1 //===- FuzzerLoop.cpp - Fuzzer's main loop --------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // Fuzzer's main loop. 9 //===----------------------------------------------------------------------===// 10 11 #include "FuzzerCorpus.h" 12 #include "FuzzerIO.h" 13 #include "FuzzerInternal.h" 14 #include "FuzzerMutate.h" 15 #include "FuzzerRandom.h" 16 #include "FuzzerTracePC.h" 17 #include <algorithm> 18 #include <cstring> 19 #include <memory> 20 #include <mutex> 21 #include <set> 22 23 #if defined(__has_include) 24 #if __has_include(<sanitizer / lsan_interface.h>) 25 #include <sanitizer/lsan_interface.h> 26 #endif 27 #endif 28 29 #define NO_SANITIZE_MEMORY 30 #if defined(__has_feature) 31 #if __has_feature(memory_sanitizer) 32 #undef NO_SANITIZE_MEMORY 33 #define NO_SANITIZE_MEMORY __attribute__((no_sanitize_memory)) 34 #endif 35 #endif 36 37 namespace fuzzer { 38 static const size_t kMaxUnitSizeToPrint = 256; 39 40 thread_local bool Fuzzer::IsMyThread; 41 42 bool RunningUserCallback = false; 43 44 // Only one Fuzzer per process. 45 static Fuzzer *F; 46 47 // Leak detection is expensive, so we first check if there were more mallocs 48 // than frees (using the sanitizer malloc hooks) and only then try to call lsan. 49 struct MallocFreeTracer { 50 void Start(int TraceLevel) { 51 this->TraceLevel = TraceLevel; 52 if (TraceLevel) 53 Printf("MallocFreeTracer: START\n"); 54 Mallocs = 0; 55 Frees = 0; 56 } 57 // Returns true if there were more mallocs than frees. 58 bool Stop() { 59 if (TraceLevel) 60 Printf("MallocFreeTracer: STOP %zd %zd (%s)\n", Mallocs.load(), 61 Frees.load(), Mallocs == Frees ? "same" : "DIFFERENT"); 62 bool Result = Mallocs > Frees; 63 Mallocs = 0; 64 Frees = 0; 65 TraceLevel = 0; 66 return Result; 67 } 68 std::atomic<size_t> Mallocs; 69 std::atomic<size_t> Frees; 70 int TraceLevel = 0; 71 72 std::recursive_mutex TraceMutex; 73 bool TraceDisabled = false; 74 }; 75 76 static MallocFreeTracer AllocTracer; 77 78 // Locks printing and avoids nested hooks triggered from mallocs/frees in 79 // sanitizer. 80 class TraceLock { 81 public: 82 TraceLock() : Lock(AllocTracer.TraceMutex) { 83 AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled; 84 } 85 ~TraceLock() { AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled; } 86 87 bool IsDisabled() const { 88 // This is already inverted value. 89 return !AllocTracer.TraceDisabled; 90 } 91 92 private: 93 std::lock_guard<std::recursive_mutex> Lock; 94 }; 95 96 ATTRIBUTE_NO_SANITIZE_MEMORY 97 void MallocHook(const volatile void *ptr, size_t size) { 98 size_t N = AllocTracer.Mallocs++; 99 F->HandleMalloc(size); 100 if (int TraceLevel = AllocTracer.TraceLevel) { 101 TraceLock Lock; 102 if (Lock.IsDisabled()) 103 return; 104 Printf("MALLOC[%zd] %p %zd\n", N, ptr, size); 105 if (TraceLevel >= 2 && EF) 106 PrintStackTrace(); 107 } 108 } 109 110 ATTRIBUTE_NO_SANITIZE_MEMORY 111 void FreeHook(const volatile void *ptr) { 112 size_t N = AllocTracer.Frees++; 113 if (int TraceLevel = AllocTracer.TraceLevel) { 114 TraceLock Lock; 115 if (Lock.IsDisabled()) 116 return; 117 Printf("FREE[%zd] %p\n", N, ptr); 118 if (TraceLevel >= 2 && EF) 119 PrintStackTrace(); 120 } 121 } 122 123 // Crash on a single malloc that exceeds the rss limit. 124 void Fuzzer::HandleMalloc(size_t Size) { 125 if (!Options.MallocLimitMb || (Size >> 20) < (size_t)Options.MallocLimitMb) 126 return; 127 Printf("==%d== ERROR: libFuzzer: out-of-memory (malloc(%zd))\n", GetPid(), 128 Size); 129 Printf(" To change the out-of-memory limit use -rss_limit_mb=<N>\n\n"); 130 PrintStackTrace(); 131 DumpCurrentUnit("oom-"); 132 Printf("SUMMARY: libFuzzer: out-of-memory\n"); 133 PrintFinalStats(); 134 _Exit(Options.OOMExitCode); // Stop right now. 135 } 136 137 Fuzzer::Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD, 138 FuzzingOptions Options) 139 : CB(CB), Corpus(Corpus), MD(MD), Options(Options) { 140 if (EF->__sanitizer_set_death_callback) 141 EF->__sanitizer_set_death_callback(StaticDeathCallback); 142 assert(!F); 143 F = this; 144 TPC.ResetMaps(); 145 IsMyThread = true; 146 if (Options.DetectLeaks && EF->__sanitizer_install_malloc_and_free_hooks) 147 EF->__sanitizer_install_malloc_and_free_hooks(MallocHook, FreeHook); 148 TPC.SetUseCounters(Options.UseCounters); 149 TPC.SetUseValueProfileMask(Options.UseValueProfile); 150 151 if (Options.Verbosity) 152 TPC.PrintModuleInfo(); 153 if (!Options.OutputCorpus.empty() && Options.ReloadIntervalSec) 154 EpochOfLastReadOfOutputCorpus = GetEpoch(Options.OutputCorpus); 155 MaxInputLen = MaxMutationLen = Options.MaxLen; 156 TmpMaxMutationLen = 0; // Will be set once we load the corpus. 157 AllocateCurrentUnitData(); 158 CurrentUnitSize = 0; 159 memset(BaseSha1, 0, sizeof(BaseSha1)); 160 auto FocusFunctionOrAuto = Options.FocusFunction; 161 DFT.Init(Options.DataFlowTrace, &FocusFunctionOrAuto , MD.GetRand()); 162 TPC.SetFocusFunction(FocusFunctionOrAuto); 163 } 164 165 Fuzzer::~Fuzzer() {} 166 167 void Fuzzer::AllocateCurrentUnitData() { 168 if (CurrentUnitData || MaxInputLen == 0) 169 return; 170 CurrentUnitData = new uint8_t[MaxInputLen]; 171 } 172 173 void Fuzzer::StaticDeathCallback() { 174 assert(F); 175 F->DeathCallback(); 176 } 177 178 void Fuzzer::DumpCurrentUnit(const char *Prefix) { 179 if (!CurrentUnitData) 180 return; // Happens when running individual inputs. 181 ScopedDisableMsanInterceptorChecks S; 182 MD.PrintMutationSequence(); 183 Printf("; base unit: %s\n", Sha1ToString(BaseSha1).c_str()); 184 size_t UnitSize = CurrentUnitSize; 185 if (UnitSize <= kMaxUnitSizeToPrint) { 186 PrintHexArray(CurrentUnitData, UnitSize, "\n"); 187 PrintASCII(CurrentUnitData, UnitSize, "\n"); 188 } 189 WriteUnitToFileWithPrefix({CurrentUnitData, CurrentUnitData + UnitSize}, 190 Prefix); 191 } 192 193 NO_SANITIZE_MEMORY 194 void Fuzzer::DeathCallback() { 195 DumpCurrentUnit("crash-"); 196 PrintFinalStats(); 197 } 198 199 void Fuzzer::StaticAlarmCallback() { 200 assert(F); 201 F->AlarmCallback(); 202 } 203 204 void Fuzzer::StaticCrashSignalCallback() { 205 assert(F); 206 F->CrashCallback(); 207 } 208 209 void Fuzzer::StaticExitCallback() { 210 assert(F); 211 F->ExitCallback(); 212 } 213 214 void Fuzzer::StaticInterruptCallback() { 215 assert(F); 216 F->InterruptCallback(); 217 } 218 219 void Fuzzer::StaticGracefulExitCallback() { 220 assert(F); 221 F->GracefulExitRequested = true; 222 Printf("INFO: signal received, trying to exit gracefully\n"); 223 } 224 225 void Fuzzer::StaticFileSizeExceedCallback() { 226 Printf("==%lu== ERROR: libFuzzer: file size exceeded\n", GetPid()); 227 exit(1); 228 } 229 230 void Fuzzer::CrashCallback() { 231 if (EF->__sanitizer_acquire_crash_state && 232 !EF->__sanitizer_acquire_crash_state()) 233 return; 234 Printf("==%lu== ERROR: libFuzzer: deadly signal\n", GetPid()); 235 PrintStackTrace(); 236 Printf("NOTE: libFuzzer has rudimentary signal handlers.\n" 237 " Combine libFuzzer with AddressSanitizer or similar for better " 238 "crash reports.\n"); 239 Printf("SUMMARY: libFuzzer: deadly signal\n"); 240 DumpCurrentUnit("crash-"); 241 PrintFinalStats(); 242 _Exit(Options.ErrorExitCode); // Stop right now. 243 } 244 245 void Fuzzer::ExitCallback() { 246 if (!RunningUserCallback) 247 return; // This exit did not come from the user callback 248 if (EF->__sanitizer_acquire_crash_state && 249 !EF->__sanitizer_acquire_crash_state()) 250 return; 251 Printf("==%lu== ERROR: libFuzzer: fuzz target exited\n", GetPid()); 252 PrintStackTrace(); 253 Printf("SUMMARY: libFuzzer: fuzz target exited\n"); 254 DumpCurrentUnit("crash-"); 255 PrintFinalStats(); 256 _Exit(Options.ErrorExitCode); 257 } 258 259 void Fuzzer::MaybeExitGracefully() { 260 if (!F->GracefulExitRequested) return; 261 Printf("==%lu== INFO: libFuzzer: exiting as requested\n", GetPid()); 262 RmDirRecursive(TempPath(".dir")); 263 F->PrintFinalStats(); 264 _Exit(0); 265 } 266 267 void Fuzzer::InterruptCallback() { 268 Printf("==%lu== libFuzzer: run interrupted; exiting\n", GetPid()); 269 PrintFinalStats(); 270 ScopedDisableMsanInterceptorChecks S; // RmDirRecursive may call opendir(). 271 RmDirRecursive(TempPath(".dir")); 272 // Stop right now, don't perform any at-exit actions. 273 _Exit(Options.InterruptExitCode); 274 } 275 276 NO_SANITIZE_MEMORY 277 void Fuzzer::AlarmCallback() { 278 assert(Options.UnitTimeoutSec > 0); 279 // In Windows Alarm callback is executed by a different thread. 280 // NetBSD's current behavior needs this change too. 281 #if !LIBFUZZER_WINDOWS && !LIBFUZZER_NETBSD 282 if (!InFuzzingThread()) 283 return; 284 #endif 285 if (!RunningUserCallback) 286 return; // We have not started running units yet. 287 size_t Seconds = 288 duration_cast<seconds>(system_clock::now() - UnitStartTime).count(); 289 if (Seconds == 0) 290 return; 291 if (Options.Verbosity >= 2) 292 Printf("AlarmCallback %zd\n", Seconds); 293 if (Seconds >= (size_t)Options.UnitTimeoutSec) { 294 if (EF->__sanitizer_acquire_crash_state && 295 !EF->__sanitizer_acquire_crash_state()) 296 return; 297 Printf("ALARM: working on the last Unit for %zd seconds\n", Seconds); 298 Printf(" and the timeout value is %d (use -timeout=N to change)\n", 299 Options.UnitTimeoutSec); 300 DumpCurrentUnit("timeout-"); 301 Printf("==%lu== ERROR: libFuzzer: timeout after %d seconds\n", GetPid(), 302 Seconds); 303 PrintStackTrace(); 304 Printf("SUMMARY: libFuzzer: timeout\n"); 305 PrintFinalStats(); 306 _Exit(Options.TimeoutExitCode); // Stop right now. 307 } 308 } 309 310 void Fuzzer::RssLimitCallback() { 311 if (EF->__sanitizer_acquire_crash_state && 312 !EF->__sanitizer_acquire_crash_state()) 313 return; 314 Printf( 315 "==%lu== ERROR: libFuzzer: out-of-memory (used: %zdMb; limit: %zdMb)\n", 316 GetPid(), GetPeakRSSMb(), Options.RssLimitMb); 317 Printf(" To change the out-of-memory limit use -rss_limit_mb=<N>\n\n"); 318 PrintMemoryProfile(); 319 DumpCurrentUnit("oom-"); 320 Printf("SUMMARY: libFuzzer: out-of-memory\n"); 321 PrintFinalStats(); 322 _Exit(Options.OOMExitCode); // Stop right now. 323 } 324 325 void Fuzzer::PrintStats(const char *Where, const char *End, size_t Units) { 326 size_t ExecPerSec = execPerSec(); 327 if (!Options.Verbosity) 328 return; 329 Printf("#%zd\t%s", TotalNumberOfRuns, Where); 330 if (size_t N = TPC.GetTotalPCCoverage()) 331 Printf(" cov: %zd", N); 332 if (size_t N = Corpus.NumFeatures()) 333 Printf(" ft: %zd", N); 334 if (!Corpus.empty()) { 335 Printf(" corp: %zd", Corpus.NumActiveUnits()); 336 if (size_t N = Corpus.SizeInBytes()) { 337 if (N < (1 << 14)) 338 Printf("/%zdb", N); 339 else if (N < (1 << 24)) 340 Printf("/%zdKb", N >> 10); 341 else 342 Printf("/%zdMb", N >> 20); 343 } 344 if (size_t FF = Corpus.NumInputsThatTouchFocusFunction()) 345 Printf(" focus: %zd", FF); 346 } 347 if (TmpMaxMutationLen) 348 Printf(" lim: %zd", TmpMaxMutationLen); 349 if (Units) 350 Printf(" units: %zd", Units); 351 352 Printf(" exec/s: %zd", ExecPerSec); 353 Printf(" rss: %zdMb", GetPeakRSSMb()); 354 Printf("%s", End); 355 } 356 357 void Fuzzer::PrintFinalStats() { 358 if (Options.PrintCoverage) 359 TPC.PrintCoverage(); 360 if (Options.PrintCorpusStats) 361 Corpus.PrintStats(); 362 if (!Options.PrintFinalStats) 363 return; 364 size_t ExecPerSec = execPerSec(); 365 Printf("stat::number_of_executed_units: %zd\n", TotalNumberOfRuns); 366 Printf("stat::average_exec_per_sec: %zd\n", ExecPerSec); 367 Printf("stat::new_units_added: %zd\n", NumberOfNewUnitsAdded); 368 Printf("stat::slowest_unit_time_sec: %zd\n", TimeOfLongestUnitInSeconds); 369 Printf("stat::peak_rss_mb: %zd\n", GetPeakRSSMb()); 370 } 371 372 void Fuzzer::SetMaxInputLen(size_t MaxInputLen) { 373 assert(this->MaxInputLen == 0); // Can only reset MaxInputLen from 0 to non-0. 374 assert(MaxInputLen); 375 this->MaxInputLen = MaxInputLen; 376 this->MaxMutationLen = MaxInputLen; 377 AllocateCurrentUnitData(); 378 Printf("INFO: -max_len is not provided; " 379 "libFuzzer will not generate inputs larger than %zd bytes\n", 380 MaxInputLen); 381 } 382 383 void Fuzzer::SetMaxMutationLen(size_t MaxMutationLen) { 384 assert(MaxMutationLen && MaxMutationLen <= MaxInputLen); 385 this->MaxMutationLen = MaxMutationLen; 386 } 387 388 void Fuzzer::CheckExitOnSrcPosOrItem() { 389 if (!Options.ExitOnSrcPos.empty()) { 390 static auto *PCsSet = new Set<uintptr_t>; 391 auto HandlePC = [&](const TracePC::PCTableEntry *TE) { 392 if (!PCsSet->insert(TE->PC).second) 393 return; 394 std::string Descr = DescribePC("%F %L", TE->PC + 1); 395 if (Descr.find(Options.ExitOnSrcPos) != std::string::npos) { 396 Printf("INFO: found line matching '%s', exiting.\n", 397 Options.ExitOnSrcPos.c_str()); 398 _Exit(0); 399 } 400 }; 401 TPC.ForEachObservedPC(HandlePC); 402 } 403 if (!Options.ExitOnItem.empty()) { 404 if (Corpus.HasUnit(Options.ExitOnItem)) { 405 Printf("INFO: found item with checksum '%s', exiting.\n", 406 Options.ExitOnItem.c_str()); 407 _Exit(0); 408 } 409 } 410 } 411 412 void Fuzzer::RereadOutputCorpus(size_t MaxSize) { 413 if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec) 414 return; 415 Vector<Unit> AdditionalCorpus; 416 ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus, 417 &EpochOfLastReadOfOutputCorpus, MaxSize, 418 /*ExitOnError*/ false); 419 if (Options.Verbosity >= 2) 420 Printf("Reload: read %zd new units.\n", AdditionalCorpus.size()); 421 bool Reloaded = false; 422 for (auto &U : AdditionalCorpus) { 423 if (U.size() > MaxSize) 424 U.resize(MaxSize); 425 if (!Corpus.HasUnit(U)) { 426 if (RunOne(U.data(), U.size())) { 427 CheckExitOnSrcPosOrItem(); 428 Reloaded = true; 429 } 430 } 431 } 432 if (Reloaded) 433 PrintStats("RELOAD"); 434 } 435 436 void Fuzzer::PrintPulseAndReportSlowInput(const uint8_t *Data, size_t Size) { 437 auto TimeOfUnit = 438 duration_cast<seconds>(UnitStopTime - UnitStartTime).count(); 439 if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) && 440 secondsSinceProcessStartUp() >= 2) 441 PrintStats("pulse "); 442 if (TimeOfUnit > TimeOfLongestUnitInSeconds * 1.1 && 443 TimeOfUnit >= Options.ReportSlowUnits) { 444 TimeOfLongestUnitInSeconds = TimeOfUnit; 445 Printf("Slowest unit: %zd s:\n", TimeOfLongestUnitInSeconds); 446 WriteUnitToFileWithPrefix({Data, Data + Size}, "slow-unit-"); 447 } 448 } 449 450 static void WriteFeatureSetToFile(const std::string &FeaturesDir, 451 const std::string &FileName, 452 const Vector<uint32_t> &FeatureSet) { 453 if (FeaturesDir.empty() || FeatureSet.empty()) return; 454 WriteToFile(reinterpret_cast<const uint8_t *>(FeatureSet.data()), 455 FeatureSet.size() * sizeof(FeatureSet[0]), 456 DirPlusFile(FeaturesDir, FileName)); 457 } 458 459 static void RenameFeatureSetFile(const std::string &FeaturesDir, 460 const std::string &OldFile, 461 const std::string &NewFile) { 462 if (FeaturesDir.empty()) return; 463 RenameFile(DirPlusFile(FeaturesDir, OldFile), 464 DirPlusFile(FeaturesDir, NewFile)); 465 } 466 467 bool Fuzzer::RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile, 468 InputInfo *II, bool *FoundUniqFeatures) { 469 if (!Size) 470 return false; 471 472 ExecuteCallback(Data, Size); 473 474 UniqFeatureSetTmp.clear(); 475 size_t FoundUniqFeaturesOfII = 0; 476 size_t NumUpdatesBefore = Corpus.NumFeatureUpdates(); 477 TPC.CollectFeatures([&](size_t Feature) { 478 if (Corpus.AddFeature(Feature, Size, Options.Shrink)) 479 UniqFeatureSetTmp.push_back(Feature); 480 if (Options.ReduceInputs && II) 481 if (std::binary_search(II->UniqFeatureSet.begin(), 482 II->UniqFeatureSet.end(), Feature)) 483 FoundUniqFeaturesOfII++; 484 }); 485 if (FoundUniqFeatures) 486 *FoundUniqFeatures = FoundUniqFeaturesOfII; 487 PrintPulseAndReportSlowInput(Data, Size); 488 size_t NumNewFeatures = Corpus.NumFeatureUpdates() - NumUpdatesBefore; 489 if (NumNewFeatures) { 490 TPC.UpdateObservedPCs(); 491 auto NewII = Corpus.AddToCorpus({Data, Data + Size}, NumNewFeatures, 492 MayDeleteFile, TPC.ObservedFocusFunction(), 493 UniqFeatureSetTmp, DFT, II); 494 WriteFeatureSetToFile(Options.FeaturesDir, Sha1ToString(NewII->Sha1), 495 NewII->UniqFeatureSet); 496 return true; 497 } 498 if (II && FoundUniqFeaturesOfII && 499 II->DataFlowTraceForFocusFunction.empty() && 500 FoundUniqFeaturesOfII == II->UniqFeatureSet.size() && 501 II->U.size() > Size) { 502 auto OldFeaturesFile = Sha1ToString(II->Sha1); 503 Corpus.Replace(II, {Data, Data + Size}); 504 RenameFeatureSetFile(Options.FeaturesDir, OldFeaturesFile, 505 Sha1ToString(II->Sha1)); 506 return true; 507 } 508 return false; 509 } 510 511 size_t Fuzzer::GetCurrentUnitInFuzzingThead(const uint8_t **Data) const { 512 assert(InFuzzingThread()); 513 *Data = CurrentUnitData; 514 return CurrentUnitSize; 515 } 516 517 void Fuzzer::CrashOnOverwrittenData() { 518 Printf("==%d== ERROR: libFuzzer: fuzz target overwrites it's const input\n", 519 GetPid()); 520 DumpCurrentUnit("crash-"); 521 Printf("SUMMARY: libFuzzer: out-of-memory\n"); 522 _Exit(Options.ErrorExitCode); // Stop right now. 523 } 524 525 // Compare two arrays, but not all bytes if the arrays are large. 526 static bool LooseMemeq(const uint8_t *A, const uint8_t *B, size_t Size) { 527 const size_t Limit = 64; 528 if (Size <= 64) 529 return !memcmp(A, B, Size); 530 // Compare first and last Limit/2 bytes. 531 return !memcmp(A, B, Limit / 2) && 532 !memcmp(A + Size - Limit / 2, B + Size - Limit / 2, Limit / 2); 533 } 534 535 void Fuzzer::ExecuteCallback(const uint8_t *Data, size_t Size) { 536 TPC.RecordInitialStack(); 537 TotalNumberOfRuns++; 538 assert(InFuzzingThread()); 539 // We copy the contents of Unit into a separate heap buffer 540 // so that we reliably find buffer overflows in it. 541 uint8_t *DataCopy = new uint8_t[Size]; 542 memcpy(DataCopy, Data, Size); 543 if (EF->__msan_unpoison) 544 EF->__msan_unpoison(DataCopy, Size); 545 if (EF->__msan_unpoison_param) 546 EF->__msan_unpoison_param(2); 547 if (CurrentUnitData && CurrentUnitData != Data) 548 memcpy(CurrentUnitData, Data, Size); 549 CurrentUnitSize = Size; 550 { 551 ScopedEnableMsanInterceptorChecks S; 552 AllocTracer.Start(Options.TraceMalloc); 553 UnitStartTime = system_clock::now(); 554 TPC.ResetMaps(); 555 RunningUserCallback = true; 556 int Res = CB(DataCopy, Size); 557 RunningUserCallback = false; 558 UnitStopTime = system_clock::now(); 559 (void)Res; 560 assert(Res == 0); 561 HasMoreMallocsThanFrees = AllocTracer.Stop(); 562 } 563 if (!LooseMemeq(DataCopy, Data, Size)) 564 CrashOnOverwrittenData(); 565 CurrentUnitSize = 0; 566 delete[] DataCopy; 567 } 568 569 std::string Fuzzer::WriteToOutputCorpus(const Unit &U) { 570 if (Options.OnlyASCII) 571 assert(IsASCII(U)); 572 if (Options.OutputCorpus.empty()) 573 return ""; 574 std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U)); 575 WriteToFile(U, Path); 576 if (Options.Verbosity >= 2) 577 Printf("Written %zd bytes to %s\n", U.size(), Path.c_str()); 578 return Path; 579 } 580 581 void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) { 582 if (!Options.SaveArtifacts) 583 return; 584 std::string Path = Options.ArtifactPrefix + Prefix + Hash(U); 585 if (!Options.ExactArtifactPath.empty()) 586 Path = Options.ExactArtifactPath; // Overrides ArtifactPrefix. 587 WriteToFile(U, Path); 588 Printf("artifact_prefix='%s'; Test unit written to %s\n", 589 Options.ArtifactPrefix.c_str(), Path.c_str()); 590 if (U.size() <= kMaxUnitSizeToPrint) 591 Printf("Base64: %s\n", Base64(U).c_str()); 592 } 593 594 void Fuzzer::PrintStatusForNewUnit(const Unit &U, const char *Text) { 595 if (!Options.PrintNEW) 596 return; 597 PrintStats(Text, ""); 598 if (Options.Verbosity) { 599 Printf(" L: %zd/%zd ", U.size(), Corpus.MaxInputSize()); 600 MD.PrintMutationSequence(); 601 Printf("\n"); 602 } 603 } 604 605 void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) { 606 II->NumSuccessfullMutations++; 607 MD.RecordSuccessfulMutationSequence(); 608 PrintStatusForNewUnit(U, II->Reduced ? "REDUCE" : "NEW "); 609 WriteToOutputCorpus(U); 610 NumberOfNewUnitsAdded++; 611 CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus. 612 LastCorpusUpdateRun = TotalNumberOfRuns; 613 } 614 615 // Tries detecting a memory leak on the particular input that we have just 616 // executed before calling this function. 617 void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size, 618 bool DuringInitialCorpusExecution) { 619 if (!HasMoreMallocsThanFrees) 620 return; // mallocs==frees, a leak is unlikely. 621 if (!Options.DetectLeaks) 622 return; 623 if (!DuringInitialCorpusExecution && 624 TotalNumberOfRuns >= Options.MaxNumberOfRuns) 625 return; 626 if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) || 627 !(EF->__lsan_do_recoverable_leak_check)) 628 return; // No lsan. 629 // Run the target once again, but with lsan disabled so that if there is 630 // a real leak we do not report it twice. 631 EF->__lsan_disable(); 632 ExecuteCallback(Data, Size); 633 EF->__lsan_enable(); 634 if (!HasMoreMallocsThanFrees) 635 return; // a leak is unlikely. 636 if (NumberOfLeakDetectionAttempts++ > 1000) { 637 Options.DetectLeaks = false; 638 Printf("INFO: libFuzzer disabled leak detection after every mutation.\n" 639 " Most likely the target function accumulates allocated\n" 640 " memory in a global state w/o actually leaking it.\n" 641 " You may try running this binary with -trace_malloc=[12]" 642 " to get a trace of mallocs and frees.\n" 643 " If LeakSanitizer is enabled in this process it will still\n" 644 " run on the process shutdown.\n"); 645 return; 646 } 647 // Now perform the actual lsan pass. This is expensive and we must ensure 648 // we don't call it too often. 649 if (EF->__lsan_do_recoverable_leak_check()) { // Leak is found, report it. 650 if (DuringInitialCorpusExecution) 651 Printf("\nINFO: a leak has been found in the initial corpus.\n\n"); 652 Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n"); 653 CurrentUnitSize = Size; 654 DumpCurrentUnit("leak-"); 655 PrintFinalStats(); 656 _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on. 657 } 658 } 659 660 void Fuzzer::MutateAndTestOne() { 661 MD.StartMutationSequence(); 662 663 auto &II = Corpus.ChooseUnitToMutate(MD.GetRand()); 664 if (Options.DoCrossOver) 665 MD.SetCrossOverWith(&Corpus.ChooseUnitToMutate(MD.GetRand()).U); 666 const auto &U = II.U; 667 memcpy(BaseSha1, II.Sha1, sizeof(BaseSha1)); 668 assert(CurrentUnitData); 669 size_t Size = U.size(); 670 assert(Size <= MaxInputLen && "Oversized Unit"); 671 memcpy(CurrentUnitData, U.data(), Size); 672 673 assert(MaxMutationLen > 0); 674 675 size_t CurrentMaxMutationLen = 676 Min(MaxMutationLen, Max(U.size(), TmpMaxMutationLen)); 677 assert(CurrentMaxMutationLen > 0); 678 679 for (int i = 0; i < Options.MutateDepth; i++) { 680 if (TotalNumberOfRuns >= Options.MaxNumberOfRuns) 681 break; 682 MaybeExitGracefully(); 683 size_t NewSize = 0; 684 if (II.HasFocusFunction && !II.DataFlowTraceForFocusFunction.empty() && 685 Size <= CurrentMaxMutationLen) 686 NewSize = MD.MutateWithMask(CurrentUnitData, Size, Size, 687 II.DataFlowTraceForFocusFunction); 688 689 // If MutateWithMask either failed or wasn't called, call default Mutate. 690 if (!NewSize) 691 NewSize = MD.Mutate(CurrentUnitData, Size, CurrentMaxMutationLen); 692 assert(NewSize > 0 && "Mutator returned empty unit"); 693 assert(NewSize <= CurrentMaxMutationLen && "Mutator return oversized unit"); 694 Size = NewSize; 695 II.NumExecutedMutations++; 696 697 bool FoundUniqFeatures = false; 698 bool NewCov = RunOne(CurrentUnitData, Size, /*MayDeleteFile=*/true, &II, 699 &FoundUniqFeatures); 700 TryDetectingAMemoryLeak(CurrentUnitData, Size, 701 /*DuringInitialCorpusExecution*/ false); 702 if (NewCov) { 703 ReportNewCoverage(&II, {CurrentUnitData, CurrentUnitData + Size}); 704 break; // We will mutate this input more in the next rounds. 705 } 706 if (Options.ReduceDepth && !FoundUniqFeatures) 707 break; 708 } 709 } 710 711 void Fuzzer::PurgeAllocator() { 712 if (Options.PurgeAllocatorIntervalSec < 0 || !EF->__sanitizer_purge_allocator) 713 return; 714 if (duration_cast<seconds>(system_clock::now() - 715 LastAllocatorPurgeAttemptTime) 716 .count() < Options.PurgeAllocatorIntervalSec) 717 return; 718 719 if (Options.RssLimitMb <= 0 || 720 GetPeakRSSMb() > static_cast<size_t>(Options.RssLimitMb) / 2) 721 EF->__sanitizer_purge_allocator(); 722 723 LastAllocatorPurgeAttemptTime = system_clock::now(); 724 } 725 726 void Fuzzer::ReadAndExecuteSeedCorpora(Vector<SizedFile> &CorporaFiles) { 727 const size_t kMaxSaneLen = 1 << 20; 728 const size_t kMinDefaultLen = 4096; 729 size_t MaxSize = 0; 730 size_t MinSize = -1; 731 size_t TotalSize = 0; 732 for (auto &File : CorporaFiles) { 733 MaxSize = Max(File.Size, MaxSize); 734 MinSize = Min(File.Size, MinSize); 735 TotalSize += File.Size; 736 } 737 if (Options.MaxLen == 0) 738 SetMaxInputLen(std::min(std::max(kMinDefaultLen, MaxSize), kMaxSaneLen)); 739 assert(MaxInputLen > 0); 740 741 // Test the callback with empty input and never try it again. 742 uint8_t dummy = 0; 743 ExecuteCallback(&dummy, 0); 744 745 // Protect lazy counters here, after the once-init code has been executed. 746 if (Options.LazyCounters) 747 TPC.ProtectLazyCounters(); 748 749 if (CorporaFiles.empty()) { 750 Printf("INFO: A corpus is not provided, starting from an empty corpus\n"); 751 Unit U({'\n'}); // Valid ASCII input. 752 RunOne(U.data(), U.size()); 753 } else { 754 Printf("INFO: seed corpus: files: %zd min: %zdb max: %zdb total: %zdb" 755 " rss: %zdMb\n", 756 CorporaFiles.size(), MinSize, MaxSize, TotalSize, GetPeakRSSMb()); 757 if (Options.ShuffleAtStartUp) 758 std::shuffle(CorporaFiles.begin(), CorporaFiles.end(), MD.GetRand()); 759 760 if (Options.PreferSmall) { 761 std::stable_sort(CorporaFiles.begin(), CorporaFiles.end()); 762 assert(CorporaFiles.front().Size <= CorporaFiles.back().Size); 763 } 764 765 // Load and execute inputs one by one. 766 for (auto &SF : CorporaFiles) { 767 auto U = FileToVector(SF.File, MaxInputLen, /*ExitOnError=*/false); 768 assert(U.size() <= MaxInputLen); 769 RunOne(U.data(), U.size()); 770 CheckExitOnSrcPosOrItem(); 771 TryDetectingAMemoryLeak(U.data(), U.size(), 772 /*DuringInitialCorpusExecution*/ true); 773 } 774 } 775 776 PrintStats("INITED"); 777 if (!Options.FocusFunction.empty()) 778 Printf("INFO: %zd/%zd inputs touch the focus function\n", 779 Corpus.NumInputsThatTouchFocusFunction(), Corpus.size()); 780 if (!Options.DataFlowTrace.empty()) 781 Printf("INFO: %zd/%zd inputs have the Data Flow Trace\n", 782 Corpus.NumInputsWithDataFlowTrace(), Corpus.size()); 783 784 if (Corpus.empty() && Options.MaxNumberOfRuns) { 785 Printf("ERROR: no interesting inputs were found. " 786 "Is the code instrumented for coverage? Exiting.\n"); 787 exit(1); 788 } 789 } 790 791 void Fuzzer::Loop(Vector<SizedFile> &CorporaFiles) { 792 ReadAndExecuteSeedCorpora(CorporaFiles); 793 DFT.Clear(); // No need for DFT any more. 794 TPC.SetPrintNewPCs(Options.PrintNewCovPcs); 795 TPC.SetPrintNewFuncs(Options.PrintNewCovFuncs); 796 system_clock::time_point LastCorpusReload = system_clock::now(); 797 798 TmpMaxMutationLen = 799 Min(MaxMutationLen, Max(size_t(4), Corpus.MaxInputSize())); 800 801 while (true) { 802 auto Now = system_clock::now(); 803 if (duration_cast<seconds>(Now - LastCorpusReload).count() >= 804 Options.ReloadIntervalSec) { 805 RereadOutputCorpus(MaxInputLen); 806 LastCorpusReload = system_clock::now(); 807 } 808 if (TotalNumberOfRuns >= Options.MaxNumberOfRuns) 809 break; 810 if (TimedOut()) 811 break; 812 813 // Update TmpMaxMutationLen 814 if (Options.LenControl) { 815 if (TmpMaxMutationLen < MaxMutationLen && 816 TotalNumberOfRuns - LastCorpusUpdateRun > 817 Options.LenControl * Log(TmpMaxMutationLen)) { 818 TmpMaxMutationLen = 819 Min(MaxMutationLen, TmpMaxMutationLen + Log(TmpMaxMutationLen)); 820 LastCorpusUpdateRun = TotalNumberOfRuns; 821 } 822 } else { 823 TmpMaxMutationLen = MaxMutationLen; 824 } 825 826 // Perform several mutations and runs. 827 MutateAndTestOne(); 828 829 PurgeAllocator(); 830 } 831 832 PrintStats("DONE ", "\n"); 833 MD.PrintRecommendedDictionary(); 834 } 835 836 void Fuzzer::MinimizeCrashLoop(const Unit &U) { 837 if (U.size() <= 1) 838 return; 839 while (!TimedOut() && TotalNumberOfRuns < Options.MaxNumberOfRuns) { 840 MD.StartMutationSequence(); 841 memcpy(CurrentUnitData, U.data(), U.size()); 842 for (int i = 0; i < Options.MutateDepth; i++) { 843 size_t NewSize = MD.Mutate(CurrentUnitData, U.size(), MaxMutationLen); 844 assert(NewSize > 0 && NewSize <= MaxMutationLen); 845 ExecuteCallback(CurrentUnitData, NewSize); 846 PrintPulseAndReportSlowInput(CurrentUnitData, NewSize); 847 TryDetectingAMemoryLeak(CurrentUnitData, NewSize, 848 /*DuringInitialCorpusExecution*/ false); 849 } 850 } 851 } 852 853 } // namespace fuzzer 854 855 extern "C" { 856 857 ATTRIBUTE_INTERFACE size_t 858 LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) { 859 assert(fuzzer::F); 860 return fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize); 861 } 862 863 } // extern "C" 864