Lines Matching +full:auto +full:- +full:string +full:- +full:detection
1 //===- FuzzerLoop.cpp - Fuzzer's main loop --------------------------------===//
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 //===----------------------------------------------------------------------===//
48 // Leak detection is expensive, so we first check if there were more mallocs
52 this->TraceLevel = TraceLevel;
100 F->HandleMalloc(size);
128 Printf("==%d== ERROR: libFuzzer: out-of-memory (malloc(%zd))\n", GetPid(),
130 Printf(" To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
132 DumpCurrentUnit("oom-");
133 Printf("SUMMARY: libFuzzer: out-of-memory\n");
141 if (EF->__sanitizer_set_death_callback)
142 EF->__sanitizer_set_death_callback(StaticDeathCallback);
147 if (Options.DetectLeaks && EF->__sanitizer_install_malloc_and_free_hooks)
148 EF->__sanitizer_install_malloc_and_free_hooks(MallocHook, FreeHook);
171 F->DeathCallback();
191 DumpCurrentUnit("crash-");
197 F->AlarmCallback();
202 F->CrashCallback();
207 F->ExitCallback();
212 F->InterruptCallback();
217 F->GracefulExitRequested = true;
227 if (EF->__sanitizer_acquire_crash_state &&
228 !EF->__sanitizer_acquire_crash_state())
236 DumpCurrentUnit("crash-");
244 if (EF->__sanitizer_acquire_crash_state &&
245 !EF->__sanitizer_acquire_crash_state())
250 DumpCurrentUnit("crash-");
256 if (!F->GracefulExitRequested) return;
259 F->PrintFinalStats();
265 return F->Options.InterruptExitCode;
273 // Stop right now, don't perform any at-exit actions.
289 duration_cast<seconds>(system_clock::now() - UnitStartTime).count();
295 if (EF->__sanitizer_acquire_crash_state &&
296 !EF->__sanitizer_acquire_crash_state())
299 Printf(" and the timeout value is %d (use -timeout=N to change)\n",
301 DumpCurrentUnit("timeout-");
312 if (EF->__sanitizer_acquire_crash_state &&
313 !EF->__sanitizer_acquire_crash_state())
315 Printf("==%lu== ERROR: libFuzzer: out-of-memory (used: %zdMb; limit: %dMb)\n",
317 Printf(" To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
319 DumpCurrentUnit("oom-");
320 Printf("SUMMARY: libFuzzer: out-of-memory\n");
376 assert(this->MaxInputLen == 0); // Can only reset MaxInputLen from 0 to non-0.
378 this->MaxInputLen = MaxInputLen;
379 this->MaxMutationLen = MaxInputLen;
381 Printf("INFO: -max_len is not provided; "
388 this->MaxMutationLen = MaxMutationLen;
393 static auto *PCsSet = new std::set<uintptr_t>;
394 auto HandlePC = [&](const TracePC::PCTableEntry *TE) {
395 if (!PCsSet->insert(TE->PC).second)
397 std::string Descr = DescribePC("%F %L", TE->PC + 1);
398 if (Descr.find(Options.ExitOnSrcPos) != std::string::npos) {
419 std::vector<std::string> AdditionalCorpusPaths;
429 auto &U = AdditionalCorpus[i];
446 auto TimeOfUnit =
447 duration_cast<seconds>(UnitStopTime - UnitStartTime).count();
448 if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) &&
451 auto Threshhold =
456 WriteUnitToFileWithPrefix({Data, Data + Size}, "slow-unit-");
460 static void WriteFeatureSetToFile(const std::string &FeaturesDir,
461 const std::string &FileName,
469 static void RenameFeatureSetFile(const std::string &FeaturesDir,
470 const std::string &OldFile,
471 const std::string &NewFile) {
477 static void WriteEdgeToMutationGraphFile(const std::string &MutationGraphFile,
480 const std::string &MS) {
484 std::string Sha1 = Sha1ToString(II->Sha1);
486 std::string OutputString;
495 std::string BaseSha1 = Sha1ToString(BaseII->Sha1);
498 OutputString.append("\" -> \"");
517 auto TimeOfUnit = duration_cast<microseconds>(UnitStopTime - UnitStartTime);
527 if (Options.ReduceInputs && II && !II->NeverReduce)
528 if (std::binary_search(II->UniqFeatureSet.begin(),
529 II->UniqFeatureSet.end(), Feature))
535 size_t NumNewFeatures = Corpus.NumFeatureUpdates() - NumUpdatesBefore;
538 auto NewII =
542 WriteFeatureSetToFile(Options.FeaturesDir, Sha1ToString(NewII->Sha1),
543 NewII->UniqFeatureSet);
549 II->DataFlowTraceForFocusFunction.empty() &&
550 FoundUniqFeaturesOfII == II->UniqFeatureSet.size() &&
551 II->U.size() > Size) {
552 auto OldFeaturesFile = Sha1ToString(II->Sha1);
555 Sha1ToString(II->Sha1));
573 Printf("SUMMARY: libFuzzer: overwrites-const-input\n");
574 DumpCurrentUnit("crash-");
586 !memcmp(A + Size - Limit / 2, B + Size - Limit / 2, Limit / 2);
600 if (EF->__msan_unpoison)
601 EF->__msan_unpoison(DataCopy, Size);
602 if (EF->__msan_unpoison_param)
603 EF->__msan_unpoison_param(2);
617 assert(CBRes == 0 || CBRes == -1);
627 std::string Fuzzer::WriteToOutputCorpus(const Unit &U) {
632 std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U));
642 std::string Path = Options.ArtifactPrefix + Prefix + Hash(U);
664 II->NumSuccessfullMutations++;
666 PrintStatusForNewUnit(U, II->Reduced ? "REDUCE" : "NEW ");
684 if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) ||
685 !(EF->__lsan_do_recoverable_leak_check))
689 EF->__lsan_disable();
691 EF->__lsan_enable();
696 Printf("INFO: libFuzzer disabled leak detection after every mutation.\n"
699 " You may try running this binary with -trace_malloc=[12]"
707 if (EF->__lsan_do_recoverable_leak_check()) { // Leak is found, report it.
710 Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n");
712 DumpCurrentUnit("leak-");
721 auto &II = Corpus.ChooseUnitToMutate(MD.GetRand());
723 auto &CrossOverII = Corpus.ChooseUnitToCrossOverWith(
727 const auto &U = II.U;
776 if (Options.PurgeAllocatorIntervalSec < 0 || !EF->__sanitizer_purge_allocator)
778 if (duration_cast<seconds>(system_clock::now() -
785 EF->__sanitizer_purge_allocator();
794 size_t MinSize = -1;
796 for (auto &File : CorporaFiles) {
826 for (auto &SF : CorporaFiles) {
827 auto U = FileToVector(SF.File, MaxInputLen, /*ExitOnError=*/false);
854 // so we add one fake input to the in-memory corpus.
863 auto FocusFunctionOrAuto = Options.FocusFunction;
877 auto Now = system_clock::now();
881 if (duration_cast<seconds>(Now - LastCorpusReload).count() >=
894 TotalNumberOfRuns - LastCorpusUpdateRun >
938 return fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize);