From 80eb76abf472e7b31d46f1bf364a594304357cb1 Mon Sep 17 00:00:00 2001 From: Kostya Serebryany Date: Wed, 6 Jan 2016 02:13:04 +0000 Subject: [PATCH] [libFuzzer] extend the dictionary mutator to optionally overwrite data with the dict entry llvm-svn: 256900 --- llvm/lib/Fuzzer/FuzzerMutate.cpp | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/llvm/lib/Fuzzer/FuzzerMutate.cpp b/llvm/lib/Fuzzer/FuzzerMutate.cpp index c3fa37a435d6..84ee18e69fb0 100644 --- a/llvm/lib/Fuzzer/FuzzerMutate.cpp +++ b/llvm/lib/Fuzzer/FuzzerMutate.cpp @@ -117,11 +117,18 @@ size_t MutationDispatcher::Mutate_AddWordFromDictionary(uint8_t *Data, assert(!D.empty()); if (D.empty()) return 0; const Unit &Word = D[Rand(D.size())]; - if (Size + Word.size() > MaxSize) return 0; - size_t Idx = Rand(Size + 1); - memmove(Data + Idx + Word.size(), Data + Idx, Size - Idx); - memcpy(Data + Idx, Word.data(), Word.size()); - return Size + Word.size(); + if (Rand.RandBool()) { // Insert Word. + if (Size + Word.size() > MaxSize) return 0; + size_t Idx = Rand(Size + 1); + memmove(Data + Idx + Word.size(), Data + Idx, Size - Idx); + memcpy(Data + Idx, Word.data(), Word.size()); + return Size + Word.size(); + } else { // Overwrite some bytes with Word. + if (Word.size() > Size) return 0; + size_t Idx = Rand(Size - Word.size()); + memcpy(Data + Idx, Word.data(), Word.size()); + return Size; + } } size_t MutationDispatcher::Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size,