replica
/
hanchenye-llvm-project
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[libFuzzer] ensure that DFT and autofocus works for C++ (mangled) functions 

llvm-svn: 363905
This commit is contained in:
Kostya Serebryany 2019-06-20 01:48:45 +00:00
parent c67c484f36
commit 27cf743bff
3 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
compiler-rt/lib/fuzzer/dataflow/DataFlow.cpp
View File

@ -98,7 +98,9 @@ static int PrintFunctions() {
FILE *Pipe = popen("sed 's/(+/ /g; s/).*//g' "
"| llvm-symbolizer "
"| grep 'dfs\\$' "
"| sed 's/dfs\\$//g'", "w");
"| sed 's/dfs\\$//g' "
"| c++filt",
"w");
for (size_t I = 0; I < NumGuards; I++) {
uintptr_t PC = PCsBeg[I * 2];
if (!BlockIsEntry(I)) continue;

4
compiler-rt/test/fuzzer/OnlySomeBytesTest.cpp
View File

@ -15,13 +15,13 @@ typedef const uint8_t *IN;
static volatile int one = 1;
extern "C" {
__attribute__((noinline)) void bad() {
fprintf(stderr, "BINGO\n");
if (one)
abort();
}
extern "C"
__attribute__((noinline)) void f0(IN in) {
uint32_t x = in[5] + 251 * in[7] + 251 * 251 * in[9];
if (x == 'F' + 251 * 'U' + 251 * 251 * 'Z') {
@ -41,8 +41,6 @@ __attribute__((noinline)) void fC(IN in) { if (in[2] == 'C') fD(in); }
__attribute__((noinline)) void fB(IN in) { if (in[1] == 'B') fC(in); }
__attribute__((noinline)) void fA(IN in) { if (in[0] == 'A') fB(in); }
} // extern "C"
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
if (Size < N) return 0;
fA((IN)Data);

11
compiler-rt/test/fuzzer/only-some-bytes.test
View File

@ -15,7 +15,11 @@ RUN: cat %t/IN/8 %t/IN/8 %t/IN/8 %t/IN/8 > %t/IN/10
RUN: cat %t/IN/10 %t/IN/10 %t/IN/10 %t/IN/10 > %t/IN/12
# %t/IN/12 is 4096 bytes-long.
RUN: %t-Fuzz -focus_function='fB(unsigned char const*)' -runs=0 %t/IN 2>&1 | FileCheck %s --check-prefix=FOCUS_fB
FOCUS_fB: Focus function is set to 'fB(unsigned char const*)'
RUN: %t-Fuzz -focus_function=f0 -runs=0 %t/IN 2>&1 | FileCheck %s --check-prefix=NO_FOCUSED_INPUT
NO_FOCUSED_INPUT: Focus function is set to 'f0'
NO_FOCUSED_INPUT: INFO: 0/2 inputs touch the focus function
RUN: (echo -n ABC; cat %t/IN/12) > %t/IN/ABC
@ -36,9 +40,12 @@ RUN: rm -rf %t/C_DFT && %t-Fuzz -collect_data_flow=%t-DFT %t/C -data_flow_trace=
RUN: not %t-Fuzz -focus_function=f0 -data_flow_trace=%t/C_DFT -seed=1 -runs=1000000 -use_value_profile=1 %t/C1 %t/C 2> %t/log
RUN: grep BINGO %t/log
# Test -focus_function=auto: run 50 times and verify that 'f0' is the most frequent focus function.
RUN: %t-Fuzz -focus_function=auto -data_flow_trace=%t/C_DFT -runs=0 %t/C -jobs=50 2>&1 | grep AUTOFOCUS | sort | uniq -c | sort -g -r | head -n 1 | FileCheck %s --check-prefix=AUTOFOCUS
# Test -focus_function=auto: run 100 times and verify that
# * 'f0' is the most frequent focus function.
# * the second most frequent is one of fA/fB/fC in a de-mangled form.
RUN: %t-Fuzz -focus_function=auto -data_flow_trace=%t/C_DFT -runs=0 %t/C -jobs=100 2>&1 | grep AUTOFOCUS | sort | uniq -c | sort -g -r | head -n 2 | FileCheck %s --check-prefix=AUTOFOCUS
AUTOFOCUS: INFO: AUTOFOCUS: {{.*}} f0
AUTOFOCUS: INFO: AUTOFOCUS: {{.*f[ABC]}}(unsigned char const*)
# Actually execute 50 fuzzing processes with a small number of runs, to test -focus_function=auto for real.
# We can not test data_flow_trace=auto in just a single run, because it may choose to focus on a wrong function.