1 //===- FuzzerInternal.h - Internal header for the Fuzzer --------*- C++ -* ===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
9 // Define the main class fuzzer::Fuzzer and most functions.
10 //===----------------------------------------------------------------------===//
18 #include <unordered_set>
21 typedef std::vector<uint8_t> Unit;
22 using namespace std::chrono;
24 Unit ReadFile(const char *Path);
25 void ReadDirToVectorOfUnits(const char *Path, std::vector<Unit> *V);
26 void WriteToFile(const Unit &U, const std::string &Path);
27 void CopyFileToErr(const std::string &Path);
28 // Returns "Dir/FileName" or equivalent for the current OS.
29 std::string DirPlusFile(const std::string &DirPath,
30 const std::string &FileName);
32 void Mutate(Unit *U, size_t MaxLen);
34 void CrossOver(const Unit &A, const Unit &B, Unit *U, size_t MaxLen);
36 void Print(const Unit &U, const char *PrintAfter = "");
37 void PrintASCII(const Unit &U, const char *PrintAfter = "");
38 std::string Hash(const Unit &U);
39 void SetTimer(int Seconds);
43 struct FuzzingOptions {
46 bool DoCrossOver = true;
48 bool ExitOnFirst = false;
49 bool UseFullCoverageSet = false;
50 int PreferSmallDuringInitialShuffle = -1;
51 size_t MaxNumberOfRuns = ULONG_MAX;
52 std::string OutputCorpus;
54 Fuzzer(FuzzingOptions Options) : Options(Options) {
57 void AddToCorpus(const Unit &U) { Corpus.push_back(U); }
58 size_t Loop(size_t NumIterations);
59 void ShuffleAndMinimize();
60 size_t CorpusSize() const { return Corpus.size(); }
61 void ReadDir(const std::string &Path) {
62 ReadDirToVectorOfUnits(Path.c_str(), &Corpus);
64 // Save the current corpus to OutputCorpus.
67 size_t secondsSinceProcessStartUp() {
68 return duration_cast<seconds>(system_clock::now() - ProcessStartTime)
72 size_t getTotalNumberOfRuns() { return TotalNumberOfRuns; }
74 static void AlarmCallback();
77 size_t MutateAndTestOne(Unit *U);
78 size_t RunOne(const Unit &U);
79 size_t RunOneMaximizeTotalCoverage(const Unit &U);
80 size_t RunOneMaximizeFullCoverageSet(const Unit &U);
81 void WriteToOutputCorpus(const Unit &U);
82 static void WriteToCrash(const Unit &U, const char *Prefix);
84 void SetDeathCallback();
85 static void DeathCallback();
86 static Unit CurrentUnit;
88 size_t TotalNumberOfRuns = 0;
90 std::vector<Unit> Corpus;
91 std::unordered_set<uintptr_t> FullCoverageSets;
92 FuzzingOptions Options;
93 system_clock::time_point ProcessStartTime = system_clock::now();
94 static system_clock::time_point UnitStartTime;
97 }; // namespace fuzzer