12 #ifndef LLVM_FUZZER_INTERNAL_H
13 #define LLVM_FUZZER_INTERNAL_H
30 using namespace std::chrono;
41 CallerCalleeCoverage = 0;
42 CounterBitmapBits = 0;
43 CounterBitmap.clear();
59 void MinimizeCrashLoop(
const Unit &U);
61 void InitializeTraceState();
62 void RereadOutputCorpus(
size_t MaxSize);
70 return Options.MaxTotalTimeSec > 0 &&
71 secondsSinceProcessStartUp() >
72 static_cast<size_t>(Options.MaxTotalTimeSec);
76 size_t Seconds = secondsSinceProcessStartUp();
77 return Seconds ? TotalNumberOfRuns / Seconds : 0;
82 static void StaticAlarmCallback();
83 static void StaticCrashSignalCallback();
84 static void StaticInterruptCallback();
85 static void StaticFileSizeExceedCallback();
87 void ExecuteCallback(
const uint8_t *Data,
size_t Size);
88 size_t RunOne(
const uint8_t *Data,
size_t Size);
91 void Merge(
const std::vector<std::string> &Corpora);
92 void CrashResistantMerge(
const std::vector<std::string> &
Args,
93 const std::vector<std::string> &Corpora);
94 void CrashResistantMergeInternalStep(
const std::string &ControlFilePath);
98 void PrintFinalStats();
99 void SetMaxInputLen(
size_t MaxInputLen);
100 void SetMaxMutationLen(
size_t MaxMutationLen);
101 void RssLimitCallback();
104 void ResetCoverage();
107 size_t GetCurrentUnitInFuzzingThead(
const uint8_t **Data)
const;
108 void TryDetectingAMemoryLeak(
const uint8_t *Data,
size_t Size,
109 bool DuringInitialCorpusExecution);
111 void HandleMalloc(
size_t Size);
114 void AlarmCallback();
115 void CrashCallback();
116 void InterruptCallback();
117 void MutateAndTestOne();
119 size_t RunOne(
const Unit &U) {
return RunOne(U.data(), U.size()); }
120 void WriteToOutputCorpus(
const Unit &U);
121 void WriteUnitToFileWithPrefix(
const Unit &U,
const char *
Prefix);
122 void PrintStats(
const char *Where,
const char *
End =
"\n",
size_t Units = 0);
123 void PrintStatusForNewUnit(
const Unit &U);
125 void AddToCorpus(
const Unit &U);
126 void CheckExitOnSrcPosOrItem();
133 void StartTraceRecording();
135 void StopTraceRecording();
137 void SetDeathCallback();
138 static void StaticDeathCallback();
139 void DumpCurrentUnit(
const char *
Prefix);
140 void DeathCallback();
142 void ResetEdgeCoverage();
143 void ResetCounters();
144 void PrepareCounters(Fuzzer::Coverage *
C);
145 bool RecordMaxCoverage(Fuzzer::Coverage *
C);
147 void AllocateCurrentUnitData();
148 uint8_t *CurrentUnitData =
nullptr;
149 std::atomic<size_t> CurrentUnitSize;
151 bool RunningCB =
false;
153 size_t TotalNumberOfRuns = 0;
154 size_t NumberOfNewUnitsAdded = 0;
156 bool HasMoreMallocsThanFrees =
false;
157 size_t NumberOfLeakDetectionAttempts = 0;
161 MutationDispatcher &MD;
162 FuzzingOptions Options;
165 system_clock::time_point UnitStartTime, UnitStopTime;
166 long TimeOfLongestUnitInSeconds = 0;
167 long EpochOfLastReadOfOutputCorpus = 0;
170 Coverage MaxCoverage;
172 size_t MaxInputLen = 0;
173 size_t MaxMutationLen = 0;
176 static thread_local
bool IsMyThread;
178 bool InMergeMode =
false;
183 #endif // LLVM_FUZZER_INTERNAL_H
size_t getTotalNumberOfRuns()
int(* UserCallback)(const uint8_t *Data, size_t Size)
size_t CallerCalleeCoverage
bool InFuzzingThread() const
size_t secondsSinceProcessStartUp()
MutationDispatcher & GetMD()
auto count(R &&Range, const E &Element) -> typename std::iterator_traits< decltype(std::begin(Range))>::difference_type
Wrapper function around std::count to count the number of times an element Element occurs in the give...
static sys::TimePoint< std::chrono::seconds > now(bool Deterministic)
static const unsigned End
static void Merge(const std::string &Input, const std::vector< std::string > Result, size_t NumNewFeatures)
static GCRegistry::Add< ShadowStackGC > C("shadow-stack","Very portable GC for uncooperative code generators")
std::vector< Unit > UnitVector
std::vector< uint8_t > CounterBitmap
std::vector< uint8_t > Unit
static const int kSHA1NumBytes