LLVM  3.7.0
Classes | Typedefs | Enumerations | Functions | Variables
fuzzer Namespace Reference

Classes

struct  FlagDescription
 
class  UserSuppliedFuzzer
 An abstract class that allows to use user-supplied mutators with libFuzzer. More...
 
class  Fuzzer
 
class  SimpleUserSuppliedFuzzer
 
struct  LabelRange
 
struct  TraceBasedMutation
 
class  TraceState
 

Typedefs

typedef void(* UserCallback )(const uint8_t *Data, size_t Size)
 
typedef std::vector< uint8_t > Unit
 

Enumerations

enum  Predicate {
  ICMP_EQ = 32, ICMP_NE = 33, ICMP_UGT = 34, ICMP_UGE = 35,
  ICMP_ULT = 36, ICMP_ULE = 37, ICMP_SGT = 38, ICMP_SGE = 39,
  ICMP_SLT = 40, ICMP_SLE = 41
}
 

Functions

size_t CrossOver (const uint8_t *Data1, size_t Size1, const uint8_t *Data2, size_t Size2, uint8_t *Out, size_t MaxOutSize)
 
 FUZZER_FLAG_INT (iterations,-1,"Number of iterations of the fuzzer internal loop"" (-1 for infinite iterations).") FUZZER_FLAG_INT(runs
 
Number of individual test runs (-1 for infinite runs).") FUZZER_FLAG_INT(mutate_depth
 
Number of individual test
Apply this number of
consecutive mutations to each
input 
FUZZER_FLAG_INT (prefer_small_during_initial_shuffle,-1,"If 1, always prefer smaller inputs during the initial corpus shuffle."" If 0, never do that. If -1, do it sometimes.") FUZZER_FLAG_INT(exit_on_first
 
Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found 
FUZZER_FLAG_INT (timeout, 1200,"Timeout in seconds (if positive). ""If one unit runs more than this number of seconds the process will abort.") FUZZER_FLAG_INT(save_minimized_corpus
 
Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found the
minimized corpus is saved into
the first input directory 
FUZZER_FLAG_INT (use_full_coverage_set, 0,"Experimental: Maximize the number of different full"" coverage sets as opposed to maximizing the total coverage."" This is potentially MUCH slower, but may discover more paths.") FUZZER_FLAG_INT(jobs
 
Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found the
minimized corpus is saved into
the first input directory
Number of jobs to run If 
min (jobs, NumberOfCpuCores()/2)\" is used.") FUZZER_FLAG_INT(reload
 
Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found the
minimized corpus is saved into
the first input directory
Number of jobs to run If
Reload the main corpus
periodically to get new units
discovered by other processes 
FUZZER_FLAG_STRING (tokens,"Use the file with tokens (one token per line) to"" fuzz a token based input language.") FUZZER_FLAG_STRING(apply_tokens
 
Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found the
minimized corpus is saved into
the first input directory
Number of jobs to run If
Reload the main corpus
periodically to get new units
discovered by other processes
Read the given input
substitute bytes with tokens
and write the result to stdout 
FUZZER_FLAG_STRING (sync_command,"Execute an external command ""\"<sync_command> <test_corpus>\" ""to synchronize the test corpus.")}
 
static void PrintHelp ()
 
static const char * FlagValue (const char *Param, const char *Name)
 
static bool ParseOneFlag (const char *Param)
 
static void ParseFlags (int argc, char **argv)
 
static void PulseThread ()
 
static void WorkerThread (const std::string &Cmd, std::atomic< int > *Counter, int NumJobs, std::atomic< bool > *HasErrors)
 
static int RunInMultipleProcesses (int argc, char **argv, int NumWorkers, int NumJobs)
 
std::vector< std::string > ReadTokensFile (const char *TokensFilePath)
 
int ApplyTokens (const Fuzzer &F, const char *InputFilePath)
 
int FuzzerDriver (int argc, char **argv, UserCallback Callback)
 Simple C-like interface with a single user-supplied callback. More...
 
int FuzzerDriver (int argc, char **argv, UserSuppliedFuzzer &USF)
 Runs the fuzzing with the UserSuppliedFuzzer. More...
 
std::string FileToString (const std::string &Path)
 
Unit FileToVector (const std::string &Path)
 
void ReadDirToVectorOfUnits (const char *Path, std::vector< Unit > *V, long *Epoch)
 
void WriteToFile (const Unit &U, const std::string &Path)
 
void CopyFileToErr (const std::string &Path)
 
std::string DirPlusFile (const std::string &DirPath, const std::string &FileName)
 
size_t Mutate (uint8_t *Data, size_t Size, size_t MaxSize)
 
void Printf (const char *Fmt,...)
 
void Print (const Unit &U, const char *PrintAfter="")
 
void PrintASCII (const Unit &U, const char *PrintAfter="")
 
std::string Hash (const Unit &U)
 
void SetTimer (int Seconds)
 
void PrintFileAsBase64 (const std::string &Path)
 
void ExecuteCommand (const std::string &Command)
 
void ComputeSHA1 (const uint8_t *Data, size_t Len, uint8_t *Out)
 
int NumberOfCpuCores ()
 
static long GetEpoch (const std::string &Path)
 
static std::vector< std::string > ListFilesInDir (const std::string &Dir, long *Epoch)
 
static uintptr_t HashOfArrayOfPCs (uintptr_t *PCs, uintptr_t NumPCs)
 
static char FlipRandomBit (char X)
 
static char RandCh ()
 
static bool ReallyHaveDFSan ()
 
template<class U , class S >
bool ComputeCmp (size_t CmpType, U Arg1, U Arg2)
 
static bool ComputeCmp (size_t CmpSize, size_t CmpType, uint64_t Arg1, uint64_t Arg2)
 
static void AlarmHandler (int, siginfo_t *, void *)
 

Variables

struct {
   Number of individual test
Apply this number of
consecutive mutations to each
input   fuzzer::If
 
   Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found   fuzzer::If
 
   Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found the
minimized corpus is saved into
the first input directory
Number of jobs to run If   fuzzer::jobs
 
   Number of individual test
Apply this number of
consecutive mutations to each
input exit after the first new
interesting input is found the
minimized corpus is saved into
the first input directory
Number of jobs to run If
Reload the main corpus
periodically to get new units
discovered by other processes
Read the given input   fuzzer::file
 
Flags
 
static const size_t kNumFlags
 
static std::vector< std::string > inputs
 
static const char * ProgName
 
static std::mutex Mu
 
static const int kSHA1NumBytes = 20
 
static FuzzerF
 
static TraceStateTS
 

Typedef Documentation

typedef std::vector<uint8_t> fuzzer::Unit

Definition at line 23 of file FuzzerInternal.h.

typedef void(* fuzzer::UserCallback)(const uint8_t *Data, size_t Size)

Definition at line 24 of file FuzzerInterface.h.

Enumeration Type Documentation

Enumerator
ICMP_EQ 

equal

ICMP_NE 

not equal

ICMP_UGT 

unsigned greater than

ICMP_UGE 

unsigned greater or equal

ICMP_ULT 

unsigned less than

ICMP_ULE 

unsigned less or equal

ICMP_SGT 

signed greater than

ICMP_SGE 

signed greater or equal

ICMP_SLT 

signed less than

ICMP_SLE 

signed less or equal

Definition at line 104 of file FuzzerTraceState.cpp.

Function Documentation

static void fuzzer::AlarmHandler ( int  ,
siginfo_t *  ,
void *   
)
static

Definition at line 48 of file FuzzerUtil.cpp.

References fuzzer::Fuzzer::StaticAlarmCallback().

Referenced by SetTimer().

int fuzzer::ApplyTokens ( const Fuzzer F,
const char *  InputFilePath 
)

Definition at line 208 of file FuzzerDriver.cpp.

References Flags, ParseFlags(), PrintHelp(), and ProgName.

template<class U , class S >
bool fuzzer::ComputeCmp ( size_t  CmpType,
Arg1,
Arg2 
)
static bool fuzzer::ComputeCmp ( size_t  CmpSize,
size_t  CmpType,
uint64_t  Arg1,
uint64_t  Arg2 
)
static

Definition at line 135 of file FuzzerTraceState.cpp.

Referenced by fuzzer::TraceState::DFSanCmpCallback().

void fuzzer::ComputeSHA1 ( const uint8_t *  Data,
size_t  Len,
uint8_t *  Out 
)

Definition at line 197 of file FuzzerSHA1.cpp.

References HASH_LENGTH.

Referenced by Hash().

void fuzzer::CopyFileToErr ( const std::string &  Path)

Definition at line 58 of file FuzzerIO.cpp.

References llvm::c_str(), FileToString(), and Printf().

size_t fuzzer::CrossOver ( const uint8_t *  Data1,
size_t  Size1,
const uint8_t *  Data2,
size_t  Size2,
uint8_t *  Out,
size_t  MaxOutSize 
)

Definition at line 19 of file FuzzerCrossOver.cpp.

References min().

Referenced by fuzzer::UserSuppliedFuzzer::BasicCrossOver(), and TEST().

std::string fuzzer::DirPlusFile ( const std::string &  DirPath,
const std::string &  FileName 
)

Definition at line 77 of file FuzzerIO.cpp.

Referenced by ReadDirToVectorOfUnits(), and fuzzer::Fuzzer::SaveCorpus().

void fuzzer::ExecuteCommand ( const std::string &  Command)

Definition at line 72 of file FuzzerUtil.cpp.

Referenced by PrintFileAsBase64().

std::string fuzzer::FileToString ( const std::string &  Path)

Definition at line 52 of file FuzzerIO.cpp.

References T.

Referenced by CopyFileToErr().

Unit fuzzer::FileToVector ( const std::string &  Path)

Definition at line 46 of file FuzzerIO.cpp.

References T.

Referenced by ReadDirToVectorOfUnits(), and ReadTokensFile().

static const char* fuzzer::FlagValue ( const char *  Param,
const char *  Name 
)
static

Definition at line 93 of file FuzzerDriver.cpp.

References Printf().

static char fuzzer::FlipRandomBit ( char  X)
static

Definition at line 18 of file FuzzerMutate.cpp.

References llvm::tgtok::Bit.

Referenced by Mutate().

fuzzer::@216::FUZZER_FLAG_INT ( iterations  ,
1,
"Number of iterations of the fuzzer internal loop"" (-1 for infinite iterations)."   
)
Number of individual test Apply this number of consecutive mutations to each input fuzzer::@216::FUZZER_FLAG_INT ( prefer_small_during_initial_shuffle  ,
1,
"If  1,
always prefer smaller inputs during the initial corpus shuffle." "If  0,
never do that.If-  1,
do it sometimes."   
)
Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found fuzzer::@216::FUZZER_FLAG_INT ( timeout  ,
1200  ,
"Timeout in seconds (if positive). ""If one unit runs more than this number of seconds the process will abort."   
)
Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory fuzzer::@216::FUZZER_FLAG_INT ( use_full_coverage_set  ,
,
"Experimental: Maximize the number of different full"" coverage sets as opposed to maximizing the total coverage."" This is potentially MUCH  slower,
but may discover more paths."   
)
Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If Reload the main corpus periodically to get new units discovered by other processes fuzzer::@216::FUZZER_FLAG_STRING ( tokens  ,
"Use the file with tokens (one token per line) to"" fuzz a token based input language."   
)
Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If Reload the main corpus periodically to get new units discovered by other processes Read the given input substitute bytes with tokens and write the result to stdout fuzzer::FUZZER_FLAG_STRING ( sync_command  ,
"Execute an external command ""\"<sync_command> <test_corpus>\" ""to synchronize the test corpus."   
)
int fuzzer::FuzzerDriver ( int  argc,
char **  argv,
UserCallback  Callback 
)

Simple C-like interface with a single user-supplied callback.

Usage:

#

void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
DoStuffWithData(Data, Size);
}
// Implement your own main() or use the one from FuzzerMain.cpp.
int main(int argc, char **argv) {
InitializeMeIfNeeded();
}
#

Definition at line 216 of file FuzzerDriver.cpp.

Referenced by main().

int fuzzer::FuzzerDriver ( int  argc,
char **  argv,
UserSuppliedFuzzer USF 
)

Runs the fuzzing with the UserSuppliedFuzzer.

Definition at line 221 of file FuzzerDriver.cpp.

static long fuzzer::GetEpoch ( const std::string &  Path)
static

Definition at line 22 of file FuzzerIO.cpp.

Referenced by ListFilesInDir(), and ReadDirToVectorOfUnits().

std::string fuzzer::Hash ( const Unit &  U)
static uintptr_t fuzzer::HashOfArrayOfPCs ( uintptr_t *  PCs,
uintptr_t  NumPCs 
)
static

Definition at line 174 of file FuzzerLoop.cpp.

static std::vector<std::string> fuzzer::ListFilesInDir ( const std::string &  Dir,
long *  Epoch 
)
static

Definition at line 28 of file FuzzerIO.cpp.

References GetEpoch().

Referenced by ReadDirToVectorOfUnits().

Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If fuzzer::@216::min ( jobs  ,
NumberOfCpuCores()/  2 
)

Referenced by add(), llvm::IntervalMapImpl::NodeBase< std::pair< KeyT, KeyT >, ValT, N >::adjustFromLeftSib(), llvm::BitVector::anyCommon(), llvm::SmallBitVector::anyCommon(), llvm::HexagonFrameLowering::assignCalleeSavedSpillSlots(), calculateSetFPREG(), llvm::CC_ARM_AAPCS_Custom_Aggregate(), llvm::StringRef::compare(), llvm::StringRef::compare_lower(), llvm::StringRef::compare_numeric(), compareBySuffix(), llvm::ComputeEditDistance(), llvm::SelectionDAG::computeKnownBits(), computeKnownBitsFromOperator(), llvm::computeKnownBitsFromRangeMetadata(), computeKnownBitsMul(), ComputeNumSignBits(), llvm::SelectionDAG::ComputeNumSignBits(), llvm::FunctionLoweringInfo::ComputePHILiveOutRegInfo(), llvm::ConstantFoldBinaryInstruction(), llvm::APInt::countTrailingZeros(), CrossOver(), DecodeDPRRegListOperand(), dfsan_weak_hook_memcmp(), EmitNops(), llvm::ARMFrameLowering::emitPrologue(), llvm::emitSourceFileHeader(), llvm::X86FrameLowering::emitSPUpdate(), llvm::SystemZSelectionDAGInfo::EmitTargetCodeForMemset(), estimateRSStackSizeLimit(), llvm::BlockFrequencyInfoImplBase::finalizeMetrics(), llvm::StringRef::find(), llvm::StringRef::find_first_not_of(), llvm::StringRef::find_first_of(), llvm::StringRef::find_last_not_of(), llvm::StringRef::find_last_of(), FoldIntToFPToInt(), llvm::InstCombiner::FoldItoFPtoI(), llvm::X86InstrInfo::foldMemoryOperandImpl(), getMemsetStringVal(), llvm::ScalarEvolution::GetMinTrailingZeros(), llvm::ScalarEvolution::getMulExpr(), getNoopInput(), llvm::getOrEnforceKnownAlignment(), llvm::MipsTargetLowering::HandleByVal(), llvm::raw_ostream::indent(), llvm::SelectionDAG::InferPtrAlignment(), llvm::ResourcePriorityQueue::initNumRegDefsLeft(), llvm::InlineFunction(), isVectorPromotionViableForSlice(), fuzzer::LabelRange::Join(), KnuthDiv(), LLVMDisasmInstruction(), LLVMInitializeMCJITCompilerOptions(), LowerVAARG(), llvm::ConstantRange::lshr(), llvm::StringRef::ltrim(), MIsNeedChainEdge(), llvm::object::COFFObjectFile::moveSymbolNext(), llvm::ConstantRange::multiply(), MyFuzzer::Mutate(), operator new(), llvm::BitVector::operator&=(), llvm::BitVector::operator==(), PerformLOADCombine(), PerformSTORECombine(), PerformVMOVRRDCombine(), llvm::SMDiagnostic::print(), llvm::AArch64TargetLowering::ReconstructShuffle(), replaceSplatVectorStore(), llvm::BitVector::reset(), llvm::SmallBitVector::reset(), llvm::StringRef::rfind(), llvm::StringRef::rtrim(), llvm::Interpreter::runFunction(), SelectInt64Count(), llvm::ConstantRange::shl(), fuzzer::Fuzzer::ShuffleAndMinimize(), SimplifyExtractValueInst(), llvm::StringRef::slice(), llvm::SplitEditor::splitRegInBlock(), llvm::SplitEditor::splitRegOutBlock(), llvm::SplitEditor::splitSingleBlock(), llvm::StringRef::substr(), llvm::BitVector::test(), llvm::SmallBitVector::test(), llvm::MachineInstr::tieOperands(), llvm::ScaledNumberBase::toString(), toStringAPFloat(), and llvm::InstCombiner::visitSwitchInst().

size_t fuzzer::Mutate ( uint8_t *  Data,
size_t  Size,
size_t  MaxSize 
)

Definition at line 37 of file FuzzerMutate.cpp.

References FlipRandomBit(), and RandCh().

Referenced by fuzzer::UserSuppliedFuzzer::BasicMutate().

int fuzzer::NumberOfCpuCores ( )

Definition at line 64 of file FuzzerUtil.cpp.

References F, and N.

static void fuzzer::ParseFlags ( int  argc,
char **  argv 
)
static

Definition at line 134 of file FuzzerDriver.cpp.

References Lock, Mu, and Printf().

Referenced by ApplyTokens().

static bool fuzzer::ParseOneFlag ( const char *  Param)
static

Definition at line 101 of file FuzzerDriver.cpp.

void fuzzer::Print ( const Unit &  U,
const char *  PrintAfter = "" 
)

Definition at line 23 of file FuzzerUtil.cpp.

References Printf().

void fuzzer::PrintASCII ( const Unit &  U,
const char *  PrintAfter = "" 
)

Definition at line 29 of file FuzzerUtil.cpp.

References Printf(), and X.

void fuzzer::Printf ( const char *  Fmt,
  ... 
)
void fuzzer::PrintFileAsBase64 ( const std::string &  Path)

Definition at line 82 of file FuzzerIO.cpp.

References ExecuteCommand().

static void fuzzer::PrintHelp ( )
static

Definition at line 73 of file FuzzerDriver.cpp.

Referenced by ApplyTokens().

static void fuzzer::PulseThread ( )
static

Definition at line 149 of file FuzzerDriver.cpp.

static char fuzzer::RandCh ( )
static

Definition at line 30 of file FuzzerMutate.cpp.

Referenced by Mutate().

void fuzzer::ReadDirToVectorOfUnits ( const char *  Path,
std::vector< Unit > *  V,
long *  Epoch 
)
std::vector<std::string> fuzzer::ReadTokensFile ( const char *  TokensFilePath)

Definition at line 196 of file FuzzerDriver.cpp.

References FileToVector(), Printf(), and fuzzer::Fuzzer::SubstituteTokens().

static bool fuzzer::ReallyHaveDFSan ( )
static
static int fuzzer::RunInMultipleProcesses ( int  argc,
char **  argv,
int  NumWorkers,
int  NumJobs 
)
static

Definition at line 176 of file FuzzerDriver.cpp.

Number of individual test fuzzer::@216::runs ( -1 for infinite  runs)
void fuzzer::SetTimer ( int  Seconds)

Definition at line 52 of file FuzzerUtil.cpp.

References AlarmHandler(), and Printf().

static void fuzzer::WorkerThread ( const std::string &  Cmd,
std::atomic< int > *  Counter,
int  NumJobs,
std::atomic< bool > *  HasErrors 
)
static

Definition at line 157 of file FuzzerDriver.cpp.

void fuzzer::WriteToFile ( const Unit &  U,
const std::string &  Path 
)

Definition at line 62 of file FuzzerIO.cpp.

Referenced by fuzzer::Fuzzer::SaveCorpus().

Variable Documentation

Fuzzer* fuzzer::F
static
Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If Reload the main corpus periodically to get new units discovered by other processes Read the given input fuzzer::file

Definition at line 56 of file FuzzerDriver.cpp.

struct { ... } fuzzer::Flags

Referenced by ApplyTokens().

Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found fuzzer::If

Definition at line 29 of file FuzzerDriver.cpp.

std::vector<std::string> fuzzer::inputs
static

Definition at line 70 of file FuzzerDriver.cpp.

Referenced by llvm::CodeExtractor::extractCodeRegion().

Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If fuzzer::jobs
Initial value:
= 1 we spawn"
" this number of jobs in separate worker processes"
" with stdout/stderr redirected to fuzz-JOB.log.")
FUZZER_FLAG_INT(workers, 0,
"Number of simultaneous worker processes to run the jobs."
" If zero
Number of individual test Apply this number of consecutive mutations to each input If
Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If jobs

Definition at line 45 of file FuzzerDriver.cpp.

const size_t fuzzer::kNumFlags
static
Initial value:
=
sizeof(FlagDescriptions) / sizeof(FlagDescriptions[0])

Definition at line 67 of file FuzzerDriver.cpp.

const int fuzzer::kSHA1NumBytes = 20
static

Definition at line 50 of file FuzzerInternal.h.

Referenced by Hash().

std::mutex fuzzer::Mu
static

Definition at line 147 of file FuzzerDriver.cpp.

Referenced by ParseFlags().

const char* fuzzer::ProgName
static

Definition at line 71 of file FuzzerDriver.cpp.

Referenced by ApplyTokens().

TraceState* fuzzer::TS
static