1 //===- FuzzerMutate.h - Internal header for the Fuzzer ----------*- C++ -* ===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // fuzzer::MutationDispatcher 10 //===----------------------------------------------------------------------===// 11 12 #ifndef LLVM_FUZZER_MUTATE_H 13 #define LLVM_FUZZER_MUTATE_H 14 15 #include "FuzzerDefs.h" 16 #include "FuzzerDictionary.h" 17 #include "FuzzerOptions.h" 18 #include "FuzzerRandom.h" 19 20 namespace fuzzer { 21 22 class MutationDispatcher { 23 public: 24 MutationDispatcher(Random &Rand, const FuzzingOptions &Options); 25 ~MutationDispatcher() {} 26 /// Indicate that we are about to start a new sequence of mutations. 27 void StartMutationSequence(); 28 /// Print the current sequence of mutations. 29 void PrintMutationSequence(); 30 /// Indicate that the current sequence of mutations was successfull. 31 void RecordSuccessfulMutationSequence(); 32 /// Mutates data by invoking user-provided mutator. 33 size_t Mutate_Custom(uint8_t *Data, size_t Size, size_t MaxSize); 34 /// Mutates data by invoking user-provided crossover. 35 size_t Mutate_CustomCrossOver(uint8_t *Data, size_t Size, size_t MaxSize); 36 /// Mutates data by shuffling bytes. 37 size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize); 38 /// Mutates data by erasing bytes. 39 size_t Mutate_EraseBytes(uint8_t *Data, size_t Size, size_t MaxSize); 40 /// Mutates data by inserting a byte. 41 size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize); 42 /// Mutates data by inserting several repeated bytes. 43 size_t Mutate_InsertRepeatedBytes(uint8_t *Data, size_t Size, size_t MaxSize); 44 /// Mutates data by chanding one byte. 45 size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize); 46 /// Mutates data by chanding one bit. 47 size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize); 48 /// Mutates data by copying/inserting a part of data into a different place. 49 size_t Mutate_CopyPart(uint8_t *Data, size_t Size, size_t MaxSize); 50 51 /// Mutates data by adding a word from the manual dictionary. 52 size_t Mutate_AddWordFromManualDictionary(uint8_t *Data, size_t Size, 53 size_t MaxSize); 54 55 /// Mutates data by adding a word from the TORC. 56 size_t Mutate_AddWordFromTORC(uint8_t *Data, size_t Size, size_t MaxSize); 57 58 /// Mutates data by adding a word from the persistent automatic dictionary. 59 size_t Mutate_AddWordFromPersistentAutoDictionary(uint8_t *Data, size_t Size, 60 size_t MaxSize); 61 62 /// Tries to find an ASCII integer in Data, changes it to another ASCII int. 63 size_t Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MaxSize); 64 /// Change a 1-, 2-, 4-, or 8-byte integer in interesting ways. 65 size_t Mutate_ChangeBinaryInteger(uint8_t *Data, size_t Size, size_t MaxSize); 66 67 /// CrossOver Data with some other element of the corpus. 68 size_t Mutate_CrossOver(uint8_t *Data, size_t Size, size_t MaxSize); 69 70 /// Applies one of the configured mutations. 71 /// Returns the new size of data which could be up to MaxSize. 72 size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize); 73 /// Applies one of the default mutations. Provided as a service 74 /// to mutation authors. 75 size_t DefaultMutate(uint8_t *Data, size_t Size, size_t MaxSize); 76 77 /// Creates a cross-over of two pieces of Data, returns its size. 78 size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2, 79 size_t Size2, uint8_t *Out, size_t MaxOutSize); 80 81 void AddWordToManualDictionary(const Word &W); 82 83 void PrintRecommendedDictionary(); 84 85 void SetCorpus(const InputCorpus *Corpus) { this->Corpus = Corpus; } 86 87 Random &GetRand() { return Rand; } 88 89 private: 90 91 struct Mutator { 92 size_t (MutationDispatcher::*Fn)(uint8_t *Data, size_t Size, size_t Max); 93 const char *Name; 94 }; 95 96 size_t AddWordFromDictionary(Dictionary &D, uint8_t *Data, size_t Size, 97 size_t MaxSize); 98 size_t MutateImpl(uint8_t *Data, size_t Size, size_t MaxSize, 99 Vector<Mutator> &Mutators); 100 101 size_t InsertPartOf(const uint8_t *From, size_t FromSize, uint8_t *To, 102 size_t ToSize, size_t MaxToSize); 103 size_t CopyPartOf(const uint8_t *From, size_t FromSize, uint8_t *To, 104 size_t ToSize); 105 size_t ApplyDictionaryEntry(uint8_t *Data, size_t Size, size_t MaxSize, 106 DictionaryEntry &DE); 107 108 template <class T> 109 DictionaryEntry MakeDictionaryEntryFromCMP(T Arg1, T Arg2, 110 const uint8_t *Data, size_t Size); 111 DictionaryEntry MakeDictionaryEntryFromCMP(const Word &Arg1, const Word &Arg2, 112 const uint8_t *Data, size_t Size); 113 DictionaryEntry MakeDictionaryEntryFromCMP(const void *Arg1, const void *Arg2, 114 const void *Arg1Mutation, 115 const void *Arg2Mutation, 116 size_t ArgSize, 117 const uint8_t *Data, size_t Size); 118 119 Random &Rand; 120 const FuzzingOptions Options; 121 122 // Dictionary provided by the user via -dict=DICT_FILE. 123 Dictionary ManualDictionary; 124 // Temporary dictionary modified by the fuzzer itself, 125 // recreated periodically. 126 Dictionary TempAutoDictionary; 127 // Persistent dictionary modified by the fuzzer, consists of 128 // entries that led to successfull discoveries in the past mutations. 129 Dictionary PersistentAutoDictionary; 130 131 Vector<Mutator> CurrentMutatorSequence; 132 Vector<DictionaryEntry *> CurrentDictionaryEntrySequence; 133 134 static const size_t kCmpDictionaryEntriesDequeSize = 16; 135 DictionaryEntry CmpDictionaryEntriesDeque[kCmpDictionaryEntriesDequeSize]; 136 size_t CmpDictionaryEntriesDequeIdx = 0; 137 138 const InputCorpus *Corpus = nullptr; 139 Vector<uint8_t> MutateInPlaceHere; 140 // CustomCrossOver needs its own buffer as a custom implementation may call 141 // LLVMFuzzerMutate, which in turn may resize MutateInPlaceHere. 142 Vector<uint8_t> CustomCrossOverInPlaceHere; 143 144 Vector<Mutator> Mutators; 145 Vector<Mutator> DefaultMutators; 146 }; 147 148 } // namespace fuzzer 149 150 #endif // LLVM_FUZZER_MUTATE_H 151
