1 //===- FuzzerInternal.h - Internal header for the Fuzzer --------*- C++ -* ===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
9 // Define the main class fuzzer::Fuzzer and most functions.
10 //===----------------------------------------------------------------------===//
12 #ifndef LLVM_FUZZER_INTERNAL_H
13 #define LLVM_FUZZER_INTERNAL_H
15 #include "FuzzerDataFlowTrace.h"
16 #include "FuzzerDefs.h"
17 #include "FuzzerExtFunctions.h"
18 #include "FuzzerInterface.h"
19 #include "FuzzerOptions.h"
20 #include "FuzzerSHA1.h"
21 #include "FuzzerValueBitMap.h"
31 using namespace std::chrono;
36 Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD,
37 FuzzingOptions Options);
39 void Loop(const Vector<std::string> &CorpusDirs);
40 void ReadAndExecuteSeedCorpora(const Vector<std::string> &CorpusDirs);
41 void MinimizeCrashLoop(const Unit &U);
42 void RereadOutputCorpus(size_t MaxSize);
44 size_t secondsSinceProcessStartUp() {
45 return duration_cast<seconds>(system_clock::now() - ProcessStartTime)
50 return Options.MaxTotalTimeSec > 0 &&
51 secondsSinceProcessStartUp() >
52 static_cast<size_t>(Options.MaxTotalTimeSec);
56 size_t Seconds = secondsSinceProcessStartUp();
57 return Seconds ? TotalNumberOfRuns / Seconds : 0;
60 size_t getTotalNumberOfRuns() { return TotalNumberOfRuns; }
62 static void StaticAlarmCallback();
63 static void StaticCrashSignalCallback();
64 static void StaticExitCallback();
65 static void StaticInterruptCallback();
66 static void StaticFileSizeExceedCallback();
67 static void StaticGracefulExitCallback();
69 void ExecuteCallback(const uint8_t *Data, size_t Size);
70 void CheckForUnstableCounters(const uint8_t *Data, size_t Size);
71 bool RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile = false,
72 InputInfo *II = nullptr, bool *FoundUniqFeatures = nullptr);
74 // Merge Corpora[1:] into Corpora[0].
75 void Merge(const Vector<std::string> &Corpora);
76 void CrashResistantMerge(const Vector<std::string> &Args,
77 const Vector<std::string> &Corpora,
78 const char *CoverageSummaryInputPathOrNull,
79 const char *CoverageSummaryOutputPathOrNull,
80 const char *MergeControlFilePathOrNull);
81 void CrashResistantMergeInternalStep(const std::string &ControlFilePath);
82 MutationDispatcher &GetMD() { return MD; }
83 void PrintFinalStats();
84 void SetMaxInputLen(size_t MaxInputLen);
85 void SetMaxMutationLen(size_t MaxMutationLen);
86 void RssLimitCallback();
88 bool InFuzzingThread() const { return IsMyThread; }
89 size_t GetCurrentUnitInFuzzingThead(const uint8_t **Data) const;
90 void TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
91 bool DuringInitialCorpusExecution);
93 void HandleMalloc(size_t Size);
94 void AnnounceOutput(const uint8_t *Data, size_t Size);
100 void MaybeExitGracefully();
101 void CrashOnOverwrittenData();
102 void InterruptCallback();
103 void MutateAndTestOne();
104 void PurgeAllocator();
105 void ReportNewCoverage(InputInfo *II, const Unit &U);
106 void PrintPulseAndReportSlowInput(const uint8_t *Data, size_t Size);
107 void WriteToOutputCorpus(const Unit &U);
108 void WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix);
109 void PrintStats(const char *Where, const char *End = "\n", size_t Units = 0);
110 void PrintStatusForNewUnit(const Unit &U, const char *Text);
111 void CheckExitOnSrcPosOrItem();
113 static void StaticDeathCallback();
114 void DumpCurrentUnit(const char *Prefix);
115 void DeathCallback();
117 void AllocateCurrentUnitData();
118 uint8_t *CurrentUnitData = nullptr;
119 std::atomic<size_t> CurrentUnitSize;
120 uint8_t BaseSha1[kSHA1NumBytes]; // Checksum of the base unit.
122 bool GracefulExitRequested = false;
124 size_t TotalNumberOfRuns = 0;
125 size_t NumberOfNewUnitsAdded = 0;
127 size_t LastCorpusUpdateRun = 0;
129 bool HasMoreMallocsThanFrees = false;
130 size_t NumberOfLeakDetectionAttempts = 0;
132 system_clock::time_point LastAllocatorPurgeAttemptTime = system_clock::now();
136 MutationDispatcher &MD;
137 FuzzingOptions Options;
140 system_clock::time_point ProcessStartTime = system_clock::now();
141 system_clock::time_point UnitStartTime, UnitStopTime;
142 long TimeOfLongestUnitInSeconds = 0;
143 long EpochOfLastReadOfOutputCorpus = 0;
145 size_t MaxInputLen = 0;
146 size_t MaxMutationLen = 0;
147 size_t TmpMaxMutationLen = 0;
149 Vector<uint32_t> UniqFeatureSetTmp;
151 // Need to know our own thread.
152 static thread_local bool IsMyThread;
155 struct ScopedEnableMsanInterceptorChecks {
156 ScopedEnableMsanInterceptorChecks() {
157 if (EF->__msan_scoped_enable_interceptor_checks)
158 EF->__msan_scoped_enable_interceptor_checks();
160 ~ScopedEnableMsanInterceptorChecks() {
161 if (EF->__msan_scoped_disable_interceptor_checks)
162 EF->__msan_scoped_disable_interceptor_checks();
166 struct ScopedDisableMsanInterceptorChecks {
167 ScopedDisableMsanInterceptorChecks() {
168 if (EF->__msan_scoped_disable_interceptor_checks)
169 EF->__msan_scoped_disable_interceptor_checks();
171 ~ScopedDisableMsanInterceptorChecks() {
172 if (EF->__msan_scoped_enable_interceptor_checks)
173 EF->__msan_scoped_enable_interceptor_checks();
177 } // namespace fuzzer
179 #endif // LLVM_FUZZER_INTERNAL_H