1 //===- FuzzerLoop.cpp - Fuzzer's main loop --------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 // Fuzzer's main loop.
9 //===----------------------------------------------------------------------===//
10
11 #include "FuzzerCorpus.h"
12 #include "FuzzerIO.h"
13 #include "FuzzerInternal.h"
14 #include "FuzzerMutate.h"
15 #include "FuzzerPlatform.h"
16 #include "FuzzerRandom.h"
17 #include "FuzzerTracePC.h"
18 #include <algorithm>
19 #include <cstring>
20 #include <memory>
21 #include <mutex>
22 #include <set>
23
24 #if defined(__has_include)
25 #if __has_include(<sanitizer / lsan_interface.h>)
26 #include <sanitizer/lsan_interface.h>
27 #endif
28 #endif
29
30 #define NO_SANITIZE_MEMORY
31 #if defined(__has_feature)
32 #if __has_feature(memory_sanitizer)
33 #undef NO_SANITIZE_MEMORY
34 #define NO_SANITIZE_MEMORY __attribute__((no_sanitize_memory))
35 #endif
36 #endif
37
38 namespace fuzzer {
39 static const size_t kMaxUnitSizeToPrint = 256;
40
41 thread_local bool Fuzzer::IsMyThread;
42
43 bool RunningUserCallback = false;
44
45 // Only one Fuzzer per process.
46 static Fuzzer *F;
47
48 // Leak detection is expensive, so we first check if there were more mallocs
49 // than frees (using the sanitizer malloc hooks) and only then try to call lsan.
50 struct MallocFreeTracer {
Startfuzzer::MallocFreeTracer51 void Start(int TraceLevel) {
52 this->TraceLevel = TraceLevel;
53 if (TraceLevel)
54 Printf("MallocFreeTracer: START\n");
55 Mallocs = 0;
56 Frees = 0;
57 }
58 // Returns true if there were more mallocs than frees.
Stopfuzzer::MallocFreeTracer59 bool Stop() {
60 if (TraceLevel)
61 Printf("MallocFreeTracer: STOP %zd %zd (%s)\n", Mallocs.load(),
62 Frees.load(), Mallocs == Frees ? "same" : "DIFFERENT");
63 bool Result = Mallocs > Frees;
64 Mallocs = 0;
65 Frees = 0;
66 TraceLevel = 0;
67 return Result;
68 }
69 std::atomic<size_t> Mallocs;
70 std::atomic<size_t> Frees;
71 int TraceLevel = 0;
72
73 std::recursive_mutex TraceMutex;
74 bool TraceDisabled = false;
75 };
76
77 static MallocFreeTracer AllocTracer;
78
79 // Locks printing and avoids nested hooks triggered from mallocs/frees in
80 // sanitizer.
81 class TraceLock {
82 public:
TraceLock()83 TraceLock() : Lock(AllocTracer.TraceMutex) {
84 AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled;
85 }
~TraceLock()86 ~TraceLock() { AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled; }
87
IsDisabled() const88 bool IsDisabled() const {
89 // This is already inverted value.
90 return !AllocTracer.TraceDisabled;
91 }
92
93 private:
94 std::lock_guard<std::recursive_mutex> Lock;
95 };
96
97 ATTRIBUTE_NO_SANITIZE_MEMORY
MallocHook(const volatile void * ptr,size_t size)98 void MallocHook(const volatile void *ptr, size_t size) {
99 size_t N = AllocTracer.Mallocs++;
100 F->HandleMalloc(size);
101 if (int TraceLevel = AllocTracer.TraceLevel) {
102 TraceLock Lock;
103 if (Lock.IsDisabled())
104 return;
105 Printf("MALLOC[%zd] %p %zd\n", N, ptr, size);
106 if (TraceLevel >= 2 && EF)
107 PrintStackTrace();
108 }
109 }
110
111 ATTRIBUTE_NO_SANITIZE_MEMORY
FreeHook(const volatile void * ptr)112 void FreeHook(const volatile void *ptr) {
113 size_t N = AllocTracer.Frees++;
114 if (int TraceLevel = AllocTracer.TraceLevel) {
115 TraceLock Lock;
116 if (Lock.IsDisabled())
117 return;
118 Printf("FREE[%zd] %p\n", N, ptr);
119 if (TraceLevel >= 2 && EF)
120 PrintStackTrace();
121 }
122 }
123
124 // Crash on a single malloc that exceeds the rss limit.
HandleMalloc(size_t Size)125 void Fuzzer::HandleMalloc(size_t Size) {
126 if (!Options.MallocLimitMb || (Size >> 20) < (size_t)Options.MallocLimitMb)
127 return;
128 Printf("==%d== ERROR: libFuzzer: out-of-memory (malloc(%zd))\n", GetPid(),
129 Size);
130 Printf(" To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
131 PrintStackTrace();
132 DumpCurrentUnit("oom-");
133 Printf("SUMMARY: libFuzzer: out-of-memory\n");
134 PrintFinalStats();
135 _Exit(Options.OOMExitCode); // Stop right now.
136 }
137
Fuzzer(UserCallback CB,InputCorpus & Corpus,MutationDispatcher & MD,FuzzingOptions Options)138 Fuzzer::Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD,
139 FuzzingOptions Options)
140 : CB(CB), Corpus(Corpus), MD(MD), Options(Options) {
141 if (EF->__sanitizer_set_death_callback)
142 EF->__sanitizer_set_death_callback(StaticDeathCallback);
143 assert(!F);
144 F = this;
145 TPC.ResetMaps();
146 IsMyThread = true;
147 if (Options.DetectLeaks && EF->__sanitizer_install_malloc_and_free_hooks)
148 EF->__sanitizer_install_malloc_and_free_hooks(MallocHook, FreeHook);
149 TPC.SetUseCounters(Options.UseCounters);
150 TPC.SetUseValueProfileMask(Options.UseValueProfile);
151
152 if (Options.Verbosity)
153 TPC.PrintModuleInfo();
154 if (!Options.OutputCorpus.empty() && Options.ReloadIntervalSec)
155 EpochOfLastReadOfOutputCorpus = GetEpoch(Options.OutputCorpus);
156 MaxInputLen = MaxMutationLen = Options.MaxLen;
157 TmpMaxMutationLen = 0; // Will be set once we load the corpus.
158 AllocateCurrentUnitData();
159 CurrentUnitSize = 0;
160 memset(BaseSha1, 0, sizeof(BaseSha1));
161 }
162
~Fuzzer()163 Fuzzer::~Fuzzer() {}
164
AllocateCurrentUnitData()165 void Fuzzer::AllocateCurrentUnitData() {
166 if (CurrentUnitData || MaxInputLen == 0)
167 return;
168 CurrentUnitData = new uint8_t[MaxInputLen];
169 }
170
StaticDeathCallback()171 void Fuzzer::StaticDeathCallback() {
172 assert(F);
173 F->DeathCallback();
174 }
175
DumpCurrentUnit(const char * Prefix)176 void Fuzzer::DumpCurrentUnit(const char *Prefix) {
177 if (!CurrentUnitData)
178 return; // Happens when running individual inputs.
179 ScopedDisableMsanInterceptorChecks S;
180 MD.PrintMutationSequence();
181 Printf("; base unit: %s\n", Sha1ToString(BaseSha1).c_str());
182 size_t UnitSize = CurrentUnitSize;
183 if (UnitSize <= kMaxUnitSizeToPrint) {
184 PrintHexArray(CurrentUnitData, UnitSize, "\n");
185 PrintASCII(CurrentUnitData, UnitSize, "\n");
186 }
187 WriteUnitToFileWithPrefix({CurrentUnitData, CurrentUnitData + UnitSize},
188 Prefix);
189 }
190
191 NO_SANITIZE_MEMORY
DeathCallback()192 void Fuzzer::DeathCallback() {
193 DumpCurrentUnit("crash-");
194 PrintFinalStats();
195 }
196
StaticAlarmCallback()197 void Fuzzer::StaticAlarmCallback() {
198 assert(F);
199 F->AlarmCallback();
200 }
201
StaticCrashSignalCallback()202 void Fuzzer::StaticCrashSignalCallback() {
203 assert(F);
204 F->CrashCallback();
205 }
206
StaticExitCallback()207 void Fuzzer::StaticExitCallback() {
208 assert(F);
209 F->ExitCallback();
210 }
211
StaticInterruptCallback()212 void Fuzzer::StaticInterruptCallback() {
213 assert(F);
214 F->InterruptCallback();
215 }
216
StaticGracefulExitCallback()217 void Fuzzer::StaticGracefulExitCallback() {
218 assert(F);
219 F->GracefulExitRequested = true;
220 Printf("INFO: signal received, trying to exit gracefully\n");
221 }
222
StaticFileSizeExceedCallback()223 void Fuzzer::StaticFileSizeExceedCallback() {
224 Printf("==%lu== ERROR: libFuzzer: file size exceeded\n", GetPid());
225 exit(1);
226 }
227
CrashCallback()228 void Fuzzer::CrashCallback() {
229 if (EF->__sanitizer_acquire_crash_state &&
230 !EF->__sanitizer_acquire_crash_state())
231 return;
232 Printf("==%lu== ERROR: libFuzzer: deadly signal\n", GetPid());
233 PrintStackTrace();
234 Printf("NOTE: libFuzzer has rudimentary signal handlers.\n"
235 " Combine libFuzzer with AddressSanitizer or similar for better "
236 "crash reports.\n");
237 Printf("SUMMARY: libFuzzer: deadly signal\n");
238 DumpCurrentUnit("crash-");
239 PrintFinalStats();
240 _Exit(Options.ErrorExitCode); // Stop right now.
241 }
242
ExitCallback()243 void Fuzzer::ExitCallback() {
244 if (!RunningUserCallback)
245 return; // This exit did not come from the user callback
246 if (EF->__sanitizer_acquire_crash_state &&
247 !EF->__sanitizer_acquire_crash_state())
248 return;
249 Printf("==%lu== ERROR: libFuzzer: fuzz target exited\n", GetPid());
250 PrintStackTrace();
251 Printf("SUMMARY: libFuzzer: fuzz target exited\n");
252 DumpCurrentUnit("crash-");
253 PrintFinalStats();
254 _Exit(Options.ErrorExitCode);
255 }
256
MaybeExitGracefully()257 void Fuzzer::MaybeExitGracefully() {
258 if (!F->GracefulExitRequested) return;
259 Printf("==%lu== INFO: libFuzzer: exiting as requested\n", GetPid());
260 RmDirRecursive(TempPath("FuzzWithFork", ".dir"));
261 F->PrintFinalStats();
262 _Exit(0);
263 }
264
InterruptCallback()265 void Fuzzer::InterruptCallback() {
266 Printf("==%lu== libFuzzer: run interrupted; exiting\n", GetPid());
267 PrintFinalStats();
268 ScopedDisableMsanInterceptorChecks S; // RmDirRecursive may call opendir().
269 RmDirRecursive(TempPath("FuzzWithFork", ".dir"));
270 // Stop right now, don't perform any at-exit actions.
271 _Exit(Options.InterruptExitCode);
272 }
273
274 NO_SANITIZE_MEMORY
AlarmCallback()275 void Fuzzer::AlarmCallback() {
276 assert(Options.UnitTimeoutSec > 0);
277 // In Windows and Fuchsia, Alarm callback is executed by a different thread.
278 // NetBSD's current behavior needs this change too.
279 #if !LIBFUZZER_WINDOWS && !LIBFUZZER_NETBSD && !LIBFUZZER_FUCHSIA
280 if (!InFuzzingThread())
281 return;
282 #endif
283 if (!RunningUserCallback)
284 return; // We have not started running units yet.
285 size_t Seconds =
286 duration_cast<seconds>(system_clock::now() - UnitStartTime).count();
287 if (Seconds == 0)
288 return;
289 if (Options.Verbosity >= 2)
290 Printf("AlarmCallback %zd\n", Seconds);
291 if (Seconds >= (size_t)Options.UnitTimeoutSec) {
292 if (EF->__sanitizer_acquire_crash_state &&
293 !EF->__sanitizer_acquire_crash_state())
294 return;
295 Printf("ALARM: working on the last Unit for %zd seconds\n", Seconds);
296 Printf(" and the timeout value is %d (use -timeout=N to change)\n",
297 Options.UnitTimeoutSec);
298 DumpCurrentUnit("timeout-");
299 Printf("==%lu== ERROR: libFuzzer: timeout after %d seconds\n", GetPid(),
300 Seconds);
301 PrintStackTrace();
302 Printf("SUMMARY: libFuzzer: timeout\n");
303 PrintFinalStats();
304 _Exit(Options.TimeoutExitCode); // Stop right now.
305 }
306 }
307
RssLimitCallback()308 void Fuzzer::RssLimitCallback() {
309 if (EF->__sanitizer_acquire_crash_state &&
310 !EF->__sanitizer_acquire_crash_state())
311 return;
312 Printf(
313 "==%lu== ERROR: libFuzzer: out-of-memory (used: %zdMb; limit: %zdMb)\n",
314 GetPid(), GetPeakRSSMb(), Options.RssLimitMb);
315 Printf(" To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
316 PrintMemoryProfile();
317 DumpCurrentUnit("oom-");
318 Printf("SUMMARY: libFuzzer: out-of-memory\n");
319 PrintFinalStats();
320 _Exit(Options.OOMExitCode); // Stop right now.
321 }
322
PrintStats(const char * Where,const char * End,size_t Units,size_t Features)323 void Fuzzer::PrintStats(const char *Where, const char *End, size_t Units,
324 size_t Features) {
325 size_t ExecPerSec = execPerSec();
326 if (!Options.Verbosity)
327 return;
328 Printf("#%zd\t%s", TotalNumberOfRuns, Where);
329 if (size_t N = TPC.GetTotalPCCoverage())
330 Printf(" cov: %zd", N);
331 if (size_t N = Features ? Features : Corpus.NumFeatures())
332 Printf(" ft: %zd", N);
333 if (!Corpus.empty()) {
334 Printf(" corp: %zd", Corpus.NumActiveUnits());
335 if (size_t N = Corpus.SizeInBytes()) {
336 if (N < (1 << 14))
337 Printf("/%zdb", N);
338 else if (N < (1 << 24))
339 Printf("/%zdKb", N >> 10);
340 else
341 Printf("/%zdMb", N >> 20);
342 }
343 if (size_t FF = Corpus.NumInputsThatTouchFocusFunction())
344 Printf(" focus: %zd", FF);
345 }
346 if (TmpMaxMutationLen)
347 Printf(" lim: %zd", TmpMaxMutationLen);
348 if (Units)
349 Printf(" units: %zd", Units);
350
351 Printf(" exec/s: %zd", ExecPerSec);
352 Printf(" rss: %zdMb", GetPeakRSSMb());
353 Printf("%s", End);
354 }
355
PrintFinalStats()356 void Fuzzer::PrintFinalStats() {
357 if (Options.PrintFullCoverage)
358 TPC.PrintCoverage(/*PrintAllCounters=*/true);
359 if (Options.PrintCoverage)
360 TPC.PrintCoverage(/*PrintAllCounters=*/false);
361 if (Options.PrintCorpusStats)
362 Corpus.PrintStats();
363 if (!Options.PrintFinalStats)
364 return;
365 size_t ExecPerSec = execPerSec();
366 Printf("stat::number_of_executed_units: %zd\n", TotalNumberOfRuns);
367 Printf("stat::average_exec_per_sec: %zd\n", ExecPerSec);
368 Printf("stat::new_units_added: %zd\n", NumberOfNewUnitsAdded);
369 Printf("stat::slowest_unit_time_sec: %zd\n", TimeOfLongestUnitInSeconds);
370 Printf("stat::peak_rss_mb: %zd\n", GetPeakRSSMb());
371 }
372
SetMaxInputLen(size_t MaxInputLen)373 void Fuzzer::SetMaxInputLen(size_t MaxInputLen) {
374 assert(this->MaxInputLen == 0); // Can only reset MaxInputLen from 0 to non-0.
375 assert(MaxInputLen);
376 this->MaxInputLen = MaxInputLen;
377 this->MaxMutationLen = MaxInputLen;
378 AllocateCurrentUnitData();
379 Printf("INFO: -max_len is not provided; "
380 "libFuzzer will not generate inputs larger than %zd bytes\n",
381 MaxInputLen);
382 }
383
SetMaxMutationLen(size_t MaxMutationLen)384 void Fuzzer::SetMaxMutationLen(size_t MaxMutationLen) {
385 assert(MaxMutationLen && MaxMutationLen <= MaxInputLen);
386 this->MaxMutationLen = MaxMutationLen;
387 }
388
CheckExitOnSrcPosOrItem()389 void Fuzzer::CheckExitOnSrcPosOrItem() {
390 if (!Options.ExitOnSrcPos.empty()) {
391 static auto *PCsSet = new Set<uintptr_t>;
392 auto HandlePC = [&](const TracePC::PCTableEntry *TE) {
393 if (!PCsSet->insert(TE->PC).second)
394 return;
395 std::string Descr = DescribePC("%F %L", TE->PC + 1);
396 if (Descr.find(Options.ExitOnSrcPos) != std::string::npos) {
397 Printf("INFO: found line matching '%s', exiting.\n",
398 Options.ExitOnSrcPos.c_str());
399 _Exit(0);
400 }
401 };
402 TPC.ForEachObservedPC(HandlePC);
403 }
404 if (!Options.ExitOnItem.empty()) {
405 if (Corpus.HasUnit(Options.ExitOnItem)) {
406 Printf("INFO: found item with checksum '%s', exiting.\n",
407 Options.ExitOnItem.c_str());
408 _Exit(0);
409 }
410 }
411 }
412
RereadOutputCorpus(size_t MaxSize)413 void Fuzzer::RereadOutputCorpus(size_t MaxSize) {
414 if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec)
415 return;
416 Vector<Unit> AdditionalCorpus;
417 ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus,
418 &EpochOfLastReadOfOutputCorpus, MaxSize,
419 /*ExitOnError*/ false);
420 if (Options.Verbosity >= 2)
421 Printf("Reload: read %zd new units.\n", AdditionalCorpus.size());
422 bool Reloaded = false;
423 for (auto &U : AdditionalCorpus) {
424 if (U.size() > MaxSize)
425 U.resize(MaxSize);
426 if (!Corpus.HasUnit(U)) {
427 if (RunOne(U.data(), U.size())) {
428 CheckExitOnSrcPosOrItem();
429 Reloaded = true;
430 }
431 }
432 }
433 if (Reloaded)
434 PrintStats("RELOAD");
435 }
436
PrintPulseAndReportSlowInput(const uint8_t * Data,size_t Size)437 void Fuzzer::PrintPulseAndReportSlowInput(const uint8_t *Data, size_t Size) {
438 auto TimeOfUnit =
439 duration_cast<seconds>(UnitStopTime - UnitStartTime).count();
440 if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) &&
441 secondsSinceProcessStartUp() >= 2)
442 PrintStats("pulse ");
443 if (TimeOfUnit > TimeOfLongestUnitInSeconds * 1.1 &&
444 TimeOfUnit >= Options.ReportSlowUnits) {
445 TimeOfLongestUnitInSeconds = TimeOfUnit;
446 Printf("Slowest unit: %zd s:\n", TimeOfLongestUnitInSeconds);
447 WriteUnitToFileWithPrefix({Data, Data + Size}, "slow-unit-");
448 }
449 }
450
WriteFeatureSetToFile(const std::string & FeaturesDir,const std::string & FileName,const Vector<uint32_t> & FeatureSet)451 static void WriteFeatureSetToFile(const std::string &FeaturesDir,
452 const std::string &FileName,
453 const Vector<uint32_t> &FeatureSet) {
454 if (FeaturesDir.empty() || FeatureSet.empty()) return;
455 WriteToFile(reinterpret_cast<const uint8_t *>(FeatureSet.data()),
456 FeatureSet.size() * sizeof(FeatureSet[0]),
457 DirPlusFile(FeaturesDir, FileName));
458 }
459
RenameFeatureSetFile(const std::string & FeaturesDir,const std::string & OldFile,const std::string & NewFile)460 static void RenameFeatureSetFile(const std::string &FeaturesDir,
461 const std::string &OldFile,
462 const std::string &NewFile) {
463 if (FeaturesDir.empty()) return;
464 RenameFile(DirPlusFile(FeaturesDir, OldFile),
465 DirPlusFile(FeaturesDir, NewFile));
466 }
467
WriteEdgeToMutationGraphFile(const std::string & MutationGraphFile,const InputInfo * II,const InputInfo * BaseII,const std::string & MS)468 static void WriteEdgeToMutationGraphFile(const std::string &MutationGraphFile,
469 const InputInfo *II,
470 const InputInfo *BaseII,
471 const std::string &MS) {
472 if (MutationGraphFile.empty())
473 return;
474
475 std::string Sha1 = Sha1ToString(II->Sha1);
476
477 std::string OutputString;
478
479 // Add a new vertex.
480 OutputString.append("\"");
481 OutputString.append(Sha1);
482 OutputString.append("\"\n");
483
484 // Add a new edge if there is base input.
485 if (BaseII) {
486 std::string BaseSha1 = Sha1ToString(BaseII->Sha1);
487 OutputString.append("\"");
488 OutputString.append(BaseSha1);
489 OutputString.append("\" -> \"");
490 OutputString.append(Sha1);
491 OutputString.append("\" [label=\"");
492 OutputString.append(MS);
493 OutputString.append("\"];\n");
494 }
495
496 AppendToFile(OutputString, MutationGraphFile);
497 }
498
RunOne(const uint8_t * Data,size_t Size,bool MayDeleteFile,InputInfo * II,bool ForceAddToCorpus,bool * FoundUniqFeatures)499 bool Fuzzer::RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile,
500 InputInfo *II, bool ForceAddToCorpus,
501 bool *FoundUniqFeatures) {
502 if (!Size)
503 return false;
504
505 ExecuteCallback(Data, Size);
506 auto TimeOfUnit = duration_cast<microseconds>(UnitStopTime - UnitStartTime);
507
508 UniqFeatureSetTmp.clear();
509 size_t FoundUniqFeaturesOfII = 0;
510 size_t NumUpdatesBefore = Corpus.NumFeatureUpdates();
511 TPC.CollectFeatures([&](size_t Feature) {
512 if (Corpus.AddFeature(Feature, Size, Options.Shrink))
513 UniqFeatureSetTmp.push_back(Feature);
514 if (Options.Entropic)
515 Corpus.UpdateFeatureFrequency(II, Feature);
516 if (Options.ReduceInputs && II && !II->NeverReduce)
517 if (std::binary_search(II->UniqFeatureSet.begin(),
518 II->UniqFeatureSet.end(), Feature))
519 FoundUniqFeaturesOfII++;
520 });
521 if (FoundUniqFeatures)
522 *FoundUniqFeatures = FoundUniqFeaturesOfII;
523 PrintPulseAndReportSlowInput(Data, Size);
524 size_t NumNewFeatures = Corpus.NumFeatureUpdates() - NumUpdatesBefore;
525 if (NumNewFeatures || ForceAddToCorpus) {
526 TPC.UpdateObservedPCs();
527 auto NewII =
528 Corpus.AddToCorpus({Data, Data + Size}, NumNewFeatures, MayDeleteFile,
529 TPC.ObservedFocusFunction(), ForceAddToCorpus,
530 TimeOfUnit, UniqFeatureSetTmp, DFT, II);
531 WriteFeatureSetToFile(Options.FeaturesDir, Sha1ToString(NewII->Sha1),
532 NewII->UniqFeatureSet);
533 WriteEdgeToMutationGraphFile(Options.MutationGraphFile, NewII, II,
534 MD.MutationSequence());
535 return true;
536 }
537 if (II && FoundUniqFeaturesOfII &&
538 II->DataFlowTraceForFocusFunction.empty() &&
539 FoundUniqFeaturesOfII == II->UniqFeatureSet.size() &&
540 II->U.size() > Size) {
541 auto OldFeaturesFile = Sha1ToString(II->Sha1);
542 Corpus.Replace(II, {Data, Data + Size});
543 RenameFeatureSetFile(Options.FeaturesDir, OldFeaturesFile,
544 Sha1ToString(II->Sha1));
545 return true;
546 }
547 return false;
548 }
549
TPCUpdateObservedPCs()550 void Fuzzer::TPCUpdateObservedPCs() { TPC.UpdateObservedPCs(); }
551
GetCurrentUnitInFuzzingThead(const uint8_t ** Data) const552 size_t Fuzzer::GetCurrentUnitInFuzzingThead(const uint8_t **Data) const {
553 assert(InFuzzingThread());
554 *Data = CurrentUnitData;
555 return CurrentUnitSize;
556 }
557
CrashOnOverwrittenData()558 void Fuzzer::CrashOnOverwrittenData() {
559 Printf("==%d== ERROR: libFuzzer: fuzz target overwrites its const input\n",
560 GetPid());
561 PrintStackTrace();
562 Printf("SUMMARY: libFuzzer: overwrites-const-input\n");
563 DumpCurrentUnit("crash-");
564 PrintFinalStats();
565 _Exit(Options.ErrorExitCode); // Stop right now.
566 }
567
568 // Compare two arrays, but not all bytes if the arrays are large.
LooseMemeq(const uint8_t * A,const uint8_t * B,size_t Size)569 static bool LooseMemeq(const uint8_t *A, const uint8_t *B, size_t Size) {
570 const size_t Limit = 64;
571 if (Size <= 64)
572 return !memcmp(A, B, Size);
573 // Compare first and last Limit/2 bytes.
574 return !memcmp(A, B, Limit / 2) &&
575 !memcmp(A + Size - Limit / 2, B + Size - Limit / 2, Limit / 2);
576 }
577
ExecuteCallback(const uint8_t * Data,size_t Size)578 void Fuzzer::ExecuteCallback(const uint8_t *Data, size_t Size) {
579 TPC.RecordInitialStack();
580 TotalNumberOfRuns++;
581 assert(InFuzzingThread());
582 // We copy the contents of Unit into a separate heap buffer
583 // so that we reliably find buffer overflows in it.
584 uint8_t *DataCopy = new uint8_t[Size];
585 memcpy(DataCopy, Data, Size);
586 if (EF->__msan_unpoison)
587 EF->__msan_unpoison(DataCopy, Size);
588 if (EF->__msan_unpoison_param)
589 EF->__msan_unpoison_param(2);
590 if (CurrentUnitData && CurrentUnitData != Data)
591 memcpy(CurrentUnitData, Data, Size);
592 CurrentUnitSize = Size;
593 {
594 ScopedEnableMsanInterceptorChecks S;
595 AllocTracer.Start(Options.TraceMalloc);
596 UnitStartTime = system_clock::now();
597 TPC.ResetMaps();
598 RunningUserCallback = true;
599 int Res = CB(DataCopy, Size);
600 RunningUserCallback = false;
601 UnitStopTime = system_clock::now();
602 (void)Res;
603 assert(Res == 0);
604 HasMoreMallocsThanFrees = AllocTracer.Stop();
605 }
606 if (!LooseMemeq(DataCopy, Data, Size))
607 CrashOnOverwrittenData();
608 CurrentUnitSize = 0;
609 delete[] DataCopy;
610 }
611
WriteToOutputCorpus(const Unit & U)612 std::string Fuzzer::WriteToOutputCorpus(const Unit &U) {
613 if (Options.OnlyASCII)
614 assert(IsASCII(U));
615 if (Options.OutputCorpus.empty())
616 return "";
617 std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U));
618 WriteToFile(U, Path);
619 if (Options.Verbosity >= 2)
620 Printf("Written %zd bytes to %s\n", U.size(), Path.c_str());
621 return Path;
622 }
623
WriteUnitToFileWithPrefix(const Unit & U,const char * Prefix)624 void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) {
625 if (!Options.SaveArtifacts)
626 return;
627 std::string Path = Options.ArtifactPrefix + Prefix + Hash(U);
628 if (!Options.ExactArtifactPath.empty())
629 Path = Options.ExactArtifactPath; // Overrides ArtifactPrefix.
630 WriteToFile(U, Path);
631 Printf("artifact_prefix='%s'; Test unit written to %s\n",
632 Options.ArtifactPrefix.c_str(), Path.c_str());
633 if (U.size() <= kMaxUnitSizeToPrint)
634 Printf("Base64: %s\n", Base64(U).c_str());
635 }
636
PrintStatusForNewUnit(const Unit & U,const char * Text)637 void Fuzzer::PrintStatusForNewUnit(const Unit &U, const char *Text) {
638 if (!Options.PrintNEW)
639 return;
640 PrintStats(Text, "");
641 if (Options.Verbosity) {
642 Printf(" L: %zd/%zd ", U.size(), Corpus.MaxInputSize());
643 MD.PrintMutationSequence(Options.Verbosity >= 2);
644 Printf("\n");
645 }
646 }
647
ReportNewCoverage(InputInfo * II,const Unit & U)648 void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) {
649 II->NumSuccessfullMutations++;
650 MD.RecordSuccessfulMutationSequence();
651 PrintStatusForNewUnit(U, II->Reduced ? "REDUCE" : "NEW ");
652 WriteToOutputCorpus(U);
653 NumberOfNewUnitsAdded++;
654 CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus.
655 LastCorpusUpdateRun = TotalNumberOfRuns;
656 }
657
658 // Tries detecting a memory leak on the particular input that we have just
659 // executed before calling this function.
TryDetectingAMemoryLeak(const uint8_t * Data,size_t Size,bool DuringInitialCorpusExecution)660 void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
661 bool DuringInitialCorpusExecution) {
662 if (!HasMoreMallocsThanFrees)
663 return; // mallocs==frees, a leak is unlikely.
664 if (!Options.DetectLeaks)
665 return;
666 if (!DuringInitialCorpusExecution &&
667 TotalNumberOfRuns >= Options.MaxNumberOfRuns)
668 return;
669 if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) ||
670 !(EF->__lsan_do_recoverable_leak_check))
671 return; // No lsan.
672 // Run the target once again, but with lsan disabled so that if there is
673 // a real leak we do not report it twice.
674 EF->__lsan_disable();
675 ExecuteCallback(Data, Size);
676 EF->__lsan_enable();
677 if (!HasMoreMallocsThanFrees)
678 return; // a leak is unlikely.
679 if (NumberOfLeakDetectionAttempts++ > 1000) {
680 Options.DetectLeaks = false;
681 Printf("INFO: libFuzzer disabled leak detection after every mutation.\n"
682 " Most likely the target function accumulates allocated\n"
683 " memory in a global state w/o actually leaking it.\n"
684 " You may try running this binary with -trace_malloc=[12]"
685 " to get a trace of mallocs and frees.\n"
686 " If LeakSanitizer is enabled in this process it will still\n"
687 " run on the process shutdown.\n");
688 return;
689 }
690 // Now perform the actual lsan pass. This is expensive and we must ensure
691 // we don't call it too often.
692 if (EF->__lsan_do_recoverable_leak_check()) { // Leak is found, report it.
693 if (DuringInitialCorpusExecution)
694 Printf("\nINFO: a leak has been found in the initial corpus.\n\n");
695 Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n");
696 CurrentUnitSize = Size;
697 DumpCurrentUnit("leak-");
698 PrintFinalStats();
699 _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on.
700 }
701 }
702
MutateAndTestOne()703 void Fuzzer::MutateAndTestOne() {
704 MD.StartMutationSequence();
705
706 auto &II = Corpus.ChooseUnitToMutate(MD.GetRand());
707 if (Options.DoCrossOver) {
708 auto &CrossOverII = Corpus.ChooseUnitToCrossOverWith(
709 MD.GetRand(), Options.CrossOverUniformDist);
710 MD.SetCrossOverWith(&CrossOverII.U);
711 }
712 const auto &U = II.U;
713 memcpy(BaseSha1, II.Sha1, sizeof(BaseSha1));
714 assert(CurrentUnitData);
715 size_t Size = U.size();
716 assert(Size <= MaxInputLen && "Oversized Unit");
717 memcpy(CurrentUnitData, U.data(), Size);
718
719 assert(MaxMutationLen > 0);
720
721 size_t CurrentMaxMutationLen =
722 Min(MaxMutationLen, Max(U.size(), TmpMaxMutationLen));
723 assert(CurrentMaxMutationLen > 0);
724
725 for (int i = 0; i < Options.MutateDepth; i++) {
726 if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
727 break;
728 MaybeExitGracefully();
729 size_t NewSize = 0;
730 if (II.HasFocusFunction && !II.DataFlowTraceForFocusFunction.empty() &&
731 Size <= CurrentMaxMutationLen)
732 NewSize = MD.MutateWithMask(CurrentUnitData, Size, Size,
733 II.DataFlowTraceForFocusFunction);
734
735 // If MutateWithMask either failed or wasn't called, call default Mutate.
736 if (!NewSize)
737 NewSize = MD.Mutate(CurrentUnitData, Size, CurrentMaxMutationLen);
738 assert(NewSize > 0 && "Mutator returned empty unit");
739 assert(NewSize <= CurrentMaxMutationLen && "Mutator return oversized unit");
740 Size = NewSize;
741 II.NumExecutedMutations++;
742 Corpus.IncrementNumExecutedMutations();
743
744 bool FoundUniqFeatures = false;
745 bool NewCov = RunOne(CurrentUnitData, Size, /*MayDeleteFile=*/true, &II,
746 /*ForceAddToCorpus*/ false, &FoundUniqFeatures);
747 TryDetectingAMemoryLeak(CurrentUnitData, Size,
748 /*DuringInitialCorpusExecution*/ false);
749 if (NewCov) {
750 ReportNewCoverage(&II, {CurrentUnitData, CurrentUnitData + Size});
751 break; // We will mutate this input more in the next rounds.
752 }
753 if (Options.ReduceDepth && !FoundUniqFeatures)
754 break;
755 }
756
757 II.NeedsEnergyUpdate = true;
758 }
759
PurgeAllocator()760 void Fuzzer::PurgeAllocator() {
761 if (Options.PurgeAllocatorIntervalSec < 0 || !EF->__sanitizer_purge_allocator)
762 return;
763 if (duration_cast<seconds>(system_clock::now() -
764 LastAllocatorPurgeAttemptTime)
765 .count() < Options.PurgeAllocatorIntervalSec)
766 return;
767
768 if (Options.RssLimitMb <= 0 ||
769 GetPeakRSSMb() > static_cast<size_t>(Options.RssLimitMb) / 2)
770 EF->__sanitizer_purge_allocator();
771
772 LastAllocatorPurgeAttemptTime = system_clock::now();
773 }
774
ReadAndExecuteSeedCorpora(Vector<SizedFile> & CorporaFiles)775 void Fuzzer::ReadAndExecuteSeedCorpora(Vector<SizedFile> &CorporaFiles) {
776 const size_t kMaxSaneLen = 1 << 20;
777 const size_t kMinDefaultLen = 4096;
778 size_t MaxSize = 0;
779 size_t MinSize = -1;
780 size_t TotalSize = 0;
781 for (auto &File : CorporaFiles) {
782 MaxSize = Max(File.Size, MaxSize);
783 MinSize = Min(File.Size, MinSize);
784 TotalSize += File.Size;
785 }
786 if (Options.MaxLen == 0)
787 SetMaxInputLen(std::min(std::max(kMinDefaultLen, MaxSize), kMaxSaneLen));
788 assert(MaxInputLen > 0);
789
790 // Test the callback with empty input and never try it again.
791 uint8_t dummy = 0;
792 ExecuteCallback(&dummy, 0);
793
794 if (CorporaFiles.empty()) {
795 Printf("INFO: A corpus is not provided, starting from an empty corpus\n");
796 Unit U({'\n'}); // Valid ASCII input.
797 RunOne(U.data(), U.size());
798 } else {
799 Printf("INFO: seed corpus: files: %zd min: %zdb max: %zdb total: %zdb"
800 " rss: %zdMb\n",
801 CorporaFiles.size(), MinSize, MaxSize, TotalSize, GetPeakRSSMb());
802 if (Options.ShuffleAtStartUp)
803 std::shuffle(CorporaFiles.begin(), CorporaFiles.end(), MD.GetRand());
804
805 if (Options.PreferSmall) {
806 std::stable_sort(CorporaFiles.begin(), CorporaFiles.end());
807 assert(CorporaFiles.front().Size <= CorporaFiles.back().Size);
808 }
809
810 // Load and execute inputs one by one.
811 for (auto &SF : CorporaFiles) {
812 auto U = FileToVector(SF.File, MaxInputLen, /*ExitOnError=*/false);
813 assert(U.size() <= MaxInputLen);
814 RunOne(U.data(), U.size(), /*MayDeleteFile*/ false, /*II*/ nullptr,
815 /*ForceAddToCorpus*/ Options.KeepSeed,
816 /*FoundUniqFeatures*/ nullptr);
817 CheckExitOnSrcPosOrItem();
818 TryDetectingAMemoryLeak(U.data(), U.size(),
819 /*DuringInitialCorpusExecution*/ true);
820 }
821 }
822
823 PrintStats("INITED");
824 if (!Options.FocusFunction.empty()) {
825 Printf("INFO: %zd/%zd inputs touch the focus function\n",
826 Corpus.NumInputsThatTouchFocusFunction(), Corpus.size());
827 if (!Options.DataFlowTrace.empty())
828 Printf("INFO: %zd/%zd inputs have the Data Flow Trace\n",
829 Corpus.NumInputsWithDataFlowTrace(),
830 Corpus.NumInputsThatTouchFocusFunction());
831 }
832
833 if (Corpus.empty() && Options.MaxNumberOfRuns) {
834 Printf("ERROR: no interesting inputs were found. "
835 "Is the code instrumented for coverage? Exiting.\n");
836 exit(1);
837 }
838 }
839
Loop(Vector<SizedFile> & CorporaFiles)840 void Fuzzer::Loop(Vector<SizedFile> &CorporaFiles) {
841 auto FocusFunctionOrAuto = Options.FocusFunction;
842 DFT.Init(Options.DataFlowTrace, &FocusFunctionOrAuto, CorporaFiles,
843 MD.GetRand());
844 TPC.SetFocusFunction(FocusFunctionOrAuto);
845 ReadAndExecuteSeedCorpora(CorporaFiles);
846 DFT.Clear(); // No need for DFT any more.
847 TPC.SetPrintNewPCs(Options.PrintNewCovPcs);
848 TPC.SetPrintNewFuncs(Options.PrintNewCovFuncs);
849 system_clock::time_point LastCorpusReload = system_clock::now();
850
851 TmpMaxMutationLen =
852 Min(MaxMutationLen, Max(size_t(4), Corpus.MaxInputSize()));
853
854 while (true) {
855 auto Now = system_clock::now();
856 if (!Options.StopFile.empty() &&
857 !FileToVector(Options.StopFile, 1, false).empty())
858 break;
859 if (duration_cast<seconds>(Now - LastCorpusReload).count() >=
860 Options.ReloadIntervalSec) {
861 RereadOutputCorpus(MaxInputLen);
862 LastCorpusReload = system_clock::now();
863 }
864 if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
865 break;
866 if (TimedOut())
867 break;
868
869 // Update TmpMaxMutationLen
870 if (Options.LenControl) {
871 if (TmpMaxMutationLen < MaxMutationLen &&
872 TotalNumberOfRuns - LastCorpusUpdateRun >
873 Options.LenControl * Log(TmpMaxMutationLen)) {
874 TmpMaxMutationLen =
875 Min(MaxMutationLen, TmpMaxMutationLen + Log(TmpMaxMutationLen));
876 LastCorpusUpdateRun = TotalNumberOfRuns;
877 }
878 } else {
879 TmpMaxMutationLen = MaxMutationLen;
880 }
881
882 // Perform several mutations and runs.
883 MutateAndTestOne();
884
885 PurgeAllocator();
886 }
887
888 PrintStats("DONE ", "\n");
889 MD.PrintRecommendedDictionary();
890 }
891
MinimizeCrashLoop(const Unit & U)892 void Fuzzer::MinimizeCrashLoop(const Unit &U) {
893 if (U.size() <= 1)
894 return;
895 while (!TimedOut() && TotalNumberOfRuns < Options.MaxNumberOfRuns) {
896 MD.StartMutationSequence();
897 memcpy(CurrentUnitData, U.data(), U.size());
898 for (int i = 0; i < Options.MutateDepth; i++) {
899 size_t NewSize = MD.Mutate(CurrentUnitData, U.size(), MaxMutationLen);
900 assert(NewSize > 0 && NewSize <= MaxMutationLen);
901 ExecuteCallback(CurrentUnitData, NewSize);
902 PrintPulseAndReportSlowInput(CurrentUnitData, NewSize);
903 TryDetectingAMemoryLeak(CurrentUnitData, NewSize,
904 /*DuringInitialCorpusExecution*/ false);
905 }
906 }
907 }
908
909 } // namespace fuzzer
910
911 extern "C" {
912
913 ATTRIBUTE_INTERFACE size_t
LLVMFuzzerMutate(uint8_t * Data,size_t Size,size_t MaxSize)914 LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
915 assert(fuzzer::F);
916 return fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize);
917 }
918
919 } // extern "C"
920