KKostya Serebryany[libFuzzer] Extend the fuzz target intarface to allow -1 return value.
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
[compiler-rt] Rename lit.*.cfg.* -> lit.*.cfg.py.* These lit configuration files are really Python source code. Using the .py file extension helps editors and tools use the correct language mode. LLVM and Clang already use this convention for lit configuration, this change simply applies it to all of compiler-rt. Reviewers: vitalybuka, dberris Differential Revision: https://reviews.llvm.org/D63658 llvm-svn: 364591 | 6 年前 | |
Summary: Add close_fd_mask functionality to AFL driver. Summary: Add support for env var AFL_DRIVER_CLOSE_FD_MASK which behaves the same as libFuzzer's -close_fd_mask=1. Also add tests. Reviewers: kcc, vitalybuka, morehouse Reviewed By: morehouse Subscribers: #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D60334 llvm-svn: 358703 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[fuzzer] Fix test checks broken after license header update llvm-svn: 351717 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[libFuzzer] Guard symbolization with try-lock. Summary: When out-of-memory or timeout occurs, threads can be stopped during symbolization, thereby causing a deadlock when the OOM/TO handlers attempt symbolization. We avoid this deadlock by skipping symbolization if another thread is symbolizing. Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D46605 llvm-svn: 331825 | 8 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[compiler-rt] Fix lld dependency for sanitizers TARGET lld is always false there. | 4 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[libFuzzer] add CompressedTest.cpp, a real-life-ish test for a custom mutator llvm-svn: 352265 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Recommit "[libFuzzer] Fix arguments of InsertPartOf/CopyPartOf calls in CrossOver mutator." The CrossOver mutator is meant to cross over two given buffers (referred to as the first/second buffer henceforth). Previously InsertPartOf/CopyPartOf calls used in the CrossOver mutator incorrectly inserted/copied part of the second buffer into a "scratch buffer" (MutateInPlaceHere of the size CurrentMaxMutationLen), rather than the first buffer. This is not intended behavior, because the scratch buffer does not always (i) contain the content of the first buffer, and (ii) have the same size as the first buffer; CurrentMaxMutationLen is typically a lot larger than the size of the first buffer. This patch fixes the issue by using the first buffer instead of the scratch buffer in InsertPartOf/CopyPartOf calls. A FuzzBench experiment was run to make sure that this change does not inadvertently degrade the performance. The performance is largely the same; more details can be found at: https://storage.googleapis.com/fuzzer-test-suite-public/fixcrossover-report/index.html This patch also adds two new tests, namely "cross_over_insert" and "cross_over_copy", which specifically target InsertPartOf and CopyPartOf, respectively. - cross_over_insert.test checks if the fuzzer can use InsertPartOf to trigger the crash. - cross_over_copy.test checks if the fuzzer can use CopyPartOf to trigger the crash. These newly added tests were designed to pass with the current patch, but not without the it (with 790878f291fa5dc58a1c560cb6cc76fd1bfd1c5a these tests do not pass). To achieve this, -max_len was intentionally given a high value. Without this patch, InsertPartOf/CopyPartOf will generate larger inputs, possibly with unpredictable data in it, thereby failing to trigger the crash. The test pass condition for these new tests is narrowed down by (i) limiting mutation depth to 1 (i.e., a single CrossOver mutation should be able to trigger the crash) and (ii) checking whether the mutation sequence of "CrossOver-" leads to the crash. Also note that these newly added tests and an existing test (cross_over.test) all use "-reduce_inputs=0" flags to prevent reducing inputs; it's easier to force the fuzzer to keep original input string this way than tweaking cov-instrumented basic blocks in the source code of the fuzzer executable. Differential Revision: https://reviews.llvm.org/D85554 | 5 年前 | |
Recommit "[libFuzzer] Link libFuzzer's own interceptors when other compiler runtimes are not linked." Summary: libFuzzer intercepts certain library functions such as memcmp/strcmp by defining weak hooks. Weak hooks, however, are called only when other runtimes such as ASan is linked. This patch defines libFuzzer's own interceptors, which is linked into the libFuzzer executable when other runtimes are not linked, i.e., when -fsanitize=fuzzer is given, but not others. The patch once landed but was reverted in 8ef9e2bf355d05bc81d8b0fe1e5333eec59a0a91 due to an assertion failure caused by calling an intercepted function, strncmp, while initializing the interceptors in fuzzerInit(). This issue is now fixed by calling libFuzzer's own implementation of library functions (i.e., internal_*) when the fuzzer has not been initialized yet, instead of recursively calling fuzzerInit() again. Reviewers: kcc, morehouse, hctim Subscribers: #sanitizers, krytarowski, mgorny, cfe-commits Tags: #clang, #sanitizers Differential Revision: https://reviews.llvm.org/D83494 | 5 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[compiler-rt] NFC: Fix trivial typo Reviewed By: xgupta Differential Revision: https://reviews.llvm.org/D77457 | 4 年前 | |
[compiler-rt] NFC: Fix trivial typo Reviewed By: xgupta Differential Revision: https://reviews.llvm.org/D77457 | 4 年前 | |
[libfuzzer] Reduce default verbosity when printing large mutation sequences When using a custom mutator (e.g. thrift mutator, similar to LPM) that calls back into libfuzzer's mutations via LLVMFuzzerMutate, the mutation sequences needed to achieve new coverage can get prohibitively large. Printing these large sequences has two downsides: 1) It makes the logs hard to understand for a human. 2) The performance cost slows down fuzzing. In this patch I change the PrintMutationSequence function to take a max number of entries, to achieve this goal. I also update PrintStatusForNewUnit to default to printing only 10 entries, in the default verbosity level (1), requiring the user to set verbosity to 2 if they want the full mutation sequence. For our use case, turning off verbosity is not an option, as that would also disable PrintStats() which is very useful for infrastructure that analyzes the logs in realtime. I imagine most users of libfuzzer always want those logs in the default. I built a fuzzer locally with this patch applied to libfuzzer. When running with the default verbosity, I see logs like this: #65 NEW cov: 4799 ft: 10443 corp: 41/1447Kb lim: 64000 exec/s: 1 rss: 575Mb L: 28658/62542 MS: 196 Custom-CrossOver-ChangeBit-EraseBytes-ChangeBit-ChangeBit-ChangeBit-CrossOver-ChangeBit-CrossOver- DE: "\xff\xff\xff\x0e"-"\xfe\xff\xff\x7f"-"\xfe\xff\xff\x7f"-"\x17\x00\x00\x00\x00\x00\x00\x00"-"\x00\x00\x00\xf9"-"\xff\xff\xff\xff"-"\xfa\xff\xff\xff"-"\xf7\xff\xff\xff"-"@\xff\xff\xff\xff\xff\xff\xff"-"E\x00"- #67 NEW cov: 4810 ft: 10462 corp: 42/1486Kb lim: 64000 exec/s: 1 rss: 577Mb L: 39823/62542 MS: 135 Custom-CopyPart-ShuffleBytes-ShuffleBytes-ChangeBit-ChangeBinInt-EraseBytes-ChangeBit-ChangeBinInt-ChangeBit- DE: "\x01\x00\x00\x00\x00\x00\x01\xf1"-"\x00\x00\x00\x07"-"\x00\x0d"-"\xfd\xff\xff\xff"-"\xfe\xff\xff\xf4"-"\xe3\xff\xff\xff"-"\xff\xff\xff\xf1"-"\xea\xff\xff\xff"-"\x00\x00\x00\xfd"-"\x01\x00\x00\x05"- Staring hard at the logs it's clear that the cap of 10 is applied. When running with verbosity level 2, the logs look like the below: #66 NEW cov: 4700 ft: 10188 corp: 37/1186Kb lim: 64000 exec/s: 2 rss: 509Mb L: 47616/61231 MS: 520 Custom-CopyPart-ChangeBinInt-ChangeBit-ChangeByte-EraseBytes-PersAutoDict-CopyPart-ShuffleBytes-ChangeBit-ShuffleBytes-CopyPart-EraseBytes-CopyPart-ChangeBinInt-CopyPart-ChangeByte-ShuffleBytes-ChangeBinInt-ShuffleBytes-ChangeBit-CMP-ShuffleBytes-ChangeBit-CrossOver-ChangeBinInt-ChangeByte-ShuffleBytes-CrossOver-EraseBytes-ChangeBinInt-InsertRepeatedBytes-PersAutoDict-InsertRepeatedBytes-InsertRepeatedBytes-CrossOver-ChangeByte-ShuffleBytes-CopyPart-ShuffleBytes-CopyPart-CrossOver-ChangeBit-ShuffleBytes-CrossOver-PersAutoDict-ChangeByte-ChangeBit-ShuffleBytes-CrossOver-ChangeByte-EraseBytes-CopyPart-ChangeBinInt-PersAutoDict-CrossOver-ShuffleBytes-CrossOver-CrossOver-EraseBytes-CrossOver-EraseBytes-CrossOver-ChangeBit-ChangeBinInt-ChangeByte-EraseBytes-ShuffleBytes-ShuffleBytes-ChangeBit-EraseBytes-ChangeBinInt-ChangeBit-ChangeBinInt-CopyPart-EraseBytes-PersAutoDict-EraseBytes-CopyPart-ChangeBinInt-ChangeByte-CrossOver-ChangeBinInt-ShuffleBytes-PersAutoDict-PersAutoDict-ChangeBinInt-CopyPart-ChangeBinInt-CrossOver-ChangeBit-ChangeBinInt-CopyPart-ChangeByte-ChangeBit-CopyPart-CrossOver-ChangeByte-ChangeBit-ChangeByte-ShuffleBytes-CMP-ChangeBit-CopyPart-ChangeBit-ChangeByte-ChangeBinInt-PersAutoDict-ChangeBinInt-CrossOver-ChangeBinInt-ChangeBit-ChangeBinInt-ChangeBinInt-PersAutoDict-ChangeBinInt-ChangeBinInt-ChangeByte-CopyPart-ShuffleBytes-ChangeByte-ChangeBit-ChangeByte-ChangeByte-EraseBytes-CrossOver-ChangeByte-ChangeByte-EraseBytes-EraseBytes-InsertRepeatedBytes-ShuffleBytes-CopyPart-CopyPart-ChangeBit-ShuffleBytes-PersAutoDict-ShuffleBytes-ChangeBit-ChangeByte-ChangeBit-ShuffleBytes-ChangeByte-ChangeBinInt-CrossOver-ChangeBinInt-ChangeBit-EraseBytes-CopyPart-ChangeByte-CrossOver-EraseBytes-CrossOver-ChangeByte-ShuffleBytes-ChangeByte-ChangeBinInt-CrossOver-ChangeByte-InsertRepeatedBytes-InsertByte-ShuffleBytes-PersAutoDict-ChangeBit-ChangeByte-ChangeBit-ShuffleBytes-ShuffleBytes-CopyPart-ShuffleBytes-EraseBytes-ShuffleBytes-ShuffleBytes-CrossOver-ChangeBinInt-CopyPart-CopyPart-CopyPart-EraseBytes-EraseBytes-ChangeByte-ChangeBinInt-ShuffleBytes-CMP-InsertByte-EraseBytes-ShuffleBytes-CopyPart-ChangeBit-CrossOver-CopyPart-CopyPart-ShuffleBytes-ChangeByte-ChangeByte-ChangeBinInt-EraseBytes-ChangeByte-ChangeBinInt-ChangeBit-ChangeBit-ChangeByte-ShuffleBytes-PersAutoDict-PersAutoDict-CMP-ChangeBit-ShuffleBytes-PersAutoDict-ChangeBinInt-EraseBytes-EraseBytes-ShuffleBytes-ChangeByte-ShuffleBytes-ChangeBit-EraseBytes-CMP-ShuffleBytes-ChangeByte-ChangeBinInt-EraseBytes-ChangeBinInt-ChangeByte-EraseBytes-ChangeByte-CrossOver-ShuffleBytes-EraseBytes-EraseBytes-ShuffleBytes-ChangeBit-EraseBytes-CopyPart-ShuffleBytes-ShuffleBytes-CrossOver-CopyPart-ChangeBinInt-ShuffleBytes-CrossOver-InsertByte-InsertByte-ChangeBinInt-ChangeBinInt-CopyPart-EraseBytes-ShuffleBytes-ChangeBit-ChangeBit-EraseBytes-ChangeByte-ChangeByte-ChangeBinInt-CrossOver-ChangeBinInt-ChangeBinInt-ShuffleBytes-ShuffleBytes-ChangeByte-ChangeByte-ChangeBinInt-ShuffleBytes-CrossOver-EraseBytes-CopyPart-CopyPart-CopyPart-ChangeBit-ShuffleBytes-ChangeByte-EraseBytes-ChangeByte-InsertRepeatedBytes-InsertByte-InsertRepeatedBytes-PersAutoDict-EraseBytes-ShuffleBytes-ChangeByte-ShuffleBytes-ChangeBinInt-ShuffleBytes-ChangeBinInt-ChangeBit-CrossOver-CrossOver-ShuffleBytes-CrossOver-CopyPart-CrossOver-CrossOver-CopyPart-ChangeByte-ChangeByte-CrossOver-ChangeBit-ChangeBinInt-EraseBytes-ShuffleBytes-EraseBytes-CMP-PersAutoDict-PersAutoDict-InsertByte-ChangeBit-ChangeByte-CopyPart-CrossOver-ChangeByte-ChangeBit-ChangeByte-CopyPart-ChangeBinInt-EraseBytes-CrossOver-ChangeBit-CrossOver-PersAutoDict-CrossOver-ChangeByte-CrossOver-ChangeByte-ChangeByte-CrossOver-ShuffleBytes-CopyPart-CopyPart-ShuffleBytes-ChangeByte-ChangeByte-ChangeBinInt-ChangeBinInt-ChangeBinInt-ChangeBinInt-ShuffleBytes-CrossOver-ChangeBinInt-ShuffleBytes-ChangeBit-PersAutoDict-ChangeBinInt-ShuffleBytes-ChangeBinInt-ChangeByte-CrossOver-ChangeBit-CopyPart-ChangeBit-ChangeBit-CopyPart-ChangeByte-PersAutoDict-ChangeBit-ShuffleBytes-ChangeByte-ChangeBit-CrossOver-ChangeByte-CrossOver-ChangeByte-CrossOver-ChangeBit-ChangeByte-ChangeBinInt-PersAutoDict-CopyPart-ChangeBinInt-ChangeBit-CrossOver-ChangeBit-PersAutoDict-ShuffleBytes-EraseBytes-CrossOver-ChangeByte-ChangeBinInt-ShuffleBytes-ChangeBinInt-InsertRepeatedBytes-PersAutoDict-CrossOver-ChangeByte-Custom-PersAutoDict-CopyPart-CopyPart-ChangeBinInt-ShuffleBytes-ChangeBinInt-ChangeBit-ShuffleBytes-CrossOver-CMP-ChangeByte-CopyPart-ShuffleBytes-CopyPart-CopyPart-CrossOver-CrossOver-CrossOver-ShuffleBytes-ChangeByte-ChangeBinInt-ChangeBit-ChangeBit-ChangeBit-ChangeByte-EraseBytes-ChangeByte-ChangeBit-ChangeByte-ChangeByte-CopyPart-PersAutoDict-ChangeBinInt-PersAutoDict-PersAutoDict-PersAutoDict-CopyPart-CopyPart-CrossOver-ChangeByte-ChangeBinInt-ShuffleBytes-ChangeBit-CopyPart-EraseBytes-CopyPart-CopyPart-CrossOver-ChangeByte-EraseBytes-ShuffleBytes-ChangeByte-CopyPart-EraseBytes-CopyPart-CrossOver-ChangeBinInt-ChangeBinInt-InsertByte-ChangeBinInt-ChangeBit-ChangeByte-CopyPart-ChangeByte-EraseBytes-ChangeByte-ChangeBit-ChangeByte-ShuffleBytes-CopyPart-ChangeBinInt-EraseBytes-CrossOver-ChangeBit-ChangeBit-CrossOver-EraseBytes-ChangeBinInt-CopyPart-CopyPart-ChangeBinInt-ChangeBit-EraseBytes-InsertRepeatedBytes-EraseBytes-ChangeBit-CrossOver-CrossOver-EraseBytes-EraseBytes-ChangeByte-CopyPart-CopyPart-ShuffleBytes-ChangeByte-ChangeBit-ChangeByte-EraseBytes-ChangeBit-ChangeByte-ChangeByte-CrossOver-CopyPart-EraseBytes-ChangeByte-EraseBytes-ChangeByte-ShuffleBytes-ShuffleBytes-ChangeByte-CopyPart-ChangeByte-ChangeByte-ChangeBit-CopyPart-ChangeBit-ChangeBinInt-CopyPart-ShuffleBytes-ChangeBit-ChangeBinInt-ChangeBit-EraseBytes-CMP-CrossOver-CopyPart-ChangeBinInt-CrossOver-CrossOver-CopyPart-CrossOver-CrossOver-InsertByte-InsertByte-CopyPart-Custom- DE: "warn"-"\x00\x00\x00\x80"-"\xfe\xff\xff\xfb"-"\xff\xff"-"\x10\x00\x00\x00"-"\xfe\xff\xff\xff"-"\xff\xff\xff\xf6"-"U\x01\x00\x00\x00\x00\x00\x00"-"\xd9\xff\xff\xff"-"\xfe\xff\xff\xea"-"\xf0\xff\xff\xff"-"\xfc\xff\xff\xff"-"warn"-"\xff\xff\xff\xff"-"\xfe\xff\xff\xfb"-"\x00\x00\x00\x80"-"\xfe\xff\xff\xf1"-"\xfe\xff\xff\xea"-"\x00\x00\x00\x00\x00\x00\x012"-"\xe2\x00"-"\xfb\xff\xff\xff"-"\x00\x00\x00\x00"-"\xe9\xff\xff\xff"-"\xff\xff"-"\x00\x00\x00\x80"-"\x01\x00\x04\xc9"-"\xf0\xff\xff\xff"-"\xf9\xff\xff\xff"-"\xff\xff\xff\xff\xff\xff\xff\x12"-"\xe2\x00"-"\xfe\xff\xff\xff"-"\xfe\xff\xff\xea"-"\xff\xff\xff\xff"-"\xf4\xff\xff\xff"-"\xe9\xff\xff\xff"-"\xf1\xff\xff\xff"- #48 NEW cov: 4502 ft: 9151 corp: 27/750Kb lim: 64000 exec/s: 2 rss: 458Mb L: 50772/50772 MS: 259 ChangeByte-ShuffleBytes-ChangeBinInt-ChangeByte-ChangeByte-ChangeByte-ChangeByte-ChangeBit-CopyPart-CrossOver-CopyPart-ChangeByte-CrossOver-CopyPart-ChangeBit-ChangeByte-EraseBytes-ChangeByte-CopyPart-CopyPart-CopyPart-ChangeBit-EraseBytes-ChangeBinInt-CrossOver-CopyPart-CrossOver-CopyPart-ChangeBit-ChangeByte-ChangeBit-InsertByte-CrossOver-InsertRepeatedBytes-InsertRepeatedBytes-InsertRepeatedBytes-ChangeBinInt-EraseBytes-InsertRepeatedBytes-InsertByte-ChangeBit-ShuffleBytes-ChangeBit-ChangeBit-CopyPart-ChangeBit-ChangeByte-CrossOver-ChangeBinInt-ChangeByte-CrossOver-CMP-ChangeByte-CrossOver-ChangeByte-ShuffleBytes-ShuffleBytes-ChangeByte-ChangeBinInt-CopyPart-EraseBytes-CrossOver-ChangeBit-ChangeBinInt-InsertByte-ChangeBit-CopyPart-ChangeBinInt-ChangeByte-CrossOver-ChangeBit-EraseBytes-CopyPart-ChangeBinInt-ChangeBit-ChangeBit-ChangeByte-CopyPart-ChangeBinInt-CrossOver-PersAutoDict-ChangeByte-ChangeBit-ChangeByte-ChangeBinInt-ChangeBinInt-EraseBytes-CopyPart-CopyPart-ChangeByte-ChangeByte-EraseBytes-PersAutoDict-CopyPart-ChangeByte-ChangeByte-EraseBytes-CrossOver-CopyPart-CopyPart-CopyPart-ChangeByte-ChangeBit-CMP-CopyPart-ChangeBinInt-ChangeBinInt-CrossOver-ChangeBit-ChangeBit-EraseBytes-ChangeByte-ShuffleBytes-ChangeBit-ChangeBinInt-CMP-InsertRepeatedBytes-CopyPart-Custom-ChangeByte-CrossOver-EraseBytes-ChangeBit-CopyPart-CrossOver-CMP-ShuffleBytes-EraseBytes-CrossOver-PersAutoDict-ChangeByte-CrossOver-CopyPart-CrossOver-CrossOver-ShuffleBytes-ChangeBinInt-CrossOver-ChangeBinInt-ShuffleBytes-PersAutoDict-ChangeByte-EraseBytes-ChangeBit-CrossOver-EraseBytes-CrossOver-ChangeBit-ChangeBinInt-EraseBytes-InsertByte-InsertRepeatedBytes-InsertByte-InsertByte-ChangeByte-ChangeBinInt-ChangeBit-CrossOver-ChangeByte-CrossOver-EraseBytes-ChangeByte-ShuffleBytes-ChangeBit-ChangeBit-ShuffleBytes-CopyPart-ChangeByte-PersAutoDict-ChangeBit-ChangeByte-InsertRepeatedBytes-CMP-CrossOver-ChangeByte-EraseBytes-ShuffleBytes-CrossOver-ShuffleBytes-ChangeBinInt-ChangeBinInt-CopyPart-PersAutoDict-ShuffleBytes-ChangeBit-CopyPart-ShuffleBytes-CopyPart-EraseBytes-ChangeByte-ChangeBit-ChangeBit-ChangeBinInt-ChangeByte-CopyPart-EraseBytes-ChangeBinInt-EraseBytes-EraseBytes-PersAutoDict-CMP-PersAutoDict-CrossOver-CrossOver-ChangeBit-CrossOver-PersAutoDict-CrossOver-CopyPart-ChangeByte-EraseBytes-ChangeByte-ShuffleBytes-ChangeByte-ChangeByte-CrossOver-ChangeBit-EraseBytes-ChangeByte-EraseBytes-ChangeBinInt-CrossOver-CrossOver-EraseBytes-ChangeBinInt-CrossOver-ChangeBit-ShuffleBytes-ChangeBit-ChangeByte-EraseBytes-ChangeBit-CrossOver-CrossOver-CrossOver-ChangeByte-ChangeBit-ShuffleBytes-ChangeBit-ChangeBit-EraseBytes-CrossOver-CrossOver-CopyPart-ShuffleBytes-ChangeByte-ChangeByte-CopyPart-CrossOver-CopyPart-CrossOver-CrossOver-EraseBytes-EraseBytes-ShuffleBytes-InsertRepeatedBytes-ChangeBit-CopyPart-Custom- DE: "\xfe\xff\xff\xfc"-"\x00\x00\x00\x00"-"F\x00"-"\xf3\xff\xff\xff"-"St9exception"-"_\x00\x00\x00"-"\xf6\xff\xff\xff"-"\xfe\xff\xff\xff"-"\x00\x00\x00\x00"-"p\x02\x00\x00\x00\x00\x00\x00"-"\xfe\xff\xff\xfb"-"\xff\xff"-"\xff\xff\xff\xff"-"\x01\x00\x00\x07"-"\xfe\xff\xff\xfe"- These are prohibitively large and of limited value in the default case (when someone is running the fuzzer, not debugging it), in my opinion. Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D86658 | 5 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[libFuzzer] make a test for exploding dfsan labels more agressive llvm-svn: 352819 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[libFuzzer] support -runs=N in the fork mode. Make sure we see one-line reports from ubsan in the fork mode. Test both llvm-svn: 358306 | 7 年前 | |
[libFuzzer] Add an option to keep initial seed inputs around. This patch adds an option "keep_seed" to keep all initial seed inputs in the corpus. Previously, only the initial seed inputs that find new coverage were added to the corpus, and all the other initial inputs were discarded. We observed in some circumstances that useful initial seed inputs are discarded as they find no new coverage, even though they contain useful fragments in them (e.g., SQLITE3 FuzzBench benchmark). This newly added option provides a way to keeping seed inputs in the corpus for those circumstances. With this patch, and with -keep_seed=1, all initial seed inputs are kept in the corpus regardless of whether they find new coverage or not. Further, these seed inputs are not replaced with smaller inputs even if -reduce_inputs=1. Differential Revision: https://reviews.llvm.org/D86577 | 5 年前 | |
[libFuzzer] simplify the DFT trace collection using the new faster DFSan mode that traces up to 16 labels at a time and never runs out of labels. Second attempt. This time with a fix for windows (putenv instead of setenv)) llvm-svn: 363445 | 7 年前 | |
[fuzzer] Reduce size of large.test This halves the size of LargeTest, dropping time to compile this file locally from 14s to 5.5s. Hopefully this will also fix the persistent timeouts in pre-merge checks. Differential Revision: https://reviews.llvm.org/D124237 | 4 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Recommit "[libFuzzer] Fix value-profile-load test." value-profile-load.test needs adjustment with a mutator change in bb54bcf84970c04c9748004f3a4cf59b0c1832a7, which reverted as of now, but will be recommitted after landing this patch. This patch makes value-profile-load.test more friendly to (and aware of) the current value profiling strategy, which is based on the hamming as well as the absolute distance. To this end, this patch adjusts the set of input values that trigger an expected crash. More specifically, this patch now uses a single value 0x01effffe as a crashing input, because this value is close to values like {0x1ffffff, 0xffffff, ...}, which are very likely to be added to the corpus per the current hamming- and absolute-distance-based value profiling strategy. Note that previously the crashing input values were {1234567 * {1, 2, ...}, s.t. < INT_MAX}. Every byte in the chosen value 0x01effeef is intentionally different; this was to make it harder to find the value without the intermediate inputs added to the corpus by the value profiling strategy. Also note that LoadTest.cpp now uses a narrower condition (Size != 8) for initial pruning of inputs, effectively preventing libFuzzer from generating inputs longer than necessary and spending time on mutating such long inputs in the corpus - a functionality not meant to be tested by this specific test. Differential Revision: https://reviews.llvm.org/D86247 | 5 年前 | |
[libFuzzer] add MagicSeparatorTest llvm-svn: 359620 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[libFuzzer] Instrument bcmp If we define memcmp in an archive, bcmp should be defined as well (many libc define bcmp/memcmp in one object file). Otherwise if the application calls bcmp or strcmp which gets optimized to bcmp (SimplifyLibCalls), the undefined reference may pull in an optimized bcmp/strcmp implementation (libc replacement) later on the linker command line. If both libFuzzer's memcmp and the optimized memcmp are strong => there will be a multiple definition error. | 5 年前 | |
[libFuzzer] Fix MSan false positives with custom mutators. We need to unpoison parameters before calling into MSan-instrumented user-defined mutators. Addresses https://github.com/google/oss-fuzz/issues/4605. Reviewed By: metzman Differential Revision: https://reviews.llvm.org/D100355 | 5 年前 | |
[libFuzzer] Unpoison parameters before calling user callback. Summary: Fixes an MSan false positive when compiling with -fsanitize=memory,fuzzer. See https://github.com/google/oss-fuzz/issues/2369 for more details. Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits, metzman, eugenis Tags: #llvm Differential Revision: https://reviews.llvm.org/D61753 llvm-svn: 360390 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[libFuzzer] ensure that DFT and autofocus works for C++ (mangled) functions llvm-svn: 363905 | 6 年前 | |
[libFuzzer] Fix fuzzer-oom.test. SinkPtr was not correctly marked as volatile, causing the malloc to get optimized out. This was causing 20-minute timeouts for the test and no OOM. | 5 年前 | |
[libFuzzer] Fix fuzzer-oom.test. SinkPtr was not correctly marked as volatile, causing the malloc to get optimized out. This was causing 20-minute timeouts for the test and no OOM. | 5 年前 | |
[libFuzzer] tests/examples for using libFuzzer for out-of-process targets [libFuzzer] tests/examples for using libFuzzer for out-of-process targets Reviewed By: kostik Differential Revision: https://reviews.llvm.org/D107498 | 4 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[libFuzzer] Extend the fuzz target intarface to allow -1 return value. With this change, fuzz targets may choose to return -1 to indicate that the input should not be added to the corpus regardless of the coverage it generated. Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D128749 | 4 年前 | |
[fuzzer] Fix reload.test on Linux/aarch64 The compiler generates a 'brk' instruction for __builtin_trap on aarch64 and Linux kernel issues a SIGTRAP. It is different from x86, where compiler emits an 'ud2' and kernel issues a SIGILL. A straightforward is to use abort instead. llvm-svn: 359126 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[libFuzzer] tests/examples for using libFuzzer for out-of-process targets [libFuzzer] tests/examples for using libFuzzer for out-of-process targets Reviewed By: kostik Differential Revision: https://reviews.llvm.org/D107498 | 4 年前 | |
[libFuzzer] teach the fork mode to ignore OOMs and timeouts llvm-svn: 353792 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[libFuzzer] Make msan.test:SimpleCmpTest succeed with less trials. Currently SimpleCmpTest passes after 9,831,994 trials on x86_64/Linux when the number of given trials is 10,000,000, just a little bigger than that. This patch modifies SimpleCmpTest.cpp so that the test passes with less trials, reducing its chances of future failures as libFuzzer evolves. More specifically, this patch changes a 32-bit equality check to a 8-bit equality check, making this test pass at 4,635,303 trials. Differential Revision: https://reviews.llvm.org/D86382 | 5 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[libFuzzer] perform more agressive value profiling in memcmp llvm-svn: 360385 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[libFuzzer] Fix stack-overflow-with-asan.test. Fix function return type and remove check for SUMMARY, since it doesn't seem to be output in Windows. | 5 年前 | |
[NFC][fuzzer] Simplify StrcmpTest.cpp The test started to consistently fail after unrelated 2ffaa9a1732c6f2af514603d25f0e8c238b3dd06. Even before the patch it was possible to fail the test, e.g. -seed=1660180256 on my workstation. Also this checks do not look related to strcmp. | 5 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Fix license headers llvm-svn: 354500 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Fix TableLookupTest on FreeBSD As with Linux placce the Counters array in the __libfuzzer_extra_counters section. This fixes the test on FreeBSD. Reviewed by: vitalybuka Differential Revision: https://reviews.llvm.org/D125902 | 4 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[libFuzzer] extend the data flow tracer to also produce basic block coverage for every input. An extended test coming in a separte change. llvm-svn: 360213 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
Update the file headers across all of the LLVM projects in the monorepo to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636 | 7 年前 | |
[fuzzer] Add Windows Visual C++ exception intercept Adds a new option, handle_winexcept to try to intercept uncaught Visual C++ exceptions on Windows. On Linux, such exceptions are handled implicitly by std::terminate() raising SIBABRT. This option brings the Windows behavior in line with Linux. Unfortunately this exception code is intentionally undocumented, however has remained stable for the last decade. More information can be found here: https://devblogs.microsoft.com/oldnewthing/20100730-00/?p=13273 Reviewed By: morehouse, metzman Differential Revision: https://reviews.llvm.org/D89755 | 5 年前 | |
[libFuzzer] Make -fsanitize=memory,fuzzer work. This patch allows libFuzzer to fuzz applications instrumented with MSan without recompiling libFuzzer with MSan instrumentation. Fixes https://github.com/google/sanitizers/issues/958. Differential Revision: https://reviews.llvm.org/D48891 llvm-svn: 336619 | 7 年前 | |
[libFuzzer] Make -fsanitize=memory,fuzzer work. This patch allows libFuzzer to fuzz applications instrumented with MSan without recompiling libFuzzer with MSan instrumentation. Fixes https://github.com/google/sanitizers/issues/958. Differential Revision: https://reviews.llvm.org/D48891 llvm-svn: 336619 | 7 年前 | |
libfuzzer: Disable broken tests for arm libfuzzer was recently enabled for Arm32 in D112091. A few tests apparently do not work with arm32 so disable them. The list of tests was obtained from https://lab.llvm.org/buildbot/#/builders/190/builds/513 Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D114312 | 4 年前 | |
Summary: Add close_fd_mask functionality to AFL driver. Summary: Add support for env var AFL_DRIVER_CLOSE_FD_MASK which behaves the same as libFuzzer's -close_fd_mask=1. Also add tests. Reviewers: kcc, vitalybuka, morehouse Reviewed By: morehouse Subscribers: #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D60334 llvm-svn: 358703 | 7 年前 | |
[libFuzzer] Enable tests on Windows Summary: Enable tests on Windows and make check-fuzzer pass on it. Make check-fuzzer pass on Windows by fixing libFuzzer, fixing tests, and by disabling tests on Windows. Most of these are disabled temporarily as support for the tests and the features they test will be added incrementally. Other tests will not be enabled since they require things that are not on Windows (eg: afl_driver tests). Every test that was explicitly disabled on Windows has a comment explaining why (unless obvious like merge-posix.test). The lit.cfg file was modified to support running tests on windows. fuzzer-dirs.test was fixed by making the Windows implementation print the same error message as the posix version. merge-control-file.test was fixed by making the test binary end with the ".exe" extension (on all platforms). Patch By: metzman Reviewers: morehouse Reviewed By: morehouse Subscribers: srhines, mgorny Differential Revision: https://reviews.llvm.org/D51549 llvm-svn: 341385 | 7 年前 | |
Summary: Add close_fd_mask functionality to AFL driver. Summary: Add support for env var AFL_DRIVER_CLOSE_FD_MASK which behaves the same as libFuzzer's -close_fd_mask=1. Also add tests. Reviewers: kcc, vitalybuka, morehouse Reviewed By: morehouse Subscribers: #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D60334 llvm-svn: 358703 | 7 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[compiler-rt][fuzzer] Disable bcmp.test on darwin It broke one of the buildbots: http://lab.llvm.org:8080/green/job/clang-stage1-RA/13026/console | 5 年前 | |
[fuzzer] Replace FuzzerExtFunctionsDlsymWin.cpp with FuzzerExtFunctionsWeakAlias.cpp Summary: Replace FuzzerExtFunctionsDlsymWin.cpp with FuzzerExtFunctionsWeakAlias.cpp to get externally defined functions (eg: LLVMFuzzerInitialize, LLVMFuzzerCustomMutator, etc) working again. Also enable tests that depended on these functions (on windows) Reviewers: rnk, morehouse Reviewed By: rnk, morehouse Subscribers: rnk, morehouse, mgorny Differential Revision: https://reviews.llvm.org/D51700 llvm-svn: 342698 | 7 年前 | |
[libFuzzer] [NFC] Split fuzzer.test into smaller tests Keeping fuzzer.test together as a gigantic test has no advantages and multiple disadvantages: - Worse test parallelization (fuzzer.test is always blocking the test run on a machine with many cores) - Debugging test failures is made more difficult (not clear what fails from fuzzer.test failing) - Makes porting tests to new platforms more difficult (whenever fuzzer.test fails have to inspect the output to figure out what is going on, and then restart all of it) - Hides dead code (in our case, "Done1000000" FileCheck variable was never used, DISABLED: not %t-UninstrumentedTest-Uninstrumented was never compiled, and there was small amount of duplication vs. simple-cmp.test) - Makes correspondence between LIT .test files and .cpp files less straightforward Differential Revision: https://reviews.llvm.org/D46557 llvm-svn: 332145 | 8 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
libfuzzer: Disable broken tests for arm libfuzzer was recently enabled for Arm32 in D112091. A few tests apparently do not work with arm32 so disable them. The list of tests was obtained from https://lab.llvm.org/buildbot/#/builders/190/builds/513 Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D114312 | 4 年前 | |
[compiler-rt][libFuzzer] Disable counters test on arm This test is either very slow or loops forever on 32 bit Arm. One of a few tests causing timeouts on our buildbots: https://lab.llvm.org/buildbot/#/builders/190/builds/513 | 4 年前 | |
[compiler-rt][SystemZ] Skip fuzzer/coverage.test This test is currently marked as XFAIL on s390x, but it is randomly passing, causing build bot issues. Setting as UNSUPPORTED for now. | 4 年前 | |
Recommit "[libFuzzer] Fix arguments of InsertPartOf/CopyPartOf calls in CrossOver mutator." The CrossOver mutator is meant to cross over two given buffers (referred to as the first/second buffer henceforth). Previously InsertPartOf/CopyPartOf calls used in the CrossOver mutator incorrectly inserted/copied part of the second buffer into a "scratch buffer" (MutateInPlaceHere of the size CurrentMaxMutationLen), rather than the first buffer. This is not intended behavior, because the scratch buffer does not always (i) contain the content of the first buffer, and (ii) have the same size as the first buffer; CurrentMaxMutationLen is typically a lot larger than the size of the first buffer. This patch fixes the issue by using the first buffer instead of the scratch buffer in InsertPartOf/CopyPartOf calls. A FuzzBench experiment was run to make sure that this change does not inadvertently degrade the performance. The performance is largely the same; more details can be found at: https://storage.googleapis.com/fuzzer-test-suite-public/fixcrossover-report/index.html This patch also adds two new tests, namely "cross_over_insert" and "cross_over_copy", which specifically target InsertPartOf and CopyPartOf, respectively. - cross_over_insert.test checks if the fuzzer can use InsertPartOf to trigger the crash. - cross_over_copy.test checks if the fuzzer can use CopyPartOf to trigger the crash. These newly added tests were designed to pass with the current patch, but not without the it (with 790878f291fa5dc58a1c560cb6cc76fd1bfd1c5a these tests do not pass). To achieve this, -max_len was intentionally given a high value. Without this patch, InsertPartOf/CopyPartOf will generate larger inputs, possibly with unpredictable data in it, thereby failing to trigger the crash. The test pass condition for these new tests is narrowed down by (i) limiting mutation depth to 1 (i.e., a single CrossOver mutation should be able to trigger the crash) and (ii) checking whether the mutation sequence of "CrossOver-" leads to the crash. Also note that these newly added tests and an existing test (cross_over.test) all use "-reduce_inputs=0" flags to prevent reducing inputs; it's easier to force the fuzzer to keep original input string this way than tweaking cov-instrumented basic blocks in the source code of the fuzzer executable. Differential Revision: https://reviews.llvm.org/D85554 | 5 年前 | |
Recommit "[libFuzzer] Fix arguments of InsertPartOf/CopyPartOf calls in CrossOver mutator." The CrossOver mutator is meant to cross over two given buffers (referred to as the first/second buffer henceforth). Previously InsertPartOf/CopyPartOf calls used in the CrossOver mutator incorrectly inserted/copied part of the second buffer into a "scratch buffer" (MutateInPlaceHere of the size CurrentMaxMutationLen), rather than the first buffer. This is not intended behavior, because the scratch buffer does not always (i) contain the content of the first buffer, and (ii) have the same size as the first buffer; CurrentMaxMutationLen is typically a lot larger than the size of the first buffer. This patch fixes the issue by using the first buffer instead of the scratch buffer in InsertPartOf/CopyPartOf calls. A FuzzBench experiment was run to make sure that this change does not inadvertently degrade the performance. The performance is largely the same; more details can be found at: https://storage.googleapis.com/fuzzer-test-suite-public/fixcrossover-report/index.html This patch also adds two new tests, namely "cross_over_insert" and "cross_over_copy", which specifically target InsertPartOf and CopyPartOf, respectively. - cross_over_insert.test checks if the fuzzer can use InsertPartOf to trigger the crash. - cross_over_copy.test checks if the fuzzer can use CopyPartOf to trigger the crash. These newly added tests were designed to pass with the current patch, but not without the it (with 790878f291fa5dc58a1c560cb6cc76fd1bfd1c5a these tests do not pass). To achieve this, -max_len was intentionally given a high value. Without this patch, InsertPartOf/CopyPartOf will generate larger inputs, possibly with unpredictable data in it, thereby failing to trigger the crash. The test pass condition for these new tests is narrowed down by (i) limiting mutation depth to 1 (i.e., a single CrossOver mutation should be able to trigger the crash) and (ii) checking whether the mutation sequence of "CrossOver-" leads to the crash. Also note that these newly added tests and an existing test (cross_over.test) all use "-reduce_inputs=0" flags to prevent reducing inputs; it's easier to force the fuzzer to keep original input string this way than tweaking cov-instrumented basic blocks in the source code of the fuzzer executable. Differential Revision: https://reviews.llvm.org/D85554 | 5 年前 | |
Recommit "[libFuzzer] Fix arguments of InsertPartOf/CopyPartOf calls in CrossOver mutator." The CrossOver mutator is meant to cross over two given buffers (referred to as the first/second buffer henceforth). Previously InsertPartOf/CopyPartOf calls used in the CrossOver mutator incorrectly inserted/copied part of the second buffer into a "scratch buffer" (MutateInPlaceHere of the size CurrentMaxMutationLen), rather than the first buffer. This is not intended behavior, because the scratch buffer does not always (i) contain the content of the first buffer, and (ii) have the same size as the first buffer; CurrentMaxMutationLen is typically a lot larger than the size of the first buffer. This patch fixes the issue by using the first buffer instead of the scratch buffer in InsertPartOf/CopyPartOf calls. A FuzzBench experiment was run to make sure that this change does not inadvertently degrade the performance. The performance is largely the same; more details can be found at: https://storage.googleapis.com/fuzzer-test-suite-public/fixcrossover-report/index.html This patch also adds two new tests, namely "cross_over_insert" and "cross_over_copy", which specifically target InsertPartOf and CopyPartOf, respectively. - cross_over_insert.test checks if the fuzzer can use InsertPartOf to trigger the crash. - cross_over_copy.test checks if the fuzzer can use CopyPartOf to trigger the crash. These newly added tests were designed to pass with the current patch, but not without the it (with 790878f291fa5dc58a1c560cb6cc76fd1bfd1c5a these tests do not pass). To achieve this, -max_len was intentionally given a high value. Without this patch, InsertPartOf/CopyPartOf will generate larger inputs, possibly with unpredictable data in it, thereby failing to trigger the crash. The test pass condition for these new tests is narrowed down by (i) limiting mutation depth to 1 (i.e., a single CrossOver mutation should be able to trigger the crash) and (ii) checking whether the mutation sequence of "CrossOver-" leads to the crash. Also note that these newly added tests and an existing test (cross_over.test) all use "-reduce_inputs=0" flags to prevent reducing inputs; it's easier to force the fuzzer to keep original input string this way than tweaking cov-instrumented basic blocks in the source code of the fuzzer executable. Differential Revision: https://reviews.llvm.org/D85554 | 5 年前 | |
[libFuzzer] Enable entropic by default. Entropic has performed at least on par with vanilla scheduling on Clusterfuzz, and has shown a slight coverage improvement on FuzzBench: https://www.fuzzbench.com/reports/2020-08-31/index.html Reviewed By: Dor1s Differential Revision: https://reviews.llvm.org/D87476 | 5 年前 | |
[libFuzzer] Disable interceptor tests on non-Linux platforms. Summary: libFuzzer's interceptor support added in 831ae45e3dc609e43ba561af07670a8fe47461ef currently only works on Linux. This patch disables the test cases added as part of that commit on non-Linux platforms. Reviewers: morehouse, hctim Subscribers: #sanitizers Tags: #sanitizers Differential Revision: https://reviews.llvm.org/D84434 | 5 年前 | |
[libFuzzer][Windows] Reenable passing tests Summary: Enable tests that were previously disabled because they didn't work on Windows. Reviewers: morehouse Reviewed By: morehouse Subscribers: morehouse Differential Revision: https://reviews.llvm.org/D57563 llvm-svn: 353000 | 7 年前 | |
Disable a dataflow fuzz test after "Have REQUIRES support the target triple" See: https://lab.llvm.org/buildbot/#/builders/75/builds/8095/steps/8/logs/stdio which shows: unsupported option '-fsanitize=dataflow' for target 'i386-unknown-linux-gnu' The other dataflow tests in the same directory were already disabled, so I think it's fine to disable this one as well. | 4 年前 | |
[libFuzzer] Update Darwin test Support for -fsanitize-coverage=trace-pc[-guard] was removed from libFuzzer, which makes this currently fail. This commit aligns this Darwin-specific test with its Linux counterpart which changed in this commit: https://github.com/llvm/llvm-project/commit/3a94519a777b9ac407a1d5ff5c31ec48b3768eec llvm-svn: 352721 | 7 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[fuzzer] Use RawPrint instead of Printf for instrumentation warning Summary: Use RawPrint instead of Printf for instrumentation warning because Printf doesn't work on Win when instrumentation is being initialized (since OutputFile is not yet initialized). Reviewers: kcc Reviewed By: kcc Differential Revision: https://reviews.llvm.org/D57531 llvm-svn: 352789 | 7 年前 | |
Move libFuzzer to compiler_rt. Resulting library binaries will be named libclang_rt.fuzzer*, and will be placed in Clang toolchain, allowing redistribution. Differential Revision: https://reviews.llvm.org/D36908 llvm-svn: 311407 | 8 年前 | |
[libFuzzer] Disable hanging tests on AArch64 Disable problematic tests which broke AArch64 bots. Details available in Bugzilla: https://bugs.llvm.org/show_bug.cgi?id=38034 Differential Revision: https://reviews.llvm.org/D49011 llvm-svn: 336446 | 7 年前 | |
[libFuzzer] Added -print_full_coverage flag. -print_full_coverage=1 produces a detailed branch coverage dump when run on a single file. Uses same infrastructure as -print_coverage flag, but prints all branches (regardless of coverage status) in an easy-to-parse format. Usage: For internal use with machine learning fuzzing models which require detailed coverage information on seed files to generate mutations. Differential Revision: https://reviews.llvm.org/D85928 | 5 年前 | |
[libFuzzer] Enable tests on Windows Summary: Enable tests on Windows and make check-fuzzer pass on it. Make check-fuzzer pass on Windows by fixing libFuzzer, fixing tests, and by disabling tests on Windows. Most of these are disabled temporarily as support for the tests and the features they test will be added incrementally. Other tests will not be enabled since they require things that are not on Windows (eg: afl_driver tests). Every test that was explicitly disabled on Windows has a comment explaining why (unless obvious like merge-posix.test). The lit.cfg file was modified to support running tests on windows. fuzzer-dirs.test was fixed by making the Windows implementation print the same error message as the posix version. merge-control-file.test was fixed by making the test binary end with the ".exe" extension (on all platforms). Patch By: metzman Reviewers: morehouse Reviewed By: morehouse Subscribers: srhines, mgorny Differential Revision: https://reviews.llvm.org/D51549 llvm-svn: 341385 | 7 年前 | |
[libFuzzer] deprecate equivalence_server llvm-svn: 332316 | 8 年前 | |
[libFuzzer] deprecate equivalence_server llvm-svn: 332316 | 8 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[compiler-rt][fuzzer] Disable 2 tests for Arm Thumb builds These tests appear to be causing timeouts on our silent Thumbv7 bot: https://lab.llvm.org/staging/#/builders/162/builds/260 It is possible they would complete given enough time. value-profile-switch seems to take a long time even on a powerful Armv8 machine. | 4 年前 | |
Enable extra coverage counters on Windows - Enable extra coverage counters on Windows. - Update extra_counters.test to run on Windows also. - Update TableLookupTest.cpp to include the required pragma/declspec for the extra coverage counters. Patch By: MichaelSquires Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D106676 | 4 年前 | |
[libFuzzer] add -features_dir= flag to dump unique input features on disk llvm-svn: 358317 | 7 年前 | |
[libFuzzer] Make dataflow and focus functions more user friendly. Summary: - Fail loudly if SetFocusFunction failed when it should not. For more info see - https://github.com/google/oss-fuzz/issues/3311 - https://github.com/google/sanitizers/issues/1190 - Fail loudly if CollectDataFlow is called without seed corpus. Reviewers: kcc, metzman Subscribers: #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D73813 | 6 年前 | |
[libFuzzer] Disable fork-sigusr.test on AArch64. Test fails on the clang-cmake-aarch64-lld build and I'm not sure why. llvm-svn: 361185 | 7 年前 | |
[libFuzzer] Increase timeouts on fork tests and skip one on aarch64 The tests fork.text, fork.sigusr.test and fork-ubsan.test intermittently fail on the aarch64 buildbots. Input gathered from the fork.sigusr.test implies that when the builder is under load the timeout value is not sufficient. The fork-ubsan.test doesn't have a timeout and I think is not always finding the error after 10000 runs so I've marked it as unsupported for now. Differential Revision: https://reviews.llvm.org/D61449 llvm-svn: 360126 | 7 年前 | |
Change filecheck default to dump input on failure Having the input dumped on failure seems like a better default: I debugged FileCheck tests for a while without knowing about this option, which really helps to understand failures. Remove -dump-input-on-failure and the environment variable FILECHECK_DUMP_INPUT_ON_FAILURE which are now obsolete. Differential Revision: https://reviews.llvm.org/D81422 | 6 年前 | |
Redistribute energy for Corpus I found that the initial corpus allocation of fork mode has certain defects. I designed a new initial corpus allocation strategy based on size grouping. This method can give more energy to the small seeds in the corpus and increase the throughput of the test. Fuzzbench data (glibfuzzer is -fork_corpus_groups=1): https://www.fuzzbench.com/reports/experimental/2021-08-05-parallel/index.html Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D105084 | 4 年前 | |
[libFuzzer] [NFC] Split fuzzer.test into smaller tests Keeping fuzzer.test together as a gigantic test has no advantages and multiple disadvantages: - Worse test parallelization (fuzzer.test is always blocking the test run on a machine with many cores) - Debugging test failures is made more difficult (not clear what fails from fuzzer.test failing) - Makes porting tests to new platforms more difficult (whenever fuzzer.test fails have to inspect the output to figure out what is going on, and then restart all of it) - Hides dead code (in our case, "Done1000000" FileCheck variable was never used, DISABLED: not %t-UninstrumentedTest-Uninstrumented was never compiled, and there was small amount of duplication vs. simple-cmp.test) - Makes correspondence between LIT .test files and .cpp files less straightforward Differential Revision: https://reviews.llvm.org/D46557 llvm-svn: 332145 | 8 年前 | |
[compiler-rt][SystemZ] Skip fuzzer/full-coverage.test This test is currently marked as XFAIL on s390x, but it is randomly passing, causing build bot issues. Setting as UNSUPPORTED for now. | 5 年前 | |
[fuzzer] Fix test checks broken after license header update llvm-svn: 351717 | 7 年前 | |
[fuzzer] Replace FuzzerExtFunctionsDlsymWin.cpp with FuzzerExtFunctionsWeakAlias.cpp Summary: Replace FuzzerExtFunctionsDlsymWin.cpp with FuzzerExtFunctionsWeakAlias.cpp to get externally defined functions (eg: LLVMFuzzerInitialize, LLVMFuzzerCustomMutator, etc) working again. Also enable tests that depended on these functions (on windows) Reviewers: rnk, morehouse Reviewed By: rnk, morehouse Subscribers: rnk, morehouse, mgorny Differential Revision: https://reviews.llvm.org/D51700 llvm-svn: 342698 | 7 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[libfuzzer] Reduce default verbosity when printing large mutation sequences When using a custom mutator (e.g. thrift mutator, similar to LPM) that calls back into libfuzzer's mutations via LLVMFuzzerMutate, the mutation sequences needed to achieve new coverage can get prohibitively large. Printing these large sequences has two downsides: 1) It makes the logs hard to understand for a human. 2) The performance cost slows down fuzzing. In this patch I change the PrintMutationSequence function to take a max number of entries, to achieve this goal. I also update PrintStatusForNewUnit to default to printing only 10 entries, in the default verbosity level (1), requiring the user to set verbosity to 2 if they want the full mutation sequence. For our use case, turning off verbosity is not an option, as that would also disable PrintStats() which is very useful for infrastructure that analyzes the logs in realtime. I imagine most users of libfuzzer always want those logs in the default. I built a fuzzer locally with this patch applied to libfuzzer. When running with the default verbosity, I see logs like this: #65 NEW cov: 4799 ft: 10443 corp: 41/1447Kb lim: 64000 exec/s: 1 rss: 575Mb L: 28658/62542 MS: 196 Custom-CrossOver-ChangeBit-EraseBytes-ChangeBit-ChangeBit-ChangeBit-CrossOver-ChangeBit-CrossOver- DE: "\xff\xff\xff\x0e"-"\xfe\xff\xff\x7f"-"\xfe\xff\xff\x7f"-"\x17\x00\x00\x00\x00\x00\x00\x00"-"\x00\x00\x00\xf9"-"\xff\xff\xff\xff"-"\xfa\xff\xff\xff"-"\xf7\xff\xff\xff"-"@\xff\xff\xff\xff\xff\xff\xff"-"E\x00"- #67 NEW cov: 4810 ft: 10462 corp: 42/1486Kb lim: 64000 exec/s: 1 rss: 577Mb L: 39823/62542 MS: 135 Custom-CopyPart-ShuffleBytes-ShuffleBytes-ChangeBit-ChangeBinInt-EraseBytes-ChangeBit-ChangeBinInt-ChangeBit- DE: "\x01\x00\x00\x00\x00\x00\x01\xf1"-"\x00\x00\x00\x07"-"\x00\x0d"-"\xfd\xff\xff\xff"-"\xfe\xff\xff\xf4"-"\xe3\xff\xff\xff"-"\xff\xff\xff\xf1"-"\xea\xff\xff\xff"-"\x00\x00\x00\xfd"-"\x01\x00\x00\x05"- Staring hard at the logs it's clear that the cap of 10 is applied. When running with verbosity level 2, the logs look like the below: #66 NEW cov: 4700 ft: 10188 corp: 37/1186Kb lim: 64000 exec/s: 2 rss: 509Mb L: 47616/61231 MS: 520 Custom-CopyPart-ChangeBinInt-ChangeBit-ChangeByte-EraseBytes-PersAutoDict-CopyPart-ShuffleBytes-ChangeBit-ShuffleBytes-CopyPart-EraseBytes-CopyPart-ChangeBinInt-CopyPart-ChangeByte-ShuffleBytes-ChangeBinInt-ShuffleBytes-ChangeBit-CMP-ShuffleBytes-ChangeBit-CrossOver-ChangeBinInt-ChangeByte-ShuffleBytes-CrossOver-EraseBytes-ChangeBinInt-InsertRepeatedBytes-PersAutoDict-InsertRepeatedBytes-InsertRepeatedBytes-CrossOver-ChangeByte-ShuffleBytes-CopyPart-ShuffleBytes-CopyPart-CrossOver-ChangeBit-ShuffleBytes-CrossOver-PersAutoDict-ChangeByte-ChangeBit-ShuffleBytes-CrossOver-ChangeByte-EraseBytes-CopyPart-ChangeBinInt-PersAutoDict-CrossOver-ShuffleBytes-CrossOver-CrossOver-EraseBytes-CrossOver-EraseBytes-CrossOver-ChangeBit-ChangeBinInt-ChangeByte-EraseBytes-ShuffleBytes-ShuffleBytes-ChangeBit-EraseBytes-ChangeBinInt-ChangeBit-ChangeBinInt-CopyPart-EraseBytes-PersAutoDict-EraseBytes-CopyPart-ChangeBinInt-ChangeByte-CrossOver-ChangeBinInt-ShuffleBytes-PersAutoDict-PersAutoDict-ChangeBinInt-CopyPart-ChangeBinInt-CrossOver-ChangeBit-ChangeBinInt-CopyPart-ChangeByte-ChangeBit-CopyPart-CrossOver-ChangeByte-ChangeBit-ChangeByte-ShuffleBytes-CMP-ChangeBit-CopyPart-ChangeBit-ChangeByte-ChangeBinInt-PersAutoDict-ChangeBinInt-CrossOver-ChangeBinInt-ChangeBit-ChangeBinInt-ChangeBinInt-PersAutoDict-ChangeBinInt-ChangeBinInt-ChangeByte-CopyPart-ShuffleBytes-ChangeByte-ChangeBit-ChangeByte-ChangeByte-EraseBytes-CrossOver-ChangeByte-ChangeByte-EraseBytes-EraseBytes-InsertRepeatedBytes-ShuffleBytes-CopyPart-CopyPart-ChangeBit-ShuffleBytes-PersAutoDict-ShuffleBytes-ChangeBit-ChangeByte-ChangeBit-ShuffleBytes-ChangeByte-ChangeBinInt-CrossOver-ChangeBinInt-ChangeBit-EraseBytes-CopyPart-ChangeByte-CrossOver-EraseBytes-CrossOver-ChangeByte-ShuffleBytes-ChangeByte-ChangeBinInt-CrossOver-ChangeByte-InsertRepeatedBytes-InsertByte-ShuffleBytes-PersAutoDict-ChangeBit-ChangeByte-ChangeBit-ShuffleBytes-ShuffleBytes-CopyPart-ShuffleBytes-EraseBytes-ShuffleBytes-ShuffleBytes-CrossOver-ChangeBinInt-CopyPart-CopyPart-CopyPart-EraseBytes-EraseBytes-ChangeByte-ChangeBinInt-ShuffleBytes-CMP-InsertByte-EraseBytes-ShuffleBytes-CopyPart-ChangeBit-CrossOver-CopyPart-CopyPart-ShuffleBytes-ChangeByte-ChangeByte-ChangeBinInt-EraseBytes-ChangeByte-ChangeBinInt-ChangeBit-ChangeBit-ChangeByte-ShuffleBytes-PersAutoDict-PersAutoDict-CMP-ChangeBit-ShuffleBytes-PersAutoDict-ChangeBinInt-EraseBytes-EraseBytes-ShuffleBytes-ChangeByte-ShuffleBytes-ChangeBit-EraseBytes-CMP-ShuffleBytes-ChangeByte-ChangeBinInt-EraseBytes-ChangeBinInt-ChangeByte-EraseBytes-ChangeByte-CrossOver-ShuffleBytes-EraseBytes-EraseBytes-ShuffleBytes-ChangeBit-EraseBytes-CopyPart-ShuffleBytes-ShuffleBytes-CrossOver-CopyPart-ChangeBinInt-ShuffleBytes-CrossOver-InsertByte-InsertByte-ChangeBinInt-ChangeBinInt-CopyPart-EraseBytes-ShuffleBytes-ChangeBit-ChangeBit-EraseBytes-ChangeByte-ChangeByte-ChangeBinInt-CrossOver-ChangeBinInt-ChangeBinInt-ShuffleBytes-ShuffleBytes-ChangeByte-ChangeByte-ChangeBinInt-ShuffleBytes-CrossOver-EraseBytes-CopyPart-CopyPart-CopyPart-ChangeBit-ShuffleBytes-ChangeByte-EraseBytes-ChangeByte-InsertRepeatedBytes-InsertByte-InsertRepeatedBytes-PersAutoDict-EraseBytes-ShuffleBytes-ChangeByte-ShuffleBytes-ChangeBinInt-ShuffleBytes-ChangeBinInt-ChangeBit-CrossOver-CrossOver-ShuffleBytes-CrossOver-CopyPart-CrossOver-CrossOver-CopyPart-ChangeByte-ChangeByte-CrossOver-ChangeBit-ChangeBinInt-EraseBytes-ShuffleBytes-EraseBytes-CMP-PersAutoDict-PersAutoDict-InsertByte-ChangeBit-ChangeByte-CopyPart-CrossOver-ChangeByte-ChangeBit-ChangeByte-CopyPart-ChangeBinInt-EraseBytes-CrossOver-ChangeBit-CrossOver-PersAutoDict-CrossOver-ChangeByte-CrossOver-ChangeByte-ChangeByte-CrossOver-ShuffleBytes-CopyPart-CopyPart-ShuffleBytes-ChangeByte-ChangeByte-ChangeBinInt-ChangeBinInt-ChangeBinInt-ChangeBinInt-ShuffleBytes-CrossOver-ChangeBinInt-ShuffleBytes-ChangeBit-PersAutoDict-ChangeBinInt-ShuffleBytes-ChangeBinInt-ChangeByte-CrossOver-ChangeBit-CopyPart-ChangeBit-ChangeBit-CopyPart-ChangeByte-PersAutoDict-ChangeBit-ShuffleBytes-ChangeByte-ChangeBit-CrossOver-ChangeByte-CrossOver-ChangeByte-CrossOver-ChangeBit-ChangeByte-ChangeBinInt-PersAutoDict-CopyPart-ChangeBinInt-ChangeBit-CrossOver-ChangeBit-PersAutoDict-ShuffleBytes-EraseBytes-CrossOver-ChangeByte-ChangeBinInt-ShuffleBytes-ChangeBinInt-InsertRepeatedBytes-PersAutoDict-CrossOver-ChangeByte-Custom-PersAutoDict-CopyPart-CopyPart-ChangeBinInt-ShuffleBytes-ChangeBinInt-ChangeBit-ShuffleBytes-CrossOver-CMP-ChangeByte-CopyPart-ShuffleBytes-CopyPart-CopyPart-CrossOver-CrossOver-CrossOver-ShuffleBytes-ChangeByte-ChangeBinInt-ChangeBit-ChangeBit-ChangeBit-ChangeByte-EraseBytes-ChangeByte-ChangeBit-ChangeByte-ChangeByte-CopyPart-PersAutoDict-ChangeBinInt-PersAutoDict-PersAutoDict-PersAutoDict-CopyPart-CopyPart-CrossOver-ChangeByte-ChangeBinInt-ShuffleBytes-ChangeBit-CopyPart-EraseBytes-CopyPart-CopyPart-CrossOver-ChangeByte-EraseBytes-ShuffleBytes-ChangeByte-CopyPart-EraseBytes-CopyPart-CrossOver-ChangeBinInt-ChangeBinInt-InsertByte-ChangeBinInt-ChangeBit-ChangeByte-CopyPart-ChangeByte-EraseBytes-ChangeByte-ChangeBit-ChangeByte-ShuffleBytes-CopyPart-ChangeBinInt-EraseBytes-CrossOver-ChangeBit-ChangeBit-CrossOver-EraseBytes-ChangeBinInt-CopyPart-CopyPart-ChangeBinInt-ChangeBit-EraseBytes-InsertRepeatedBytes-EraseBytes-ChangeBit-CrossOver-CrossOver-EraseBytes-EraseBytes-ChangeByte-CopyPart-CopyPart-ShuffleBytes-ChangeByte-ChangeBit-ChangeByte-EraseBytes-ChangeBit-ChangeByte-ChangeByte-CrossOver-CopyPart-EraseBytes-ChangeByte-EraseBytes-ChangeByte-ShuffleBytes-ShuffleBytes-ChangeByte-CopyPart-ChangeByte-ChangeByte-ChangeBit-CopyPart-ChangeBit-ChangeBinInt-CopyPart-ShuffleBytes-ChangeBit-ChangeBinInt-ChangeBit-EraseBytes-CMP-CrossOver-CopyPart-ChangeBinInt-CrossOver-CrossOver-CopyPart-CrossOver-CrossOver-InsertByte-InsertByte-CopyPart-Custom- DE: "warn"-"\x00\x00\x00\x80"-"\xfe\xff\xff\xfb"-"\xff\xff"-"\x10\x00\x00\x00"-"\xfe\xff\xff\xff"-"\xff\xff\xff\xf6"-"U\x01\x00\x00\x00\x00\x00\x00"-"\xd9\xff\xff\xff"-"\xfe\xff\xff\xea"-"\xf0\xff\xff\xff"-"\xfc\xff\xff\xff"-"warn"-"\xff\xff\xff\xff"-"\xfe\xff\xff\xfb"-"\x00\x00\x00\x80"-"\xfe\xff\xff\xf1"-"\xfe\xff\xff\xea"-"\x00\x00\x00\x00\x00\x00\x012"-"\xe2\x00"-"\xfb\xff\xff\xff"-"\x00\x00\x00\x00"-"\xe9\xff\xff\xff"-"\xff\xff"-"\x00\x00\x00\x80"-"\x01\x00\x04\xc9"-"\xf0\xff\xff\xff"-"\xf9\xff\xff\xff"-"\xff\xff\xff\xff\xff\xff\xff\x12"-"\xe2\x00"-"\xfe\xff\xff\xff"-"\xfe\xff\xff\xea"-"\xff\xff\xff\xff"-"\xf4\xff\xff\xff"-"\xe9\xff\xff\xff"-"\xf1\xff\xff\xff"- #48 NEW cov: 4502 ft: 9151 corp: 27/750Kb lim: 64000 exec/s: 2 rss: 458Mb L: 50772/50772 MS: 259 ChangeByte-ShuffleBytes-ChangeBinInt-ChangeByte-ChangeByte-ChangeByte-ChangeByte-ChangeBit-CopyPart-CrossOver-CopyPart-ChangeByte-CrossOver-CopyPart-ChangeBit-ChangeByte-EraseBytes-ChangeByte-CopyPart-CopyPart-CopyPart-ChangeBit-EraseBytes-ChangeBinInt-CrossOver-CopyPart-CrossOver-CopyPart-ChangeBit-ChangeByte-ChangeBit-InsertByte-CrossOver-InsertRepeatedBytes-InsertRepeatedBytes-InsertRepeatedBytes-ChangeBinInt-EraseBytes-InsertRepeatedBytes-InsertByte-ChangeBit-ShuffleBytes-ChangeBit-ChangeBit-CopyPart-ChangeBit-ChangeByte-CrossOver-ChangeBinInt-ChangeByte-CrossOver-CMP-ChangeByte-CrossOver-ChangeByte-ShuffleBytes-ShuffleBytes-ChangeByte-ChangeBinInt-CopyPart-EraseBytes-CrossOver-ChangeBit-ChangeBinInt-InsertByte-ChangeBit-CopyPart-ChangeBinInt-ChangeByte-CrossOver-ChangeBit-EraseBytes-CopyPart-ChangeBinInt-ChangeBit-ChangeBit-ChangeByte-CopyPart-ChangeBinInt-CrossOver-PersAutoDict-ChangeByte-ChangeBit-ChangeByte-ChangeBinInt-ChangeBinInt-EraseBytes-CopyPart-CopyPart-ChangeByte-ChangeByte-EraseBytes-PersAutoDict-CopyPart-ChangeByte-ChangeByte-EraseBytes-CrossOver-CopyPart-CopyPart-CopyPart-ChangeByte-ChangeBit-CMP-CopyPart-ChangeBinInt-ChangeBinInt-CrossOver-ChangeBit-ChangeBit-EraseBytes-ChangeByte-ShuffleBytes-ChangeBit-ChangeBinInt-CMP-InsertRepeatedBytes-CopyPart-Custom-ChangeByte-CrossOver-EraseBytes-ChangeBit-CopyPart-CrossOver-CMP-ShuffleBytes-EraseBytes-CrossOver-PersAutoDict-ChangeByte-CrossOver-CopyPart-CrossOver-CrossOver-ShuffleBytes-ChangeBinInt-CrossOver-ChangeBinInt-ShuffleBytes-PersAutoDict-ChangeByte-EraseBytes-ChangeBit-CrossOver-EraseBytes-CrossOver-ChangeBit-ChangeBinInt-EraseBytes-InsertByte-InsertRepeatedBytes-InsertByte-InsertByte-ChangeByte-ChangeBinInt-ChangeBit-CrossOver-ChangeByte-CrossOver-EraseBytes-ChangeByte-ShuffleBytes-ChangeBit-ChangeBit-ShuffleBytes-CopyPart-ChangeByte-PersAutoDict-ChangeBit-ChangeByte-InsertRepeatedBytes-CMP-CrossOver-ChangeByte-EraseBytes-ShuffleBytes-CrossOver-ShuffleBytes-ChangeBinInt-ChangeBinInt-CopyPart-PersAutoDict-ShuffleBytes-ChangeBit-CopyPart-ShuffleBytes-CopyPart-EraseBytes-ChangeByte-ChangeBit-ChangeBit-ChangeBinInt-ChangeByte-CopyPart-EraseBytes-ChangeBinInt-EraseBytes-EraseBytes-PersAutoDict-CMP-PersAutoDict-CrossOver-CrossOver-ChangeBit-CrossOver-PersAutoDict-CrossOver-CopyPart-ChangeByte-EraseBytes-ChangeByte-ShuffleBytes-ChangeByte-ChangeByte-CrossOver-ChangeBit-EraseBytes-ChangeByte-EraseBytes-ChangeBinInt-CrossOver-CrossOver-EraseBytes-ChangeBinInt-CrossOver-ChangeBit-ShuffleBytes-ChangeBit-ChangeByte-EraseBytes-ChangeBit-CrossOver-CrossOver-CrossOver-ChangeByte-ChangeBit-ShuffleBytes-ChangeBit-ChangeBit-EraseBytes-CrossOver-CrossOver-CopyPart-ShuffleBytes-ChangeByte-ChangeByte-CopyPart-CrossOver-CopyPart-CrossOver-CrossOver-EraseBytes-EraseBytes-ShuffleBytes-InsertRepeatedBytes-ChangeBit-CopyPart-Custom- DE: "\xfe\xff\xff\xfc"-"\x00\x00\x00\x00"-"F\x00"-"\xf3\xff\xff\xff"-"St9exception"-"_\x00\x00\x00"-"\xf6\xff\xff\xff"-"\xfe\xff\xff\xff"-"\x00\x00\x00\x00"-"p\x02\x00\x00\x00\x00\x00\x00"-"\xfe\xff\xff\xfb"-"\xff\xff"-"\xff\xff\xff\xff"-"\x01\x00\x00\x07"-"\xfe\xff\xff\xfe"- These are prohibitively large and of limited value in the default case (when someone is running the fuzzer, not debugging it), in my opinion. Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D86658 | 5 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[fuzzer] Create user provided fuzzer writeable directories when requested if they dont exist Currently, libFuzzer will exit with an error message if a non-existent directory is provided for any of the appropriate arguments. For cases where libFuzzer is used in a specialized embedded environment, it would be much easier to have libFuzzer create the directories for the user. This patch accommodates for this scenario by allowing the user to provide the argument -create_missing_dirs=1 which makes libFuzzer attempt to create the artifact_prefix, exact_artifact_path, features_dir and/or corpus directory if they don't already exist rather than throw an error and exit. Split off from D84808 as requested [here](https://reviews.llvm.org/D84808#2208546). Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D86733 | 5 年前 | |
[libFuzzer] [NFC] Generalize fdmask test. The ordering of stderr/stdout writes might not be guaranteed, and is irrelevant for this test. Differential Revision: https://reviews.llvm.org/D47294 llvm-svn: 333245 | 8 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[libfuzzer] Fix a test's run line r342698 removed the 'UNSUPPORTED: windows' flags from a number of fuzzer tests, however too many lines were removed from 'fuzzer-flags.test', including the run-line that generates the test binary, which breaks that test for me (and the clang-x64-ninja-win7 buildbot). This patch just re-adds that line. llvm-svn: 342720 | 7 年前 | |
[fuzzer] Fix test checks broken after license header update llvm-svn: 351717 | 7 年前 | |
[fuzzer] Fix test checks broken after license header update llvm-svn: 351717 | 7 年前 | |
[fuzzer] Fix test checks broken after license header update llvm-svn: 351717 | 7 年前 | |
[fuzzer] Fix test checks broken after license header update llvm-svn: 351717 | 7 年前 | |
[NFC][lsan][fuzzer] Relax fuzzer-leak.test With lsan we can't guarantee to catch leak on the same iteration. | 5 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[libFuzzer] Disable value-profile-cmp.test and fuzzer-oom.test on ARM64 value-profile-cmp was always flaky, and OOM fails to work in some environments. counters.test fails when vectorization is enabled, and it is more likely to kick in when compiling for ARM. Differential Revision: https://reviews.llvm.org/D54004 llvm-svn: 346193 | 7 年前 | |
Remove XFAIL: ios from test that passes in CI llvm-svn: 365253 | 6 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[libFuzzer] Set default sanitizer options in fuzzer tests Summary: Set default ASAN_OPTIONS when running libFuzzer tests. This allows us to remove special casing in code for Darwin where we usually pass abort_on_error=0 to override platform defaults for tests. A previous commit changed the code to make the tests pass: https://github.com/llvm/llvm-project/commit/7764a04af007eca68eafcf5caaea560ed05e35a9 Adapted a few tests to use %env_asan_opts= instead of directly setting the environment variable. rdar://problem/47515276 Reviewers: kcc, george.karpenkov Differential Revision: https://reviews.llvm.org/D57465 llvm-svn: 352711 | 7 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[libFuzzer] [NFC] Remaining minor fixes to support testing on devices. XFAIL's and adding %run commands. llvm-svn: 334774 | 7 年前 | |
[libFuzzer] Re-enable libFuzzer on i386 Linux and fix test Summary: Re-enable libFuzzer on i386 Linux after it was accidentally disabled. Also disable gc-sections.test on i386 since lld isn't garbage collecting properly with ASAN on i386. Reviewers: morehouse Reviewed By: morehouse Subscribers: srhines, mgorny, #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D61415 llvm-svn: 359802 | 7 年前 | |
Move libFuzzer to compiler_rt. Resulting library binaries will be named libclang_rt.fuzzer*, and will be placed in Clang toolchain, allowing redistribution. Differential Revision: https://reviews.llvm.org/D36908 llvm-svn: 311407 | 8 年前 | |
[fuzzer] Replace FuzzerExtFunctionsDlsymWin.cpp with FuzzerExtFunctionsWeakAlias.cpp Summary: Replace FuzzerExtFunctionsDlsymWin.cpp with FuzzerExtFunctionsWeakAlias.cpp to get externally defined functions (eg: LLVMFuzzerInitialize, LLVMFuzzerCustomMutator, etc) working again. Also enable tests that depended on these functions (on windows) Reviewers: rnk, morehouse Reviewed By: rnk, morehouse Subscribers: rnk, morehouse, mgorny Differential Revision: https://reviews.llvm.org/D51700 llvm-svn: 342698 | 7 年前 | |
[libFuzzer] Enable entropic by default. Entropic has performed at least on par with vanilla scheduling on Clusterfuzz, and has shown a slight coverage improvement on FuzzBench: https://www.fuzzbench.com/reports/2020-08-31/index.html Reviewed By: Dor1s Differential Revision: https://reviews.llvm.org/D87476 | 5 年前 | |
[compiler-rt] Disable fuzzer large.test when LLVM_ENABLE_EXPENSIVE_CHECKS=ON This test is timing out on Green Dragon http://green.lab.llvm.org/green/job/clang-stage1-cmake-RA-expensive/ and looks like it's not executed on other bots with expensive checks enabled http://lab.llvm.org:8011/builders/llvm-clang-x86_64-expensive-checks-ubuntu http://lab.llvm.org:8011/builders/llvm-clang-x86_64-expensive-checks-win The test times out at the C++ source file takes too long to build (2+ hours on my machine), as clang spends a lot of time in IR/MIR verifiers. Differential Revision: https://reviews.llvm.org/D70024 | 6 年前 | |
[libFuzzer] make len_control less agressive: set the initial max len to the length of the largest seed. This was the original intent, but... Now, with a test, to ensure it stays this way llvm-svn: 354191 | 7 年前 | |
[libFuzzer] Require linux for libcxx.test llvm-svn: 359223 | 7 年前 | |
[compiler-rt][fuzzer] Disable 2 tests for Arm Thumb builds These tests appear to be causing timeouts on our silent Thumbv7 bot: https://lab.llvm.org/staging/#/builders/162/builds/260 It is possible they would complete given enough time. value-profile-switch seems to take a long time even on a powerful Armv8 machine. | 4 年前 | |
[CMake] Rename TARGET_TRIPLE to LLVM_TARGET_TRIPLE This clarifies that this is an LLVM specific variable and avoids potential conflicts with other projects. Differential Revision: https://reviews.llvm.org/D119918 | 4 年前 | |
[libFuzzer] disable two tests on i386 that are causing timeouts on the bots llvm-svn: 360211 | 7 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[libFuzzer] Disable interceptor tests on non-Linux platforms. Summary: libFuzzer's interceptor support added in 831ae45e3dc609e43ba561af07670a8fe47461ef currently only works on Linux. This patch disables the test cases added as part of that commit on non-Linux platforms. Reviewers: morehouse, hctim Subscribers: #sanitizers Tags: #sanitizers Differential Revision: https://reviews.llvm.org/D84434 | 5 年前 | |
[libFuzzer] Disable noasan-memcmp64.test and bcmp.test on Windows. Summary: This patch disables (i) noasan-memcmp64.test on Windows as libFuzzer's interceptors are only supported on Linux for now, and (ii) bcmp.test as on Windows bcmp is not available in strings.h. Reviewers: morehouse, hctim, kcc Subscribers: #sanitizers Tags: #sanitizers Differential Revision: https://reviews.llvm.org/D84536 | 5 年前 | |
[libFuzzer] when doing the merge, keep track of the coveraged edges, not just features llvm-svn: 354076 | 7 年前 | |
[libFuzzer] Enable tests on Windows Summary: Enable tests on Windows and make check-fuzzer pass on it. Make check-fuzzer pass on Windows by fixing libFuzzer, fixing tests, and by disabling tests on Windows. Most of these are disabled temporarily as support for the tests and the features they test will be added incrementally. Other tests will not be enabled since they require things that are not on Windows (eg: afl_driver tests). Every test that was explicitly disabled on Windows has a comment explaining why (unless obvious like merge-posix.test). The lit.cfg file was modified to support running tests on windows. fuzzer-dirs.test was fixed by making the Windows implementation print the same error message as the posix version. merge-control-file.test was fixed by making the test binary end with the ".exe" extension (on all platforms). Patch By: metzman Reviewers: morehouse Reviewed By: morehouse Subscribers: srhines, mgorny Differential Revision: https://reviews.llvm.org/D51549 llvm-svn: 341385 | 7 年前 | |
[libFuzzer] Sleep after process exits in merge-sigusr.test. Ensure that log file has been fully updated before trying to read it. llvm-svn: 361339 | 7 年前 | |
[compiler-rt] NFC: Fix trivial typo Reviewed By: xgupta Differential Revision: https://reviews.llvm.org/D77457 | 4 年前 | |
Fix up fuzzing test on Windows. 3bd112c720dc fixed the fuzzing test on Linux, which, after https://reviews.llvm.org/D125933, has one less branch. Turns out, on Windows, that it still has the extra branch. I'm guessing that's because exit() isn't known to be noreturn on Windows or something. Either way, just make the test more tolerant. | 4 年前 | |
[libFuzzer][Windows] Reenable passing tests Summary: Enable tests that were previously disabled because they didn't work on Windows. Reviewers: morehouse Reviewed By: morehouse Subscribers: morehouse Differential Revision: https://reviews.llvm.org/D57563 llvm-svn: 353000 | 7 年前 | |
[libFuzzer] Fix minimizing timeouts When one tries to minimize timeouts using -minimize_crash=1, minimization immediately fails. The following sequence of events is responsible for this: [parent] SIGALRM occurs [parent] read() returns -EINTR (or -ERESTARTSYS according to strace) [parent] fgets() returns NULL [parent] ExecuteCommand() closes child's stdout and returns [child ] SIGALRM occurs [child ] AlarmCallback() attempts to write "ALARM: ..." to stdout [child ] Dies with SIGPIPE without calling DumpCurrentUnit() [parent] Does not see -exact_artifact_path and exits When minimizing, the timer in parent is not necessary, so fix by not setting it in this case. Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D85359 | 5 年前 | |
[libFuzzer][Windows] Reenable passing tests Summary: Enable tests that were previously disabled because they didn't work on Windows. Reviewers: morehouse Reviewed By: morehouse Subscribers: morehouse Differential Revision: https://reviews.llvm.org/D57563 llvm-svn: 353000 | 7 年前 | |
libfuzzer: Disable broken tests for arm libfuzzer was recently enabled for Arm32 in D112091. A few tests apparently do not work with arm32 so disable them. The list of tests was obtained from https://lab.llvm.org/buildbot/#/builders/190/builds/513 Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D114312 | 4 年前 | |
libfuzzer: Disable broken tests for arm libfuzzer was recently enabled for Arm32 in D112091. A few tests apparently do not work with arm32 so disable them. The list of tests was obtained from https://lab.llvm.org/buildbot/#/builders/190/builds/513 Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D114312 | 4 年前 | |
[msan] Set poison_in_dtor=1 by default It's still disabled by default at compile time. Reviewed By: kstoimenov Differential Revision: https://reviews.llvm.org/D123875 | 4 年前 | |
[libFuzzer] Add a command-line option for tracing mutation of corpus inputs in the dot graph format. This patch adds a new command-line option -mutation_graph_file=FILE for debugging purposes, which traces how corpus inputs evolve during a fuzzing run. For each new input that is added to the corpus, a new vertex corresponding to the added input, as well as a new edge that connects its base input to itself are written to the given file. Each vertex is labeled with the filename of the input, and each edge is labeled with the mutation sequence that led to the input w.r.t. its base input. The format of the mutation graph file is the dot file format. Once prepended and appended with "graph {" and "}", respectively, the graph becomes a valid dot file and can be visualized. Differential Revision: https://reviews.llvm.org/D86560 | 5 年前 | |
Recommit "[libFuzzer] Disable implicit builtin knowledge about memcmp-like functions when -fsanitize=fuzzer-no-link is given." Summary: This patch disables implicit builtin knowledge about memcmp-like functions when compiling the program for fuzzing, i.e., when -fsanitize=fuzzer(-no-link) is given. This allows libFuzzer to always intercept memcmp-like functions as it effectively disables optimizing calls to such functions into different forms. This is done by adding a set of flags (-fno-builtin-memcmp and others) in the clang driver. Individual -fno-builtin-* flags previously used in several libFuzzer tests are now removed, as it is now done automatically in the clang driver. The patch was once reverted in 8ef9e2bf355d05bc81d8b0fe1e5333eec59a0a91, as this patch was dependent on a reverted commit f78d9fceea736d431e9e3cbca291e3909e3aa46d. This reverted commit was recommitted in 831ae45e3dc609e43ba561af07670a8fe47461ef, so relanding this dependent patch too. Reviewers: morehouse, hctim Subscribers: cfe-commits, #sanitizers Tags: #clang, #sanitizers Differential Revision: https://reviews.llvm.org/D83987 | 5 年前 | |
Recommit "[libFuzzer] Disable implicit builtin knowledge about memcmp-like functions when -fsanitize=fuzzer-no-link is given." Summary: This patch disables implicit builtin knowledge about memcmp-like functions when compiling the program for fuzzing, i.e., when -fsanitize=fuzzer(-no-link) is given. This allows libFuzzer to always intercept memcmp-like functions as it effectively disables optimizing calls to such functions into different forms. This is done by adding a set of flags (-fno-builtin-memcmp and others) in the clang driver. Individual -fno-builtin-* flags previously used in several libFuzzer tests are now removed, as it is now done automatically in the clang driver. The patch was once reverted in 8ef9e2bf355d05bc81d8b0fe1e5333eec59a0a91, as this patch was dependent on a reverted commit f78d9fceea736d431e9e3cbca291e3909e3aa46d. This reverted commit was recommitted in 831ae45e3dc609e43ba561af07670a8fe47461ef, so relanding this dependent patch too. Reviewers: morehouse, hctim Subscribers: cfe-commits, #sanitizers Tags: #clang, #sanitizers Differential Revision: https://reviews.llvm.org/D83987 | 5 年前 | |
Recommit "[libFuzzer] Disable implicit builtin knowledge about memcmp-like functions when -fsanitize=fuzzer-no-link is given." Summary: This patch disables implicit builtin knowledge about memcmp-like functions when compiling the program for fuzzing, i.e., when -fsanitize=fuzzer(-no-link) is given. This allows libFuzzer to always intercept memcmp-like functions as it effectively disables optimizing calls to such functions into different forms. This is done by adding a set of flags (-fno-builtin-memcmp and others) in the clang driver. Individual -fno-builtin-* flags previously used in several libFuzzer tests are now removed, as it is now done automatically in the clang driver. The patch was once reverted in 8ef9e2bf355d05bc81d8b0fe1e5333eec59a0a91, as this patch was dependent on a reverted commit f78d9fceea736d431e9e3cbca291e3909e3aa46d. This reverted commit was recommitted in 831ae45e3dc609e43ba561af07670a8fe47461ef, so relanding this dependent patch too. Reviewers: morehouse, hctim Subscribers: cfe-commits, #sanitizers Tags: #clang, #sanitizers Differential Revision: https://reviews.llvm.org/D83987 | 5 年前 | |
Recommit "[libFuzzer] Disable implicit builtin knowledge about memcmp-like functions when -fsanitize=fuzzer-no-link is given." Summary: This patch disables implicit builtin knowledge about memcmp-like functions when compiling the program for fuzzing, i.e., when -fsanitize=fuzzer(-no-link) is given. This allows libFuzzer to always intercept memcmp-like functions as it effectively disables optimizing calls to such functions into different forms. This is done by adding a set of flags (-fno-builtin-memcmp and others) in the clang driver. Individual -fno-builtin-* flags previously used in several libFuzzer tests are now removed, as it is now done automatically in the clang driver. The patch was once reverted in 8ef9e2bf355d05bc81d8b0fe1e5333eec59a0a91, as this patch was dependent on a reverted commit f78d9fceea736d431e9e3cbca291e3909e3aa46d. This reverted commit was recommitted in 831ae45e3dc609e43ba561af07670a8fe47461ef, so relanding this dependent patch too. Reviewers: morehouse, hctim Subscribers: cfe-commits, #sanitizers Tags: #clang, #sanitizers Differential Revision: https://reviews.llvm.org/D83987 | 5 年前 | |
Recommit "[libFuzzer] Disable implicit builtin knowledge about memcmp-like functions when -fsanitize=fuzzer-no-link is given." Summary: This patch disables implicit builtin knowledge about memcmp-like functions when compiling the program for fuzzing, i.e., when -fsanitize=fuzzer(-no-link) is given. This allows libFuzzer to always intercept memcmp-like functions as it effectively disables optimizing calls to such functions into different forms. This is done by adding a set of flags (-fno-builtin-memcmp and others) in the clang driver. Individual -fno-builtin-* flags previously used in several libFuzzer tests are now removed, as it is now done automatically in the clang driver. The patch was once reverted in 8ef9e2bf355d05bc81d8b0fe1e5333eec59a0a91, as this patch was dependent on a reverted commit f78d9fceea736d431e9e3cbca291e3909e3aa46d. This reverted commit was recommitted in 831ae45e3dc609e43ba561af07670a8fe47461ef, so relanding this dependent patch too. Reviewers: morehouse, hctim Subscribers: cfe-commits, #sanitizers Tags: #clang, #sanitizers Differential Revision: https://reviews.llvm.org/D83987 | 5 年前 | |
Recommit "[libFuzzer] Disable implicit builtin knowledge about memcmp-like functions when -fsanitize=fuzzer-no-link is given." Summary: This patch disables implicit builtin knowledge about memcmp-like functions when compiling the program for fuzzing, i.e., when -fsanitize=fuzzer(-no-link) is given. This allows libFuzzer to always intercept memcmp-like functions as it effectively disables optimizing calls to such functions into different forms. This is done by adding a set of flags (-fno-builtin-memcmp and others) in the clang driver. Individual -fno-builtin-* flags previously used in several libFuzzer tests are now removed, as it is now done automatically in the clang driver. The patch was once reverted in 8ef9e2bf355d05bc81d8b0fe1e5333eec59a0a91, as this patch was dependent on a reverted commit f78d9fceea736d431e9e3cbca291e3909e3aa46d. This reverted commit was recommitted in 831ae45e3dc609e43ba561af07670a8fe47461ef, so relanding this dependent patch too. Reviewers: morehouse, hctim Subscribers: cfe-commits, #sanitizers Tags: #clang, #sanitizers Differential Revision: https://reviews.llvm.org/D83987 | 5 年前 | |
[libFuzzer] Extend the fuzz target intarface to allow -1 return value. With this change, fuzz targets may choose to return -1 to indicate that the input should not be added to the corpus regardless of the coverage it generated. Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D128749 | 4 年前 | |
[libFuzzer][Windows] Reenable passing tests Summary: Enable tests that were previously disabled because they didn't work on Windows. Reviewers: morehouse Reviewed By: morehouse Subscribers: morehouse Differential Revision: https://reviews.llvm.org/D57563 llvm-svn: 353000 | 7 年前 | |
[libFuzzer][Windows] Reenable passing tests Summary: Enable tests that were previously disabled because they didn't work on Windows. Reviewers: morehouse Reviewed By: morehouse Subscribers: morehouse Differential Revision: https://reviews.llvm.org/D57563 llvm-svn: 353000 | 7 年前 | |
[libfuzzer] Disable failing DFSan-related tests These have been broken by https://reviews.llvm.org/D104494. However, lib/fuzzer/dataflow/ is unused (?) so addressing this is not a priority. Added TODOs to re-enable them in the future. Reviewed By: stephan.yichao.zhao Differential Revision: https://reviews.llvm.org/D104568 | 5 年前 | |
[libfuzzer] Disable failing DFSan-related tests These have been broken by https://reviews.llvm.org/D104494. However, lib/fuzzer/dataflow/ is unused (?) so addressing this is not a priority. Added TODOs to re-enable them in the future. Reviewed By: stephan.yichao.zhao Differential Revision: https://reviews.llvm.org/D104568 | 5 年前 | |
[libFuzzer] tests/examples for using libFuzzer for out-of-process targets [libFuzzer] tests/examples for using libFuzzer for out-of-process targets Reviewed By: kostik Differential Revision: https://reviews.llvm.org/D107498 | 4 年前 | |
[libFuzzer] [NFC] Fix grammar error with "it's" llvm-svn: 372937 | 6 年前 | |
[libFuzzer] Mark several tests UNSUPPORTED for aarch64. Now that check-fuzzer runs as part of check-all, some aarch64 bots had tests failing. llvm-svn: 335639 | 7 年前 | |
[fuzzer] Read files as binary Summary: Read corpus files as binary to avoid automatic conversions Reviewers: Dor1s, morehouse Reviewed By: Dor1s, morehouse Differential Revision: https://reviews.llvm.org/D54180 llvm-svn: 346279 | 7 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[libFuzzer] [Tests] [NFC] Change seed for reduce_inputs.test Differential Revision: https://reviews.llvm.org/D48686 llvm-svn: 335802 | 7 年前 | |
[libFuzzer] Extend the fuzz target intarface to allow -1 return value. With this change, fuzz targets may choose to return -1 to indicate that the input should not be added to the corpus regardless of the coverage it generated. Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D128749 | 4 年前 | |
Use binary write mode in WriteToFile function to avoid appended \r characters on Windows Summary: When using libfuzzer on Windows, in the contents of a crash sample, bytes that can be mistaken for a \n are replaced by a \r\n sequence. As a consequence, crashes are not reproducible. This patch will open files in binary mode to fix this issue. The patch does not affect POSIX systems. Patch by tuktuk Reviewers: kcc, vitalybuka Reviewed By: vitalybuka Subscribers: dexonsmith, jdoerfert, llvm-commits, #sanitizers Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D60008 llvm-svn: 357807 | 7 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
Revert "[TSan] Attempt to fix iOS on-device test" This reverts commit a2ca358291a3a621bfae66eeb01f51eeb69d2dd4. llvm-svn: 365375 | 6 年前 | |
Greedy set cover implementation of Merger::Merge Extend the existing single-pass algorithm for Merger::Merge with an algorithm that gives better results. This new implementation can be used with a new **set_cover_merge=1** flag. This greedy set cover implementation gives a substantially smaller final corpus (40%-80% less testcases) while preserving the same features/coverage. At the same time, the execution time penalty is not that significant (+50% for ~1M corpus files and far less for smaller corpora). These results were obtained by comparing several targets with varying size corpora. Change Merger::CrashResistantMergeInternalStep to collect all features from each file and not just unique ones. This is needed for the set cover algorithm to work correctly. The implementation of the algorithm in Merger::SetCoverMerge uses a bitvector to store features that are covered by a file while performing the pass. Collisions while indexing the bitvector are ignored similarly to the fuzzer. Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D105284 | 4 年前 | |
[libFuzzer] Increase the iteration limit in shrink.test After https://reviews.llvm.org/D48800, shrink.test started failing on x86_64h architecture. Looking into this, the optimization pass is too eager to unroll the loop on x86_64h, possibly leading to worse coverage data. Alternative solutions include not unrolling the loop when fuzzing, or disabling this test on that architecture. Differential Revision: https://reviews.llvm.org/D50484 llvm-svn: 339303 | 7 年前 | |
libfuzzer: Disable broken tests for arm libfuzzer was recently enabled for Arm32 in D112091. A few tests apparently do not work with arm32 so disable them. The list of tests was obtained from https://lab.llvm.org/buildbot/#/builders/190/builds/513 Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D114312 | 4 年前 | |
[libFuzzer] Enable tests on Windows Summary: Enable tests on Windows and make check-fuzzer pass on it. Make check-fuzzer pass on Windows by fixing libFuzzer, fixing tests, and by disabling tests on Windows. Most of these are disabled temporarily as support for the tests and the features they test will be added incrementally. Other tests will not be enabled since they require things that are not on Windows (eg: afl_driver tests). Every test that was explicitly disabled on Windows has a comment explaining why (unless obvious like merge-posix.test). The lit.cfg file was modified to support running tests on windows. fuzzer-dirs.test was fixed by making the Windows implementation print the same error message as the posix version. merge-control-file.test was fixed by making the test binary end with the ".exe" extension (on all platforms). Patch By: metzman Reviewers: morehouse Reviewed By: morehouse Subscribers: srhines, mgorny Differential Revision: https://reviews.llvm.org/D51549 llvm-svn: 341385 | 7 年前 | |
[libFuzzer] extend the data flow tracer to also produce basic block coverage for every input. An extended test coming in a separte change. llvm-svn: 360213 | 7 年前 | |
[libFuzzer] run the -fork=1 tests only on linux llvm-svn: 353777 | 7 年前 | |
[libFuzzer] Fix stack-overflow-with-asan.test. Fix function return type and remove check for SUMMARY, since it doesn't seem to be output in Windows. | 5 年前 | |
[fuzzer] Replace FuzzerExtFunctionsDlsymWin.cpp with FuzzerExtFunctionsWeakAlias.cpp Summary: Replace FuzzerExtFunctionsDlsymWin.cpp with FuzzerExtFunctionsWeakAlias.cpp to get externally defined functions (eg: LLVMFuzzerInitialize, LLVMFuzzerCustomMutator, etc) working again. Also enable tests that depended on these functions (on windows) Reviewers: rnk, morehouse Reviewed By: rnk, morehouse Subscribers: rnk, morehouse, mgorny Differential Revision: https://reviews.llvm.org/D51700 llvm-svn: 342698 | 7 年前 | |
[libFuzzer] Disable interceptor tests on non-Linux platforms. Summary: libFuzzer's interceptor support added in 831ae45e3dc609e43ba561af07670a8fe47461ef currently only works on Linux. This patch disables the test cases added as part of that commit on non-Linux platforms. Reviewers: morehouse, hctim Subscribers: #sanitizers Tags: #sanitizers Differential Revision: https://reviews.llvm.org/D84434 | 5 年前 | |
[libFuzzer] Set default sanitizer options in fuzzer tests Summary: Set default ASAN_OPTIONS when running libFuzzer tests. This allows us to remove special casing in code for Darwin where we usually pass abort_on_error=0 to override platform defaults for tests. A previous commit changed the code to make the tests pass: https://github.com/llvm/llvm-project/commit/7764a04af007eca68eafcf5caaea560ed05e35a9 Adapted a few tests to use %env_asan_opts= instead of directly setting the environment variable. rdar://problem/47515276 Reviewers: kcc, george.karpenkov Differential Revision: https://reviews.llvm.org/D57465 llvm-svn: 352711 | 7 年前 | |
[libFuzzer] Disable interceptor tests on non-Linux platforms. Summary: libFuzzer's interceptor support added in 831ae45e3dc609e43ba561af07670a8fe47461ef currently only works on Linux. This patch disables the test cases added as part of that commit on non-Linux platforms. Reviewers: morehouse, hctim Subscribers: #sanitizers Tags: #sanitizers Differential Revision: https://reviews.llvm.org/D84434 | 5 年前 | |
[libFuzzer] Disable interceptor tests on non-Linux platforms. Summary: libFuzzer's interceptor support added in 831ae45e3dc609e43ba561af07670a8fe47461ef currently only works on Linux. This patch disables the test cases added as part of that commit on non-Linux platforms. Reviewers: morehouse, hctim Subscribers: #sanitizers Tags: #sanitizers Differential Revision: https://reviews.llvm.org/D84434 | 5 年前 | |
[SanitizerCoverage] Use zeroext for cmp parameters on all targets Commit 9385aaa84851 ("[sancov] Fix PR33732") added zeroext to __sanitizer_cov_trace(_const)?_cmp[1248] parameters for x86_64 only, however, it is useful on other targets, in particular, on SystemZ: it fixes swap-cmp.test. Therefore, use it on all targets. This is safe: if target ABI does not require zero extension for a particular parameter, zeroext is simply ignored. A similar change has been implemeted as part of commit 3bc439bdff8b ("[MSan] Add instrumentation for SystemZ"), and there were no problems with it. Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D85689 | 5 年前 | |
Enable symbolize-deadlock.test on Windows Summary: Remove unneeded #include of <unistd.h> from SymbolizeDeadlock.cpp to enable compilation on Windows and enable symbolize-deadlock.test on Windows. Patch by Jonathan Metzman (@metzman). Reviewers: Dor1s Reviewed By: Dor1s Subscribers: kcc, delcypher, llvm-commits, #sanitizers Differential Revision: https://reviews.llvm.org/D51685 llvm-svn: 341473 | 7 年前 | |
[libFuzzer] relax a flaky test llvm-svn: 352778 | 7 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
fix broken test llvm-svn: 359590 | 7 年前 | |
[Fuzzer][Test] Use %python substitution for trace-malloc-unbalanced.test This test was found to fail for some of our downstream builds, on computers where python was not on the default $PATH. Therefore add a %python substitution to use sys.executable, based on similar solutions for python calls in tests elsewhere in LLVM. Differential Revision: https://reviews.llvm.org/D96799 | 5 年前 | |
[libFuzzer] [NFC] Prefix all run lines with %run This patch does not do anything, but paves the way for future changes, where %run command will be expanded into a script performing the testing on device. Differential Revision: https://reviews.llvm.org/D46553 llvm-svn: 332144 | 8 年前 | |
[libFuzzer] Enable tests on Windows Summary: Enable tests on Windows and make check-fuzzer pass on it. Make check-fuzzer pass on Windows by fixing libFuzzer, fixing tests, and by disabling tests on Windows. Most of these are disabled temporarily as support for the tests and the features they test will be added incrementally. Other tests will not be enabled since they require things that are not on Windows (eg: afl_driver tests). Every test that was explicitly disabled on Windows has a comment explaining why (unless obvious like merge-posix.test). The lit.cfg file was modified to support running tests on windows. fuzzer-dirs.test was fixed by making the Windows implementation print the same error message as the posix version. merge-control-file.test was fixed by making the test binary end with the ".exe" extension (on all platforms). Patch By: metzman Reviewers: morehouse Reviewed By: morehouse Subscribers: srhines, mgorny Differential Revision: https://reviews.llvm.org/D51549 llvm-svn: 341385 | 7 年前 | |
[fuzzer] Disable uncaught-exception on non-Win+undo bad fix Test is failing on non-Windows platforms. Also undo speculative fix since it causes failures on Windows. | 5 年前 | |
[libFuzzer][Windows] Reenable passing tests Summary: Enable tests that were previously disabled because they didn't work on Windows. Reviewers: morehouse Reviewed By: morehouse Subscribers: morehouse Differential Revision: https://reviews.llvm.org/D57563 llvm-svn: 353000 | 7 年前 | |
[libFuzzer][Windows] Temporarily disable value-profile-cmp2.test on Win Summary: Temporarily disable value-profile-cmp2.test on Win. https://reviews.llvm.org/D57465 causes the test to fail on Win. However, it seems that the behavior of libFuzzer on Win was broken before that patch. It crashes in the exit handler when not used with ASAN. Prior to the patch, the crash handler would run, tricking the test into thinking libFuzzer on Win had exited properly. Reviewers: morehouse, vitalybuka Reviewed By: morehouse Subscribers: yln Differential Revision: https://reviews.llvm.org/D57551 llvm-svn: 352815 | 7 年前 | |
[libFuzzer] Disable value profiling tests on ARM Some seem fragile, some fail, and some just take a really long time to run. It does not seem to make sense to support some subset of value profiling tests. Differential Revision: https://reviews.llvm.org/D53047 llvm-svn: 344105 | 7 年前 | |
[libFuzzer][Windows] Reenable passing tests Summary: Enable tests that were previously disabled because they didn't work on Windows. Reviewers: morehouse Reviewed By: morehouse Subscribers: morehouse Differential Revision: https://reviews.llvm.org/D57563 llvm-svn: 353000 | 7 年前 | |
libfuzzer: Disable broken tests for arm libfuzzer was recently enabled for Arm32 in D112091. A few tests apparently do not work with arm32 so disable them. The list of tests was obtained from https://lab.llvm.org/buildbot/#/builders/190/builds/513 Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D114312 | 4 年前 | |
Recommit "[libFuzzer] Fix value-profile-load test." value-profile-load.test needs adjustment with a mutator change in bb54bcf84970c04c9748004f3a4cf59b0c1832a7, which reverted as of now, but will be recommitted after landing this patch. This patch makes value-profile-load.test more friendly to (and aware of) the current value profiling strategy, which is based on the hamming as well as the absolute distance. To this end, this patch adjusts the set of input values that trigger an expected crash. More specifically, this patch now uses a single value 0x01effffe as a crashing input, because this value is close to values like {0x1ffffff, 0xffffff, ...}, which are very likely to be added to the corpus per the current hamming- and absolute-distance-based value profiling strategy. Note that previously the crashing input values were {1234567 * {1, 2, ...}, s.t. < INT_MAX}. Every byte in the chosen value 0x01effeef is intentionally different; this was to make it harder to find the value without the intermediate inputs added to the corpus by the value profiling strategy. Also note that LoadTest.cpp now uses a narrower condition (Size != 8) for initial pruning of inputs, effectively preventing libFuzzer from generating inputs longer than necessary and spending time on mutating such long inputs in the corpus - a functionality not meant to be tested by this specific test. Differential Revision: https://reviews.llvm.org/D86247 | 5 年前 | |
[libFuzzer] simplify value-profile-mem.test a little bit llvm-svn: 360372 | 7 年前 | |
[libFuzzer] Disable value profiling tests on ARM Some seem fragile, some fail, and some just take a really long time to run. It does not seem to make sense to support some subset of value profiling tests. Differential Revision: https://reviews.llvm.org/D53047 llvm-svn: 344105 | 7 年前 | |
[libFuzzer] Disable value profiling tests on ARM Some seem fragile, some fail, and some just take a really long time to run. It does not seem to make sense to support some subset of value profiling tests. Differential Revision: https://reviews.llvm.org/D53047 llvm-svn: 344105 | 7 年前 | |
[libFuzzer] Disable value-profile-strncmp.test on aarch64. Test no longer finds the BINGO on clang-cmake-aarch64-full bot, and I can't reproduce on our ARM machine. llvm-svn: 342255 | 7 年前 | |
[compiler-rt][fuzzer] Disable 2 tests for Arm Thumb builds These tests appear to be causing timeouts on our silent Thumbv7 bot: https://lab.llvm.org/staging/#/builders/162/builds/260 It is possible they would complete given enough time. value-profile-switch seems to take a long time even on a powerful Armv8 machine. | 4 年前 | |
Use clang driver for libfuzzer tests on Windows Summary: There's no real reason to use clang-cl on Windows, the clang driver works just as well. This fixes a test which uses the -O0 flag, which was recently removed from clang-cl to match MSVC, which lacks this flag. While I'm here, remove the explicit -std=c++11 flag. Previously, this flag was necessary when the default C++ standard was C++98. Now that the default is C++14, this is no longer necessary. It's problematic on Windows, because the Visual C++ standard library relies on C++14 features, and attempting to compile it with C++11 results in errors. Rather than adding logic to conditionally set the standard to C++11 only on non-Win, this flag can be removed. See http://lab.llvm.org:8011/builders/clang-x64-windows-msvc and https://reviews.llvm.org/D64506. Reviewers: morehouse, thakis Subscribers: #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D64587 llvm-svn: 365841 | 6 年前 |