From 7f4227d59a19ff3361c775e51d6c39443ef08574 Mon Sep 17 00:00:00 2001 From: Kostya Serebryany Date: Wed, 5 Aug 2015 18:23:01 +0000 Subject: [PATCH] [libFuzzer] use data-flow feedback from strcmp llvm-svn: 244084 --- llvm/docs/LibFuzzer.rst | 2 +- llvm/lib/Fuzzer/FuzzerTraceState.cpp | 38 ++++++++++++++++++++++++++++++++-- llvm/lib/Fuzzer/test/CMakeLists.txt | 2 ++ llvm/lib/Fuzzer/test/fuzzer-dfsan.test | 3 +++ llvm/lib/Fuzzer/test/fuzzer.test | 3 +++ 5 files changed, 45 insertions(+), 3 deletions(-) diff --git a/llvm/docs/LibFuzzer.rst b/llvm/docs/LibFuzzer.rst index 3b074aa..0eabb5d 100644 --- a/llvm/docs/LibFuzzer.rst +++ b/llvm/docs/LibFuzzer.rst @@ -282,7 +282,7 @@ Data-flow-guided fuzzing With an additional compiler flag ``-fsanitize-coverage=trace-cmp`` (see SanitizerCoverageTraceDataFlow_) and extra run-time flag ``-use_traces=1`` the fuzzer will try to apply *data-flow-guided fuzzing*. That is, the fuzzer will record the inputs to comparison instructions, switch statements, -and several libc functions (``memcmp``, ``strncmp``, etc). +and several libc functions (``memcmp``, ``strcmp``, ``strncmp``, etc). It will later use those recorded inputs during mutations. This mode can be combined with DataFlowSanitizer_ to achieve better sensitivity. diff --git a/llvm/lib/Fuzzer/FuzzerTraceState.cpp b/llvm/lib/Fuzzer/FuzzerTraceState.cpp index 1c01e8a..13635a7 100644 --- a/llvm/lib/Fuzzer/FuzzerTraceState.cpp +++ b/llvm/lib/Fuzzer/FuzzerTraceState.cpp @@ -356,8 +356,9 @@ void TraceState::TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, CSP->Counter[ComputeCmp(CmpSize, CmpType, Arg1, Arg2)]++; size_t C0 = CSP->Counter[0]; size_t C1 = CSP->Counter[1]; - if (!CSP->IsInterestingCmpTarget()) - return; + // FIXME: is this a good idea or a bad? + // if (!CSP->IsInterestingCmpTarget()) + // return; if (Options.Verbosity >= 3) Printf("TraceCmp: %p %zd/%zd; %zd %zd\n", CSP->PC, C0, C1, Arg1, Arg2); Added += TryToAddDesiredData(Arg1, Arg2, CmpSize); @@ -479,6 +480,23 @@ void dfsan_weak_hook_strncmp(void *caller_pc, const char *s1, const char *s2, TS->DFSanCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2, L1, L2); } +void dfsan_weak_hook_strcmp(void *caller_pc, const char *s1, const char *s2, + dfsan_label s1_label, dfsan_label s2_label) { + if (!TS) return; + uintptr_t PC = reinterpret_cast(caller_pc); + uint64_t S1 = 0, S2 = 0; + size_t Len1 = strlen(s1); + size_t Len2 = strlen(s2); + size_t N = std::min(Len1, Len2); + if (N <= 1) return; // Not interesting. + // Simplification: handle only first 8 bytes. + memcpy(&S1, s1, std::min(N, sizeof(S1))); + memcpy(&S2, s2, std::min(N, sizeof(S2))); + dfsan_label L1 = dfsan_read_label(s1, Len1); + dfsan_label L2 = dfsan_read_label(s2, Len2); + TS->DFSanCmpCallback(PC, N, fuzzer::ICMP_EQ, S1, S2, L1, L2); +} + void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1, const void *s2, size_t n) { if (!TS) return; @@ -506,6 +524,22 @@ void __sanitizer_weak_hook_strncmp(void *caller_pc, const char *s1, TS->TraceCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2); } +void __sanitizer_weak_hook_strcmp(void *caller_pc, const char *s1, + const char *s2) { + if (!TS) return; + uintptr_t PC = reinterpret_cast(caller_pc); + uint64_t S1 = 0, S2 = 0; + size_t Len1 = strlen(s1); + size_t Len2 = strlen(s2); + size_t N = std::min(Len1, Len2); + if (N <= 1) return; // Not interesting. + // Simplification: handle only first 8 bytes. + memcpy(&S1, s1, std::min(N, sizeof(S1))); + memcpy(&S2, s2, std::min(N, sizeof(S2))); + TS->TraceCmpCallback(PC, N, fuzzer::ICMP_EQ, S1, S2); +} + + void __sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1, uint64_t Arg2) { if (!TS) return; diff --git a/llvm/lib/Fuzzer/test/CMakeLists.txt b/llvm/lib/Fuzzer/test/CMakeLists.txt index b8c1f32..893274d 100644 --- a/llvm/lib/Fuzzer/test/CMakeLists.txt +++ b/llvm/lib/Fuzzer/test/CMakeLists.txt @@ -7,6 +7,7 @@ set(CMAKE_CXX_FLAGS_RELEASE "${LIBFUZZER_FLAGS_BASE} -O0 -fsanitize-coverage=edg set(DFSanTests MemcmpTest SimpleCmpTest + StrcmpTest StrncmpTest SwitchTest ) @@ -21,6 +22,7 @@ set(Tests NullDerefTest SimpleCmpTest SimpleTest + StrcmpTest StrncmpTest SwitchTest TimeoutTest diff --git a/llvm/lib/Fuzzer/test/fuzzer-dfsan.test b/llvm/lib/Fuzzer/test/fuzzer-dfsan.test index 266cb51..d682032 100644 --- a/llvm/lib/Fuzzer/test/fuzzer-dfsan.test +++ b/llvm/lib/Fuzzer/test/fuzzer-dfsan.test @@ -15,5 +15,8 @@ RUN: LLVMFuzzer-MemcmpTest-DFSan -use_traces=1 -seed=1 -runs=2 -timeout=5 -verbo RUN: not LLVMFuzzer-StrncmpTest-DFSan -use_traces=1 -seed=1 -runs=10000 -timeout=5 2>&1 | FileCheck %s --check-prefix=CHECK3 RUN: LLVMFuzzer-StrncmpTest-DFSan -use_traces=1 -seed=1 -runs=2 -timeout=5 -verbosity=3 2>&1 | FileCheck %s -check-prefix=CHECK_DFSanCmpCallback +RUN: not LLVMFuzzer-StrcmpTest-DFSan -use_traces=1 -seed=1 -runs=10000 -timeout=5 2>&1 | FileCheck %s --check-prefix=CHECK3 +RUN: LLVMFuzzer-StrcmpTest-DFSan -use_traces=1 -seed=1 -runs=2 -timeout=5 -verbosity=3 2>&1 | FileCheck %s -check-prefix=CHECK_DFSanCmpCallback + RUN: not LLVMFuzzer-SwitchTest-DFSan -use_traces=1 -seed=1 -runs=100000 -timeout=5 2>&1 | FileCheck %s --check-prefix=CHECK4 RUN: LLVMFuzzer-SwitchTest-DFSan -use_traces=1 -seed=1 -runs=2 -timeout=5 -verbosity=3 2>&1 | FileCheck %s -check-prefix=CHECK_DFSanSwitchCallback diff --git a/llvm/lib/Fuzzer/test/fuzzer.test b/llvm/lib/Fuzzer/test/fuzzer.test index bfb5849..83fc0f8 100644 --- a/llvm/lib/Fuzzer/test/fuzzer.test +++ b/llvm/lib/Fuzzer/test/fuzzer.test @@ -32,5 +32,8 @@ Done1000000: Done 1000000 runs in RUN: not LLVMFuzzer-StrncmpTest -use_traces=1 -seed=1 -runs=10000 2>&1 | FileCheck %s RUN: LLVMFuzzer-StrncmpTest -seed=1 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000 +RUN: not LLVMFuzzer-StrcmpTest -use_traces=1 -seed=1 -runs=10000 2>&1 | FileCheck %s +RUN: LLVMFuzzer-StrcmpTest -seed=1 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000 + RUN: not LLVMFuzzer-SwitchTest -use_traces=1 -seed=1 -runs=1000000 2>&1 | FileCheck %s RUN: LLVMFuzzer-SwitchTest -seed=1 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000 -- 2.7.4