6 Commits

Author SHA1 Message Date
Khem Raj
60e32a1f34 [fuzzer] Fix build on musl
cstddef is needed for size_t definition.
(Multiple headers can provide size_t but none of them exists.)

Reviewed By: MaskRay

Differential Revision: https://reviews.llvm.org/D96213
2021-06-13 12:32:07 -07:00
Matt Morehouse
49dda4e58a [libFuzzer] Break dependency on common_interface_defs.h
Some libFuzzer users build using the build.sh script, without access to
the <sanitizer/common_interface_defs.h> include.

Update https://github.com/rust-fuzz/libfuzzer/issues/65.

Reviewed By: dokyungs

Differential Revision: https://reviews.llvm.org/D86981
2020-09-01 15:35:14 -07:00
Fangrui Song
f7ffb122d0 [libFuzzer] Instrument bcmp
If we define memcmp in an archive, bcmp should be defined as well (many libc
define bcmp/memcmp in one object file).  Otherwise if the application calls bcmp
or strcmp which gets optimized to bcmp (SimplifyLibCalls), the undefined
reference may pull in an optimized bcmp/strcmp implementation (libc replacement)
later on the linker command line.  If both libFuzzer's memcmp and the optimized
memcmp are strong => there will be a multiple definition error.
2020-07-24 00:24:46 -07:00
Dokyung Song
831ae45e3d Recommit "[libFuzzer] Link libFuzzer's own interceptors when other compiler runtimes are not linked."
Summary: libFuzzer intercepts certain library functions such as memcmp/strcmp by defining weak hooks. Weak hooks, however, are called only when other runtimes such as ASan is linked. This patch defines libFuzzer's own interceptors, which is linked into the libFuzzer executable when other runtimes are not linked, i.e., when -fsanitize=fuzzer is given, but not others.

The patch once landed but was reverted in 8ef9e2bf355d05bc81d8b0fe1e5333eec59a0a91 due to an assertion failure caused by calling an intercepted function, strncmp, while initializing the interceptors in fuzzerInit(). This issue is now fixed by calling libFuzzer's own implementation of library functions (i.e., internal_*) when the fuzzer has not been initialized yet, instead of recursively calling fuzzerInit() again.

Reviewers: kcc, morehouse, hctim

Subscribers: #sanitizers, krytarowski, mgorny, cfe-commits

Tags: #clang, #sanitizers

Differential Revision: https://reviews.llvm.org/D83494
2020-07-23 15:59:07 +00:00
Richard Smith
8ef9e2bf35 Revert "[libFuzzer] Link libFuzzer's own interceptors when other compiler runtimes are not linked."
This causes binaries linked with this runtime to crash on startup if
dlsym uses any of the intercepted functions. (For example, that happens
when using tcmalloc as the allocator: dlsym attempts to allocate memory
with malloc, and tcmalloc uses strncmp within its implementation.)

Also revert dependent commit "[libFuzzer] Disable implicit builtin knowledge about memcmp-like functions when -fsanitize=fuzzer-no-link is given."

This reverts commit f78d9fceea736d431e9e3cbca291e3909e3aa46d and 12d1124c49beec0fb79d36944960e5bf0f236d4c.
2020-07-16 18:06:37 -07:00
Dokyung Song
f78d9fceea [libFuzzer] Link libFuzzer's own interceptors when other compiler runtimes are not linked.
Summary: libFuzzer intercepts certain library functions such as memcmp/strcmp by defining weak hooks. Weak hooks, however, are called only when other runtimes such as ASan is linked. This patch defines libFuzzer's own interceptors, which is linked into the libFuzzer executable when other runtimes are not linked, i.e., when -fsanitize=fuzzer is given, but not others.

Reviewers: kcc, morehouse, hctim

Reviewed By: morehouse, hctim

Subscribers: krytarowski, mgorny, cfe-commits, #sanitizers

Tags: #clang, #sanitizers

Differential Revision: https://reviews.llvm.org/D83494
2020-07-16 20:26:35 +00:00