X-Git-Url: http://demsky.eecs.uci.edu/git/?a=blobdiff_plain;f=lib%2FFuzzer%2FFuzzerInterface.h;h=c96343404f42904c3a608fd68bc86f54ea2ce456;hb=e5920b3247ddb99946d407d11687bf5131e259f4;hp=c4582d61f1acc2f0d96b2624bffd10c8b28bae16;hpb=397ed3e704b42b19af6e1b12b09df29970cac4e7;p=oota-llvm.git diff --git a/lib/Fuzzer/FuzzerInterface.h b/lib/Fuzzer/FuzzerInterface.h index c4582d61f1a..c96343404f4 100644 --- a/lib/Fuzzer/FuzzerInterface.h +++ b/lib/Fuzzer/FuzzerInterface.h @@ -18,10 +18,13 @@ #include #include +#include +#include namespace fuzzer { -typedef void (*UserCallback)(const uint8_t *Data, size_t Size); +/// Returns an int 0. Values other than zero are reserved for future. +typedef int (*UserCallback)(const uint8_t *Data, size_t Size); /** Simple C-like interface with a single user-supplied callback. Usage: @@ -29,8 +32,9 @@ Usage: #\code #include "FuzzerInterface.h" -void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { +int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { DoStuffWithData(Data, Size); + return 0; } // Implement your own main() or use the one from FuzzerMain.cpp. @@ -62,33 +66,49 @@ class FuzzerRandomLibc : public FuzzerRandomBase { size_t Rand() override; }; +class MutationDispatcher { + public: + MutationDispatcher(FuzzerRandomBase &Rand); + ~MutationDispatcher(); + /// Mutates data by shuffling bytes. + size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize); + /// Mutates data by erasing a byte. + size_t Mutate_EraseByte(uint8_t *Data, size_t Size, size_t MaxSize); + /// Mutates data by inserting a byte. + size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize); + /// Mutates data by chanding one byte. + size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize); + /// Mutates data by chanding one bit. + size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize); + + /// Mutates data by adding a word from the dictionary. + size_t Mutate_AddWordFromDictionary(uint8_t *Data, size_t Size, + size_t MaxSize); + + size_t Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MaxSize); + + /// Applies one of the above mutations. + /// Returns the new size of data which could be up to MaxSize. + size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize); + + /// Creates a cross-over of two pieces of Data, returns its size. + size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2, + size_t Size2, uint8_t *Out, size_t MaxOutSize); + + void AddWordToDictionary(const uint8_t *Word, size_t Size); -/// Mutates data by shuffling bytes. -size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize, - FuzzerRandomBase &Rand); -/// Mutates data by erasing a byte. -size_t Mutate_EraseByte(uint8_t *Data, size_t Size, size_t MaxSize, - FuzzerRandomBase &Rand); -/// Mutates data by inserting a byte. -size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize, - FuzzerRandomBase &Rand); -/// Mutates data by chanding one byte. -size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize, - FuzzerRandomBase &Rand); -/// Mutates data by chanding one bit. -size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize, - FuzzerRandomBase &Rand); - -/// Applies one of the above mutations. -/// Returns the new size of data which could be up to MaxSize. -size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize, - FuzzerRandomBase &Rand); - -/// Creates a cross-over of two pieces of Data, returns its size. -size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2, - size_t Size2, uint8_t *Out, size_t MaxOutSize, - FuzzerRandomBase &Rand); + private: + FuzzerRandomBase &Rand; + struct Impl; + Impl *MDImpl; +}; +// For backward compatibility only, deprecated. +static inline size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize, + FuzzerRandomBase &Rand) { + MutationDispatcher MD(Rand); + return MD.Mutate(Data, Size, MaxSize); +} /** An abstract class that allows to use user-supplied mutators with libFuzzer. @@ -100,7 +120,7 @@ class MyFuzzer : public fuzzer::UserSuppliedFuzzer { public: MyFuzzer(fuzzer::FuzzerRandomBase *Rand); // Must define the target function. - void TargetFunction(...) { ... } + int TargetFunction(...) { ...; return 0; } // Optionally define the mutator. size_t Mutate(...) { ... } // Optionally define the CrossOver method. @@ -115,35 +135,40 @@ int main(int argc, char **argv) { */ class UserSuppliedFuzzer { public: - UserSuppliedFuzzer(); // Deprecated, don't use. UserSuppliedFuzzer(FuzzerRandomBase *Rand); /// Executes the target function on 'Size' bytes of 'Data'. - virtual void TargetFunction(const uint8_t *Data, size_t Size) = 0; + virtual int TargetFunction(const uint8_t *Data, size_t Size) = 0; /// Mutates 'Size' bytes of data in 'Data' inplace into up to 'MaxSize' bytes, /// returns the new size of the data, which should be positive. virtual size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize) { - return ::fuzzer::Mutate(Data, Size, MaxSize, GetRand()); + return MD.Mutate(Data, Size, MaxSize); } /// Crosses 'Data1' and 'Data2', writes up to 'MaxOutSize' bytes into Out, /// returns the number of bytes written, which should be positive. virtual size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2, size_t Size2, uint8_t *Out, size_t MaxOutSize) { - return ::fuzzer::CrossOver(Data1, Size1, Data2, Size2, Out, MaxOutSize, - GetRand()); + return MD.CrossOver(Data1, Size1, Data2, Size2, Out, MaxOutSize); } virtual ~UserSuppliedFuzzer(); FuzzerRandomBase &GetRand() { return *Rand; } + MutationDispatcher &GetMD() { return MD; } + private: bool OwnRand = false; FuzzerRandomBase *Rand; + MutationDispatcher MD; }; /// Runs the fuzzing with the UserSuppliedFuzzer. int FuzzerDriver(int argc, char **argv, UserSuppliedFuzzer &USF); +/// More C++-ish interface. +int FuzzerDriver(const std::vector &Args, UserSuppliedFuzzer &USF); +int FuzzerDriver(const std::vector &Args, UserCallback Callback); + } // namespace fuzzer #endif // LLVM_FUZZER_INTERFACE_H