|
LLVM
3.7.0
|
Classes | |
| struct | FlagDescription |
| class | UserSuppliedFuzzer |
| An abstract class that allows to use user-supplied mutators with libFuzzer. More... | |
| class | Fuzzer |
| class | SimpleUserSuppliedFuzzer |
| struct | LabelRange |
| struct | TraceBasedMutation |
| class | TraceState |
Typedefs | |
| typedef void(* | UserCallback )(const uint8_t *Data, size_t Size) |
| typedef std::vector< uint8_t > | Unit |
Enumerations | |
| enum | Predicate { ICMP_EQ = 32, ICMP_NE = 33, ICMP_UGT = 34, ICMP_UGE = 35, ICMP_ULT = 36, ICMP_ULE = 37, ICMP_SGT = 38, ICMP_SGE = 39, ICMP_SLT = 40, ICMP_SLE = 41 } |
Functions | |
| size_t | CrossOver (const uint8_t *Data1, size_t Size1, const uint8_t *Data2, size_t Size2, uint8_t *Out, size_t MaxOutSize) |
| FUZZER_FLAG_INT (iterations,-1,"Number of iterations of the fuzzer internal loop"" (-1 for infinite iterations).") FUZZER_FLAG_INT(runs | |
| Number of individual test | runs (-1 for infinite runs).") FUZZER_FLAG_INT(mutate_depth |
| Number of individual test Apply this number of consecutive mutations to each input | FUZZER_FLAG_INT (prefer_small_during_initial_shuffle,-1,"If 1, always prefer smaller inputs during the initial corpus shuffle."" If 0, never do that. If -1, do it sometimes.") FUZZER_FLAG_INT(exit_on_first |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found | FUZZER_FLAG_INT (timeout, 1200,"Timeout in seconds (if positive). ""If one unit runs more than this number of seconds the process will abort.") FUZZER_FLAG_INT(save_minimized_corpus |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory | FUZZER_FLAG_INT (use_full_coverage_set, 0,"Experimental: Maximize the number of different full"" coverage sets as opposed to maximizing the total coverage."" This is potentially MUCH slower, but may discover more paths.") FUZZER_FLAG_INT(jobs |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If | min (jobs, NumberOfCpuCores()/2)\" is used.") FUZZER_FLAG_INT(reload |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If Reload the main corpus periodically to get new units discovered by other processes | FUZZER_FLAG_STRING (tokens,"Use the file with tokens (one token per line) to"" fuzz a token based input language.") FUZZER_FLAG_STRING(apply_tokens |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If Reload the main corpus periodically to get new units discovered by other processes Read the given input substitute bytes with tokens and write the result to stdout | FUZZER_FLAG_STRING (sync_command,"Execute an external command ""\"<sync_command> <test_corpus>\" ""to synchronize the test corpus.")} |
| static void | PrintHelp () |
| static const char * | FlagValue (const char *Param, const char *Name) |
| static bool | ParseOneFlag (const char *Param) |
| static void | ParseFlags (int argc, char **argv) |
| static void | PulseThread () |
| static void | WorkerThread (const std::string &Cmd, std::atomic< int > *Counter, int NumJobs, std::atomic< bool > *HasErrors) |
| static int | RunInMultipleProcesses (int argc, char **argv, int NumWorkers, int NumJobs) |
| std::vector< std::string > | ReadTokensFile (const char *TokensFilePath) |
| int | ApplyTokens (const Fuzzer &F, const char *InputFilePath) |
| int | FuzzerDriver (int argc, char **argv, UserCallback Callback) |
| Simple C-like interface with a single user-supplied callback. More... | |
| int | FuzzerDriver (int argc, char **argv, UserSuppliedFuzzer &USF) |
| Runs the fuzzing with the UserSuppliedFuzzer. More... | |
| std::string | FileToString (const std::string &Path) |
| Unit | FileToVector (const std::string &Path) |
| void | ReadDirToVectorOfUnits (const char *Path, std::vector< Unit > *V, long *Epoch) |
| void | WriteToFile (const Unit &U, const std::string &Path) |
| void | CopyFileToErr (const std::string &Path) |
| std::string | DirPlusFile (const std::string &DirPath, const std::string &FileName) |
| size_t | Mutate (uint8_t *Data, size_t Size, size_t MaxSize) |
| void | Printf (const char *Fmt,...) |
| void | Print (const Unit &U, const char *PrintAfter="") |
| void | PrintASCII (const Unit &U, const char *PrintAfter="") |
| std::string | Hash (const Unit &U) |
| void | SetTimer (int Seconds) |
| void | PrintFileAsBase64 (const std::string &Path) |
| void | ExecuteCommand (const std::string &Command) |
| void | ComputeSHA1 (const uint8_t *Data, size_t Len, uint8_t *Out) |
| int | NumberOfCpuCores () |
| static long | GetEpoch (const std::string &Path) |
| static std::vector< std::string > | ListFilesInDir (const std::string &Dir, long *Epoch) |
| static uintptr_t | HashOfArrayOfPCs (uintptr_t *PCs, uintptr_t NumPCs) |
| static char | FlipRandomBit (char X) |
| static char | RandCh () |
| static bool | ReallyHaveDFSan () |
| template<class U , class S > | |
| bool | ComputeCmp (size_t CmpType, U Arg1, U Arg2) |
| static bool | ComputeCmp (size_t CmpSize, size_t CmpType, uint64_t Arg1, uint64_t Arg2) |
| static void | AlarmHandler (int, siginfo_t *, void *) |
Variables | |
| struct { | |
| Number of individual test Apply this number of consecutive mutations to each input fuzzer::If | |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found fuzzer::If | |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If fuzzer::jobs | |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If Reload the main corpus periodically to get new units discovered by other processes Read the given input fuzzer::file | |
| } | Flags |
| static const size_t | kNumFlags |
| static std::vector< std::string > | inputs |
| static const char * | ProgName |
| static std::mutex | Mu |
| static const int | kSHA1NumBytes = 20 |
| static Fuzzer * | F |
| static TraceState * | TS |
| typedef std::vector<uint8_t> fuzzer::Unit |
Definition at line 23 of file FuzzerInternal.h.
| typedef void(* fuzzer::UserCallback)(const uint8_t *Data, size_t Size) |
Definition at line 24 of file FuzzerInterface.h.
| enum fuzzer::Predicate |
Definition at line 104 of file FuzzerTraceState.cpp.
|
static |
Definition at line 48 of file FuzzerUtil.cpp.
References fuzzer::Fuzzer::StaticAlarmCallback().
Referenced by SetTimer().
Definition at line 208 of file FuzzerDriver.cpp.
References Flags, ParseFlags(), PrintHelp(), and ProgName.
| bool fuzzer::ComputeCmp | ( | size_t | CmpType, |
| U | Arg1, | ||
| U | Arg2 | ||
| ) |
|
static |
Definition at line 135 of file FuzzerTraceState.cpp.
Referenced by fuzzer::TraceState::DFSanCmpCallback().
| void fuzzer::ComputeSHA1 | ( | const uint8_t * | Data, |
| size_t | Len, | ||
| uint8_t * | Out | ||
| ) |
| void fuzzer::CopyFileToErr | ( | const std::string & | Path | ) |
Definition at line 58 of file FuzzerIO.cpp.
References llvm::c_str(), FileToString(), and Printf().
| size_t fuzzer::CrossOver | ( | const uint8_t * | Data1, |
| size_t | Size1, | ||
| const uint8_t * | Data2, | ||
| size_t | Size2, | ||
| uint8_t * | Out, | ||
| size_t | MaxOutSize | ||
| ) |
Definition at line 19 of file FuzzerCrossOver.cpp.
References min().
Referenced by fuzzer::UserSuppliedFuzzer::BasicCrossOver(), and TEST().
Definition at line 77 of file FuzzerIO.cpp.
Referenced by ReadDirToVectorOfUnits(), and fuzzer::Fuzzer::SaveCorpus().
| void fuzzer::ExecuteCommand | ( | const std::string & | Command | ) |
Definition at line 72 of file FuzzerUtil.cpp.
Referenced by PrintFileAsBase64().
| std::string fuzzer::FileToString | ( | const std::string & | Path | ) |
Definition at line 46 of file FuzzerIO.cpp.
References T.
Referenced by ReadDirToVectorOfUnits(), and ReadTokensFile().
Definition at line 93 of file FuzzerDriver.cpp.
References Printf().
|
static |
Definition at line 18 of file FuzzerMutate.cpp.
References llvm::tgtok::Bit.
Referenced by Mutate().
| fuzzer::@216::FUZZER_FLAG_INT | ( | iterations | , |
| - | 1, | ||
| "Number of iterations of the fuzzer internal loop"" (-1 for infinite iterations)." | |||
| ) |
| Number of individual test Apply this number of consecutive mutations to each input fuzzer::@216::FUZZER_FLAG_INT | ( | prefer_small_during_initial_shuffle | , |
| - | 1, | ||
| "If | 1, | ||
| always prefer smaller inputs during the initial corpus shuffle." "If | 0, | ||
| never do that.If- | 1, | ||
| do it sometimes." | |||
| ) |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found fuzzer::@216::FUZZER_FLAG_INT | ( | timeout | , |
| 1200 | , | ||
| "Timeout in seconds (if positive). ""If one unit runs more than this number of seconds the process will abort." | |||
| ) |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory fuzzer::@216::FUZZER_FLAG_INT | ( | use_full_coverage_set | , |
| 0 | , | ||
| "Experimental: Maximize the number of different full"" coverage sets as opposed to maximizing the total coverage."" This is potentially MUCH | slower, | ||
| but may discover more paths." | |||
| ) |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If Reload the main corpus periodically to get new units discovered by other processes fuzzer::@216::FUZZER_FLAG_STRING | ( | tokens | , |
| "Use the file with tokens (one token per line) to"" fuzz a token based input language." | |||
| ) |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If Reload the main corpus periodically to get new units discovered by other processes Read the given input substitute bytes with tokens and write the result to stdout fuzzer::FUZZER_FLAG_STRING | ( | sync_command | , |
| "Execute an external command ""\"<sync_command> <test_corpus>\" ""to synchronize the test corpus." | |||
| ) |
Simple C-like interface with a single user-supplied callback.
Usage:
#
Definition at line 216 of file FuzzerDriver.cpp.
Referenced by main().
| int fuzzer::FuzzerDriver | ( | int | argc, |
| char ** | argv, | ||
| UserSuppliedFuzzer & | USF | ||
| ) |
Runs the fuzzing with the UserSuppliedFuzzer.
Definition at line 221 of file FuzzerDriver.cpp.
|
static |
Definition at line 22 of file FuzzerIO.cpp.
Referenced by ListFilesInDir(), and ReadDirToVectorOfUnits().
| std::string fuzzer::Hash | ( | const Unit & | U | ) |
Definition at line 39 of file FuzzerUtil.cpp.
References ComputeSHA1(), and kSHA1NumBytes.
Referenced by llvm::DWARFAcceleratorTable::dump(), llvm::IndexedInstrProfReader::getFunctionCounts(), HashMachineInstr(), makeTypeSignature(), llvm::IndexedInstrProf::MD5Hash(), llvm::InstrProfLookupTrait::ReadData(), fuzzer::Fuzzer::RereadOutputCorpus(), fuzzer::Fuzzer::SaveCorpus(), fuzzer::Fuzzer::ShuffleAndMinimize(), and TEST().
|
static |
Definition at line 174 of file FuzzerLoop.cpp.
|
static |
Definition at line 28 of file FuzzerIO.cpp.
References GetEpoch().
Referenced by ReadDirToVectorOfUnits().
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If fuzzer::@216::min | ( | jobs | , |
| NumberOfCpuCores()/ | 2 | ||
| ) |
Referenced by add(), llvm::IntervalMapImpl::NodeBase< std::pair< KeyT, KeyT >, ValT, N >::adjustFromLeftSib(), llvm::BitVector::anyCommon(), llvm::SmallBitVector::anyCommon(), llvm::HexagonFrameLowering::assignCalleeSavedSpillSlots(), calculateSetFPREG(), llvm::CC_ARM_AAPCS_Custom_Aggregate(), llvm::StringRef::compare(), llvm::StringRef::compare_lower(), llvm::StringRef::compare_numeric(), compareBySuffix(), llvm::ComputeEditDistance(), llvm::SelectionDAG::computeKnownBits(), computeKnownBitsFromOperator(), llvm::computeKnownBitsFromRangeMetadata(), computeKnownBitsMul(), ComputeNumSignBits(), llvm::SelectionDAG::ComputeNumSignBits(), llvm::FunctionLoweringInfo::ComputePHILiveOutRegInfo(), llvm::ConstantFoldBinaryInstruction(), llvm::APInt::countTrailingZeros(), CrossOver(), DecodeDPRRegListOperand(), dfsan_weak_hook_memcmp(), EmitNops(), llvm::ARMFrameLowering::emitPrologue(), llvm::emitSourceFileHeader(), llvm::X86FrameLowering::emitSPUpdate(), llvm::SystemZSelectionDAGInfo::EmitTargetCodeForMemset(), estimateRSStackSizeLimit(), llvm::BlockFrequencyInfoImplBase::finalizeMetrics(), llvm::StringRef::find(), llvm::StringRef::find_first_not_of(), llvm::StringRef::find_first_of(), llvm::StringRef::find_last_not_of(), llvm::StringRef::find_last_of(), FoldIntToFPToInt(), llvm::InstCombiner::FoldItoFPtoI(), llvm::X86InstrInfo::foldMemoryOperandImpl(), getMemsetStringVal(), llvm::ScalarEvolution::GetMinTrailingZeros(), llvm::ScalarEvolution::getMulExpr(), getNoopInput(), llvm::getOrEnforceKnownAlignment(), llvm::MipsTargetLowering::HandleByVal(), llvm::raw_ostream::indent(), llvm::SelectionDAG::InferPtrAlignment(), llvm::ResourcePriorityQueue::initNumRegDefsLeft(), llvm::InlineFunction(), isVectorPromotionViableForSlice(), fuzzer::LabelRange::Join(), KnuthDiv(), LLVMDisasmInstruction(), LLVMInitializeMCJITCompilerOptions(), LowerVAARG(), llvm::ConstantRange::lshr(), llvm::StringRef::ltrim(), MIsNeedChainEdge(), llvm::object::COFFObjectFile::moveSymbolNext(), llvm::ConstantRange::multiply(), MyFuzzer::Mutate(), operator new(), llvm::BitVector::operator&=(), llvm::BitVector::operator==(), PerformLOADCombine(), PerformSTORECombine(), PerformVMOVRRDCombine(), llvm::SMDiagnostic::print(), llvm::AArch64TargetLowering::ReconstructShuffle(), replaceSplatVectorStore(), llvm::BitVector::reset(), llvm::SmallBitVector::reset(), llvm::StringRef::rfind(), llvm::StringRef::rtrim(), llvm::Interpreter::runFunction(), SelectInt64Count(), llvm::ConstantRange::shl(), fuzzer::Fuzzer::ShuffleAndMinimize(), SimplifyExtractValueInst(), llvm::StringRef::slice(), llvm::SplitEditor::splitRegInBlock(), llvm::SplitEditor::splitRegOutBlock(), llvm::SplitEditor::splitSingleBlock(), llvm::StringRef::substr(), llvm::BitVector::test(), llvm::SmallBitVector::test(), llvm::MachineInstr::tieOperands(), llvm::ScaledNumberBase::toString(), toStringAPFloat(), and llvm::InstCombiner::visitSwitchInst().
| size_t fuzzer::Mutate | ( | uint8_t * | Data, |
| size_t | Size, | ||
| size_t | MaxSize | ||
| ) |
Definition at line 37 of file FuzzerMutate.cpp.
References FlipRandomBit(), and RandCh().
Referenced by fuzzer::UserSuppliedFuzzer::BasicMutate().
| int fuzzer::NumberOfCpuCores | ( | ) |
Definition at line 64 of file FuzzerUtil.cpp.
|
static |
Definition at line 134 of file FuzzerDriver.cpp.
References Lock, Mu, and Printf().
Referenced by ApplyTokens().
Definition at line 101 of file FuzzerDriver.cpp.
Definition at line 23 of file FuzzerUtil.cpp.
References Printf().
Definition at line 29 of file FuzzerUtil.cpp.
| void fuzzer::Printf | ( | const char * | Fmt, |
| ... | |||
| ) |
Definition at line 87 of file FuzzerIO.cpp.
Referenced by fuzzer::TraceState::ApplyTraceBasedMutation(), CopyFileToErr(), fuzzer::TraceState::DFSanCmpCallback(), FlagValue(), ParseFlags(), Print(), PrintASCII(), ReadTokensFile(), fuzzer::Fuzzer::RereadOutputCorpus(), fuzzer::Fuzzer::SaveCorpus(), SetTimer(), fuzzer::Fuzzer::ShuffleAndMinimize(), and fuzzer::TraceState::TraceCmpCallback().
| void fuzzer::PrintFileAsBase64 | ( | const std::string & | Path | ) |
Definition at line 82 of file FuzzerIO.cpp.
References ExecuteCommand().
|
static |
Definition at line 73 of file FuzzerDriver.cpp.
Referenced by ApplyTokens().
|
static |
Definition at line 149 of file FuzzerDriver.cpp.
|
static |
Definition at line 30 of file FuzzerMutate.cpp.
Referenced by Mutate().
| void fuzzer::ReadDirToVectorOfUnits | ( | const char * | Path, |
| std::vector< Unit > * | V, | ||
| long * | Epoch | ||
| ) |
Definition at line 67 of file FuzzerIO.cpp.
References DirPlusFile(), FileToVector(), GetEpoch(), ListFilesInDir(), and X.
Referenced by fuzzer::Fuzzer::ReadDir(), and fuzzer::Fuzzer::RereadOutputCorpus().
| std::vector<std::string> fuzzer::ReadTokensFile | ( | const char * | TokensFilePath | ) |
Definition at line 196 of file FuzzerDriver.cpp.
References FileToVector(), Printf(), and fuzzer::Fuzzer::SubstituteTokens().
|
static |
Definition at line 97 of file FuzzerTraceState.cpp.
Referenced by fuzzer::TraceState::DFSanCmpCallback(), and fuzzer::Fuzzer::InitializeTraceState().
|
static |
Definition at line 176 of file FuzzerDriver.cpp.
| Number of individual test fuzzer::@216::runs | ( | -1 for infinite | runs | ) |
| void fuzzer::SetTimer | ( | int | Seconds | ) |
Definition at line 52 of file FuzzerUtil.cpp.
References AlarmHandler(), and Printf().
|
static |
Definition at line 157 of file FuzzerDriver.cpp.
Definition at line 62 of file FuzzerIO.cpp.
Referenced by fuzzer::Fuzzer::SaveCorpus().
|
static |
Definition at line 19 of file FuzzerLoop.cpp.
Referenced by fuzzer::Fuzzer::Fuzzer(), NumberOfCpuCores(), and fuzzer::Fuzzer::StaticAlarmCallback().
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If Reload the main corpus periodically to get new units discovered by other processes Read the given input fuzzer::file |
Definition at line 56 of file FuzzerDriver.cpp.
| struct { ... } fuzzer::Flags |
Referenced by ApplyTokens().
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found fuzzer::If |
Definition at line 29 of file FuzzerDriver.cpp.
|
static |
Definition at line 70 of file FuzzerDriver.cpp.
Referenced by llvm::CodeExtractor::extractCodeRegion().
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If fuzzer::jobs |
Definition at line 45 of file FuzzerDriver.cpp.
|
static |
Definition at line 67 of file FuzzerDriver.cpp.
Definition at line 50 of file FuzzerInternal.h.
Referenced by Hash().
|
static |
Definition at line 147 of file FuzzerDriver.cpp.
Referenced by ParseFlags().
|
static |
Definition at line 71 of file FuzzerDriver.cpp.
Referenced by ApplyTokens().
|
static |
Definition at line 296 of file FuzzerTraceState.cpp.
Referenced by llvm::MCStreamer::EmitAssignment(), llvm::MipsAsmPrinter::EmitBasicBlockEnd(), llvm::MipsAsmPrinter::EmitFunctionBodyEnd(), llvm::MipsAsmPrinter::EmitFunctionBodyStart(), llvm::MipsAsmPrinter::EmitFunctionEntryLabel(), llvm::MipsAsmPrinter::EmitInstruction(), llvm::MCStreamer::EmitLabel(), llvm::MCStreamer::Finish(), llvm::MipsAsmPrinter::printSavedRegsBitmask(), and llvm::AMDGPUAsmPrinter::runOnMachineFunction().
1.8.6