c10e63677f
The CrossOver mutator is meant to cross over two given buffers (referred to as the first/second buffer henceforth). Previously InsertPartOf/CopyPartOf calls used in the CrossOver mutator incorrectly inserted/copied part of the second buffer into a "scratch buffer" (MutateInPlaceHere of the size CurrentMaxMutationLen), rather than the first buffer. This is not intended behavior, because the scratch buffer does not always (i) contain the content of the first buffer, and (ii) have the same size as the first buffer; CurrentMaxMutationLen is typically a lot larger than the size of the first buffer. This patch fixes the issue by using the first buffer instead of the scratch buffer in InsertPartOf/CopyPartOf calls. A FuzzBench experiment was run to make sure that this change does not inadvertently degrade the performance. The performance is largely the same; more details can be found at: https://storage.googleapis.com/fuzzer-test-suite-public/fixcrossover-report/index.html This patch also adds two new tests, namely "cross_over_insert" and "cross_over_copy", which specifically target InsertPartOf and CopyPartOf, respectively. - cross_over_insert.test checks if the fuzzer can use InsertPartOf to trigger the crash. - cross_over_copy.test checks if the fuzzer can use CopyPartOf to trigger the crash. These newly added tests were designed to pass with the current patch, but not without the it (with 790878f291fa5dc58a1c560cb6cc76fd1bfd1c5a these tests do not pass). To achieve this, -max_len was intentionally given a high value. Without this patch, InsertPartOf/CopyPartOf will generate larger inputs, possibly with unpredictable data in it, thereby failing to trigger the crash. The test pass condition for these new tests is narrowed down by (i) limiting mutation depth to 1 (i.e., a single CrossOver mutation should be able to trigger the crash) and (ii) checking whether the mutation sequence of "CrossOver-" leads to the crash. Also note that these newly added tests and an existing test (cross_over.test) all use "-reduce_inputs=0" flags to prevent reducing inputs; it's easier to force the fuzzer to keep original input string this way than tweaking cov-instrumented basic blocks in the source code of the fuzzer executable. Differential Revision: https://reviews.llvm.org/D85554
54 lines
1.6 KiB
C++
54 lines
1.6 KiB
C++
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
|
|
// Test for a fuzzer. The fuzzer must find the string
|
|
// ABCDEFGHIJ
|
|
// We use it as a test for each of CrossOver functionalities
|
|
// by passing the following sets of two inputs to it:
|
|
// {ABCDE00000, ZZZZZFGHIJ}
|
|
// {ABCDEHIJ, ZFG} to specifically test InsertPartOf
|
|
// {ABCDE00HIJ, ZFG} to specifically test CopyPartOf
|
|
//
|
|
#include <assert.h>
|
|
#include <cstddef>
|
|
#include <cstdint>
|
|
#include <cstdlib>
|
|
#include <iostream>
|
|
#include <ostream>
|
|
|
|
static volatile int Sink;
|
|
static volatile int *NullPtr;
|
|
|
|
// A modified jenkins_one_at_a_time_hash initialized by non-zero,
|
|
// so that simple_hash(0) != 0. See also
|
|
// https://en.wikipedia.org/wiki/Jenkins_hash_function
|
|
static uint32_t simple_hash(const uint8_t *Data, size_t Size) {
|
|
uint32_t Hash = 0x12039854;
|
|
for (uint32_t i = 0; i < Size; i++) {
|
|
Hash += Data[i];
|
|
Hash += (Hash << 10);
|
|
Hash ^= (Hash >> 6);
|
|
}
|
|
Hash += (Hash << 3);
|
|
Hash ^= (Hash >> 11);
|
|
Hash += (Hash << 15);
|
|
return Hash;
|
|
}
|
|
|
|
// Don't leave the string in the binary, so that fuzzer don't cheat;
|
|
// const char *ABC = "ABCDEFGHIJ";
|
|
// static uint32_t ExpectedHash = simple_hash((const uint8_t *)ABC, 10);
|
|
static const uint32_t ExpectedHash = 0xe1677acb;
|
|
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
|
// fprintf(stderr, "ExpectedHash: %x\n", ExpectedHash);
|
|
if (Size == 10 && ExpectedHash == simple_hash(Data, Size))
|
|
*NullPtr = 0;
|
|
if (*Data == 'A')
|
|
Sink++;
|
|
if (*Data == 'Z')
|
|
Sink--;
|
|
return 0;
|
|
}
|