LLVM  6.0.0svn
FuzzerMutate.h
Go to the documentation of this file.
1 //===- FuzzerMutate.h - Internal header for the Fuzzer ----------*- C++ -* ===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 // fuzzer::MutationDispatcher
10 //===----------------------------------------------------------------------===//
11 
12 #ifndef LLVM_FUZZER_MUTATE_H
13 #define LLVM_FUZZER_MUTATE_H
14 
15 #include "FuzzerDefs.h"
16 #include "FuzzerDictionary.h"
17 #include "FuzzerOptions.h"
18 #include "FuzzerRandom.h"
19 
20 namespace fuzzer {
21 
23 public:
24  MutationDispatcher(Random &Rand, const FuzzingOptions &Options);
26  /// Indicate that we are about to start a new sequence of mutations.
27  void StartMutationSequence();
28  /// Print the current sequence of mutations.
29  void PrintMutationSequence();
30  /// Indicate that the current sequence of mutations was successfull.
32  /// Mutates data by invoking user-provided mutator.
33  size_t Mutate_Custom(uint8_t *Data, size_t Size, size_t MaxSize);
34  /// Mutates data by invoking user-provided crossover.
35  size_t Mutate_CustomCrossOver(uint8_t *Data, size_t Size, size_t MaxSize);
36  /// Mutates data by shuffling bytes.
37  size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize);
38  /// Mutates data by erasing bytes.
39  size_t Mutate_EraseBytes(uint8_t *Data, size_t Size, size_t MaxSize);
40  /// Mutates data by inserting a byte.
41  size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize);
42  /// Mutates data by inserting several repeated bytes.
43  size_t Mutate_InsertRepeatedBytes(uint8_t *Data, size_t Size, size_t MaxSize);
44  /// Mutates data by chanding one byte.
45  size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize);
46  /// Mutates data by chanding one bit.
47  size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize);
48  /// Mutates data by copying/inserting a part of data into a different place.
49  size_t Mutate_CopyPart(uint8_t *Data, size_t Size, size_t MaxSize);
50 
51  /// Mutates data by adding a word from the manual dictionary.
52  size_t Mutate_AddWordFromManualDictionary(uint8_t *Data, size_t Size,
53  size_t MaxSize);
54 
55  /// Mutates data by adding a word from the TORC.
56  size_t Mutate_AddWordFromTORC(uint8_t *Data, size_t Size, size_t MaxSize);
57 
58  /// Mutates data by adding a word from the persistent automatic dictionary.
59  size_t Mutate_AddWordFromPersistentAutoDictionary(uint8_t *Data, size_t Size,
60  size_t MaxSize);
61 
62  /// Tries to find an ASCII integer in Data, changes it to another ASCII int.
63  size_t Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MaxSize);
64  /// Change a 1-, 2-, 4-, or 8-byte integer in interesting ways.
65  size_t Mutate_ChangeBinaryInteger(uint8_t *Data, size_t Size, size_t MaxSize);
66 
67  /// CrossOver Data with some other element of the corpus.
68  size_t Mutate_CrossOver(uint8_t *Data, size_t Size, size_t MaxSize);
69 
70  /// Applies one of the configured mutations.
71  /// Returns the new size of data which could be up to MaxSize.
72  size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize);
73  /// Applies one of the default mutations. Provided as a service
74  /// to mutation authors.
75  size_t DefaultMutate(uint8_t *Data, size_t Size, size_t MaxSize);
76 
77  /// Creates a cross-over of two pieces of Data, returns its size.
78  size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2,
79  size_t Size2, uint8_t *Out, size_t MaxOutSize);
80 
81  void AddWordToManualDictionary(const Word &W);
82 
84 
85  void SetCorpus(const InputCorpus *Corpus) { this->Corpus = Corpus; }
86 
87  Random &GetRand() { return Rand; }
88 
89 private:
90 
91  struct Mutator {
92  size_t (MutationDispatcher::*Fn)(uint8_t *Data, size_t Size, size_t Max);
93  const char *Name;
94  };
95 
96  size_t AddWordFromDictionary(Dictionary &D, uint8_t *Data, size_t Size,
97  size_t MaxSize);
98  size_t MutateImpl(uint8_t *Data, size_t Size, size_t MaxSize,
99  const std::vector<Mutator> &Mutators);
100 
101  size_t InsertPartOf(const uint8_t *From, size_t FromSize, uint8_t *To,
102  size_t ToSize, size_t MaxToSize);
103  size_t CopyPartOf(const uint8_t *From, size_t FromSize, uint8_t *To,
104  size_t ToSize);
105  size_t ApplyDictionaryEntry(uint8_t *Data, size_t Size, size_t MaxSize,
106  DictionaryEntry &DE);
107 
108  template <class T>
109  DictionaryEntry MakeDictionaryEntryFromCMP(T Arg1, T Arg2,
110  const uint8_t *Data, size_t Size);
111  DictionaryEntry MakeDictionaryEntryFromCMP(const Word &Arg1, const Word &Arg2,
112  const uint8_t *Data, size_t Size);
113  DictionaryEntry MakeDictionaryEntryFromCMP(const void *Arg1, const void *Arg2,
114  const void *Arg1Mutation,
115  const void *Arg2Mutation,
116  size_t ArgSize,
117  const uint8_t *Data, size_t Size);
118 
119  Random &Rand;
120  const FuzzingOptions Options;
121 
122  // Dictionary provided by the user via -dict=DICT_FILE.
123  Dictionary ManualDictionary;
124  // Temporary dictionary modified by the fuzzer itself,
125  // recreated periodically.
126  Dictionary TempAutoDictionary;
127  // Persistent dictionary modified by the fuzzer, consists of
128  // entries that led to successfull discoveries in the past mutations.
129  Dictionary PersistentAutoDictionary;
130 
131  std::vector<Mutator> CurrentMutatorSequence;
132  std::vector<DictionaryEntry *> CurrentDictionaryEntrySequence;
133 
134  static const size_t kCmpDictionaryEntriesDequeSize = 16;
135  DictionaryEntry CmpDictionaryEntriesDeque[kCmpDictionaryEntriesDequeSize];
136  size_t CmpDictionaryEntriesDequeIdx = 0;
137 
138  const InputCorpus *Corpus = nullptr;
139  std::vector<uint8_t> MutateInPlaceHere;
140  // CustomCrossOver needs its own buffer as a custom implementation may call
141  // LLVMFuzzerMutate, which in turn may resize MutateInPlaceHere.
142  std::vector<uint8_t> CustomCrossOverInPlaceHere;
143 
144  std::vector<Mutator> Mutators;
145  std::vector<Mutator> DefaultMutators;
146 };
147 
148 } // namespace fuzzer
149 
150 #endif // LLVM_FUZZER_MUTATE_H
size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by inserting a byte.
size_t Mutate_Custom(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by invoking user-provided mutator.
void StartMutationSequence()
Indicate that we are about to start a new sequence of mutations.
size_t Mutate_ChangeBinaryInteger(uint8_t *Data, size_t Size, size_t MaxSize)
Change a 1-, 2-, 4-, or 8-byte integer in interesting ways.
size_t Mutate_CrossOver(uint8_t *Data, size_t Size, size_t MaxSize)
CrossOver Data with some other element of the corpus.
size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize)
Applies one of the configured mutations.
size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2, size_t Size2, uint8_t *Out, size_t MaxOutSize)
Creates a cross-over of two pieces of Data, returns its size.
size_t DefaultMutate(uint8_t *Data, size_t Size, size_t MaxSize)
Applies one of the default mutations.
size_t Mutate_AddWordFromManualDictionary(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by adding a word from the manual dictionary.
void PrintMutationSequence()
Print the current sequence of mutations.
void RecordSuccessfulMutationSequence()
Indicate that the current sequence of mutations was successfull.
MutationDispatcher(Random &Rand, const FuzzingOptions &Options)
size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by chanding one bit.
size_t Mutate_CustomCrossOver(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by invoking user-provided crossover.
size_t Mutate_InsertRepeatedBytes(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by inserting several repeated bytes.
void AddWordToManualDictionary(const Word &W)
size_t Mutate_AddWordFromPersistentAutoDictionary(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by adding a word from the persistent automatic dictionary.
size_t Mutate_CopyPart(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by copying/inserting a part of data into a different place.
size_t Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MaxSize)
Tries to find an ASCII integer in Data, changes it to another ASCII int.
static GCRegistry::Add< StatepointGC > D("statepoint-example", "an example strategy for statepoint")
void SetCorpus(const InputCorpus *Corpus)
Definition: FuzzerMutate.h:85
size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by chanding one byte.
constexpr char Size[]
Key for Kernel::Arg::Metadata::mSize.
T Max(T a, T b)
Definition: FuzzerDefs.h:91
size_t Mutate_AddWordFromTORC(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by adding a word from the TORC.
size_t Mutate_EraseBytes(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by erasing bytes.
size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize)
Mutates data by shuffling bytes.