1 //===- FuzzerLoop.cpp - Fuzzer's main loop --------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 // Fuzzer's main loop.
9 //===----------------------------------------------------------------------===//
10 
11 #include "FuzzerCorpus.h"
12 #include "FuzzerIO.h"
13 #include "FuzzerInternal.h"
14 #include "FuzzerMutate.h"
15 #include "FuzzerRandom.h"
16 #include "FuzzerTracePC.h"
17 #include <algorithm>
18 #include <cstring>
19 #include <memory>
20 #include <mutex>
21 #include <set>
22 
23 #if defined(__has_include)
24 #if __has_include(<sanitizer / lsan_interface.h>)
25 #include <sanitizer/lsan_interface.h>
26 #endif
27 #endif
28 
29 #define NO_SANITIZE_MEMORY
30 #if defined(__has_feature)
31 #if __has_feature(memory_sanitizer)
32 #undef NO_SANITIZE_MEMORY
33 #define NO_SANITIZE_MEMORY __attribute__((no_sanitize_memory))
34 #endif
35 #endif
36 
37 namespace fuzzer {
38 static const size_t kMaxUnitSizeToPrint = 256;
39 
40 thread_local bool Fuzzer::IsMyThread;
41 
42 bool RunningUserCallback = false;
43 
44 // Only one Fuzzer per process.
45 static Fuzzer *F;
46 
47 // Leak detection is expensive, so we first check if there were more mallocs
48 // than frees (using the sanitizer malloc hooks) and only then try to call lsan.
49 struct MallocFreeTracer {
50   void Start(int TraceLevel) {
51     this->TraceLevel = TraceLevel;
52     if (TraceLevel)
53       Printf("MallocFreeTracer: START\n");
54     Mallocs = 0;
55     Frees = 0;
56   }
57   // Returns true if there were more mallocs than frees.
58   bool Stop() {
59     if (TraceLevel)
60       Printf("MallocFreeTracer: STOP %zd %zd (%s)\n", Mallocs.load(),
61              Frees.load(), Mallocs == Frees ? "same" : "DIFFERENT");
62     bool Result = Mallocs > Frees;
63     Mallocs = 0;
64     Frees = 0;
65     TraceLevel = 0;
66     return Result;
67   }
68   std::atomic<size_t> Mallocs;
69   std::atomic<size_t> Frees;
70   int TraceLevel = 0;
71 
72   std::recursive_mutex TraceMutex;
73   bool TraceDisabled = false;
74 };
75 
76 static MallocFreeTracer AllocTracer;
77 
78 // Locks printing and avoids nested hooks triggered from mallocs/frees in
79 // sanitizer.
80 class TraceLock {
81 public:
82   TraceLock() : Lock(AllocTracer.TraceMutex) {
83     AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled;
84   }
85   ~TraceLock() { AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled; }
86 
87   bool IsDisabled() const {
88     // This is already inverted value.
89     return !AllocTracer.TraceDisabled;
90   }
91 
92 private:
93   std::lock_guard<std::recursive_mutex> Lock;
94 };
95 
96 ATTRIBUTE_NO_SANITIZE_MEMORY
97 void MallocHook(const volatile void *ptr, size_t size) {
98   size_t N = AllocTracer.Mallocs++;
99   F->HandleMalloc(size);
100   if (int TraceLevel = AllocTracer.TraceLevel) {
101     TraceLock Lock;
102     if (Lock.IsDisabled())
103       return;
104     Printf("MALLOC[%zd] %p %zd\n", N, ptr, size);
105     if (TraceLevel >= 2 && EF)
106       PrintStackTrace();
107   }
108 }
109 
110 ATTRIBUTE_NO_SANITIZE_MEMORY
111 void FreeHook(const volatile void *ptr) {
112   size_t N = AllocTracer.Frees++;
113   if (int TraceLevel = AllocTracer.TraceLevel) {
114     TraceLock Lock;
115     if (Lock.IsDisabled())
116       return;
117     Printf("FREE[%zd]   %p\n", N, ptr);
118     if (TraceLevel >= 2 && EF)
119       PrintStackTrace();
120   }
121 }
122 
123 // Crash on a single malloc that exceeds the rss limit.
124 void Fuzzer::HandleMalloc(size_t Size) {
125   if (!Options.MallocLimitMb || (Size >> 20) < (size_t)Options.MallocLimitMb)
126     return;
127   Printf("==%d== ERROR: libFuzzer: out-of-memory (malloc(%zd))\n", GetPid(),
128          Size);
129   Printf("   To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
130   PrintStackTrace();
131   DumpCurrentUnit("oom-");
132   Printf("SUMMARY: libFuzzer: out-of-memory\n");
133   PrintFinalStats();
134   _Exit(Options.OOMExitCode); // Stop right now.
135 }
136 
137 Fuzzer::Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD,
138                FuzzingOptions Options)
139     : CB(CB), Corpus(Corpus), MD(MD), Options(Options) {
140   if (EF->__sanitizer_set_death_callback)
141     EF->__sanitizer_set_death_callback(StaticDeathCallback);
142   assert(!F);
143   F = this;
144   TPC.ResetMaps();
145   IsMyThread = true;
146   if (Options.DetectLeaks && EF->__sanitizer_install_malloc_and_free_hooks)
147     EF->__sanitizer_install_malloc_and_free_hooks(MallocHook, FreeHook);
148   TPC.SetUseCounters(Options.UseCounters);
149   TPC.SetUseValueProfileMask(Options.UseValueProfile);
150 
151   if (Options.Verbosity)
152     TPC.PrintModuleInfo();
153   if (!Options.OutputCorpus.empty() && Options.ReloadIntervalSec)
154     EpochOfLastReadOfOutputCorpus = GetEpoch(Options.OutputCorpus);
155   MaxInputLen = MaxMutationLen = Options.MaxLen;
156   TmpMaxMutationLen = 0;  // Will be set once we load the corpus.
157   AllocateCurrentUnitData();
158   CurrentUnitSize = 0;
159   memset(BaseSha1, 0, sizeof(BaseSha1));
160   auto FocusFunctionOrAuto = Options.FocusFunction;
161   DFT.Init(Options.DataFlowTrace, &FocusFunctionOrAuto , MD.GetRand());
162   TPC.SetFocusFunction(FocusFunctionOrAuto);
163 }
164 
165 Fuzzer::~Fuzzer() {}
166 
167 void Fuzzer::AllocateCurrentUnitData() {
168   if (CurrentUnitData || MaxInputLen == 0)
169     return;
170   CurrentUnitData = new uint8_t[MaxInputLen];
171 }
172 
173 void Fuzzer::StaticDeathCallback() {
174   assert(F);
175   F->DeathCallback();
176 }
177 
178 void Fuzzer::DumpCurrentUnit(const char *Prefix) {
179   if (!CurrentUnitData)
180     return; // Happens when running individual inputs.
181   ScopedDisableMsanInterceptorChecks S;
182   MD.PrintMutationSequence();
183   Printf("; base unit: %s\n", Sha1ToString(BaseSha1).c_str());
184   size_t UnitSize = CurrentUnitSize;
185   if (UnitSize <= kMaxUnitSizeToPrint) {
186     PrintHexArray(CurrentUnitData, UnitSize, "\n");
187     PrintASCII(CurrentUnitData, UnitSize, "\n");
188   }
189   WriteUnitToFileWithPrefix({CurrentUnitData, CurrentUnitData + UnitSize},
190                             Prefix);
191 }
192 
193 NO_SANITIZE_MEMORY
194 void Fuzzer::DeathCallback() {
195   DumpCurrentUnit("crash-");
196   PrintFinalStats();
197 }
198 
199 void Fuzzer::StaticAlarmCallback() {
200   assert(F);
201   F->AlarmCallback();
202 }
203 
204 void Fuzzer::StaticCrashSignalCallback() {
205   assert(F);
206   F->CrashCallback();
207 }
208 
209 void Fuzzer::StaticExitCallback() {
210   assert(F);
211   F->ExitCallback();
212 }
213 
214 void Fuzzer::StaticInterruptCallback() {
215   assert(F);
216   F->InterruptCallback();
217 }
218 
219 void Fuzzer::StaticGracefulExitCallback() {
220   assert(F);
221   F->GracefulExitRequested = true;
222   Printf("INFO: signal received, trying to exit gracefully\n");
223 }
224 
225 void Fuzzer::StaticFileSizeExceedCallback() {
226   Printf("==%lu== ERROR: libFuzzer: file size exceeded\n", GetPid());
227   exit(1);
228 }
229 
230 void Fuzzer::CrashCallback() {
231   if (EF->__sanitizer_acquire_crash_state &&
232       !EF->__sanitizer_acquire_crash_state())
233     return;
234   Printf("==%lu== ERROR: libFuzzer: deadly signal\n", GetPid());
235   PrintStackTrace();
236   Printf("NOTE: libFuzzer has rudimentary signal handlers.\n"
237          "      Combine libFuzzer with AddressSanitizer or similar for better "
238          "crash reports.\n");
239   Printf("SUMMARY: libFuzzer: deadly signal\n");
240   DumpCurrentUnit("crash-");
241   PrintFinalStats();
242   _Exit(Options.ErrorExitCode); // Stop right now.
243 }
244 
245 void Fuzzer::ExitCallback() {
246   if (!RunningUserCallback)
247     return; // This exit did not come from the user callback
248   if (EF->__sanitizer_acquire_crash_state &&
249       !EF->__sanitizer_acquire_crash_state())
250     return;
251   Printf("==%lu== ERROR: libFuzzer: fuzz target exited\n", GetPid());
252   PrintStackTrace();
253   Printf("SUMMARY: libFuzzer: fuzz target exited\n");
254   DumpCurrentUnit("crash-");
255   PrintFinalStats();
256   _Exit(Options.ErrorExitCode);
257 }
258 
259 void Fuzzer::MaybeExitGracefully() {
260   if (!F->GracefulExitRequested) return;
261   Printf("==%lu== INFO: libFuzzer: exiting as requested\n", GetPid());
262   RmDirRecursive(TempPath(".dir"));
263   F->PrintFinalStats();
264   _Exit(0);
265 }
266 
267 void Fuzzer::InterruptCallback() {
268   Printf("==%lu== libFuzzer: run interrupted; exiting\n", GetPid());
269   PrintFinalStats();
270   ScopedDisableMsanInterceptorChecks S; // RmDirRecursive may call opendir().
271   RmDirRecursive(TempPath(".dir"));
272   // Stop right now, don't perform any at-exit actions.
273   _Exit(Options.InterruptExitCode);
274 }
275 
276 NO_SANITIZE_MEMORY
277 void Fuzzer::AlarmCallback() {
278   assert(Options.UnitTimeoutSec > 0);
279   // In Windows Alarm callback is executed by a different thread.
280   // NetBSD's current behavior needs this change too.
281 #if !LIBFUZZER_WINDOWS && !LIBFUZZER_NETBSD
282   if (!InFuzzingThread())
283     return;
284 #endif
285   if (!RunningUserCallback)
286     return; // We have not started running units yet.
287   size_t Seconds =
288       duration_cast<seconds>(system_clock::now() - UnitStartTime).count();
289   if (Seconds == 0)
290     return;
291   if (Options.Verbosity >= 2)
292     Printf("AlarmCallback %zd\n", Seconds);
293   if (Seconds >= (size_t)Options.UnitTimeoutSec) {
294     if (EF->__sanitizer_acquire_crash_state &&
295         !EF->__sanitizer_acquire_crash_state())
296       return;
297     Printf("ALARM: working on the last Unit for %zd seconds\n", Seconds);
298     Printf("       and the timeout value is %d (use -timeout=N to change)\n",
299            Options.UnitTimeoutSec);
300     DumpCurrentUnit("timeout-");
301     Printf("==%lu== ERROR: libFuzzer: timeout after %d seconds\n", GetPid(),
302            Seconds);
303     PrintStackTrace();
304     Printf("SUMMARY: libFuzzer: timeout\n");
305     PrintFinalStats();
306     _Exit(Options.TimeoutExitCode); // Stop right now.
307   }
308 }
309 
310 void Fuzzer::RssLimitCallback() {
311   if (EF->__sanitizer_acquire_crash_state &&
312       !EF->__sanitizer_acquire_crash_state())
313     return;
314   Printf(
315       "==%lu== ERROR: libFuzzer: out-of-memory (used: %zdMb; limit: %zdMb)\n",
316       GetPid(), GetPeakRSSMb(), Options.RssLimitMb);
317   Printf("   To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
318   PrintMemoryProfile();
319   DumpCurrentUnit("oom-");
320   Printf("SUMMARY: libFuzzer: out-of-memory\n");
321   PrintFinalStats();
322   _Exit(Options.OOMExitCode); // Stop right now.
323 }
324 
325 void Fuzzer::PrintStats(const char *Where, const char *End, size_t Units) {
326   size_t ExecPerSec = execPerSec();
327   if (!Options.Verbosity)
328     return;
329   Printf("#%zd\t%s", TotalNumberOfRuns, Where);
330   if (size_t N = TPC.GetTotalPCCoverage())
331     Printf(" cov: %zd", N);
332   if (size_t N = Corpus.NumFeatures())
333     Printf(" ft: %zd", N);
334   if (!Corpus.empty()) {
335     Printf(" corp: %zd", Corpus.NumActiveUnits());
336     if (size_t N = Corpus.SizeInBytes()) {
337       if (N < (1 << 14))
338         Printf("/%zdb", N);
339       else if (N < (1 << 24))
340         Printf("/%zdKb", N >> 10);
341       else
342         Printf("/%zdMb", N >> 20);
343     }
344     if (size_t FF = Corpus.NumInputsThatTouchFocusFunction())
345       Printf(" focus: %zd", FF);
346   }
347   if (TmpMaxMutationLen)
348     Printf(" lim: %zd", TmpMaxMutationLen);
349   if (Units)
350     Printf(" units: %zd", Units);
351 
352   Printf(" exec/s: %zd", ExecPerSec);
353   Printf(" rss: %zdMb", GetPeakRSSMb());
354   Printf("%s", End);
355 }
356 
357 void Fuzzer::PrintFinalStats() {
358   if (Options.PrintCoverage)
359     TPC.PrintCoverage();
360   if (Options.PrintCorpusStats)
361     Corpus.PrintStats();
362   if (!Options.PrintFinalStats)
363     return;
364   size_t ExecPerSec = execPerSec();
365   Printf("stat::number_of_executed_units: %zd\n", TotalNumberOfRuns);
366   Printf("stat::average_exec_per_sec:     %zd\n", ExecPerSec);
367   Printf("stat::new_units_added:          %zd\n", NumberOfNewUnitsAdded);
368   Printf("stat::slowest_unit_time_sec:    %zd\n", TimeOfLongestUnitInSeconds);
369   Printf("stat::peak_rss_mb:              %zd\n", GetPeakRSSMb());
370 }
371 
372 void Fuzzer::SetMaxInputLen(size_t MaxInputLen) {
373   assert(this->MaxInputLen == 0); // Can only reset MaxInputLen from 0 to non-0.
374   assert(MaxInputLen);
375   this->MaxInputLen = MaxInputLen;
376   this->MaxMutationLen = MaxInputLen;
377   AllocateCurrentUnitData();
378   Printf("INFO: -max_len is not provided; "
379          "libFuzzer will not generate inputs larger than %zd bytes\n",
380          MaxInputLen);
381 }
382 
383 void Fuzzer::SetMaxMutationLen(size_t MaxMutationLen) {
384   assert(MaxMutationLen && MaxMutationLen <= MaxInputLen);
385   this->MaxMutationLen = MaxMutationLen;
386 }
387 
388 void Fuzzer::CheckExitOnSrcPosOrItem() {
389   if (!Options.ExitOnSrcPos.empty()) {
390     static auto *PCsSet = new Set<uintptr_t>;
391     auto HandlePC = [&](const TracePC::PCTableEntry *TE) {
392       if (!PCsSet->insert(TE->PC).second)
393         return;
394       std::string Descr = DescribePC("%F %L", TE->PC + 1);
395       if (Descr.find(Options.ExitOnSrcPos) != std::string::npos) {
396         Printf("INFO: found line matching '%s', exiting.\n",
397                Options.ExitOnSrcPos.c_str());
398         _Exit(0);
399       }
400     };
401     TPC.ForEachObservedPC(HandlePC);
402   }
403   if (!Options.ExitOnItem.empty()) {
404     if (Corpus.HasUnit(Options.ExitOnItem)) {
405       Printf("INFO: found item with checksum '%s', exiting.\n",
406              Options.ExitOnItem.c_str());
407       _Exit(0);
408     }
409   }
410 }
411 
412 void Fuzzer::RereadOutputCorpus(size_t MaxSize) {
413   if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec)
414     return;
415   Vector<Unit> AdditionalCorpus;
416   ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus,
417                          &EpochOfLastReadOfOutputCorpus, MaxSize,
418                          /*ExitOnError*/ false);
419   if (Options.Verbosity >= 2)
420     Printf("Reload: read %zd new units.\n", AdditionalCorpus.size());
421   bool Reloaded = false;
422   for (auto &U : AdditionalCorpus) {
423     if (U.size() > MaxSize)
424       U.resize(MaxSize);
425     if (!Corpus.HasUnit(U)) {
426       if (RunOne(U.data(), U.size())) {
427         CheckExitOnSrcPosOrItem();
428         Reloaded = true;
429       }
430     }
431   }
432   if (Reloaded)
433     PrintStats("RELOAD");
434 }
435 
436 void Fuzzer::PrintPulseAndReportSlowInput(const uint8_t *Data, size_t Size) {
437   auto TimeOfUnit =
438       duration_cast<seconds>(UnitStopTime - UnitStartTime).count();
439   if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) &&
440       secondsSinceProcessStartUp() >= 2)
441     PrintStats("pulse ");
442   if (TimeOfUnit > TimeOfLongestUnitInSeconds * 1.1 &&
443       TimeOfUnit >= Options.ReportSlowUnits) {
444     TimeOfLongestUnitInSeconds = TimeOfUnit;
445     Printf("Slowest unit: %zd s:\n", TimeOfLongestUnitInSeconds);
446     WriteUnitToFileWithPrefix({Data, Data + Size}, "slow-unit-");
447   }
448 }
449 
450 static void WriteFeatureSetToFile(const std::string &FeaturesDir,
451                                   const std::string &FileName,
452                                   const Vector<uint32_t> &FeatureSet) {
453   if (FeaturesDir.empty() || FeatureSet.empty()) return;
454   WriteToFile(reinterpret_cast<const uint8_t *>(FeatureSet.data()),
455               FeatureSet.size() * sizeof(FeatureSet[0]),
456               DirPlusFile(FeaturesDir, FileName));
457 }
458 
459 static void RenameFeatureSetFile(const std::string &FeaturesDir,
460                                  const std::string &OldFile,
461                                  const std::string &NewFile) {
462   if (FeaturesDir.empty()) return;
463   RenameFile(DirPlusFile(FeaturesDir, OldFile),
464              DirPlusFile(FeaturesDir, NewFile));
465 }
466 
467 bool Fuzzer::RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile,
468                     InputInfo *II, bool *FoundUniqFeatures) {
469   if (!Size)
470     return false;
471 
472   ExecuteCallback(Data, Size);
473 
474   UniqFeatureSetTmp.clear();
475   size_t FoundUniqFeaturesOfII = 0;
476   size_t NumUpdatesBefore = Corpus.NumFeatureUpdates();
477   TPC.CollectFeatures([&](size_t Feature) {
478     if (Corpus.AddFeature(Feature, Size, Options.Shrink))
479       UniqFeatureSetTmp.push_back(Feature);
480     if (Options.ReduceInputs && II)
481       if (std::binary_search(II->UniqFeatureSet.begin(),
482                              II->UniqFeatureSet.end(), Feature))
483         FoundUniqFeaturesOfII++;
484   });
485   if (FoundUniqFeatures)
486     *FoundUniqFeatures = FoundUniqFeaturesOfII;
487   PrintPulseAndReportSlowInput(Data, Size);
488   size_t NumNewFeatures = Corpus.NumFeatureUpdates() - NumUpdatesBefore;
489   if (NumNewFeatures) {
490     TPC.UpdateObservedPCs();
491     auto NewII = Corpus.AddToCorpus({Data, Data + Size}, NumNewFeatures,
492                                     MayDeleteFile, TPC.ObservedFocusFunction(),
493                                     UniqFeatureSetTmp, DFT, II);
494     WriteFeatureSetToFile(Options.FeaturesDir, Sha1ToString(NewII->Sha1),
495                           NewII->UniqFeatureSet);
496     return true;
497   }
498   if (II && FoundUniqFeaturesOfII &&
499       II->DataFlowTraceForFocusFunction.empty() &&
500       FoundUniqFeaturesOfII == II->UniqFeatureSet.size() &&
501       II->U.size() > Size) {
502     auto OldFeaturesFile = Sha1ToString(II->Sha1);
503     Corpus.Replace(II, {Data, Data + Size});
504     RenameFeatureSetFile(Options.FeaturesDir, OldFeaturesFile,
505                          Sha1ToString(II->Sha1));
506     return true;
507   }
508   return false;
509 }
510 
511 size_t Fuzzer::GetCurrentUnitInFuzzingThead(const uint8_t **Data) const {
512   assert(InFuzzingThread());
513   *Data = CurrentUnitData;
514   return CurrentUnitSize;
515 }
516 
517 void Fuzzer::CrashOnOverwrittenData() {
518   Printf("==%d== ERROR: libFuzzer: fuzz target overwrites it's const input\n",
519          GetPid());
520   DumpCurrentUnit("crash-");
521   Printf("SUMMARY: libFuzzer: out-of-memory\n");
522   _Exit(Options.ErrorExitCode); // Stop right now.
523 }
524 
525 // Compare two arrays, but not all bytes if the arrays are large.
526 static bool LooseMemeq(const uint8_t *A, const uint8_t *B, size_t Size) {
527   const size_t Limit = 64;
528   if (Size <= 64)
529     return !memcmp(A, B, Size);
530   // Compare first and last Limit/2 bytes.
531   return !memcmp(A, B, Limit / 2) &&
532          !memcmp(A + Size - Limit / 2, B + Size - Limit / 2, Limit / 2);
533 }
534 
535 void Fuzzer::ExecuteCallback(const uint8_t *Data, size_t Size) {
536   TPC.RecordInitialStack();
537   TotalNumberOfRuns++;
538   assert(InFuzzingThread());
539   // We copy the contents of Unit into a separate heap buffer
540   // so that we reliably find buffer overflows in it.
541   uint8_t *DataCopy = new uint8_t[Size];
542   memcpy(DataCopy, Data, Size);
543   if (EF->__msan_unpoison)
544     EF->__msan_unpoison(DataCopy, Size);
545   if (EF->__msan_unpoison_param)
546     EF->__msan_unpoison_param(2);
547   if (CurrentUnitData && CurrentUnitData != Data)
548     memcpy(CurrentUnitData, Data, Size);
549   CurrentUnitSize = Size;
550   {
551     ScopedEnableMsanInterceptorChecks S;
552     AllocTracer.Start(Options.TraceMalloc);
553     UnitStartTime = system_clock::now();
554     TPC.ResetMaps();
555     RunningUserCallback = true;
556     int Res = CB(DataCopy, Size);
557     RunningUserCallback = false;
558     UnitStopTime = system_clock::now();
559     (void)Res;
560     assert(Res == 0);
561     HasMoreMallocsThanFrees = AllocTracer.Stop();
562   }
563   if (!LooseMemeq(DataCopy, Data, Size))
564     CrashOnOverwrittenData();
565   CurrentUnitSize = 0;
566   delete[] DataCopy;
567 }
568 
569 std::string Fuzzer::WriteToOutputCorpus(const Unit &U) {
570   if (Options.OnlyASCII)
571     assert(IsASCII(U));
572   if (Options.OutputCorpus.empty())
573     return "";
574   std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U));
575   WriteToFile(U, Path);
576   if (Options.Verbosity >= 2)
577     Printf("Written %zd bytes to %s\n", U.size(), Path.c_str());
578   return Path;
579 }
580 
581 void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) {
582   if (!Options.SaveArtifacts)
583     return;
584   std::string Path = Options.ArtifactPrefix + Prefix + Hash(U);
585   if (!Options.ExactArtifactPath.empty())
586     Path = Options.ExactArtifactPath; // Overrides ArtifactPrefix.
587   WriteToFile(U, Path);
588   Printf("artifact_prefix='%s'; Test unit written to %s\n",
589          Options.ArtifactPrefix.c_str(), Path.c_str());
590   if (U.size() <= kMaxUnitSizeToPrint)
591     Printf("Base64: %s\n", Base64(U).c_str());
592 }
593 
594 void Fuzzer::PrintStatusForNewUnit(const Unit &U, const char *Text) {
595   if (!Options.PrintNEW)
596     return;
597   PrintStats(Text, "");
598   if (Options.Verbosity) {
599     Printf(" L: %zd/%zd ", U.size(), Corpus.MaxInputSize());
600     MD.PrintMutationSequence();
601     Printf("\n");
602   }
603 }
604 
605 void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) {
606   II->NumSuccessfullMutations++;
607   MD.RecordSuccessfulMutationSequence();
608   PrintStatusForNewUnit(U, II->Reduced ? "REDUCE" : "NEW   ");
609   WriteToOutputCorpus(U);
610   NumberOfNewUnitsAdded++;
611   CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus.
612   LastCorpusUpdateRun = TotalNumberOfRuns;
613 }
614 
615 // Tries detecting a memory leak on the particular input that we have just
616 // executed before calling this function.
617 void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
618                                      bool DuringInitialCorpusExecution) {
619   if (!HasMoreMallocsThanFrees)
620     return; // mallocs==frees, a leak is unlikely.
621   if (!Options.DetectLeaks)
622     return;
623   if (!DuringInitialCorpusExecution &&
624       TotalNumberOfRuns >= Options.MaxNumberOfRuns)
625     return;
626   if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) ||
627       !(EF->__lsan_do_recoverable_leak_check))
628     return; // No lsan.
629   // Run the target once again, but with lsan disabled so that if there is
630   // a real leak we do not report it twice.
631   EF->__lsan_disable();
632   ExecuteCallback(Data, Size);
633   EF->__lsan_enable();
634   if (!HasMoreMallocsThanFrees)
635     return; // a leak is unlikely.
636   if (NumberOfLeakDetectionAttempts++ > 1000) {
637     Options.DetectLeaks = false;
638     Printf("INFO: libFuzzer disabled leak detection after every mutation.\n"
639            "      Most likely the target function accumulates allocated\n"
640            "      memory in a global state w/o actually leaking it.\n"
641            "      You may try running this binary with -trace_malloc=[12]"
642            "      to get a trace of mallocs and frees.\n"
643            "      If LeakSanitizer is enabled in this process it will still\n"
644            "      run on the process shutdown.\n");
645     return;
646   }
647   // Now perform the actual lsan pass. This is expensive and we must ensure
648   // we don't call it too often.
649   if (EF->__lsan_do_recoverable_leak_check()) { // Leak is found, report it.
650     if (DuringInitialCorpusExecution)
651       Printf("\nINFO: a leak has been found in the initial corpus.\n\n");
652     Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n");
653     CurrentUnitSize = Size;
654     DumpCurrentUnit("leak-");
655     PrintFinalStats();
656     _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on.
657   }
658 }
659 
660 void Fuzzer::MutateAndTestOne() {
661   MD.StartMutationSequence();
662 
663   auto &II = Corpus.ChooseUnitToMutate(MD.GetRand());
664   if (Options.DoCrossOver)
665     MD.SetCrossOverWith(&Corpus.ChooseUnitToMutate(MD.GetRand()).U);
666   const auto &U = II.U;
667   memcpy(BaseSha1, II.Sha1, sizeof(BaseSha1));
668   assert(CurrentUnitData);
669   size_t Size = U.size();
670   assert(Size <= MaxInputLen && "Oversized Unit");
671   memcpy(CurrentUnitData, U.data(), Size);
672 
673   assert(MaxMutationLen > 0);
674 
675   size_t CurrentMaxMutationLen =
676       Min(MaxMutationLen, Max(U.size(), TmpMaxMutationLen));
677   assert(CurrentMaxMutationLen > 0);
678 
679   for (int i = 0; i < Options.MutateDepth; i++) {
680     if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
681       break;
682     MaybeExitGracefully();
683     size_t NewSize = 0;
684     if (II.HasFocusFunction && !II.DataFlowTraceForFocusFunction.empty() &&
685         Size <= CurrentMaxMutationLen)
686       NewSize = MD.MutateWithMask(CurrentUnitData, Size, Size,
687                                   II.DataFlowTraceForFocusFunction);
688 
689     // If MutateWithMask either failed or wasn't called, call default Mutate.
690     if (!NewSize)
691       NewSize = MD.Mutate(CurrentUnitData, Size, CurrentMaxMutationLen);
692     assert(NewSize > 0 && "Mutator returned empty unit");
693     assert(NewSize <= CurrentMaxMutationLen && "Mutator return oversized unit");
694     Size = NewSize;
695     II.NumExecutedMutations++;
696 
697     bool FoundUniqFeatures = false;
698     bool NewCov = RunOne(CurrentUnitData, Size, /*MayDeleteFile=*/true, &II,
699                          &FoundUniqFeatures);
700     TryDetectingAMemoryLeak(CurrentUnitData, Size,
701                             /*DuringInitialCorpusExecution*/ false);
702     if (NewCov) {
703       ReportNewCoverage(&II, {CurrentUnitData, CurrentUnitData + Size});
704       break;  // We will mutate this input more in the next rounds.
705     }
706     if (Options.ReduceDepth && !FoundUniqFeatures)
707       break;
708   }
709 }
710 
711 void Fuzzer::PurgeAllocator() {
712   if (Options.PurgeAllocatorIntervalSec < 0 || !EF->__sanitizer_purge_allocator)
713     return;
714   if (duration_cast<seconds>(system_clock::now() -
715                              LastAllocatorPurgeAttemptTime)
716           .count() < Options.PurgeAllocatorIntervalSec)
717     return;
718 
719   if (Options.RssLimitMb <= 0 ||
720       GetPeakRSSMb() > static_cast<size_t>(Options.RssLimitMb) / 2)
721     EF->__sanitizer_purge_allocator();
722 
723   LastAllocatorPurgeAttemptTime = system_clock::now();
724 }
725 
726 void Fuzzer::ReadAndExecuteSeedCorpora(Vector<SizedFile> &CorporaFiles) {
727   const size_t kMaxSaneLen = 1 << 20;
728   const size_t kMinDefaultLen = 4096;
729   size_t MaxSize = 0;
730   size_t MinSize = -1;
731   size_t TotalSize = 0;
732   for (auto &File : CorporaFiles) {
733     MaxSize = Max(File.Size, MaxSize);
734     MinSize = Min(File.Size, MinSize);
735     TotalSize += File.Size;
736   }
737   if (Options.MaxLen == 0)
738     SetMaxInputLen(std::min(std::max(kMinDefaultLen, MaxSize), kMaxSaneLen));
739   assert(MaxInputLen > 0);
740 
741   // Test the callback with empty input and never try it again.
742   uint8_t dummy = 0;
743   ExecuteCallback(&dummy, 0);
744 
745   // Protect lazy counters here, after the once-init code has been executed.
746   if (Options.LazyCounters)
747     TPC.ProtectLazyCounters();
748 
749   if (CorporaFiles.empty()) {
750     Printf("INFO: A corpus is not provided, starting from an empty corpus\n");
751     Unit U({'\n'}); // Valid ASCII input.
752     RunOne(U.data(), U.size());
753   } else {
754     Printf("INFO: seed corpus: files: %zd min: %zdb max: %zdb total: %zdb"
755            " rss: %zdMb\n",
756            CorporaFiles.size(), MinSize, MaxSize, TotalSize, GetPeakRSSMb());
757     if (Options.ShuffleAtStartUp)
758       std::shuffle(CorporaFiles.begin(), CorporaFiles.end(), MD.GetRand());
759 
760     if (Options.PreferSmall) {
761       std::stable_sort(CorporaFiles.begin(), CorporaFiles.end());
762       assert(CorporaFiles.front().Size <= CorporaFiles.back().Size);
763     }
764 
765     // Load and execute inputs one by one.
766     for (auto &SF : CorporaFiles) {
767       auto U = FileToVector(SF.File, MaxInputLen, /*ExitOnError=*/false);
768       assert(U.size() <= MaxInputLen);
769       RunOne(U.data(), U.size());
770       CheckExitOnSrcPosOrItem();
771       TryDetectingAMemoryLeak(U.data(), U.size(),
772                               /*DuringInitialCorpusExecution*/ true);
773     }
774   }
775 
776   PrintStats("INITED");
777   if (!Options.FocusFunction.empty())
778     Printf("INFO: %zd/%zd inputs touch the focus function\n",
779            Corpus.NumInputsThatTouchFocusFunction(), Corpus.size());
780   if (!Options.DataFlowTrace.empty())
781     Printf("INFO: %zd/%zd inputs have the Data Flow Trace\n",
782            Corpus.NumInputsWithDataFlowTrace(), Corpus.size());
783 
784   if (Corpus.empty() && Options.MaxNumberOfRuns) {
785     Printf("ERROR: no interesting inputs were found. "
786            "Is the code instrumented for coverage? Exiting.\n");
787     exit(1);
788   }
789 }
790 
791 void Fuzzer::Loop(Vector<SizedFile> &CorporaFiles) {
792   ReadAndExecuteSeedCorpora(CorporaFiles);
793   DFT.Clear();  // No need for DFT any more.
794   TPC.SetPrintNewPCs(Options.PrintNewCovPcs);
795   TPC.SetPrintNewFuncs(Options.PrintNewCovFuncs);
796   system_clock::time_point LastCorpusReload = system_clock::now();
797 
798   TmpMaxMutationLen =
799       Min(MaxMutationLen, Max(size_t(4), Corpus.MaxInputSize()));
800 
801   while (true) {
802     auto Now = system_clock::now();
803     if (duration_cast<seconds>(Now - LastCorpusReload).count() >=
804         Options.ReloadIntervalSec) {
805       RereadOutputCorpus(MaxInputLen);
806       LastCorpusReload = system_clock::now();
807     }
808     if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
809       break;
810     if (TimedOut())
811       break;
812 
813     // Update TmpMaxMutationLen
814     if (Options.LenControl) {
815       if (TmpMaxMutationLen < MaxMutationLen &&
816           TotalNumberOfRuns - LastCorpusUpdateRun >
817               Options.LenControl * Log(TmpMaxMutationLen)) {
818         TmpMaxMutationLen =
819             Min(MaxMutationLen, TmpMaxMutationLen + Log(TmpMaxMutationLen));
820         LastCorpusUpdateRun = TotalNumberOfRuns;
821       }
822     } else {
823       TmpMaxMutationLen = MaxMutationLen;
824     }
825 
826     // Perform several mutations and runs.
827     MutateAndTestOne();
828 
829     PurgeAllocator();
830   }
831 
832   PrintStats("DONE  ", "\n");
833   MD.PrintRecommendedDictionary();
834 }
835 
836 void Fuzzer::MinimizeCrashLoop(const Unit &U) {
837   if (U.size() <= 1)
838     return;
839   while (!TimedOut() && TotalNumberOfRuns < Options.MaxNumberOfRuns) {
840     MD.StartMutationSequence();
841     memcpy(CurrentUnitData, U.data(), U.size());
842     for (int i = 0; i < Options.MutateDepth; i++) {
843       size_t NewSize = MD.Mutate(CurrentUnitData, U.size(), MaxMutationLen);
844       assert(NewSize > 0 && NewSize <= MaxMutationLen);
845       ExecuteCallback(CurrentUnitData, NewSize);
846       PrintPulseAndReportSlowInput(CurrentUnitData, NewSize);
847       TryDetectingAMemoryLeak(CurrentUnitData, NewSize,
848                               /*DuringInitialCorpusExecution*/ false);
849     }
850   }
851 }
852 
853 } // namespace fuzzer
854 
855 extern "C" {
856 
857 ATTRIBUTE_INTERFACE size_t
858 LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
859   assert(fuzzer::F);
860   return fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize);
861 }
862 
863 } // extern "C"
864