1 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 2 // See https://llvm.org/LICENSE.txt for license information. 3 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 4 5 // Avoid ODR violations (LibFuzzer is built without ASan and this test is built 6 // with ASan) involving C++ standard library types when using libcxx. 7 #define _LIBCPP_HAS_NO_ASAN 8 9 // Do not attempt to use LLVM ostream from gtest. 10 #define GTEST_NO_LLVM_RAW_OSTREAM 1 11 12 #include "FuzzerCorpus.h" 13 #include "FuzzerDictionary.h" 14 #include "FuzzerInternal.h" 15 #include "FuzzerMerge.h" 16 #include "FuzzerMutate.h" 17 #include "FuzzerRandom.h" 18 #include "FuzzerTracePC.h" 19 #include "gtest/gtest.h" 20 #include <memory> 21 #include <set> 22 #include <sstream> 23 24 using namespace fuzzer; 25 26 // For now, have LLVMFuzzerTestOneInput just to make it link. 27 // Later we may want to make unittests that actually call LLVMFuzzerTestOneInput. 28 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { 29 abort(); 30 } 31 32 TEST(Fuzzer, Basename) { 33 EXPECT_EQ(Basename("foo/bar"), "bar"); 34 EXPECT_EQ(Basename("bar"), "bar"); 35 EXPECT_EQ(Basename("/bar"), "bar"); 36 EXPECT_EQ(Basename("foo/x"), "x"); 37 EXPECT_EQ(Basename("foo/"), ""); 38 #if LIBFUZZER_WINDOWS 39 EXPECT_EQ(Basename("foo\\bar"), "bar"); 40 EXPECT_EQ(Basename("foo\\bar/baz"), "baz"); 41 EXPECT_EQ(Basename("\\bar"), "bar"); 42 EXPECT_EQ(Basename("foo\\x"), "x"); 43 EXPECT_EQ(Basename("foo\\"), ""); 44 #endif 45 } 46 47 TEST(Fuzzer, CrossOver) { 48 std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); 49 fuzzer::EF = t.get(); 50 Random Rand(0); 51 std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); 52 Unit A({0, 1, 2}), B({5, 6, 7}); 53 Unit C; 54 Unit Expected[] = { 55 { 0 }, 56 { 0, 1 }, 57 { 0, 5 }, 58 { 0, 1, 2 }, 59 { 0, 1, 5 }, 60 { 0, 5, 1 }, 61 { 0, 5, 6 }, 62 { 0, 1, 2, 5 }, 63 { 0, 1, 5, 2 }, 64 { 0, 1, 5, 6 }, 65 { 0, 5, 1, 2 }, 66 { 0, 5, 1, 6 }, 67 { 0, 5, 6, 1 }, 68 { 0, 5, 6, 7 }, 69 { 0, 1, 2, 5, 6 }, 70 { 0, 1, 5, 2, 6 }, 71 { 0, 1, 5, 6, 2 }, 72 { 0, 1, 5, 6, 7 }, 73 { 0, 5, 1, 2, 6 }, 74 { 0, 5, 1, 6, 2 }, 75 { 0, 5, 1, 6, 7 }, 76 { 0, 5, 6, 1, 2 }, 77 { 0, 5, 6, 1, 7 }, 78 { 0, 5, 6, 7, 1 }, 79 { 0, 1, 2, 5, 6, 7 }, 80 { 0, 1, 5, 2, 6, 7 }, 81 { 0, 1, 5, 6, 2, 7 }, 82 { 0, 1, 5, 6, 7, 2 }, 83 { 0, 5, 1, 2, 6, 7 }, 84 { 0, 5, 1, 6, 2, 7 }, 85 { 0, 5, 1, 6, 7, 2 }, 86 { 0, 5, 6, 1, 2, 7 }, 87 { 0, 5, 6, 1, 7, 2 }, 88 { 0, 5, 6, 7, 1, 2 } 89 }; 90 for (size_t Len = 1; Len < 8; Len++) { 91 Set<Unit> FoundUnits, ExpectedUnitsWitThisLength; 92 for (int Iter = 0; Iter < 3000; Iter++) { 93 C.resize(Len); 94 size_t NewSize = MD->CrossOver(A.data(), A.size(), B.data(), B.size(), 95 C.data(), C.size()); 96 C.resize(NewSize); 97 FoundUnits.insert(C); 98 } 99 for (const Unit &U : Expected) 100 if (U.size() <= Len) 101 ExpectedUnitsWitThisLength.insert(U); 102 EXPECT_EQ(ExpectedUnitsWitThisLength, FoundUnits); 103 } 104 } 105 106 TEST(Fuzzer, Hash) { 107 uint8_t A[] = {'a', 'b', 'c'}; 108 fuzzer::Unit U(A, A + sizeof(A)); 109 EXPECT_EQ("a9993e364706816aba3e25717850c26c9cd0d89d", fuzzer::Hash(U)); 110 U.push_back('d'); 111 EXPECT_EQ("81fe8bfe87576c3ecb22426f8e57847382917acf", fuzzer::Hash(U)); 112 } 113 114 typedef size_t (MutationDispatcher::*Mutator)(uint8_t *Data, size_t Size, 115 size_t MaxSize); 116 117 void TestEraseBytes(Mutator M, int NumIter) { 118 std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); 119 fuzzer::EF = t.get(); 120 uint8_t REM0[8] = {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; 121 uint8_t REM1[8] = {0x00, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; 122 uint8_t REM2[8] = {0x00, 0x11, 0x33, 0x44, 0x55, 0x66, 0x77}; 123 uint8_t REM3[8] = {0x00, 0x11, 0x22, 0x44, 0x55, 0x66, 0x77}; 124 uint8_t REM4[8] = {0x00, 0x11, 0x22, 0x33, 0x55, 0x66, 0x77}; 125 uint8_t REM5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x66, 0x77}; 126 uint8_t REM6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x77}; 127 uint8_t REM7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; 128 129 uint8_t REM8[6] = {0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; 130 uint8_t REM9[6] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55}; 131 uint8_t REM10[6] = {0x00, 0x11, 0x22, 0x55, 0x66, 0x77}; 132 133 uint8_t REM11[5] = {0x33, 0x44, 0x55, 0x66, 0x77}; 134 uint8_t REM12[5] = {0x00, 0x11, 0x22, 0x33, 0x44}; 135 uint8_t REM13[5] = {0x00, 0x44, 0x55, 0x66, 0x77}; 136 137 138 Random Rand(0); 139 std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); 140 int FoundMask = 0; 141 for (int i = 0; i < NumIter; i++) { 142 uint8_t T[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; 143 size_t NewSize = (*MD.*M)(T, sizeof(T), sizeof(T)); 144 if (NewSize == 7 && !memcmp(REM0, T, 7)) FoundMask |= 1 << 0; 145 if (NewSize == 7 && !memcmp(REM1, T, 7)) FoundMask |= 1 << 1; 146 if (NewSize == 7 && !memcmp(REM2, T, 7)) FoundMask |= 1 << 2; 147 if (NewSize == 7 && !memcmp(REM3, T, 7)) FoundMask |= 1 << 3; 148 if (NewSize == 7 && !memcmp(REM4, T, 7)) FoundMask |= 1 << 4; 149 if (NewSize == 7 && !memcmp(REM5, T, 7)) FoundMask |= 1 << 5; 150 if (NewSize == 7 && !memcmp(REM6, T, 7)) FoundMask |= 1 << 6; 151 if (NewSize == 7 && !memcmp(REM7, T, 7)) FoundMask |= 1 << 7; 152 153 if (NewSize == 6 && !memcmp(REM8, T, 6)) FoundMask |= 1 << 8; 154 if (NewSize == 6 && !memcmp(REM9, T, 6)) FoundMask |= 1 << 9; 155 if (NewSize == 6 && !memcmp(REM10, T, 6)) FoundMask |= 1 << 10; 156 157 if (NewSize == 5 && !memcmp(REM11, T, 5)) FoundMask |= 1 << 11; 158 if (NewSize == 5 && !memcmp(REM12, T, 5)) FoundMask |= 1 << 12; 159 if (NewSize == 5 && !memcmp(REM13, T, 5)) FoundMask |= 1 << 13; 160 } 161 EXPECT_EQ(FoundMask, (1 << 14) - 1); 162 } 163 164 TEST(FuzzerMutate, EraseBytes1) { 165 TestEraseBytes(&MutationDispatcher::Mutate_EraseBytes, 200); 166 } 167 TEST(FuzzerMutate, EraseBytes2) { 168 TestEraseBytes(&MutationDispatcher::Mutate, 2000); 169 } 170 171 void TestInsertByte(Mutator M, int NumIter) { 172 std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); 173 fuzzer::EF = t.get(); 174 Random Rand(0); 175 std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); 176 int FoundMask = 0; 177 uint8_t INS0[8] = {0xF1, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; 178 uint8_t INS1[8] = {0x00, 0xF2, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; 179 uint8_t INS2[8] = {0x00, 0x11, 0xF3, 0x22, 0x33, 0x44, 0x55, 0x66}; 180 uint8_t INS3[8] = {0x00, 0x11, 0x22, 0xF4, 0x33, 0x44, 0x55, 0x66}; 181 uint8_t INS4[8] = {0x00, 0x11, 0x22, 0x33, 0xF5, 0x44, 0x55, 0x66}; 182 uint8_t INS5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0xF6, 0x55, 0x66}; 183 uint8_t INS6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0xF7, 0x66}; 184 uint8_t INS7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xF8}; 185 for (int i = 0; i < NumIter; i++) { 186 uint8_t T[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; 187 size_t NewSize = (*MD.*M)(T, 7, 8); 188 if (NewSize == 8 && !memcmp(INS0, T, 8)) FoundMask |= 1 << 0; 189 if (NewSize == 8 && !memcmp(INS1, T, 8)) FoundMask |= 1 << 1; 190 if (NewSize == 8 && !memcmp(INS2, T, 8)) FoundMask |= 1 << 2; 191 if (NewSize == 8 && !memcmp(INS3, T, 8)) FoundMask |= 1 << 3; 192 if (NewSize == 8 && !memcmp(INS4, T, 8)) FoundMask |= 1 << 4; 193 if (NewSize == 8 && !memcmp(INS5, T, 8)) FoundMask |= 1 << 5; 194 if (NewSize == 8 && !memcmp(INS6, T, 8)) FoundMask |= 1 << 6; 195 if (NewSize == 8 && !memcmp(INS7, T, 8)) FoundMask |= 1 << 7; 196 } 197 EXPECT_EQ(FoundMask, 255); 198 } 199 200 TEST(FuzzerMutate, InsertByte1) { 201 TestInsertByte(&MutationDispatcher::Mutate_InsertByte, 1 << 15); 202 } 203 TEST(FuzzerMutate, InsertByte2) { 204 TestInsertByte(&MutationDispatcher::Mutate, 1 << 17); 205 } 206 207 void TestInsertRepeatedBytes(Mutator M, int NumIter) { 208 std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); 209 fuzzer::EF = t.get(); 210 Random Rand(0); 211 std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); 212 int FoundMask = 0; 213 uint8_t INS0[7] = {0x00, 0x11, 0x22, 0x33, 'a', 'a', 'a'}; 214 uint8_t INS1[7] = {0x00, 0x11, 0x22, 'a', 'a', 'a', 0x33}; 215 uint8_t INS2[7] = {0x00, 0x11, 'a', 'a', 'a', 0x22, 0x33}; 216 uint8_t INS3[7] = {0x00, 'a', 'a', 'a', 0x11, 0x22, 0x33}; 217 uint8_t INS4[7] = {'a', 'a', 'a', 0x00, 0x11, 0x22, 0x33}; 218 219 uint8_t INS5[8] = {0x00, 0x11, 0x22, 0x33, 'b', 'b', 'b', 'b'}; 220 uint8_t INS6[8] = {0x00, 0x11, 0x22, 'b', 'b', 'b', 'b', 0x33}; 221 uint8_t INS7[8] = {0x00, 0x11, 'b', 'b', 'b', 'b', 0x22, 0x33}; 222 uint8_t INS8[8] = {0x00, 'b', 'b', 'b', 'b', 0x11, 0x22, 0x33}; 223 uint8_t INS9[8] = {'b', 'b', 'b', 'b', 0x00, 0x11, 0x22, 0x33}; 224 225 for (int i = 0; i < NumIter; i++) { 226 uint8_t T[8] = {0x00, 0x11, 0x22, 0x33}; 227 size_t NewSize = (*MD.*M)(T, 4, 8); 228 if (NewSize == 7 && !memcmp(INS0, T, 7)) FoundMask |= 1 << 0; 229 if (NewSize == 7 && !memcmp(INS1, T, 7)) FoundMask |= 1 << 1; 230 if (NewSize == 7 && !memcmp(INS2, T, 7)) FoundMask |= 1 << 2; 231 if (NewSize == 7 && !memcmp(INS3, T, 7)) FoundMask |= 1 << 3; 232 if (NewSize == 7 && !memcmp(INS4, T, 7)) FoundMask |= 1 << 4; 233 234 if (NewSize == 8 && !memcmp(INS5, T, 8)) FoundMask |= 1 << 5; 235 if (NewSize == 8 && !memcmp(INS6, T, 8)) FoundMask |= 1 << 6; 236 if (NewSize == 8 && !memcmp(INS7, T, 8)) FoundMask |= 1 << 7; 237 if (NewSize == 8 && !memcmp(INS8, T, 8)) FoundMask |= 1 << 8; 238 if (NewSize == 8 && !memcmp(INS9, T, 8)) FoundMask |= 1 << 9; 239 240 } 241 EXPECT_EQ(FoundMask, (1 << 10) - 1); 242 } 243 244 TEST(FuzzerMutate, InsertRepeatedBytes1) { 245 TestInsertRepeatedBytes(&MutationDispatcher::Mutate_InsertRepeatedBytes, 10000); 246 } 247 TEST(FuzzerMutate, InsertRepeatedBytes2) { 248 TestInsertRepeatedBytes(&MutationDispatcher::Mutate, 300000); 249 } 250 251 void TestChangeByte(Mutator M, int NumIter) { 252 std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); 253 fuzzer::EF = t.get(); 254 Random Rand(0); 255 std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); 256 int FoundMask = 0; 257 uint8_t CH0[8] = {0xF0, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; 258 uint8_t CH1[8] = {0x00, 0xF1, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; 259 uint8_t CH2[8] = {0x00, 0x11, 0xF2, 0x33, 0x44, 0x55, 0x66, 0x77}; 260 uint8_t CH3[8] = {0x00, 0x11, 0x22, 0xF3, 0x44, 0x55, 0x66, 0x77}; 261 uint8_t CH4[8] = {0x00, 0x11, 0x22, 0x33, 0xF4, 0x55, 0x66, 0x77}; 262 uint8_t CH5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0xF5, 0x66, 0x77}; 263 uint8_t CH6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0xF5, 0x77}; 264 uint8_t CH7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xF7}; 265 for (int i = 0; i < NumIter; i++) { 266 uint8_t T[9] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; 267 size_t NewSize = (*MD.*M)(T, 8, 9); 268 if (NewSize == 8 && !memcmp(CH0, T, 8)) FoundMask |= 1 << 0; 269 if (NewSize == 8 && !memcmp(CH1, T, 8)) FoundMask |= 1 << 1; 270 if (NewSize == 8 && !memcmp(CH2, T, 8)) FoundMask |= 1 << 2; 271 if (NewSize == 8 && !memcmp(CH3, T, 8)) FoundMask |= 1 << 3; 272 if (NewSize == 8 && !memcmp(CH4, T, 8)) FoundMask |= 1 << 4; 273 if (NewSize == 8 && !memcmp(CH5, T, 8)) FoundMask |= 1 << 5; 274 if (NewSize == 8 && !memcmp(CH6, T, 8)) FoundMask |= 1 << 6; 275 if (NewSize == 8 && !memcmp(CH7, T, 8)) FoundMask |= 1 << 7; 276 } 277 EXPECT_EQ(FoundMask, 255); 278 } 279 280 TEST(FuzzerMutate, ChangeByte1) { 281 TestChangeByte(&MutationDispatcher::Mutate_ChangeByte, 1 << 15); 282 } 283 TEST(FuzzerMutate, ChangeByte2) { 284 TestChangeByte(&MutationDispatcher::Mutate, 1 << 17); 285 } 286 287 void TestChangeBit(Mutator M, int NumIter) { 288 std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); 289 fuzzer::EF = t.get(); 290 Random Rand(0); 291 std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); 292 int FoundMask = 0; 293 uint8_t CH0[8] = {0x01, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; 294 uint8_t CH1[8] = {0x00, 0x13, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; 295 uint8_t CH2[8] = {0x00, 0x11, 0x02, 0x33, 0x44, 0x55, 0x66, 0x77}; 296 uint8_t CH3[8] = {0x00, 0x11, 0x22, 0x37, 0x44, 0x55, 0x66, 0x77}; 297 uint8_t CH4[8] = {0x00, 0x11, 0x22, 0x33, 0x54, 0x55, 0x66, 0x77}; 298 uint8_t CH5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x54, 0x66, 0x77}; 299 uint8_t CH6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x76, 0x77}; 300 uint8_t CH7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xF7}; 301 for (int i = 0; i < NumIter; i++) { 302 uint8_t T[9] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; 303 size_t NewSize = (*MD.*M)(T, 8, 9); 304 if (NewSize == 8 && !memcmp(CH0, T, 8)) FoundMask |= 1 << 0; 305 if (NewSize == 8 && !memcmp(CH1, T, 8)) FoundMask |= 1 << 1; 306 if (NewSize == 8 && !memcmp(CH2, T, 8)) FoundMask |= 1 << 2; 307 if (NewSize == 8 && !memcmp(CH3, T, 8)) FoundMask |= 1 << 3; 308 if (NewSize == 8 && !memcmp(CH4, T, 8)) FoundMask |= 1 << 4; 309 if (NewSize == 8 && !memcmp(CH5, T, 8)) FoundMask |= 1 << 5; 310 if (NewSize == 8 && !memcmp(CH6, T, 8)) FoundMask |= 1 << 6; 311 if (NewSize == 8 && !memcmp(CH7, T, 8)) FoundMask |= 1 << 7; 312 } 313 EXPECT_EQ(FoundMask, 255); 314 } 315 316 TEST(FuzzerMutate, ChangeBit1) { 317 TestChangeBit(&MutationDispatcher::Mutate_ChangeBit, 1 << 16); 318 } 319 TEST(FuzzerMutate, ChangeBit2) { 320 TestChangeBit(&MutationDispatcher::Mutate, 1 << 18); 321 } 322 323 void TestShuffleBytes(Mutator M, int NumIter) { 324 std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); 325 fuzzer::EF = t.get(); 326 Random Rand(0); 327 std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); 328 int FoundMask = 0; 329 uint8_t CH0[7] = {0x00, 0x22, 0x11, 0x33, 0x44, 0x55, 0x66}; 330 uint8_t CH1[7] = {0x11, 0x00, 0x33, 0x22, 0x44, 0x55, 0x66}; 331 uint8_t CH2[7] = {0x00, 0x33, 0x11, 0x22, 0x44, 0x55, 0x66}; 332 uint8_t CH3[7] = {0x00, 0x11, 0x22, 0x44, 0x55, 0x66, 0x33}; 333 uint8_t CH4[7] = {0x00, 0x11, 0x22, 0x33, 0x55, 0x44, 0x66}; 334 for (int i = 0; i < NumIter; i++) { 335 uint8_t T[7] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; 336 size_t NewSize = (*MD.*M)(T, 7, 7); 337 if (NewSize == 7 && !memcmp(CH0, T, 7)) FoundMask |= 1 << 0; 338 if (NewSize == 7 && !memcmp(CH1, T, 7)) FoundMask |= 1 << 1; 339 if (NewSize == 7 && !memcmp(CH2, T, 7)) FoundMask |= 1 << 2; 340 if (NewSize == 7 && !memcmp(CH3, T, 7)) FoundMask |= 1 << 3; 341 if (NewSize == 7 && !memcmp(CH4, T, 7)) FoundMask |= 1 << 4; 342 } 343 EXPECT_EQ(FoundMask, 31); 344 } 345 346 TEST(FuzzerMutate, ShuffleBytes1) { 347 TestShuffleBytes(&MutationDispatcher::Mutate_ShuffleBytes, 1 << 17); 348 } 349 TEST(FuzzerMutate, ShuffleBytes2) { 350 TestShuffleBytes(&MutationDispatcher::Mutate, 1 << 20); 351 } 352 353 void TestCopyPart(Mutator M, int NumIter) { 354 std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); 355 fuzzer::EF = t.get(); 356 Random Rand(0); 357 std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); 358 int FoundMask = 0; 359 uint8_t CH0[7] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x00, 0x11}; 360 uint8_t CH1[7] = {0x55, 0x66, 0x22, 0x33, 0x44, 0x55, 0x66}; 361 uint8_t CH2[7] = {0x00, 0x55, 0x66, 0x33, 0x44, 0x55, 0x66}; 362 uint8_t CH3[7] = {0x00, 0x11, 0x22, 0x00, 0x11, 0x22, 0x66}; 363 uint8_t CH4[7] = {0x00, 0x11, 0x11, 0x22, 0x33, 0x55, 0x66}; 364 365 for (int i = 0; i < NumIter; i++) { 366 uint8_t T[7] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; 367 size_t NewSize = (*MD.*M)(T, 7, 7); 368 if (NewSize == 7 && !memcmp(CH0, T, 7)) FoundMask |= 1 << 0; 369 if (NewSize == 7 && !memcmp(CH1, T, 7)) FoundMask |= 1 << 1; 370 if (NewSize == 7 && !memcmp(CH2, T, 7)) FoundMask |= 1 << 2; 371 if (NewSize == 7 && !memcmp(CH3, T, 7)) FoundMask |= 1 << 3; 372 if (NewSize == 7 && !memcmp(CH4, T, 7)) FoundMask |= 1 << 4; 373 } 374 375 uint8_t CH5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x00, 0x11, 0x22}; 376 uint8_t CH6[8] = {0x22, 0x33, 0x44, 0x00, 0x11, 0x22, 0x33, 0x44}; 377 uint8_t CH7[8] = {0x00, 0x11, 0x22, 0x00, 0x11, 0x22, 0x33, 0x44}; 378 uint8_t CH8[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x22, 0x33, 0x44}; 379 uint8_t CH9[8] = {0x00, 0x11, 0x22, 0x22, 0x33, 0x44, 0x33, 0x44}; 380 381 for (int i = 0; i < NumIter; i++) { 382 uint8_t T[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; 383 size_t NewSize = (*MD.*M)(T, 5, 8); 384 if (NewSize == 8 && !memcmp(CH5, T, 8)) FoundMask |= 1 << 5; 385 if (NewSize == 8 && !memcmp(CH6, T, 8)) FoundMask |= 1 << 6; 386 if (NewSize == 8 && !memcmp(CH7, T, 8)) FoundMask |= 1 << 7; 387 if (NewSize == 8 && !memcmp(CH8, T, 8)) FoundMask |= 1 << 8; 388 if (NewSize == 8 && !memcmp(CH9, T, 8)) FoundMask |= 1 << 9; 389 } 390 391 EXPECT_EQ(FoundMask, 1023); 392 } 393 394 TEST(FuzzerMutate, CopyPart1) { 395 TestCopyPart(&MutationDispatcher::Mutate_CopyPart, 1 << 10); 396 } 397 TEST(FuzzerMutate, CopyPart2) { 398 TestCopyPart(&MutationDispatcher::Mutate, 1 << 13); 399 } 400 TEST(FuzzerMutate, CopyPartNoInsertAtMaxSize) { 401 // This (non exhaustively) tests if `Mutate_CopyPart` tries to perform an 402 // insert on an input of size `MaxSize`. Performing an insert in this case 403 // will lead to the mutation failing. 404 std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); 405 fuzzer::EF = t.get(); 406 Random Rand(0); 407 std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); 408 uint8_t Data[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x00, 0x11, 0x22}; 409 size_t MaxSize = sizeof(Data); 410 for (int count = 0; count < (1 << 18); ++count) { 411 size_t NewSize = MD->Mutate_CopyPart(Data, MaxSize, MaxSize); 412 ASSERT_EQ(NewSize, MaxSize); 413 } 414 } 415 416 void TestAddWordFromDictionary(Mutator M, int NumIter) { 417 std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); 418 fuzzer::EF = t.get(); 419 Random Rand(0); 420 std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); 421 uint8_t Word1[4] = {0xAA, 0xBB, 0xCC, 0xDD}; 422 uint8_t Word2[3] = {0xFF, 0xEE, 0xEF}; 423 MD->AddWordToManualDictionary(Word(Word1, sizeof(Word1))); 424 MD->AddWordToManualDictionary(Word(Word2, sizeof(Word2))); 425 int FoundMask = 0; 426 uint8_t CH0[7] = {0x00, 0x11, 0x22, 0xAA, 0xBB, 0xCC, 0xDD}; 427 uint8_t CH1[7] = {0x00, 0x11, 0xAA, 0xBB, 0xCC, 0xDD, 0x22}; 428 uint8_t CH2[7] = {0x00, 0xAA, 0xBB, 0xCC, 0xDD, 0x11, 0x22}; 429 uint8_t CH3[7] = {0xAA, 0xBB, 0xCC, 0xDD, 0x00, 0x11, 0x22}; 430 uint8_t CH4[6] = {0x00, 0x11, 0x22, 0xFF, 0xEE, 0xEF}; 431 uint8_t CH5[6] = {0x00, 0x11, 0xFF, 0xEE, 0xEF, 0x22}; 432 uint8_t CH6[6] = {0x00, 0xFF, 0xEE, 0xEF, 0x11, 0x22}; 433 uint8_t CH7[6] = {0xFF, 0xEE, 0xEF, 0x00, 0x11, 0x22}; 434 for (int i = 0; i < NumIter; i++) { 435 uint8_t T[7] = {0x00, 0x11, 0x22}; 436 size_t NewSize = (*MD.*M)(T, 3, 7); 437 if (NewSize == 7 && !memcmp(CH0, T, 7)) FoundMask |= 1 << 0; 438 if (NewSize == 7 && !memcmp(CH1, T, 7)) FoundMask |= 1 << 1; 439 if (NewSize == 7 && !memcmp(CH2, T, 7)) FoundMask |= 1 << 2; 440 if (NewSize == 7 && !memcmp(CH3, T, 7)) FoundMask |= 1 << 3; 441 if (NewSize == 6 && !memcmp(CH4, T, 6)) FoundMask |= 1 << 4; 442 if (NewSize == 6 && !memcmp(CH5, T, 6)) FoundMask |= 1 << 5; 443 if (NewSize == 6 && !memcmp(CH6, T, 6)) FoundMask |= 1 << 6; 444 if (NewSize == 6 && !memcmp(CH7, T, 6)) FoundMask |= 1 << 7; 445 } 446 EXPECT_EQ(FoundMask, 255); 447 } 448 449 TEST(FuzzerMutate, AddWordFromDictionary1) { 450 TestAddWordFromDictionary( 451 &MutationDispatcher::Mutate_AddWordFromManualDictionary, 1 << 15); 452 } 453 454 TEST(FuzzerMutate, AddWordFromDictionary2) { 455 TestAddWordFromDictionary(&MutationDispatcher::Mutate, 1 << 15); 456 } 457 458 void TestChangeASCIIInteger(Mutator M, int NumIter) { 459 std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); 460 fuzzer::EF = t.get(); 461 Random Rand(0); 462 std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); 463 464 uint8_t CH0[8] = {'1', '2', '3', '4', '5', '6', '7', '7'}; 465 uint8_t CH1[8] = {'1', '2', '3', '4', '5', '6', '7', '9'}; 466 uint8_t CH2[8] = {'2', '4', '6', '9', '1', '3', '5', '6'}; 467 uint8_t CH3[8] = {'0', '6', '1', '7', '2', '8', '3', '9'}; 468 int FoundMask = 0; 469 for (int i = 0; i < NumIter; i++) { 470 uint8_t T[8] = {'1', '2', '3', '4', '5', '6', '7', '8'}; 471 size_t NewSize = (*MD.*M)(T, 8, 8); 472 /**/ if (NewSize == 8 && !memcmp(CH0, T, 8)) FoundMask |= 1 << 0; 473 else if (NewSize == 8 && !memcmp(CH1, T, 8)) FoundMask |= 1 << 1; 474 else if (NewSize == 8 && !memcmp(CH2, T, 8)) FoundMask |= 1 << 2; 475 else if (NewSize == 8 && !memcmp(CH3, T, 8)) FoundMask |= 1 << 3; 476 else if (NewSize == 8) FoundMask |= 1 << 4; 477 } 478 EXPECT_EQ(FoundMask, 31); 479 } 480 481 TEST(FuzzerMutate, ChangeASCIIInteger1) { 482 TestChangeASCIIInteger(&MutationDispatcher::Mutate_ChangeASCIIInteger, 483 1 << 15); 484 } 485 486 TEST(FuzzerMutate, ChangeASCIIInteger2) { 487 TestChangeASCIIInteger(&MutationDispatcher::Mutate, 1 << 15); 488 } 489 490 void TestChangeBinaryInteger(Mutator M, int NumIter) { 491 std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); 492 fuzzer::EF = t.get(); 493 Random Rand(0); 494 std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); 495 496 uint8_t CH0[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x79}; 497 uint8_t CH1[8] = {0x00, 0x11, 0x22, 0x31, 0x44, 0x55, 0x66, 0x77}; 498 uint8_t CH2[8] = {0xff, 0x10, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; 499 uint8_t CH3[8] = {0x00, 0x11, 0x2a, 0x33, 0x44, 0x55, 0x66, 0x77}; 500 uint8_t CH4[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x4f, 0x66, 0x77}; 501 uint8_t CH5[8] = {0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99, 0x88}; 502 uint8_t CH6[8] = {0x00, 0x11, 0x22, 0x00, 0x00, 0x00, 0x08, 0x77}; // Size 503 uint8_t CH7[8] = {0x00, 0x08, 0x00, 0x33, 0x44, 0x55, 0x66, 0x77}; // Sw(Size) 504 505 int FoundMask = 0; 506 for (int i = 0; i < NumIter; i++) { 507 uint8_t T[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; 508 size_t NewSize = (*MD.*M)(T, 8, 8); 509 /**/ if (NewSize == 8 && !memcmp(CH0, T, 8)) FoundMask |= 1 << 0; 510 else if (NewSize == 8 && !memcmp(CH1, T, 8)) FoundMask |= 1 << 1; 511 else if (NewSize == 8 && !memcmp(CH2, T, 8)) FoundMask |= 1 << 2; 512 else if (NewSize == 8 && !memcmp(CH3, T, 8)) FoundMask |= 1 << 3; 513 else if (NewSize == 8 && !memcmp(CH4, T, 8)) FoundMask |= 1 << 4; 514 else if (NewSize == 8 && !memcmp(CH5, T, 8)) FoundMask |= 1 << 5; 515 else if (NewSize == 8 && !memcmp(CH6, T, 8)) FoundMask |= 1 << 6; 516 else if (NewSize == 8 && !memcmp(CH7, T, 8)) FoundMask |= 1 << 7; 517 } 518 EXPECT_EQ(FoundMask, 255); 519 } 520 521 TEST(FuzzerMutate, ChangeBinaryInteger1) { 522 TestChangeBinaryInteger(&MutationDispatcher::Mutate_ChangeBinaryInteger, 523 1 << 12); 524 } 525 526 TEST(FuzzerMutate, ChangeBinaryInteger2) { 527 TestChangeBinaryInteger(&MutationDispatcher::Mutate, 1 << 15); 528 } 529 530 531 TEST(FuzzerDictionary, ParseOneDictionaryEntry) { 532 Unit U; 533 EXPECT_FALSE(ParseOneDictionaryEntry("", &U)); 534 EXPECT_FALSE(ParseOneDictionaryEntry(" ", &U)); 535 EXPECT_FALSE(ParseOneDictionaryEntry("\t ", &U)); 536 EXPECT_FALSE(ParseOneDictionaryEntry(" \" ", &U)); 537 EXPECT_FALSE(ParseOneDictionaryEntry(" zz\" ", &U)); 538 EXPECT_FALSE(ParseOneDictionaryEntry(" \"zz ", &U)); 539 EXPECT_FALSE(ParseOneDictionaryEntry(" \"\" ", &U)); 540 EXPECT_TRUE(ParseOneDictionaryEntry("\"a\"", &U)); 541 EXPECT_EQ(U, Unit({'a'})); 542 EXPECT_TRUE(ParseOneDictionaryEntry("\"abc\"", &U)); 543 EXPECT_EQ(U, Unit({'a', 'b', 'c'})); 544 EXPECT_TRUE(ParseOneDictionaryEntry("abc=\"abc\"", &U)); 545 EXPECT_EQ(U, Unit({'a', 'b', 'c'})); 546 EXPECT_FALSE(ParseOneDictionaryEntry("\"\\\"", &U)); 547 EXPECT_TRUE(ParseOneDictionaryEntry("\"\\\\\"", &U)); 548 EXPECT_EQ(U, Unit({'\\'})); 549 EXPECT_TRUE(ParseOneDictionaryEntry("\"\\xAB\"", &U)); 550 EXPECT_EQ(U, Unit({0xAB})); 551 EXPECT_TRUE(ParseOneDictionaryEntry("\"\\xABz\\xDE\"", &U)); 552 EXPECT_EQ(U, Unit({0xAB, 'z', 0xDE})); 553 EXPECT_TRUE(ParseOneDictionaryEntry("\"#\"", &U)); 554 EXPECT_EQ(U, Unit({'#'})); 555 EXPECT_TRUE(ParseOneDictionaryEntry("\"\\\"\"", &U)); 556 EXPECT_EQ(U, Unit({'"'})); 557 } 558 559 TEST(FuzzerDictionary, ParseDictionaryFile) { 560 Vector<Unit> Units; 561 EXPECT_FALSE(ParseDictionaryFile("zzz\n", &Units)); 562 EXPECT_FALSE(ParseDictionaryFile("", &Units)); 563 EXPECT_TRUE(ParseDictionaryFile("\n", &Units)); 564 EXPECT_EQ(Units.size(), 0U); 565 EXPECT_TRUE(ParseDictionaryFile("#zzzz a b c d\n", &Units)); 566 EXPECT_EQ(Units.size(), 0U); 567 EXPECT_TRUE(ParseDictionaryFile(" #zzzz\n", &Units)); 568 EXPECT_EQ(Units.size(), 0U); 569 EXPECT_TRUE(ParseDictionaryFile(" #zzzz\n", &Units)); 570 EXPECT_EQ(Units.size(), 0U); 571 EXPECT_TRUE(ParseDictionaryFile(" #zzzz\naaa=\"aa\"", &Units)); 572 EXPECT_EQ(Units, Vector<Unit>({Unit({'a', 'a'})})); 573 EXPECT_TRUE( 574 ParseDictionaryFile(" #zzzz\naaa=\"aa\"\n\nabc=\"abc\"", &Units)); 575 EXPECT_EQ(Units, 576 Vector<Unit>({Unit({'a', 'a'}), Unit({'a', 'b', 'c'})})); 577 } 578 579 TEST(FuzzerUtil, Base64) { 580 EXPECT_EQ("", Base64({})); 581 EXPECT_EQ("YQ==", Base64({'a'})); 582 EXPECT_EQ("eA==", Base64({'x'})); 583 EXPECT_EQ("YWI=", Base64({'a', 'b'})); 584 EXPECT_EQ("eHk=", Base64({'x', 'y'})); 585 EXPECT_EQ("YWJj", Base64({'a', 'b', 'c'})); 586 EXPECT_EQ("eHl6", Base64({'x', 'y', 'z'})); 587 EXPECT_EQ("YWJjeA==", Base64({'a', 'b', 'c', 'x'})); 588 EXPECT_EQ("YWJjeHk=", Base64({'a', 'b', 'c', 'x', 'y'})); 589 EXPECT_EQ("YWJjeHl6", Base64({'a', 'b', 'c', 'x', 'y', 'z'})); 590 } 591 592 TEST(Corpus, Distribution) { 593 DataFlowTrace DFT; 594 Random Rand(0); 595 std::unique_ptr<InputCorpus> C(new InputCorpus("")); 596 size_t N = 10; 597 size_t TriesPerUnit = 1<<16; 598 for (size_t i = 0; i < N; i++) 599 C->AddToCorpus(Unit{static_cast<uint8_t>(i)}, 1, false, false, {}, DFT, 600 nullptr); 601 602 Vector<size_t> Hist(N); 603 for (size_t i = 0; i < N * TriesPerUnit; i++) { 604 Hist[C->ChooseUnitIdxToMutate(Rand)]++; 605 } 606 for (size_t i = 0; i < N; i++) { 607 // A weak sanity check that every unit gets invoked. 608 EXPECT_GT(Hist[i], TriesPerUnit / N / 3); 609 } 610 } 611 612 TEST(Merge, Bad) { 613 const char *kInvalidInputs[] = { 614 "", 615 "x", 616 "3\nx", 617 "2\n3", 618 "2\n2", 619 "2\n2\nA\n", 620 "2\n2\nA\nB\nC\n", 621 "0\n0\n", 622 "1\n1\nA\nDONE 0", 623 "1\n1\nA\nSTARTED 1", 624 }; 625 Merger M; 626 for (auto S : kInvalidInputs) { 627 // fprintf(stderr, "TESTING:\n%s\n", S); 628 EXPECT_FALSE(M.Parse(S, false)); 629 } 630 } 631 632 void EQ(const Vector<uint32_t> &A, const Vector<uint32_t> &B) { 633 EXPECT_EQ(A, B); 634 } 635 636 void EQ(const Vector<std::string> &A, const Vector<std::string> &B) { 637 Set<std::string> a(A.begin(), A.end()); 638 Set<std::string> b(B.begin(), B.end()); 639 EXPECT_EQ(a, b); 640 } 641 642 static void Merge(const std::string &Input, 643 const Vector<std::string> Result, 644 size_t NumNewFeatures) { 645 Merger M; 646 Vector<std::string> NewFiles; 647 EXPECT_TRUE(M.Parse(Input, true)); 648 std::stringstream SS; 649 M.PrintSummary(SS); 650 EXPECT_EQ(NumNewFeatures, M.Merge({}, &NewFiles)); 651 EXPECT_EQ(M.AllFeatures(), M.ParseSummary(SS)); 652 EQ(NewFiles, Result); 653 } 654 655 TEST(Merge, Good) { 656 Merger M; 657 658 EXPECT_TRUE(M.Parse("1\n0\nAA\n", false)); 659 EXPECT_EQ(M.Files.size(), 1U); 660 EXPECT_EQ(M.NumFilesInFirstCorpus, 0U); 661 EXPECT_EQ(M.Files[0].Name, "AA"); 662 EXPECT_TRUE(M.LastFailure.empty()); 663 EXPECT_EQ(M.FirstNotProcessedFile, 0U); 664 665 EXPECT_TRUE(M.Parse("2\n1\nAA\nBB\nSTARTED 0 42\n", false)); 666 EXPECT_EQ(M.Files.size(), 2U); 667 EXPECT_EQ(M.NumFilesInFirstCorpus, 1U); 668 EXPECT_EQ(M.Files[0].Name, "AA"); 669 EXPECT_EQ(M.Files[1].Name, "BB"); 670 EXPECT_EQ(M.LastFailure, "AA"); 671 EXPECT_EQ(M.FirstNotProcessedFile, 1U); 672 673 EXPECT_TRUE(M.Parse("3\n1\nAA\nBB\nC\n" 674 "STARTED 0 1000\n" 675 "DONE 0 1 2 3\n" 676 "STARTED 1 1001\n" 677 "DONE 1 4 5 6 \n" 678 "STARTED 2 1002\n" 679 "", true)); 680 EXPECT_EQ(M.Files.size(), 3U); 681 EXPECT_EQ(M.NumFilesInFirstCorpus, 1U); 682 EXPECT_EQ(M.Files[0].Name, "AA"); 683 EXPECT_EQ(M.Files[0].Size, 1000U); 684 EXPECT_EQ(M.Files[1].Name, "BB"); 685 EXPECT_EQ(M.Files[1].Size, 1001U); 686 EXPECT_EQ(M.Files[2].Name, "C"); 687 EXPECT_EQ(M.Files[2].Size, 1002U); 688 EXPECT_EQ(M.LastFailure, "C"); 689 EXPECT_EQ(M.FirstNotProcessedFile, 3U); 690 EQ(M.Files[0].Features, {1, 2, 3}); 691 EQ(M.Files[1].Features, {4, 5, 6}); 692 693 694 Vector<std::string> NewFiles; 695 696 EXPECT_TRUE(M.Parse("3\n2\nAA\nBB\nC\n" 697 "STARTED 0 1000\nDONE 0 1 2 3\n" 698 "STARTED 1 1001\nDONE 1 4 5 6 \n" 699 "STARTED 2 1002\nDONE 2 6 1 3 \n" 700 "", true)); 701 EXPECT_EQ(M.Files.size(), 3U); 702 EXPECT_EQ(M.NumFilesInFirstCorpus, 2U); 703 EXPECT_TRUE(M.LastFailure.empty()); 704 EXPECT_EQ(M.FirstNotProcessedFile, 3U); 705 EQ(M.Files[0].Features, {1, 2, 3}); 706 EQ(M.Files[1].Features, {4, 5, 6}); 707 EQ(M.Files[2].Features, {1, 3, 6}); 708 EXPECT_EQ(0U, M.Merge({}, &NewFiles)); 709 EQ(NewFiles, {}); 710 711 EXPECT_TRUE(M.Parse("3\n1\nA\nB\nC\n" 712 "STARTED 0 1000\nDONE 0 1 2 3\n" 713 "STARTED 1 1001\nDONE 1 4 5 6 \n" 714 "STARTED 2 1002\nDONE 2 6 1 3\n" 715 "", true)); 716 EQ(M.Files[0].Features, {1, 2, 3}); 717 EQ(M.Files[1].Features, {4, 5, 6}); 718 EQ(M.Files[2].Features, {1, 3, 6}); 719 EXPECT_EQ(3U, M.Merge({}, &NewFiles)); 720 EQ(NewFiles, {"B"}); 721 722 // Same as the above, but with InitialFeatures. 723 EXPECT_TRUE(M.Parse("2\n0\nB\nC\n" 724 "STARTED 0 1001\nDONE 0 4 5 6 \n" 725 "STARTED 1 1002\nDONE 1 6 1 3\n" 726 "", true)); 727 EQ(M.Files[0].Features, {4, 5, 6}); 728 EQ(M.Files[1].Features, {1, 3, 6}); 729 Set<uint32_t> InitialFeatures; 730 InitialFeatures.insert(1); 731 InitialFeatures.insert(2); 732 InitialFeatures.insert(3); 733 EXPECT_EQ(3U, M.Merge(InitialFeatures, &NewFiles)); 734 EQ(NewFiles, {"B"}); 735 } 736 737 TEST(Merge, Merge) { 738 739 Merge("3\n1\nA\nB\nC\n" 740 "STARTED 0 1000\nDONE 0 1 2 3\n" 741 "STARTED 1 1001\nDONE 1 4 5 6 \n" 742 "STARTED 2 1002\nDONE 2 6 1 3 \n", 743 {"B"}, 3); 744 745 Merge("3\n0\nA\nB\nC\n" 746 "STARTED 0 2000\nDONE 0 1 2 3\n" 747 "STARTED 1 1001\nDONE 1 4 5 6 \n" 748 "STARTED 2 1002\nDONE 2 6 1 3 \n", 749 {"A", "B", "C"}, 6); 750 751 Merge("4\n0\nA\nB\nC\nD\n" 752 "STARTED 0 2000\nDONE 0 1 2 3\n" 753 "STARTED 1 1101\nDONE 1 4 5 6 \n" 754 "STARTED 2 1102\nDONE 2 6 1 3 100 \n" 755 "STARTED 3 1000\nDONE 3 1 \n", 756 {"A", "B", "C", "D"}, 7); 757 758 Merge("4\n1\nA\nB\nC\nD\n" 759 "STARTED 0 2000\nDONE 0 4 5 6 7 8\n" 760 "STARTED 1 1100\nDONE 1 1 2 3 \n" 761 "STARTED 2 1100\nDONE 2 2 3 \n" 762 "STARTED 3 1000\nDONE 3 1 \n", 763 {"B", "D"}, 3); 764 } 765 766 TEST(Fuzzer, ForEachNonZeroByte) { 767 const size_t N = 64; 768 alignas(64) uint8_t Ar[N + 8] = { 769 0, 0, 0, 0, 0, 0, 0, 0, 770 1, 2, 0, 0, 0, 0, 0, 0, 771 0, 0, 3, 0, 4, 0, 0, 0, 772 0, 0, 0, 0, 0, 0, 0, 0, 773 0, 0, 0, 5, 0, 6, 0, 0, 774 0, 0, 0, 0, 0, 0, 7, 0, 775 0, 0, 0, 0, 0, 0, 0, 0, 776 0, 0, 0, 0, 0, 0, 0, 8, 777 9, 9, 9, 9, 9, 9, 9, 9, 778 }; 779 typedef Vector<std::pair<size_t, uint8_t> > Vec; 780 Vec Res, Expected; 781 auto CB = [&](size_t FirstFeature, size_t Idx, uint8_t V) { 782 Res.push_back({FirstFeature + Idx, V}); 783 }; 784 ForEachNonZeroByte(Ar, Ar + N, 100, CB); 785 Expected = {{108, 1}, {109, 2}, {118, 3}, {120, 4}, 786 {135, 5}, {137, 6}, {146, 7}, {163, 8}}; 787 EXPECT_EQ(Res, Expected); 788 789 Res.clear(); 790 ForEachNonZeroByte(Ar + 9, Ar + N, 109, CB); 791 Expected = { {109, 2}, {118, 3}, {120, 4}, 792 {135, 5}, {137, 6}, {146, 7}, {163, 8}}; 793 EXPECT_EQ(Res, Expected); 794 795 Res.clear(); 796 ForEachNonZeroByte(Ar + 9, Ar + N - 9, 109, CB); 797 Expected = { {109, 2}, {118, 3}, {120, 4}, 798 {135, 5}, {137, 6}, {146, 7}}; 799 EXPECT_EQ(Res, Expected); 800 } 801 802 // FuzzerCommand unit tests. The arguments in the two helper methods below must 803 // match. 804 static void makeCommandArgs(Vector<std::string> *ArgsToAdd) { 805 assert(ArgsToAdd); 806 ArgsToAdd->clear(); 807 ArgsToAdd->push_back("foo"); 808 ArgsToAdd->push_back("-bar=baz"); 809 ArgsToAdd->push_back("qux"); 810 ArgsToAdd->push_back(Command::ignoreRemainingArgs()); 811 ArgsToAdd->push_back("quux"); 812 ArgsToAdd->push_back("-grault=garply"); 813 } 814 815 static std::string makeCmdLine(const char *separator, const char *suffix) { 816 std::string CmdLine("foo -bar=baz qux "); 817 if (strlen(separator) != 0) { 818 CmdLine += separator; 819 CmdLine += " "; 820 } 821 CmdLine += Command::ignoreRemainingArgs(); 822 CmdLine += " quux -grault=garply"; 823 if (strlen(suffix) != 0) { 824 CmdLine += " "; 825 CmdLine += suffix; 826 } 827 return CmdLine; 828 } 829 830 TEST(FuzzerCommand, Create) { 831 std::string CmdLine; 832 833 // Default constructor 834 Command DefaultCmd; 835 836 CmdLine = DefaultCmd.toString(); 837 EXPECT_EQ(CmdLine, ""); 838 839 // Explicit constructor 840 Vector<std::string> ArgsToAdd; 841 makeCommandArgs(&ArgsToAdd); 842 Command InitializedCmd(ArgsToAdd); 843 844 CmdLine = InitializedCmd.toString(); 845 EXPECT_EQ(CmdLine, makeCmdLine("", "")); 846 847 // Compare each argument 848 auto InitializedArgs = InitializedCmd.getArguments(); 849 auto i = ArgsToAdd.begin(); 850 auto j = InitializedArgs.begin(); 851 while (i != ArgsToAdd.end() && j != InitializedArgs.end()) { 852 EXPECT_EQ(*i++, *j++); 853 } 854 EXPECT_EQ(i, ArgsToAdd.end()); 855 EXPECT_EQ(j, InitializedArgs.end()); 856 857 // Copy constructor 858 Command CopiedCmd(InitializedCmd); 859 860 CmdLine = CopiedCmd.toString(); 861 EXPECT_EQ(CmdLine, makeCmdLine("", "")); 862 863 // Assignment operator 864 Command AssignedCmd; 865 AssignedCmd = CopiedCmd; 866 867 CmdLine = AssignedCmd.toString(); 868 EXPECT_EQ(CmdLine, makeCmdLine("", "")); 869 } 870 871 TEST(FuzzerCommand, ModifyArguments) { 872 Vector<std::string> ArgsToAdd; 873 makeCommandArgs(&ArgsToAdd); 874 Command Cmd; 875 std::string CmdLine; 876 877 Cmd.addArguments(ArgsToAdd); 878 CmdLine = Cmd.toString(); 879 EXPECT_EQ(CmdLine, makeCmdLine("", "")); 880 881 Cmd.addArgument("waldo"); 882 EXPECT_TRUE(Cmd.hasArgument("waldo")); 883 884 CmdLine = Cmd.toString(); 885 EXPECT_EQ(CmdLine, makeCmdLine("waldo", "")); 886 887 Cmd.removeArgument("waldo"); 888 EXPECT_FALSE(Cmd.hasArgument("waldo")); 889 890 CmdLine = Cmd.toString(); 891 EXPECT_EQ(CmdLine, makeCmdLine("", "")); 892 } 893 894 TEST(FuzzerCommand, ModifyFlags) { 895 Vector<std::string> ArgsToAdd; 896 makeCommandArgs(&ArgsToAdd); 897 Command Cmd(ArgsToAdd); 898 std::string Value, CmdLine; 899 ASSERT_FALSE(Cmd.hasFlag("fred")); 900 901 Value = Cmd.getFlagValue("fred"); 902 EXPECT_EQ(Value, ""); 903 904 CmdLine = Cmd.toString(); 905 EXPECT_EQ(CmdLine, makeCmdLine("", "")); 906 907 Cmd.addFlag("fred", "plugh"); 908 EXPECT_TRUE(Cmd.hasFlag("fred")); 909 910 Value = Cmd.getFlagValue("fred"); 911 EXPECT_EQ(Value, "plugh"); 912 913 CmdLine = Cmd.toString(); 914 EXPECT_EQ(CmdLine, makeCmdLine("-fred=plugh", "")); 915 916 Cmd.removeFlag("fred"); 917 EXPECT_FALSE(Cmd.hasFlag("fred")); 918 919 Value = Cmd.getFlagValue("fred"); 920 EXPECT_EQ(Value, ""); 921 922 CmdLine = Cmd.toString(); 923 EXPECT_EQ(CmdLine, makeCmdLine("", "")); 924 } 925 926 TEST(FuzzerCommand, SetOutput) { 927 Vector<std::string> ArgsToAdd; 928 makeCommandArgs(&ArgsToAdd); 929 Command Cmd(ArgsToAdd); 930 std::string CmdLine; 931 ASSERT_FALSE(Cmd.hasOutputFile()); 932 ASSERT_FALSE(Cmd.isOutAndErrCombined()); 933 934 Cmd.combineOutAndErr(true); 935 EXPECT_TRUE(Cmd.isOutAndErrCombined()); 936 937 CmdLine = Cmd.toString(); 938 EXPECT_EQ(CmdLine, makeCmdLine("", "2>&1")); 939 940 Cmd.combineOutAndErr(false); 941 EXPECT_FALSE(Cmd.isOutAndErrCombined()); 942 943 Cmd.setOutputFile("xyzzy"); 944 EXPECT_TRUE(Cmd.hasOutputFile()); 945 946 CmdLine = Cmd.toString(); 947 EXPECT_EQ(CmdLine, makeCmdLine("", ">xyzzy")); 948 949 Cmd.setOutputFile("thud"); 950 EXPECT_TRUE(Cmd.hasOutputFile()); 951 952 CmdLine = Cmd.toString(); 953 EXPECT_EQ(CmdLine, makeCmdLine("", ">thud")); 954 955 Cmd.combineOutAndErr(); 956 EXPECT_TRUE(Cmd.isOutAndErrCombined()); 957 958 CmdLine = Cmd.toString(); 959 EXPECT_EQ(CmdLine, makeCmdLine("", ">thud 2>&1")); 960 } 961 962 int main(int argc, char **argv) { 963 testing::InitGoogleTest(&argc, argv); 964 return RUN_ALL_TESTS(); 965 } 966