LLVM  3.7.0
Classes | Namespaces | Macros | Functions | Variables
FuzzerDriver.cpp File Reference
#include "FuzzerInterface.h"
#include "FuzzerInternal.h"
#include <cstring>
#include <chrono>
#include <unistd.h>
#include <thread>
#include <atomic>
#include <mutex>
#include <string>
#include <sstream>
#include <algorithm>
#include <iterator>
#include "FuzzerFlags.def"
Include dependency graph for FuzzerDriver.cpp:

Go to the source code of this file.

Classes

struct  fuzzer::FlagDescription
 

Namespaces

 fuzzer
 

Macros

#define FUZZER_FLAG_INT(Name, Default, Description)   int Name;
 
#define FUZZER_FLAG_STRING(Name, Description)   const char *Name;
 
#define FUZZER_FLAG_INT(Name, Default, Description)   { #Name, Description, Default, &Flags.Name, nullptr},
 
#define FUZZER_FLAG_STRING(Name, Description)   { #Name, Description, 0, nullptr, &Flags.Name },
 

Functions

 fuzzer::FUZZER_FLAG_INT (iterations,-1,"Number of iterations of the fuzzer internal loop"" (-1 for infinite iterations).") FUZZER_FLAG_INT(runs
 
Number of individual test fuzzer::runs (-1 for infinite runs).") FUZZER_FLAG_INT(mutate_depth
 
Number of individual test
Apply this number of
consecutive mutations to each
input 
fuzzer::FUZZER_FLAG_INT (prefer_small_during_initial_shuffle,-1,"If 1, always prefer smaller inputs during the initial corpus shuffle."" If 0, never do that. If -1, do it sometimes.") FUZZER_FLAG_INT(exit_on_first
 
Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found 
fuzzer::FUZZER_FLAG_INT (timeout, 1200,"Timeout in seconds (if positive). ""If one unit runs more than this number of seconds the process will abort.") FUZZER_FLAG_INT(save_minimized_corpus
 
Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found the
minimized corpus is saved into
the first input directory 
fuzzer::FUZZER_FLAG_INT (use_full_coverage_set, 0,"Experimental: Maximize the number of different full"" coverage sets as opposed to maximizing the total coverage."" This is potentially MUCH slower, but may discover more paths.") FUZZER_FLAG_INT(jobs
 
Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found the
minimized corpus is saved into
the first input directory
Number of jobs to run If 
fuzzer::min (jobs, NumberOfCpuCores()/2)\" is used.") FUZZER_FLAG_INT(reload
 
Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found the
minimized corpus is saved into
the first input directory
Number of jobs to run If
Reload the main corpus
periodically to get new units
discovered by other processes 
fuzzer::FUZZER_FLAG_STRING (tokens,"Use the file with tokens (one token per line) to"" fuzz a token based input language.") FUZZER_FLAG_STRING(apply_tokens
 
Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found the
minimized corpus is saved into
the first input directory
Number of jobs to run If
Reload the main corpus
periodically to get new units
discovered by other processes
Read the given input
substitute bytes with tokens
and write the result to stdout 
fuzzer::FUZZER_FLAG_STRING (sync_command,"Execute an external command ""\"<sync_command> <test_corpus>\" ""to synchronize the test corpus.")}
 
static void fuzzer::PrintHelp ()
 
static const char * fuzzer::FlagValue (const char *Param, const char *Name)
 
static bool fuzzer::ParseOneFlag (const char *Param)
 
static void fuzzer::ParseFlags (int argc, char **argv)
 
static void fuzzer::PulseThread ()
 
static void fuzzer::WorkerThread (const std::string &Cmd, std::atomic< int > *Counter, int NumJobs, std::atomic< bool > *HasErrors)
 
static int fuzzer::RunInMultipleProcesses (int argc, char **argv, int NumWorkers, int NumJobs)
 
std::vector< std::string > fuzzer::ReadTokensFile (const char *TokensFilePath)
 
int fuzzer::ApplyTokens (const Fuzzer &F, const char *InputFilePath)
 
int fuzzer::FuzzerDriver (int argc, char **argv, UserCallback Callback)
 Simple C-like interface with a single user-supplied callback. More...
 
int fuzzer::FuzzerDriver (int argc, char **argv, UserSuppliedFuzzer &USF)
 Runs the fuzzing with the UserSuppliedFuzzer. More...
 

Variables

struct {
   Number of individual test
Apply this number of
consecutive mutations to each
input   fuzzer::If
 
   Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found   fuzzer::If
 
   Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found the
minimized corpus is saved into
the first input directory
Number of jobs to run If   fuzzer::jobs
 
   Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found the
minimized corpus is saved into
the first input directory
Number of jobs to run If
Reload the main corpus
periodically to get new units
discovered by other processes
Read the given input   fuzzer::file
 
fuzzer::Flags
 
static const size_t fuzzer::kNumFlags
 
static std::vector< std::string > fuzzer::inputs
 
static const char * fuzzer::ProgName
 
static std::mutex fuzzer::Mu
 

Macro Definition Documentation

#define FUZZER_FLAG_INT (   Name,
  Default,
  Description 
)    int Name;

Definition at line 46 of file FuzzerDriver.cpp.

#define FUZZER_FLAG_INT (   Name,
  Default,
  Description 
)    { #Name, Description, Default, &Flags.Name, nullptr},

Definition at line 46 of file FuzzerDriver.cpp.

#define FUZZER_FLAG_STRING (   Name,
  Description 
)    const char *Name;

Definition at line 48 of file FuzzerDriver.cpp.

#define FUZZER_FLAG_STRING (   Name,
  Description 
)    { #Name, Description, 0, nullptr, &Flags.Name },

Definition at line 48 of file FuzzerDriver.cpp.