|
LLVM
3.7.0
|
#include "FuzzerInterface.h"#include "FuzzerInternal.h"#include <cstring>#include <chrono>#include <unistd.h>#include <thread>#include <atomic>#include <mutex>#include <string>#include <sstream>#include <algorithm>#include <iterator>#include "FuzzerFlags.def"Go to the source code of this file.
Classes | |
| struct | fuzzer::FlagDescription |
Namespaces | |
| fuzzer | |
Macros | |
| #define | FUZZER_FLAG_INT(Name, Default, Description) int Name; |
| #define | FUZZER_FLAG_STRING(Name, Description) const char *Name; |
| #define | FUZZER_FLAG_INT(Name, Default, Description) { #Name, Description, Default, &Flags.Name, nullptr}, |
| #define | FUZZER_FLAG_STRING(Name, Description) { #Name, Description, 0, nullptr, &Flags.Name }, |
Functions | |
| fuzzer::FUZZER_FLAG_INT (iterations,-1,"Number of iterations of the fuzzer internal loop"" (-1 for infinite iterations).") FUZZER_FLAG_INT(runs | |
| Number of individual test | fuzzer::runs (-1 for infinite runs).") FUZZER_FLAG_INT(mutate_depth |
| Number of individual test Apply this number of consecutive mutations to each input | fuzzer::FUZZER_FLAG_INT (prefer_small_during_initial_shuffle,-1,"If 1, always prefer smaller inputs during the initial corpus shuffle."" If 0, never do that. If -1, do it sometimes.") FUZZER_FLAG_INT(exit_on_first |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found | fuzzer::FUZZER_FLAG_INT (timeout, 1200,"Timeout in seconds (if positive). ""If one unit runs more than this number of seconds the process will abort.") FUZZER_FLAG_INT(save_minimized_corpus |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory | fuzzer::FUZZER_FLAG_INT (use_full_coverage_set, 0,"Experimental: Maximize the number of different full"" coverage sets as opposed to maximizing the total coverage."" This is potentially MUCH slower, but may discover more paths.") FUZZER_FLAG_INT(jobs |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If | fuzzer::min (jobs, NumberOfCpuCores()/2)\" is used.") FUZZER_FLAG_INT(reload |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If Reload the main corpus periodically to get new units discovered by other processes | fuzzer::FUZZER_FLAG_STRING (tokens,"Use the file with tokens (one token per line) to"" fuzz a token based input language.") FUZZER_FLAG_STRING(apply_tokens |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If Reload the main corpus periodically to get new units discovered by other processes Read the given input substitute bytes with tokens and write the result to stdout | fuzzer::FUZZER_FLAG_STRING (sync_command,"Execute an external command ""\"<sync_command> <test_corpus>\" ""to synchronize the test corpus.")} |
| static void | fuzzer::PrintHelp () |
| static const char * | fuzzer::FlagValue (const char *Param, const char *Name) |
| static bool | fuzzer::ParseOneFlag (const char *Param) |
| static void | fuzzer::ParseFlags (int argc, char **argv) |
| static void | fuzzer::PulseThread () |
| static void | fuzzer::WorkerThread (const std::string &Cmd, std::atomic< int > *Counter, int NumJobs, std::atomic< bool > *HasErrors) |
| static int | fuzzer::RunInMultipleProcesses (int argc, char **argv, int NumWorkers, int NumJobs) |
| std::vector< std::string > | fuzzer::ReadTokensFile (const char *TokensFilePath) |
| int | fuzzer::ApplyTokens (const Fuzzer &F, const char *InputFilePath) |
| int | fuzzer::FuzzerDriver (int argc, char **argv, UserCallback Callback) |
| Simple C-like interface with a single user-supplied callback. More... | |
| int | fuzzer::FuzzerDriver (int argc, char **argv, UserSuppliedFuzzer &USF) |
| Runs the fuzzing with the UserSuppliedFuzzer. More... | |
Variables | |
| struct { | |
| Number of individual test Apply this number of consecutive mutations to each input fuzzer::If | |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found fuzzer::If | |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If fuzzer::jobs | |
| Number of individual test Apply this number of consecutive mutations to each input exit after the first new interesting input is found the minimized corpus is saved into the first input directory Number of jobs to run If Reload the main corpus periodically to get new units discovered by other processes Read the given input fuzzer::file | |
| } | fuzzer::Flags |
| static const size_t | fuzzer::kNumFlags |
| static std::vector< std::string > | fuzzer::inputs |
| static const char * | fuzzer::ProgName |
| static std::mutex | fuzzer::Mu |
Definition at line 46 of file FuzzerDriver.cpp.
| #define FUZZER_FLAG_INT | ( | Name, | |
| Default, | |||
| Description | |||
| ) | { #Name, Description, Default, &Flags.Name, nullptr}, |
Definition at line 46 of file FuzzerDriver.cpp.
| #define FUZZER_FLAG_STRING | ( | Name, | |
| Description | |||
| ) | const char *Name; |
Definition at line 48 of file FuzzerDriver.cpp.
| #define FUZZER_FLAG_STRING | ( | Name, | |
| Description | |||
| ) | { #Name, Description, 0, nullptr, &Flags.Name }, |
Definition at line 48 of file FuzzerDriver.cpp.
1.8.6