summaryrefslogtreecommitdiff
path: root/lib/fuzzer/FuzzerLoop.cpp
AgeCommit message (Collapse)Author
2018-07-23[libFuzzer] Handle unstable edges by using minimum hit countsMax Moroz
Summary: Created unstable_handle flag that takes 1 or 2, depending on the handling type. Modified RunOne to accommodate the following heuristic: Use the first CollectFeatures to count how many features there are. If no new features, CollectFeatures like before. If there is new feature, we run CB 2 more times, Check which edges are unstable per input and we store the least amount of hit counts for each edge. Apply these hit counts back to inline8bitcounters so that CollectFeatures can work as intended. Modified UnstableCounters to 8int_t and created a bitset UnstableSet to tell which edges are unstable. Patch by Kyungtak Woo (@kevinwkt). Reviewers: Dor1s, metzman, morehouse Reviewed By: Dor1s, morehouse Subscribers: delcypher, #sanitizers, llvm-commits, kcc Differential Revision: https://reviews.llvm.org/D49525 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337696 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-19[libFuzzer] first experimental attempt at DFT-based mutations ↵Kostya Serebryany
(DFT=data-flow-trace) git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337434 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-17[libFuzzer] Mutation tracking and logging implemented.Max Moroz
Summary: Code now exists to track number of mutations that are used in fuzzing in total and ones that produce new coverage. The stats are currently being dumped to the command line. Patch by Kodé Williams (@kodewilliams). Reviewers: metzman, Dor1s, morehouse, kcc Reviewed By: Dor1s, morehouse, kcc Subscribers: delcypher, kubamracek, kcc, morehouse, llvm-commits, #sanitizers, mgorny Differential Revision: https://reviews.llvm.org/D48054 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337324 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-17libFuzzer: prevent irrelevant strings from leaking into auto-dictionaryMatt Morehouse
This is a fix for bug 37047. https://bugs.llvm.org/show_bug.cgi?id=37047 Implemented by basically reversing the logic. Previously all strings were considered, with some operations excluded. Now strings are excluded by default, and only strings during the CB considered. Patch By: pdknsk Differential Revision: https://reviews.llvm.org/D48800 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337296 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-16Revert r337194 (https://reviews.llvm.org/D48891) due to compilation errors.Max Moroz
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337206 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-16[libFuzzer] Mutation tracking and logging implemented.Max Moroz
Summary: Code now exists to track number of mutations that are used in fuzzing in total and ones that produce new coverage. The stats are currently being dumped to the command line. Patch by Kodé Williams (@kodewilliams). Reviewers: metzman, Dor1s, morehouse, kcc Reviewed By: Dor1s, morehouse, kcc Subscribers: delcypher, kubamracek, kcc, morehouse, llvm-commits, #sanitizers, mgorny Differential Revision: https://reviews.llvm.org/D48054 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337194 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-16[libFuzzer] Implement stat::stability_rate based on the percentage of ↵Max Moroz
unstable edges. Summary: Created a -print_unstable_stats flag. When -print_unstable_stats=1, we run it 2 more times on interesting inputs poisoning unstable edges in an array. On program termination, we run PrintUnstableStats() which will print a line with a stability percentage like AFL does. Patch by Kyungtak Woo (@kevinwkt). Reviewers: metzman, Dor1s, kcc, morehouse Reviewed By: metzman, Dor1s, morehouse Subscribers: delcypher, llvm-commits, #sanitizers, kcc, morehouse, Dor1s Differential Revision: https://reviews.llvm.org/D49212 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337187 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-16Revert r337175 (https://reviews.llvm.org/D49212) due to unintentional format ↵Max Moroz
changes. git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337180 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-16[libFuzzer] Implement stat::stability_rate based on the percentage of ↵Max Moroz
unstable edges. Summary: Created a -print_unstable_stats flag. When -print_unstable_stats=1, we run it 2 more times on interesting inputs poisoning unstable edges in an array. On program termination, we run PrintUnstableStats() which will print a line with a stability percentage like AFL does. Patch by Kyungtak Woo (@kevinwkt). Reviewers: metzman, Dor1s, kcc, morehouse Reviewed By: metzman, Dor1s, morehouse Subscribers: delcypher, llvm-commits, #sanitizers, kcc, morehouse, Dor1s Differential Revision: https://reviews.llvm.org/D49212 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@337175 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-09[libFuzzer] Make -fsanitize=memory,fuzzer work.Matt Morehouse
This patch allows libFuzzer to fuzz applications instrumented with MSan without recompiling libFuzzer with MSan instrumentation. Fixes https://github.com/google/sanitizers/issues/958. Differential Revision: https://reviews.llvm.org/D48891 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@336619 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-09Revert "[libFuzzer] Mutation tracking and logging implemented"Matt Morehouse
This reverts r336597 due to bot breakage. git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@336616 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-09[libFuzzer] Mutation tracking and logging implementedMatt Morehouse
Code now exists to track number of mutations that are used in fuzzing in total and ones that produce new coverage. The stats are currently being dumped to the command line. Patch By: Kode Williams Differntial Revision: https://reviews.llvm.org/D48054 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@336597 91177308-0d34-0410-b5e6-96231b3b80d8
2018-07-03[libFuzzer] add one more value profile metric, under a flag (experimental)Kostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@336234 91177308-0d34-0410-b5e6-96231b3b80d8
2018-06-07[libFuzzer] make the corpus elements aware of their data flow tracesKostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@334158 91177308-0d34-0410-b5e6-96231b3b80d8
2018-06-06[libFuzzer] remove an experimental flag -use_feature_frequencyKostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@334146 91177308-0d34-0410-b5e6-96231b3b80d8
2018-06-06[libFuzzer] initial implementation of -data_flow_trace. It parses the data ↵Kostya Serebryany
flow trace and prints the summary, but doesn't use the information in any other way yet git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@334058 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-23[libFuzzer] Don't complain about lack of interesting inputs when -runs=0.Max Moroz
Summary: The most common usecase for -runs=0 is for generating code coverage over some corpus. Coverage reports based on sancov are about to be deprecated, which means some external coverage solution will be used, e.g. Clang source based code coverage, which does not use any sancov instrumentations and thus libFuzzer would consider any input to be not interesting in that case. Reviewers: kcc Reviewed By: kcc Subscribers: alex, delcypher, #sanitizers, llvm-commits Differential Revision: https://reviews.llvm.org/D47271 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@333116 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-21[libFuzzer] reinstate -dump_coverage, which is still in use (reverts r332036)Kostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@332876 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-16[libFuzzer] add an experimental flag -focus_function: libFuzzer will try to ↵Kostya Serebryany
focus on inputs that trigger that function git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@332554 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-10[libFuzzer] remove the dump_coverage flag, it hasn't been working with the ↵Kostya Serebryany
inline sanitizer coverage anyway git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@332036 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-10[libFuzzer] remove the experimental support for clang coverage ↵Kostya Serebryany
instrumentation. This mode has not been used and our experiments with https://github.com/google/fuzzer-test-suite show that this signal is weaker than the SanitizerCoverage git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@332034 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-08[libFuzzer] Guard symbolization with try-lock.Matt Morehouse
Summary: When out-of-memory or timeout occurs, threads can be stopped during symbolization, thereby causing a deadlock when the OOM/TO handlers attempt symbolization. We avoid this deadlock by skipping symbolization if another thread is symbolizing. Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D46605 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@331825 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-02[libFuzzer] Don't short-circuit from CrashCallback.Matt Morehouse
Short-circuiting causes tests to fail on Mac since libFuzzer crashes rather than exiting with an error code when an unexpected signal happens. git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@331324 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-01[libFuzzer] Report at most one crash per input.Matt Morehouse
Summary: Fixes https://github.com/google/sanitizers/issues/788/, a deadlock caused by multiple crashes happening at the same time. Before printing a crash report, we now test and set an atomic flag. If the flag was already set, the crash handler returns immediately. Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits, kubamracek Differential Revision: https://reviews.llvm.org/D46277 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@331310 91177308-0d34-0410-b5e6-96231b3b80d8
2018-02-22[libFuzzer] Include TEMP_MAX_LEN in Fuzzer::PrintStats.Matt Morehouse
Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D43597 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@325817 91177308-0d34-0410-b5e6-96231b3b80d8
2018-02-13[libFuzzer] Set -experimental_len_control=1000 as default.Matt Morehouse
Summary: Experiments using https://github.com/google/fuzzer-test-suite/tree/master/engine-comparison show a significant increase in coverage and reduction in corpus size with this option enabled. Addresses https://llvm.org/pr36371. Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D42932 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@325050 91177308-0d34-0410-b5e6-96231b3b80d8
2018-01-17Reland "[libFuzzer] Support using libc++"Petr Hosek
This is needed in case the users of libFuzzer use libc++ in their code, which the fuzz target (libFuzzer) will be linked against. When libc++ source is available, we build a private version of it and link it against libFuzzer which allows using the same static library against codebases which use both libc++ and libstdc++. Differential Revision: https://reviews.llvm.org/D37631 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@322755 91177308-0d34-0410-b5e6-96231b3b80d8
2018-01-17Revert "[libFuzzer] Support using libc++"Petr Hosek
This reverts commit r322604: test is failing for standalone compiler-rt. git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@322689 91177308-0d34-0410-b5e6-96231b3b80d8
2018-01-17[libFuzzer] Support using libc++Petr Hosek
This is needed in case the users of libFuzzer use libc++ in their code, which the fuzz target (libFuzzer) will be linked against. When libc++ source is available, we build a private version of it and link it against libFuzzer which allows using the same static library against codebases which use both libc++ and libstdc++. Differential Revision: https://reviews.llvm.org/D37631 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@322604 91177308-0d34-0410-b5e6-96231b3b80d8
2017-12-12[libFuzzer] change the strategy for -experimental_len_control to grow ↵Kostya Serebryany
max_len slower git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@320531 91177308-0d34-0410-b5e6-96231b3b80d8
2017-12-08[libFuzzer] honor -use_counters, sligntly change the meaning of ↵Kostya Serebryany
-experimental_len_control, call UpdateFeatureFrequency only if instructed by the flag git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@320205 91177308-0d34-0410-b5e6-96231b3b80d8
2017-12-01[libFuzzer] add a flag -malloc_limit_mbKostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@319590 91177308-0d34-0410-b5e6-96231b3b80d8
2017-12-01[libFuzzer] remove stale flags; NFCKostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@319572 91177308-0d34-0410-b5e6-96231b3b80d8
2017-12-01[libFuzzer] add an experimental search heuristic flag -reduce_depthKostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@319571 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-09[libFuzzer] Don't add leaking inputs to corpus.Matt Morehouse
Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D39850 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@317831 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-09[libFuzzer] handle SIGUSR1/SIGUSR2 and try to exit grafully on these signalsKostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@317829 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-02[fuzzer] Fix nested mallocsVitaly Buka
Summary: Nested mallocs are possible with internal symbolizer. Reviewers: kcc Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D39397 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@317186 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-01[fuzzer] Fix threaded stack printingVitaly Buka
Reviewers: kcc Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D39397 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@317071 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-01Revert "[fuzzer] Fix threaded stack printing and nested mallocs"Vitaly Buka
Fails on darwin Revert "[fuzzer] Script to detect unbalanced allocation in -trace_malloc output" Needs previous one. This reverts commit r317034, r317036. git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@317061 91177308-0d34-0410-b5e6-96231b3b80d8
2017-10-31[fuzzer] Fix threaded stack printing and nested mallocsVitaly Buka
Summary: Nested mallocs are possible with internal symbolizer. Reviewers: kcc Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D39397 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@317034 91177308-0d34-0410-b5e6-96231b3b80d8
2017-10-23[Sanitizers-libFuzzer] Addressing coding style issues.Alex Shlyapnikov
Summary: The result of clang-format and few manual changes (as prompted on D39155). Reviewers: vitalybuka Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D39211 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@316395 91177308-0d34-0410-b5e6-96231b3b80d8
2017-10-23[libFuzzer] Periodically purge allocator's quarantine to prolong fuzzing ↵Alex Shlyapnikov
sessions. Summary: Fuzzing targets that allocate/deallocate a lot of memory tend to consume a lot of RSS when ASan quarantine is enabled. Purging quarantine between iterations and returning memory to OS keeps RSS down and should not reduce the quarantine effectiveness provided the fuzz target does not preserve state between iterations (in this case this feature can be turned off). Based on D39153. Reviewers: vitalybuka Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D39155 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@316382 91177308-0d34-0410-b5e6-96231b3b80d8
2017-10-13[libFuzzer] tweam use_feature_frequency to be less aggressive; run a dummy ↵Kostya Serebryany
input before the seed corpus git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@315657 91177308-0d34-0410-b5e6-96231b3b80d8
2017-10-11[libFuzzer] experimental flag to tweak the corpus distribution. Seems to ↵Kostya Serebryany
improve the situation dramatically on the png benchmark and make things worse on a number of micro-puzzles. Needs more A/B testing git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@315407 91177308-0d34-0410-b5e6-96231b3b80d8
2017-10-05[libFuzzer] Disable experimental clang coverage support by default.Max Moroz
Summary: It can be enabled via "-use_clang_coverage=1" flag. Reason for disabling: libFuzzer resets Clang Counters and makes it impossible to generate coverage report for a regular fuzz target (i.e. not standalone build). Reviewers: kcc Reviewed By: kcc Subscribers: kcc Differential Revision: https://reviews.llvm.org/D38604 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@315029 91177308-0d34-0410-b5e6-96231b3b80d8
2017-09-12[libFuzzer] factor out some code into GetSizedFilesFromDir; NFCKostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@313081 91177308-0d34-0410-b5e6-96231b3b80d8
2017-09-12[libfuzzer] Compare TotalNumberOfRuns with MaxNumberOfRuns when testing a ↵Max Moroz
memory leak. Summary: Fuzzer::TryDetectingAMemoryLeak may call ExecuteCallback which would increment TotalNumberOfRuns, but it doesn't respect Options.MaxNumberOfRuns value specified by a user. Context: https://github.com/google/oss-fuzz/issues/822#issuecomment-328153970 Reviewers: kcc Reviewed By: kcc Differential Revision: https://reviews.llvm.org/D37632 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@312993 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-31[libFuzzer] tolerate missing files when loading the seed corpusKostya Serebryany
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@312269 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-29[libFUzzer] change the way we load the seed corpora: instead of loading all ↵Kostya Serebryany
files and these executing all files, load and execute them one-by-one. This should reduce the memory usage in many cases git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@312033 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-29[libFuzzer] refactoring: move reading the seed corpus closer to where it's ↵Kostya Serebryany
consumed; NFC git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@311972 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-30 19:10:35 +0000