18 #include <unordered_set>
23 typedef std::vector<uint8_t>
Unit;
24 using namespace std::chrono;
34 const std::string &FileName);
36 size_t Mutate(uint8_t *Data,
size_t Size,
size_t MaxSize);
38 size_t CrossOver(
const uint8_t *Data1,
size_t Size1,
const uint8_t *Data2,
39 size_t Size2, uint8_t *Out,
size_t MaxOutSize);
41 void Printf(
const char *Fmt, ...);
52 void ComputeSHA1(
const uint8_t *Data,
size_t Len, uint8_t *Out);
61 int UnitTimeoutSec = 300;
62 bool DoCrossOver =
true;
64 bool ExitOnFirst =
false;
65 bool UseCounters =
false;
66 bool UseTraces =
false;
67 bool UseFullCoverageSet =
false;
69 int PreferSmallDuringInitialShuffle = -1;
70 size_t MaxNumberOfRuns = ULONG_MAX;
71 int SyncTimeout = 600;
78 void Loop(
size_t NumIterations);
79 void ShuffleAndMinimize();
80 void InitializeTraceState();
82 void ReadDir(
const std::string &Path,
long *Epoch) {
85 void RereadOutputCorpus();
96 static void StaticAlarmCallback();
98 Unit SubstituteTokens(
const Unit &U)
const;
101 void AlarmCallback();
102 void ExecuteCallback(
const Unit &U);
103 void MutateAndTestOne(
Unit *U);
104 void ReportNewCoverage(
size_t NewCoverage,
const Unit &U);
105 size_t RunOne(
const Unit &U);
106 void RunOneAndUpdateCorpus(
const Unit &U);
107 size_t RunOneMaximizeTotalCoverage(
const Unit &U);
108 size_t RunOneMaximizeFullCoverageSet(
const Unit &U);
109 size_t RunOneMaximizeCoveragePairs(
const Unit &U);
110 void WriteToOutputCorpus(
const Unit &U);
111 void WriteToCrash(
const Unit &U,
const char *
Prefix);
112 void PrintStats(
const char *Where,
size_t Cov,
const char *End =
"\n");
113 void PrintUnitInASCIIOrTokens(
const Unit &U,
const char *
PrintAfter =
"");
122 void StartTraceRecording();
124 size_t StopTraceRecording();
126 void ApplyTraceBasedMutation(
size_t Idx,
Unit *U);
128 void SetDeathCallback();
129 static void StaticDeathCallback();
130 void DeathCallback();
133 size_t TotalNumberOfRuns = 0;
135 std::vector<Unit> Corpus;
136 std::unordered_set<std::string> UnitHashesAddedToCorpus;
137 std::unordered_set<uintptr_t> FullCoverageSets;
140 std::vector<uint8_t> CounterBitmap;
143 for (
auto x : CounterBitmap) Res += __builtin_popcount(x);
147 UserSuppliedFuzzer &USF;
148 FuzzingOptions Options;
151 system_clock::time_point UnitStartTime;
152 long TimeOfLongestUnitInSeconds = 0;
153 long EpochOfLastReadOfOutputCorpus = 0;
160 return Callback(Data, Size);
size_t getTotalNumberOfRuns()
void PrintASCII(const Unit &U, const char *PrintAfter="")
void ReadDir(const std::string &Path, long *Epoch)
void Print(const Unit &U, const char *PrintAfter="")
void SetTimer(int Seconds)
void(* UserCallback)(const uint8_t *Data, size_t Size)
std::vector< std::string > Tokens
size_t secondsSinceProcessStartUp()
void ExecuteCommand(const std::string &Command)
SimpleUserSuppliedFuzzer(UserCallback Callback)
void PrintFileAsBase64(const std::string &Path)
std::string FileToString(const std::string &Path)
size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize)
size_t CorpusSize() const
void Printf(const char *Fmt,...)
void ComputeSHA1(const uint8_t *Data, size_t Len, uint8_t *Out)
static PassOptionList PrintAfter("print-after", llvm::cl::desc("Print IR after specified passes"), cl::Hidden)
virtual void TargetFunction(const uint8_t *Data, size_t Size)
Executes the target function on 'Size' bytes of 'Data'.
size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2, size_t Size2, uint8_t *Out, size_t MaxOutSize)
void AddToCorpus(const Unit &U)
std::string DirPlusFile(const std::string &DirPath, const std::string &FileName)
An abstract class that allows to use user-supplied mutators with libFuzzer.
void CopyFileToErr(const std::string &Path)
void WriteToFile(const Unit &U, const std::string &Path)
Unit FileToVector(const std::string &Path)
std::vector< uint8_t > Unit
void ReadDirToVectorOfUnits(const char *Path, std::vector< Unit > *V, long *Epoch)
std::string Hash(const Unit &U)
static const int kSHA1NumBytes
static sys::TimeValue now(bool Deterministic)