mirror of
https://github.com/llvm/llvm-project.git
synced 2025-04-28 10:16:06 +00:00
[lib/Fuzzer] rename TestOneInput to LLVMFuzzerTestOneInput to make it more unique
llvm-svn: 236652
This commit is contained in:
parent
d6616acb2c
commit
566bc5aa8a
@ -20,7 +20,7 @@ This library is intended primarily for in-process coverage-guided fuzz testing
|
|||||||
optimizations options (e.g. -O0, -O1, -O2) to diversify testing.
|
optimizations options (e.g. -O0, -O1, -O2) to diversify testing.
|
||||||
* Build a test driver using the same options as the library.
|
* Build a test driver using the same options as the library.
|
||||||
The test driver is a C/C++ file containing interesting calls to the library
|
The test driver is a C/C++ file containing interesting calls to the library
|
||||||
inside a single function ``extern "C" void TestOneInput(const uint8_t *Data, size_t Size);``
|
inside a single function ``extern "C" void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);``
|
||||||
* Link the Fuzzer, the library and the driver together into an executable
|
* Link the Fuzzer, the library and the driver together into an executable
|
||||||
using the same sanitizer options as for the library.
|
using the same sanitizer options as for the library.
|
||||||
* Collect the initial corpus of inputs for the
|
* Collect the initial corpus of inputs for the
|
||||||
@ -56,7 +56,7 @@ Toy example
|
|||||||
A simple function that does something interesting if it receives the input "HI!"::
|
A simple function that does something interesting if it receives the input "HI!"::
|
||||||
|
|
||||||
cat << EOF >> test_fuzzer.cc
|
cat << EOF >> test_fuzzer.cc
|
||||||
extern "C" void TestOneInput(const unsigned char *data, unsigned long size) {
|
extern "C" void LLVMFuzzerTestOneInput(const unsigned char *data, unsigned long size) {
|
||||||
if (size > 0 && data[0] == 'H')
|
if (size > 0 && data[0] == 'H')
|
||||||
if (size > 1 && data[1] == 'I')
|
if (size > 1 && data[1] == 'I')
|
||||||
if (size > 2 && data[2] == '!')
|
if (size > 2 && data[2] == '!')
|
||||||
@ -92,7 +92,7 @@ Here we show how to use lib/Fuzzer on something real, yet simple: pcre2_::
|
|||||||
cat << EOF > pcre_fuzzer.cc
|
cat << EOF > pcre_fuzzer.cc
|
||||||
#include <string.h>
|
#include <string.h>
|
||||||
#include "pcre2posix.h"
|
#include "pcre2posix.h"
|
||||||
extern "C" void TestOneInput(const unsigned char *data, size_t size) {
|
extern "C" void LLVMFuzzerTestOneInput(const unsigned char *data, size_t size) {
|
||||||
if (size < 1) return;
|
if (size < 1) return;
|
||||||
char *str = new char[size+1];
|
char *str = new char[size+1];
|
||||||
memcpy(str, data, size);
|
memcpy(str, data, size);
|
||||||
@ -196,7 +196,7 @@ to find Heartbleed with LibFuzzer::
|
|||||||
assert (SSL_CTX_use_PrivateKey_file(sctx, "server.key", SSL_FILETYPE_PEM));
|
assert (SSL_CTX_use_PrivateKey_file(sctx, "server.key", SSL_FILETYPE_PEM));
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
extern "C" void TestOneInput(unsigned char *Data, size_t Size) {
|
extern "C" void LLVMFuzzerTestOneInput(unsigned char *Data, size_t Size) {
|
||||||
static int unused = Init();
|
static int unused = Init();
|
||||||
SSL *server = SSL_new(sctx);
|
SSL *server = SSL_new(sctx);
|
||||||
BIO *sinbio = BIO_new(BIO_s_mem());
|
BIO *sinbio = BIO_new(BIO_s_mem());
|
||||||
@ -259,7 +259,7 @@ Periodically restart both fuzzers so that they can use each other's findings.
|
|||||||
How good is my fuzzer?
|
How good is my fuzzer?
|
||||||
----------------------
|
----------------------
|
||||||
|
|
||||||
Once you implement your target function ``TestOneInput`` and fuzz it to death,
|
Once you implement your target function ``LLVMFuzzerTestOneInput`` and fuzz it to death,
|
||||||
you will want to know whether the function or the corpus can be improved further.
|
you will want to know whether the function or the corpus can be improved further.
|
||||||
One easy to use metric is, of course, code coverage.
|
One easy to use metric is, of course, code coverage.
|
||||||
You can get the coverage for your corpus like this::
|
You can get the coverage for your corpus like this::
|
||||||
|
@ -13,8 +13,8 @@
|
|||||||
#include "FuzzerInternal.h"
|
#include "FuzzerInternal.h"
|
||||||
|
|
||||||
// This function should be defined by the user.
|
// This function should be defined by the user.
|
||||||
extern "C" void TestOneInput(const uint8_t *Data, size_t Size);
|
extern "C" void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
|
||||||
|
|
||||||
int main(int argc, char **argv) {
|
int main(int argc, char **argv) {
|
||||||
return fuzzer::FuzzerDriver(argc, argv, TestOneInput);
|
return fuzzer::FuzzerDriver(argc, argv, LLVMFuzzerTestOneInput);
|
||||||
}
|
}
|
||||||
|
@ -9,4 +9,4 @@ fun:__sanitizer_cov_module_init=uninstrumented
|
|||||||
fun:__sanitizer_cov_module_init=discard
|
fun:__sanitizer_cov_module_init=discard
|
||||||
|
|
||||||
# Don't add extra parameters to the Fuzzer callback.
|
# Don't add extra parameters to the Fuzzer callback.
|
||||||
fun:TestOneInput=uninstrumented
|
fun:LLVMFuzzerTestOneInput=uninstrumented
|
||||||
|
@ -2,7 +2,7 @@
|
|||||||
// executed many times.
|
// executed many times.
|
||||||
#include <iostream>
|
#include <iostream>
|
||||||
|
|
||||||
extern "C" void TestOneInput(const uint8_t *Data, size_t Size) {
|
extern "C" void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
||||||
int Num = 0;
|
int Num = 0;
|
||||||
for (size_t i = 0; i < Size; i++)
|
for (size_t i = 0; i < Size; i++)
|
||||||
if (Data[i] == 'A' + i)
|
if (Data[i] == 'A' + i)
|
||||||
|
@ -10,7 +10,7 @@ static void Found() {
|
|||||||
exit(1);
|
exit(1);
|
||||||
}
|
}
|
||||||
|
|
||||||
extern "C" void TestOneInput(const uint8_t *Data, size_t Size) {
|
extern "C" void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
||||||
// looking for "thread_local unsigned A;"
|
// looking for "thread_local unsigned A;"
|
||||||
if (Size < 24) return;
|
if (Size < 24) return;
|
||||||
if (0 == memcmp(&Data[0], "thread_local", 12))
|
if (0 == memcmp(&Data[0], "thread_local", 12))
|
||||||
|
@ -4,7 +4,7 @@
|
|||||||
#include <cstddef>
|
#include <cstddef>
|
||||||
#include <iostream>
|
#include <iostream>
|
||||||
|
|
||||||
extern "C" void TestOneInput(const uint8_t *Data, size_t Size) {
|
extern "C" void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
||||||
int bits = 0;
|
int bits = 0;
|
||||||
if (Size > 0 && Data[0] == 'F') bits |= 1;
|
if (Size > 0 && Data[0] == 'F') bits |= 1;
|
||||||
if (Size > 1 && Data[1] == 'U') bits |= 2;
|
if (Size > 1 && Data[1] == 'U') bits |= 2;
|
||||||
|
@ -4,7 +4,7 @@
|
|||||||
#include <cstddef>
|
#include <cstddef>
|
||||||
#include <iostream>
|
#include <iostream>
|
||||||
|
|
||||||
extern "C" void TestOneInput(const uint8_t *Data, size_t Size) {
|
extern "C" void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
||||||
int bits = 0;
|
int bits = 0;
|
||||||
if (Size > 0 && Data[0] == 'F') bits |= 1;
|
if (Size > 0 && Data[0] == 'F') bits |= 1;
|
||||||
if (Size > 1 && Data[1] == 'U') bits |= 2;
|
if (Size > 1 && Data[1] == 'U') bits |= 2;
|
||||||
|
@ -2,9 +2,9 @@
|
|||||||
#include "gtest/gtest.h"
|
#include "gtest/gtest.h"
|
||||||
#include <set>
|
#include <set>
|
||||||
|
|
||||||
// For now, have TestOneInput just to make it link.
|
// For now, have LLVMFuzzerTestOneInput just to make it link.
|
||||||
// Later we may want to make unittests that actually call TestOneInput.
|
// Later we may want to make unittests that actually call LLVMFuzzerTestOneInput.
|
||||||
extern "C" void TestOneInput(const uint8_t *Data, size_t Size) {
|
extern "C" void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
||||||
abort();
|
abort();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -6,7 +6,7 @@
|
|||||||
|
|
||||||
static volatile int Sink;
|
static volatile int Sink;
|
||||||
|
|
||||||
extern "C" void TestOneInput(const uint8_t *Data, size_t Size) {
|
extern "C" void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
||||||
if (Size > 0 && Data[0] == 'H') {
|
if (Size > 0 && Data[0] == 'H') {
|
||||||
Sink = 1;
|
Sink = 1;
|
||||||
if (Size > 1 && Data[1] == 'i') {
|
if (Size > 1 && Data[1] == 'i') {
|
||||||
|
@ -7,7 +7,7 @@
|
|||||||
static volatile int Sink;
|
static volatile int Sink;
|
||||||
static volatile int *Null = 0;
|
static volatile int *Null = 0;
|
||||||
|
|
||||||
extern "C" void TestOneInput(const uint8_t *Data, size_t Size) {
|
extern "C" void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
||||||
if (Size > 0 && Data[0] == 'H') {
|
if (Size > 0 && Data[0] == 'H') {
|
||||||
Sink = 1;
|
Sink = 1;
|
||||||
if (Size > 1 && Data[1] == 'i') {
|
if (Size > 1 && Data[1] == 'i') {
|
||||||
|
@ -6,7 +6,7 @@
|
|||||||
|
|
||||||
static volatile int Sink;
|
static volatile int Sink;
|
||||||
|
|
||||||
extern "C" void TestOneInput(const uint8_t *Data, size_t Size) {
|
extern "C" void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
||||||
if (Size > 0 && Data[0] == 'H') {
|
if (Size > 0 && Data[0] == 'H') {
|
||||||
Sink = 1;
|
Sink = 1;
|
||||||
if (Size > 1 && Data[1] == 'i') {
|
if (Size > 1 && Data[1] == 'i') {
|
||||||
|
@ -6,7 +6,7 @@
|
|||||||
|
|
||||||
static volatile int Sink;
|
static volatile int Sink;
|
||||||
|
|
||||||
extern "C" void TestOneInput(const uint8_t *Data, size_t Size) {
|
extern "C" void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
||||||
if (Size > 0 && Data[0] == 'H') {
|
if (Size > 0 && Data[0] == 'H') {
|
||||||
Sink = 1;
|
Sink = 1;
|
||||||
if (Size > 1 && Data[1] == 'i') {
|
if (Size > 1 && Data[1] == 'i') {
|
||||||
|
@ -4,7 +4,7 @@
|
|||||||
#include <cstring>
|
#include <cstring>
|
||||||
#include <cstdio>
|
#include <cstdio>
|
||||||
|
|
||||||
extern "C" void TestOneInput(const uint8_t *Data, size_t Size) {
|
extern "C" void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
||||||
if (Size < 14) return;
|
if (Size < 14) return;
|
||||||
uint64_t x = 0;
|
uint64_t x = 0;
|
||||||
int64_t y = 0;
|
int64_t y = 0;
|
||||||
|
Loading…
x
Reference in New Issue
Block a user