1 //===- FuzzerInternal.h - Internal header for the Fuzzer --------*- C++ -* ===//
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
8 // Define the main class fuzzer::Fuzzer and most functions.
9 //===----------------------------------------------------------------------===//
11 #ifndef LLVM_FUZZER_INTERNAL_H
12 #define LLVM_FUZZER_INTERNAL_H
14 #include "FuzzerDataFlowTrace.h"
15 #include "FuzzerDefs.h"
16 #include "FuzzerExtFunctions.h"
17 #include "FuzzerInterface.h"
18 #include "FuzzerOptions.h"
19 #include "FuzzerSHA1.h"
20 #include "FuzzerValueBitMap.h"
30 using namespace std::chrono;
35 Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD,
36 FuzzingOptions Options);
38 void Loop(Vector<SizedFile> &CorporaFiles);
39 void ReadAndExecuteSeedCorpora(Vector<SizedFile> &CorporaFiles);
40 void MinimizeCrashLoop(const Unit &U);
41 void RereadOutputCorpus(size_t MaxSize);
43 size_t secondsSinceProcessStartUp() {
44 return duration_cast<seconds>(system_clock::now() - ProcessStartTime)
49 return Options.MaxTotalTimeSec > 0 &&
50 secondsSinceProcessStartUp() >
51 static_cast<size_t>(Options.MaxTotalTimeSec);
55 size_t Seconds = secondsSinceProcessStartUp();
56 return Seconds ? TotalNumberOfRuns / Seconds : 0;
59 size_t getTotalNumberOfRuns() { return TotalNumberOfRuns; }
61 static void StaticAlarmCallback();
62 static void StaticCrashSignalCallback();
63 static void StaticExitCallback();
64 static void StaticInterruptCallback();
65 static void StaticFileSizeExceedCallback();
66 static void StaticGracefulExitCallback();
68 void ExecuteCallback(const uint8_t *Data, size_t Size);
69 bool RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile = false,
70 InputInfo *II = nullptr, bool *FoundUniqFeatures = nullptr);
72 // Merge Corpora[1:] into Corpora[0].
73 void Merge(const Vector<std::string> &Corpora);
74 void CrashResistantMergeInternalStep(const std::string &ControlFilePath);
75 MutationDispatcher &GetMD() { return MD; }
76 void PrintFinalStats();
77 void SetMaxInputLen(size_t MaxInputLen);
78 void SetMaxMutationLen(size_t MaxMutationLen);
79 void RssLimitCallback();
81 bool InFuzzingThread() const { return IsMyThread; }
82 size_t GetCurrentUnitInFuzzingThead(const uint8_t **Data) const;
83 void TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
84 bool DuringInitialCorpusExecution);
86 void HandleMalloc(size_t Size);
87 static void MaybeExitGracefully();
88 std::string WriteToOutputCorpus(const Unit &U);
94 void CrashOnOverwrittenData();
95 void InterruptCallback();
96 void MutateAndTestOne();
97 void PurgeAllocator();
98 void ReportNewCoverage(InputInfo *II, const Unit &U);
99 void PrintPulseAndReportSlowInput(const uint8_t *Data, size_t Size);
100 void WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix);
101 void PrintStats(const char *Where, const char *End = "\n", size_t Units = 0);
102 void PrintStatusForNewUnit(const Unit &U, const char *Text);
103 void CheckExitOnSrcPosOrItem();
105 static void StaticDeathCallback();
106 void DumpCurrentUnit(const char *Prefix);
107 void DeathCallback();
109 void AllocateCurrentUnitData();
110 uint8_t *CurrentUnitData = nullptr;
111 std::atomic<size_t> CurrentUnitSize;
112 uint8_t BaseSha1[kSHA1NumBytes]; // Checksum of the base unit.
114 bool GracefulExitRequested = false;
116 size_t TotalNumberOfRuns = 0;
117 size_t NumberOfNewUnitsAdded = 0;
119 size_t LastCorpusUpdateRun = 0;
121 bool HasMoreMallocsThanFrees = false;
122 size_t NumberOfLeakDetectionAttempts = 0;
124 system_clock::time_point LastAllocatorPurgeAttemptTime = system_clock::now();
128 MutationDispatcher &MD;
129 FuzzingOptions Options;
132 system_clock::time_point ProcessStartTime = system_clock::now();
133 system_clock::time_point UnitStartTime, UnitStopTime;
134 long TimeOfLongestUnitInSeconds = 0;
135 long EpochOfLastReadOfOutputCorpus = 0;
137 size_t MaxInputLen = 0;
138 size_t MaxMutationLen = 0;
139 size_t TmpMaxMutationLen = 0;
141 Vector<uint32_t> UniqFeatureSetTmp;
143 // Need to know our own thread.
144 static thread_local bool IsMyThread;
147 struct ScopedEnableMsanInterceptorChecks {
148 ScopedEnableMsanInterceptorChecks() {
149 if (EF->__msan_scoped_enable_interceptor_checks)
150 EF->__msan_scoped_enable_interceptor_checks();
152 ~ScopedEnableMsanInterceptorChecks() {
153 if (EF->__msan_scoped_disable_interceptor_checks)
154 EF->__msan_scoped_disable_interceptor_checks();
158 struct ScopedDisableMsanInterceptorChecks {
159 ScopedDisableMsanInterceptorChecks() {
160 if (EF->__msan_scoped_disable_interceptor_checks)
161 EF->__msan_scoped_disable_interceptor_checks();
163 ~ScopedDisableMsanInterceptorChecks() {
164 if (EF->__msan_scoped_enable_interceptor_checks)
165 EF->__msan_scoped_enable_interceptor_checks();
169 } // namespace fuzzer
171 #endif // LLVM_FUZZER_INTERNAL_H