mirror of
https://github.com/c64scene-ar/llvm-6502.git
synced 2025-08-10 02:25:47 +00:00
c9baf3befb
Summary: A simple genetic in-process coverage-guided fuzz testing library. I've used this fuzzer to test clang-format (it found 12+ bugs, thanks djasper@ for the fixes!) and it may also help us test other parts of LLVM. So why not keep it in the LLVM repository? I plan to add the cmake build rules later (in a separate patch, if that's ok) and also add a clang-format-fuzzer target. See README.txt for details. Test Plan: Tests will follow separately. Reviewers: djasper, chandlerc, rnk Reviewed By: rnk Subscribers: majnemer, ygribov, dblaikie, llvm-commits Differential Revision: http://reviews.llvm.org/D7184 git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227252 91177308-0d34-0410-b5e6-96231b3b80d8
78 lines
2.2 KiB
C++
78 lines
2.2 KiB
C++
//===- FuzzerInternal.h - Internal header for the Fuzzer --------*- C++ -* ===//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
// Define the main class fuzzer::Fuzzer and most functions.
|
|
//===----------------------------------------------------------------------===//
|
|
#include <cassert>
|
|
#include <chrono>
|
|
#include <cstddef>
|
|
#include <cstdlib>
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
namespace fuzzer {
|
|
typedef std::vector<uint8_t> Unit;
|
|
using namespace std::chrono;
|
|
|
|
Unit ReadFile(const char *Path);
|
|
std::vector<std::string> ListFilesInDir(const std::string &Dir);
|
|
void ReadDirToVectorOfUnits(const char *Path, std::vector<Unit> *V);
|
|
void WriteToFile(const Unit &U, const std::string &Path);
|
|
|
|
void Mutate(Unit *U, size_t MaxLen);
|
|
|
|
void CrossOver(const Unit &A, const Unit &B, Unit *U, size_t MaxLen);
|
|
|
|
void Print(const Unit &U, const char *PrintAfter = "");
|
|
void PrintASCII(const Unit &U, const char *PrintAfter = "");
|
|
std::string Hash(const Unit &U);
|
|
void SetTimer(int Seconds);
|
|
|
|
class Fuzzer {
|
|
public:
|
|
struct FuzzingOptions {
|
|
int Verbosity = 1;
|
|
int MaxLen = 0;
|
|
bool DoCrossOver = true;
|
|
bool MutateDepth = 10;
|
|
bool ExitOnFirst = false;
|
|
std::string OutputCorpus;
|
|
};
|
|
Fuzzer(FuzzingOptions Options) : Options(Options) {
|
|
SetDeathCallback();
|
|
}
|
|
void AddToCorpus(const Unit &U) { Corpus.push_back(U); }
|
|
size_t Loop(size_t NumIterations);
|
|
void ShuffleAndMinimize();
|
|
size_t CorpusSize() const { return Corpus.size(); }
|
|
void ReadDir(const std::string &Path) {
|
|
ReadDirToVectorOfUnits(Path.c_str(), &Corpus);
|
|
}
|
|
|
|
static void AlarmCallback();
|
|
|
|
private:
|
|
size_t MutateAndTestOne(Unit *U);
|
|
size_t RunOne(const Unit &U);
|
|
void WriteToOutputCorpus(const Unit &U);
|
|
static void WriteToCrash(const Unit &U, const char *Prefix);
|
|
|
|
void SetDeathCallback();
|
|
static void DeathCallback();
|
|
static Unit CurrentUnit;
|
|
|
|
size_t TotalNumberOfRuns = 0;
|
|
|
|
std::vector<Unit> Corpus;
|
|
FuzzingOptions Options;
|
|
system_clock::time_point ProcessStartTime = system_clock::now();
|
|
static system_clock::time_point UnitStartTime;
|
|
};
|
|
|
|
}; // namespace fuzzer
|