1 //===- FuzzerLoop.cpp - Fuzzer's main loop --------------------------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 // Fuzzer's main loop.
10 //===----------------------------------------------------------------------===//
11
12 #include "FuzzerCorpus.h"
13 #include "FuzzerIO.h"
14 #include "FuzzerInternal.h"
15 #include "FuzzerMutate.h"
16 #include "FuzzerRandom.h"
17 #include "FuzzerShmem.h"
18 #include "FuzzerTracePC.h"
19 #include <algorithm>
20 #include <cstring>
21 #include <memory>
22 #include <mutex>
23 #include <set>
24
25 #if defined(__has_include)
26 #if __has_include(<sanitizer / lsan_interface.h>)
27 #include <sanitizer/lsan_interface.h>
28 #endif
29 #endif
30
31 #define NO_SANITIZE_MEMORY
32 #if defined(__has_feature)
33 #if __has_feature(memory_sanitizer)
34 #undef NO_SANITIZE_MEMORY
35 #define NO_SANITIZE_MEMORY __attribute__((no_sanitize_memory))
36 #endif
37 #endif
38
39 namespace fuzzer {
40 static const size_t kMaxUnitSizeToPrint = 256;
41
42 thread_local bool Fuzzer::IsMyThread;
43
44 SharedMemoryRegion SMR;
45
46 bool RunningUserCallback = false;
47
48 // Only one Fuzzer per process.
49 static Fuzzer *F;
50
51 // Leak detection is expensive, so we first check if there were more mallocs
52 // than frees (using the sanitizer malloc hooks) and only then try to call lsan.
53 struct MallocFreeTracer {
Startfuzzer::MallocFreeTracer54 void Start(int TraceLevel) {
55 this->TraceLevel = TraceLevel;
56 if (TraceLevel)
57 Printf("MallocFreeTracer: START\n");
58 Mallocs = 0;
59 Frees = 0;
60 }
61 // Returns true if there were more mallocs than frees.
Stopfuzzer::MallocFreeTracer62 bool Stop() {
63 if (TraceLevel)
64 Printf("MallocFreeTracer: STOP %zd %zd (%s)\n", Mallocs.load(),
65 Frees.load(), Mallocs == Frees ? "same" : "DIFFERENT");
66 bool Result = Mallocs > Frees;
67 Mallocs = 0;
68 Frees = 0;
69 TraceLevel = 0;
70 return Result;
71 }
72 std::atomic<size_t> Mallocs;
73 std::atomic<size_t> Frees;
74 int TraceLevel = 0;
75
76 std::recursive_mutex TraceMutex;
77 bool TraceDisabled = false;
78 };
79
80 static MallocFreeTracer AllocTracer;
81
82 // Locks printing and avoids nested hooks triggered from mallocs/frees in
83 // sanitizer.
84 class TraceLock {
85 public:
TraceLock()86 TraceLock() : Lock(AllocTracer.TraceMutex) {
87 AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled;
88 }
~TraceLock()89 ~TraceLock() { AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled; }
90
IsDisabled() const91 bool IsDisabled() const {
92 // This is already inverted value.
93 return !AllocTracer.TraceDisabled;
94 }
95
96 private:
97 std::lock_guard<std::recursive_mutex> Lock;
98 };
99
100 ATTRIBUTE_NO_SANITIZE_MEMORY
MallocHook(const volatile void * ptr,size_t size)101 void MallocHook(const volatile void *ptr, size_t size) {
102 size_t N = AllocTracer.Mallocs++;
103 F->HandleMalloc(size);
104 if (int TraceLevel = AllocTracer.TraceLevel) {
105 TraceLock Lock;
106 if (Lock.IsDisabled())
107 return;
108 Printf("MALLOC[%zd] %p %zd\n", N, ptr, size);
109 if (TraceLevel >= 2 && EF)
110 PrintStackTrace();
111 }
112 }
113
114 ATTRIBUTE_NO_SANITIZE_MEMORY
FreeHook(const volatile void * ptr)115 void FreeHook(const volatile void *ptr) {
116 size_t N = AllocTracer.Frees++;
117 if (int TraceLevel = AllocTracer.TraceLevel) {
118 TraceLock Lock;
119 if (Lock.IsDisabled())
120 return;
121 Printf("FREE[%zd] %p\n", N, ptr);
122 if (TraceLevel >= 2 && EF)
123 PrintStackTrace();
124 }
125 }
126
127 // Crash on a single malloc that exceeds the rss limit.
HandleMalloc(size_t Size)128 void Fuzzer::HandleMalloc(size_t Size) {
129 if (!Options.MallocLimitMb || (Size >> 20) < (size_t)Options.MallocLimitMb)
130 return;
131 Printf("==%d== ERROR: libFuzzer: out-of-memory (malloc(%zd))\n", GetPid(),
132 Size);
133 Printf(" To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
134 PrintStackTrace();
135 DumpCurrentUnit("oom-");
136 Printf("SUMMARY: libFuzzer: out-of-memory\n");
137 PrintFinalStats();
138 _Exit(Options.ErrorExitCode); // Stop right now.
139 }
140
Fuzzer(UserCallback CB,InputCorpus & Corpus,MutationDispatcher & MD,FuzzingOptions Options)141 Fuzzer::Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD,
142 FuzzingOptions Options)
143 : CB(CB), Corpus(Corpus), MD(MD), Options(Options) {
144 if (EF->__sanitizer_set_death_callback)
145 EF->__sanitizer_set_death_callback(StaticDeathCallback);
146 assert(!F);
147 F = this;
148 TPC.ResetMaps();
149 IsMyThread = true;
150 if (Options.DetectLeaks && EF->__sanitizer_install_malloc_and_free_hooks)
151 EF->__sanitizer_install_malloc_and_free_hooks(MallocHook, FreeHook);
152 TPC.SetUseCounters(Options.UseCounters);
153 TPC.SetUseValueProfileMask(Options.UseValueProfile);
154
155 if (Options.Verbosity)
156 TPC.PrintModuleInfo();
157 if (!Options.OutputCorpus.empty() && Options.ReloadIntervalSec)
158 EpochOfLastReadOfOutputCorpus = GetEpoch(Options.OutputCorpus);
159 MaxInputLen = MaxMutationLen = Options.MaxLen;
160 TmpMaxMutationLen = Max(size_t(4), Corpus.MaxInputSize());
161 AllocateCurrentUnitData();
162 CurrentUnitSize = 0;
163 memset(BaseSha1, 0, sizeof(BaseSha1));
164 TPC.SetFocusFunction(Options.FocusFunction);
165 DFT.Init(Options.DataFlowTrace, Options.FocusFunction);
166 }
167
~Fuzzer()168 Fuzzer::~Fuzzer() {}
169
AllocateCurrentUnitData()170 void Fuzzer::AllocateCurrentUnitData() {
171 if (CurrentUnitData || MaxInputLen == 0)
172 return;
173 CurrentUnitData = new uint8_t[MaxInputLen];
174 }
175
StaticDeathCallback()176 void Fuzzer::StaticDeathCallback() {
177 assert(F);
178 F->DeathCallback();
179 }
180
DumpCurrentUnit(const char * Prefix)181 void Fuzzer::DumpCurrentUnit(const char *Prefix) {
182 if (!CurrentUnitData)
183 return; // Happens when running individual inputs.
184 ScopedDisableMsanInterceptorChecks S;
185 MD.PrintMutationSequence();
186 Printf("; base unit: %s\n", Sha1ToString(BaseSha1).c_str());
187 size_t UnitSize = CurrentUnitSize;
188 if (UnitSize <= kMaxUnitSizeToPrint) {
189 PrintHexArray(CurrentUnitData, UnitSize, "\n");
190 PrintASCII(CurrentUnitData, UnitSize, "\n");
191 }
192 WriteUnitToFileWithPrefix({CurrentUnitData, CurrentUnitData + UnitSize},
193 Prefix);
194 }
195
196 NO_SANITIZE_MEMORY
DeathCallback()197 void Fuzzer::DeathCallback() {
198 DumpCurrentUnit("crash-");
199 PrintFinalStats();
200 }
201
StaticAlarmCallback()202 void Fuzzer::StaticAlarmCallback() {
203 assert(F);
204 F->AlarmCallback();
205 }
206
StaticCrashSignalCallback()207 void Fuzzer::StaticCrashSignalCallback() {
208 assert(F);
209 F->CrashCallback();
210 }
211
StaticExitCallback()212 void Fuzzer::StaticExitCallback() {
213 assert(F);
214 F->ExitCallback();
215 }
216
StaticInterruptCallback()217 void Fuzzer::StaticInterruptCallback() {
218 assert(F);
219 F->InterruptCallback();
220 }
221
StaticGracefulExitCallback()222 void Fuzzer::StaticGracefulExitCallback() {
223 assert(F);
224 F->GracefulExitRequested = true;
225 Printf("INFO: signal received, trying to exit gracefully\n");
226 }
227
StaticFileSizeExceedCallback()228 void Fuzzer::StaticFileSizeExceedCallback() {
229 Printf("==%lu== ERROR: libFuzzer: file size exceeded\n", GetPid());
230 exit(1);
231 }
232
CrashCallback()233 void Fuzzer::CrashCallback() {
234 if (EF->__sanitizer_acquire_crash_state)
235 EF->__sanitizer_acquire_crash_state();
236 Printf("==%lu== ERROR: libFuzzer: deadly signal\n", GetPid());
237 PrintStackTrace();
238 Printf("NOTE: libFuzzer has rudimentary signal handlers.\n"
239 " Combine libFuzzer with AddressSanitizer or similar for better "
240 "crash reports.\n");
241 Printf("SUMMARY: libFuzzer: deadly signal\n");
242 DumpCurrentUnit("crash-");
243 PrintFinalStats();
244 _Exit(Options.ErrorExitCode); // Stop right now.
245 }
246
ExitCallback()247 void Fuzzer::ExitCallback() {
248 if (!RunningUserCallback)
249 return; // This exit did not come from the user callback
250 if (EF->__sanitizer_acquire_crash_state &&
251 !EF->__sanitizer_acquire_crash_state())
252 return;
253 Printf("==%lu== ERROR: libFuzzer: fuzz target exited\n", GetPid());
254 PrintStackTrace();
255 Printf("SUMMARY: libFuzzer: fuzz target exited\n");
256 DumpCurrentUnit("crash-");
257 PrintFinalStats();
258 _Exit(Options.ErrorExitCode);
259 }
260
MaybeExitGracefully()261 void Fuzzer::MaybeExitGracefully() {
262 if (!GracefulExitRequested) return;
263 Printf("==%lu== INFO: libFuzzer: exiting as requested\n", GetPid());
264 PrintFinalStats();
265 _Exit(0);
266 }
267
InterruptCallback()268 void Fuzzer::InterruptCallback() {
269 Printf("==%lu== libFuzzer: run interrupted; exiting\n", GetPid());
270 PrintFinalStats();
271 _Exit(0); // Stop right now, don't perform any at-exit actions.
272 }
273
274 NO_SANITIZE_MEMORY
AlarmCallback()275 void Fuzzer::AlarmCallback() {
276 assert(Options.UnitTimeoutSec > 0);
277 // In Windows Alarm callback is executed by a different thread.
278 // NetBSD's current behavior needs this change too.
279 #if !LIBFUZZER_WINDOWS && !LIBFUZZER_NETBSD
280 if (!InFuzzingThread())
281 return;
282 #endif
283 if (!RunningUserCallback)
284 return; // We have not started running units yet.
285 size_t Seconds =
286 duration_cast<seconds>(system_clock::now() - UnitStartTime).count();
287 if (Seconds == 0)
288 return;
289 if (Options.Verbosity >= 2)
290 Printf("AlarmCallback %zd\n", Seconds);
291 if (Seconds >= (size_t)Options.UnitTimeoutSec) {
292 if (EF->__sanitizer_acquire_crash_state &&
293 !EF->__sanitizer_acquire_crash_state())
294 return;
295 Printf("ALARM: working on the last Unit for %zd seconds\n", Seconds);
296 Printf(" and the timeout value is %d (use -timeout=N to change)\n",
297 Options.UnitTimeoutSec);
298 DumpCurrentUnit("timeout-");
299 Printf("==%lu== ERROR: libFuzzer: timeout after %d seconds\n", GetPid(),
300 Seconds);
301 PrintStackTrace();
302 Printf("SUMMARY: libFuzzer: timeout\n");
303 PrintFinalStats();
304 _Exit(Options.TimeoutExitCode); // Stop right now.
305 }
306 }
307
RssLimitCallback()308 void Fuzzer::RssLimitCallback() {
309 if (EF->__sanitizer_acquire_crash_state &&
310 !EF->__sanitizer_acquire_crash_state())
311 return;
312 Printf(
313 "==%lu== ERROR: libFuzzer: out-of-memory (used: %zdMb; limit: %zdMb)\n",
314 GetPid(), GetPeakRSSMb(), Options.RssLimitMb);
315 Printf(" To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
316 PrintMemoryProfile();
317 DumpCurrentUnit("oom-");
318 Printf("SUMMARY: libFuzzer: out-of-memory\n");
319 PrintFinalStats();
320 _Exit(Options.ErrorExitCode); // Stop right now.
321 }
322
PrintStats(const char * Where,const char * End,size_t Units)323 void Fuzzer::PrintStats(const char *Where, const char *End, size_t Units) {
324 size_t ExecPerSec = execPerSec();
325 if (!Options.Verbosity)
326 return;
327 Printf("#%zd\t%s", TotalNumberOfRuns, Where);
328 if (size_t N = TPC.GetTotalPCCoverage())
329 Printf(" cov: %zd", N);
330 if (size_t N = Corpus.NumFeatures())
331 Printf(" ft: %zd", N);
332 if (!Corpus.empty()) {
333 Printf(" corp: %zd", Corpus.NumActiveUnits());
334 if (size_t N = Corpus.SizeInBytes()) {
335 if (N < (1 << 14))
336 Printf("/%zdb", N);
337 else if (N < (1 << 24))
338 Printf("/%zdKb", N >> 10);
339 else
340 Printf("/%zdMb", N >> 20);
341 }
342 if (size_t FF = Corpus.NumInputsThatTouchFocusFunction())
343 Printf(" focus: %zd", FF);
344 }
345 if (TmpMaxMutationLen)
346 Printf(" lim: %zd", TmpMaxMutationLen);
347 if (Units)
348 Printf(" units: %zd", Units);
349
350 Printf(" exec/s: %zd", ExecPerSec);
351 Printf(" rss: %zdMb", GetPeakRSSMb());
352 Printf("%s", End);
353 }
354
PrintFinalStats()355 void Fuzzer::PrintFinalStats() {
356 if (Options.PrintCoverage)
357 TPC.PrintCoverage();
358 if (Options.PrintUnstableStats)
359 TPC.PrintUnstableStats();
360 if (Options.DumpCoverage)
361 TPC.DumpCoverage();
362 if (Options.PrintCorpusStats)
363 Corpus.PrintStats();
364 if (!Options.PrintFinalStats)
365 return;
366 size_t ExecPerSec = execPerSec();
367 Printf("stat::number_of_executed_units: %zd\n", TotalNumberOfRuns);
368 Printf("stat::average_exec_per_sec: %zd\n", ExecPerSec);
369 Printf("stat::new_units_added: %zd\n", NumberOfNewUnitsAdded);
370 Printf("stat::slowest_unit_time_sec: %zd\n", TimeOfLongestUnitInSeconds);
371 Printf("stat::peak_rss_mb: %zd\n", GetPeakRSSMb());
372 }
373
SetMaxInputLen(size_t MaxInputLen)374 void Fuzzer::SetMaxInputLen(size_t MaxInputLen) {
375 assert(this->MaxInputLen == 0); // Can only reset MaxInputLen from 0 to non-0.
376 assert(MaxInputLen);
377 this->MaxInputLen = MaxInputLen;
378 this->MaxMutationLen = MaxInputLen;
379 AllocateCurrentUnitData();
380 Printf("INFO: -max_len is not provided; "
381 "libFuzzer will not generate inputs larger than %zd bytes\n",
382 MaxInputLen);
383 }
384
SetMaxMutationLen(size_t MaxMutationLen)385 void Fuzzer::SetMaxMutationLen(size_t MaxMutationLen) {
386 assert(MaxMutationLen && MaxMutationLen <= MaxInputLen);
387 this->MaxMutationLen = MaxMutationLen;
388 }
389
CheckExitOnSrcPosOrItem()390 void Fuzzer::CheckExitOnSrcPosOrItem() {
391 if (!Options.ExitOnSrcPos.empty()) {
392 static auto *PCsSet = new Set<uintptr_t>;
393 auto HandlePC = [&](uintptr_t PC) {
394 if (!PCsSet->insert(PC).second)
395 return;
396 std::string Descr = DescribePC("%F %L", PC + 1);
397 if (Descr.find(Options.ExitOnSrcPos) != std::string::npos) {
398 Printf("INFO: found line matching '%s', exiting.\n",
399 Options.ExitOnSrcPos.c_str());
400 _Exit(0);
401 }
402 };
403 TPC.ForEachObservedPC(HandlePC);
404 }
405 if (!Options.ExitOnItem.empty()) {
406 if (Corpus.HasUnit(Options.ExitOnItem)) {
407 Printf("INFO: found item with checksum '%s', exiting.\n",
408 Options.ExitOnItem.c_str());
409 _Exit(0);
410 }
411 }
412 }
413
RereadOutputCorpus(size_t MaxSize)414 void Fuzzer::RereadOutputCorpus(size_t MaxSize) {
415 if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec)
416 return;
417 Vector<Unit> AdditionalCorpus;
418 ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus,
419 &EpochOfLastReadOfOutputCorpus, MaxSize,
420 /*ExitOnError*/ false);
421 if (Options.Verbosity >= 2)
422 Printf("Reload: read %zd new units.\n", AdditionalCorpus.size());
423 bool Reloaded = false;
424 for (auto &U : AdditionalCorpus) {
425 if (U.size() > MaxSize)
426 U.resize(MaxSize);
427 if (!Corpus.HasUnit(U)) {
428 if (RunOne(U.data(), U.size())) {
429 CheckExitOnSrcPosOrItem();
430 Reloaded = true;
431 }
432 }
433 }
434 if (Reloaded)
435 PrintStats("RELOAD");
436 }
437
PrintPulseAndReportSlowInput(const uint8_t * Data,size_t Size)438 void Fuzzer::PrintPulseAndReportSlowInput(const uint8_t *Data, size_t Size) {
439 auto TimeOfUnit =
440 duration_cast<seconds>(UnitStopTime - UnitStartTime).count();
441 if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) &&
442 secondsSinceProcessStartUp() >= 2)
443 PrintStats("pulse ");
444 if (TimeOfUnit > TimeOfLongestUnitInSeconds * 1.1 &&
445 TimeOfUnit >= Options.ReportSlowUnits) {
446 TimeOfLongestUnitInSeconds = TimeOfUnit;
447 Printf("Slowest unit: %zd s:\n", TimeOfLongestUnitInSeconds);
448 WriteUnitToFileWithPrefix({Data, Data + Size}, "slow-unit-");
449 }
450 }
451
CheckForUnstableCounters(const uint8_t * Data,size_t Size)452 void Fuzzer::CheckForUnstableCounters(const uint8_t *Data, size_t Size) {
453 auto CBSetupAndRun = [&]() {
454 ScopedEnableMsanInterceptorChecks S;
455 UnitStartTime = system_clock::now();
456 TPC.ResetMaps();
457 RunningUserCallback = true;
458 CB(Data, Size);
459 RunningUserCallback = false;
460 UnitStopTime = system_clock::now();
461 };
462
463 // Copy original run counters into our unstable counters
464 TPC.InitializeUnstableCounters();
465
466 // First Rerun
467 CBSetupAndRun();
468 if (TPC.UpdateUnstableCounters(Options.HandleUnstable)) {
469 // Second Rerun
470 CBSetupAndRun();
471 TPC.UpdateAndApplyUnstableCounters(Options.HandleUnstable);
472 }
473 }
474
RunOne(const uint8_t * Data,size_t Size,bool MayDeleteFile,InputInfo * II,bool * FoundUniqFeatures)475 bool Fuzzer::RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile,
476 InputInfo *II, bool *FoundUniqFeatures) {
477 if (!Size)
478 return false;
479
480 ExecuteCallback(Data, Size);
481
482 UniqFeatureSetTmp.clear();
483 size_t FoundUniqFeaturesOfII = 0;
484 size_t NumUpdatesBefore = Corpus.NumFeatureUpdates();
485 bool NewFeaturesUnstable = false;
486
487 if (Options.HandleUnstable || Options.PrintUnstableStats) {
488 TPC.CollectFeatures([&](size_t Feature) {
489 if (Corpus.IsFeatureNew(Feature, Size, Options.Shrink))
490 NewFeaturesUnstable = true;
491 });
492 if (NewFeaturesUnstable)
493 CheckForUnstableCounters(Data, Size);
494 }
495
496 TPC.CollectFeatures([&](size_t Feature) {
497 if (Corpus.AddFeature(Feature, Size, Options.Shrink))
498 UniqFeatureSetTmp.push_back(Feature);
499 if (Options.ReduceInputs && II)
500 if (std::binary_search(II->UniqFeatureSet.begin(),
501 II->UniqFeatureSet.end(), Feature))
502 FoundUniqFeaturesOfII++;
503 });
504
505 if (FoundUniqFeatures)
506 *FoundUniqFeatures = FoundUniqFeaturesOfII;
507 PrintPulseAndReportSlowInput(Data, Size);
508 size_t NumNewFeatures = Corpus.NumFeatureUpdates() - NumUpdatesBefore;
509
510 if (NumNewFeatures) {
511 TPC.UpdateObservedPCs();
512 Corpus.AddToCorpus({Data, Data + Size}, NumNewFeatures, MayDeleteFile,
513 TPC.ObservedFocusFunction(), UniqFeatureSetTmp, DFT, II);
514 return true;
515 }
516 if (II && FoundUniqFeaturesOfII &&
517 II->DataFlowTraceForFocusFunction.empty() &&
518 FoundUniqFeaturesOfII == II->UniqFeatureSet.size() &&
519 II->U.size() > Size) {
520 Corpus.Replace(II, {Data, Data + Size});
521 return true;
522 }
523 return false;
524 }
525
GetCurrentUnitInFuzzingThead(const uint8_t ** Data) const526 size_t Fuzzer::GetCurrentUnitInFuzzingThead(const uint8_t **Data) const {
527 assert(InFuzzingThread());
528 *Data = CurrentUnitData;
529 return CurrentUnitSize;
530 }
531
CrashOnOverwrittenData()532 void Fuzzer::CrashOnOverwrittenData() {
533 Printf("==%d== ERROR: libFuzzer: fuzz target overwrites it's const input\n",
534 GetPid());
535 DumpCurrentUnit("crash-");
536 Printf("SUMMARY: libFuzzer: out-of-memory\n");
537 _Exit(Options.ErrorExitCode); // Stop right now.
538 }
539
540 // Compare two arrays, but not all bytes if the arrays are large.
LooseMemeq(const uint8_t * A,const uint8_t * B,size_t Size)541 static bool LooseMemeq(const uint8_t *A, const uint8_t *B, size_t Size) {
542 const size_t Limit = 64;
543 if (Size <= 64)
544 return !memcmp(A, B, Size);
545 // Compare first and last Limit/2 bytes.
546 return !memcmp(A, B, Limit / 2) &&
547 !memcmp(A + Size - Limit / 2, B + Size - Limit / 2, Limit / 2);
548 }
549
ExecuteCallback(const uint8_t * Data,size_t Size)550 void Fuzzer::ExecuteCallback(const uint8_t *Data, size_t Size) {
551 TPC.RecordInitialStack();
552 TotalNumberOfRuns++;
553 assert(InFuzzingThread());
554 if (SMR.IsClient())
555 SMR.WriteByteArray(Data, Size);
556 // We copy the contents of Unit into a separate heap buffer
557 // so that we reliably find buffer overflows in it.
558 uint8_t *DataCopy = new uint8_t[Size];
559 memcpy(DataCopy, Data, Size);
560 if (EF->__msan_unpoison)
561 EF->__msan_unpoison(DataCopy, Size);
562 if (CurrentUnitData && CurrentUnitData != Data)
563 memcpy(CurrentUnitData, Data, Size);
564 CurrentUnitSize = Size;
565 {
566 ScopedEnableMsanInterceptorChecks S;
567 AllocTracer.Start(Options.TraceMalloc);
568 UnitStartTime = system_clock::now();
569 TPC.ResetMaps();
570 RunningUserCallback = true;
571 int Res = CB(DataCopy, Size);
572 RunningUserCallback = false;
573 UnitStopTime = system_clock::now();
574 (void)Res;
575 assert(Res == 0);
576 HasMoreMallocsThanFrees = AllocTracer.Stop();
577 }
578 if (!LooseMemeq(DataCopy, Data, Size))
579 CrashOnOverwrittenData();
580 CurrentUnitSize = 0;
581 delete[] DataCopy;
582 }
583
WriteToOutputCorpus(const Unit & U)584 void Fuzzer::WriteToOutputCorpus(const Unit &U) {
585 if (Options.OnlyASCII)
586 assert(IsASCII(U));
587 if (Options.OutputCorpus.empty())
588 return;
589 std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U));
590 WriteToFile(U, Path);
591 if (Options.Verbosity >= 2)
592 Printf("Written %zd bytes to %s\n", U.size(), Path.c_str());
593 }
594
WriteUnitToFileWithPrefix(const Unit & U,const char * Prefix)595 void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) {
596 if (!Options.SaveArtifacts)
597 return;
598 std::string Path = Options.ArtifactPrefix + Prefix + Hash(U);
599 if (!Options.ExactArtifactPath.empty())
600 Path = Options.ExactArtifactPath; // Overrides ArtifactPrefix.
601 WriteToFile(U, Path);
602 Printf("artifact_prefix='%s'; Test unit written to %s\n",
603 Options.ArtifactPrefix.c_str(), Path.c_str());
604 if (U.size() <= kMaxUnitSizeToPrint)
605 Printf("Base64: %s\n", Base64(U).c_str());
606 }
607
PrintStatusForNewUnit(const Unit & U,const char * Text)608 void Fuzzer::PrintStatusForNewUnit(const Unit &U, const char *Text) {
609 if (!Options.PrintNEW)
610 return;
611 PrintStats(Text, "");
612 if (Options.Verbosity) {
613 Printf(" L: %zd/%zd ", U.size(), Corpus.MaxInputSize());
614 MD.PrintMutationSequence();
615 Printf("\n");
616 }
617 }
618
ReportNewCoverage(InputInfo * II,const Unit & U)619 void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) {
620 II->NumSuccessfullMutations++;
621 MD.RecordSuccessfulMutationSequence();
622 PrintStatusForNewUnit(U, II->Reduced ? "REDUCE" : "NEW ");
623 WriteToOutputCorpus(U);
624 NumberOfNewUnitsAdded++;
625 CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus.
626 LastCorpusUpdateRun = TotalNumberOfRuns;
627 }
628
629 // Tries detecting a memory leak on the particular input that we have just
630 // executed before calling this function.
TryDetectingAMemoryLeak(const uint8_t * Data,size_t Size,bool DuringInitialCorpusExecution)631 void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
632 bool DuringInitialCorpusExecution) {
633 if (!HasMoreMallocsThanFrees)
634 return; // mallocs==frees, a leak is unlikely.
635 if (!Options.DetectLeaks)
636 return;
637 if (!DuringInitialCorpusExecution &&
638 TotalNumberOfRuns >= Options.MaxNumberOfRuns)
639 return;
640 if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) ||
641 !(EF->__lsan_do_recoverable_leak_check))
642 return; // No lsan.
643 // Run the target once again, but with lsan disabled so that if there is
644 // a real leak we do not report it twice.
645 EF->__lsan_disable();
646 ExecuteCallback(Data, Size);
647 EF->__lsan_enable();
648 if (!HasMoreMallocsThanFrees)
649 return; // a leak is unlikely.
650 if (NumberOfLeakDetectionAttempts++ > 1000) {
651 Options.DetectLeaks = false;
652 Printf("INFO: libFuzzer disabled leak detection after every mutation.\n"
653 " Most likely the target function accumulates allocated\n"
654 " memory in a global state w/o actually leaking it.\n"
655 " You may try running this binary with -trace_malloc=[12]"
656 " to get a trace of mallocs and frees.\n"
657 " If LeakSanitizer is enabled in this process it will still\n"
658 " run on the process shutdown.\n");
659 return;
660 }
661 // Now perform the actual lsan pass. This is expensive and we must ensure
662 // we don't call it too often.
663 if (EF->__lsan_do_recoverable_leak_check()) { // Leak is found, report it.
664 if (DuringInitialCorpusExecution)
665 Printf("\nINFO: a leak has been found in the initial corpus.\n\n");
666 Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n");
667 CurrentUnitSize = Size;
668 DumpCurrentUnit("leak-");
669 PrintFinalStats();
670 _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on.
671 }
672 }
673
MutateAndTestOne()674 void Fuzzer::MutateAndTestOne() {
675 MD.StartMutationSequence();
676
677 auto &II = Corpus.ChooseUnitToMutate(MD.GetRand());
678 const auto &U = II.U;
679 memcpy(BaseSha1, II.Sha1, sizeof(BaseSha1));
680 assert(CurrentUnitData);
681 size_t Size = U.size();
682 assert(Size <= MaxInputLen && "Oversized Unit");
683 memcpy(CurrentUnitData, U.data(), Size);
684
685 assert(MaxMutationLen > 0);
686
687 size_t CurrentMaxMutationLen =
688 Min(MaxMutationLen, Max(U.size(), TmpMaxMutationLen));
689 assert(CurrentMaxMutationLen > 0);
690
691 for (int i = 0; i < Options.MutateDepth; i++) {
692 if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
693 break;
694 MaybeExitGracefully();
695 size_t NewSize = 0;
696 if (II.HasFocusFunction && !II.DataFlowTraceForFocusFunction.empty() &&
697 Size <= CurrentMaxMutationLen)
698 NewSize = MD.MutateWithMask(CurrentUnitData, Size, Size,
699 II.DataFlowTraceForFocusFunction);
700 else
701 NewSize = MD.Mutate(CurrentUnitData, Size, CurrentMaxMutationLen);
702 assert(NewSize > 0 && "Mutator returned empty unit");
703 assert(NewSize <= CurrentMaxMutationLen && "Mutator return oversized unit");
704 Size = NewSize;
705 II.NumExecutedMutations++;
706
707 bool FoundUniqFeatures = false;
708 bool NewCov = RunOne(CurrentUnitData, Size, /*MayDeleteFile=*/true, &II,
709 &FoundUniqFeatures);
710 TryDetectingAMemoryLeak(CurrentUnitData, Size,
711 /*DuringInitialCorpusExecution*/ false);
712 if (NewCov) {
713 ReportNewCoverage(&II, {CurrentUnitData, CurrentUnitData + Size});
714 break; // We will mutate this input more in the next rounds.
715 }
716 if (Options.ReduceDepth && !FoundUniqFeatures)
717 break;
718 }
719 }
720
PurgeAllocator()721 void Fuzzer::PurgeAllocator() {
722 if (Options.PurgeAllocatorIntervalSec < 0 || !EF->__sanitizer_purge_allocator)
723 return;
724 if (duration_cast<seconds>(system_clock::now() -
725 LastAllocatorPurgeAttemptTime)
726 .count() < Options.PurgeAllocatorIntervalSec)
727 return;
728
729 if (Options.RssLimitMb <= 0 ||
730 GetPeakRSSMb() > static_cast<size_t>(Options.RssLimitMb) / 2)
731 EF->__sanitizer_purge_allocator();
732
733 LastAllocatorPurgeAttemptTime = system_clock::now();
734 }
735
ReadAndExecuteSeedCorpora(const Vector<std::string> & CorpusDirs)736 void Fuzzer::ReadAndExecuteSeedCorpora(const Vector<std::string> &CorpusDirs) {
737 const size_t kMaxSaneLen = 1 << 20;
738 const size_t kMinDefaultLen = 4096;
739 Vector<SizedFile> SizedFiles;
740 size_t MaxSize = 0;
741 size_t MinSize = -1;
742 size_t TotalSize = 0;
743 size_t LastNumFiles = 0;
744 for (auto &Dir : CorpusDirs) {
745 GetSizedFilesFromDir(Dir, &SizedFiles);
746 Printf("INFO: % 8zd files found in %s\n", SizedFiles.size() - LastNumFiles,
747 Dir.c_str());
748 LastNumFiles = SizedFiles.size();
749 }
750 for (auto &File : SizedFiles) {
751 MaxSize = Max(File.Size, MaxSize);
752 MinSize = Min(File.Size, MinSize);
753 TotalSize += File.Size;
754 }
755 if (Options.MaxLen == 0)
756 SetMaxInputLen(std::min(std::max(kMinDefaultLen, MaxSize), kMaxSaneLen));
757 assert(MaxInputLen > 0);
758
759 // Test the callback with empty input and never try it again.
760 uint8_t dummy = 0;
761 ExecuteCallback(&dummy, 0);
762
763 if (SizedFiles.empty()) {
764 Printf("INFO: A corpus is not provided, starting from an empty corpus\n");
765 Unit U({'\n'}); // Valid ASCII input.
766 RunOne(U.data(), U.size());
767 } else {
768 Printf("INFO: seed corpus: files: %zd min: %zdb max: %zdb total: %zdb"
769 " rss: %zdMb\n",
770 SizedFiles.size(), MinSize, MaxSize, TotalSize, GetPeakRSSMb());
771 if (Options.ShuffleAtStartUp)
772 std::shuffle(SizedFiles.begin(), SizedFiles.end(), MD.GetRand());
773
774 if (Options.PreferSmall) {
775 std::stable_sort(SizedFiles.begin(), SizedFiles.end());
776 assert(SizedFiles.front().Size <= SizedFiles.back().Size);
777 }
778
779 // Load and execute inputs one by one.
780 for (auto &SF : SizedFiles) {
781 auto U = FileToVector(SF.File, MaxInputLen, /*ExitOnError=*/false);
782 assert(U.size() <= MaxInputLen);
783 RunOne(U.data(), U.size());
784 CheckExitOnSrcPosOrItem();
785 TryDetectingAMemoryLeak(U.data(), U.size(),
786 /*DuringInitialCorpusExecution*/ true);
787 }
788 }
789
790 PrintStats("INITED");
791 if (!Options.FocusFunction.empty())
792 Printf("INFO: %zd/%zd inputs touch the focus function\n",
793 Corpus.NumInputsThatTouchFocusFunction(), Corpus.size());
794 if (!Options.DataFlowTrace.empty())
795 Printf("INFO: %zd/%zd inputs have the Data Flow Trace\n",
796 Corpus.NumInputsWithDataFlowTrace(), Corpus.size());
797
798 if (Corpus.empty() && Options.MaxNumberOfRuns) {
799 Printf("ERROR: no interesting inputs were found. "
800 "Is the code instrumented for coverage? Exiting.\n");
801 exit(1);
802 }
803 }
804
Loop(const Vector<std::string> & CorpusDirs)805 void Fuzzer::Loop(const Vector<std::string> &CorpusDirs) {
806 ReadAndExecuteSeedCorpora(CorpusDirs);
807 DFT.Clear(); // No need for DFT any more.
808 TPC.SetPrintNewPCs(Options.PrintNewCovPcs);
809 TPC.SetPrintNewFuncs(Options.PrintNewCovFuncs);
810 system_clock::time_point LastCorpusReload = system_clock::now();
811 if (Options.DoCrossOver)
812 MD.SetCorpus(&Corpus);
813 while (true) {
814 auto Now = system_clock::now();
815 if (duration_cast<seconds>(Now - LastCorpusReload).count() >=
816 Options.ReloadIntervalSec) {
817 RereadOutputCorpus(MaxInputLen);
818 LastCorpusReload = system_clock::now();
819 }
820 if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
821 break;
822 if (TimedOut())
823 break;
824
825 // Update TmpMaxMutationLen
826 if (Options.LenControl) {
827 if (TmpMaxMutationLen < MaxMutationLen &&
828 TotalNumberOfRuns - LastCorpusUpdateRun >
829 Options.LenControl * Log(TmpMaxMutationLen)) {
830 TmpMaxMutationLen =
831 Min(MaxMutationLen, TmpMaxMutationLen + Log(TmpMaxMutationLen));
832 LastCorpusUpdateRun = TotalNumberOfRuns;
833 }
834 } else {
835 TmpMaxMutationLen = MaxMutationLen;
836 }
837
838 // Perform several mutations and runs.
839 MutateAndTestOne();
840
841 PurgeAllocator();
842 }
843
844 PrintStats("DONE ", "\n");
845 MD.PrintRecommendedDictionary();
846 }
847
MinimizeCrashLoop(const Unit & U)848 void Fuzzer::MinimizeCrashLoop(const Unit &U) {
849 if (U.size() <= 1)
850 return;
851 while (!TimedOut() && TotalNumberOfRuns < Options.MaxNumberOfRuns) {
852 MD.StartMutationSequence();
853 memcpy(CurrentUnitData, U.data(), U.size());
854 for (int i = 0; i < Options.MutateDepth; i++) {
855 size_t NewSize = MD.Mutate(CurrentUnitData, U.size(), MaxMutationLen);
856 assert(NewSize > 0 && NewSize <= MaxMutationLen);
857 ExecuteCallback(CurrentUnitData, NewSize);
858 PrintPulseAndReportSlowInput(CurrentUnitData, NewSize);
859 TryDetectingAMemoryLeak(CurrentUnitData, NewSize,
860 /*DuringInitialCorpusExecution*/ false);
861 }
862 }
863 }
864
AnnounceOutput(const uint8_t * Data,size_t Size)865 void Fuzzer::AnnounceOutput(const uint8_t *Data, size_t Size) {
866 if (SMR.IsServer()) {
867 SMR.WriteByteArray(Data, Size);
868 } else if (SMR.IsClient()) {
869 SMR.PostClient();
870 SMR.WaitServer();
871 size_t OtherSize = SMR.ReadByteArraySize();
872 uint8_t *OtherData = SMR.GetByteArray();
873 if (Size != OtherSize || memcmp(Data, OtherData, Size) != 0) {
874 size_t i = 0;
875 for (i = 0; i < Min(Size, OtherSize); i++)
876 if (Data[i] != OtherData[i])
877 break;
878 Printf("==%lu== ERROR: libFuzzer: equivalence-mismatch. Sizes: %zd %zd; "
879 "offset %zd\n",
880 GetPid(), Size, OtherSize, i);
881 DumpCurrentUnit("mismatch-");
882 Printf("SUMMARY: libFuzzer: equivalence-mismatch\n");
883 PrintFinalStats();
884 _Exit(Options.ErrorExitCode);
885 }
886 }
887 }
888
889 } // namespace fuzzer
890
891 extern "C" {
892
893 __attribute__((visibility("default"))) size_t
LLVMFuzzerMutate(uint8_t * Data,size_t Size,size_t MaxSize)894 LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
895 assert(fuzzer::F);
896 return fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize);
897 }
898
899 // Experimental
900 __attribute__((visibility("default"))) void
LLVMFuzzerAnnounceOutput(const uint8_t * Data,size_t Size)901 LLVMFuzzerAnnounceOutput(const uint8_t *Data, size_t Size) {
902 assert(fuzzer::F);
903 fuzzer::F->AnnounceOutput(Data, Size);
904 }
905 } // extern "C"
906