1 //===- FuzzerLoop.cpp - Fuzzer's main loop --------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 // Fuzzer's main loop.
9 //===----------------------------------------------------------------------===//
10 
11 #include "FuzzerCorpus.h"
12 #include "FuzzerIO.h"
13 #include "FuzzerInternal.h"
14 #include "FuzzerMutate.h"
15 #include "FuzzerRandom.h"
16 #include "FuzzerTracePC.h"
17 #include <algorithm>
18 #include <cstring>
19 #include <memory>
20 #include <mutex>
21 #include <set>
22 
23 #if defined(__has_include)
24 #if __has_include(<sanitizer / lsan_interface.h>)
25 #include <sanitizer/lsan_interface.h>
26 #endif
27 #endif
28 
29 #define NO_SANITIZE_MEMORY
30 #if defined(__has_feature)
31 #if __has_feature(memory_sanitizer)
32 #undef NO_SANITIZE_MEMORY
33 #define NO_SANITIZE_MEMORY __attribute__((no_sanitize_memory))
34 #endif
35 #endif
36 
37 namespace fuzzer {
38 static const size_t kMaxUnitSizeToPrint = 256;
39 
40 thread_local bool Fuzzer::IsMyThread;
41 
42 bool RunningUserCallback = false;
43 
44 // Only one Fuzzer per process.
45 static Fuzzer *F;
46 
47 // Leak detection is expensive, so we first check if there were more mallocs
48 // than frees (using the sanitizer malloc hooks) and only then try to call lsan.
49 struct MallocFreeTracer {
50   void Start(int TraceLevel) {
51     this->TraceLevel = TraceLevel;
52     if (TraceLevel)
53       Printf("MallocFreeTracer: START\n");
54     Mallocs = 0;
55     Frees = 0;
56   }
57   // Returns true if there were more mallocs than frees.
58   bool Stop() {
59     if (TraceLevel)
60       Printf("MallocFreeTracer: STOP %zd %zd (%s)\n", Mallocs.load(),
61              Frees.load(), Mallocs == Frees ? "same" : "DIFFERENT");
62     bool Result = Mallocs > Frees;
63     Mallocs = 0;
64     Frees = 0;
65     TraceLevel = 0;
66     return Result;
67   }
68   std::atomic<size_t> Mallocs;
69   std::atomic<size_t> Frees;
70   int TraceLevel = 0;
71 
72   std::recursive_mutex TraceMutex;
73   bool TraceDisabled = false;
74 };
75 
76 static MallocFreeTracer AllocTracer;
77 
78 // Locks printing and avoids nested hooks triggered from mallocs/frees in
79 // sanitizer.
80 class TraceLock {
81 public:
82   TraceLock() : Lock(AllocTracer.TraceMutex) {
83     AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled;
84   }
85   ~TraceLock() { AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled; }
86 
87   bool IsDisabled() const {
88     // This is already inverted value.
89     return !AllocTracer.TraceDisabled;
90   }
91 
92 private:
93   std::lock_guard<std::recursive_mutex> Lock;
94 };
95 
96 ATTRIBUTE_NO_SANITIZE_MEMORY
97 void MallocHook(const volatile void *ptr, size_t size) {
98   size_t N = AllocTracer.Mallocs++;
99   F->HandleMalloc(size);
100   if (int TraceLevel = AllocTracer.TraceLevel) {
101     TraceLock Lock;
102     if (Lock.IsDisabled())
103       return;
104     Printf("MALLOC[%zd] %p %zd\n", N, ptr, size);
105     if (TraceLevel >= 2 && EF)
106       PrintStackTrace();
107   }
108 }
109 
110 ATTRIBUTE_NO_SANITIZE_MEMORY
111 void FreeHook(const volatile void *ptr) {
112   size_t N = AllocTracer.Frees++;
113   if (int TraceLevel = AllocTracer.TraceLevel) {
114     TraceLock Lock;
115     if (Lock.IsDisabled())
116       return;
117     Printf("FREE[%zd]   %p\n", N, ptr);
118     if (TraceLevel >= 2 && EF)
119       PrintStackTrace();
120   }
121 }
122 
123 // Crash on a single malloc that exceeds the rss limit.
124 void Fuzzer::HandleMalloc(size_t Size) {
125   if (!Options.MallocLimitMb || (Size >> 20) < (size_t)Options.MallocLimitMb)
126     return;
127   Printf("==%d== ERROR: libFuzzer: out-of-memory (malloc(%zd))\n", GetPid(),
128          Size);
129   Printf("   To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
130   PrintStackTrace();
131   DumpCurrentUnit("oom-");
132   Printf("SUMMARY: libFuzzer: out-of-memory\n");
133   PrintFinalStats();
134   _Exit(Options.OOMExitCode); // Stop right now.
135 }
136 
137 Fuzzer::Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD,
138                FuzzingOptions Options)
139     : CB(CB), Corpus(Corpus), MD(MD), Options(Options) {
140   if (EF->__sanitizer_set_death_callback)
141     EF->__sanitizer_set_death_callback(StaticDeathCallback);
142   assert(!F);
143   F = this;
144   TPC.ResetMaps();
145   IsMyThread = true;
146   if (Options.DetectLeaks && EF->__sanitizer_install_malloc_and_free_hooks)
147     EF->__sanitizer_install_malloc_and_free_hooks(MallocHook, FreeHook);
148   TPC.SetUseCounters(Options.UseCounters);
149   TPC.SetUseValueProfileMask(Options.UseValueProfile);
150 
151   if (Options.Verbosity)
152     TPC.PrintModuleInfo();
153   if (!Options.OutputCorpus.empty() && Options.ReloadIntervalSec)
154     EpochOfLastReadOfOutputCorpus = GetEpoch(Options.OutputCorpus);
155   MaxInputLen = MaxMutationLen = Options.MaxLen;
156   TmpMaxMutationLen = 0;  // Will be set once we load the corpus.
157   AllocateCurrentUnitData();
158   CurrentUnitSize = 0;
159   memset(BaseSha1, 0, sizeof(BaseSha1));
160   TPC.SetFocusFunction(Options.FocusFunction);
161   DFT.Init(Options.DataFlowTrace, Options.FocusFunction);
162 }
163 
164 Fuzzer::~Fuzzer() {}
165 
166 void Fuzzer::AllocateCurrentUnitData() {
167   if (CurrentUnitData || MaxInputLen == 0)
168     return;
169   CurrentUnitData = new uint8_t[MaxInputLen];
170 }
171 
172 void Fuzzer::StaticDeathCallback() {
173   assert(F);
174   F->DeathCallback();
175 }
176 
177 void Fuzzer::DumpCurrentUnit(const char *Prefix) {
178   if (!CurrentUnitData)
179     return; // Happens when running individual inputs.
180   ScopedDisableMsanInterceptorChecks S;
181   MD.PrintMutationSequence();
182   Printf("; base unit: %s\n", Sha1ToString(BaseSha1).c_str());
183   size_t UnitSize = CurrentUnitSize;
184   if (UnitSize <= kMaxUnitSizeToPrint) {
185     PrintHexArray(CurrentUnitData, UnitSize, "\n");
186     PrintASCII(CurrentUnitData, UnitSize, "\n");
187   }
188   WriteUnitToFileWithPrefix({CurrentUnitData, CurrentUnitData + UnitSize},
189                             Prefix);
190 }
191 
192 NO_SANITIZE_MEMORY
193 void Fuzzer::DeathCallback() {
194   DumpCurrentUnit("crash-");
195   PrintFinalStats();
196 }
197 
198 void Fuzzer::StaticAlarmCallback() {
199   assert(F);
200   F->AlarmCallback();
201 }
202 
203 void Fuzzer::StaticCrashSignalCallback() {
204   assert(F);
205   F->CrashCallback();
206 }
207 
208 void Fuzzer::StaticExitCallback() {
209   assert(F);
210   F->ExitCallback();
211 }
212 
213 void Fuzzer::StaticInterruptCallback() {
214   assert(F);
215   F->InterruptCallback();
216 }
217 
218 void Fuzzer::StaticGracefulExitCallback() {
219   assert(F);
220   F->GracefulExitRequested = true;
221   Printf("INFO: signal received, trying to exit gracefully\n");
222 }
223 
224 void Fuzzer::StaticFileSizeExceedCallback() {
225   Printf("==%lu== ERROR: libFuzzer: file size exceeded\n", GetPid());
226   exit(1);
227 }
228 
229 void Fuzzer::CrashCallback() {
230   if (EF->__sanitizer_acquire_crash_state &&
231       !EF->__sanitizer_acquire_crash_state())
232     return;
233   Printf("==%lu== ERROR: libFuzzer: deadly signal\n", GetPid());
234   PrintStackTrace();
235   Printf("NOTE: libFuzzer has rudimentary signal handlers.\n"
236          "      Combine libFuzzer with AddressSanitizer or similar for better "
237          "crash reports.\n");
238   Printf("SUMMARY: libFuzzer: deadly signal\n");
239   DumpCurrentUnit("crash-");
240   PrintFinalStats();
241   _Exit(Options.ErrorExitCode); // Stop right now.
242 }
243 
244 void Fuzzer::ExitCallback() {
245   if (!RunningUserCallback)
246     return; // This exit did not come from the user callback
247   if (EF->__sanitizer_acquire_crash_state &&
248       !EF->__sanitizer_acquire_crash_state())
249     return;
250   Printf("==%lu== ERROR: libFuzzer: fuzz target exited\n", GetPid());
251   PrintStackTrace();
252   Printf("SUMMARY: libFuzzer: fuzz target exited\n");
253   DumpCurrentUnit("crash-");
254   PrintFinalStats();
255   _Exit(Options.ErrorExitCode);
256 }
257 
258 void Fuzzer::MaybeExitGracefully() {
259   if (!F->GracefulExitRequested) return;
260   Printf("==%lu== INFO: libFuzzer: exiting as requested\n", GetPid());
261   RmDirRecursive(TempPath(".dir"));
262   F->PrintFinalStats();
263   _Exit(0);
264 }
265 
266 void Fuzzer::InterruptCallback() {
267   Printf("==%lu== libFuzzer: run interrupted; exiting\n", GetPid());
268   PrintFinalStats();
269   RmDirRecursive(TempPath(".dir"));
270   // Stop right now, don't perform any at-exit actions.
271   _Exit(Options.InterruptExitCode);
272 }
273 
274 NO_SANITIZE_MEMORY
275 void Fuzzer::AlarmCallback() {
276   assert(Options.UnitTimeoutSec > 0);
277   // In Windows Alarm callback is executed by a different thread.
278   // NetBSD's current behavior needs this change too.
279 #if !LIBFUZZER_WINDOWS && !LIBFUZZER_NETBSD
280   if (!InFuzzingThread())
281     return;
282 #endif
283   if (!RunningUserCallback)
284     return; // We have not started running units yet.
285   size_t Seconds =
286       duration_cast<seconds>(system_clock::now() - UnitStartTime).count();
287   if (Seconds == 0)
288     return;
289   if (Options.Verbosity >= 2)
290     Printf("AlarmCallback %zd\n", Seconds);
291   if (Seconds >= (size_t)Options.UnitTimeoutSec) {
292     if (EF->__sanitizer_acquire_crash_state &&
293         !EF->__sanitizer_acquire_crash_state())
294       return;
295     Printf("ALARM: working on the last Unit for %zd seconds\n", Seconds);
296     Printf("       and the timeout value is %d (use -timeout=N to change)\n",
297            Options.UnitTimeoutSec);
298     DumpCurrentUnit("timeout-");
299     Printf("==%lu== ERROR: libFuzzer: timeout after %d seconds\n", GetPid(),
300            Seconds);
301     PrintStackTrace();
302     Printf("SUMMARY: libFuzzer: timeout\n");
303     PrintFinalStats();
304     _Exit(Options.TimeoutExitCode); // Stop right now.
305   }
306 }
307 
308 void Fuzzer::RssLimitCallback() {
309   if (EF->__sanitizer_acquire_crash_state &&
310       !EF->__sanitizer_acquire_crash_state())
311     return;
312   Printf(
313       "==%lu== ERROR: libFuzzer: out-of-memory (used: %zdMb; limit: %zdMb)\n",
314       GetPid(), GetPeakRSSMb(), Options.RssLimitMb);
315   Printf("   To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
316   PrintMemoryProfile();
317   DumpCurrentUnit("oom-");
318   Printf("SUMMARY: libFuzzer: out-of-memory\n");
319   PrintFinalStats();
320   _Exit(Options.OOMExitCode); // Stop right now.
321 }
322 
323 void Fuzzer::PrintStats(const char *Where, const char *End, size_t Units) {
324   size_t ExecPerSec = execPerSec();
325   if (!Options.Verbosity)
326     return;
327   Printf("#%zd\t%s", TotalNumberOfRuns, Where);
328   if (size_t N = TPC.GetTotalPCCoverage())
329     Printf(" cov: %zd", N);
330   if (size_t N = Corpus.NumFeatures())
331     Printf(" ft: %zd", N);
332   if (!Corpus.empty()) {
333     Printf(" corp: %zd", Corpus.NumActiveUnits());
334     if (size_t N = Corpus.SizeInBytes()) {
335       if (N < (1 << 14))
336         Printf("/%zdb", N);
337       else if (N < (1 << 24))
338         Printf("/%zdKb", N >> 10);
339       else
340         Printf("/%zdMb", N >> 20);
341     }
342     if (size_t FF = Corpus.NumInputsThatTouchFocusFunction())
343       Printf(" focus: %zd", FF);
344   }
345   if (TmpMaxMutationLen)
346     Printf(" lim: %zd", TmpMaxMutationLen);
347   if (Units)
348     Printf(" units: %zd", Units);
349 
350   Printf(" exec/s: %zd", ExecPerSec);
351   Printf(" rss: %zdMb", GetPeakRSSMb());
352   Printf("%s", End);
353 }
354 
355 void Fuzzer::PrintFinalStats() {
356   if (Options.PrintCoverage)
357     TPC.PrintCoverage();
358   if (Options.PrintCorpusStats)
359     Corpus.PrintStats();
360   if (!Options.PrintFinalStats)
361     return;
362   size_t ExecPerSec = execPerSec();
363   Printf("stat::number_of_executed_units: %zd\n", TotalNumberOfRuns);
364   Printf("stat::average_exec_per_sec:     %zd\n", ExecPerSec);
365   Printf("stat::new_units_added:          %zd\n", NumberOfNewUnitsAdded);
366   Printf("stat::slowest_unit_time_sec:    %zd\n", TimeOfLongestUnitInSeconds);
367   Printf("stat::peak_rss_mb:              %zd\n", GetPeakRSSMb());
368 }
369 
370 void Fuzzer::SetMaxInputLen(size_t MaxInputLen) {
371   assert(this->MaxInputLen == 0); // Can only reset MaxInputLen from 0 to non-0.
372   assert(MaxInputLen);
373   this->MaxInputLen = MaxInputLen;
374   this->MaxMutationLen = MaxInputLen;
375   AllocateCurrentUnitData();
376   Printf("INFO: -max_len is not provided; "
377          "libFuzzer will not generate inputs larger than %zd bytes\n",
378          MaxInputLen);
379 }
380 
381 void Fuzzer::SetMaxMutationLen(size_t MaxMutationLen) {
382   assert(MaxMutationLen && MaxMutationLen <= MaxInputLen);
383   this->MaxMutationLen = MaxMutationLen;
384 }
385 
386 void Fuzzer::CheckExitOnSrcPosOrItem() {
387   if (!Options.ExitOnSrcPos.empty()) {
388     static auto *PCsSet = new Set<uintptr_t>;
389     auto HandlePC = [&](const TracePC::PCTableEntry *TE) {
390       if (!PCsSet->insert(TE->PC).second)
391         return;
392       std::string Descr = DescribePC("%F %L", TE->PC + 1);
393       if (Descr.find(Options.ExitOnSrcPos) != std::string::npos) {
394         Printf("INFO: found line matching '%s', exiting.\n",
395                Options.ExitOnSrcPos.c_str());
396         _Exit(0);
397       }
398     };
399     TPC.ForEachObservedPC(HandlePC);
400   }
401   if (!Options.ExitOnItem.empty()) {
402     if (Corpus.HasUnit(Options.ExitOnItem)) {
403       Printf("INFO: found item with checksum '%s', exiting.\n",
404              Options.ExitOnItem.c_str());
405       _Exit(0);
406     }
407   }
408 }
409 
410 void Fuzzer::RereadOutputCorpus(size_t MaxSize) {
411   if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec)
412     return;
413   Vector<Unit> AdditionalCorpus;
414   ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus,
415                          &EpochOfLastReadOfOutputCorpus, MaxSize,
416                          /*ExitOnError*/ false);
417   if (Options.Verbosity >= 2)
418     Printf("Reload: read %zd new units.\n", AdditionalCorpus.size());
419   bool Reloaded = false;
420   for (auto &U : AdditionalCorpus) {
421     if (U.size() > MaxSize)
422       U.resize(MaxSize);
423     if (!Corpus.HasUnit(U)) {
424       if (RunOne(U.data(), U.size())) {
425         CheckExitOnSrcPosOrItem();
426         Reloaded = true;
427       }
428     }
429   }
430   if (Reloaded)
431     PrintStats("RELOAD");
432 }
433 
434 void Fuzzer::PrintPulseAndReportSlowInput(const uint8_t *Data, size_t Size) {
435   auto TimeOfUnit =
436       duration_cast<seconds>(UnitStopTime - UnitStartTime).count();
437   if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) &&
438       secondsSinceProcessStartUp() >= 2)
439     PrintStats("pulse ");
440   if (TimeOfUnit > TimeOfLongestUnitInSeconds * 1.1 &&
441       TimeOfUnit >= Options.ReportSlowUnits) {
442     TimeOfLongestUnitInSeconds = TimeOfUnit;
443     Printf("Slowest unit: %zd s:\n", TimeOfLongestUnitInSeconds);
444     WriteUnitToFileWithPrefix({Data, Data + Size}, "slow-unit-");
445   }
446 }
447 
448 static void WriteFeatureSetToFile(const std::string &FeaturesDir,
449                                   const std::string &FileName,
450                                   const Vector<uint32_t> &FeatureSet) {
451   if (FeaturesDir.empty() || FeatureSet.empty()) return;
452   WriteToFile(reinterpret_cast<const uint8_t *>(FeatureSet.data()),
453               FeatureSet.size() * sizeof(FeatureSet[0]),
454               DirPlusFile(FeaturesDir, FileName));
455 }
456 
457 static void RenameFeatureSetFile(const std::string &FeaturesDir,
458                                  const std::string &OldFile,
459                                  const std::string &NewFile) {
460   if (FeaturesDir.empty()) return;
461   RenameFile(DirPlusFile(FeaturesDir, OldFile),
462              DirPlusFile(FeaturesDir, NewFile));
463 }
464 
465 bool Fuzzer::RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile,
466                     InputInfo *II, bool *FoundUniqFeatures) {
467   if (!Size)
468     return false;
469 
470   ExecuteCallback(Data, Size);
471 
472   UniqFeatureSetTmp.clear();
473   size_t FoundUniqFeaturesOfII = 0;
474   size_t NumUpdatesBefore = Corpus.NumFeatureUpdates();
475   TPC.CollectFeatures([&](size_t Feature) {
476     if (Corpus.AddFeature(Feature, Size, Options.Shrink))
477       UniqFeatureSetTmp.push_back(Feature);
478     if (Options.ReduceInputs && II)
479       if (std::binary_search(II->UniqFeatureSet.begin(),
480                              II->UniqFeatureSet.end(), Feature))
481         FoundUniqFeaturesOfII++;
482   });
483   if (FoundUniqFeatures)
484     *FoundUniqFeatures = FoundUniqFeaturesOfII;
485   PrintPulseAndReportSlowInput(Data, Size);
486   size_t NumNewFeatures = Corpus.NumFeatureUpdates() - NumUpdatesBefore;
487   if (NumNewFeatures) {
488     TPC.UpdateObservedPCs();
489     auto NewII = Corpus.AddToCorpus({Data, Data + Size}, NumNewFeatures,
490                                     MayDeleteFile, TPC.ObservedFocusFunction(),
491                                     UniqFeatureSetTmp, DFT, II);
492     WriteFeatureSetToFile(Options.FeaturesDir, Sha1ToString(NewII->Sha1),
493                           NewII->UniqFeatureSet);
494     return true;
495   }
496   if (II && FoundUniqFeaturesOfII &&
497       II->DataFlowTraceForFocusFunction.empty() &&
498       FoundUniqFeaturesOfII == II->UniqFeatureSet.size() &&
499       II->U.size() > Size) {
500     auto OldFeaturesFile = Sha1ToString(II->Sha1);
501     Corpus.Replace(II, {Data, Data + Size});
502     RenameFeatureSetFile(Options.FeaturesDir, OldFeaturesFile,
503                          Sha1ToString(II->Sha1));
504     return true;
505   }
506   return false;
507 }
508 
509 size_t Fuzzer::GetCurrentUnitInFuzzingThead(const uint8_t **Data) const {
510   assert(InFuzzingThread());
511   *Data = CurrentUnitData;
512   return CurrentUnitSize;
513 }
514 
515 void Fuzzer::CrashOnOverwrittenData() {
516   Printf("==%d== ERROR: libFuzzer: fuzz target overwrites it's const input\n",
517          GetPid());
518   DumpCurrentUnit("crash-");
519   Printf("SUMMARY: libFuzzer: out-of-memory\n");
520   _Exit(Options.ErrorExitCode); // Stop right now.
521 }
522 
523 // Compare two arrays, but not all bytes if the arrays are large.
524 static bool LooseMemeq(const uint8_t *A, const uint8_t *B, size_t Size) {
525   const size_t Limit = 64;
526   if (Size <= 64)
527     return !memcmp(A, B, Size);
528   // Compare first and last Limit/2 bytes.
529   return !memcmp(A, B, Limit / 2) &&
530          !memcmp(A + Size - Limit / 2, B + Size - Limit / 2, Limit / 2);
531 }
532 
533 void Fuzzer::ExecuteCallback(const uint8_t *Data, size_t Size) {
534   TPC.RecordInitialStack();
535   TotalNumberOfRuns++;
536   assert(InFuzzingThread());
537   // We copy the contents of Unit into a separate heap buffer
538   // so that we reliably find buffer overflows in it.
539   uint8_t *DataCopy = new uint8_t[Size];
540   memcpy(DataCopy, Data, Size);
541   if (EF->__msan_unpoison)
542     EF->__msan_unpoison(DataCopy, Size);
543   if (CurrentUnitData && CurrentUnitData != Data)
544     memcpy(CurrentUnitData, Data, Size);
545   CurrentUnitSize = Size;
546   {
547     ScopedEnableMsanInterceptorChecks S;
548     AllocTracer.Start(Options.TraceMalloc);
549     UnitStartTime = system_clock::now();
550     TPC.ResetMaps();
551     RunningUserCallback = true;
552     int Res = CB(DataCopy, Size);
553     RunningUserCallback = false;
554     UnitStopTime = system_clock::now();
555     (void)Res;
556     assert(Res == 0);
557     HasMoreMallocsThanFrees = AllocTracer.Stop();
558   }
559   if (!LooseMemeq(DataCopy, Data, Size))
560     CrashOnOverwrittenData();
561   CurrentUnitSize = 0;
562   delete[] DataCopy;
563 }
564 
565 std::string Fuzzer::WriteToOutputCorpus(const Unit &U) {
566   if (Options.OnlyASCII)
567     assert(IsASCII(U));
568   if (Options.OutputCorpus.empty())
569     return "";
570   std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U));
571   WriteToFile(U, Path);
572   if (Options.Verbosity >= 2)
573     Printf("Written %zd bytes to %s\n", U.size(), Path.c_str());
574   return Path;
575 }
576 
577 void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) {
578   if (!Options.SaveArtifacts)
579     return;
580   std::string Path = Options.ArtifactPrefix + Prefix + Hash(U);
581   if (!Options.ExactArtifactPath.empty())
582     Path = Options.ExactArtifactPath; // Overrides ArtifactPrefix.
583   WriteToFile(U, Path);
584   Printf("artifact_prefix='%s'; Test unit written to %s\n",
585          Options.ArtifactPrefix.c_str(), Path.c_str());
586   if (U.size() <= kMaxUnitSizeToPrint)
587     Printf("Base64: %s\n", Base64(U).c_str());
588 }
589 
590 void Fuzzer::PrintStatusForNewUnit(const Unit &U, const char *Text) {
591   if (!Options.PrintNEW)
592     return;
593   PrintStats(Text, "");
594   if (Options.Verbosity) {
595     Printf(" L: %zd/%zd ", U.size(), Corpus.MaxInputSize());
596     MD.PrintMutationSequence();
597     Printf("\n");
598   }
599 }
600 
601 void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) {
602   II->NumSuccessfullMutations++;
603   MD.RecordSuccessfulMutationSequence();
604   PrintStatusForNewUnit(U, II->Reduced ? "REDUCE" : "NEW   ");
605   WriteToOutputCorpus(U);
606   NumberOfNewUnitsAdded++;
607   CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus.
608   LastCorpusUpdateRun = TotalNumberOfRuns;
609 }
610 
611 // Tries detecting a memory leak on the particular input that we have just
612 // executed before calling this function.
613 void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
614                                      bool DuringInitialCorpusExecution) {
615   if (!HasMoreMallocsThanFrees)
616     return; // mallocs==frees, a leak is unlikely.
617   if (!Options.DetectLeaks)
618     return;
619   if (!DuringInitialCorpusExecution &&
620       TotalNumberOfRuns >= Options.MaxNumberOfRuns)
621     return;
622   if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) ||
623       !(EF->__lsan_do_recoverable_leak_check))
624     return; // No lsan.
625   // Run the target once again, but with lsan disabled so that if there is
626   // a real leak we do not report it twice.
627   EF->__lsan_disable();
628   ExecuteCallback(Data, Size);
629   EF->__lsan_enable();
630   if (!HasMoreMallocsThanFrees)
631     return; // a leak is unlikely.
632   if (NumberOfLeakDetectionAttempts++ > 1000) {
633     Options.DetectLeaks = false;
634     Printf("INFO: libFuzzer disabled leak detection after every mutation.\n"
635            "      Most likely the target function accumulates allocated\n"
636            "      memory in a global state w/o actually leaking it.\n"
637            "      You may try running this binary with -trace_malloc=[12]"
638            "      to get a trace of mallocs and frees.\n"
639            "      If LeakSanitizer is enabled in this process it will still\n"
640            "      run on the process shutdown.\n");
641     return;
642   }
643   // Now perform the actual lsan pass. This is expensive and we must ensure
644   // we don't call it too often.
645   if (EF->__lsan_do_recoverable_leak_check()) { // Leak is found, report it.
646     if (DuringInitialCorpusExecution)
647       Printf("\nINFO: a leak has been found in the initial corpus.\n\n");
648     Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n");
649     CurrentUnitSize = Size;
650     DumpCurrentUnit("leak-");
651     PrintFinalStats();
652     _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on.
653   }
654 }
655 
656 void Fuzzer::MutateAndTestOne() {
657   MD.StartMutationSequence();
658 
659   auto &II = Corpus.ChooseUnitToMutate(MD.GetRand());
660   if (Options.DoCrossOver)
661     MD.SetCrossOverWith(&Corpus.ChooseUnitToMutate(MD.GetRand()).U);
662   const auto &U = II.U;
663   memcpy(BaseSha1, II.Sha1, sizeof(BaseSha1));
664   assert(CurrentUnitData);
665   size_t Size = U.size();
666   assert(Size <= MaxInputLen && "Oversized Unit");
667   memcpy(CurrentUnitData, U.data(), Size);
668 
669   assert(MaxMutationLen > 0);
670 
671   size_t CurrentMaxMutationLen =
672       Min(MaxMutationLen, Max(U.size(), TmpMaxMutationLen));
673   assert(CurrentMaxMutationLen > 0);
674 
675   for (int i = 0; i < Options.MutateDepth; i++) {
676     if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
677       break;
678     MaybeExitGracefully();
679     size_t NewSize = 0;
680     if (II.HasFocusFunction && !II.DataFlowTraceForFocusFunction.empty() &&
681         Size <= CurrentMaxMutationLen)
682       NewSize = MD.MutateWithMask(CurrentUnitData, Size, Size,
683                                   II.DataFlowTraceForFocusFunction);
684 
685     // If MutateWithMask either failed or wasn't called, call default Mutate.
686     if (!NewSize)
687       NewSize = MD.Mutate(CurrentUnitData, Size, CurrentMaxMutationLen);
688     assert(NewSize > 0 && "Mutator returned empty unit");
689     assert(NewSize <= CurrentMaxMutationLen && "Mutator return oversized unit");
690     Size = NewSize;
691     II.NumExecutedMutations++;
692 
693     bool FoundUniqFeatures = false;
694     bool NewCov = RunOne(CurrentUnitData, Size, /*MayDeleteFile=*/true, &II,
695                          &FoundUniqFeatures);
696     TryDetectingAMemoryLeak(CurrentUnitData, Size,
697                             /*DuringInitialCorpusExecution*/ false);
698     if (NewCov) {
699       ReportNewCoverage(&II, {CurrentUnitData, CurrentUnitData + Size});
700       break;  // We will mutate this input more in the next rounds.
701     }
702     if (Options.ReduceDepth && !FoundUniqFeatures)
703         break;
704   }
705 }
706 
707 void Fuzzer::PurgeAllocator() {
708   if (Options.PurgeAllocatorIntervalSec < 0 || !EF->__sanitizer_purge_allocator)
709     return;
710   if (duration_cast<seconds>(system_clock::now() -
711                              LastAllocatorPurgeAttemptTime)
712           .count() < Options.PurgeAllocatorIntervalSec)
713     return;
714 
715   if (Options.RssLimitMb <= 0 ||
716       GetPeakRSSMb() > static_cast<size_t>(Options.RssLimitMb) / 2)
717     EF->__sanitizer_purge_allocator();
718 
719   LastAllocatorPurgeAttemptTime = system_clock::now();
720 }
721 
722 void Fuzzer::ReadAndExecuteSeedCorpora(
723     const Vector<std::string> &CorpusDirs,
724     const Vector<std::string> &ExtraSeedFiles) {
725   const size_t kMaxSaneLen = 1 << 20;
726   const size_t kMinDefaultLen = 4096;
727   Vector<SizedFile> SizedFiles;
728   size_t MaxSize = 0;
729   size_t MinSize = -1;
730   size_t TotalSize = 0;
731   size_t LastNumFiles = 0;
732   for (auto &Dir : CorpusDirs) {
733     GetSizedFilesFromDir(Dir, &SizedFiles);
734     Printf("INFO: % 8zd files found in %s\n", SizedFiles.size() - LastNumFiles,
735            Dir.c_str());
736     LastNumFiles = SizedFiles.size();
737   }
738   // Add files from -seed_inputs.
739   for (auto &File : ExtraSeedFiles)
740     if (auto Size = FileSize(File))
741       SizedFiles.push_back({File, Size});
742 
743   for (auto &File : SizedFiles) {
744     MaxSize = Max(File.Size, MaxSize);
745     MinSize = Min(File.Size, MinSize);
746     TotalSize += File.Size;
747   }
748   if (Options.MaxLen == 0)
749     SetMaxInputLen(std::min(std::max(kMinDefaultLen, MaxSize), kMaxSaneLen));
750   assert(MaxInputLen > 0);
751 
752   // Test the callback with empty input and never try it again.
753   uint8_t dummy = 0;
754   ExecuteCallback(&dummy, 0);
755 
756   // Protect lazy counters here, after the once-init code has been executed.
757   if (Options.LazyCounters)
758     TPC.ProtectLazyCounters();
759 
760   if (SizedFiles.empty()) {
761     Printf("INFO: A corpus is not provided, starting from an empty corpus\n");
762     Unit U({'\n'}); // Valid ASCII input.
763     RunOne(U.data(), U.size());
764   } else {
765     Printf("INFO: seed corpus: files: %zd min: %zdb max: %zdb total: %zdb"
766            " rss: %zdMb\n",
767            SizedFiles.size(), MinSize, MaxSize, TotalSize, GetPeakRSSMb());
768     if (Options.ShuffleAtStartUp)
769       std::shuffle(SizedFiles.begin(), SizedFiles.end(), MD.GetRand());
770 
771     if (Options.PreferSmall) {
772       std::stable_sort(SizedFiles.begin(), SizedFiles.end());
773       assert(SizedFiles.front().Size <= SizedFiles.back().Size);
774     }
775 
776     // Load and execute inputs one by one.
777     for (auto &SF : SizedFiles) {
778       auto U = FileToVector(SF.File, MaxInputLen, /*ExitOnError=*/false);
779       assert(U.size() <= MaxInputLen);
780       RunOne(U.data(), U.size());
781       CheckExitOnSrcPosOrItem();
782       TryDetectingAMemoryLeak(U.data(), U.size(),
783                               /*DuringInitialCorpusExecution*/ true);
784     }
785   }
786 
787   PrintStats("INITED");
788   if (!Options.FocusFunction.empty())
789     Printf("INFO: %zd/%zd inputs touch the focus function\n",
790            Corpus.NumInputsThatTouchFocusFunction(), Corpus.size());
791   if (!Options.DataFlowTrace.empty())
792     Printf("INFO: %zd/%zd inputs have the Data Flow Trace\n",
793            Corpus.NumInputsWithDataFlowTrace(), Corpus.size());
794 
795   if (Corpus.empty() && Options.MaxNumberOfRuns) {
796     Printf("ERROR: no interesting inputs were found. "
797            "Is the code instrumented for coverage? Exiting.\n");
798     exit(1);
799   }
800 }
801 
802 void Fuzzer::Loop(const Vector<std::string> &CorpusDirs,
803                   const Vector<std::string> &ExtraSeedFiles) {
804   ReadAndExecuteSeedCorpora(CorpusDirs, ExtraSeedFiles);
805   DFT.Clear();  // No need for DFT any more.
806   TPC.SetPrintNewPCs(Options.PrintNewCovPcs);
807   TPC.SetPrintNewFuncs(Options.PrintNewCovFuncs);
808   system_clock::time_point LastCorpusReload = system_clock::now();
809 
810   TmpMaxMutationLen =
811       Min(MaxMutationLen, Max(size_t(4), Corpus.MaxInputSize()));
812 
813   while (true) {
814     auto Now = system_clock::now();
815     if (duration_cast<seconds>(Now - LastCorpusReload).count() >=
816         Options.ReloadIntervalSec) {
817       RereadOutputCorpus(MaxInputLen);
818       LastCorpusReload = system_clock::now();
819     }
820     if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
821       break;
822     if (TimedOut())
823       break;
824 
825     // Update TmpMaxMutationLen
826     if (Options.LenControl) {
827       if (TmpMaxMutationLen < MaxMutationLen &&
828           TotalNumberOfRuns - LastCorpusUpdateRun >
829               Options.LenControl * Log(TmpMaxMutationLen)) {
830         TmpMaxMutationLen =
831             Min(MaxMutationLen, TmpMaxMutationLen + Log(TmpMaxMutationLen));
832         LastCorpusUpdateRun = TotalNumberOfRuns;
833       }
834     } else {
835       TmpMaxMutationLen = MaxMutationLen;
836     }
837 
838     // Perform several mutations and runs.
839     MutateAndTestOne();
840 
841     PurgeAllocator();
842   }
843 
844   PrintStats("DONE  ", "\n");
845   MD.PrintRecommendedDictionary();
846 }
847 
848 void Fuzzer::MinimizeCrashLoop(const Unit &U) {
849   if (U.size() <= 1)
850     return;
851   while (!TimedOut() && TotalNumberOfRuns < Options.MaxNumberOfRuns) {
852     MD.StartMutationSequence();
853     memcpy(CurrentUnitData, U.data(), U.size());
854     for (int i = 0; i < Options.MutateDepth; i++) {
855       size_t NewSize = MD.Mutate(CurrentUnitData, U.size(), MaxMutationLen);
856       assert(NewSize > 0 && NewSize <= MaxMutationLen);
857       ExecuteCallback(CurrentUnitData, NewSize);
858       PrintPulseAndReportSlowInput(CurrentUnitData, NewSize);
859       TryDetectingAMemoryLeak(CurrentUnitData, NewSize,
860                               /*DuringInitialCorpusExecution*/ false);
861     }
862   }
863 }
864 
865 } // namespace fuzzer
866 
867 extern "C" {
868 
869 ATTRIBUTE_INTERFACE size_t
870 LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
871   assert(fuzzer::F);
872   return fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize);
873 }
874 
875 } // extern "C"
876