOLDER(const char* const* args) {
}
static bool cmdlineCheckBinaryType(honggfuzz_t* hfuzz) {
int fd;
off_t fileSz;
int fd;
off_t fileSz;
uint8_t* map = files_mapFile(hfuzz->exe.cmdline[0], &fileSz, &fd, /* isWriteable= */ false);
if (!map) {
/* It's not a critical error */
@@ -135,8 +135,8 @@ static void cmdlineUsage(const char* pname, struct custom_option* opts) {
}
bool cmdlineAddEnv(honggfuzz_t* hfuzz, char* env) {
size_t enveqlen = strlen(env);
const char* eqpos = strchr(env, '=');
size_t enveqlen = strlen(env);
const char* eqpos = strchr(env, '=');
if (eqpos) {
enveqlen = (uintptr_t)eqpos - (uintptr_t)env + 1;
}
@@ -291,128 +291,128 @@ bool cmdlineParse(int argc, char* argv[], honggfuzz_t* hfuzz) {
*hfuzz = (honggfuzz_t){
.threads =
{
.threadsFinished = 0,
.threadsMax = ({
.threadsFinished = 0,
.threadsMax = ({
long ncpus = sysconf(_SC_NPROCESSORS_ONLN);
(ncpus <= 1 ? 1 : ncpus / 2);
}),
.threadsActiveCnt = 0,
.mainThread = pthread_self(),
.mainPid = getpid(),
.mainThread = pthread_self(),
.mainPid = getpid(),
},
.io =
{
.inputDir = NULL,
.outputDir = NULL,
.inputDirPtr = NULL,
.fileCnt = 0,
.testedFileCnt = 0,
.maxFileSz = 0,
.newUnitsAdded = 0,
.fileExtn = "fuzz",
.workDir = {},
.crashDir = NULL,
.covDirNew = NULL,
.saveUnique = true,
.dynfileqMaxSz = 0U,
.dynfileqCnt = 0U,
.dynfileqCurrent = NULL,
.inputDir = NULL,
.outputDir = NULL,
.inputDirPtr = NULL,
.fileCnt = 0,
.testedFileCnt = 0,
.maxFileSz = 0,
.newUnitsAdded = 0,
.fileExtn = "fuzz",
.workDir = {},
.crashDir = NULL,
.covDirNew = NULL,
.saveUnique = true,
.dynfileqMaxSz = 0U,
.dynfileqCnt = 0U,
.dynfileqCurrent = NULL,
.dynfileq2Current = NULL,
.exportFeedback = false,
.exportFeedback = false,
},
.exe =
{
.argc = 0,
.cmdline = NULL,
.nullifyStdio = true,
.fuzzStdin = false,
.externalCommand = NULL,
.postExternalCommand = NULL,
.argc = 0,
.cmdline = NULL,
.nullifyStdio = true,
.fuzzStdin = false,
.externalCommand = NULL,
.postExternalCommand = NULL,
.feedbackMutateCommand = NULL,
.persistent = false,
.netDriver = false,
.asLimit = 0U,
.rssLimit = 0U,
.dataLimit = 0U,
.stackLimit = 0U,
.clearEnv = false,
.env_ptrs = {},
.env_vals = {},
.persistent = false,
.netDriver = false,
.asLimit = 0U,
.rssLimit = 0U,
.dataLimit = 0U,
.stackLimit = 0U,
.clearEnv = false,
.env_ptrs = {},
.env_vals = {},
},
.timing =
{
.timeStart = time(NULL),
.runEndTime = 0,
.tmOut = 1,
.lastCovUpdate = time(NULL),
.timeStart = time(NULL),
.runEndTime = 0,
.tmOut = 1,
.lastCovUpdate = time(NULL),
.timeOfLongestUnitUSecs = 0,
.tmoutVTALRM = false,
.tmoutVTALRM = false,
},
.mutate =
{
.mutationsMax = 0,
.dictionary = {},
.dictionaryCnt = 0,
.dictionaryFile = NULL,
.mutationsMax = 0,
.dictionary = {},
.dictionaryCnt = 0,
.dictionaryFile = NULL,
.mutationsPerRun = 5,
.maxInputSz = 0,
.maxInputSz = 0,
},
.display =
{
.useScreen = true,
.useScreen = true,
.lastDisplayUSecs = util_timeNowUSecs(),
.cmdline_txt[0] = '\0',
.cmdline_txt[0] = '\0',
},
.cfg =
{
.useVerifier = false,
.exitUponCrash = false,
.reportFile = NULL,
.useVerifier = false,
.exitUponCrash = false,
.reportFile = NULL,
.dynFileIterExpire = 0,
.only_printable = false,
.minimize = false,
.switchingToFDM = false,
.only_printable = false,
.minimize = false,
.switchingToFDM = false,
},
.sanitizer =
{
.enable = false,
.enable = false,
.del_report = false,
},
.feedback =
{
.covFeedbackMap = NULL,
.covFeedbackFd = -1,
.cmpFeedbackMap = NULL,
.cmpFeedbackFd = -1,
.cmpFeedback = true,
.blacklistFile = NULL,
.blacklist = NULL,
.blacklistCnt = 0,
.covFeedbackMap = NULL,
.covFeedbackFd = -1,
.cmpFeedbackMap = NULL,
.cmpFeedbackFd = -1,
.cmpFeedback = true,
.blacklistFile = NULL,
.blacklist = NULL,
.blacklistCnt = 0,
.skipFeedbackOnTimeout = false,
.dynFileMethod = _HF_DYNFILE_SOFT,
.state = _HF_STATE_UNSET,
.dynFileMethod = _HF_DYNFILE_SOFT,
.state = _HF_STATE_UNSET,
.hwCnts =
{
.cpuInstrCnt = 0ULL,
.cpuInstrCnt = 0ULL,
.cpuBranchCnt = 0ULL,
.bbCnt = 0ULL,
.newBBCnt = 0ULL,
.softCntPc = 0ULL,
.softCntCmp = 0ULL,
.bbCnt = 0ULL,
.newBBCnt = 0ULL,
.softCntPc = 0ULL,
.softCntCmp = 0ULL,
},
},
.cnts =
{
.mutationsCnt = 0,
.crashesCnt = 0,
.uniqueCrashesCnt = 0,
.mutationsCnt = 0,
.crashesCnt = 0,
.uniqueCrashesCnt = 0,
.verifiedCrashesCnt = 0,
.blCrashesCnt = 0,
.timeoutedCnt = 0,
.blCrashesCnt = 0,
.timeoutedCnt = 0,
},
.socketFuzzer =
{
.enabled = false,
.enabled = false,
.serverSocket = -1,
.clientSocket = -1,
},
@@ -420,37 +420,37 @@ bool cmdlineParse(int argc, char* argv[], honggfuzz_t* hfuzz) {
{
.dynfileq = PTHREAD_RWLOCK_INITIALIZER,
.feedback = PTHREAD_MUTEX_INITIALIZER,
.report = PTHREAD_MUTEX_INITIALIZER,
.report = PTHREAD_MUTEX_INITIALIZER,
},
/* Linux code */
.arch_linux =
{
.exeFd = -1,
.dynamicCutOffAddr = ~(0ULL),
.exeFd = -1,
.dynamicCutOffAddr = ~(0ULL),
.disableRandomization = true,
.ignoreAddr = NULL,
.symsBlFile = NULL,
.symsBlCnt = 0,
.symsBl = NULL,
.symsWlFile = NULL,
.symsWlCnt = 0,
.symsWl = NULL,
.cloneFlags = 0,
.useNetNs = HF_MAYBE,
.kernelOnly = false,
.useClone = true,
.ignoreAddr = NULL,
.symsBlFile = NULL,
.symsBlCnt = 0,
.symsBl = NULL,
.symsWlFile = NULL,
.symsWlCnt = 0,
.symsWl = NULL,
.cloneFlags = 0,
.useNetNs = HF_MAYBE,
.kernelOnly = false,
.useClone = true,
},
/* NetBSD code */
.arch_netbsd =
{
.ignoreAddr = NULL,
.symsBlFile = NULL,
.symsBlCnt = 0,
.symsBl = NULL,
.symsBlCnt = 0,
.symsBl = NULL,
.symsWlFile = NULL,
.symsWlCnt = 0,
.symsWl = NULL,
.symsWlCnt = 0,
.symsWl = NULL,
},
};
@@ -539,9 +539,9 @@ bool cmdlineParse(int argc, char* argv[], honggfuzz_t* hfuzz) {
opts[i] = custom_opts[i].opt;
}
enum llevel_t ll = INFO;
const char* logfile = NULL;
int opt_index = 0;
enum llevel_t ll = INFO;
const char* logfile = NULL;
int opt_index = 0;
for (;;) {
int c = getopt_long(
argc, argv, "-?hQvVsuPxf:i:dqe:W:r:c:F:t:R:n:N:l:p:g:E:w:B:zMTS", opts, &opt_index);
@@ -614,7 +614,7 @@ bool cmdlineParse(int argc, char* argv[], honggfuzz_t* hfuzz) {
break;
case 0x10B:
hfuzz->socketFuzzer.enabled = true;
hfuzz->timing.tmOut = 0; /* Disable process timeout checks */
hfuzz->timing.tmOut = 0; /* Disable process timeout checks */
break;
case 0x10C:
hfuzz->exe.netDriver = true;
@@ -645,7 +645,7 @@ bool cmdlineParse(int argc, char* argv[], honggfuzz_t* hfuzz) {
break;
case 'n':
if (optarg[0] == 'a') {
long ncpus = sysconf(_SC_NPROCESSORS_ONLN);
long ncpus = sysconf(_SC_NPROCESSORS_ONLN);
hfuzz->threads.threadsMax = (ncpus < 1 ? 1 : ncpus);
} else {
if (!util_isANumber(optarg)) {
@@ -775,7 +775,7 @@ bool cmdlineParse(int argc, char* argv[], honggfuzz_t* hfuzz) {
logInitLogFile(logfile, -1, ll);
hfuzz->exe.argc = argc - optind;
hfuzz->exe.argc = argc - optind;
hfuzz->exe.cmdline = (const char* const*)&argv[optind];
if (hfuzz->exe.argc <= 0) {
LOG_E("No fuzz command provided");
display.c
+35 -35
View File
@@ -38,20 +38,20 @@
#include "libhfcommon/log.h"
#include "libhfcommon/util.h"
#define ESC_CLEAR_ALL "\033[2J"
#define ESC_CLEAR_LINE "\033[2K"
#define ESC_CLEAR_ABOVE "\033[1J"
#define ESC_TERM_RESET "\033c"
#define ESC_NAV(x, y) "\033[" #x ";" #y "H"
#define ESC_BOLD "\033[1m"
#define ESC_RED "\033[31m"
#define ESC_RESET "\033[0m"
#define ESC_CLEAR_ALL "\033[2J"
#define ESC_CLEAR_LINE "\033[2K"
#define ESC_CLEAR_ABOVE "\033[1J"
#define ESC_TERM_RESET "\033c"
#define ESC_NAV(x, y) "\033[" #x ";" #y "H"
#define ESC_BOLD "\033[1m"
#define ESC_RED "\033[31m"
#define ESC_RESET "\033[0m"
#define ESC_SCROLL_REGION(x, y) "\033[" #x ";" #y "r"
#define ESC_SCROLL_DISABLE "\033[?7h"
#define ESC_SCROLL_RESET "\033[r"
#define ESC_NAV_DOWN(x) "\033[" #x "B"
#define ESC_NAV_HORIZ(x) "\033[" #x "G"
#define ESC_RESET_SETTINGS "\033[!p"
#define ESC_SCROLL_DISABLE "\033[?7h"
#define ESC_SCROLL_RESET "\033[r"
#define ESC_NAV_DOWN(x) "\033[" #x "B"
#define ESC_NAV_HORIZ(x) "\033[" #x "G"
#define ESC_RESET_SETTINGS "\033[!p"
static char displayBuf[1024 * 1024];
static void display_start(void) {
@@ -86,10 +86,10 @@ static void display_printKMG(uint64_t val) {
}
static unsigned getCpuUse(int numCpus) {
static uint64_t prevUserT = 0UL;
static uint64_t prevNiceT = 0UL;
static uint64_t prevUserT = 0UL;
static uint64_t prevNiceT = 0UL;
static uint64_t prevSystemT = 0UL;
static uint64_t prevIdleT = 0UL;
static uint64_t prevIdleT = 0UL;
FILE* f = fopen("/proc/stat", "re");
if (f == NULL) {
@@ -105,15 +105,15 @@ static unsigned getCpuUse(int numCpus) {
return 0;
}
uint64_t userCycles = (userT - prevUserT);
uint64_t niceCycles = (niceT - prevNiceT);
uint64_t userCycles = (userT - prevUserT);
uint64_t niceCycles = (niceT - prevNiceT);
uint64_t systemCycles = (systemT - prevSystemT);
uint64_t idleCycles = (idleT - prevIdleT);
uint64_t idleCycles = (idleT - prevIdleT);
prevUserT = userT;
prevNiceT = niceT;
prevUserT = userT;
prevNiceT = niceT;
prevSystemT = systemT;
prevIdleT = idleT;
prevIdleT = idleT;
uint64_t allCycles = userCycles + niceCycles + systemCycles + idleCycles;
if (allCycles == 0) {
@@ -130,11 +130,11 @@ static void getDuration(time_t elapsed_second, char* buf, size_t bufSz) {
}
unsigned int day, hour, min, second;
day = elapsed_second / 24 / 3600;
day = elapsed_second / 24 / 3600;
elapsed_second = elapsed_second - day * 24 * 3600;
hour = elapsed_second / 3600;
min = (elapsed_second - 3600 * hour) / 60;
second = elapsed_second - hour * 3600 - min * 60;
hour = elapsed_second / 3600;
min = (elapsed_second - 3600 * hour) / 60;
second = elapsed_second - hour * 3600 - min * 60;
snprintf(buf, bufSz, "%u days %02u hrs %02u mins %02u secs", day, hour, min, second);
}
@@ -166,10 +166,10 @@ void display_display(honggfuzz_t* hfuzz) {
return;
}
const time_t curr_sec = time(NULL);
const time_t elapsed_sec = curr_sec - hfuzz->timing.timeStart;
const int64_t curr_time_usecs = util_timeNowUSecs();
const int64_t elapsed_usecs = curr_time_usecs - hfuzz->display.lastDisplayUSecs;
const time_t curr_sec = time(NULL);
const time_t elapsed_sec = curr_sec - hfuzz->timing.timeStart;
const int64_t curr_time_usecs = util_timeNowUSecs();
const int64_t elapsed_usecs = curr_time_usecs - hfuzz->display.lastDisplayUSecs;
hfuzz->display.lastDisplayUSecs = curr_time_usecs;
char lastCovStr[64];
@@ -197,7 +197,7 @@ void display_display(honggfuzz_t* hfuzz) {
}
static size_t prev_exec_cnt = 0UL;
size_t exec_per_usecs =
size_t exec_per_usecs =
elapsed_usecs ? ((curr_exec_cnt - prev_exec_cnt) * 1000000) / elapsed_usecs : 0;
prev_exec_cnt = curr_exec_cnt;
@@ -295,12 +295,12 @@ void display_display(honggfuzz_t* hfuzz) {
ATOMIC_GET(hfuzz->feedback.hwCnts.bbCnt));
}
if (hfuzz->feedback.dynFileMethod & _HF_DYNFILE_SOFT) {
uint64_t softCntPc = ATOMIC_GET(hfuzz->feedback.hwCnts.softCntPc);
uint64_t softCntPc = ATOMIC_GET(hfuzz->feedback.hwCnts.softCntPc);
uint64_t softCntEdge = ATOMIC_GET(hfuzz->feedback.hwCnts.softCntEdge);
uint64_t softCntCmp = ATOMIC_GET(hfuzz->feedback.hwCnts.softCntCmp);
uint64_t guardNb = ATOMIC_GET(hfuzz->feedback.covFeedbackMap->guardNb);
uint64_t softCntCmp = ATOMIC_GET(hfuzz->feedback.hwCnts.softCntCmp);
uint64_t guardNb = ATOMIC_GET(hfuzz->feedback.covFeedbackMap->guardNb);
display_put(" edge: " ESC_BOLD "%" _HF_NONMON_SEP PRIu64 ESC_RESET "/"
"%" _HF_NONMON_SEP PRIu64 " [%" PRId64 "%%]",
"%" _HF_NONMON_SEP PRIu64 " [%" PRId64 "%%]",
softCntEdge, guardNb, guardNb ? ((softCntEdge * 100) / guardNb) : 0);
display_put(" pc: " ESC_BOLD "%" _HF_NONMON_SEP PRIu64 ESC_RESET, softCntPc);
display_put(" cmp: " ESC_BOLD "%" _HF_NONMON_SEP PRIu64 ESC_RESET, softCntCmp);
fuzz.c
+40 -40
View File
@@ -127,16 +127,16 @@ static void fuzz_setDynamicMainState(run_t* run) {
*/
if (run->global->io.dynfileqCnt == 0) {
dynfile_t dynfile = {
.size = 0,
.cov = {},
.idx = 0,
.fd = -1,
.size = 0,
.cov = {},
.idx = 0,
.fd = -1,
.timeExecUSecs = 1,
.path = "[DYNAMIC-0-SIZE]",
.data = (uint8_t*)"",
.path = "[DYNAMIC-0-SIZE]",
.data = (uint8_t*)"",
};
dynfile_t* tmp_dynfile = run->dynfile;
run->dynfile = &dynfile;
run->dynfile = &dynfile;
input_addDynamicInput(run);
run->dynfile = tmp_dynfile;
}
@@ -273,10 +273,10 @@ static bool fuzz_runVerifier(run_t* run) {
LOG_I("Launching verifier for HASH: %" PRIx64 " (iteration: %d out of %d)", run->backtrace,
i + 1, _HF_VERIFIER_ITER);
run->timeStartedUSecs = util_timeNowUSecs();
run->backtrace = 0;
run->access = 0;
run->exception = 0;
run->mainWorker = false;
run->backtrace = 0;
run->access = 0;
run->exception = 0;
run->mainWorker = false;
if (!subproc_Run(run)) {
LOG_F("subproc_Run()");
@@ -389,19 +389,19 @@ static bool fuzz_fetchInput(run_t* run) {
static void fuzz_fuzzLoop(run_t* run) {
run->timeStartedUSecs = util_timeNowUSecs();
run->crashFileName[0] = '\0';
run->pc = 0;
run->backtrace = 0;
run->access = 0;
run->exception = 0;
run->report[0] = '\0';
run->mainWorker = true;
run->mutationsPerRun = run->global->mutate.mutationsPerRun;
run->tmOutSignaled = false;
run->pc = 0;
run->backtrace = 0;
run->access = 0;
run->exception = 0;
run->report[0] = '\0';
run->mainWorker = true;
run->mutationsPerRun = run->global->mutate.mutationsPerRun;
run->tmOutSignaled = false;
run->hwCnts.cpuInstrCnt = 0;
run->hwCnts.cpuInstrCnt = 0;
run->hwCnts.cpuBranchCnt = 0;
run->hwCnts.bbCnt = 0;
run->hwCnts.newBBCnt = 0;
run->hwCnts.bbCnt = 0;
run->hwCnts.newBBCnt = 0;
if (!fuzz_fetchInput(run)) {
if (run->global->cfg.minimize && fuzz_getState(run->global) == _HF_STATE_DYNAMIC_MINIMIZE) {
@@ -426,19 +426,19 @@ static void fuzz_fuzzLoop(run_t* run) {
static void fuzz_fuzzLoopSocket(run_t* run) {
run->timeStartedUSecs = util_timeNowUSecs();
run->crashFileName[0] = '\0';
run->pc = 0;
run->backtrace = 0;
run->access = 0;
run->exception = 0;
run->report[0] = '\0';
run->mainWorker = true;
run->mutationsPerRun = run->global->mutate.mutationsPerRun;
run->tmOutSignaled = false;
run->pc = 0;
run->backtrace = 0;
run->access = 0;
run->exception = 0;
run->report[0] = '\0';
run->mainWorker = true;
run->mutationsPerRun = run->global->mutate.mutationsPerRun;
run->tmOutSignaled = false;
run->hwCnts.cpuInstrCnt = 0;
run->hwCnts.cpuInstrCnt = 0;
run->hwCnts.cpuBranchCnt = 0;
run->hwCnts.bbCnt = 0;
run->hwCnts.newBBCnt = 0;
run->hwCnts.bbCnt = 0;
run->hwCnts.newBBCnt = 0;
LOG_I("------------------------------------------------------");
@@ -462,7 +462,7 @@ static void fuzz_fuzzLoopSocket(run_t* run) {
or: it crashed by fuzzing. Restart it too.
*/
LOG_D("------[ 2.1: Target down, will restart it");
run->pid = 0; // make subproc_Run() restart it on next iteration
run->pid = 0; // make subproc_Run() restart it on next iteration
return;
}
@@ -478,17 +478,17 @@ static void fuzz_fuzzLoopSocket(run_t* run) {
}
static void* fuzz_threadNew(void* arg) {
honggfuzz_t* hfuzz = (honggfuzz_t*)arg;
honggfuzz_t* hfuzz = (honggfuzz_t*)arg;
unsigned int fuzzNo = ATOMIC_POST_INC(hfuzz->threads.threadsActiveCnt);
LOG_I("Launched new fuzzing thread, no. #%u", fuzzNo);
run_t run = {
.global = hfuzz,
.pid = 0,
.dynfile = (dynfile_t*)util_Malloc(sizeof(dynfile_t) + hfuzz->io.maxFileSz),
.fuzzNo = fuzzNo,
.global = hfuzz,
.pid = 0,
.dynfile = (dynfile_t*)util_Malloc(sizeof(dynfile_t) + hfuzz->io.maxFileSz),
.fuzzNo = fuzzNo,
.persistentSock = -1,
.tmOutSignaled = false,
.tmOutSignaled = false,
};
/* Do not try to handle input files with socketfuzzer */
fuzz.h
+4 -4
View File
@@ -28,10 +28,10 @@
#include "honggfuzz.h"
extern void fuzz_threadsStart(honggfuzz_t* fuzz);
extern bool fuzz_isTerminating(void);
extern void fuzz_setTerminating(void);
extern bool fuzz_shouldTerminate(void);
extern void fuzz_threadsStart(honggfuzz_t* fuzz);
extern bool fuzz_isTerminating(void);
extern void fuzz_setTerminating(void);
extern bool fuzz_shouldTerminate(void);
extern fuzzState_t fuzz_getState(honggfuzz_t* hfuzz);
#endif
hfuzz_cc/hfuzz-cc.c
+7 -7
View File
@@ -20,9 +20,9 @@
#define ARGS_MAX 4096
static bool isCXX = false;
static bool isGCC = false;
static bool usePCGuard = true;
static bool isCXX = false;
static bool isGCC = false;
static bool usePCGuard = true;
static bool hasCmdLineFSanitizeFuzzer = false;
/* Embed libhf/.a inside this binary */
@@ -206,7 +206,7 @@ static int execCC(int argc, char** argv) {
/* It'll point back to the libhfuzz's source tree */
char* getIncPaths(void) {
#if !defined(_HFUZZ_INC_PATH)
#error \
#error \
"You need to define _HFUZZ_INC_PATH to a directory with the directory called 'includes', containing honggfuzz's lib* includes. Typically it'd be the build/sources dir"
#endif
@@ -223,8 +223,8 @@ static bool getLibPath(
return true;
}
ptrdiff_t len = (uintptr_t)end - (uintptr_t)start;
uint64_t crc64 = util_CRC64(start, len);
ptrdiff_t len = (uintptr_t)end - (uintptr_t)start;
uint64_t crc64 = util_CRC64(start, len);
snprintf(path, PATH_MAX, "/tmp/%s.%d.%" PRIx64 ".a", name, geteuid(), crc64);
/* Does the library exist, belongs to the user, and is of expected size? */
@@ -235,7 +235,7 @@ static bool getLibPath(
/* If not, create it with atomic rename() */
char template[] = "/tmp/lib.honggfuzz.a.XXXXXX";
int fd = TEMP_FAILURE_RETRY(mkostemp(template, O_CLOEXEC));
int fd = TEMP_FAILURE_RETRY(mkostemp(template, O_CLOEXEC));
if (fd == -1) {
PLOG_E("mkostemp('%s')", template);
return false;
honggfuzz.c
+9 -9
View File
@@ -46,8 +46,8 @@
#include "socketfuzzer.h"
#include "subproc.h"
static int sigReceived = 0;
static bool clearWin = false;
static int sigReceived = 0;
static bool clearWin = false;
/*
* CygWin/MinGW incorrectly copies stack during fork(), so we need to keep some
@@ -103,7 +103,7 @@ static void setupRLimits(void) {
LOG_E("RLIMIT_NOFILE max limit < 1024 (%zu). Expect troubles!", (size_t)rlim.rlim_max);
return;
}
rlim.rlim_cur = MIN(1024, rlim.rlim_max); // we don't need more
rlim.rlim_cur = MIN(1024, rlim.rlim_max); // we don't need more
if (setrlimit(RLIMIT_NOFILE, &rlim) == -1) {
PLOG_E("Couldn't setrlimit(RLIMIT_NOFILE, cur=%zu/max=%zu)", (size_t)rlim.rlim_cur,
(size_t)rlim.rlim_max);
@@ -114,12 +114,12 @@ static void setupMainThreadTimer(void) {
const struct itimerval it = {
.it_value =
{
.tv_sec = 1,
.tv_sec = 1,
.tv_usec = 0,
},
.it_interval =
{
.tv_sec = 0,
.tv_sec = 0,
.tv_usec = 1000ULL * 200ULL,
},
};
@@ -149,7 +149,7 @@ static void setupSignalsPreThreads(void) {
struct sigaction sa = {
.sa_handler = sigHandler,
.sa_flags = 0,
.sa_flags = 0,
};
sigemptyset(&sa.sa_mask);
if (sigaction(SIGTERM, &sa, NULL) == -1) {
@@ -188,7 +188,7 @@ static void setupSignalsMainThread(void) {
static void printSummary(honggfuzz_t* hfuzz) {
uint64_t exec_per_sec = 0;
uint64_t elapsed_sec = time(NULL) - hfuzz->timing.timeStart;
uint64_t elapsed_sec = time(NULL) - hfuzz->timing.timeStart;
if (elapsed_sec) {
exec_per_sec = hfuzz->cnts.mutationsCnt / elapsed_sec;
}
@@ -198,7 +198,7 @@ static void printSummary(honggfuzz_t* hfuzz) {
struct rusage usage;
if (getrusage(RUSAGE_CHILDREN, &usage)) {
PLOG_W("getrusage failed");
usage.ru_maxrss = 0; // 0 means something went wrong with rusage
usage.ru_maxrss = 0; // 0 means something went wrong with rusage
}
#ifdef _HF_ARCH_DARWIN
usage.ru_maxrss >>= 20;
@@ -235,7 +235,7 @@ static void* signalThread(void* arg) {
for (;;) {
int sig = 0;
errno = 0;
errno = 0;
int ret = sigwait(&ss, &sig);
if (ret == EINTR) {
continue;
honggfuzz.h
+134 -134
View File
@@ -37,7 +37,7 @@
#include "libhfcommon/util.h"
#define PROG_NAME "honggfuzz"
#define PROG_NAME "honggfuzz"
#define PROG_VERSION "2.2"
/* Name of the template which will be replaced with the proper name of the file */
@@ -65,7 +65,7 @@
#define _HF_REPORT_SIZE 32768
/* Perf bitmap size */
#define _HF_PERF_BITMAP_SIZE_16M (1024U * 1024U * 16U)
#define _HF_PERF_BITMAP_SIZE_16M (1024U * 1024U * 16U)
#define _HF_PERF_BITMAP_BITSZ_MASK 0x7FFFFFFULL
/* Maximum number of PC guards (=trace-pc-guard) we support */
#define _HF_PC_GUARD_MAX (1024ULL * 1024ULL * 64ULL)
@@ -86,7 +86,7 @@
#define _HF_INPUT_FD 1021
/* FD used to pass coverage feedback from the fuzzed process */
#define _HF_COV_BITMAP_FD 1022
#define _HF_BITMAP_FD _HF_COV_BITMAP_FD /* Old name for _HF_COV_BITMAP_FD */
#define _HF_BITMAP_FD _HF_COV_BITMAP_FD /* Old name for _HF_COV_BITMAP_FD */
/* FD used to pass data to a persistent process */
#define _HF_PERSISTENT_FD 1023
@@ -111,12 +111,12 @@ static const uint8_t HFReadyTag = 'R';
#define _HF_NONMON_SEP "'"
typedef enum {
_HF_DYNFILE_NONE = 0x0,
_HF_DYNFILE_INSTR_COUNT = 0x1,
_HF_DYNFILE_NONE = 0x0,
_HF_DYNFILE_INSTR_COUNT = 0x1,
_HF_DYNFILE_BRANCH_COUNT = 0x2,
_HF_DYNFILE_BTS_EDGE = 0x10,
_HF_DYNFILE_IPT_BLOCK = 0x20,
_HF_DYNFILE_SOFT = 0x40,
_HF_DYNFILE_BTS_EDGE = 0x10,
_HF_DYNFILE_IPT_BLOCK = 0x20,
_HF_DYNFILE_SOFT = 0x40,
} dynFileMethod_t;
typedef struct {
@@ -139,20 +139,20 @@ typedef enum {
typedef enum {
HF_MAYBE = -1,
HF_NO = 0,
HF_YES = 1,
HF_NO = 0,
HF_YES = 1,
} tristate_t;
struct _dynfile_t {
size_t size;
uint64_t cov[4];
size_t idx;
int fd;
uint64_t timeExecUSecs;
char path[PATH_MAX];
size_t size;
uint64_t cov[4];
size_t idx;
int fd;
uint64_t timeExecUSecs;
char path[PATH_MAX];
struct _dynfile_t* src;
uint32_t refs;
uint8_t* data;
uint32_t refs;
uint8_t* data;
TAILQ_ENTRY(_dynfile_t) pointers;
};
@@ -165,8 +165,8 @@ struct strings_t {
};
typedef struct {
uint8_t pcGuardMap[_HF_PC_GUARD_MAX];
uint8_t bbMapPc[_HF_PERF_BITMAP_SIZE_16M];
uint8_t pcGuardMap[_HF_PC_GUARD_MAX];
uint8_t bbMapPc[_HF_PERF_BITMAP_SIZE_16M];
uint32_t bbMapCmp[_HF_PERF_BITMAP_SIZE_16M];
uint64_t pidNewPC[_HF_THREAD_MAX];
uint64_t pidNewEdge[_HF_THREAD_MAX];
@@ -180,111 +180,111 @@ typedef struct {
typedef struct {
uint32_t cnt;
struct {
uint8_t val[32];
uint8_t val[32];
uint32_t len;
} valArr[1024 * 16];
} cmpfeedback_t;
typedef struct {
struct {
size_t threadsMax;
size_t threadsFinished;
uint32_t threadsActiveCnt;
size_t threadsMax;
size_t threadsFinished;
uint32_t threadsActiveCnt;
pthread_t mainThread;
pid_t mainPid;
pid_t mainPid;
pthread_t threads[_HF_THREAD_MAX];
} threads;
struct {
const char* inputDir;
const char* outputDir;
DIR* inputDirPtr;
size_t fileCnt;
size_t testedFileCnt;
DIR* inputDirPtr;
size_t fileCnt;
size_t testedFileCnt;
const char* fileExtn;
size_t maxFileSz;
size_t newUnitsAdded;
char workDir[PATH_MAX];
size_t maxFileSz;
size_t newUnitsAdded;
char workDir[PATH_MAX];
const char* crashDir;
const char* covDirNew;
bool saveUnique;
size_t dynfileqMaxSz;
size_t dynfileqCnt;
dynfile_t* dynfileqCurrent;
dynfile_t* dynfileq2Current;
bool saveUnique;
size_t dynfileqMaxSz;
size_t dynfileqCnt;
dynfile_t* dynfileqCurrent;
dynfile_t* dynfileq2Current;
TAILQ_HEAD(dyns_t, _dynfile_t) dynfileq;
bool exportFeedback;
} io;
struct {
int argc;
int argc;
const char* const* cmdline;
bool nullifyStdio;
bool fuzzStdin;
const char* externalCommand;
const char* postExternalCommand;
const char* feedbackMutateCommand;
bool netDriver;
bool persistent;
uint64_t asLimit;
uint64_t rssLimit;
uint64_t dataLimit;
uint64_t coreLimit;
uint64_t stackLimit;
bool clearEnv;
char* env_ptrs[128];
char env_vals[128][4096];
sigset_t waitSigSet;
bool nullifyStdio;
bool fuzzStdin;
const char* externalCommand;
const char* postExternalCommand;
const char* feedbackMutateCommand;
bool netDriver;
bool persistent;
uint64_t asLimit;
uint64_t rssLimit;
uint64_t dataLimit;
uint64_t coreLimit;
uint64_t stackLimit;
bool clearEnv;
char* env_ptrs[128];
char env_vals[128][4096];
sigset_t waitSigSet;
} exe;
struct {
time_t timeStart;
time_t runEndTime;
time_t tmOut;
time_t lastCovUpdate;
time_t timeStart;
time_t runEndTime;
time_t tmOut;
time_t lastCovUpdate;
int64_t timeOfLongestUnitUSecs;
bool tmoutVTALRM;
bool tmoutVTALRM;
} timing;
struct {
struct {
uint8_t val[256];
size_t len;
size_t len;
} dictionary[1024];
size_t dictionaryCnt;
size_t dictionaryCnt;
const char* dictionaryFile;
size_t mutationsMax;
unsigned mutationsPerRun;
size_t maxInputSz;
size_t mutationsMax;
unsigned mutationsPerRun;
size_t maxInputSz;
} mutate;
struct {
bool useScreen;
char cmdline_txt[65];
bool useScreen;
char cmdline_txt[65];
int64_t lastDisplayUSecs;
} display;
struct {
bool useVerifier;
bool exitUponCrash;
bool useVerifier;
bool exitUponCrash;
const char* reportFile;
size_t dynFileIterExpire;
bool only_printable;
bool minimize;
bool switchingToFDM;
size_t dynFileIterExpire;
bool only_printable;
bool minimize;
bool switchingToFDM;
} cfg;
struct {
bool enable;
bool del_report;
} sanitizer;
struct {
fuzzState_t state;
feedback_t* covFeedbackMap;
int covFeedbackFd;
cmpfeedback_t* cmpFeedbackMap;
int cmpFeedbackFd;
bool cmpFeedback;
const char* blacklistFile;
uint64_t* blacklist;
size_t blacklistCnt;
bool skipFeedbackOnTimeout;
uint64_t maxCov[4];
fuzzState_t state;
feedback_t* covFeedbackMap;
int covFeedbackFd;
cmpfeedback_t* cmpFeedbackMap;
int cmpFeedbackFd;
bool cmpFeedback;
const char* blacklistFile;
uint64_t* blacklist;
size_t blacklistCnt;
bool skipFeedbackOnTimeout;
uint64_t maxCov[4];
dynFileMethod_t dynFileMethod;
hwcnt_t hwCnts;
hwcnt_t hwCnts;
} feedback;
struct {
size_t mutationsCnt;
@@ -296,88 +296,88 @@ typedef struct {
} cnts;
struct {
bool enabled;
int serverSocket;
int clientSocket;
int serverSocket;
int clientSocket;
} socketFuzzer;
struct {
pthread_rwlock_t dynfileq;
pthread_mutex_t feedback;
pthread_mutex_t report;
pthread_mutex_t state;
pthread_mutex_t input;
pthread_mutex_t timing;
pthread_mutex_t feedback;
pthread_mutex_t report;
pthread_mutex_t state;
pthread_mutex_t input;
pthread_mutex_t timing;
} mutex;
/* For the Linux code */
struct {
int exeFd;
uint64_t dynamicCutOffAddr;
bool disableRandomization;
void* ignoreAddr;
int exeFd;
uint64_t dynamicCutOffAddr;
bool disableRandomization;
void* ignoreAddr;
const char* symsBlFile;
char** symsBl;
size_t symsBlCnt;
char** symsBl;
size_t symsBlCnt;
const char* symsWlFile;
char** symsWl;
size_t symsWlCnt;
uintptr_t cloneFlags;
tristate_t useNetNs;
bool kernelOnly;
bool useClone;
char** symsWl;
size_t symsWlCnt;
uintptr_t cloneFlags;
tristate_t useNetNs;
bool kernelOnly;
bool useClone;
} arch_linux;
/* For the NetBSD code */
struct {
void* ignoreAddr;
void* ignoreAddr;
const char* symsBlFile;
char** symsBl;
size_t symsBlCnt;
char** symsBl;
size_t symsBlCnt;
const char* symsWlFile;
char** symsWl;
size_t symsWlCnt;
char** symsWl;
size_t symsWlCnt;
} arch_netbsd;
} honggfuzz_t;
typedef enum {
_HF_RS_UNKNOWN = 0,
_HF_RS_UNKNOWN = 0,
_HF_RS_WAITING_FOR_INITIAL_READY = 1,
_HF_RS_WAITING_FOR_READY = 2,
_HF_RS_SEND_DATA = 3,
_HF_RS_WAITING_FOR_READY = 2,
_HF_RS_SEND_DATA = 3,
} runState_t;
typedef struct {
honggfuzz_t* global;
pid_t pid;
int64_t timeStartedUSecs;
char crashFileName[PATH_MAX];
uint64_t pc;
uint64_t backtrace;
uint64_t access;
int exception;
char report[_HF_REPORT_SIZE];
bool mainWorker;
unsigned mutationsPerRun;
dynfile_t* dynfile;
bool staticFileTryMore;
uint32_t fuzzNo;
int persistentSock;
runState_t runState;
bool tmOutSignaled;
char* args[_HF_ARGS_MAX + 1];
int perThreadCovFeedbackFd;
unsigned triesLeft;
dynfile_t* current;
pid_t pid;
int64_t timeStartedUSecs;
char crashFileName[PATH_MAX];
uint64_t pc;
uint64_t backtrace;
uint64_t access;
int exception;
char report[_HF_REPORT_SIZE];
bool mainWorker;
unsigned mutationsPerRun;
dynfile_t* dynfile;
bool staticFileTryMore;
uint32_t fuzzNo;
int persistentSock;
runState_t runState;
bool tmOutSignaled;
char* args[_HF_ARGS_MAX + 1];
int perThreadCovFeedbackFd;
unsigned triesLeft;
dynfile_t* current;
#if !defined(_HF_ARCH_DARWIN)
timer_t timerId;
#endif // !defined(_HF_ARCH_DARWIN)
#endif // !defined(_HF_ARCH_DARWIN)
hwcnt_t hwCnts;
struct {
/* For Linux code */
uint8_t* perfMmapBuf;
uint8_t* perfMmapAux;
int cpuInstrFd;
int cpuBranchFd;
int cpuIptBtsFd;
int cpuInstrFd;
int cpuBranchFd;
int cpuIptBtsFd;
} arch_linux;
} run_t;
input.c
+34 -34
View File
@@ -65,7 +65,7 @@ bool input_getDirStatsAndRewind(honggfuzz_t* hfuzz) {
size_t fileCnt = 0U;
for (;;) {
errno = 0;
errno = 0;
struct dirent* entry = readdir(hfuzz->io.inputDirPtr);
if (entry == NULL && errno == EINTR) {
continue;
@@ -132,7 +132,7 @@ bool input_getNext(run_t* run, char fname[PATH_MAX], bool rewind) {
}
for (;;) {
errno = 0;
errno = 0;
struct dirent* entry = readdir(run->global->io.inputDirPtr);
if (entry == NULL && errno == EINTR) {
continue;
@@ -207,8 +207,8 @@ bool input_parseDictionary(honggfuzz_t* hfuzz) {
fclose(fDict);
};
char* lineptr = NULL;
size_t n = 0;
char* lineptr = NULL;
size_t n = 0;
defer {
free(lineptr);
};
@@ -237,7 +237,7 @@ bool input_parseDictionary(honggfuzz_t* hfuzz) {
}
const char* start = strchr(lineptr, '"');
char* end = strrchr(lineptr, '"');
char* end = strrchr(lineptr, '"');
if (!start || !end) {
LOG_W("Malformed dictionary line '%s', skipping", lineptr);
continue;
@@ -256,9 +256,9 @@ bool input_parseDictionary(honggfuzz_t* hfuzz) {
LOG_D("Parsing dictionary word: '%s'", bufv);
len = util_decodeCString(bufv);
len = util_decodeCString(bufv);
size_t dictEntry = ATOMIC_POST_INC(hfuzz->mutate.dictionaryCnt);
len = HF_MIN((size_t)len, sizeof(hfuzz->mutate.dictionary[dictEntry].val));
len = HF_MIN((size_t)len, sizeof(hfuzz->mutate.dictionary[dictEntry].val));
memcpy(hfuzz->mutate.dictionary[dictEntry].val, bufv, len);
hfuzz->mutate.dictionary[dictEntry].len = len;
@@ -368,18 +368,18 @@ static bool input_cmpCov(dynfile_t* item1, dynfile_t* item2) {
return false;
}
#define TAILQ_FOREACH_HF(var, head, field) \
#define TAILQ_FOREACH_HF(var, head, field) \
for ((var) = TAILQ_FIRST((head)); (var); (var) = TAILQ_NEXT((var), field))
void input_addDynamicInput(run_t* run) {
ATOMIC_SET(run->global->timing.lastCovUpdate, time(NULL));
dynfile_t* dynfile = (dynfile_t*)util_Calloc(sizeof(dynfile_t));
dynfile->size = run->dynfile->size;
dynfile->size = run->dynfile->size;
memcpy(dynfile->cov, run->dynfile->cov, sizeof(dynfile->cov));
dynfile->timeExecUSecs = util_timeNowUSecs() - run->timeStartedUSecs;
dynfile->data = (uint8_t*)util_AllocCopy(run->dynfile->data, run->dynfile->size);
dynfile->src = run->dynfile->src;
dynfile->data = (uint8_t*)util_AllocCopy(run->dynfile->data, run->dynfile->size);
dynfile->src = run->dynfile->src;
if (run->dynfile->src) {
ATOMIC_POST_INC(run->dynfile->src->refs);
}
@@ -398,7 +398,7 @@ void input_addDynamicInput(run_t* run) {
/* Sort it by coverage - put better coverage earlier in the list */
dynfile_t* iter = NULL;
TAILQ_FOREACH_HF(iter, &run->global->io.dynfileq, pointers) {
TAILQ_FOREACH_HF (iter, &run->global->io.dynfileq, pointers) {
if (input_cmpCov(dynfile, iter)) {
TAILQ_INSERT_BEFORE(iter, dynfile, pointers);
break;
@@ -435,7 +435,7 @@ bool input_inDynamicCorpus(run_t* run, const char* fname) {
MX_SCOPED_RWLOCK_WRITE(&run->global->mutex.dynfileq);
dynfile_t* iter = NULL;
TAILQ_FOREACH_HF(iter, &run->global->io.dynfileq, pointers) {
TAILQ_FOREACH_HF (iter, &run->global->io.dynfileq, pointers) {
if (strncmp(iter->path, fname, PATH_MAX) == 0) {
return true;
}
@@ -451,7 +451,7 @@ static inline int input_speedFactor(run_t* run, dynfile_t* dynfile) {
avg_usecs_per_input /= run->global->threads.threadsMax;
/* Cap both vals to 1us-1s */
avg_usecs_per_input = HF_CAP(avg_usecs_per_input, 1U, 1000000U);
avg_usecs_per_input = HF_CAP(avg_usecs_per_input, 1U, 1000000U);
uint64_t sample_usecs = HF_CAP(dynfile->timeExecUSecs, 1U, 1000000U);
if (sample_usecs >= avg_usecs_per_input) {
@@ -473,13 +473,13 @@ static inline int input_skipFactor(run_t* run, dynfile_t* dynfile, int* speed_fa
/* Inputs with lower total coverage -> lower chance of being tested */
static const int scaleMap[200] = {
[95 ... 199] = -15,
[90 ... 94] = -7,
[80 ... 89] = -3,
[60 ... 79] = -1,
[50 ... 59] = 0,
[30 ... 49] = 5,
[11 ... 29] = 10,
[0 ... 10] = 15,
[90 ... 94] = -7,
[80 ... 89] = -3,
[60 ... 79] = -1,
[50 ... 59] = 0,
[30 ... 49] = 5,
[11 ... 29] = 10,
[0 ... 10] = 15,
};
uint64_t maxCov0 = ATOMIC_GET(run->global->feedback.maxCov[0]);
@@ -493,12 +493,12 @@ static inline int input_skipFactor(run_t* run, dynfile_t* dynfile, int* speed_fa
/* Older inputs -> lower chance of being tested */
static const int scaleMap[200] = {
[100 ... 199] = -10,
[95 ... 99] = -5,
[91 ... 94] = -1,
[81 ... 90] = 0,
[71 ... 80] = 1,
[41 ... 70] = 2,
[0 ... 40] = 3,
[95 ... 99] = -5,
[91 ... 94] = -1,
[81 ... 90] = 0,
[71 ... 80] = 1,
[41 ... 70] = 2,
[0 ... 40] = 3,
};
const unsigned percentile = (dynfile->idx * 100) / run->global->io.dynfileqCnt;
@@ -538,7 +538,7 @@ bool input_prepareDynamicInput(run_t* run, bool needs_mangle) {
break;
}
run->current = run->global->io.dynfileqCurrent;
run->current = run->global->io.dynfileqCurrent;
run->global->io.dynfileqCurrent = TAILQ_NEXT(run->global->io.dynfileqCurrent, pointers);
int skip_factor = input_skipFactor(run, run->current, &speed_factor);
@@ -554,10 +554,10 @@ bool input_prepareDynamicInput(run_t* run, bool needs_mangle) {
input_setSize(run, run->current->size);
memcpy(run->dynfile->cov, run->current->cov, sizeof(run->dynfile->cov));
run->dynfile->idx = run->current->idx;
run->dynfile->idx = run->current->idx;
run->dynfile->timeExecUSecs = run->current->timeExecUSecs;
snprintf(run->dynfile->path, sizeof(run->dynfile->path), "%s", run->current->path);
run->dynfile->src = run->current;
run->dynfile->src = run->current;
run->dynfile->refs = 0;
memcpy(run->dynfile->data, run->current->data, run->current->size);
@@ -583,7 +583,7 @@ size_t input_getRandomInputAsBuf(run_t* run, const uint8_t** buf) {
run->global->io.dynfileq2Current = TAILQ_FIRST(&run->global->io.dynfileq);
}
current = run->global->io.dynfileq2Current;
current = run->global->io.dynfileq2Current;
run->global->io.dynfileq2Current = TAILQ_NEXT(run->global->io.dynfileq2Current, pointers);
}
@@ -608,7 +608,7 @@ static bool input_shouldReadNewFile(run_t* run) {
size_t newsz = run->dynfile->size * 2;
if (newsz >= run->global->mutate.maxInputSz) {
/* That's the largest size for this specific file that will be ever used */
newsz = run->global->mutate.maxInputSz;
newsz = run->global->mutate.maxInputSz;
run->staticFileTryMore = false;
}
@@ -646,8 +646,8 @@ bool input_prepareStaticFile(run_t* run, bool rewind, bool needs_mangle) {
input_setSize(run, fileSz);
memset(run->dynfile->cov, '\0', sizeof(run->dynfile->cov));
run->dynfile->idx = 0;
run->dynfile->src = NULL;
run->dynfile->idx = 0;
run->dynfile->src = NULL;
run->dynfile->refs = 0;
if (needs_mangle) {
input.h
+17 -17
View File
@@ -28,23 +28,23 @@
#include "honggfuzz.h"
extern void input_setSize(run_t* run, size_t sz);
extern bool input_getDirStatsAndRewind(honggfuzz_t* hfuzz);
extern bool input_getNext(run_t* run, char fname[PATH_MAX], bool rewind);
extern bool input_init(honggfuzz_t* hfuzz);
extern bool input_parseDictionary(honggfuzz_t* hfuzz);
extern void input_freeDictionary(honggfuzz_t* hfuzz);
extern bool input_parseBlacklist(honggfuzz_t* hfuzz);
extern bool input_writeCovFile(const char* dir, dynfile_t* dynfile);
extern void input_addDynamicInput(run_t* run);
extern bool input_inDynamicCorpus(run_t* run, const char* fname);
extern void input_renumerateInputs(honggfuzz_t* hfuzz);
extern bool input_prepareDynamicInput(run_t* run, bool needs_mangle);
extern void input_setSize(run_t* run, size_t sz);
extern bool input_getDirStatsAndRewind(honggfuzz_t* hfuzz);
extern bool input_getNext(run_t* run, char fname[PATH_MAX], bool rewind);
extern bool input_init(honggfuzz_t* hfuzz);
extern bool input_parseDictionary(honggfuzz_t* hfuzz);
extern void input_freeDictionary(honggfuzz_t* hfuzz);
extern bool input_parseBlacklist(honggfuzz_t* hfuzz);
extern bool input_writeCovFile(const char* dir, dynfile_t* dynfile);
extern void input_addDynamicInput(run_t* run);
extern bool input_inDynamicCorpus(run_t* run, const char* fname);
extern void input_renumerateInputs(honggfuzz_t* hfuzz);
extern bool input_prepareDynamicInput(run_t* run, bool needs_mangle);
extern size_t input_getRandomInputAsBuf(run_t* run, const uint8_t** buf);
extern bool input_prepareStaticFile(run_t* run, bool rewind, bool needs_mangle);
extern bool input_removeStaticFile(const char* dir, const char* name);
extern bool input_prepareExternalFile(run_t* run);
extern bool input_postProcessFile(run_t* run, const char* cmd);
extern bool input_prepareDynamicFileForMinimization(run_t* run);
extern bool input_prepareStaticFile(run_t* run, bool rewind, bool needs_mangle);
extern bool input_removeStaticFile(const char* dir, const char* name);
extern bool input_prepareExternalFile(run_t* run);
extern bool input_postProcessFile(run_t* run, const char* cmd);
extern bool input_prepareDynamicFileForMinimization(run_t* run);
#endif /* ifndef _HF_INPUT_H_ */
libhfcommon/common.h
+8 -8
View File
@@ -29,7 +29,7 @@
/* Stringify */
#define HF__XSTR(x) #x
#define HF_XSTR(x) HF__XSTR(x)
#define HF_XSTR(x) HF__XSTR(x)
#define HF_ATTR_UNUSED __attribute__((unused))
@@ -43,13 +43,13 @@
/* TEMP_FAILURE_RETRY, but for all OSes */
#ifndef TEMP_FAILURE_RETRY
#define TEMP_FAILURE_RETRY(exp) \
({ \
__typeof(exp) _rc; \
do { \
_rc = (exp); \
} while (_rc == -1 && errno == EINTR); \
_rc; \
#define TEMP_FAILURE_RETRY(exp) \
({ \
__typeof(exp) _rc; \
do { \
_rc = (exp); \
} while (_rc == -1 && errno == EINTR); \
_rc; \
})
#endif /* ifndef TEMP_FAILURE_RETRY */
libhfcommon/files.c
+6 -6
View File
@@ -247,7 +247,7 @@ size_t files_parseSymbolFilter(const char* srcFile, char*** filterList) {
return 0;
}
char* lineptr = NULL;
char* lineptr = NULL;
size_t symbolsRead = 0, n = 0;
for (;;) {
if (getline(&lineptr, &n, f) == -1) {
@@ -365,7 +365,7 @@ int files_createSharedMem(size_t sz, const char* name, bool exportmap) {
#if !defined(_HF_ARCH_DARWIN) && !defined(__ANDROID__)
/* shm objects under MacOSX are 'a-typical' */
if (fd == -1) {
char tmpname[PATH_MAX];
char tmpname[PATH_MAX];
struct timeval tv;
gettimeofday(&tv, NULL);
snprintf(tmpname, sizeof(tmpname), "/%s%lx%lx%d", name, (unsigned long)tv.tv_sec,
@@ -404,8 +404,8 @@ void* files_mapSharedMem(size_t sz, int* fd, const char* name, bool nocore, bool
return NULL;
}
int mflags = files_getTmpMapFlags(MAP_SHARED, /* nocore= */ true);
void* ret = mmap(NULL, sz, PROT_READ | PROT_WRITE, mflags, *fd, 0);
int mflags = files_getTmpMapFlags(MAP_SHARED, /* nocore= */ true);
void* ret = mmap(NULL, sz, PROT_READ | PROT_WRITE, mflags, *fd, 0);
if (ret == MAP_FAILED) {
PLOG_W("mmap(sz=%zu, fd=%d)", sz, *fd);
*fd = -1;
@@ -432,7 +432,7 @@ void* files_mapSharedMem(size_t sz, int* fd, const char* name, bool nocore, bool
sa_family_t files_sockFamily(int sock) {
struct sockaddr addr;
socklen_t addrlen = sizeof(addr);
socklen_t addrlen = sizeof(addr);
if (getsockname(sock, &addr, &addrlen) == -1) {
PLOG_W("getsockname(sock=%d)", sock);
@@ -471,7 +471,7 @@ const char* files_sockAddrToStr(const struct sockaddr* sa, const socklen_t len)
}
struct sockaddr_un* sun = (struct sockaddr_un*)sa;
int pathlen;
int pathlen;
if (sun->sun_path[0] == '\0') {
/* Abstract socket
libhfcommon/files.h
+9 -9
View File
@@ -34,26 +34,26 @@
extern ssize_t files_readFileToBufMax(const char* fname, uint8_t* buf, size_t fileMaxSz);
extern bool files_writeBufToFile(const char* fname, const uint8_t* buf, size_t fileSz, int flags);
extern bool files_writeStrToFile(const char* fname, const char* str, int flags);
extern int files_writeBufToTmpFile(const char* dir, const uint8_t* buf, size_t fileSz, int flags);
extern int files_writeBufToTmpFile(const char* dir, const uint8_t* buf, size_t fileSz, int flags);
extern bool files_writeToFd(int fd, const uint8_t* buf, size_t fileSz);
extern bool files_writeStrToFd(int fd, const char* str);
extern ssize_t files_readFromFd(int fd, uint8_t* buf, size_t fileSz);
extern ssize_t files_readFromFdSeek(int fd, uint8_t* buf, size_t fileSz, off_t pos);
extern bool files_writePatternToFd(int fd, off_t size, unsigned char p);
extern bool files_writePatternToFd(int fd, off_t size, unsigned char p);
extern bool files_sendToSocketNB(int fd, const uint8_t* buf, size_t fileSz);
extern bool files_sendToSocket(int fd, const uint8_t* buf, size_t fileSz);
extern bool files_sendToSocketNB(int fd, const uint8_t* buf, size_t fileSz);
extern bool files_sendToSocket(int fd, const uint8_t* buf, size_t fileSz);
extern sa_family_t files_sockFamily(int sock);
extern const char* files_sockAddrToStr(const struct sockaddr* sa, const socklen_t len);
extern bool files_exists(const char* fname);
extern bool files_exists(const char* fname);
extern const char* files_basename(const char* path);
extern bool files_resetFile(int fd, size_t sz);
extern bool files_resetFile(int fd, size_t sz);
extern uint8_t* files_mapFile(const char* fname, off_t* fileSz, int* fd, bool isWritable);
extern int files_getTmpMapFlags(int flag, bool nocore);
extern int files_createSharedMem(size_t sz, const char* name, bool exportmap);
extern void* files_mapSharedMem(size_t sz, int* fd, const char* name, bool nocore, bool export);
extern int files_getTmpMapFlags(int flag, bool nocore);
extern int files_createSharedMem(size_t sz, const char* name, bool exportmap);
extern void* files_mapSharedMem(size_t sz, int* fd, const char* name, bool nocore, bool export);
extern size_t files_parseSymbolFilter(const char* inFIle, char*** filterList);
libhfcommon/log.c
+9 -9
View File
@@ -48,10 +48,10 @@
#define __hf_pid() getpid()
#endif
static int hf_log_fd = STDERR_FILENO;
static bool hf_log_fd_isatty = false;
enum llevel_t hf_log_level = INFO;
static pthread_mutex_t log_mutex = PTHREAD_MUTEX_INITIALIZER;
static int hf_log_fd = STDERR_FILENO;
static bool hf_log_fd_isatty = false;
enum llevel_t hf_log_level = INFO;
static pthread_mutex_t log_mutex = PTHREAD_MUTEX_INITIALIZER;
__attribute__((constructor)) static void log_init(void) {
hf_log_fd = fcntl(hf_log_fd, F_DUPFD_CLOEXEC, 0);
@@ -83,7 +83,7 @@ void logInitLogFile(const char* logfile, int fd, enum llevel_t ll) {
}
void logLog(enum llevel_t ll, const char* fn, int ln, bool perr, const char* fmt, ...) {
int saved_errno = errno;
int saved_errno = errno;
char strerr[512];
if (perr == true) {
snprintf(strerr, sizeof(strerr), "%s", strerror(saved_errno));
@@ -91,8 +91,8 @@ void logLog(enum llevel_t ll, const char* fn, int ln, bool perr, const char* fmt
struct ll_t {
const char* descr;
const char* prefix;
const bool print_funcline;
const bool print_time;
const bool print_funcline;
const bool print_time;
};
static const struct ll_t logLevels[] = {
{"F", "\033[7;35m", true, true},
@@ -104,7 +104,7 @@ void logLog(enum llevel_t ll, const char* fn, int ln, bool perr, const char* fmt
{"HB", "\033[1m", false, false},
};
time_t ltstamp = time(NULL);
time_t ltstamp = time(NULL);
struct tm utctime;
localtime_r(&ltstamp, &utctime);
char timestr[32];
@@ -154,7 +154,7 @@ void logStop(int sig) {
}
void logRedirectLogFD(int fd) {
hf_log_fd = fd;
hf_log_fd = fd;
hf_log_fd_isatty = isatty(hf_log_fd);
}
libhfcommon/log.h
+29 -29
View File
@@ -30,47 +30,47 @@ enum llevel_t { FATAL = 0, ERROR, WARNING, INFO, DEBUG, HELP, HELP_BOLD };
extern enum llevel_t hf_log_level;
#define LOG_HELP(...) logLog(HELP, __FUNCTION__, __LINE__, false, __VA_ARGS__);
#define LOG_HELP(...) logLog(HELP, __FUNCTION__, __LINE__, false, __VA_ARGS__);
#define LOG_HELP_BOLD(...) logLog(HELP_BOLD, __FUNCTION__, __LINE__, false, __VA_ARGS__);
#define LOG_D(...) \
if (hf_log_level >= DEBUG) { \
logLog(DEBUG, __FUNCTION__, __LINE__, false, __VA_ARGS__); \
#define LOG_D(...) \
if (hf_log_level >= DEBUG) { \
logLog(DEBUG, __FUNCTION__, __LINE__, false, __VA_ARGS__); \
}
#define LOG_I(...) \
if (hf_log_level >= INFO) { \
logLog(INFO, __FUNCTION__, __LINE__, false, __VA_ARGS__); \
#define LOG_I(...) \
if (hf_log_level >= INFO) { \
logLog(INFO, __FUNCTION__, __LINE__, false, __VA_ARGS__); \
}
#define LOG_W(...) \
if (hf_log_level >= WARNING) { \
logLog(WARNING, __FUNCTION__, __LINE__, false, __VA_ARGS__); \
#define LOG_W(...) \
if (hf_log_level >= WARNING) { \
logLog(WARNING, __FUNCTION__, __LINE__, false, __VA_ARGS__); \
}
#define LOG_E(...) \
if (hf_log_level >= ERROR) { \
logLog(ERROR, __FUNCTION__, __LINE__, false, __VA_ARGS__); \
#define LOG_E(...) \
if (hf_log_level >= ERROR) { \
logLog(ERROR, __FUNCTION__, __LINE__, false, __VA_ARGS__); \
}
#define LOG_F(...) \
logLog(FATAL, __FUNCTION__, __LINE__, false, __VA_ARGS__); \
#define LOG_F(...) \
logLog(FATAL, __FUNCTION__, __LINE__, false, __VA_ARGS__); \
exit(EXIT_FAILURE);
#define PLOG_D(...) \
if (hf_log_level >= DEBUG) { \
logLog(DEBUG, __FUNCTION__, __LINE__, true, __VA_ARGS__); \
#define PLOG_D(...) \
if (hf_log_level >= DEBUG) { \
logLog(DEBUG, __FUNCTION__, __LINE__, true, __VA_ARGS__); \
}
#define PLOG_I(...) \
if (hf_log_level >= INFO) { \
logLog(INFO, __FUNCTION__, __LINE__, true, __VA_ARGS__); \
#define PLOG_I(...) \
if (hf_log_level >= INFO) { \
logLog(INFO, __FUNCTION__, __LINE__, true, __VA_ARGS__); \
}
#define PLOG_W(...) \
if (hf_log_level >= WARNING) { \
logLog(WARNING, __FUNCTION__, __LINE__, true, __VA_ARGS__); \
#define PLOG_W(...) \
if (hf_log_level >= WARNING) { \
logLog(WARNING, __FUNCTION__, __LINE__, true, __VA_ARGS__); \
}
#define PLOG_E(...) \
if (hf_log_level >= ERROR) { \
logLog(ERROR, __FUNCTION__, __LINE__, true, __VA_ARGS__); \
#define PLOG_E(...) \
if (hf_log_level >= ERROR) { \
logLog(ERROR, __FUNCTION__, __LINE__, true, __VA_ARGS__); \
}
#define PLOG_F(...) \
logLog(FATAL, __FUNCTION__, __LINE__, true, __VA_ARGS__); \
#define PLOG_F(...) \
logLog(FATAL, __FUNCTION__, __LINE__, true, __VA_ARGS__); \
exit(EXIT_FAILURE);
extern void logInitLogFile(const char* logfile, int fd, enum llevel_t ll);
libhfcommon/util.c
+7 -7
View File
@@ -96,7 +96,7 @@ char* util_StrDup(const char* s) {
}
static __thread pthread_once_t rndThreadOnce = PTHREAD_ONCE_INIT;
static __thread uint64_t rndState[2];
static __thread uint64_t rndState[2];
static void util_rndInitThread(void) {
int fd = TEMP_FAILURE_RETRY(open("/dev/urandom", O_RDONLY | O_CLOEXEC));
@@ -117,8 +117,8 @@ static inline uint64_t util_RotL(const uint64_t x, int k) {
}
static inline uint64_t util_InternalRnd64(void) {
const uint64_t s0 = rndState[0];
uint64_t s1 = rndState[1];
const uint64_t s0 = rndState[0];
uint64_t s1 = rndState[1];
const uint64_t result = s0 + s1;
s1 ^= s0;
rndState[0] = util_RotL(s0, 55) ^ s1 ^ (s1 << 14);
@@ -257,7 +257,7 @@ void util_sleepForMSec(uint64_t msec) {
return;
}
struct timespec ts = {
.tv_sec = msec / 1000U,
.tv_sec = msec / 1000U,
.tv_nsec = (msec % 1000U) * 1000000U,
};
TEMP_FAILURE_RETRY(nanosleep(&ts, &ts));
@@ -306,7 +306,7 @@ void util_mutexRWUnlock(pthread_rwlock_t* mutex, const char* func, int line) {
}
int64_t fastArray64Search(uint64_t* array, size_t arraySz, uint64_t key) {
size_t low = 0;
size_t low = 0;
size_t high = arraySz - 1;
size_t mid;
@@ -369,7 +369,7 @@ size_t util_decodeCString(char* s) {
case 'x': {
if (s[i + 1] && s[i + 2]) {
char hex[] = {s[i + 1], s[i + 2], 0};
s[o] = strtoul(hex, NULL, 16);
s[o] = strtoul(hex, NULL, 16);
i += 2;
} else {
s[o] = s[i];
@@ -673,7 +673,7 @@ uint64_t util_CRC64Rev(const uint8_t* buf, size_t len) {
}
static const struct {
const int signo;
const int signo;
const char* const signame;
} sigNames[] = {
#if defined(SIGHUP)
libhfcommon/util.h
+52 -52
View File
@@ -55,15 +55,15 @@
*/
#define __STRMERGE(a, b) a##b
#define _STRMERGE(a, b) __STRMERGE(a, b)
#define _STRMERGE(a, b) __STRMERGE(a, b)
#ifdef __clang__
#if __has_extension(blocks)
static void __attribute__((unused)) __clang_cleanup_func(void (^*dfunc)(void)) {
(*dfunc)();
}
#define defer \
void (^_STRMERGE(__defer_f_, __COUNTER__))(void) \
#define defer \
void (^_STRMERGE(__defer_f_, __COUNTER__))(void) \
__attribute__((cleanup(__clang_cleanup_func))) __attribute__((unused)) = ^
#else /* __has_extension(blocks) */
@@ -72,63 +72,63 @@ static void __attribute__((unused)) __clang_cleanup_func(void (^*dfunc)(void)) {
#else /* !__clang__, e.g.: gcc */
#define __block
#define _DEFER(a, count) \
auto void _STRMERGE(__defer_f_, count)(void* _defer_arg __attribute__((unused))); \
int _STRMERGE(__defer_var_, count) __attribute__((cleanup(_STRMERGE(__defer_f_, count)))) \
__attribute__((unused)); \
#define _DEFER(a, count) \
auto void _STRMERGE(__defer_f_, count)(void* _defer_arg __attribute__((unused))); \
int _STRMERGE(__defer_var_, count) __attribute__((cleanup(_STRMERGE(__defer_f_, count)))) \
__attribute__((unused)); \
void _STRMERGE(__defer_f_, count)(void* _defer_arg __attribute__((unused)))
#define defer _DEFER(a, __COUNTER__)
#endif /* ifdef __clang__ */
/* Block scoped mutexes */
#define MX_SCOPED_LOCK(m) \
MX_LOCK(m); \
defer { \
MX_UNLOCK(m); \
#define MX_SCOPED_LOCK(m) \
MX_LOCK(m); \
defer { \
MX_UNLOCK(m); \
}
#define MX_SCOPED_RWLOCK_READ(m) \
MX_RWLOCK_READ(m); \
defer { \
MX_RWLOCK_UNLOCK(m); \
#define MX_SCOPED_RWLOCK_READ(m) \
MX_RWLOCK_READ(m); \
defer { \
MX_RWLOCK_UNLOCK(m); \
}
#define MX_SCOPED_RWLOCK_WRITE(m) \
MX_RWLOCK_WRITE(m); \
defer { \
MX_RWLOCK_UNLOCK(m); \
#define MX_SCOPED_RWLOCK_WRITE(m) \
MX_RWLOCK_WRITE(m); \
defer { \
MX_RWLOCK_UNLOCK(m); \
}
#define HF_STR_LEN 8192
#define HF_STR_LEN 8192
#define HF_STR_LEN_MINUS_1 8191
#define MX_LOCK(m) util_mutexLock(m, __func__, __LINE__)
#define MX_UNLOCK(m) util_mutexUnlock(m, __func__, __LINE__)
#define MX_RWLOCK_READ(m) util_mutexRWLockRead(m, __func__, __LINE__)
#define MX_RWLOCK_WRITE(m) util_mutexRWLockWrite(m, __func__, __LINE__)
#define MX_LOCK(m) util_mutexLock(m, __func__, __LINE__)
#define MX_UNLOCK(m) util_mutexUnlock(m, __func__, __LINE__)
#define MX_RWLOCK_READ(m) util_mutexRWLockRead(m, __func__, __LINE__)
#define MX_RWLOCK_WRITE(m) util_mutexRWLockWrite(m, __func__, __LINE__)
#define MX_RWLOCK_UNLOCK(m) util_mutexRWUnlock(m, __func__, __LINE__)
/* Atomics */
#define ATOMIC_GET(x) __atomic_load_n(&(x), __ATOMIC_RELAXED)
#define ATOMIC_SET(x, y) __atomic_store_n(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_CLEAR(x) __atomic_store_n(&(x), 0, __ATOMIC_RELAXED)
#define ATOMIC_GET(x) __atomic_load_n(&(x), __ATOMIC_RELAXED)
#define ATOMIC_SET(x, y) __atomic_store_n(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_CLEAR(x) __atomic_store_n(&(x), 0, __ATOMIC_RELAXED)
#define ATOMIC_XCHG(x, y) __atomic_exchange_n(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_PRE_INC(x) __atomic_add_fetch(&(x), 1, __ATOMIC_RELAXED)
#define ATOMIC_PRE_INC(x) __atomic_add_fetch(&(x), 1, __ATOMIC_RELAXED)
#define ATOMIC_POST_INC(x) __atomic_fetch_add(&(x), 1, __ATOMIC_RELAXED)
#define ATOMIC_PRE_DEC(x) __atomic_sub_fetch(&(x), 1, __ATOMIC_RELAXED)
#define ATOMIC_PRE_DEC(x) __atomic_sub_fetch(&(x), 1, __ATOMIC_RELAXED)
#define ATOMIC_POST_DEC(x) __atomic_fetch_sub(&(x), 1, __ATOMIC_RELAXED)
#define ATOMIC_PRE_ADD(x, y) __atomic_add_fetch(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_PRE_ADD(x, y) __atomic_add_fetch(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_POST_ADD(x, y) __atomic_fetch_add(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_PRE_SUB(x, y) __atomic_sub_fetch(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_PRE_SUB(x, y) __atomic_sub_fetch(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_POST_SUB(x, y) __atomic_fetch_sub(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_PRE_AND(x, y) __atomic_and_fetch(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_PRE_AND(x, y) __atomic_and_fetch(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_POST_AND(x, y) __atomic_fetch_and(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_PRE_OR(x, y) __atomic_or_fetch(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_PRE_OR(x, y) __atomic_or_fetch(&(x), y, __ATOMIC_RELAXED)
#define ATOMIC_POST_OR(x, y) __atomic_fetch_or(&(x), y, __ATOMIC_RELAXED)
__attribute__((always_inline)) static inline bool ATOMIC_BITMAP_SET(uint8_t* addr, size_t offset) {
@@ -151,15 +151,15 @@ __attribute__((always_inline)) static inline bool ATOMIC_BITMAP_SET(uint8_t* add
#endif /* defined(__x86_64__) || defined(__i386__) */
}
#define HF_MAX(x, y) ((x > y) ? x : y)
#define HF_MIN(x, y) ((x < y) ? x : y)
#define HF_MAX(x, y) ((x > y) ? x : y)
#define HF_MIN(x, y) ((x < y) ? x : y)
#define HF_CAP(v, x, y) HF_MAX(x, HF_MIN(y, v))
#define util_Log2(v) ((sizeof(unsigned int) * 8) - __builtin_clz((unsigned int)v) - 1)
#define util_Log2(v) ((sizeof(unsigned int) * 8) - __builtin_clz((unsigned int)v) - 1)
typedef enum {
LHFC_ADDR_NOTFOUND = 0,
LHFC_ADDR_RO = 1,
LHFC_ADDR_RW = 2,
LHFC_ADDR_RO = 1,
LHFC_ADDR_RW = 2,
} lhfc_addr_t;
extern void* util_Malloc(size_t sz);
@@ -169,33 +169,33 @@ extern void* util_MMap(size_t sz);
extern void* util_Realloc(void* ptr, size_t sz);
extern uint64_t util_rndGet(uint64_t min, uint64_t max);
extern void util_rndBuf(uint8_t* buf, size_t sz);
extern void util_rndBufPrintable(uint8_t* buf, size_t sz);
extern void util_rndBuf(uint8_t* buf, size_t sz);
extern void util_rndBufPrintable(uint8_t* buf, size_t sz);
extern uint64_t util_rnd64(void);
extern uint8_t util_rndPrintable(void);
extern uint8_t util_rndPrintable(void);
extern char* util_StrDup(const char* s);
extern int util_ssnprintf(char* str, size_t size, const char* format, ...)
extern int util_ssnprintf(char* str, size_t size, const char* format, ...)
__attribute__((format(printf, 3, 4)));
extern int util_vssnprintf(char* str, size_t size, const char* format, va_list ap);
extern bool util_strStartsWith(const char* str, const char* tofind);
extern bool util_isANumber(const char* s);
extern size_t util_decodeCString(char* s);
extern void util_getLocalTime(const char* fmt, char* buf, size_t len, time_t tm);
extern int util_vssnprintf(char* str, size_t size, const char* format, va_list ap);
extern bool util_strStartsWith(const char* str, const char* tofind);
extern bool util_isANumber(const char* s);
extern size_t util_decodeCString(char* s);
extern void util_getLocalTime(const char* fmt, char* buf, size_t len, time_t tm);
extern const char* util_sigName(int signo);
extern void util_turnToPrintable(uint8_t* buf, size_t sz);
extern void util_turnToPrintable(uint8_t* buf, size_t sz);
extern void util_closeStdio(bool close_stdin, bool close_stdout, bool close_stderr);
extern lhfc_addr_t util_getProgAddr(const void* addr);
extern bool util_32bitValInBinary(uint32_t v);
extern bool util_64bitValInBinary(uint32_t v);
extern bool util_32bitValInBinary(uint32_t v);
extern bool util_64bitValInBinary(uint32_t v);
extern uint64_t util_hash(const char* buf, size_t len);
extern int64_t fastArray64Search(uint64_t* array, size_t arraySz, uint64_t key);
extern int64_t fastArray64Search(uint64_t* array, size_t arraySz, uint64_t key);
extern int64_t util_timeNowUSecs(void);
extern void util_sleepForMSec(uint64_t msec);
extern void util_sleepForMSec(uint64_t msec);
extern uint64_t util_getUINT32(const uint8_t* buf);
extern uint64_t util_getUINT64(const uint8_t* buf);
libhfnetdriver/netdriver.c
+28 -28
View File
@@ -29,20 +29,20 @@
__attribute__((visibility("default"))) __attribute__((used))
const char *const LIBHFNETDRIVER_module_netdriver = _HF_NETDRIVER_SIG;
#define HFND_TCP_PORT_ENV "HFND_TCP_PORT"
#define HFND_SOCK_PATH_ENV "HFND_SOCK_PATH"
#define HFND_TCP_PORT_ENV "HFND_TCP_PORT"
#define HFND_SOCK_PATH_ENV "HFND_SOCK_PATH"
#define HFND_SKIP_FUZZING_ENV "HFND_SKIP_FUZZING"
static char *initial_server_argv[] = {"fuzzer", NULL};
static struct {
int argc_server;
int argc_server;
char **argv_server;
struct {
struct sockaddr_storage addr;
socklen_t slen;
int type; /* as per man 2 socket */
int protocol; /* as per man 2 socket */
socklen_t slen;
int type; /* as per man 2 socket */
int protocol; /* as per man 2 socket */
} dest_addr;
} hfnd_globals = {
.argc_server = 1,
@@ -63,7 +63,7 @@ static void *netDriver_mainProgram(void *unused HF_ATTR_UNUSED) {
}
static void netDriver_startOriginalProgramInThread(void) {
pthread_t t;
pthread_t t;
pthread_attr_t attr;
pthread_attr_init(&attr);
@@ -102,7 +102,7 @@ static void netDriver_initNsIfNeeded(void) {
}
char tmpdir[PATH_MAX] = {};
int ret = HonggfuzzNetDriverTempdir(tmpdir, sizeof(tmpdir));
int ret = HonggfuzzNetDriverTempdir(tmpdir, sizeof(tmpdir));
if (ret < 0) {
LOG_F("HonggfuzzNetDriverTempdir failed");
}
@@ -131,8 +131,8 @@ static void netDriver_bindToRndLoopback(int sock, sa_family_t sa_family) {
return;
}
const struct sockaddr_in bsaddr = {
.sin_family = AF_INET,
.sin_port = htons(0),
.sin_family = AF_INET,
.sin_port = htons(0),
.sin_addr.s_addr = htonl((((uint32_t)util_rnd64()) & 0x00FFFFFF) | 0x7F000000),
};
if (bind(sock, (struct sockaddr *)&bsaddr, sizeof(bsaddr)) == -1) {
@@ -216,7 +216,7 @@ __attribute__((weak)) int HonggfuzzNetDriverArgsForServer(
for (int i = 0; i < argc; i++) {
if (strcmp(argv[i], "--") == 0) {
/* Replace '--' with argv[0] */
argv[i] = argv[0];
argv[i] = argv[0];
*server_argc = argc - i;
*server_argv = &argv[i];
return i;
@@ -250,7 +250,7 @@ __attribute__((weak)) socklen_t HonggfuzzNetDriverServerAddress(
static uint16_t netDriver_getTCPPort(int argc, char **argv) {
const char *port_str = getenv(HFND_TCP_PORT_ENV);
if (port_str) {
errno = 0;
errno = 0;
signed long portsl = strtol(port_str, NULL, 0);
if (errno != 0) {
PLOG_F("Couldn't convert '%s'='%s' to a number", HFND_TCP_PORT_ENV, port_str);
@@ -276,7 +276,7 @@ static const char *netDriver_getSockPath(int argc HF_ATTR_UNUSED, char **argv HF
}
static __thread char path[PATH_MAX] = {};
const char *sock_path = getenv(HFND_SOCK_PATH_ENV);
const char * sock_path = getenv(HFND_SOCK_PATH_ENV);
/* If it starts with '/' it's an absolute path */
if (sock_path && sock_path[0] == '/') {
snprintf(path, sizeof(path), "%s", sock_path);
@@ -298,8 +298,8 @@ static bool netDriver_connAndAssign(
if (fd >= 0) {
close(fd);
memcpy(&hfnd_globals.dest_addr.addr, addr, slen);
hfnd_globals.dest_addr.slen = slen;
hfnd_globals.dest_addr.type = type;
hfnd_globals.dest_addr.slen = slen;
hfnd_globals.dest_addr.type = type;
hfnd_globals.dest_addr.protocol = protocol;
return true;
}
@@ -307,10 +307,10 @@ static bool netDriver_connAndAssign(
}
static bool netDriver_checkIfServerReady(int argc, char **argv) {
struct sockaddr_storage addr = {.ss_family = AF_UNSPEC};
int type = SOCK_STREAM;
int protocol = 0;
socklen_t slen = HonggfuzzNetDriverServerAddress(&addr, &type, &protocol);
struct sockaddr_storage addr = {.ss_family = AF_UNSPEC};
int type = SOCK_STREAM;
int protocol = 0;
socklen_t slen = HonggfuzzNetDriverServerAddress(&addr, &type, &protocol);
/* User provided specific destination address */
if (slen > 0) {
if (netDriver_connAndAssign((struct sockaddr *)&addr, slen, type, protocol)) {
@@ -326,7 +326,7 @@ static bool netDriver_checkIfServerReady(int argc, char **argv) {
/* Try to connect to ${HFND_TMP_DIR}/${HFND_DEFAULT_SOCK_PATH} first via a PF_UNIX socket */
struct sockaddr_un sun = {
.sun_family = PF_UNIX,
.sun_path = {},
.sun_path = {},
};
snprintf(sun.sun_path, sizeof(sun.sun_path), "%s", netDriver_getSockPath(argc, argv));
if (netDriver_connAndAssign((const struct sockaddr *)&sun, sizeof(sun), SOCK_STREAM, 0)) {
@@ -340,21 +340,21 @@ static bool netDriver_checkIfServerReady(int argc, char **argv) {
return true;
}
#endif /* defined(SOCK_SEQPACKET) */
/* Next, try TCP4 and TCP6 connections to the localhost */
const uint16_t tcp_port = netDriver_getTCPPort(argc, argv);
const struct sockaddr_in addr4 = {
.sin_family = PF_INET,
.sin_port = htons(tcp_port),
/* Next, try TCP4 and TCP6 connections to the localhost */
const uint16_t tcp_port = netDriver_getTCPPort(argc, argv);
const struct sockaddr_in addr4 = {
.sin_family = PF_INET,
.sin_port = htons(tcp_port),
.sin_addr.s_addr = htonl(INADDR_LOOPBACK),
};
if (netDriver_connAndAssign((const struct sockaddr *)&addr4, sizeof(addr4), SOCK_STREAM, 0)) {
return true;
}
const struct sockaddr_in6 addr6 = {
.sin6_family = PF_INET6,
.sin6_port = htons(tcp_port),
.sin6_family = PF_INET6,
.sin6_port = htons(tcp_port),
.sin6_flowinfo = 0,
.sin6_addr = in6addr_loopback,
.sin6_addr = in6addr_loopback,
.sin6_scope_id = 0,
};
if (netDriver_connAndAssign((const struct sockaddr *)&addr6, sizeof(addr6), SOCK_STREAM, 0)) {
libhfnetdriver/netdriver.h
+3 -3
View File
@@ -11,9 +11,9 @@
extern "C" {
#endif
#define HFND_TMP_DIR_OLD "/tmp/FUZZ"
#define HFND_TMP_DIR "/tmp/HFND_TMP_DIR"
#define HFND_DEFAULT_TCP_PORT 8080
#define HFND_TMP_DIR_OLD "/tmp/FUZZ"
#define HFND_TMP_DIR "/tmp/HFND_TMP_DIR"
#define HFND_DEFAULT_TCP_PORT 8080
#define HFND_DEFAULT_SOCK_PATH "socket"
/*
libhfuzz/fetch.c
+2 -2
View File
@@ -22,7 +22,7 @@
__attribute__((visibility("default"))) __attribute__((used)) const char* LIBHFUZZ_module_fetch =
_HF_PERSISTENT_SIG;
static const uint8_t* inputFile = NULL;
static const uint8_t* inputFile = NULL;
__attribute__((constructor)) static void init(void) {
if (fcntl(_HF_INPUT_FD, F_GETFD) == -1 && errno == EBADF) {
return;
@@ -40,7 +40,7 @@ void HonggfuzzFetchData(const uint8_t** buf_ptr, size_t* len_ptr) {
}
uint64_t rcvLen;
ssize_t sz = files_readFromFd(_HF_PERSISTENT_FD, (uint8_t*)&rcvLen, sizeof(rcvLen));
ssize_t sz = files_readFromFd(_HF_PERSISTENT_FD, (uint8_t*)&rcvLen, sizeof(rcvLen));
if (sz == -1) {
PLOG_F("readFromFd(fd=%d, size=%zu) failed", _HF_PERSISTENT_FD, sizeof(rcvLen));
}
libhfuzz/instrument.c
+48 -48
View File
@@ -46,8 +46,8 @@ __attribute__((used)) const char* const LIBHFUZZ_module_instrument = "LIBHFUZZ_m
*/
static feedback_t bbMapFb;
feedback_t* globalCovFeedback = &bbMapFb;
feedback_t* localCovFeedback = &bbMapFb;
feedback_t* globalCovFeedback = &bbMapFb;
feedback_t* localCovFeedback = &bbMapFb;
cmpfeedback_t* globalCmpFeedback = NULL;
uint32_t my_thread_no = 0;
@@ -96,7 +96,7 @@ static void* initialzeTryMapHugeTLB(int fd, size_t sz) {
* Try to map the local structure using HugeTLB. It'll be way fatser later to clean it with
* { ftruncate(fd, 0); ftruncate(fd, size); }
*/
mflags = files_getTmpMapFlags(MAP_SHARED | MAP_HUGE_2MB, /* nocore= */ true);
mflags = files_getTmpMapFlags(MAP_SHARED | MAP_HUGE_2MB, /* nocore= */ true);
void* ret = mmap(NULL, sz, PROT_READ | PROT_WRITE, mflags, fd, 0);
#if defined(__x86_64__) || defined(__i386__)
if (ret == MAP_FAILED) {
@@ -177,8 +177,8 @@ static bool initializeGlobalCovFeedback(void) {
static void initializeInstrument(void) {
if (fcntl(_HF_LOG_FD, F_GETFD) != -1) {
enum llevel_t ll = INFO;
const char* llstr = getenv(_HF_LOG_LEVEL_ENV);
enum llevel_t ll = INFO;
const char* llstr = getenv(_HF_LOG_LEVEL_ENV);
if (llstr) {
ll = atoi(llstr);
}
@@ -217,14 +217,14 @@ static void initializeInstrument(void) {
static __thread pthread_once_t localInitOnce = PTHREAD_ONCE_INIT;
extern void hfuzzInstrumentInit(void);
extern void hfuzzInstrumentInit(void);
__attribute__((constructor)) void hfuzzInstrumentInit(void) {
pthread_once(&localInitOnce, initializeInstrument);
}
__attribute__((weak)) size_t instrumentReserveGuard(size_t cnt) {
static size_t guardCnt = 1;
size_t base = guardCnt;
size_t base = guardCnt;
guardCnt += cnt;
if (guardCnt >= _HF_PC_GUARD_MAX) {
LOG_F(
@@ -326,9 +326,9 @@ HF_REQUIRE_SSE42_POPCNT void hfuzz_trace_pc(uintptr_t pc) {
*/
HF_REQUIRE_SSE42_POPCNT static inline void hfuzz_trace_cmp1_internal(
uintptr_t pc, uint8_t Arg1, uint8_t Arg2) {
uintptr_t pos = pc % _HF_PERF_BITMAP_SIZE_16M;
register uint8_t v = ((sizeof(Arg1) * 8) - __builtin_popcount(Arg1 ^ Arg2));
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
uintptr_t pos = pc % _HF_PERF_BITMAP_SIZE_16M;
register uint8_t v = ((sizeof(Arg1) * 8) - __builtin_popcount(Arg1 ^ Arg2));
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
if (prev < v) {
ATOMIC_SET(globalCovFeedback->bbMapCmp[pos], v);
ATOMIC_POST_ADD(globalCovFeedback->pidNewCmp[my_thread_no], v - prev);
@@ -338,9 +338,9 @@ HF_REQUIRE_SSE42_POPCNT static inline void hfuzz_trace_cmp1_internal(
HF_REQUIRE_SSE42_POPCNT static inline void hfuzz_trace_cmp2_internal(
uintptr_t pc, uint16_t Arg1, uint16_t Arg2) {
uintptr_t pos = pc % _HF_PERF_BITMAP_SIZE_16M;
register uint8_t v = ((sizeof(Arg1) * 8) - __builtin_popcount(Arg1 ^ Arg2));
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
uintptr_t pos = pc % _HF_PERF_BITMAP_SIZE_16M;
register uint8_t v = ((sizeof(Arg1) * 8) - __builtin_popcount(Arg1 ^ Arg2));
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
if (prev < v) {
ATOMIC_SET(globalCovFeedback->bbMapCmp[pos], v);
ATOMIC_POST_ADD(globalCovFeedback->pidNewCmp[my_thread_no], v - prev);
@@ -350,9 +350,9 @@ HF_REQUIRE_SSE42_POPCNT static inline void hfuzz_trace_cmp2_internal(
HF_REQUIRE_SSE42_POPCNT static inline void hfuzz_trace_cmp4_internal(
uintptr_t pc, uint32_t Arg1, uint32_t Arg2) {
uintptr_t pos = pc % _HF_PERF_BITMAP_SIZE_16M;
register uint8_t v = ((sizeof(Arg1) * 8) - __builtin_popcount(Arg1 ^ Arg2));
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
uintptr_t pos = pc % _HF_PERF_BITMAP_SIZE_16M;
register uint8_t v = ((sizeof(Arg1) * 8) - __builtin_popcount(Arg1 ^ Arg2));
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
if (prev < v) {
ATOMIC_SET(globalCovFeedback->bbMapCmp[pos], v);
ATOMIC_POST_ADD(globalCovFeedback->pidNewCmp[my_thread_no], v - prev);
@@ -362,9 +362,9 @@ HF_REQUIRE_SSE42_POPCNT static inline void hfuzz_trace_cmp4_internal(
HF_REQUIRE_SSE42_POPCNT static inline void hfuzz_trace_cmp8_internal(
uintptr_t pc, uint64_t Arg1, uint64_t Arg2) {
uintptr_t pos = pc % _HF_PERF_BITMAP_SIZE_16M;
register uint8_t v = ((sizeof(Arg1) * 8) - __builtin_popcountll(Arg1 ^ Arg2));
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
uintptr_t pos = pc % _HF_PERF_BITMAP_SIZE_16M;
register uint8_t v = ((sizeof(Arg1) * 8) - __builtin_popcountll(Arg1 ^ Arg2));
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
if (prev < v) {
ATOMIC_SET(globalCovFeedback->bbMapCmp[pos], v);
ATOMIC_POST_ADD(globalCovFeedback->pidNewCmp[my_thread_no], v - prev);
@@ -503,9 +503,9 @@ HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_trace_cmp(
*/
HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t* Cases) {
for (uint64_t i = 0; i < Cases[0]; i++) {
uintptr_t pos = ((uintptr_t)__builtin_return_address(0) + i) % _HF_PERF_BITMAP_SIZE_16M;
uint8_t v = (uint8_t)Cases[1] - __builtin_popcountll(Val ^ Cases[i + 2]);
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
uintptr_t pos = ((uintptr_t)__builtin_return_address(0) + i) % _HF_PERF_BITMAP_SIZE_16M;
uint8_t v = (uint8_t)Cases[1] - __builtin_popcountll(Val ^ Cases[i + 2]);
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
if (prev < v) {
ATOMIC_SET(globalCovFeedback->bbMapCmp[pos], v);
ATOMIC_POST_ADD(globalCovFeedback->pidNewCmp[my_thread_no], v - prev);
@@ -529,9 +529,9 @@ HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_trace_cmpd(
* -fsanitize-coverage=trace-div
*/
HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_trace_div8(uint64_t Val) {
uintptr_t pos = (uintptr_t)__builtin_return_address(0) % _HF_PERF_BITMAP_SIZE_16M;
uint8_t v = ((sizeof(Val) * 8) - __builtin_popcountll(Val));
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
uintptr_t pos = (uintptr_t)__builtin_return_address(0) % _HF_PERF_BITMAP_SIZE_16M;
uint8_t v = ((sizeof(Val) * 8) - __builtin_popcountll(Val));
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
if (prev < v) {
ATOMIC_SET(globalCovFeedback->bbMapCmp[pos], v);
ATOMIC_POST_ADD(globalCovFeedback->pidNewCmp[my_thread_no], v - prev);
@@ -540,9 +540,9 @@ HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_trace_div8(uint64_t Val) {
}
HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_trace_div4(uint32_t Val) {
uintptr_t pos = (uintptr_t)__builtin_return_address(0) % _HF_PERF_BITMAP_SIZE_16M;
uint8_t v = ((sizeof(Val) * 8) - __builtin_popcount(Val));
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
uintptr_t pos = (uintptr_t)__builtin_return_address(0) % _HF_PERF_BITMAP_SIZE_16M;
uint8_t v = ((sizeof(Val) * 8) - __builtin_popcount(Val));
uint8_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
if (prev < v) {
ATOMIC_SET(globalCovFeedback->bbMapCmp[pos], v);
ATOMIC_POST_ADD(globalCovFeedback->pidNewCmp[my_thread_no], v - prev);
@@ -556,7 +556,7 @@ HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_trace_div4(uint32_t Val) {
HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_trace_pc_indir(uintptr_t callee) {
register size_t pos1 = (uintptr_t)__builtin_return_address(0) << 12;
register size_t pos2 = callee & 0xFFF;
register size_t pos = (pos1 | pos2) & _HF_PERF_BITMAP_BITSZ_MASK;
register size_t pos = (pos1 | pos2) & _HF_PERF_BITMAP_BITSZ_MASK;
register bool prev = ATOMIC_BITMAP_SET(globalCovFeedback->bbMapPc, pos);
if (!prev) {
@@ -573,7 +573,7 @@ __attribute__((weak)) HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_indir_call16(
void* callee, void* callee_cache16[] HF_ATTR_UNUSED) {
register size_t pos1 = (uintptr_t)__builtin_return_address(0) << 12;
register size_t pos2 = (uintptr_t)callee & 0xFFF;
register size_t pos = (pos1 | pos2) & _HF_PERF_BITMAP_BITSZ_MASK;
register size_t pos = (pos1 | pos2) & _HF_PERF_BITMAP_BITSZ_MASK;
register bool prev = ATOMIC_BITMAP_SET(globalCovFeedback->bbMapPc, pos);
if (!prev) {
@@ -585,7 +585,7 @@ __attribute__((weak)) HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_indir_call16(
/*
* -fsanitize-coverage=trace-pc-guard
*/
static bool guards_initialized = false;
static bool guards_initialized = false;
HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_trace_pc_guard_init(uint32_t* start, uint32_t* stop) {
guards_initialized = true;
@@ -606,7 +606,7 @@ HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_trace_pc_guard_init(uint32_t* start
for (uint32_t* x = start; x < stop; x++) {
uint32_t guardNo = instrumentReserveGuard(1);
*x = guardNo;
*x = guardNo;
}
wmb();
@@ -614,14 +614,14 @@ HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_trace_pc_guard_init(uint32_t* start
/* Map number of visits to an edge into buckets */
static uint8_t const instrumentCntMap[256] = {
[0] = 0,
[1] = 1U << 0,
[2] = 1U << 1,
[3] = 1U << 2,
[4 ... 5] = 1U << 3,
[6 ... 10] = 1U << 4,
[11 ... 32] = 1U << 5,
[33 ... 64] = 1U << 6,
[0] = 0,
[1] = 1U << 0,
[2] = 1U << 1,
[3] = 1U << 2,
[4 ... 5] = 1U << 3,
[6 ... 10] = 1U << 4,
[11 ... 32] = 1U << 5,
[33 ... 64] = 1U << 6,
[65 ... 255] = 1U << 7,
};
@@ -692,26 +692,26 @@ HF_REQUIRE_SSE42_POPCNT void __sanitizer_cov_trace_pc_guard(uint32_t* guard_ptr)
/* Support up to 256 DSO modules with separate 8bit counters */
static struct {
uint8_t* start;
size_t cnt;
size_t guard;
size_t cnt;
size_t guard;
} hf8bitcounters[256] = {};
void instrument8BitCountersCount(void) {
rmb();
uint64_t totalEdge = 0;
uint64_t totalCmp = 0;
uint64_t totalCmp = 0;
for (size_t i = 0; i < ARRAYSIZE(hf8bitcounters) && hf8bitcounters[i].start; i++) {
for (size_t j = 0; j < hf8bitcounters[i].cnt; j++) {
const uint8_t v = hf8bitcounters[i].start[j];
const uint8_t v = hf8bitcounters[i].start[j];
hf8bitcounters[i].start[j] = 0;
if (!v) {
continue;
}
const uint8_t newval = instrumentCntMap[v];
const size_t guard = hf8bitcounters[i].guard + j;
const size_t guard = hf8bitcounters[i].guard + j;
/* New hits */
if (ATOMIC_GET(globalCovFeedback->pcGuardMap[guard]) < newval) {
@@ -749,7 +749,7 @@ void __sanitizer_cov_8bit_counters_init(char* start, char* end) {
for (size_t i = 0; i < ARRAYSIZE(hf8bitcounters); i++) {
if (hf8bitcounters[i].start == NULL) {
hf8bitcounters[i].start = (uint8_t*)start;
hf8bitcounters[i].cnt = (uintptr_t)end - (uintptr_t)start;
hf8bitcounters[i].cnt = (uintptr_t)end - (uintptr_t)start;
hf8bitcounters[i].guard = instrumentReserveGuard(hf8bitcounters[i].cnt);
LOG_D("8-bit module initialization %p-%p (count:%zu) at guard %zu", start, end,
hf8bitcounters[i].cnt, hf8bitcounters[i].guard);
@@ -775,8 +775,8 @@ __attribute__((weak)) __thread uintptr_t __sancov_lowest_stack = 0;
#endif /* !defined(__CYGWIN__) */
bool instrumentUpdateCmpMap(uintptr_t addr, uint32_t v) {
uintptr_t pos = addr % _HF_PERF_BITMAP_SIZE_16M;
uint32_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
uintptr_t pos = addr % _HF_PERF_BITMAP_SIZE_16M;
uint32_t prev = ATOMIC_GET(globalCovFeedback->bbMapCmp[pos]);
if (prev < v) {
ATOMIC_SET(globalCovFeedback->bbMapCmp[pos], v);
ATOMIC_POST_ADD(globalCovFeedback->pidNewCmp[my_thread_no], v - prev);
libhfuzz/instrument.h
+8 -8
View File
@@ -28,14 +28,14 @@
#include <stdbool.h>
#include <stddef.h>
extern void instrument8BitCountersCount(void);
extern void instrumentResetLocalCovFeedback(void);
extern void instrument8BitCountersCount(void);
extern void instrumentResetLocalCovFeedback(void);
extern unsigned instrumentThreadNo(void);
extern bool instrumentUpdateCmpMap(uintptr_t addr, uint32_t v);
extern void instrumentClearNewCov();
extern void instrumentAddConstMem(const void* m, size_t len, bool check_if_ro);
extern void instrumentAddConstStr(const char* s);
extern void instrumentAddConstStrN(const char* s, size_t n);
extern bool instrumentConstAvail();
extern bool instrumentUpdateCmpMap(uintptr_t addr, uint32_t v);
extern void instrumentClearNewCov();
extern void instrumentAddConstMem(const void* m, size_t len, bool check_if_ro);
extern void instrumentAddConstStr(const char* s);
extern void instrumentAddConstStrN(const char* s, size_t n);
extern bool instrumentConstAvail();
#endif /* ifdef _HF_LIBHFUZZ_INSTRUMENT_H_ */
libhfuzz/memorycmp.c
+2 -2
View File
@@ -198,7 +198,7 @@ static inline char* HF_strcpy(char* dest, const char* src, uintptr_t addr) {
/* Define a weak function x, as well as __wrap_x pointing to x */
#define XVAL(x) x
#define HF_WEAK_WRAP(ret, func, ...) \
#define HF_WEAK_WRAP(ret, func, ...) \
_Pragma(HF__XSTR(weak func = __wrap_##func)) XVAL(ret) XVAL(__wrap_##func)(__VA_ARGS__)
/* Typical libc wrappers */
@@ -543,7 +543,7 @@ HF_WEAK_WRAP(bool, g_str_has_suffix, const char* str, const char* suffix) {
if (!str || !suffix) {
return false;
}
size_t str_len = __builtin_strlen(str);
size_t str_len = __builtin_strlen(str);
size_t suffix_len = __builtin_strlen(suffix);
if (str_len < suffix_len) {
return false;
libhfuzz/performance.c
+6 -6
View File
@@ -12,12 +12,12 @@
#include "libhfcommon/util.h"
#include "libhfuzz/instrument.h"
#define HF_USEC_PER_SEC 1000000
#define HF_USEC_PER_SEC 1000000
#define HF_CHECK_INTERVAL_USECS (HF_USEC_PER_SEC * 20) /* Peform this check every 20 sec. */
#define HF_RESET_RATIO 5 /* Reset ourselves, if currently n times slower than in the beginning */
#define HF_RESET_RATIO 5 /* Reset ourselves, if currently n times slower than in the beginning */
static uint64_t iterCnt = 0;
static time_t firstInputUSecs = 0;
static uint64_t iterCnt = 0;
static time_t firstInputUSecs = 0;
static uint64_t initialUSecsPerExec = 0;
@@ -32,8 +32,8 @@ static bool performanceInit(void) {
uint64_t timeDiffUSecs = util_timeNowUSecs() - firstInputUSecs;
if (iterCnt == 5000 || timeDiffUSecs > HF_CHECK_INTERVAL_USECS) {
initialUSecsPerExec = timeDiffUSecs / iterCnt;
lastCheckUSecs = util_timeNowUSecs();
lastCheckIters = iterCnt;
lastCheckUSecs = util_timeNowUSecs();
lastCheckIters = iterCnt;
LOG_I("Thread %u (pid=%d) initial speed set at %" PRIu64 " us/exec", instrumentThreadNo(),
(int)getpid(), initialUSecsPerExec);
libhfuzz/persistent.c
+5 -5
View File
@@ -40,7 +40,7 @@ __attribute__((weak)) int LLVMFuzzerTestOneInput(
return 0;
}
static const uint8_t* inputFile = NULL;
static const uint8_t* inputFile = NULL;
__attribute__((constructor)) static void initializePersistent(void) {
if (fcntl(_HF_INPUT_FD, F_GETFD) == -1 && errno == EBADF) {
return;
@@ -59,7 +59,7 @@ void HF_ITER(const uint8_t** buf_ptr, size_t* len_ptr) {
extern const char* const LIBHFUZZ_module_memorycmp;
extern const char* const LIBHFUZZ_module_instrument;
static void HonggfuzzRunOneInput(const uint8_t* buf, size_t len) {
static void HonggfuzzRunOneInput(const uint8_t* buf, size_t len) {
instrumentResetLocalCovFeedback();
int ret = LLVMFuzzerTestOneInput(buf, len);
if (ret != 0) {
@@ -71,7 +71,7 @@ static void HonggfuzzRunOneInput(const uint8_t* buf, size_t len) {
static void HonggfuzzPersistentLoop(void) {
for (;;) {
size_t len;
size_t len;
const uint8_t* buf;
/* Check whether the current benchmark is fast enough, or maybe we should restart it */
@@ -83,7 +83,7 @@ static void HonggfuzzPersistentLoop(void) {
}
static int HonggfuzzRunFromFile(int argc, char** argv) {
int in_fd = STDIN_FILENO;
int in_fd = STDIN_FILENO;
const char* fname = "[STDIN]";
if (argc > 1) {
fname = argv[argc - 1];
@@ -98,7 +98,7 @@ static int HonggfuzzRunFromFile(int argc, char** argv) {
LOG_I("Usage for fuzzing: honggfuzz -P [flags] -- %s", argv[0]);
uint8_t* buf = (uint8_t*)util_Calloc(_HF_INPUT_MAX_SIZE);
ssize_t len = files_readFromFd(in_fd, buf, _HF_INPUT_MAX_SIZE);
ssize_t len = files_readFromFd(in_fd, buf, _HF_INPUT_MAX_SIZE);
if (len < 0) {
LOG_E("Couldn't read data from stdin: %s", strerror(errno));
free(buf);
linux/arch.c
+7 -7
View File
@@ -178,7 +178,7 @@ void arch_prepareParentAfterFork(run_t* run) {
if (run->global->exe.persistent) {
const struct f_owner_ex fown = {
.type = F_OWNER_TID,
.pid = syscall(__NR_gettid),
.pid = syscall(__NR_gettid),
};
if (fcntl(run->persistentSock, F_SETOWN_EX, &fown)) {
PLOG_F("fcntl(%d, F_SETOWN_EX)", run->persistentSock);
@@ -209,7 +209,7 @@ void arch_prepareParent(run_t* run) {
static bool arch_checkWait(run_t* run) {
/* All queued wait events must be tested when SIGCHLD was delivered */
for (;;) {
int status;
int status;
pid_t pid = TEMP_FAILURE_RETRY(waitpid(-1, &status, __WALL | __WNOTHREAD | WNOHANG));
if (pid == 0) {
return false;
@@ -250,7 +250,7 @@ void arch_reapChild(run_t* run) {
subproc_checkTermination(run);
const struct timespec ts = {
.tv_sec = 0ULL,
.tv_sec = 0ULL,
.tv_nsec = (1000ULL * 1000ULL * 100ULL),
};
/* Return with SIGIO, SIGCHLD */
@@ -293,7 +293,7 @@ bool arch_archInit(honggfuzz_t* hfuzz) {
break;
}
const char* gversion = gnu_get_libc_version();
int major, minor;
int major, minor;
if (sscanf(gversion, "%d.%d", &major, &minor) != 2) {
LOG_W("Unknown glibc version:'%s'. Using clone() instead of fork()", gversion);
break;
@@ -313,7 +313,7 @@ bool arch_archInit(honggfuzz_t* hfuzz) {
if (hfuzz->feedback.dynFileMethod != _HF_DYNFILE_NONE) {
unsigned long major = 0, minor = 0;
char* p = NULL;
char* p = NULL;
/*
* Check that Linux kernel is compatible
@@ -342,7 +342,7 @@ bool arch_archInit(honggfuzz_t* hfuzz) {
return false;
}
p = uts.release;
p = uts.release;
major = strtoul(p, &p, 10);
if (*p++ != '.') {
LOG_F("Unsupported kernel version (%s)", uts.release);
@@ -386,7 +386,7 @@ bool arch_archInit(honggfuzz_t* hfuzz) {
bool arch_archThreadInit(run_t* run) {
run->arch_linux.perfMmapBuf = NULL;
run->arch_linux.perfMmapAux = NULL;
run->arch_linux.cpuInstrFd = -1;
run->arch_linux.cpuInstrFd = -1;
run->arch_linux.cpuBranchFd = -1;
run->arch_linux.cpuIptBtsFd = -1;
linux/bfd.c
+12 -12
View File
@@ -50,7 +50,7 @@
#endif /* !defined(bfd_get_section_size) */
typedef struct {
bfd* bfdh;
bfd* bfdh;
asymbol** syms;
asymbol** dsyms;
} bfd_t;
@@ -132,7 +132,7 @@ void arch_bfdDemangle(funcs_t* funcs, size_t funcCnt) {
static struct bfd_section* arch_getSectionForPc(bfd* bfdh, uint64_t pc) {
for (struct bfd_section* section = bfdh->sections; section; section = section->next) {
uintptr_t vma = (uintptr_t)bfd_get_section_vma(bfdh, section);
uintptr_t sz = (uintptr_t)bfd_get_section_size(section);
uintptr_t sz = (uintptr_t)bfd_get_section_size(section);
if ((pc > vma) && (pc < (vma + sz))) {
return section;
}
@@ -147,8 +147,8 @@ void arch_bfdResolveSyms(pid_t pid, funcs_t* funcs, size_t num) {
bfd_init();
bfd_t bfdParams = {
.bfdh = NULL,
.syms = NULL,
.bfdh = NULL,
.syms = NULL,
.dsyms = NULL,
};
@@ -156,8 +156,8 @@ void arch_bfdResolveSyms(pid_t pid, funcs_t* funcs, size_t num) {
return;
}
const char* func;
const char* file;
const char* func;
const char* file;
unsigned int line;
for (unsigned int i = 0; i < num; i++) {
snprintf(funcs[i].func, sizeof(funcs->func), "UNKNOWN");
@@ -220,7 +220,7 @@ void arch_bfdDisasm(pid_t pid, uint8_t* mem, size_t size, char* instr) {
disassembler(bfd_get_arch(bfdh), bfd_little_endian(bfdh) ? FALSE : TRUE, 0, NULL);
#else
disassembler_ftype disassemble = disassembler(bfdh);
#endif // defined(_HD_BFD_GE_2_29)
#endif // defined(_HD_BFD_GE_2_29)
if (disassemble == NULL) {
LOG_W("disassembler() failed");
bfd_close(bfdh);
@@ -229,12 +229,12 @@ void arch_bfdDisasm(pid_t pid, uint8_t* mem, size_t size, char* instr) {
struct disassemble_info info;
init_disassemble_info(&info, instr, arch_bfdFPrintF);
info.arch = bfd_get_arch(bfdh);
info.mach = bfd_get_mach(bfdh);
info.buffer = mem;
info.arch = bfd_get_arch(bfdh);
info.mach = bfd_get_mach(bfdh);
info.buffer = mem;
info.buffer_length = size;
info.section = NULL;
info.endian = bfd_little_endian(bfdh) ? BFD_ENDIAN_LITTLE : BFD_ENDIAN_BIG;
info.section = NULL;
info.endian = bfd_little_endian(bfdh) ? BFD_ENDIAN_LITTLE : BFD_ENDIAN_BIG;
disassemble_init_for_target(&info);
strcpy(instr, "");
linux/bfd.h
+1 -1
View File
@@ -33,7 +33,7 @@
#define _HF_INSTR_SZ 64
#define PACKAGE 1
#define PACKAGE 1
#define PACKAGE_VERSION 1
#if !defined(_HF_LINUX_NO_BFD)
linux/perf.c
+13 -13
View File
@@ -49,7 +49,7 @@
#define _HF_PERF_MAP_SZ (1024 * 512)
#define _HF_PERF_AUX_SZ (1024 * 1024)
/* PERF_TYPE for Intel_PT/BTS -1 if none */
static int32_t perfIntelPtPerfType = -1;
static int32_t perfIntelPtPerfType = -1;
static int32_t perfIntelBtsPerfType = -1;
#if defined(PERF_ATTR_SIZE_VER5)
@@ -61,8 +61,8 @@ __attribute__((hot)) static inline void arch_perfBtsCount(run_t* run) {
uint64_t misc;
};
uint64_t aux_head = ATOMIC_GET(pem->aux_head);
struct bts_branch* br = (struct bts_branch*)run->arch_linux.perfMmapAux;
uint64_t aux_head = ATOMIC_GET(pem->aux_head);
struct bts_branch* br = (struct bts_branch*)run->arch_linux.perfMmapAux;
for (; br < ((struct bts_branch*)(run->arch_linux.perfMmapAux + aux_head)); br++) {
/*
* Kernel sometimes reports branches from the kernel (iret), we are not interested in that
@@ -141,17 +141,17 @@ static bool arch_perfCreate(run_t* run, pid_t pid, dynFileMethod_t method, int*
pe.enable_on_exec = 1;
}
pe.exclude_hv = 1;
pe.type = PERF_TYPE_HARDWARE;
pe.type = PERF_TYPE_HARDWARE;
switch (method) {
case _HF_DYNFILE_INSTR_COUNT:
LOG_D("Using: PERF_COUNT_HW_INSTRUCTIONS for pid=%d", (int)pid);
pe.config = PERF_COUNT_HW_INSTRUCTIONS;
pe.config = PERF_COUNT_HW_INSTRUCTIONS;
pe.inherit = 1;
break;
case _HF_DYNFILE_BRANCH_COUNT:
LOG_D("Using: PERF_COUNT_HW_BRANCH_INSTRUCTIONS for pid=%d", (int)pid);
pe.config = PERF_COUNT_HW_BRANCH_INSTRUCTIONS;
pe.config = PERF_COUNT_HW_BRANCH_INSTRUCTIONS;
pe.inherit = 1;
break;
case _HF_DYNFILE_BTS_EDGE:
@@ -160,7 +160,7 @@ static bool arch_perfCreate(run_t* run, pid_t pid, dynFileMethod_t method, int*
break;
case _HF_DYNFILE_IPT_BLOCK:
LOG_D("Using: (Intel PT) type=%" PRIu32 " for pid=%d", perfIntelPtPerfType, (int)pid);
pe.type = perfIntelPtPerfType;
pe.type = perfIntelPtPerfType;
pe.config = RTIT_CTL_DISRETC;
break;
default:
@@ -194,8 +194,8 @@ static bool arch_perfCreate(run_t* run, pid_t pid, dynFileMethod_t method, int*
}
struct perf_event_mmap_page* pem = (struct perf_event_mmap_page*)run->arch_linux.perfMmapBuf;
pem->aux_offset = pem->data_offset + pem->data_size;
pem->aux_size = _HF_PERF_AUX_SZ;
pem->aux_offset = pem->data_offset + pem->data_size;
pem->aux_size = _HF_PERF_AUX_SZ;
if ((run->arch_linux.perfMmapAux = mmap(
NULL, pem->aux_size, PROT_READ, MAP_SHARED, *perfFd, pem->aux_offset)) == MAP_FAILED) {
munmap(run->arch_linux.perfMmapBuf, _HF_PERF_MAP_SZ + getpagesize());
@@ -371,19 +371,19 @@ void arch_perfAnalyze(run_t* run) {
ioctl(run->arch_linux.cpuIptBtsFd, PERF_EVENT_IOC_RESET, 0);
}
run->hwCnts.cpuInstrCnt = instrCount;
run->hwCnts.cpuInstrCnt = instrCount;
run->hwCnts.cpuBranchCnt = branchCount;
}
bool arch_perfInit(honggfuzz_t* hfuzz HF_ATTR_UNUSED) {
static char const intel_pt_path[] = "/sys/bus/event_source/devices/intel_pt/type";
static char const intel_pt_path[] = "/sys/bus/event_source/devices/intel_pt/type";
static char const intel_bts_path[] = "/sys/bus/event_source/devices/intel_bts/type";
if (files_exists(intel_pt_path)) {
uint8_t buf[256];
ssize_t sz = files_readFileToBufMax(intel_pt_path, buf, sizeof(buf) - 1);
if (sz > 0) {
buf[sz] = '\0';
buf[sz] = '\0';
perfIntelPtPerfType = (int32_t)strtoul((char*)buf, NULL, 10);
LOG_D("perfIntelPtPerfType = %" PRIu32, perfIntelPtPerfType);
}
@@ -393,7 +393,7 @@ bool arch_perfInit(honggfuzz_t* hfuzz HF_ATTR_UNUSED) {
uint8_t buf[256];
ssize_t sz = files_readFileToBufMax(intel_bts_path, buf, sizeof(buf) - 1);
if (sz > 0) {
buf[sz] = '\0';
buf[sz] = '\0';
perfIntelBtsPerfType = (int32_t)strtoul((char*)buf, NULL, 10);
LOG_D("perfIntelBtsPerfType = %" PRIu32, perfIntelBtsPerfType);
}
linux/pt.c
+7 -7
View File
@@ -36,9 +36,9 @@
#include <intel-pt.h>
struct pt_cpu ptCpu = {
.vendor = pcv_unknown,
.family = 0,
.model = 0,
.vendor = pcv_unknown,
.family = 0,
.model = 0,
.stepping = 0,
};
@@ -50,7 +50,7 @@ void perf_ptInit(void) {
}
for (;;) {
char k[1024], t[1024], v[1024];
int ret = fscanf(f, "%1023[^\t]%1023[\t]: %1023[^\n]\n", k, t, v);
int ret = fscanf(f, "%1023[^\t]%1023[\t]: %1023[^\n]\n", k, t, v);
if (ret == EOF) {
break;
}
@@ -87,7 +87,7 @@ inline static uint64_t sext(uint64_t val, uint8_t sign) {
uint64_t signbit, mask;
signbit = 1ull << (sign - 1);
mask = ~0ull << sign;
mask = ~0ull << sign;
return val & signbit ? val | mask : val & ~mask;
}
@@ -141,8 +141,8 @@ void arch_ptAnalyze(run_t* run) {
struct pt_config ptc;
pt_config_init(&ptc);
ptc.begin = &run->arch_linux.perfMmapAux[aux_tail];
ptc.end = &run->arch_linux.perfMmapAux[aux_head];
ptc.cpu = ptCpu;
ptc.end = &run->arch_linux.perfMmapAux[aux_head];
ptc.cpu = ptCpu;
int errcode = pt_cpu_errata(&ptc.errata, &ptc.cpu);
if (errcode < 0) {
linux/pt.h
+32 -32
View File
@@ -33,38 +33,38 @@ extern void perf_ptInit(void);
#define BIT(nr) (1UL << (nr))
#endif
#define RTIT_CTL_TRACEEN BIT(0)
#define RTIT_CTL_CYCLEACC BIT(1)
#define RTIT_CTL_OS BIT(2)
#define RTIT_CTL_USR BIT(3)
#define RTIT_CTL_PWR_EVT_EN BIT(4)
#define RTIT_CTL_FUP_ON_PTW BIT(5)
#define RTIT_CTL_CR3EN BIT(7)
#define RTIT_CTL_TOPA BIT(8)
#define RTIT_CTL_MTC_EN BIT(9)
#define RTIT_CTL_TSC_EN BIT(10)
#define RTIT_CTL_DISRETC BIT(11)
#define RTIT_CTL_PTW_EN BIT(12)
#define RTIT_CTL_BRANCH_EN BIT(13)
#define RTIT_CTL_MTC_RANGE_OFFSET 14
#define RTIT_CTL_MTC_RANGE (0x0full << RTIT_CTL_MTC_RANGE_OFFSET)
#define RTIT_CTL_TRACEEN BIT(0)
#define RTIT_CTL_CYCLEACC BIT(1)
#define RTIT_CTL_OS BIT(2)
#define RTIT_CTL_USR BIT(3)
#define RTIT_CTL_PWR_EVT_EN BIT(4)
#define RTIT_CTL_FUP_ON_PTW BIT(5)
#define RTIT_CTL_CR3EN BIT(7)
#define RTIT_CTL_TOPA BIT(8)
#define RTIT_CTL_MTC_EN BIT(9)
#define RTIT_CTL_TSC_EN BIT(10)
#define RTIT_CTL_DISRETC BIT(11)
#define RTIT_CTL_PTW_EN BIT(12)
#define RTIT_CTL_BRANCH_EN BIT(13)
#define RTIT_CTL_MTC_RANGE_OFFSET 14
#define RTIT_CTL_MTC_RANGE (0x0full << RTIT_CTL_MTC_RANGE_OFFSET)
#define RTIT_CTL_CYC_THRESH_OFFSET 19
#define RTIT_CTL_CYC_THRESH (0x0full << RTIT_CTL_CYC_THRESH_OFFSET)
#define RTIT_CTL_PSB_FREQ_OFFSET 24
#define RTIT_CTL_PSB_FREQ (0x0full << RTIT_CTL_PSB_FREQ_OFFSET)
#define RTIT_CTL_ADDR0_OFFSET 32
#define RTIT_CTL_ADDR0 (0x0full << RTIT_CTL_ADDR0_OFFSET)
#define RTIT_CTL_ADDR1_OFFSET 36
#define RTIT_CTL_ADDR1 (0x0full << RTIT_CTL_ADDR1_OFFSET)
#define RTIT_CTL_ADDR2_OFFSET 40
#define RTIT_CTL_ADDR2 (0x0full << RTIT_CTL_ADDR2_OFFSET)
#define RTIT_CTL_ADDR3_OFFSET 44
#define RTIT_CTL_ADDR3 (0x0full << RTIT_CTL_ADDR3_OFFSET)
#define RTIT_STATUS_FILTEREN BIT(0)
#define RTIT_STATUS_CONTEXTEN BIT(1)
#define RTIT_STATUS_TRIGGEREN BIT(2)
#define RTIT_STATUS_BUFFOVF BIT(3)
#define RTIT_STATUS_ERROR BIT(4)
#define RTIT_STATUS_STOPPED BIT(5)
#define RTIT_CTL_CYC_THRESH (0x0full << RTIT_CTL_CYC_THRESH_OFFSET)
#define RTIT_CTL_PSB_FREQ_OFFSET 24
#define RTIT_CTL_PSB_FREQ (0x0full << RTIT_CTL_PSB_FREQ_OFFSET)
#define RTIT_CTL_ADDR0_OFFSET 32
#define RTIT_CTL_ADDR0 (0x0full << RTIT_CTL_ADDR0_OFFSET)
#define RTIT_CTL_ADDR1_OFFSET 36
#define RTIT_CTL_ADDR1 (0x0full << RTIT_CTL_ADDR1_OFFSET)
#define RTIT_CTL_ADDR2_OFFSET 40
#define RTIT_CTL_ADDR2 (0x0full << RTIT_CTL_ADDR2_OFFSET)
#define RTIT_CTL_ADDR3_OFFSET 44
#define RTIT_CTL_ADDR3 (0x0full << RTIT_CTL_ADDR3_OFFSET)
#define RTIT_STATUS_FILTEREN BIT(0)
#define RTIT_STATUS_CONTEXTEN BIT(1)
#define RTIT_STATUS_TRIGGEREN BIT(2)
#define RTIT_STATUS_BUFFOVF BIT(3)
#define RTIT_STATUS_ERROR BIT(4)
#define RTIT_STATUS_STOPPED BIT(5)
#endif /* _HF_LINUX_INTEL_PT_LIB */
linux/trace.c
+45 -45
View File
@@ -231,36 +231,36 @@ struct user_regs_struct {
static struct {
const char* descr;
bool important;
bool important;
} arch_sigs[_NSIG + 1] = {
[0 ...(_NSIG)].important = false,
[0 ...(_NSIG)].descr = "UNKNOWN",
[0 ...(_NSIG)].descr = "UNKNOWN",
[SIGTRAP].important = false,
[SIGTRAP].descr = "SIGTRAP",
[SIGTRAP].descr = "SIGTRAP",
[SIGILL].important = true,
[SIGILL].descr = "SIGILL",
[SIGILL].descr = "SIGILL",
[SIGFPE].important = true,
[SIGFPE].descr = "SIGFPE",
[SIGFPE].descr = "SIGFPE",
[SIGSEGV].important = true,
[SIGSEGV].descr = "SIGSEGV",
[SIGSEGV].descr = "SIGSEGV",
[SIGBUS].important = true,
[SIGBUS].descr = "SIGBUS",
[SIGBUS].descr = "SIGBUS",
[SIGABRT].important = true,
[SIGABRT].descr = "SIGABRT",
[SIGABRT].descr = "SIGABRT",
/* Is affected from tmoutVTALRM flag */
[SIGVTALRM].important = false,
[SIGVTALRM].descr = "SIGVTALRM-TMOUT",
[SIGVTALRM].descr = "SIGVTALRM-TMOUT",
/* seccomp-bpf kill */
[SIGSYS].important = true,
[SIGSYS].descr = "SIGSYS",
[SIGSYS].descr = "SIGSYS",
};
#ifndef SI_FROMUSER
@@ -273,11 +273,11 @@ static size_t arch_getProcMem(pid_t pid, uint8_t* buf, size_t len, uint64_t pc)
*/
const struct iovec local_iov = {
.iov_base = buf,
.iov_len = len,
.iov_len = len,
};
const struct iovec remote_iov = {
.iov_base = (void*)(uintptr_t)pc,
.iov_len = len,
.iov_len = len,
};
if (process_vm_readv(pid, &local_iov, 1, &remote_iov, 1, 0) == (ssize_t)len) {
return len;
@@ -289,12 +289,12 @@ static size_t arch_getProcMem(pid_t pid, uint8_t* buf, size_t len, uint64_t pc)
* Ok, let's do it via ptrace() then.
* len must be aligned to the sizeof(long)
*/
int cnt = len / sizeof(long);
int cnt = len / sizeof(long);
size_t memsz = 0;
for (int x = 0; x < cnt; x++) {
uint8_t* addr = (uint8_t*)(uintptr_t)pc + (int)(x * sizeof(long));
long ret = ptrace(PTRACE_PEEKDATA, pid, addr, NULL);
long ret = ptrace(PTRACE_PEEKDATA, pid, addr, NULL);
if (errno != 0) {
PLOG_W("Couldn't PT_READ_D on pid %d, addr: %p", pid, addr);
@@ -322,7 +322,7 @@ static size_t arch_getPC(pid_t pid, uint64_t* pc, uint64_t* status_reg HF_ATTR_U
#endif
const struct iovec pt_iov = {
.iov_base = &regs,
.iov_len = sizeof(regs),
.iov_len = sizeof(regs),
};
if (ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &pt_iov) == -1L) {
@@ -345,8 +345,8 @@ static size_t arch_getPC(pid_t pid, uint64_t* pc, uint64_t* status_reg HF_ATTR_U
*/
if (pt_iov.iov_len == sizeof(struct user_regs_struct_32)) {
struct user_regs_struct_32* r32 = (struct user_regs_struct_32*)&regs;
*pc = r32->eip;
*status_reg = r32->eflags;
*pc = r32->eip;
*status_reg = r32->eflags;
return pt_iov.iov_len;
}
@@ -355,8 +355,8 @@ static size_t arch_getPC(pid_t pid, uint64_t* pc, uint64_t* status_reg HF_ATTR_U
*/
if (pt_iov.iov_len == sizeof(struct user_regs_struct_64)) {
struct user_regs_struct_64* r64 = (struct user_regs_struct_64*)&regs;
*pc = r64->ip;
*status_reg = r64->flags;
*pc = r64->ip;
*status_reg = r64->flags;
return pt_iov.iov_len;
}
LOG_W("Unknown registers structure size: '%zd'", pt_iov.iov_len);
@@ -370,10 +370,10 @@ static size_t arch_getPC(pid_t pid, uint64_t* pc, uint64_t* status_reg HF_ATTR_U
if (pt_iov.iov_len == sizeof(struct user_regs_struct_32)) {
struct user_regs_struct_32* r32 = (struct user_regs_struct_32*)&regs;
#ifdef __ANDROID__
*pc = r32->ARM_pc;
*pc = r32->ARM_pc;
*status_reg = r32->ARM_cpsr;
#else
*pc = r32->uregs[ARM_pc];
*pc = r32->uregs[ARM_pc];
*status_reg = r32->uregs[ARM_cpsr];
#endif
return pt_iov.iov_len;
@@ -384,8 +384,8 @@ static size_t arch_getPC(pid_t pid, uint64_t* pc, uint64_t* status_reg HF_ATTR_U
*/
if (pt_iov.iov_len == sizeof(struct user_regs_struct_64)) {
struct user_regs_struct_64* r64 = (struct user_regs_struct_64*)&regs;
*pc = r64->pc;
*status_reg = r64->pstate;
*pc = r64->pc;
*status_reg = r64->pstate;
return pt_iov.iov_len;
}
LOG_W("Unknown registers structure size: '%zd'", pt_iov.iov_len);
@@ -398,7 +398,7 @@ static size_t arch_getPC(pid_t pid, uint64_t* pc, uint64_t* status_reg HF_ATTR_U
*/
if (pt_iov.iov_len == sizeof(struct user_regs_struct_32)) {
struct user_regs_struct_32* r32 = (struct user_regs_struct_32*)&regs;
*pc = r32->nip;
*pc = r32->nip;
return pt_iov.iov_len;
}
@@ -407,7 +407,7 @@ static size_t arch_getPC(pid_t pid, uint64_t* pc, uint64_t* status_reg HF_ATTR_U
*/
if (pt_iov.iov_len == sizeof(struct user_regs_struct_64)) {
struct user_regs_struct_64* r64 = (struct user_regs_struct_64*)&regs;
*pc = r64->nip;
*pc = r64->nip;
return pt_iov.iov_len;
}
@@ -431,7 +431,7 @@ static void arch_getInstrStr(pid_t pid, uint64_t pc, uint64_t status_reg HF_ATTR
* which is sizeof(long) on 64bit CPU archs (on most of them, I hope;)
*/
uint8_t buf[MAX_INSTR_SZ];
size_t memsz;
size_t memsz;
snprintf(instr, _HF_INSTR_SZ, "%s", "[UNKNOWN]");
@@ -460,7 +460,7 @@ static void arch_getInstrStr(pid_t pid, uint64_t pc, uint64_t status_reg HF_ATTR
LOG_E("Unknown/Unsupported Android CPU architecture");
#endif
csh handle;
csh handle;
cs_err err = cs_open(arch, mode, &handle);
if (err != CS_ERR_OK) {
LOG_W("Capstone initialization failed: '%s'", cs_strerror(err));
@@ -468,7 +468,7 @@ static void arch_getInstrStr(pid_t pid, uint64_t pc, uint64_t status_reg HF_ATTR
}
cs_insn* insn;
size_t count = cs_disasm(handle, buf, sizeof(buf), pc, 0, &insn);
size_t count = cs_disasm(handle, buf, sizeof(buf), pc, 0, &insn);
if (count < 1) {
LOG_W("Couldn't disassemble the assembler instructions' stream: '%s'",
@@ -497,17 +497,17 @@ static void arch_traceAnalyzeData(run_t* run, pid_t pid) {
free(funcs);
};
uint64_t pc = 0;
uint64_t pc = 0;
uint64_t status_reg = 0;
size_t pcRegSz = arch_getPC(pid, &pc, &status_reg);
size_t pcRegSz = arch_getPC(pid, &pc, &status_reg);
if (!pcRegSz) {
LOG_W("ptrace arch_getPC failed");
return;
}
uint64_t crashAddr = 0;
char description[HF_STR_LEN] = {};
size_t funcCnt = sanitizers_parseReport(run, pid, funcs, &pc, &crashAddr, description);
uint64_t crashAddr = 0;
char description[HF_STR_LEN] = {};
size_t funcCnt = sanitizers_parseReport(run, pid, funcs, &pc, &crashAddr, description);
if (funcCnt <= 0) {
funcCnt = arch_unwindStack(pid, funcs);
#if !defined(__ANDROID__)
@@ -530,8 +530,8 @@ static void arch_traceAnalyzeData(run_t* run, pid_t pid) {
}
static void arch_traceSaveData(run_t* run, pid_t pid) {
char instr[_HF_INSTR_SZ] = "\x00";
siginfo_t si = {};
char instr[_HF_INSTR_SZ] = "\x00";
siginfo_t si = {};
if (ptrace(PTRACE_GETSIGINFO, pid, 0, &si) == -1) {
PLOG_W("Couldn't get siginfo for pid %d", pid);
@@ -543,9 +543,9 @@ static void arch_traceSaveData(run_t* run, pid_t pid) {
crashAddr = 0UL;
}
uint64_t pc = 0;
uint64_t pc = 0;
uint64_t status_reg = 0;
size_t pcRegSz = arch_getPC(pid, &pc, &status_reg);
size_t pcRegSz = arch_getPC(pid, &pc, &status_reg);
if (!pcRegSz) {
LOG_W("ptrace arch_getPC failed");
return;
@@ -559,7 +559,7 @@ static void arch_traceSaveData(run_t* run, pid_t pid) {
free(funcs);
};
char description[HF_STR_LEN] = {};
char description[HF_STR_LEN] = {};
size_t funcCnt = sanitizers_parseReport(run, pid, funcs, &pc, &crashAddr, description);
if (funcCnt == 0) {
funcCnt = arch_unwindStack(pid, funcs);
@@ -671,7 +671,7 @@ static void arch_traceSaveData(run_t* run, pid_t pid) {
/* Those addresses will be random, so depend on stack-traces for uniqueness */
if (!run->global->arch_linux.disableRandomization) {
pc = 0UL;
pc = 0UL;
crashAddr = 0UL;
}
/* crashAddr (si.si_addr) never makes sense for SIGABRT */
@@ -822,7 +822,7 @@ static bool arch_listThreads(int tasks[], size_t thrSz, int pid) {
}
size_t count = 0;
DIR* dir = opendir(path);
DIR* dir = opendir(path);
if (!dir) {
PLOG_E("Couldn't open dir '%s'", path);
return false;
@@ -832,7 +832,7 @@ static bool arch_listThreads(int tasks[], size_t thrSz, int pid) {
};
for (;;) {
errno = 0;
errno = 0;
const struct dirent* res = readdir(dir);
if (res == NULL && errno != 0) {
PLOG_E("Couldn't read contents of '%s'", path);
@@ -866,7 +866,7 @@ static bool arch_listThreads(int tasks[], size_t thrSz, int pid) {
bool arch_traceWaitForPidStop(pid_t pid) {
for (;;) {
int status;
int status;
pid_t ret = wait4(pid, &status, __WALL | WUNTRACED, NULL);
if (ret == -1 && errno == EINTR) {
continue;
@@ -962,8 +962,8 @@ void arch_traceSignalsInit(honggfuzz_t* hfuzz) {
LOG_I("Sanitizer support enabled. SIGSEGV/SIGBUS/SIGILL/SIGFPE will not be reported, and "
"should be handled by *SAN code internally");
arch_sigs[SIGSEGV].important = false;
arch_sigs[SIGBUS].important = false;
arch_sigs[SIGILL].important = false;
arch_sigs[SIGFPE].important = false;
arch_sigs[SIGBUS].important = false;
arch_sigs[SIGILL].important = false;
arch_sigs[SIGFPE].important = false;
}
}
linux/trace.h
+1 -1
View File
@@ -28,7 +28,7 @@
#include "honggfuzz.h"
#define _HF_DYNFILE_SUB_MASK 0xFFFUL // Zero-set two MSB
#define _HF_DYNFILE_SUB_MASK 0xFFFUL // Zero-set two MSB
extern bool arch_traceWaitForPidStop(pid_t pid);
extern bool arch_traceEnable(run_t* run);
linux/unwind.c
+15 -15
View File
@@ -56,16 +56,16 @@ static const char* UNW_ER[] = {
typedef struct {
unsigned long start;
unsigned long end;
char perms[6];
char perms[6];
unsigned long offset;
char dev[8];
char dev[8];
unsigned long inode;
char name[PATH_MAX];
char name[PATH_MAX];
} procMap_t;
static procMap_t* arch_parsePidMaps(pid_t pid, size_t* mapsCount) {
FILE* f = NULL;
char fProcMaps[PATH_MAX] = {0};
FILE* f = NULL;
char fProcMaps[PATH_MAX] = {0};
snprintf(fProcMaps, PATH_MAX, "/proc/%d/maps", pid);
if ((f = fopen(fProcMaps, "rb")) == NULL) {
@@ -76,7 +76,7 @@ static procMap_t* arch_parsePidMaps(pid_t pid, size_t* mapsCount) {
fclose(f);
};
*mapsCount = 0;
*mapsCount = 0;
procMap_t* mapsList = malloc(sizeof(procMap_t));
if (mapsList == NULL) {
PLOG_W("malloc(size='%zu')", sizeof(procMap_t));
@@ -121,7 +121,7 @@ static char* arch_searchMaps(unsigned long addr, size_t mapsCnt, procMap_t* maps
#ifndef __ANDROID__
size_t arch_unwindStack(pid_t pid, funcs_t* funcs) {
size_t num_frames = 0, mapsCnt = 0;
size_t num_frames = 0, mapsCnt = 0;
procMap_t* mapsList = arch_parsePidMaps(pid, &mapsCnt);
defer {
free(mapsList);
@@ -146,7 +146,7 @@ size_t arch_unwindStack(pid_t pid, funcs_t* funcs) {
};
unw_cursor_t c;
int ret = unw_init_remote(&c, as, ui);
int ret = unw_init_remote(&c, as, ui);
if (ret < 0) {
LOG_E("[pid='%d'] unw_init_remote failed (%s)", pid, UNW_ER[-ret]);
return num_frames;
@@ -154,8 +154,8 @@ size_t arch_unwindStack(pid_t pid, funcs_t* funcs) {
for (num_frames = 0; unw_step(&c) > 0 && num_frames < _HF_MAX_FUNCS; num_frames++) {
unw_word_t ip;
char* module = NULL;
ret = unw_get_reg(&c, UNW_REG_IP, &ip);
char* module = NULL;
ret = unw_get_reg(&c, UNW_REG_IP, &ip);
if (ret < 0) {
LOG_E("[pid='%d'] [%zd] failed to read IP (%s)", pid, num_frames, UNW_ER[-ret]);
funcs[num_frames].pc = 0;
@@ -174,7 +174,7 @@ size_t arch_unwindStack(pid_t pid, funcs_t* funcs) {
#else /* !defined(__ANDROID__) */
size_t arch_unwindStack(pid_t pid, funcs_t* funcs) {
size_t num_frames = 0, mapsCnt = 0;
size_t num_frames = 0, mapsCnt = 0;
procMap_t* mapsList = arch_parsePidMaps(pid, &mapsCnt);
defer {
free(mapsList);
@@ -199,16 +199,16 @@ size_t arch_unwindStack(pid_t pid, funcs_t* funcs) {
};
unw_cursor_t cursor;
int ret = unw_init_remote(&cursor, as, ui);
int ret = unw_init_remote(&cursor, as, ui);
if (ret < 0) {
LOG_E("[pid='%d'] unw_init_remote failed (%s)", pid, UNW_ER[-ret]);
return num_frames;
}
do {
char* module = NULL;
char* module = NULL;
unw_word_t pc = 0, offset = 0;
char buf[_HF_FUNC_NAME_SZ] = {0};
char buf[_HF_FUNC_NAME_SZ] = {0};
ret = unw_get_reg(&cursor, UNW_REG_IP, &pc);
if (ret < 0) {
@@ -237,7 +237,7 @@ size_t arch_unwindStack(pid_t pid, funcs_t* funcs) {
// Compared to bfd, line var plays the role of offset from func_name
// Reports format is adjusted accordingly to reflect in saved file
funcs[num_frames].line = offset;
funcs[num_frames].pc = (void*)pc;
funcs[num_frames].pc = (void*)pc;
memcpy(funcs[num_frames].func, buf, sizeof(funcs[num_frames].func));
if (mapsCnt > 0 && (module = arch_searchMaps(pc, mapsCnt, mapsList)) != NULL) {
memcpy(funcs[num_frames].module, module, sizeof(funcs[num_frames].module));
linux/unwind.h
+2 -2
View File
@@ -27,7 +27,7 @@
#include "sanitizers.h"
extern size_t arch_unwindStack(pid_t pid, funcs_t* funcs);
extern char* arch_btContainsSymbol(
size_t symbolsListSz, char** symbolsList, size_t num_frames, funcs_t* funcs);
extern char* arch_btContainsSymbol(
size_t symbolsListSz, char** symbolsList, size_t num_frames, funcs_t* funcs);
#endif
mac/arch.c
+24 -24
View File
@@ -102,27 +102,27 @@ static char* g_fuzzer_crash_callstack[PID_MAX + 1];
char g_service_name[256];
struct {
bool important;
bool important;
const char* descr;
} arch_sigs[NSIG];
__attribute__((constructor)) void arch_initSigs(void) {
for (int x = 0; x < NSIG; x++) arch_sigs[x].important = false;
arch_sigs[SIGILL].important = true;
arch_sigs[SIGILL].descr = "SIGILL";
arch_sigs[SIGFPE].important = true;
arch_sigs[SIGFPE].descr = "SIGFPE";
arch_sigs[SIGILL].important = true;
arch_sigs[SIGILL].descr = "SIGILL";
arch_sigs[SIGFPE].important = true;
arch_sigs[SIGFPE].descr = "SIGFPE";
arch_sigs[SIGSEGV].important = true;
arch_sigs[SIGSEGV].descr = "SIGSEGV";
arch_sigs[SIGBUS].important = true;
arch_sigs[SIGBUS].descr = "SIGBUS";
arch_sigs[SIGSEGV].descr = "SIGSEGV";
arch_sigs[SIGBUS].important = true;
arch_sigs[SIGBUS].descr = "SIGBUS";
arch_sigs[SIGABRT].important = true;
arch_sigs[SIGABRT].descr = "SIGABRT";
arch_sigs[SIGABRT].descr = "SIGABRT";
/* Is affected from tmoutVTALRM flag */
arch_sigs[SIGVTALRM].important = false;
arch_sigs[SIGVTALRM].descr = "SIGVTALRM";
arch_sigs[SIGVTALRM].descr = "SIGVTALRM";
}
const char* exception_to_string(int exception) {
@@ -220,9 +220,9 @@ static void arch_analyzeSignal(run_t* run, int status) {
/*
* Get data from exception handler
*/
run->pc = g_fuzzer_crash_information[run->pid].pc;
run->pc = g_fuzzer_crash_information[run->pid].pc;
run->exception = g_fuzzer_crash_information[run->pid].exception;
run->access = g_fuzzer_crash_information[run->pid].access;
run->access = g_fuzzer_crash_information[run->pid].access;
run->backtrace = g_fuzzer_crash_information[run->pid].backtrace;
defer {
@@ -336,7 +336,7 @@ void arch_prepareParentAfterFork(run_t* run HF_ATTR_UNUSED) {
static bool arch_checkWait(run_t* run) {
/* All queued wait events must be tested when SIGCHLD was delivered */
for (;;) {
int status;
int status;
pid_t pid = TEMP_FAILURE_RETRY(wait4(run->pid, &status, WNOHANG, NULL));
if (pid == 0) {
return false;
@@ -378,7 +378,7 @@ void arch_reapChild(run_t* run) {
if (run->global->exe.persistent) {
struct pollfd pfd = {
.fd = run->persistentSock,
.fd = run->persistentSock,
.events = POLLIN,
};
int r = poll(&pfd, 1, 250 /* 0.25s */);
@@ -483,8 +483,8 @@ bool arch_archInit(honggfuzz_t* hfuzz) {
static void write_crash_report(thread_port_t thread, task_port_t task, exception_type_t exception,
mach_exception_data_t code, mach_msg_type_number_t code_count, int* flavor,
thread_state_t in_state, mach_msg_type_number_t in_state_count) {
NSAutoreleasePool* pool = [[NSAutoreleasePool alloc] init];
CrashReport* _crashReport = nil;
NSAutoreleasePool* pool = [[NSAutoreleasePool alloc] init];
CrashReport* _crashReport = nil;
_crashReport = [[CrashReport alloc] initWithTask:task
exceptionType:exception
@@ -496,7 +496,7 @@ static void write_crash_report(thread_port_t thread, task_port_t task, exception
threadStateCount:in_state_count];
NSString* crashDescription = [_crashReport description];
char* description = (char*)[crashDescription UTF8String];
char* description = (char*)[crashDescription UTF8String];
LOG_D("CrashReport: %s", description);
@@ -509,8 +509,8 @@ static void write_crash_report(thread_port_t thread, task_port_t task, exception
static uint64_t hash_callstack(thread_port_t thread, task_port_t task, exception_type_t exception,
mach_exception_data_t code, mach_msg_type_number_t code_count, int* flavor,
thread_state_t in_state, mach_msg_type_number_t in_state_count) {
NSAutoreleasePool* pool = [[NSAutoreleasePool alloc] init];
CrashReport* _crashReport = nil;
NSAutoreleasePool* pool = [[NSAutoreleasePool alloc] init];
CrashReport* _crashReport = nil;
_crashReport = [[CrashReport alloc] initWithTask:task
exceptionType:exception
@@ -522,7 +522,7 @@ static uint64_t hash_callstack(thread_port_t thread, task_port_t task, exception
threadStateCount:in_state_count];
NSString* crashDescription = [_crashReport description];
char* description = (char*)[crashDescription UTF8String];
char* description = (char*)[crashDescription UTF8String];
/*
* The callstack begins with the following word
@@ -569,7 +569,7 @@ static uint64_t hash_callstack(thread_port_t thread, task_port_t task, exception
LOG_W("Too large callstack (%zu bytes), truncating to %d bytes", callstack_size,
MAX_CALLSTACK_SIZE);
callstack_start[MAX_CALLSTACK_SIZE] = '\0';
callstack_end = callstack_start + MAX_CALLSTACK_SIZE;
callstack_end = callstack_start + MAX_CALLSTACK_SIZE;
}
pid_t pid;
@@ -590,7 +590,7 @@ static uint64_t hash_callstack(thread_port_t thread, task_port_t task, exception
* it's NULL-terminated.
*/
*callstack_end = '\0';
*buf = util_StrDup(callstack_start);
*buf = util_StrDup(callstack_start);
/*
*
@@ -630,7 +630,7 @@ static uint64_t hash_callstack(thread_port_t thread, task_port_t task, exception
*/
uint64_t hash = 0;
char* pos = callstack_start;
char* pos = callstack_start;
/*
* Go through each line until we run out of lines
@@ -724,7 +724,7 @@ kern_return_t catch_mach_exception_raise_state_identity(
exception_data[1] = code[1];
mach_exception_data_type_t access_address = exception_data[1];
run->access = (uint64_t)access_address;
run->access = (uint64_t)access_address;
/*
* Get a hash of the callstack
mangle.c
+22 -22
View File
@@ -61,7 +61,7 @@ static inline size_t mangle_getLen(size_t max) {
const uint64_t max2 = (uint64_t)max * max;
const uint64_t max3 = (uint64_t)max * max * max;
const uint64_t rnd = util_rndGet(1, max2 - 1);
const uint64_t rnd = util_rndGet(1, max2 - 1);
uint64_t ret = rnd * rnd;
ret /= max3;
@@ -100,10 +100,10 @@ static inline void mangle_Move(run_t* run, size_t off_from, size_t off_to, size_
}
size_t len_from = run->dynfile->size - off_from;
len = HF_MIN(len, len_from);
len = HF_MIN(len, len_from);
size_t len_to = run->dynfile->size - off_to;
len = HF_MIN(len, len_to);
len = HF_MIN(len, len_to);
memmove(&run->dynfile->data[off_to], &run->dynfile->data[off_from], len);
}
@@ -156,13 +156,13 @@ static inline void mangle_UseValue(run_t* run, const uint8_t* val, size_t len, b
}
static void mangle_MemSwap(run_t* run, bool printable HF_ATTR_UNUSED) {
size_t off1 = mangle_getOffSet(run);
size_t off1 = mangle_getOffSet(run);
size_t maxlen1 = run->dynfile->size - off1;
size_t off2 = mangle_getOffSet(run);
size_t off2 = mangle_getOffSet(run);
size_t maxlen2 = run->dynfile->size - off2;
size_t len = mangle_getLen(HF_MIN(maxlen1, maxlen2));
size_t len = mangle_getLen(HF_MIN(maxlen1, maxlen2));
uint8_t* tmpbuf = (uint8_t*)util_Malloc(len);
defer {
free(tmpbuf);
@@ -201,9 +201,9 @@ static void mangle_Bytes(run_t* run, bool printable) {
}
static void mangle_ByteRepeatOverwrite(run_t* run, bool printable) {
size_t off = mangle_getOffSet(run);
size_t off = mangle_getOffSet(run);
size_t destOff = off + 1;
size_t maxSz = run->dynfile->size - destOff;
size_t maxSz = run->dynfile->size - destOff;
/* No space to repeat */
if (!maxSz) {
@@ -216,9 +216,9 @@ static void mangle_ByteRepeatOverwrite(run_t* run, bool printable) {
}
static void mangle_ByteRepeatInsert(run_t* run, bool printable) {
size_t off = mangle_getOffSet(run);
size_t off = mangle_getOffSet(run);
size_t destOff = off + 1;
size_t maxSz = run->dynfile->size - destOff;
size_t maxSz = run->dynfile->size - destOff;
/* No space to repeat */
if (!maxSz) {
@@ -227,7 +227,7 @@ static void mangle_ByteRepeatInsert(run_t* run, bool printable) {
}
size_t len = mangle_getLen(maxSz);
len = mangle_Inflate(run, destOff, len, printable);
len = mangle_Inflate(run, destOff, len, printable);
memset(&run->dynfile->data[destOff], run->dynfile->data[off], len);
}
@@ -241,7 +241,7 @@ static void mangle_Bit(run_t* run, bool printable) {
static const struct {
const uint8_t val[8];
const size_t size;
const size_t size;
} mangleMagicVals[] = {
/* 1B - No endianness */
{"\x00\x00\x00\x00\x00\x00\x00\x00", 1},
@@ -496,7 +496,7 @@ static inline const uint8_t* mangle_FeedbackDict(run_t* run, size_t* len) {
return NULL;
}
cmpfeedback_t* cmpf = run->global->feedback.cmpFeedbackMap;
uint32_t cnt = ATOMIC_GET(cmpf->cnt);
uint32_t cnt = ATOMIC_GET(cmpf->cnt);
if (cnt == 0) {
return NULL;
}
@@ -504,7 +504,7 @@ static inline const uint8_t* mangle_FeedbackDict(run_t* run, size_t* len) {
cnt = ARRAYSIZE(cmpf->valArr);
}
uint32_t choice = util_rndGet(0, cnt - 1);
*len = (size_t)ATOMIC_GET(cmpf->valArr[choice].len);
*len = (size_t)ATOMIC_GET(cmpf->valArr[choice].len);
if (*len == 0) {
return NULL;
}
@@ -512,7 +512,7 @@ static inline const uint8_t* mangle_FeedbackDict(run_t* run, size_t* len) {
}
static void mangle_ConstFeedbackDict(run_t* run, bool printable) {
size_t len;
size_t len;
const uint8_t* val = mangle_FeedbackDict(run, &len);
if (val == NULL) {
mangle_Bytes(run, printable);
@@ -524,7 +524,7 @@ static void mangle_ConstFeedbackDict(run_t* run, bool printable) {
static void mangle_MemSet(run_t* run, bool printable) {
size_t off = mangle_getOffSet(run);
size_t len = mangle_getLen(run->dynfile->size - off);
int val = printable ? (int)util_rndPrintable() : (int)util_rndGet(0, UINT8_MAX);
int val = printable ? (int)util_rndPrintable() : (int)util_rndGet(0, UINT8_MAX);
memset(&run->dynfile->data[off], val, len);
}
@@ -684,7 +684,7 @@ static void mangle_Shrink(run_t* run, bool printable HF_ATTR_UNUSED) {
}
size_t off_start = mangle_getOffSet(run);
size_t len = mangle_LenLeft(run, off_start);
size_t len = mangle_LenLeft(run, off_start);
if (len == 0) {
return;
}
@@ -693,7 +693,7 @@ static void mangle_Shrink(run_t* run, bool printable HF_ATTR_UNUSED) {
} else {
len = mangle_getLen(len);
}
size_t off_end = off_start + len;
size_t off_end = off_start + len;
size_t len_to_move = run->dynfile->size - off_end;
mangle_Move(run, off_end, off_start, len_to_move);
@@ -722,8 +722,8 @@ static void mangle_ASCIINumChange(run_t* run, bool printable) {
return;
}
size_t len = HF_MIN(20, run->dynfile->size - off);
char numbuf[21] = {};
size_t len = HF_MIN(20, run->dynfile->size - off);
char numbuf[21] = {};
strncpy(numbuf, (const char*)&run->dynfile->data[off], len);
uint64_t val = (uint64_t)strtoull(numbuf, NULL, 10);
@@ -756,14 +756,14 @@ static void mangle_ASCIINumChange(run_t* run, bool printable) {
static void mangle_Splice(run_t* run, bool printable) {
const uint8_t* buf;
size_t sz = input_getRandomInputAsBuf(run, &buf);
size_t sz = input_getRandomInputAsBuf(run, &buf);
if (!sz) {
mangle_Bytes(run, printable);
return;
}
size_t remoteOff = mangle_getLen(sz) - 1;
size_t len = mangle_getLen(sz - remoteOff);
size_t len = mangle_getLen(sz - remoteOff);
mangle_UseValue(run, &buf[remoteOff], len, printable);
}
netbsd/arch.c
+2 -2
View File
@@ -154,7 +154,7 @@ void arch_reapChild(run_t* run) {
if (run->global->exe.persistent) {
struct pollfd pfd = {
.fd = run->persistentSock,
.fd = run->persistentSock,
.events = POLLIN,
};
int r = poll(&pfd, 1, 250 /* 0.25s */);
@@ -164,7 +164,7 @@ void arch_reapChild(run_t* run) {
} else {
/* Return with SIGIO, SIGCHLD */
const struct timespec ts = {
.tv_sec = 0ULL,
.tv_sec = 0ULL,
.tv_nsec = (1000ULL * 1000ULL * 250ULL),
};
int sig = sigtimedwait(&run->global->exe.waitSigSet, NULL, &ts /* 0.25s */);
netbsd/trace.c
+29 -29
View File
@@ -82,36 +82,36 @@
static struct {
const char* descr;
bool important;
bool important;
} arch_sigs[_NSIG + 1] = {
[0 ...(_NSIG)].important = false,
[0 ...(_NSIG)].descr = "UNKNOWN",
[0 ...(_NSIG)].descr = "UNKNOWN",
[SIGTRAP].important = false,
[SIGTRAP].descr = "SIGTRAP",
[SIGTRAP].descr = "SIGTRAP",
[SIGILL].important = true,
[SIGILL].descr = "SIGILL",
[SIGILL].descr = "SIGILL",
[SIGFPE].important = true,
[SIGFPE].descr = "SIGFPE",
[SIGFPE].descr = "SIGFPE",
[SIGSEGV].important = true,
[SIGSEGV].descr = "SIGSEGV",
[SIGSEGV].descr = "SIGSEGV",
[SIGBUS].important = true,
[SIGBUS].descr = "SIGBUS",
[SIGBUS].descr = "SIGBUS",
[SIGABRT].important = true,
[SIGABRT].descr = "SIGABRT",
[SIGABRT].descr = "SIGABRT",
/* Is affected from tmoutVTALRM flag */
[SIGVTALRM].important = false,
[SIGVTALRM].descr = "SIGVTALRM-TMOUT",
[SIGVTALRM].descr = "SIGVTALRM-TMOUT",
/* seccomp-bpf kill */
[SIGSYS].important = true,
[SIGSYS].descr = "SIGSYS",
[SIGSYS].descr = "SIGSYS",
};
#ifndef SI_FROMUSER
@@ -120,10 +120,10 @@ static struct {
static size_t arch_getProcMem(pid_t pid, uint8_t* buf, size_t len, register_t pc) {
struct ptrace_io_desc io;
size_t bytes_read;
size_t bytes_read;
bytes_read = 0;
io.piod_op = PIOD_READ_D;
bytes_read = 0;
io.piod_op = PIOD_READ_D;
io.piod_len = len;
do {
@@ -137,7 +137,7 @@ static size_t arch_getProcMem(pid_t pid, uint8_t* buf, size_t len, register_t pc
break;
}
bytes_read = io.piod_len;
bytes_read = io.piod_len;
io.piod_len = len - bytes_read;
} while (bytes_read < len);
@@ -169,8 +169,8 @@ static void arch_getInstrStr(pid_t pid, lwpid_t lwp, register_t* pc, char* instr
* We need a value aligned to 8
* which is sizeof(long) on 64bit CPU archs (on most of them, I hope;)
*/
uint8_t buf[MAX_INSTR_SZ];
size_t memsz;
uint8_t buf[MAX_INSTR_SZ];
size_t memsz;
register_t status_reg = 0;
snprintf(instr, _HF_INSTR_SZ, "%s", "[UNKNOWN]");
@@ -193,13 +193,13 @@ static void arch_getInstrStr(pid_t pid, lwpid_t lwp, register_t* pc, char* instr
arch = CS_ARCH_X86;
mode = CS_MODE_32;
#elif defined(__x86_64__)
arch = CS_ARCH_X86;
mode = CS_MODE_64;
arch = CS_ARCH_X86;
mode = CS_MODE_64;
#else
#error Unsupported CPU architecture
#endif
csh handle;
csh handle;
cs_err err = cs_open(arch, mode, &handle);
if (err != CS_ERR_OK) {
LOG_W("Capstone initialization failed: '%s'", cs_strerror(err));
@@ -207,7 +207,7 @@ static void arch_getInstrStr(pid_t pid, lwpid_t lwp, register_t* pc, char* instr
}
cs_insn* insn;
size_t count = cs_disasm(handle, buf, sizeof(buf), *pc, 0, &insn);
size_t count = cs_disasm(handle, buf, sizeof(buf), *pc, 0, &insn);
if (count < 1) {
LOG_W("Couldn't disassemble the assembler instructions' stream: '%s'",
@@ -232,7 +232,7 @@ static void arch_getInstrStr(pid_t pid, lwpid_t lwp, register_t* pc, char* instr
static void arch_traceAnalyzeData(run_t* run, pid_t pid) {
ptrace_siginfo_t info;
register_t pc = 0, status_reg = 0;
register_t pc = 0, status_reg = 0;
if (ptrace(PT_GET_SIGINFO, pid, &info, sizeof(info)) == -1) {
PLOG_W("Couldn't get siginfo for pid %d", pid);
@@ -262,7 +262,7 @@ static void arch_traceAnalyzeData(run_t* run, pid_t pid) {
if (pc) {
/* Manually update major frame PC & frames counter */
funcs[0].pc = (void*)(uintptr_t)pc;
funcCnt = 1;
funcCnt = 1;
} else {
return;
}
@@ -279,7 +279,7 @@ static void arch_traceSaveData(run_t* run, pid_t pid) {
/* Local copy since flag is overridden for some crashes */
bool saveUnique = run->global->io.saveUnique;
char instr[_HF_INSTR_SZ] = "\x00";
char instr[_HF_INSTR_SZ] = "\x00";
struct ptrace_siginfo info;
memset(&info, 0, sizeof(info));
@@ -320,7 +320,7 @@ static void arch_traceSaveData(run_t* run, pid_t pid) {
if (pc) {
/* Manually update major frame PC & frames counter */
funcs[0].pc = (void*)(uintptr_t)pc;
funcCnt = 1;
funcCnt = 1;
} else {
saveUnique = false;
}
@@ -404,8 +404,8 @@ static void arch_traceSaveData(run_t* run, pid_t pid) {
ATOMIC_POST_ADD(run->global->cfg.dynFileIterExpire, _HF_DYNFILE_SUB_MASK);
void* sig_addr = info.psi_siginfo.si_addr;
pc = 0UL;
sig_addr = NULL;
pc = 0UL;
sig_addr = NULL;
/* User-induced signals don't set si.si_addr */
if (SI_FROMUSER(&info.psi_siginfo)) {
@@ -454,9 +454,9 @@ static void arch_traceSaveData(run_t* run, pid_t pid) {
}
static void arch_traceEvent(run_t* run HF_ATTR_UNUSED, pid_t pid) {
ptrace_state_t state;
ptrace_state_t state;
ptrace_siginfo_t info;
int sig = 0;
int sig = 0;
if (ptrace(PT_GET_SIGINFO, pid, &info, sizeof(info)) == -1) {
PLOG_E("ptrace(PT_GET_SIGINFO, pid=%d)", (int)pid);
@@ -584,7 +584,7 @@ bool arch_traceWaitForPidStop(pid_t pid) {
LOG_D("Waiting for pid=%d to stop", (int)pid);
for (;;) {
int status;
int status;
pid_t ret = wait4(pid, &status, __WALL | WUNTRACED | WTRAPPED, NULL);
if (ret == -1 && errno == EINTR) {
continue;
netbsd/trace.h
+1 -1
View File
@@ -28,7 +28,7 @@
#include "honggfuzz.h"
#define _HF_DYNFILE_SUB_MASK 0xFFFUL // Zero-set two MSB
#define _HF_DYNFILE_SUB_MASK 0xFFFUL // Zero-set two MSB
extern bool arch_traceWaitForPidStop(pid_t pid);
extern bool arch_traceEnable(run_t* run);
netbsd/unwind.h
+1 -1
View File
@@ -30,7 +30,7 @@
#include "sanitizers.h"
/* String buffer size for function names in stack traces produced from libunwind */
#define _HF_FUNC_NAME_SZ 256 // Should be alright for mangled C++ procs too
#define _HF_FUNC_NAME_SZ 256 // Should be alright for mangled C++ procs too
extern char* arch_btContainsSymbol(
size_t symbolsListSz, char** symbolsList, size_t num_frames, funcs_t* funcs);
posix/arch.c
+14 -14
View File
@@ -51,30 +51,30 @@
#include "subproc.h"
struct {
bool important;
bool important;
const char* descr;
} arch_sigs[NSIG] = {
[0 ...(NSIG - 1)].important = false,
[0 ...(NSIG - 1)].descr = "UNKNOWN",
[0 ...(NSIG - 1)].descr = "UNKNOWN",
[SIGILL].important = true,
[SIGILL].descr = "SIGILL",
[SIGILL].descr = "SIGILL",
[SIGFPE].important = true,
[SIGFPE].descr = "SIGFPE",
[SIGFPE].descr = "SIGFPE",
[SIGSEGV].important = true,
[SIGSEGV].descr = "SIGSEGV",
[SIGSEGV].descr = "SIGSEGV",
[SIGBUS].important = true,
[SIGBUS].descr = "SIGBUS",
[SIGBUS].descr = "SIGBUS",
[SIGABRT].important = true,
[SIGABRT].descr = "SIGABRT",
[SIGABRT].descr = "SIGABRT",
/* Is affected from tmout_vtalrm flag */
[SIGVTALRM].important = false,
[SIGVTALRM].descr = "SIGVTALRM-TMOUT",
[SIGVTALRM].descr = "SIGVTALRM-TMOUT",
};
/*
@@ -117,10 +117,10 @@ static void arch_analyzeSignal(run_t* run, pid_t pid, int status) {
defer {
free(funcs);
};
uint64_t pc = 0;
uint64_t crashAddr = 0;
char description[HF_STR_LEN] = {};
size_t funcCnt = sanitizers_parseReport(run, pid, funcs, &pc, &crashAddr, description);
uint64_t pc = 0;
uint64_t crashAddr = 0;
char description[HF_STR_LEN] = {};
size_t funcCnt = sanitizers_parseReport(run, pid, funcs, &pc, &crashAddr, description);
/*
* Calculate backtrace callstack hash signature
@@ -197,7 +197,7 @@ void arch_prepareParentAfterFork(run_t* fuzzer HF_ATTR_UNUSED) {
static bool arch_checkWait(run_t* run) {
/* All queued wait events must be tested when SIGCHLD was delivered */
for (;;) {
int status;
int status;
pid_t pid = TEMP_FAILURE_RETRY(waitpid(run->pid, &status, WNOHANG));
if (pid == 0) {
return false;
@@ -239,7 +239,7 @@ void arch_reapChild(run_t* run) {
if (run->global->exe.persistent) {
struct pollfd pfd = {
.fd = run->persistentSock,
.fd = run->persistentSock,
.events = POLLIN,
};
int r = poll(&pfd, 1, 250 /* 0.25s */);
sanitizers.c
+32 -32
View File
@@ -19,18 +19,18 @@
/*
* Common sanitizer flags if --sanitizers is enabled
*/
#define kSAN_COMMON \
"symbolize=1:" \
"detect_leaks=0:" \
"disable_coredump=0:" \
"detect_odr_violation=0:" \
"allocator_may_return_null=1:" \
"allow_user_segv_handler=0:" \
"handle_segv=2:" \
"handle_sigbus=2:" \
"handle_abort=2:" \
"handle_sigill=2:" \
"handle_sigfpe=2:" \
#define kSAN_COMMON \
"symbolize=1:" \
"detect_leaks=0:" \
"disable_coredump=0:" \
"detect_odr_violation=0:" \
"allocator_may_return_null=1:" \
"allow_user_segv_handler=0:" \
"handle_segv=2:" \
"handle_sigbus=2:" \
"handle_abort=2:" \
"handle_sigill=2:" \
"handle_sigfpe=2:" \
"abort_on_error=1"
/* --{ ASan }-- */
@@ -50,18 +50,18 @@
#define kLSAN_OPTS kSAN_COMMON
/* If no sanitzer support was requested, simply abort() on errors */
#define kSAN_REGULAR \
"symbolize=1:" \
"detect_leaks=0:" \
"disable_coredump=0:" \
"detect_odr_violation=0:" \
"allocator_may_return_null=1:" \
"allow_user_segv_handler=1:" \
"handle_segv=0:" \
"handle_sigbus=0:" \
"handle_abort=0:" \
"handle_sigill=0:" \
"handle_sigfpe=0:" \
#define kSAN_REGULAR \
"symbolize=1:" \
"detect_leaks=0:" \
"disable_coredump=0:" \
"detect_odr_violation=0:" \
"allocator_may_return_null=1:" \
"allow_user_segv_handler=1:" \
"handle_segv=0:" \
"handle_sigbus=0:" \
"handle_abort=0:" \
"handle_sigill=0:" \
"handle_sigfpe=0:" \
"abort_on_error=1"
static void sanitizers_AddFlag(honggfuzz_t* hfuzz, const char* env, const char* val) {
@@ -110,8 +110,8 @@ static pid_t sanitizers_PidForTid(pid_t pid) {
defer {
fclose(f);
};
char* lineptr = NULL;
size_t n = 0;
char* lineptr = NULL;
size_t n = 0;
defer {
free(lineptr);
};
@@ -128,7 +128,7 @@ static pid_t sanitizers_PidForTid(pid_t pid) {
size_t sanitizers_parseReport(run_t* run, pid_t pid, funcs_t* funcs, uint64_t* pc,
uint64_t* crashAddr, char description[HF_STR_LEN]) {
char crashReport[PATH_MAX];
char crashReport[PATH_MAX];
const char* crashReportCpy = crashReport;
/* Under Linux the crash is seen in TID, but the sanitizer report is created for PID */
@@ -148,12 +148,12 @@ size_t sanitizers_parseReport(run_t* run, pid_t pid, funcs_t* funcs, uint64_t* p
}
};
bool headerFound = false;
bool frameFound = false;
unsigned int frameIdx = 0;
bool headerFound = false;
bool frameFound = false;
unsigned int frameIdx = 0;
char* lineptr = NULL;
size_t n = 0;
char* lineptr = NULL;
size_t n = 0;
defer {
free(lineptr);
};
sanitizers.h
+6 -6
View File
@@ -26,9 +26,9 @@
#define kLOGPREFIX "HF.sanitizer.log"
/* String buffer size for function names in stack traces produced from libunwind */
#define _HF_FUNC_NAME_SZ 256 // Should be alright for mangled C++ procs too
#define _HF_FUNC_NAME_SZ_MINUS_1 255 // For scanf()
#define _HF_MAX_FUNCS 80
#define _HF_FUNC_NAME_SZ 256 // Should be alright for mangled C++ procs too
#define _HF_FUNC_NAME_SZ_MINUS_1 255 // For scanf()
#define _HF_MAX_FUNCS 80
/* Constant prefix used for single frame crashes stackhash masking */
#define _HF_SINGLE_FRAME_MASK 0xBADBAD0000000000
@@ -58,9 +58,9 @@ typedef struct {
size_t line;
} funcs_t;
extern bool sanitizers_Init(honggfuzz_t* hfuzz);
extern size_t sanitizers_parseReport(run_t* run, pid_t pid, funcs_t* funcs, uint64_t* pc,
uint64_t* crashAddr, char description[HF_STR_LEN]);
extern bool sanitizers_Init(honggfuzz_t* hfuzz);
extern size_t sanitizers_parseReport(run_t* run, pid_t pid, funcs_t* funcs, uint64_t* pc,
uint64_t* crashAddr, char description[HF_STR_LEN]);
extern uint64_t sanitizers_hashCallstack(
run_t* run, funcs_t* funcs, size_t funcCnt, bool enableMasking);
socketfuzzer.c
+3 -3
View File
@@ -113,10 +113,10 @@ bool fuzz_notifySocketFuzzerCrash(run_t* run) {
}
bool setupSocketFuzzer(honggfuzz_t* run) {
int s, len;
socklen_t t;
int s, len;
socklen_t t;
struct sockaddr_un local, remote;
char socketPath[512];
char socketPath[512];
snprintf(socketPath, sizeof(socketPath), "/tmp/honggfuzz_socket.%i", getpid());
if ((s = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
socketfuzzer.h
+1 -1
View File
@@ -3,7 +3,7 @@
bool fuzz_waitForExternalInput(run_t* run);
bool fuzz_prepareSocketFuzzer(run_t* run);
int fuzz_waitforSocketFuzzer(run_t* run);
int fuzz_waitforSocketFuzzer(run_t* run);
bool fuzz_notifySocketFuzzerNewCov(honggfuzz_t* hfuzz);
bool fuzz_notifySocketFuzzerCrash(run_t* run);
socketfuzzer/vulnserver_cov.c
+7 -7
View File
@@ -47,8 +47,8 @@ void handleData5(char *data, int len) {
void doprocessing(int sock, int serversock) {
char data[1024];
int n = 0;
int len = 0;
int n = 0;
int len = 0;
while (1) {
bzero(data, sizeof(data));
@@ -95,10 +95,10 @@ void doprocessing(int sock, int serversock) {
}
int main(int argc, char *argv[]) {
int sockfd, newsockfd, portno, clilen;
char buffer[256];
int sockfd, newsockfd, portno, clilen;
char buffer[256];
struct sockaddr_in serv_addr, cli_addr;
int n, pid;
int n, pid;
if (argc == 2) {
portno = atoi(argv[1]);
@@ -117,9 +117,9 @@ int main(int argc, char *argv[]) {
perror("# vulnserver_cov: setsockopt(SO_REUSEPORT) failed");
bzero((char *)&serv_addr, sizeof(serv_addr));
serv_addr.sin_family = AF_INET;
serv_addr.sin_family = AF_INET;
serv_addr.sin_addr.s_addr = INADDR_ANY;
serv_addr.sin_port = htons(portno);
serv_addr.sin_port = htons(portno);
printf("# vulnserver_cov: Listening on port: %i\n", portno);
subproc.c
+1 -1
View File
@@ -512,7 +512,7 @@ void subproc_checkTimeLimit(run_t* run) {
return;
}
int64_t curUSecs = util_timeNowUSecs();
int64_t curUSecs = util_timeNowUSecs();
int64_t diffUSecs = curUSecs - run->timeStartedUSecs;
if (run->tmOutSignaled && (diffUSecs > ((run->global->timing.tmOut + 1) * 1000000))) {