maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

[libFuzzer] Make dataflow and focus functions more user friendly. 

Summary:
- Fail loudly if SetFocusFunction failed when it should not. For more info see
  - https://github.com/google/oss-fuzz/issues/3311
  - https://github.com/google/sanitizers/issues/1190
- Fail loudly if CollectDataFlow is called without seed corpus.

Reviewers: kcc, metzman

Subscribers: #sanitizers, llvm-commits

Tags: #sanitizers, #llvm

Differential Revision: https://reviews.llvm.org/D73813
This commit is contained in:
Max Moroz 2020-01-31 13:19:03 -08:00
parent 333f2ad8b8
commit ad7b908b4e
4 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
compiler-rt/lib/fuzzer/FuzzerDataFlowTrace.cpp
View File

@ -248,6 +248,11 @@ int CollectDataFlow(const std::string &DFTBinary, const std::string &DirPath,
const Vector<SizedFile> &CorporaFiles) {
Printf("INFO: collecting data flow: bin: %s dir: %s files: %zd\n",
DFTBinary.c_str(), DirPath.c_str(), CorporaFiles.size());
if (CorporaFiles.empty()) {
Printf("ERROR: can't collect data flow without corpus provided.");
return 1;
}
static char DFSanEnv[] = "DFSAN_OPTIONS=fast16labels=1:warn_unimplemented=0";
putenv(DFSanEnv);
MkDir(DirPath);

8
compiler-rt/lib/fuzzer/FuzzerTracePC.cpp
View File

@ -240,7 +240,9 @@ void TracePC::IterateCoveredFunctions(CallBack CB) {
void TracePC::SetFocusFunction(const std::string &FuncName) {
// This function should be called once.
assert(!FocusFunctionCounterPtr);
if (FuncName.empty())
// "auto" is not a valid function name. If this function is called with "auto"
// that means the auto focus functionality failed.
if (FuncName.empty() || FuncName == "auto")
return;
for (size_t M = 0; M < NumModules; M++) {
auto &PCTE = ModulePCTable[M];
@ -256,6 +258,10 @@ void TracePC::SetFocusFunction(const std::string &FuncName) {
return;
}
}
Printf("ERROR: Failed to set focus function. Make sure the function name is "
"valid (%s) and symbolization is enabled.\n", FuncName.c_str());
exit(1);
}
bool TracePC::ObservedFocusFunction() {

6
compiler-rt/test/fuzzer/dataflow.test
View File

@ -118,3 +118,9 @@ RUN: printf "%0.sA" {1..150001} > %t/IN/very_long_input
RUN: rm -rf %t/OUT
RUN: %t-ThreeFunctionsTest -collect_data_flow=%t-ThreeFunctionsTestDF -data_flow_trace=%t/OUT %t/IN/very_long_input
RUN: rm %t/IN/very_long_input
# Test that it fails explicitly when an empty corpus is provided.
RUN: rm -rf %t/IN && mkdir %t/IN
RUN: not %t-ThreeFunctionsTest -collect_data_flow=%t-ThreeFunctionsTestDF -data_flow_trace=%t/OUT %t/IN 2>&1 | FileCheck %s --check-prefix=EMPTY_CORPUS
EMPTY_CORPUS: ERROR: can't collect data flow without corpus provided

4
compiler-rt/test/fuzzer/target-function.test → compiler-rt/test/fuzzer/focus-function.test
View File

@ -10,9 +10,9 @@ RUN: %t-exe -runs=100 2>&1 | FileCheck %s --check-prefix=FOCUS_NONE
FOCUS_NONE-NOT: INFO: Focus function is set to
FOCUS_NONE-NOT: INFO: {{.*}} inputs touch the focus function
RUN: %t-exe -runs=100 -focus_function=WRONG 2>&1 | FileCheck %s --check-prefix=FOCUS_WRONG
RUN: not %t-exe -runs=100 -focus_function=WRONG 2>&1 | FileCheck %s --check-prefix=FOCUS_WRONG
FOCUS_WRONG-NOT: INFO: Focus function is set to
FOCUS_WRONG: INFO: 0/1 inputs touch the focus function
FOCUS_WRONG: ERROR: Failed to set focus function
RUN: %t-exe -runs=100 -focus_function=f0 2>&1 | FileCheck %s --check-prefix=FOCUS_F0
FOCUS_F0: INFO: Focus function is set to 'f0'