From c59b692c85e0b75ffb3168c2dbec2a0280886c9b Mon Sep 17 00:00:00 2001 From: Marcos Pividori Date: Tue, 13 Dec 2016 17:45:20 +0000 Subject: [PATCH] [libFuzzer] Improve Signal Handler interface. Add new flags to FuzzingOptions to represent the different conditions on the signal handling. These options are passed when calling SetSignalHandler(). This changes simplify the implementation of Windows's exception handling. Now we can define a unique handler for all the exceptions. Differential Revision: https://reviews.llvm.org/D27238 llvm-svn: 289557 --- llvm/lib/Fuzzer/FuzzerDriver.cpp | 18 ++-- llvm/lib/Fuzzer/FuzzerOptions.h | 7 ++ llvm/lib/Fuzzer/FuzzerUtil.h | 10 +- llvm/lib/Fuzzer/FuzzerUtilPosix.cpp | 25 +++-- llvm/lib/Fuzzer/FuzzerUtilWindows.cpp | 169 +++++++++++++--------------------- 5 files changed, 97 insertions(+), 132 deletions(-) diff --git a/llvm/lib/Fuzzer/FuzzerDriver.cpp b/llvm/lib/Fuzzer/FuzzerDriver.cpp index 2e94530e..1ff822c 100644 --- a/llvm/lib/Fuzzer/FuzzerDriver.cpp +++ b/llvm/lib/Fuzzer/FuzzerDriver.cpp @@ -457,16 +457,14 @@ int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) { StartRssThread(F, Flags.rss_limit_mb); - // Timer - if (Flags.timeout > 0) - SetTimer(Flags.timeout / 2 + 1); - if (Flags.handle_segv) SetSigSegvHandler(); - if (Flags.handle_bus) SetSigBusHandler(); - if (Flags.handle_abrt) SetSigAbrtHandler(); - if (Flags.handle_ill) SetSigIllHandler(); - if (Flags.handle_fpe) SetSigFpeHandler(); - if (Flags.handle_int) SetSigIntHandler(); - if (Flags.handle_term) SetSigTermHandler(); + Options.HandleAbrt = Flags.handle_abrt; + Options.HandleBus = Flags.handle_bus; + Options.HandleFpe = Flags.handle_fpe; + Options.HandleIll = Flags.handle_ill; + Options.HandleInt = Flags.handle_int; + Options.HandleSegv = Flags.handle_segv; + Options.HandleTerm = Flags.handle_term; + SetSignalHandler(Options); if (Flags.minimize_crash_internal_step) return MinimizeCrashInputInternalStep(F, Corpus); diff --git a/llvm/lib/Fuzzer/FuzzerOptions.h b/llvm/lib/Fuzzer/FuzzerOptions.h index 59126a2..f1cd493 100644 --- a/llvm/lib/Fuzzer/FuzzerOptions.h +++ b/llvm/lib/Fuzzer/FuzzerOptions.h @@ -53,6 +53,13 @@ struct FuzzingOptions { bool PrintCoverage = false; bool DetectLeaks = true; int TraceMalloc = 0; + bool HandleAbrt = false; + bool HandleBus = false; + bool HandleFpe = false; + bool HandleIll = false; + bool HandleInt = false; + bool HandleSegv = false; + bool HandleTerm = false; }; } // namespace fuzzer diff --git a/llvm/lib/Fuzzer/FuzzerUtil.h b/llvm/lib/Fuzzer/FuzzerUtil.h index eb42537..c237379 100644 --- a/llvm/lib/Fuzzer/FuzzerUtil.h +++ b/llvm/lib/Fuzzer/FuzzerUtil.h @@ -43,15 +43,7 @@ int NumberOfCpuCores(); bool ExecuteCommandAndReadOutput(const std::string &Command, std::string *Out); // Platform specific functions. -void SetTimer(int Seconds); - -void SetSigSegvHandler(); -void SetSigBusHandler(); -void SetSigAbrtHandler(); -void SetSigIllHandler(); -void SetSigFpeHandler(); -void SetSigIntHandler(); -void SetSigTermHandler(); +void SetSignalHandler(const FuzzingOptions& Options); void SleepSeconds(int Seconds); diff --git a/llvm/lib/Fuzzer/FuzzerUtilPosix.cpp b/llvm/lib/Fuzzer/FuzzerUtilPosix.cpp index ad1e304..abb2680 100644 --- a/llvm/lib/Fuzzer/FuzzerUtilPosix.cpp +++ b/llvm/lib/Fuzzer/FuzzerUtilPosix.cpp @@ -64,13 +64,24 @@ void SetTimer(int Seconds) { SetSigaction(SIGALRM, AlarmHandler); } -void SetSigSegvHandler() { SetSigaction(SIGSEGV, CrashHandler); } -void SetSigBusHandler() { SetSigaction(SIGBUS, CrashHandler); } -void SetSigAbrtHandler() { SetSigaction(SIGABRT, CrashHandler); } -void SetSigIllHandler() { SetSigaction(SIGILL, CrashHandler); } -void SetSigFpeHandler() { SetSigaction(SIGFPE, CrashHandler); } -void SetSigIntHandler() { SetSigaction(SIGINT, InterruptHandler); } -void SetSigTermHandler() { SetSigaction(SIGTERM, InterruptHandler); } +void SetSignalHandler(const FuzzingOptions& Options) { + if (Options.UnitTimeoutSec > 0) + SetTimer(Options.UnitTimeoutSec / 2 + 1); + if (Options.HandleInt) + SetSigaction(SIGINT, InterruptHandler); + if (Options.HandleTerm) + SetSigaction(SIGTERM, InterruptHandler); + if (Options.HandleSegv) + SetSigaction(SIGSEGV, CrashHandler); + if (Options.HandleBus) + SetSigaction(SIGBUS, CrashHandler); + if (Options.HandleAbrt) + SetSigaction(SIGABRT, CrashHandler); + if (Options.HandleIll) + SetSigaction(SIGILL, CrashHandler); + if (Options.HandleFpe) + SetSigaction(SIGFPE, CrashHandler); +} void SleepSeconds(int Seconds) { sleep(Seconds); // Use C API to avoid coverage from instrumented libc++. diff --git a/llvm/lib/Fuzzer/FuzzerUtilWindows.cpp b/llvm/lib/Fuzzer/FuzzerUtilWindows.cpp index c149699..f2dd6e6 100644 --- a/llvm/lib/Fuzzer/FuzzerUtilWindows.cpp +++ b/llvm/lib/Fuzzer/FuzzerUtilWindows.cpp @@ -13,7 +13,6 @@ #if LIBFUZZER_WINDOWS #include "FuzzerIO.h" #include "FuzzerInternal.h" -#include #include #include #include @@ -24,75 +23,58 @@ #include #include #include +#include namespace fuzzer { -LONG WINAPI SEGVHandler(PEXCEPTION_POINTERS ExceptionInfo) { - switch (ExceptionInfo->ExceptionRecord->ExceptionCode) { - case EXCEPTION_ACCESS_VIOLATION: - case EXCEPTION_ARRAY_BOUNDS_EXCEEDED: - case EXCEPTION_STACK_OVERFLOW: - Fuzzer::StaticCrashSignalCallback(); - break; - } - return EXCEPTION_CONTINUE_SEARCH; -} - -LONG WINAPI BUSHandler(PEXCEPTION_POINTERS ExceptionInfo) { - switch (ExceptionInfo->ExceptionRecord->ExceptionCode) { - case EXCEPTION_DATATYPE_MISALIGNMENT: - case EXCEPTION_IN_PAGE_ERROR: - Fuzzer::StaticCrashSignalCallback(); - break; - } - return EXCEPTION_CONTINUE_SEARCH; -} +static const FuzzingOptions* HandlerOpt = nullptr; -LONG WINAPI ILLHandler(PEXCEPTION_POINTERS ExceptionInfo) { +LONG CALLBACK ExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo) { switch (ExceptionInfo->ExceptionRecord->ExceptionCode) { - case EXCEPTION_ILLEGAL_INSTRUCTION: - case EXCEPTION_PRIV_INSTRUCTION: - Fuzzer::StaticCrashSignalCallback(); - break; + case EXCEPTION_ACCESS_VIOLATION: + case EXCEPTION_ARRAY_BOUNDS_EXCEEDED: + case EXCEPTION_STACK_OVERFLOW: + if (HandlerOpt->HandleSegv) + Fuzzer::StaticCrashSignalCallback(); + break; + case EXCEPTION_DATATYPE_MISALIGNMENT: + case EXCEPTION_IN_PAGE_ERROR: + if (HandlerOpt->HandleBus) + Fuzzer::StaticCrashSignalCallback(); + break; + case EXCEPTION_ILLEGAL_INSTRUCTION: + case EXCEPTION_PRIV_INSTRUCTION: + if (HandlerOpt->HandleIll) + Fuzzer::StaticCrashSignalCallback(); + break; + case EXCEPTION_FLT_DENORMAL_OPERAND: + case EXCEPTION_FLT_DIVIDE_BY_ZERO: + case EXCEPTION_FLT_INEXACT_RESULT: + case EXCEPTION_FLT_INVALID_OPERATION: + case EXCEPTION_FLT_OVERFLOW: + case EXCEPTION_FLT_STACK_CHECK: + case EXCEPTION_FLT_UNDERFLOW: + case EXCEPTION_INT_DIVIDE_BY_ZERO: + case EXCEPTION_INT_OVERFLOW: + if (HandlerOpt->HandleFpe) + Fuzzer::StaticCrashSignalCallback(); + break; } return EXCEPTION_CONTINUE_SEARCH; } -LONG WINAPI FPEHandler(PEXCEPTION_POINTERS ExceptionInfo) { - switch (ExceptionInfo->ExceptionRecord->ExceptionCode) { - case EXCEPTION_FLT_DENORMAL_OPERAND: - case EXCEPTION_FLT_DIVIDE_BY_ZERO: - case EXCEPTION_FLT_INEXACT_RESULT: - case EXCEPTION_FLT_INVALID_OPERATION: - case EXCEPTION_FLT_OVERFLOW: - case EXCEPTION_FLT_STACK_CHECK: - case EXCEPTION_FLT_UNDERFLOW: - case EXCEPTION_INT_DIVIDE_BY_ZERO: - case EXCEPTION_INT_OVERFLOW: - Fuzzer::StaticCrashSignalCallback(); - break; - } - return EXCEPTION_CONTINUE_SEARCH; -} - -BOOL WINAPI INTHandler(DWORD dwCtrlType) { +BOOL WINAPI CtrlHandler(DWORD dwCtrlType) { switch (dwCtrlType) { - case CTRL_C_EVENT: - Fuzzer::StaticInterruptCallback(); - return TRUE; - default: - return FALSE; - } -} - -BOOL WINAPI TERMHandler(DWORD dwCtrlType) { - switch (dwCtrlType) { - case CTRL_BREAK_EVENT: - Fuzzer::StaticInterruptCallback(); - return TRUE; - default: - return FALSE; + case CTRL_C_EVENT: + if (HandlerOpt->HandleInt) + Fuzzer::StaticInterruptCallback(); + return TRUE; + case CTRL_BREAK_EVENT: + if (HandlerOpt->HandleTerm) + Fuzzer::StaticInterruptCallback(); + return TRUE; } + return FALSE; } void CALLBACK AlarmHandler(PVOID, BOOLEAN) { @@ -126,59 +108,34 @@ class TimerQ { static TimerQ Timer; -void SetTimer(int Seconds) { - Timer.SetTimer(Seconds); - return; -} - -void SetSigSegvHandler() { - if (!AddVectoredExceptionHandler(1, SEGVHandler)) { - Printf("libFuzzer: AddVectoredExceptionHandler failed.\n"); - exit(1); - } -} - -void SetSigBusHandler() { - if (!AddVectoredExceptionHandler(1, BUSHandler)) { - Printf("libFuzzer: AddVectoredExceptionHandler failed.\n"); - exit(1); - } -} - static void CrashHandler(int) { Fuzzer::StaticCrashSignalCallback(); } -void SetSigAbrtHandler() { signal(SIGABRT, CrashHandler); } +void SetSignalHandler(const FuzzingOptions& Options) { + HandlerOpt = &Options; -void SetSigIllHandler() { - if (!AddVectoredExceptionHandler(1, ILLHandler)) { - Printf("libFuzzer: AddVectoredExceptionHandler failed.\n"); - exit(1); - } -} + if (Options.UnitTimeoutSec > 0) + Timer.SetTimer(Options.UnitTimeoutSec / 2 + 1); -void SetSigFpeHandler() { - if (!AddVectoredExceptionHandler(1, FPEHandler)) { - Printf("libFuzzer: AddVectoredExceptionHandler failed.\n"); - exit(1); - } -} + if (Options.HandleInt || Options.HandleTerm) + if (!SetConsoleCtrlHandler(CtrlHandler, TRUE)) { + DWORD LastError = GetLastError(); + Printf("libFuzzer: SetConsoleCtrlHandler failed (Error code: %lu).\n", + LastError); + exit(1); + } -void SetSigIntHandler() { - if (!SetConsoleCtrlHandler(INTHandler, TRUE)) { - DWORD LastError = GetLastError(); - Printf("libFuzzer: SetConsoleCtrlHandler failed (Error code: %lu).\n", - LastError); - exit(1); - } -} + if (Options.HandleSegv || Options.HandleBus || Options.HandleIll || + Options.HandleFpe) + if (!AddVectoredExceptionHandler(1, ExceptionHandler)) { + Printf("libFuzzer: AddVectoredExceptionHandler failed.\n"); + exit(1); + } -void SetSigTermHandler() { - if (!SetConsoleCtrlHandler(TERMHandler, TRUE)) { - DWORD LastError = GetLastError(); - Printf("libFuzzer: SetConsoleCtrlHandler failed (Error code: %lu).\n", - LastError); - exit(1); - } + if (Options.HandleAbrt) + if (SIG_ERR == signal(SIGABRT, CrashHandler)) { + Printf("libFuzzer: signal failed with %d\n", errno); + exit(1); + } } void SleepSeconds(int Seconds) { Sleep(Seconds * 1000); } -- 2.7.4