1 //===- FuzzerMutate.h - Internal header for the Fuzzer ----------*- C++ -* ===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
9 // fuzzer::MutationDispatcher
10 //===----------------------------------------------------------------------===//
12 #ifndef LLVM_FUZZER_MUTATE_H
13 #define LLVM_FUZZER_MUTATE_H
15 #include "FuzzerDefs.h"
16 #include "FuzzerDictionary.h"
17 #include "FuzzerOptions.h"
18 #include "FuzzerRandom.h"
22 class MutationDispatcher {
24 MutationDispatcher(Random &Rand, const FuzzingOptions &Options);
25 ~MutationDispatcher() {}
26 /// Indicate that we are about to start a new sequence of mutations.
27 void StartMutationSequence();
28 /// Print the current sequence of mutations.
29 void PrintMutationSequence();
30 /// Indicate that the current sequence of mutations was successful.
31 void RecordSuccessfulMutationSequence();
32 /// Mutates data by invoking user-provided mutator.
33 size_t Mutate_Custom(uint8_t *Data, size_t Size, size_t MaxSize);
34 /// Mutates data by invoking user-provided crossover.
35 size_t Mutate_CustomCrossOver(uint8_t *Data, size_t Size, size_t MaxSize);
36 /// Mutates data by shuffling bytes.
37 size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize);
38 /// Mutates data by erasing bytes.
39 size_t Mutate_EraseBytes(uint8_t *Data, size_t Size, size_t MaxSize);
40 /// Mutates data by inserting a byte.
41 size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize);
42 /// Mutates data by inserting several repeated bytes.
43 size_t Mutate_InsertRepeatedBytes(uint8_t *Data, size_t Size, size_t MaxSize);
44 /// Mutates data by chanding one byte.
45 size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize);
46 /// Mutates data by chanding one bit.
47 size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize);
48 /// Mutates data by copying/inserting a part of data into a different place.
49 size_t Mutate_CopyPart(uint8_t *Data, size_t Size, size_t MaxSize);
51 /// Mutates data by adding a word from the manual dictionary.
52 size_t Mutate_AddWordFromManualDictionary(uint8_t *Data, size_t Size,
55 /// Mutates data by adding a word from the TORC.
56 size_t Mutate_AddWordFromTORC(uint8_t *Data, size_t Size, size_t MaxSize);
58 /// Mutates data by adding a word from the persistent automatic dictionary.
59 size_t Mutate_AddWordFromPersistentAutoDictionary(uint8_t *Data, size_t Size,
62 /// Tries to find an ASCII integer in Data, changes it to another ASCII int.
63 size_t Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MaxSize);
64 /// Change a 1-, 2-, 4-, or 8-byte integer in interesting ways.
65 size_t Mutate_ChangeBinaryInteger(uint8_t *Data, size_t Size, size_t MaxSize);
67 /// CrossOver Data with some other element of the corpus.
68 size_t Mutate_CrossOver(uint8_t *Data, size_t Size, size_t MaxSize);
70 /// Applies one of the configured mutations.
71 /// Returns the new size of data which could be up to MaxSize.
72 size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize);
74 /// Applies one of the configured mutations to the bytes of Data
75 /// that have '1' in Mask.
76 /// Mask.size() should be >= Size.
77 size_t MutateWithMask(uint8_t *Data, size_t Size, size_t MaxSize,
78 const Vector<uint8_t> &Mask);
80 /// Applies one of the default mutations. Provided as a service
81 /// to mutation authors.
82 size_t DefaultMutate(uint8_t *Data, size_t Size, size_t MaxSize);
84 /// Creates a cross-over of two pieces of Data, returns its size.
85 size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2,
86 size_t Size2, uint8_t *Out, size_t MaxOutSize);
88 void AddWordToManualDictionary(const Word &W);
90 void PrintRecommendedDictionary();
92 void SetCorpus(const InputCorpus *Corpus) { this->Corpus = Corpus; }
94 Random &GetRand() { return Rand; }
98 size_t (MutationDispatcher::*Fn)(uint8_t *Data, size_t Size, size_t Max);
102 size_t AddWordFromDictionary(Dictionary &D, uint8_t *Data, size_t Size,
104 size_t MutateImpl(uint8_t *Data, size_t Size, size_t MaxSize,
105 Vector<Mutator> &Mutators);
107 size_t InsertPartOf(const uint8_t *From, size_t FromSize, uint8_t *To,
108 size_t ToSize, size_t MaxToSize);
109 size_t CopyPartOf(const uint8_t *From, size_t FromSize, uint8_t *To,
111 size_t ApplyDictionaryEntry(uint8_t *Data, size_t Size, size_t MaxSize,
112 DictionaryEntry &DE);
115 DictionaryEntry MakeDictionaryEntryFromCMP(T Arg1, T Arg2,
116 const uint8_t *Data, size_t Size);
117 DictionaryEntry MakeDictionaryEntryFromCMP(const Word &Arg1, const Word &Arg2,
118 const uint8_t *Data, size_t Size);
119 DictionaryEntry MakeDictionaryEntryFromCMP(const void *Arg1, const void *Arg2,
120 const void *Arg1Mutation,
121 const void *Arg2Mutation,
123 const uint8_t *Data, size_t Size);
126 const FuzzingOptions Options;
128 // Dictionary provided by the user via -dict=DICT_FILE.
129 Dictionary ManualDictionary;
130 // Temporary dictionary modified by the fuzzer itself,
131 // recreated periodically.
132 Dictionary TempAutoDictionary;
133 // Persistent dictionary modified by the fuzzer, consists of
134 // entries that led to successful discoveries in the past mutations.
135 Dictionary PersistentAutoDictionary;
137 Vector<DictionaryEntry *> CurrentDictionaryEntrySequence;
139 static const size_t kCmpDictionaryEntriesDequeSize = 16;
140 DictionaryEntry CmpDictionaryEntriesDeque[kCmpDictionaryEntriesDequeSize];
141 size_t CmpDictionaryEntriesDequeIdx = 0;
143 const InputCorpus *Corpus = nullptr;
144 Vector<uint8_t> MutateInPlaceHere;
145 Vector<uint8_t> MutateWithMaskTemp;
146 // CustomCrossOver needs its own buffer as a custom implementation may call
147 // LLVMFuzzerMutate, which in turn may resize MutateInPlaceHere.
148 Vector<uint8_t> CustomCrossOverInPlaceHere;
150 Vector<Mutator> Mutators;
151 Vector<Mutator> DefaultMutators;
152 Vector<Mutator> CurrentMutatorSequence;
155 } // namespace fuzzer
157 #endif // LLVM_FUZZER_MUTATE_H