[libFuzzer] allow user to specify the merge control file
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk/lib/fuzzer@317747 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/FuzzerDriver.cpp b/FuzzerDriver.cpp
index 18c73ca..abc3144 100644
--- a/FuzzerDriver.cpp
+++ b/FuzzerDriver.cpp
@@ -701,19 +701,21 @@
}
if (Flags.merge) {
- const size_t kDefaultMaxMergeLen = 1 << 20;
- if (Options.MaxLen == 0)
- F->SetMaxInputLen(kDefaultMaxMergeLen);
-
- if (Flags.merge_control_file)
- F->CrashResistantMergeInternalStep(Flags.merge_control_file);
- else
- F->CrashResistantMerge(Args, *Inputs,
- Flags.load_coverage_summary,
- Flags.save_coverage_summary);
+ F->CrashResistantMerge(Args, *Inputs,
+ Flags.load_coverage_summary,
+ Flags.save_coverage_summary,
+ Flags.merge_control_file);
exit(0);
}
+ if (Flags.merge_inner) {
+ const size_t kDefaultMaxMergeLen = 1 << 20;
+ if (Options.MaxLen == 0)
+ F->SetMaxInputLen(kDefaultMaxMergeLen);
+ assert(Flags.merge_control_file);
+ F->CrashResistantMergeInternalStep(Flags.merge_control_file);
+ exit(0);
+ }
if (Flags.analyze_dict) {
size_t MaxLen = INT_MAX; // Large max length.
diff --git a/FuzzerFlags.def b/FuzzerFlags.def
index e4bca46..db8c9ed 100644
--- a/FuzzerFlags.def
+++ b/FuzzerFlags.def
@@ -38,7 +38,10 @@
FUZZER_FLAG_INT(merge, 0, "If 1, the 2-nd, 3-rd, etc corpora will be "
"merged into the 1-st corpus. Only interesting units will be taken. "
"This flag can be used to minimize a corpus.")
-FUZZER_FLAG_STRING(merge_control_file, "internal flag")
+FUZZER_FLAG_STRING(merge_inner, "internal flag")
+FUZZER_FLAG_STRING(merge_control_file,
+ "Specify a control file used for the merge proccess. "
+ "By default a temporary file will be used.")
FUZZER_FLAG_STRING(save_coverage_summary, "Experimental:"
" save coverage summary to a given file."
" Used with -merge=1")
diff --git a/FuzzerInternal.h b/FuzzerInternal.h
index 97c1408..3716244 100644
--- a/FuzzerInternal.h
+++ b/FuzzerInternal.h
@@ -73,7 +73,8 @@
void CrashResistantMerge(const Vector<std::string> &Args,
const Vector<std::string> &Corpora,
const char *CoverageSummaryInputPathOrNull,
- const char *CoverageSummaryOutputPathOrNull);
+ const char *CoverageSummaryOutputPathOrNull,
+ const char *MergeControlFilePathOrNull);
void CrashResistantMergeInternalStep(const std::string &ControlFilePath);
MutationDispatcher &GetMD() { return MD; }
void PrintFinalStats();
diff --git a/FuzzerMerge.cpp b/FuzzerMerge.cpp
index 03cf00a..e6e935d 100644
--- a/FuzzerMerge.cpp
+++ b/FuzzerMerge.cpp
@@ -260,7 +260,8 @@
void Fuzzer::CrashResistantMerge(const Vector<std::string> &Args,
const Vector<std::string> &Corpora,
const char *CoverageSummaryInputPathOrNull,
- const char *CoverageSummaryOutputPathOrNull) {
+ const char *CoverageSummaryOutputPathOrNull,
+ const char *MergeControlFilePathOrNull) {
if (Corpora.size() <= 1) {
Printf("Merge requires two or more corpus dirs\n");
return;
@@ -274,8 +275,11 @@
std::sort(AllFiles.begin() + NumFilesInFirstCorpus, AllFiles.end());
Printf("MERGE-OUTER: %zd files, %zd in the initial corpus\n",
AllFiles.size(), NumFilesInFirstCorpus);
- auto CFPath = DirPlusFile(TmpDir(),
- "libFuzzerTemp." + std::to_string(GetPid()) + ".txt");
+ auto CFPath =
+ MergeControlFilePathOrNull
+ ? MergeControlFilePathOrNull
+ : DirPlusFile(TmpDir(),
+ "libFuzzerTemp." + std::to_string(GetPid()) + ".txt");
// Write the control file.
RemoveFile(CFPath);
std::ofstream ControlFile(CFPath);
@@ -293,12 +297,13 @@
// Execute the inner process untill it passes.
// Every inner process should execute at least one input.
auto BaseCmd = SplitBefore("-ignore_remaining_args=1",
- CloneArgsWithoutX(Args, "keep-all-flags"));
+ CloneArgsWithoutX(Args, "merge"));
bool Success = false;
for (size_t i = 1; i <= AllFiles.size(); i++) {
Printf("MERGE-OUTER: attempt %zd\n", i);
- auto ExitCode = ExecuteCommand(BaseCmd.first + " -merge_control_file=" +
- CFPath + " " + BaseCmd.second);
+ auto ExitCode =
+ ExecuteCommand(BaseCmd.first + " -merge_control_file=" + CFPath +
+ " -merge_inner=1 " + BaseCmd.second);
if (!ExitCode) {
Printf("MERGE-OUTER: succesfull in %zd attempt(s)\n", i);
Success = true;
@@ -338,8 +343,9 @@
NewFiles.size(), NumNewFeatures);
for (auto &F: NewFiles)
WriteToOutputCorpus(FileToVector(F));
- // We are done, delete the control file.
- RemoveFile(CFPath);
+ // We are done, delete the control file if it was a temporary one.
+ if (!MergeControlFilePathOrNull)
+ RemoveFile(CFPath);
}
} // namespace fuzzer