12 #ifndef LLVM_FUZZER_MUTATE_H
13 #define LLVM_FUZZER_MUTATE_H
32 size_t Mutate_Custom(uint8_t *Data,
size_t Size,
size_t MaxSize);
75 size_t Mutate(uint8_t *Data,
size_t Size,
size_t MaxSize);
78 size_t DefaultMutate(uint8_t *Data,
size_t Size,
size_t MaxSize);
81 size_t CrossOver(
const uint8_t *Data1,
size_t Size1,
const uint8_t *Data2,
82 size_t Size2, uint8_t *Out,
size_t MaxOutSize);
101 size_t AddWordFromDictionary(Dictionary &
D, uint8_t *Data,
size_t Size,
103 size_t MutateImpl(uint8_t *Data,
size_t Size,
size_t MaxSize,
104 const std::vector<Mutator> &Mutators);
106 size_t InsertPartOf(
const uint8_t *From,
size_t FromSize, uint8_t *To,
107 size_t ToSize,
size_t MaxToSize);
108 size_t CopyPartOf(
const uint8_t *From,
size_t FromSize, uint8_t *To,
110 size_t ApplyDictionaryEntry(uint8_t *Data,
size_t Size,
size_t MaxSize,
111 DictionaryEntry &DE);
114 DictionaryEntry MakeDictionaryEntryFromCMP(
T Arg1,
T Arg2,
115 const uint8_t *Data,
size_t Size);
118 const FuzzingOptions &Options;
121 Dictionary ManualDictionary;
124 Dictionary TempAutoDictionary;
127 Dictionary PersistentAutoDictionary;
129 std::vector<Mutator> CurrentMutatorSequence;
130 std::vector<DictionaryEntry *> CurrentDictionaryEntrySequence;
132 static const size_t kCmpDictionaryEntriesDequeSize = 16;
133 DictionaryEntry CmpDictionaryEntriesDeque[kCmpDictionaryEntriesDequeSize];
134 size_t CmpDictionaryEntriesDequeIdx = 0;
136 const InputCorpus *Corpus =
nullptr;
137 std::vector<uint8_t> MutateInPlaceHere;
139 std::vector<Mutator> Mutators;
140 std::vector<Mutator> DefaultMutators;
145 #endif // LLVM_FUZZER_MUTATE_H
size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by inserting a byte.
size_t Mutate_Custom(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by invoking user-provided mutator.
void StartMutationSequence()
Indicate that we are about to start a new sequence of mutations.
size_t Mutate_ChangeBinaryInteger(uint8_t *Data, size_t Size, size_t MaxSize)
Change a 1-, 2-, 4-, or 8-byte integer in interesting ways.
size_t Mutate_CrossOver(uint8_t *Data, size_t Size, size_t MaxSize)
CrossOver Data with some other element of the corpus.
size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize)
Applies one of the configured mutations.
size_t(MutationDispatcher::* Mutator)(uint8_t *Data, size_t Size, size_t MaxSize)
size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2, size_t Size2, uint8_t *Out, size_t MaxOutSize)
Creates a cross-over of two pieces of Data, returns its size.
size_t DefaultMutate(uint8_t *Data, size_t Size, size_t MaxSize)
Applies one of the default mutations.
size_t Mutate_AddWordFromManualDictionary(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by adding a word from the manual dictionary.
void PrintRecommendedDictionary()
static GCRegistry::Add< StatepointGC > D("statepoint-example","an example strategy for statepoint")
void PrintMutationSequence()
Print the current sequence of mutations.
void RecordSuccessfulMutationSequence()
Indicate that the current sequence of mutations was successfull.
void AddWordToAutoDictionary(DictionaryEntry DE)
MutationDispatcher(Random &Rand, const FuzzingOptions &Options)
size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by chanding one bit.
size_t Mutate_CustomCrossOver(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by invoking user-provided crossover.
size_t Mutate_AddWordFromTemporaryAutoDictionary(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by adding a word from the temporary automatic dictionary.
void ClearAutoDictionary()
size_t Mutate_InsertRepeatedBytes(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by inserting several repeated bytes.
void AddWordToManualDictionary(const Word &W)
size_t Mutate_AddWordFromPersistentAutoDictionary(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by adding a word from the persistent automatic dictionary.
size_t Mutate_CopyPart(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by copying/inserting a part of data into a different place.
size_t Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MaxSize)
Tries to find an ASCII integer in Data, changes it to another ASCII int.
void SetCorpus(const InputCorpus *Corpus)
size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by chanding one byte.
size_t Mutate_AddWordFromTORC(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by adding a word from the TORC.
size_t Mutate_EraseBytes(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by erasing bytes.
size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by shuffling bytes.