summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorKostya Serebryany <kcc@google.com>2017-08-29 02:05:01 +0000
committerKostya Serebryany <kcc@google.com>2017-08-29 02:05:01 +0000
commit895df3ed0da58642a4b690506e1c250d0bde2836 (patch)
tree14583a2db81f1d3f0aeb985e3922b33010cbaf71 /lib
parent886bbfa61b2327865e1ccd9916554de6e026bc5d (diff)
[libFuzzer] refactoring: move reading the seed corpus closer to where it's consumed; NFC
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@311972 91177308-0d34-0410-b5e6-96231b3b80d8
Diffstat (limited to 'lib')
-rw-r--r--lib/fuzzer/FuzzerDriver.cpp38
-rw-r--r--lib/fuzzer/FuzzerInternal.h3
-rw-r--r--lib/fuzzer/FuzzerLoop.cpp31
3 files changed, 43 insertions, 29 deletions
diff --git a/lib/fuzzer/FuzzerDriver.cpp b/lib/fuzzer/FuzzerDriver.cpp
index 1ed709237..804f426e9 100644
--- a/lib/fuzzer/FuzzerDriver.cpp
+++ b/lib/fuzzer/FuzzerDriver.cpp
@@ -558,8 +558,6 @@ int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
if (Flags.workers > 0 && Flags.jobs > 0)
return RunInMultipleProcesses(Args, Flags.workers, Flags.jobs);
- const size_t kMaxSaneLen = 1 << 20;
- const size_t kMinDefaultLen = 4096;
FuzzingOptions Options;
Options.Verbosity = Flags.verbosity;
Options.MaxLen = Flags.max_len;
@@ -702,8 +700,10 @@ int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
}
if (Flags.merge) {
+ const size_t kDefaultMaxMergeLen = 1 << 20;
if (Options.MaxLen == 0)
- F->SetMaxInputLen(kMaxSaneLen);
+ F->SetMaxInputLen(kDefaultMaxMergeLen);
+
if (Flags.merge_control_file)
F->CrashResistantMergeInternalStep(Flags.merge_control_file);
else
@@ -713,16 +713,16 @@ int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
exit(0);
}
- size_t TemporaryMaxLen = Options.MaxLen ? Options.MaxLen : kMaxSaneLen;
-
- UnitVector InitialCorpus;
- for (auto &Inp : *Inputs) {
- Printf("Loading corpus dir: %s\n", Inp.c_str());
- ReadDirToVectorOfUnits(Inp.c_str(), &InitialCorpus, nullptr,
- TemporaryMaxLen, /*ExitOnError=*/false);
- }
if (Flags.analyze_dict) {
+ size_t MaxLen = INT_MAX; // Large max length.
+ UnitVector InitialCorpus;
+ for (auto &Inp : *Inputs) {
+ Printf("Loading corpus dir: %s\n", Inp.c_str());
+ ReadDirToVectorOfUnits(Inp.c_str(), &InitialCorpus, nullptr,
+ MaxLen, /*ExitOnError=*/false);
+ }
+
if (Dictionary.empty() || Inputs->empty()) {
Printf("ERROR: can't analyze dict without dict and corpus provided\n");
return 1;
@@ -735,21 +735,7 @@ int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
exit(0);
}
- if (Options.MaxLen == 0) {
- size_t MaxLen = 0;
- for (auto &U : InitialCorpus)
- MaxLen = std::max(U.size(), MaxLen);
- F->SetMaxInputLen(std::min(std::max(kMinDefaultLen, MaxLen), kMaxSaneLen));
- }
-
- if (InitialCorpus.empty()) {
- InitialCorpus.push_back(Unit({'\n'})); // Valid ASCII input.
- if (Options.Verbosity)
- Printf("INFO: A corpus is not provided, starting from an empty corpus\n");
- }
- F->ShuffleAndMinimize(&InitialCorpus);
- InitialCorpus.clear(); // Don't need this memory any more.
- F->Loop();
+ F->Loop(*Inputs);
if (Flags.verbosity)
Printf("Done %zd runs in %zd second(s)\n", F->getTotalNumberOfRuns(),
diff --git a/lib/fuzzer/FuzzerInternal.h b/lib/fuzzer/FuzzerInternal.h
index 567c6e6a2..70136a30b 100644
--- a/lib/fuzzer/FuzzerInternal.h
+++ b/lib/fuzzer/FuzzerInternal.h
@@ -35,7 +35,8 @@ public:
Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD,
FuzzingOptions Options);
~Fuzzer();
- void Loop();
+ void Loop(const Vector<std::string> &CorpusDirs);
+ void ReadAndExecuteSeedCorpora(const Vector<std::string> &CorpusDirs);
void MinimizeCrashLoop(const Unit &U);
void ShuffleAndMinimize(UnitVector *V);
void RereadOutputCorpus(size_t MaxSize);
diff --git a/lib/fuzzer/FuzzerLoop.cpp b/lib/fuzzer/FuzzerLoop.cpp
index dd828917f..84ea2d6e8 100644
--- a/lib/fuzzer/FuzzerLoop.cpp
+++ b/lib/fuzzer/FuzzerLoop.cpp
@@ -380,7 +380,8 @@ void Fuzzer::ShuffleCorpus(UnitVector *V) {
}
void Fuzzer::ShuffleAndMinimize(UnitVector *InitialCorpus) {
- Printf("#0\tREAD units: %zd\n", InitialCorpus->size());
+ Printf("#0\tREAD units: %zd; rss: %zdMb\n", InitialCorpus->size(),
+ GetPeakRSSMb());
if (Options.ShuffleAtStartUp)
ShuffleCorpus(InitialCorpus);
@@ -624,7 +625,33 @@ void Fuzzer::MutateAndTestOne() {
}
}
-void Fuzzer::Loop() {
+void Fuzzer::ReadAndExecuteSeedCorpora(const Vector<std::string> &CorpusDirs) {
+ const size_t kMaxSaneLen = 1 << 20;
+ const size_t kMinDefaultLen = 4096;
+ size_t TemporaryMaxLen = Options.MaxLen ? Options.MaxLen : kMaxSaneLen;
+ UnitVector InitialCorpus;
+ for (auto &Inp : CorpusDirs) {
+ Printf("Loading corpus dir: %s\n", Inp.c_str());
+ ReadDirToVectorOfUnits(Inp.c_str(), &InitialCorpus, nullptr,
+ TemporaryMaxLen, /*ExitOnError=*/false);
+ }
+ if (Options.MaxLen == 0) {
+ size_t MaxLen = 0;
+ for (auto &U : InitialCorpus)
+ MaxLen = std::max(U.size(), MaxLen);
+ SetMaxInputLen(std::min(std::max(kMinDefaultLen, MaxLen), kMaxSaneLen));
+ }
+
+ if (InitialCorpus.empty()) {
+ InitialCorpus.push_back(Unit({'\n'})); // Valid ASCII input.
+ if (Options.Verbosity)
+ Printf("INFO: A corpus is not provided, starting from an empty corpus\n");
+ }
+ ShuffleAndMinimize(&InitialCorpus);
+}
+
+void Fuzzer::Loop(const Vector<std::string> &CorpusDirs) {
+ ReadAndExecuteSeedCorpora(CorpusDirs);
TPC.SetPrintNewPCs(Options.PrintNewCovPcs);
TPC.SetPrintNewFuncs(Options.PrintNewCovFuncs);
system_clock::time_point LastCorpusReload = system_clock::now();