1 //===- FuzzerInternal.h - Internal header for the Fuzzer --------*- C++ -* ===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
9 // Define the main class fuzzer::Fuzzer and most functions.
10 //===----------------------------------------------------------------------===//
17 #include <unordered_set>
20 typedef std::vector<uint8_t> Unit;
21 using namespace std::chrono;
23 Unit ReadFile(const char *Path);
24 void ReadDirToVectorOfUnits(const char *Path, std::vector<Unit> *V);
25 void WriteToFile(const Unit &U, const std::string &Path);
26 // Returns "Dir/FileName" or equivalent for the current OS.
27 std::string DirPlusFile(const std::string &DirPath,
28 const std::string &FileName);
30 void Mutate(Unit *U, size_t MaxLen);
32 void CrossOver(const Unit &A, const Unit &B, Unit *U, size_t MaxLen);
34 void Print(const Unit &U, const char *PrintAfter = "");
35 void PrintASCII(const Unit &U, const char *PrintAfter = "");
36 std::string Hash(const Unit &U);
37 void SetTimer(int Seconds);
41 struct FuzzingOptions {
44 bool DoCrossOver = true;
45 bool MutateDepth = 10;
46 bool ExitOnFirst = false;
47 bool UseFullCoverageSet = false;
48 std::string OutputCorpus;
50 Fuzzer(FuzzingOptions Options) : Options(Options) {
53 void AddToCorpus(const Unit &U) { Corpus.push_back(U); }
54 size_t Loop(size_t NumIterations);
55 void ShuffleAndMinimize();
56 size_t CorpusSize() const { return Corpus.size(); }
57 void ReadDir(const std::string &Path) {
58 ReadDirToVectorOfUnits(Path.c_str(), &Corpus);
60 // Save the current corpus to OutputCorpus.
63 static void AlarmCallback();
66 size_t MutateAndTestOne(Unit *U);
67 size_t RunOne(const Unit &U);
68 size_t RunOneMaximizeTotalCoverage(const Unit &U);
69 size_t RunOneMaximizeFullCoverageSet(const Unit &U);
70 void WriteToOutputCorpus(const Unit &U);
71 static void WriteToCrash(const Unit &U, const char *Prefix);
73 void SetDeathCallback();
74 static void DeathCallback();
75 static Unit CurrentUnit;
77 size_t TotalNumberOfRuns = 0;
79 std::vector<Unit> Corpus;
80 std::unordered_set<uintptr_t> FullCoverageSets;
81 FuzzingOptions Options;
82 system_clock::time_point ProcessStartTime = system_clock::now();
83 static system_clock::time_point UnitStartTime;
86 }; // namespace fuzzer