1 //===- FuzzerMutate.h - Internal header for the Fuzzer ----------*- C++ -* ===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // fuzzer::MutationDispatcher 10 //===----------------------------------------------------------------------===// 11 12 #ifndef LLVM_FUZZER_MUTATE_H 13 #define LLVM_FUZZER_MUTATE_H 14 15 #include "FuzzerDefs.h" 16 #include "FuzzerDictionary.h" 17 #include "FuzzerOptions.h" 18 #include "FuzzerRandom.h" 19 20 namespace fuzzer { 21 22 class MutationDispatcher { 23 public: 24 MutationDispatcher(Random &Rand, const FuzzingOptions &Options); 25 ~MutationDispatcher() {} 26 /// Indicate that we are about to start a new sequence of mutations. 27 void StartMutationSequence(); 28 /// Print the current sequence of mutations. 29 void PrintMutationSequence(); 30 /// Indicate that the current sequence of mutations was successfull. 31 void RecordSuccessfulMutationSequence(); 32 /// Mutates data by invoking user-provided mutator. 33 size_t Mutate_Custom(uint8_t *Data, size_t Size, size_t MaxSize); 34 /// Mutates data by invoking user-provided crossover. 35 size_t Mutate_CustomCrossOver(uint8_t *Data, size_t Size, size_t MaxSize); 36 /// Mutates data by shuffling bytes. 37 size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize); 38 /// Mutates data by erasing bytes. 39 size_t Mutate_EraseBytes(uint8_t *Data, size_t Size, size_t MaxSize); 40 /// Mutates data by inserting a byte. 41 size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize); 42 /// Mutates data by inserting several repeated bytes. 43 size_t Mutate_InsertRepeatedBytes(uint8_t *Data, size_t Size, size_t MaxSize); 44 /// Mutates data by chanding one byte. 45 size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize); 46 /// Mutates data by chanding one bit. 47 size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize); 48 /// Mutates data by copying/inserting a part of data into a different place. 49 size_t Mutate_CopyPart(uint8_t *Data, size_t Size, size_t MaxSize); 50 51 /// Mutates data by adding a word from the manual dictionary. 52 size_t Mutate_AddWordFromManualDictionary(uint8_t *Data, size_t Size, 53 size_t MaxSize); 54 55 /// Mutates data by adding a word from the temporary automatic dictionary. 56 size_t Mutate_AddWordFromTemporaryAutoDictionary(uint8_t *Data, size_t Size, 57 size_t MaxSize); 58 59 /// Mutates data by adding a word from the TORC. 60 size_t Mutate_AddWordFromTORC(uint8_t *Data, size_t Size, size_t MaxSize); 61 62 /// Mutates data by adding a word from the persistent automatic dictionary. 63 size_t Mutate_AddWordFromPersistentAutoDictionary(uint8_t *Data, size_t Size, 64 size_t MaxSize); 65 66 /// Tries to find an ASCII integer in Data, changes it to another ASCII int. 67 size_t Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MaxSize); 68 /// Change a 1-, 2-, 4-, or 8-byte integer in interesting ways. 69 size_t Mutate_ChangeBinaryInteger(uint8_t *Data, size_t Size, size_t MaxSize); 70 71 /// CrossOver Data with some other element of the corpus. 72 size_t Mutate_CrossOver(uint8_t *Data, size_t Size, size_t MaxSize); 73 74 /// Applies one of the configured mutations. 75 /// Returns the new size of data which could be up to MaxSize. 76 size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize); 77 /// Applies one of the default mutations. Provided as a service 78 /// to mutation authors. 79 size_t DefaultMutate(uint8_t *Data, size_t Size, size_t MaxSize); 80 81 /// Creates a cross-over of two pieces of Data, returns its size. 82 size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2, 83 size_t Size2, uint8_t *Out, size_t MaxOutSize); 84 85 void AddWordToManualDictionary(const Word &W); 86 87 void AddWordToAutoDictionary(DictionaryEntry DE); 88 void ClearAutoDictionary(); 89 void PrintRecommendedDictionary(); 90 91 void SetCorpus(const InputCorpus *Corpus) { this->Corpus = Corpus; } 92 93 Random &GetRand() { return Rand; } 94 95 private: 96 97 struct Mutator { 98 size_t (MutationDispatcher::*Fn)(uint8_t *Data, size_t Size, size_t Max); 99 const char *Name; 100 }; 101 102 size_t AddWordFromDictionary(Dictionary &D, uint8_t *Data, size_t Size, 103 size_t MaxSize); 104 size_t MutateImpl(uint8_t *Data, size_t Size, size_t MaxSize, 105 const std::vector<Mutator> &Mutators); 106 107 size_t InsertPartOf(const uint8_t *From, size_t FromSize, uint8_t *To, 108 size_t ToSize, size_t MaxToSize); 109 size_t CopyPartOf(const uint8_t *From, size_t FromSize, uint8_t *To, 110 size_t ToSize); 111 size_t ApplyDictionaryEntry(uint8_t *Data, size_t Size, size_t MaxSize, 112 DictionaryEntry &DE); 113 114 template <class T> 115 DictionaryEntry MakeDictionaryEntryFromCMP(T Arg1, T Arg2, 116 const uint8_t *Data, size_t Size); 117 DictionaryEntry MakeDictionaryEntryFromCMP(const Word &Arg1, const Word &Arg2, 118 const uint8_t *Data, size_t Size); 119 DictionaryEntry MakeDictionaryEntryFromCMP(const void *Arg1, const void *Arg2, 120 const void *Arg1Mutation, 121 const void *Arg2Mutation, 122 size_t ArgSize, 123 const uint8_t *Data, size_t Size); 124 125 Random &Rand; 126 const FuzzingOptions Options; 127 128 // Dictionary provided by the user via -dict=DICT_FILE. 129 Dictionary ManualDictionary; 130 // Temporary dictionary modified by the fuzzer itself, 131 // recreated periodically. 132 Dictionary TempAutoDictionary; 133 // Persistent dictionary modified by the fuzzer, consists of 134 // entries that led to successfull discoveries in the past mutations. 135 Dictionary PersistentAutoDictionary; 136 137 std::vector<Mutator> CurrentMutatorSequence; 138 std::vector<DictionaryEntry *> CurrentDictionaryEntrySequence; 139 140 static const size_t kCmpDictionaryEntriesDequeSize = 16; 141 DictionaryEntry CmpDictionaryEntriesDeque[kCmpDictionaryEntriesDequeSize]; 142 size_t CmpDictionaryEntriesDequeIdx = 0; 143 144 const InputCorpus *Corpus = nullptr; 145 std::vector<uint8_t> MutateInPlaceHere; 146 // CustomCrossOver needs its own buffer as a custom implementation may call 147 // LLVMFuzzerMutate, which in turn may resize MutateInPlaceHere. 148 std::vector<uint8_t> CustomCrossOverInPlaceHere; 149 150 std::vector<Mutator> Mutators; 151 std::vector<Mutator> DefaultMutators; 152 }; 153 154 } // namespace fuzzer 155 156 #endif // LLVM_FUZZER_MUTATE_H 157
