1 //===- FuzzerInternal.h - Internal header for the Fuzzer --------*- C++ -* ===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // Define the main class fuzzer::Fuzzer and most functions. 10 //===----------------------------------------------------------------------===// 11 12 #ifndef LLVM_FUZZER_INTERNAL_H 13 #define LLVM_FUZZER_INTERNAL_H 14 15 #include "FuzzerDefs.h" 16 #include "FuzzerExtFunctions.h" 17 #include "FuzzerInterface.h" 18 #include "FuzzerOptions.h" 19 #include "FuzzerSHA1.h" 20 #include "FuzzerValueBitMap.h" 21 #include <algorithm> 22 #include <atomic> 23 #include <chrono> 24 #include <climits> 25 #include <cstdlib> 26 #include <string.h> 27 28 namespace fuzzer { 29 30 using namespace std::chrono; 31 32 class Fuzzer { 33 public: 34 35 Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD, 36 FuzzingOptions Options); 37 ~Fuzzer(); 38 void Loop(); 39 void MinimizeCrashLoop(const Unit &U); 40 void ShuffleAndMinimize(UnitVector *V); 41 void InitializeTraceState(); 42 void RereadOutputCorpus(size_t MaxSize); 43 44 size_t secondsSinceProcessStartUp() { 45 return duration_cast<seconds>(system_clock::now() - ProcessStartTime) 46 .count(); 47 } 48 49 bool TimedOut() { 50 return Options.MaxTotalTimeSec > 0 && 51 secondsSinceProcessStartUp() > 52 static_cast<size_t>(Options.MaxTotalTimeSec); 53 } 54 55 size_t execPerSec() { 56 size_t Seconds = secondsSinceProcessStartUp(); 57 return Seconds ? TotalNumberOfRuns / Seconds : 0; 58 } 59 60 size_t getTotalNumberOfRuns() { return TotalNumberOfRuns; } 61 62 static void StaticAlarmCallback(); 63 static void StaticCrashSignalCallback(); 64 static void StaticInterruptCallback(); 65 static void StaticFileSizeExceedCallback(); 66 67 void ExecuteCallback(const uint8_t *Data, size_t Size); 68 size_t RunOne(const uint8_t *Data, size_t Size); 69 70 // Merge Corpora[1:] into Corpora[0]. 71 void Merge(const std::vector<std::string> &Corpora); 72 void CrashResistantMerge(const std::vector<std::string> &Args, 73 const std::vector<std::string> &Corpora, 74 const char *CoverageSummaryInputPathOrNull, 75 const char *CoverageSummaryOutputPathOrNull); 76 void CrashResistantMergeInternalStep(const std::string &ControlFilePath); 77 MutationDispatcher &GetMD() { return MD; } 78 void PrintFinalStats(); 79 void SetMaxInputLen(size_t MaxInputLen); 80 void SetMaxMutationLen(size_t MaxMutationLen); 81 void RssLimitCallback(); 82 83 bool InFuzzingThread() const { return IsMyThread; } 84 size_t GetCurrentUnitInFuzzingThead(const uint8_t **Data) const; 85 void TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size, 86 bool DuringInitialCorpusExecution); 87 88 void HandleMalloc(size_t Size); 89 void AnnounceOutput(const uint8_t *Data, size_t Size); 90 91 private: 92 void AlarmCallback(); 93 void CrashCallback(); 94 void InterruptCallback(); 95 void MutateAndTestOne(); 96 void ReportNewCoverage(InputInfo *II, const Unit &U); 97 size_t RunOne(const Unit &U) { return RunOne(U.data(), U.size()); } 98 void WriteToOutputCorpus(const Unit &U); 99 void WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix); 100 void PrintStats(const char *Where, const char *End = "\n", size_t Units = 0); 101 void PrintStatusForNewUnit(const Unit &U); 102 void ShuffleCorpus(UnitVector *V); 103 void AddToCorpus(const Unit &U); 104 void CheckExitOnSrcPosOrItem(); 105 106 // Trace-based fuzzing: we run a unit with some kind of tracing 107 // enabled and record potentially useful mutations. Then 108 // We apply these mutations one by one to the unit and run it again. 109 110 // Start tracing; forget all previously proposed mutations. 111 void StartTraceRecording(); 112 // Stop tracing. 113 void StopTraceRecording(); 114 115 static void StaticDeathCallback(); 116 void DumpCurrentUnit(const char *Prefix); 117 void DeathCallback(); 118 119 void AllocateCurrentUnitData(); 120 uint8_t *CurrentUnitData = nullptr; 121 std::atomic<size_t> CurrentUnitSize; 122 uint8_t BaseSha1[kSHA1NumBytes]; // Checksum of the base unit. 123 bool RunningCB = false; 124 125 size_t TotalNumberOfRuns = 0; 126 size_t NumberOfNewUnitsAdded = 0; 127 128 bool HasMoreMallocsThanFrees = false; 129 size_t NumberOfLeakDetectionAttempts = 0; 130 131 UserCallback CB; 132 InputCorpus &Corpus; 133 MutationDispatcher &MD; 134 FuzzingOptions Options; 135 136 system_clock::time_point ProcessStartTime = system_clock::now(); 137 system_clock::time_point UnitStartTime, UnitStopTime; 138 long TimeOfLongestUnitInSeconds = 0; 139 long EpochOfLastReadOfOutputCorpus = 0; 140 141 size_t MaxInputLen = 0; 142 size_t MaxMutationLen = 0; 143 144 // Need to know our own thread. 145 static thread_local bool IsMyThread; 146 }; 147 148 }; // namespace fuzzer 149 150 #endif // LLVM_FUZZER_INTERNAL_H 151