44 : MD(MD), Options(Options), F(F) {}
47 const uint8_t *Data2);
50 const uint8_t *DesiredData,
size_t DataSize);
58 InterestingWords.clear();
66 for (
size_t i = 0;
i < NumMutations;
i++) {
67 auto &M = Mutations[
i];
69 AutoDictUnitCounts[M.W]++;
71 if ((AutoDictAdds & (AutoDictAdds - 1)) == 0) {
72 typedef std::pair<size_t, Word> CU;
73 std::vector<CU> CountedUnits;
74 for (
auto &
I : AutoDictUnitCounts)
75 CountedUnits.push_back(std::make_pair(
I.second,
I.first));
76 std::sort(CountedUnits.begin(), CountedUnits.end(),
77 [](
const CU &a,
const CU &b) {
return a.first > b.first; });
79 for (
auto &
I : CountedUnits) {
88 for (
auto &W : InterestingWords)
93 if (NumMutations >= kMaxMutations)
return;
94 auto &M = Mutations[NumMutations++];
100 assert(Size <=
sizeof(Data));
101 AddMutation(Pos, Size, reinterpret_cast<uint8_t*>(&Data));
106 if (Size <= 1)
return;
109 InterestingWords.insert(W);
113 bool IsTwoByteData(uint64_t Data) {
114 int64_t
Signed =
static_cast<int64_t
>(Data);
116 return Signed == 0 || Signed == -1
L;
123 bool WantToHandleOneMoreMutation() {
124 const size_t FirstN = 64;
126 if (NumMutations <= FirstN)
return true;
127 size_t Diff = NumMutations - FirstN;
128 size_t DiffLog =
sizeof(long) * 8 - __builtin_clzl((
long)Diff);
129 assert(DiffLog > 0 && DiffLog < 64);
130 bool WantThisOne = MD.
GetRand()(1 << DiffLog) == 0;
134 static const size_t kMaxMutations = 1 << 16;
136 TraceBasedMutation Mutations[kMaxMutations];
138 std::set<Word> InterestingWords;
139 MutationDispatcher &MD;
140 const FuzzingOptions Options;
142 std::map<Word, size_t> AutoDictUnitCounts;
143 size_t AutoDictAdds = 0;
147 const uint8_t *DesiredData,
149 if (NumMutations >= kMaxMutations || !WantToHandleOneMoreMutation())
return 0;
151 const uint8_t *UnitData;
154 const uint8_t *Beg = UnitData;
155 const uint8_t *
End = Beg + UnitSize;
156 for (
const uint8_t *Cur = Beg; Cur <
End; Cur++) {
157 Cur = (uint8_t *)
SearchMemory(Cur, End - Cur, PresentData, DataSize);
160 size_t Pos = Cur - Beg;
169 const uint8_t *Data2) {
174 if ((Added1 || Added2) && Options.
Verbosity >= 3) {
175 Printf(
"MemCmp Added %d%d: ", Added1, Added2);
184 void Fuzzer::StartTraceRecording() {
189 void Fuzzer::StopTraceRecording() {
201 for (; Len < MaxLen && S[Len]; Len++) {}
213 #ifndef LLVM_FUZZER_DEFINES_SANITIZER_WEAK_HOOOKS
214 # define LLVM_FUZZER_DEFINES_SANITIZER_WEAK_HOOOKS 1
217 #if LLVM_FUZZER_DEFINES_SANITIZER_WEAK_HOOOKS
219 const void *s2,
size_t n,
int result) {
222 if (result == 0)
return;
225 reinterpret_cast<const uint8_t *>(s2));
229 const char *s2,
size_t n,
int result) {
232 if (result == 0)
return;
239 reinterpret_cast<const uint8_t *>(s2));
243 const char *s2,
int result) {
246 if (result == 0)
return;
247 size_t Len1 = strlen(s1);
248 size_t Len2 = strlen(s2);
252 reinterpret_cast<const uint8_t *>(s2));
256 const char *s2,
size_t n,
int result) {
260 const char *s2,
int result) {
264 const char *s2,
char *result) {
268 const char *s2,
char *result) {
272 const void *s2,
size_t len2,
void *result) {
277 #endif // LLVM_FUZZER_DEFINES_SANITIZER_WEAK_HOOOKS
void AddValueForStrcmp(void *caller_pc, const char *s1, const char *s2, size_t n)
void __sanitizer_weak_hook_memmem(void *called_pc, const void *s1, size_t len1, const void *s2, size_t len2, void *result)
void InitializeTraceState()
static bool DoingMyOwnMemmem
void AddValueForMemcmp(void *caller_pc, const void *s1, const void *s2, size_t n)
bool InFuzzingThread() const
void AddInterestingWord(const uint8_t *Data, size_t Size)
void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1, const void *s2, size_t n, int result)
void __sanitizer_weak_hook_strncasecmp(void *called_pc, const char *s1, const char *s2, size_t n, int result)
size_t GetCurrentUnitInFuzzingThead(const uint8_t **Data) const
static bool RecordingMemmem
void AddWordToAutoDictionary(DictionaryEntry DE)
~ScopedDoingMyOwnMemmem()
Maximum length of the test input libFuzzer tries to guess a good value based on the corpus and reports it always prefer smaller inputs during the corpus shuffle When libFuzzer itself reports a bug this exit code will be used If indicates the maximal total time in seconds to run the fuzzer minimizes the provided crash input Use with etc Experimental Use value profile to guide fuzzing Number of simultaneous worker processes to run the jobs If min(jobs, NumberOfCpuCores()/2)\" is used.") FUZZER_FLAG_INT(reload
void AddMutation(uint32_t Pos, uint32_t Size, uint64_t Data)
void Printf(const char *Fmt,...)
int TryToAddDesiredData(const uint8_t *PresentData, const uint8_t *DesiredData, size_t DataSize)
void ClearAutoDictionary()
static const unsigned End
TraceState(MutationDispatcher &MD, const FuzzingOptions &Options, const Fuzzer *F)
void StartTraceRecording()
void __sanitizer_weak_hook_strncmp(void *caller_pc, const char *s1, const char *s2, size_t n, int result)
static size_t GetMaxSize()
void TraceMemcmpCallback(size_t CmpSize, const uint8_t *Data1, const uint8_t *Data2)
const void * SearchMemory(const void *haystack, size_t haystacklen, const void *needle, size_t needlelen)
void __sanitizer_weak_hook_strcasecmp(void *called_pc, const char *s1, const char *s2, int result)
void AddMutation(uint32_t Pos, uint32_t Size, const uint8_t *Data)
static size_t InternalStrnlen(const char *S, size_t MaxLen)
void StopTraceRecording()
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
void __sanitizer_weak_hook_strstr(void *called_pc, const char *s1, const char *s2, char *result)
void __sanitizer_weak_hook_strcasestr(void *called_pc, const char *s1, const char *s2, char *result)
void __sanitizer_weak_hook_strcmp(void *caller_pc, const char *s1, const char *s2, int result)
static bool RecordingMemcmp
static void PrintASCII(const Word &W, const char *PrintAfter)