george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 1 | //===- FuzzerTracePC.cpp - PC tracing--------------------------------------===// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // Trace PCs. |
| 10 | // This module implements __sanitizer_cov_trace_pc_guard[_init], |
| 11 | // the callback required for -fsanitize-coverage=trace-pc-guard instrumentation. |
| 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
| 15 | #include "FuzzerTracePC.h" |
| 16 | #include "FuzzerCorpus.h" |
| 17 | #include "FuzzerDefs.h" |
| 18 | #include "FuzzerDictionary.h" |
| 19 | #include "FuzzerExtFunctions.h" |
| 20 | #include "FuzzerIO.h" |
| 21 | #include "FuzzerUtil.h" |
| 22 | #include "FuzzerValueBitMap.h" |
| 23 | #include <set> |
| 24 | |
| 25 | // The coverage counters and PCs. |
| 26 | // These are declared as global variables named "__sancov_*" to simplify |
| 27 | // experiments with inlined instrumentation. |
| 28 | alignas(64) ATTRIBUTE_INTERFACE |
| 29 | uint8_t __sancov_trace_pc_guard_8bit_counters[fuzzer::TracePC::kNumPCs]; |
| 30 | |
| 31 | ATTRIBUTE_INTERFACE |
| 32 | uintptr_t __sancov_trace_pc_pcs[fuzzer::TracePC::kNumPCs]; |
| 33 | |
kcc | 1c0379f | 2017-08-22 01:28:32 +0000 | [diff] [blame] | 34 | // Used by -fsanitize-coverage=stack-depth to track stack depth |
morehouse | 40c623a | 2018-08-29 18:08:34 +0000 | [diff] [blame^] | 35 | ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC uintptr_t __sancov_lowest_stack; |
kcc | 1c0379f | 2017-08-22 01:28:32 +0000 | [diff] [blame] | 36 | |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 37 | namespace fuzzer { |
| 38 | |
| 39 | TracePC TPC; |
| 40 | |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 41 | uint8_t *TracePC::Counters() const { |
| 42 | return __sancov_trace_pc_guard_8bit_counters; |
| 43 | } |
| 44 | |
| 45 | uintptr_t *TracePC::PCs() const { |
| 46 | return __sancov_trace_pc_pcs; |
| 47 | } |
| 48 | |
| 49 | size_t TracePC::GetTotalPCCoverage() { |
| 50 | if (ObservedPCs.size()) |
| 51 | return ObservedPCs.size(); |
| 52 | size_t Res = 0; |
| 53 | for (size_t i = 1, N = GetNumPCs(); i < N; i++) |
| 54 | if (PCs()[i]) |
| 55 | Res++; |
| 56 | return Res; |
| 57 | } |
| 58 | |
dor1s | d7197f4 | 2018-07-18 17:03:27 +0000 | [diff] [blame] | 59 | template<class CallBack> |
| 60 | void TracePC::IterateInline8bitCounters(CallBack CB) const { |
dor1s | bb93329 | 2018-07-16 16:01:31 +0000 | [diff] [blame] | 61 | if (NumInline8bitCounters && NumInline8bitCounters == NumPCsInPCTables) { |
dor1s | d7197f4 | 2018-07-18 17:03:27 +0000 | [diff] [blame] | 62 | size_t CounterIdx = 0; |
dor1s | bb93329 | 2018-07-16 16:01:31 +0000 | [diff] [blame] | 63 | for (size_t i = 0; i < NumModulesWithInline8bitCounters; i++) { |
| 64 | uint8_t *Beg = ModuleCounters[i].Start; |
| 65 | size_t Size = ModuleCounters[i].Stop - Beg; |
| 66 | assert(Size == (size_t)(ModulePCTable[i].Stop - ModulePCTable[i].Start)); |
dor1s | d7197f4 | 2018-07-18 17:03:27 +0000 | [diff] [blame] | 67 | for (size_t j = 0; j < Size; j++, CounterIdx++) |
| 68 | CB(i, j, CounterIdx); |
dor1s | bb93329 | 2018-07-16 16:01:31 +0000 | [diff] [blame] | 69 | } |
| 70 | } |
| 71 | } |
| 72 | |
dor1s | d7197f4 | 2018-07-18 17:03:27 +0000 | [diff] [blame] | 73 | // Initializes unstable counters by copying Inline8bitCounters to unstable |
| 74 | // counters. |
| 75 | void TracePC::InitializeUnstableCounters() { |
| 76 | IterateInline8bitCounters([&](int i, int j, int UnstableIdx) { |
dor1s | f50b3bb | 2018-07-23 14:20:52 +0000 | [diff] [blame] | 77 | UnstableCounters[UnstableIdx].Counter = ModuleCounters[i].Start[j]; |
dor1s | d7197f4 | 2018-07-18 17:03:27 +0000 | [diff] [blame] | 78 | }); |
| 79 | } |
| 80 | |
dor1s | bb93329 | 2018-07-16 16:01:31 +0000 | [diff] [blame] | 81 | // Compares the current counters with counters from previous runs |
| 82 | // and records differences as unstable edges. |
dor1s | 658ff78 | 2018-08-08 14:32:46 +0000 | [diff] [blame] | 83 | bool TracePC::UpdateUnstableCounters(int UnstableMode) { |
| 84 | bool Updated = false; |
dor1s | d7197f4 | 2018-07-18 17:03:27 +0000 | [diff] [blame] | 85 | IterateInline8bitCounters([&](int i, int j, int UnstableIdx) { |
dor1s | d626626 | 2018-07-24 21:02:44 +0000 | [diff] [blame] | 86 | if (ModuleCounters[i].Start[j] != UnstableCounters[UnstableIdx].Counter) { |
dor1s | 658ff78 | 2018-08-08 14:32:46 +0000 | [diff] [blame] | 87 | Updated = true; |
dor1s | f50b3bb | 2018-07-23 14:20:52 +0000 | [diff] [blame] | 88 | UnstableCounters[UnstableIdx].IsUnstable = true; |
dor1s | d626626 | 2018-07-24 21:02:44 +0000 | [diff] [blame] | 89 | if (UnstableMode == ZeroUnstable) |
| 90 | UnstableCounters[UnstableIdx].Counter = 0; |
| 91 | else if (UnstableMode == MinUnstable) |
| 92 | UnstableCounters[UnstableIdx].Counter = std::min( |
| 93 | ModuleCounters[i].Start[j], UnstableCounters[UnstableIdx].Counter); |
| 94 | } |
dor1s | f50b3bb | 2018-07-23 14:20:52 +0000 | [diff] [blame] | 95 | }); |
dor1s | 658ff78 | 2018-08-08 14:32:46 +0000 | [diff] [blame] | 96 | return Updated; |
dor1s | f50b3bb | 2018-07-23 14:20:52 +0000 | [diff] [blame] | 97 | } |
| 98 | |
dor1s | 658ff78 | 2018-08-08 14:32:46 +0000 | [diff] [blame] | 99 | // Updates and applies unstable counters to ModuleCounters in single iteration |
| 100 | void TracePC::UpdateAndApplyUnstableCounters(int UnstableMode) { |
dor1s | f50b3bb | 2018-07-23 14:20:52 +0000 | [diff] [blame] | 101 | IterateInline8bitCounters([&](int i, int j, int UnstableIdx) { |
dor1s | 658ff78 | 2018-08-08 14:32:46 +0000 | [diff] [blame] | 102 | if (ModuleCounters[i].Start[j] != UnstableCounters[UnstableIdx].Counter) { |
| 103 | UnstableCounters[UnstableIdx].IsUnstable = true; |
| 104 | if (UnstableMode == ZeroUnstable) |
| 105 | ModuleCounters[i].Start[j] = 0; |
| 106 | else if (UnstableMode == MinUnstable) |
| 107 | ModuleCounters[i].Start[j] = std::min( |
| 108 | ModuleCounters[i].Start[j], UnstableCounters[UnstableIdx].Counter); |
| 109 | } |
dor1s | d7197f4 | 2018-07-18 17:03:27 +0000 | [diff] [blame] | 110 | }); |
dor1s | bb93329 | 2018-07-16 16:01:31 +0000 | [diff] [blame] | 111 | } |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 112 | |
| 113 | void TracePC::HandleInline8bitCountersInit(uint8_t *Start, uint8_t *Stop) { |
| 114 | if (Start == Stop) return; |
| 115 | if (NumModulesWithInline8bitCounters && |
| 116 | ModuleCounters[NumModulesWithInline8bitCounters-1].Start == Start) return; |
| 117 | assert(NumModulesWithInline8bitCounters < |
| 118 | sizeof(ModuleCounters) / sizeof(ModuleCounters[0])); |
| 119 | ModuleCounters[NumModulesWithInline8bitCounters++] = {Start, Stop}; |
| 120 | NumInline8bitCounters += Stop - Start; |
| 121 | } |
| 122 | |
kcc | 98957a1 | 2017-08-25 19:29:47 +0000 | [diff] [blame] | 123 | void TracePC::HandlePCsInit(const uintptr_t *Start, const uintptr_t *Stop) { |
| 124 | const PCTableEntry *B = reinterpret_cast<const PCTableEntry *>(Start); |
| 125 | const PCTableEntry *E = reinterpret_cast<const PCTableEntry *>(Stop); |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 126 | if (NumPCTables && ModulePCTable[NumPCTables - 1].Start == B) return; |
| 127 | assert(NumPCTables < sizeof(ModulePCTable) / sizeof(ModulePCTable[0])); |
| 128 | ModulePCTable[NumPCTables++] = {B, E}; |
| 129 | NumPCsInPCTables += E - B; |
| 130 | } |
| 131 | |
| 132 | void TracePC::HandleInit(uint32_t *Start, uint32_t *Stop) { |
| 133 | if (Start == Stop || *Start) return; |
| 134 | assert(NumModules < sizeof(Modules) / sizeof(Modules[0])); |
| 135 | for (uint32_t *P = Start; P < Stop; P++) { |
| 136 | NumGuards++; |
| 137 | if (NumGuards == kNumPCs) { |
| 138 | RawPrint( |
| 139 | "WARNING: The binary has too many instrumented PCs.\n" |
| 140 | " You may want to reduce the size of the binary\n" |
| 141 | " for more efficient fuzzing and precise coverage data\n"); |
| 142 | } |
| 143 | *P = NumGuards % kNumPCs; |
| 144 | } |
| 145 | Modules[NumModules].Start = Start; |
| 146 | Modules[NumModules].Stop = Stop; |
| 147 | NumModules++; |
| 148 | } |
| 149 | |
| 150 | void TracePC::PrintModuleInfo() { |
| 151 | if (NumGuards) { |
| 152 | Printf("INFO: Loaded %zd modules (%zd guards): ", NumModules, NumGuards); |
| 153 | for (size_t i = 0; i < NumModules; i++) |
| 154 | Printf("%zd [%p, %p), ", Modules[i].Stop - Modules[i].Start, |
| 155 | Modules[i].Start, Modules[i].Stop); |
| 156 | Printf("\n"); |
| 157 | } |
| 158 | if (NumModulesWithInline8bitCounters) { |
| 159 | Printf("INFO: Loaded %zd modules (%zd inline 8-bit counters): ", |
| 160 | NumModulesWithInline8bitCounters, NumInline8bitCounters); |
| 161 | for (size_t i = 0; i < NumModulesWithInline8bitCounters; i++) |
| 162 | Printf("%zd [%p, %p), ", ModuleCounters[i].Stop - ModuleCounters[i].Start, |
| 163 | ModuleCounters[i].Start, ModuleCounters[i].Stop); |
| 164 | Printf("\n"); |
| 165 | } |
| 166 | if (NumPCTables) { |
| 167 | Printf("INFO: Loaded %zd PC tables (%zd PCs): ", NumPCTables, |
| 168 | NumPCsInPCTables); |
| 169 | for (size_t i = 0; i < NumPCTables; i++) { |
| 170 | Printf("%zd [%p,%p), ", ModulePCTable[i].Stop - ModulePCTable[i].Start, |
| 171 | ModulePCTable[i].Start, ModulePCTable[i].Stop); |
| 172 | } |
| 173 | Printf("\n"); |
| 174 | |
| 175 | if ((NumGuards && NumGuards != NumPCsInPCTables) || |
| 176 | (NumInline8bitCounters && NumInline8bitCounters != NumPCsInPCTables)) { |
kcc | e220ebb | 2017-10-14 00:07:11 +0000 | [diff] [blame] | 177 | Printf("ERROR: The size of coverage PC tables does not match the\n" |
| 178 | "number of instrumented PCs. This might be a compiler bug,\n" |
| 179 | "please contact the libFuzzer developers.\n" |
| 180 | "Also check https://bugs.llvm.org/show_bug.cgi?id=34636\n" |
| 181 | "for possible workarounds (tl;dr: don't use the old GNU ld)\n"); |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 182 | _Exit(1); |
| 183 | } |
| 184 | } |
delcypher | fcd19a8 | 2018-04-20 06:46:19 +0000 | [diff] [blame] | 185 | if (size_t NumExtraCounters = ExtraCountersEnd() - ExtraCountersBegin()) |
| 186 | Printf("INFO: %zd Extra Counters\n", NumExtraCounters); |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 187 | } |
| 188 | |
| 189 | ATTRIBUTE_NO_SANITIZE_ALL |
| 190 | void TracePC::HandleCallerCallee(uintptr_t Caller, uintptr_t Callee) { |
| 191 | const uintptr_t kBits = 12; |
| 192 | const uintptr_t kMask = (1 << kBits) - 1; |
| 193 | uintptr_t Idx = (Caller & kMask) | ((Callee & kMask) << kBits); |
| 194 | ValueProfileMap.AddValueModPrime(Idx); |
| 195 | } |
| 196 | |
| 197 | void TracePC::UpdateObservedPCs() { |
kcc | ec9da66 | 2017-08-28 22:52:22 +0000 | [diff] [blame] | 198 | Vector<uintptr_t> CoveredFuncs; |
kcc | 00da648 | 2017-08-25 20:09:25 +0000 | [diff] [blame] | 199 | auto ObservePC = [&](uintptr_t PC) { |
kcc | 09b3e5f | 2018-07-06 19:47:00 +0000 | [diff] [blame] | 200 | if (ObservedPCs.insert(PC).second && DoPrintNewPCs) { |
| 201 | PrintPC("\tNEW_PC: %p %F %L", "\tNEW_PC: %p", PC + 1); |
| 202 | Printf("\n"); |
| 203 | } |
kcc | 1c0379f | 2017-08-22 01:28:32 +0000 | [diff] [blame] | 204 | }; |
kcc | 00da648 | 2017-08-25 20:09:25 +0000 | [diff] [blame] | 205 | |
| 206 | auto Observe = [&](const PCTableEntry &TE) { |
| 207 | if (TE.PCFlags & 1) |
kcc | b3080d0 | 2018-07-19 22:00:48 +0000 | [diff] [blame] | 208 | if (++ObservedFuncs[TE.PC] == 1 && NumPrintNewFuncs) |
kcc | ec9da66 | 2017-08-28 22:52:22 +0000 | [diff] [blame] | 209 | CoveredFuncs.push_back(TE.PC); |
kcc | 00da648 | 2017-08-25 20:09:25 +0000 | [diff] [blame] | 210 | ObservePC(TE.PC); |
| 211 | }; |
| 212 | |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 213 | if (NumPCsInPCTables) { |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 214 | if (NumInline8bitCounters == NumPCsInPCTables) { |
dor1s | d7197f4 | 2018-07-18 17:03:27 +0000 | [diff] [blame] | 215 | IterateInline8bitCounters([&](int i, int j, int CounterIdx) { |
| 216 | if (ModuleCounters[i].Start[j]) |
| 217 | Observe(ModulePCTable[i].Start[j]); |
| 218 | }); |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 219 | } else if (NumGuards == NumPCsInPCTables) { |
| 220 | size_t GuardIdx = 1; |
| 221 | for (size_t i = 0; i < NumModules; i++) { |
| 222 | uint32_t *Beg = Modules[i].Start; |
| 223 | size_t Size = Modules[i].Stop - Beg; |
| 224 | assert(Size == |
| 225 | (size_t)(ModulePCTable[i].Stop - ModulePCTable[i].Start)); |
| 226 | for (size_t j = 0; j < Size; j++, GuardIdx++) |
| 227 | if (Counters()[GuardIdx]) |
kcc | 00da648 | 2017-08-25 20:09:25 +0000 | [diff] [blame] | 228 | Observe(ModulePCTable[i].Start[j]); |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 229 | } |
| 230 | } |
| 231 | } |
kcc | ec9da66 | 2017-08-28 22:52:22 +0000 | [diff] [blame] | 232 | |
kcc | b3080d0 | 2018-07-19 22:00:48 +0000 | [diff] [blame] | 233 | for (size_t i = 0, N = Min(CoveredFuncs.size(), NumPrintNewFuncs); i < N; |
| 234 | i++) { |
kcc | 873dc11 | 2018-06-07 21:15:24 +0000 | [diff] [blame] | 235 | Printf("\tNEW_FUNC[%zd/%zd]: ", i + 1, CoveredFuncs.size()); |
kcc | 09b3e5f | 2018-07-06 19:47:00 +0000 | [diff] [blame] | 236 | PrintPC("%p %F %L", "%p", CoveredFuncs[i] + 1); |
| 237 | Printf("\n"); |
kcc | ec9da66 | 2017-08-28 22:52:22 +0000 | [diff] [blame] | 238 | } |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 239 | } |
| 240 | |
| 241 | inline ALWAYS_INLINE uintptr_t GetPreviousInstructionPc(uintptr_t PC) { |
| 242 | // TODO: this implementation is x86 only. |
| 243 | // see sanitizer_common GetPreviousInstructionPc for full implementation. |
| 244 | return PC - 1; |
| 245 | } |
| 246 | |
| 247 | inline ALWAYS_INLINE uintptr_t GetNextInstructionPc(uintptr_t PC) { |
| 248 | // TODO: this implementation is x86 only. |
| 249 | // see sanitizer_common GetPreviousInstructionPc for full implementation. |
| 250 | return PC + 1; |
| 251 | } |
| 252 | |
| 253 | static std::string GetModuleName(uintptr_t PC) { |
| 254 | char ModulePathRaw[4096] = ""; // What's PATH_MAX in portable C++? |
| 255 | void *OffsetRaw = nullptr; |
| 256 | if (!EF->__sanitizer_get_module_and_offset_for_pc( |
| 257 | reinterpret_cast<void *>(PC), ModulePathRaw, |
| 258 | sizeof(ModulePathRaw), &OffsetRaw)) |
| 259 | return ""; |
| 260 | return ModulePathRaw; |
| 261 | } |
| 262 | |
kcc | 85cad3d | 2018-05-11 01:17:52 +0000 | [diff] [blame] | 263 | template<class CallBack> |
| 264 | void TracePC::IterateCoveredFunctions(CallBack CB) { |
| 265 | for (size_t i = 0; i < NumPCTables; i++) { |
| 266 | auto &M = ModulePCTable[i]; |
| 267 | assert(M.Start < M.Stop); |
| 268 | auto ModuleName = GetModuleName(M.Start->PC); |
| 269 | for (auto NextFE = M.Start; NextFE < M.Stop; ) { |
| 270 | auto FE = NextFE; |
| 271 | assert((FE->PCFlags & 1) && "Not a function entry point"); |
| 272 | do { |
| 273 | NextFE++; |
| 274 | } while (NextFE < M.Stop && !(NextFE->PCFlags & 1)); |
| 275 | if (ObservedFuncs.count(FE->PC)) |
kcc | b3080d0 | 2018-07-19 22:00:48 +0000 | [diff] [blame] | 276 | CB(FE, NextFE, ObservedFuncs[FE->PC]); |
kcc | 85cad3d | 2018-05-11 01:17:52 +0000 | [diff] [blame] | 277 | } |
| 278 | } |
| 279 | } |
| 280 | |
kcc | 3acbe07 | 2018-05-16 23:26:37 +0000 | [diff] [blame] | 281 | void TracePC::SetFocusFunction(const std::string &FuncName) { |
| 282 | // This function should be called once. |
| 283 | assert(FocusFunction.first > NumModulesWithInline8bitCounters); |
| 284 | if (FuncName.empty()) |
| 285 | return; |
| 286 | for (size_t M = 0; M < NumModulesWithInline8bitCounters; M++) { |
| 287 | auto &PCTE = ModulePCTable[M]; |
| 288 | size_t N = PCTE.Stop - PCTE.Start; |
| 289 | for (size_t I = 0; I < N; I++) { |
| 290 | if (!(PCTE.Start[I].PCFlags & 1)) continue; // not a function entry. |
| 291 | auto Name = DescribePC("%F", GetNextInstructionPc(PCTE.Start[I].PC)); |
| 292 | if (Name[0] == 'i' && Name[1] == 'n' && Name[2] == ' ') |
| 293 | Name = Name.substr(3, std::string::npos); |
| 294 | if (FuncName != Name) continue; |
| 295 | Printf("INFO: Focus function is set to '%s'\n", Name.c_str()); |
| 296 | FocusFunction = {M, I}; |
| 297 | return; |
| 298 | } |
| 299 | } |
| 300 | } |
| 301 | |
| 302 | bool TracePC::ObservedFocusFunction() { |
| 303 | size_t I = FocusFunction.first; |
| 304 | size_t J = FocusFunction.second; |
| 305 | if (I >= NumModulesWithInline8bitCounters) |
| 306 | return false; |
| 307 | auto &MC = ModuleCounters[I]; |
| 308 | size_t Size = MC.Stop - MC.Start; |
| 309 | if (J >= Size) |
| 310 | return false; |
| 311 | return MC.Start[J] != 0; |
| 312 | } |
| 313 | |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 314 | void TracePC::PrintCoverage() { |
| 315 | if (!EF->__sanitizer_symbolize_pc || |
| 316 | !EF->__sanitizer_get_module_and_offset_for_pc) { |
| 317 | Printf("INFO: __sanitizer_symbolize_pc or " |
| 318 | "__sanitizer_get_module_and_offset_for_pc is not available," |
| 319 | " not printing coverage\n"); |
| 320 | return; |
| 321 | } |
| 322 | Printf("COVERAGE:\n"); |
kcc | b3080d0 | 2018-07-19 22:00:48 +0000 | [diff] [blame] | 323 | auto CoveredFunctionCallback = [&](const PCTableEntry *First, |
| 324 | const PCTableEntry *Last, |
| 325 | uintptr_t Counter) { |
kcc | 85cad3d | 2018-05-11 01:17:52 +0000 | [diff] [blame] | 326 | assert(First < Last); |
| 327 | auto VisualizePC = GetNextInstructionPc(First->PC); |
| 328 | std::string FileStr = DescribePC("%s", VisualizePC); |
kcc | b3080d0 | 2018-07-19 22:00:48 +0000 | [diff] [blame] | 329 | if (!IsInterestingCoverageFile(FileStr)) |
| 330 | return; |
kcc | 85cad3d | 2018-05-11 01:17:52 +0000 | [diff] [blame] | 331 | std::string FunctionStr = DescribePC("%F", VisualizePC); |
kcc | b3080d0 | 2018-07-19 22:00:48 +0000 | [diff] [blame] | 332 | if (FunctionStr.find("in ") == 0) |
| 333 | FunctionStr = FunctionStr.substr(3); |
kcc | 85cad3d | 2018-05-11 01:17:52 +0000 | [diff] [blame] | 334 | std::string LineStr = DescribePC("%l", VisualizePC); |
| 335 | size_t Line = std::stoul(LineStr); |
kcc | b3080d0 | 2018-07-19 22:00:48 +0000 | [diff] [blame] | 336 | size_t NumEdges = Last - First; |
morehouse | f64b940 | 2018-06-25 15:59:24 +0000 | [diff] [blame] | 337 | Vector<uintptr_t> UncoveredPCs; |
kcc | 85cad3d | 2018-05-11 01:17:52 +0000 | [diff] [blame] | 338 | for (auto TE = First; TE < Last; TE++) |
| 339 | if (!ObservedPCs.count(TE->PC)) |
| 340 | UncoveredPCs.push_back(TE->PC); |
kcc | b3080d0 | 2018-07-19 22:00:48 +0000 | [diff] [blame] | 341 | Printf("COVERED_FUNC: hits: %zd", Counter); |
| 342 | Printf(" edges: %zd/%zd", NumEdges - UncoveredPCs.size(), NumEdges); |
| 343 | Printf(" %s %s:%zd\n", FunctionStr.c_str(), FileStr.c_str(), Line); |
| 344 | for (auto PC: UncoveredPCs) |
kcc | 85cad3d | 2018-05-11 01:17:52 +0000 | [diff] [blame] | 345 | Printf(" UNCOVERED_PC: %s\n", |
| 346 | DescribePC("%s:%l", GetNextInstructionPc(PC)).c_str()); |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 347 | }; |
| 348 | |
kcc | 85cad3d | 2018-05-11 01:17:52 +0000 | [diff] [blame] | 349 | IterateCoveredFunctions(CoveredFunctionCallback); |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 350 | } |
| 351 | |
kcc | a7dd2a9 | 2018-05-21 19:47:00 +0000 | [diff] [blame] | 352 | void TracePC::DumpCoverage() { |
| 353 | if (EF->__sanitizer_dump_coverage) { |
| 354 | Vector<uintptr_t> PCsCopy(GetNumPCs()); |
| 355 | for (size_t i = 0; i < GetNumPCs(); i++) |
| 356 | PCsCopy[i] = PCs()[i] ? GetPreviousInstructionPc(PCs()[i]) : 0; |
| 357 | EF->__sanitizer_dump_coverage(PCsCopy.data(), PCsCopy.size()); |
| 358 | } |
| 359 | } |
| 360 | |
dor1s | bb93329 | 2018-07-16 16:01:31 +0000 | [diff] [blame] | 361 | void TracePC::PrintUnstableStats() { |
| 362 | size_t count = 0; |
dor1s | 7266777 | 2018-08-06 23:14:13 +0000 | [diff] [blame] | 363 | Printf("UNSTABLE_FUNCTIONS:\n"); |
| 364 | IterateInline8bitCounters([&](int i, int j, int UnstableIdx) { |
| 365 | const PCTableEntry &TE = ModulePCTable[i].Start[j]; |
| 366 | if (UnstableCounters[UnstableIdx].IsUnstable) { |
dor1s | bb93329 | 2018-07-16 16:01:31 +0000 | [diff] [blame] | 367 | count++; |
dor1s | 7266777 | 2018-08-06 23:14:13 +0000 | [diff] [blame] | 368 | if (ObservedFuncs.count(TE.PC)) { |
| 369 | auto VisualizePC = GetNextInstructionPc(TE.PC); |
| 370 | std::string FunctionStr = DescribePC("%F", VisualizePC); |
| 371 | if (FunctionStr.find("in ") == 0) |
| 372 | FunctionStr = FunctionStr.substr(3); |
| 373 | Printf("%s\n", FunctionStr.c_str()); |
| 374 | } |
| 375 | } |
| 376 | }); |
| 377 | |
dor1s | bb93329 | 2018-07-16 16:01:31 +0000 | [diff] [blame] | 378 | Printf("stat::stability_rate: %.2f\n", |
| 379 | 100 - static_cast<float>(count * 100) / NumInline8bitCounters); |
| 380 | } |
| 381 | |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 382 | // Value profile. |
| 383 | // We keep track of various values that affect control flow. |
| 384 | // These values are inserted into a bit-set-based hash map. |
| 385 | // Every new bit in the map is treated as a new coverage. |
| 386 | // |
| 387 | // For memcmp/strcmp/etc the interesting value is the length of the common |
| 388 | // prefix of the parameters. |
| 389 | // For cmp instructions the interesting value is a XOR of the parameters. |
| 390 | // The interesting value is mixed up with the PC and is then added to the map. |
| 391 | |
| 392 | ATTRIBUTE_NO_SANITIZE_ALL |
| 393 | void TracePC::AddValueForMemcmp(void *caller_pc, const void *s1, const void *s2, |
| 394 | size_t n, bool StopAtZero) { |
| 395 | if (!n) return; |
| 396 | size_t Len = std::min(n, Word::GetMaxSize()); |
| 397 | const uint8_t *A1 = reinterpret_cast<const uint8_t *>(s1); |
| 398 | const uint8_t *A2 = reinterpret_cast<const uint8_t *>(s2); |
| 399 | uint8_t B1[Word::kMaxSize]; |
| 400 | uint8_t B2[Word::kMaxSize]; |
| 401 | // Copy the data into locals in this non-msan-instrumented function |
| 402 | // to avoid msan complaining further. |
| 403 | size_t Hash = 0; // Compute some simple hash of both strings. |
| 404 | for (size_t i = 0; i < Len; i++) { |
| 405 | B1[i] = A1[i]; |
| 406 | B2[i] = A2[i]; |
| 407 | size_t T = B1[i]; |
| 408 | Hash ^= (T << 8) | B2[i]; |
| 409 | } |
| 410 | size_t I = 0; |
| 411 | for (; I < Len; I++) |
| 412 | if (B1[I] != B2[I] || (StopAtZero && B1[I] == 0)) |
| 413 | break; |
| 414 | size_t PC = reinterpret_cast<size_t>(caller_pc); |
| 415 | size_t Idx = (PC & 4095) | (I << 12); |
| 416 | ValueProfileMap.AddValue(Idx); |
| 417 | TORCW.Insert(Idx ^ Hash, Word(B1, Len), Word(B2, Len)); |
| 418 | } |
| 419 | |
| 420 | template <class T> |
| 421 | ATTRIBUTE_TARGET_POPCNT ALWAYS_INLINE |
| 422 | ATTRIBUTE_NO_SANITIZE_ALL |
| 423 | void TracePC::HandleCmp(uintptr_t PC, T Arg1, T Arg2) { |
| 424 | uint64_t ArgXor = Arg1 ^ Arg2; |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 425 | if (sizeof(T) == 4) |
dor1s | e6729cb | 2018-07-16 15:15:34 +0000 | [diff] [blame] | 426 | TORC4.Insert(ArgXor, Arg1, Arg2); |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 427 | else if (sizeof(T) == 8) |
dor1s | e6729cb | 2018-07-16 15:15:34 +0000 | [diff] [blame] | 428 | TORC8.Insert(ArgXor, Arg1, Arg2); |
kcc | 6d3b8e9 | 2018-08-02 00:24:49 +0000 | [diff] [blame] | 429 | uint64_t HammingDistance = __builtin_popcountll(ArgXor); // [0,64] |
| 430 | uint64_t AbsoluteDistance = |
| 431 | (Arg1 == Arg2 ? 0 : __builtin_clzll(Arg1 - Arg2) + 1); |
| 432 | ValueProfileMap.AddValue(PC * 128 + HammingDistance); |
| 433 | ValueProfileMap.AddValue(PC * 128 + 64 + AbsoluteDistance); |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 434 | } |
| 435 | |
| 436 | static size_t InternalStrnlen(const char *S, size_t MaxLen) { |
| 437 | size_t Len = 0; |
| 438 | for (; Len < MaxLen && S[Len]; Len++) {} |
| 439 | return Len; |
| 440 | } |
| 441 | |
| 442 | // Finds min of (strlen(S1), strlen(S2)). |
| 443 | // Needed bacause one of these strings may actually be non-zero terminated. |
| 444 | static size_t InternalStrnlen2(const char *S1, const char *S2) { |
| 445 | size_t Len = 0; |
| 446 | for (; S1[Len] && S2[Len]; Len++) {} |
| 447 | return Len; |
| 448 | } |
| 449 | |
| 450 | void TracePC::ClearInlineCounters() { |
| 451 | for (size_t i = 0; i < NumModulesWithInline8bitCounters; i++) { |
| 452 | uint8_t *Beg = ModuleCounters[i].Start; |
| 453 | size_t Size = ModuleCounters[i].Stop - Beg; |
| 454 | memset(Beg, 0, Size); |
| 455 | } |
| 456 | } |
| 457 | |
kcc | 0f3c031 | 2017-08-22 01:50:00 +0000 | [diff] [blame] | 458 | ATTRIBUTE_NO_SANITIZE_ALL |
kcc | 1c0379f | 2017-08-22 01:28:32 +0000 | [diff] [blame] | 459 | void TracePC::RecordInitialStack() { |
kcc | 0f3c031 | 2017-08-22 01:50:00 +0000 | [diff] [blame] | 460 | int stack; |
| 461 | __sancov_lowest_stack = InitialStack = reinterpret_cast<uintptr_t>(&stack); |
kcc | 1c0379f | 2017-08-22 01:28:32 +0000 | [diff] [blame] | 462 | } |
| 463 | |
| 464 | uintptr_t TracePC::GetMaxStackOffset() const { |
| 465 | return InitialStack - __sancov_lowest_stack; // Stack grows down |
| 466 | } |
| 467 | |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 468 | } // namespace fuzzer |
| 469 | |
| 470 | extern "C" { |
| 471 | ATTRIBUTE_INTERFACE |
| 472 | ATTRIBUTE_NO_SANITIZE_ALL |
| 473 | void __sanitizer_cov_trace_pc_guard(uint32_t *Guard) { |
| 474 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 475 | uint32_t Idx = *Guard; |
| 476 | __sancov_trace_pc_pcs[Idx] = PC; |
| 477 | __sancov_trace_pc_guard_8bit_counters[Idx]++; |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 478 | } |
| 479 | |
| 480 | // Best-effort support for -fsanitize-coverage=trace-pc, which is available |
| 481 | // in both Clang and GCC. |
| 482 | ATTRIBUTE_INTERFACE |
| 483 | ATTRIBUTE_NO_SANITIZE_ALL |
| 484 | void __sanitizer_cov_trace_pc() { |
| 485 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 486 | uintptr_t Idx = PC & (((uintptr_t)1 << fuzzer::TracePC::kTracePcBits) - 1); |
| 487 | __sancov_trace_pc_pcs[Idx] = PC; |
| 488 | __sancov_trace_pc_guard_8bit_counters[Idx]++; |
| 489 | } |
| 490 | |
| 491 | ATTRIBUTE_INTERFACE |
| 492 | void __sanitizer_cov_trace_pc_guard_init(uint32_t *Start, uint32_t *Stop) { |
| 493 | fuzzer::TPC.HandleInit(Start, Stop); |
| 494 | } |
| 495 | |
| 496 | ATTRIBUTE_INTERFACE |
| 497 | void __sanitizer_cov_8bit_counters_init(uint8_t *Start, uint8_t *Stop) { |
| 498 | fuzzer::TPC.HandleInline8bitCountersInit(Start, Stop); |
| 499 | } |
| 500 | |
| 501 | ATTRIBUTE_INTERFACE |
kcc | 98957a1 | 2017-08-25 19:29:47 +0000 | [diff] [blame] | 502 | void __sanitizer_cov_pcs_init(const uintptr_t *pcs_beg, |
| 503 | const uintptr_t *pcs_end) { |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 504 | fuzzer::TPC.HandlePCsInit(pcs_beg, pcs_end); |
| 505 | } |
| 506 | |
| 507 | ATTRIBUTE_INTERFACE |
| 508 | ATTRIBUTE_NO_SANITIZE_ALL |
| 509 | void __sanitizer_cov_trace_pc_indir(uintptr_t Callee) { |
| 510 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 511 | fuzzer::TPC.HandleCallerCallee(PC, Callee); |
| 512 | } |
| 513 | |
| 514 | ATTRIBUTE_INTERFACE |
| 515 | ATTRIBUTE_NO_SANITIZE_ALL |
| 516 | ATTRIBUTE_TARGET_POPCNT |
| 517 | void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) { |
| 518 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 519 | fuzzer::TPC.HandleCmp(PC, Arg1, Arg2); |
| 520 | } |
| 521 | |
| 522 | ATTRIBUTE_INTERFACE |
| 523 | ATTRIBUTE_NO_SANITIZE_ALL |
| 524 | ATTRIBUTE_TARGET_POPCNT |
| 525 | // Now the __sanitizer_cov_trace_const_cmp[1248] callbacks just mimic |
| 526 | // the behaviour of __sanitizer_cov_trace_cmp[1248] ones. This, however, |
| 527 | // should be changed later to make full use of instrumentation. |
| 528 | void __sanitizer_cov_trace_const_cmp8(uint64_t Arg1, uint64_t Arg2) { |
| 529 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 530 | fuzzer::TPC.HandleCmp(PC, Arg1, Arg2); |
| 531 | } |
| 532 | |
| 533 | ATTRIBUTE_INTERFACE |
| 534 | ATTRIBUTE_NO_SANITIZE_ALL |
| 535 | ATTRIBUTE_TARGET_POPCNT |
| 536 | void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) { |
| 537 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 538 | fuzzer::TPC.HandleCmp(PC, Arg1, Arg2); |
| 539 | } |
| 540 | |
| 541 | ATTRIBUTE_INTERFACE |
| 542 | ATTRIBUTE_NO_SANITIZE_ALL |
| 543 | ATTRIBUTE_TARGET_POPCNT |
| 544 | void __sanitizer_cov_trace_const_cmp4(uint32_t Arg1, uint32_t Arg2) { |
| 545 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 546 | fuzzer::TPC.HandleCmp(PC, Arg1, Arg2); |
| 547 | } |
| 548 | |
| 549 | ATTRIBUTE_INTERFACE |
| 550 | ATTRIBUTE_NO_SANITIZE_ALL |
| 551 | ATTRIBUTE_TARGET_POPCNT |
| 552 | void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) { |
| 553 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 554 | fuzzer::TPC.HandleCmp(PC, Arg1, Arg2); |
| 555 | } |
| 556 | |
| 557 | ATTRIBUTE_INTERFACE |
| 558 | ATTRIBUTE_NO_SANITIZE_ALL |
| 559 | ATTRIBUTE_TARGET_POPCNT |
| 560 | void __sanitizer_cov_trace_const_cmp2(uint16_t Arg1, uint16_t Arg2) { |
| 561 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 562 | fuzzer::TPC.HandleCmp(PC, Arg1, Arg2); |
| 563 | } |
| 564 | |
| 565 | ATTRIBUTE_INTERFACE |
| 566 | ATTRIBUTE_NO_SANITIZE_ALL |
| 567 | ATTRIBUTE_TARGET_POPCNT |
| 568 | void __sanitizer_cov_trace_cmp1(uint8_t Arg1, uint8_t Arg2) { |
| 569 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 570 | fuzzer::TPC.HandleCmp(PC, Arg1, Arg2); |
| 571 | } |
| 572 | |
| 573 | ATTRIBUTE_INTERFACE |
| 574 | ATTRIBUTE_NO_SANITIZE_ALL |
| 575 | ATTRIBUTE_TARGET_POPCNT |
| 576 | void __sanitizer_cov_trace_const_cmp1(uint8_t Arg1, uint8_t Arg2) { |
| 577 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 578 | fuzzer::TPC.HandleCmp(PC, Arg1, Arg2); |
| 579 | } |
| 580 | |
| 581 | ATTRIBUTE_INTERFACE |
| 582 | ATTRIBUTE_NO_SANITIZE_ALL |
| 583 | ATTRIBUTE_TARGET_POPCNT |
| 584 | void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases) { |
| 585 | uint64_t N = Cases[0]; |
| 586 | uint64_t ValSizeInBits = Cases[1]; |
| 587 | uint64_t *Vals = Cases + 2; |
| 588 | // Skip the most common and the most boring case. |
| 589 | if (Vals[N - 1] < 256 && Val < 256) |
| 590 | return; |
| 591 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 592 | size_t i; |
| 593 | uint64_t Token = 0; |
| 594 | for (i = 0; i < N; i++) { |
| 595 | Token = Val ^ Vals[i]; |
| 596 | if (Val < Vals[i]) |
| 597 | break; |
| 598 | } |
| 599 | |
| 600 | if (ValSizeInBits == 16) |
| 601 | fuzzer::TPC.HandleCmp(PC + i, static_cast<uint16_t>(Token), (uint16_t)(0)); |
| 602 | else if (ValSizeInBits == 32) |
| 603 | fuzzer::TPC.HandleCmp(PC + i, static_cast<uint32_t>(Token), (uint32_t)(0)); |
| 604 | else |
| 605 | fuzzer::TPC.HandleCmp(PC + i, Token, (uint64_t)(0)); |
| 606 | } |
| 607 | |
| 608 | ATTRIBUTE_INTERFACE |
| 609 | ATTRIBUTE_NO_SANITIZE_ALL |
| 610 | ATTRIBUTE_TARGET_POPCNT |
| 611 | void __sanitizer_cov_trace_div4(uint32_t Val) { |
| 612 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 613 | fuzzer::TPC.HandleCmp(PC, Val, (uint32_t)0); |
| 614 | } |
| 615 | |
| 616 | ATTRIBUTE_INTERFACE |
| 617 | ATTRIBUTE_NO_SANITIZE_ALL |
| 618 | ATTRIBUTE_TARGET_POPCNT |
| 619 | void __sanitizer_cov_trace_div8(uint64_t Val) { |
| 620 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 621 | fuzzer::TPC.HandleCmp(PC, Val, (uint64_t)0); |
| 622 | } |
| 623 | |
| 624 | ATTRIBUTE_INTERFACE |
| 625 | ATTRIBUTE_NO_SANITIZE_ALL |
| 626 | ATTRIBUTE_TARGET_POPCNT |
| 627 | void __sanitizer_cov_trace_gep(uintptr_t Idx) { |
| 628 | uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); |
| 629 | fuzzer::TPC.HandleCmp(PC, Idx, (uintptr_t)0); |
| 630 | } |
| 631 | |
| 632 | ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY |
| 633 | void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1, |
| 634 | const void *s2, size_t n, int result) { |
morehouse | c6ee875 | 2018-07-17 16:12:00 +0000 | [diff] [blame] | 635 | if (!fuzzer::RunningUserCallback) return; |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 636 | if (result == 0) return; // No reason to mutate. |
| 637 | if (n <= 1) return; // Not interesting. |
| 638 | fuzzer::TPC.AddValueForMemcmp(caller_pc, s1, s2, n, /*StopAtZero*/false); |
| 639 | } |
| 640 | |
| 641 | ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY |
| 642 | void __sanitizer_weak_hook_strncmp(void *caller_pc, const char *s1, |
| 643 | const char *s2, size_t n, int result) { |
morehouse | c6ee875 | 2018-07-17 16:12:00 +0000 | [diff] [blame] | 644 | if (!fuzzer::RunningUserCallback) return; |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 645 | if (result == 0) return; // No reason to mutate. |
| 646 | size_t Len1 = fuzzer::InternalStrnlen(s1, n); |
| 647 | size_t Len2 = fuzzer::InternalStrnlen(s2, n); |
| 648 | n = std::min(n, Len1); |
| 649 | n = std::min(n, Len2); |
| 650 | if (n <= 1) return; // Not interesting. |
| 651 | fuzzer::TPC.AddValueForMemcmp(caller_pc, s1, s2, n, /*StopAtZero*/true); |
| 652 | } |
| 653 | |
| 654 | ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY |
| 655 | void __sanitizer_weak_hook_strcmp(void *caller_pc, const char *s1, |
dor1s | e6729cb | 2018-07-16 15:15:34 +0000 | [diff] [blame] | 656 | const char *s2, int result) { |
morehouse | c6ee875 | 2018-07-17 16:12:00 +0000 | [diff] [blame] | 657 | if (!fuzzer::RunningUserCallback) return; |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 658 | if (result == 0) return; // No reason to mutate. |
| 659 | size_t N = fuzzer::InternalStrnlen2(s1, s2); |
| 660 | if (N <= 1) return; // Not interesting. |
| 661 | fuzzer::TPC.AddValueForMemcmp(caller_pc, s1, s2, N, /*StopAtZero*/true); |
| 662 | } |
| 663 | |
| 664 | ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY |
| 665 | void __sanitizer_weak_hook_strncasecmp(void *called_pc, const char *s1, |
| 666 | const char *s2, size_t n, int result) { |
morehouse | c6ee875 | 2018-07-17 16:12:00 +0000 | [diff] [blame] | 667 | if (!fuzzer::RunningUserCallback) return; |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 668 | return __sanitizer_weak_hook_strncmp(called_pc, s1, s2, n, result); |
| 669 | } |
| 670 | |
| 671 | ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY |
| 672 | void __sanitizer_weak_hook_strcasecmp(void *called_pc, const char *s1, |
| 673 | const char *s2, int result) { |
morehouse | c6ee875 | 2018-07-17 16:12:00 +0000 | [diff] [blame] | 674 | if (!fuzzer::RunningUserCallback) return; |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 675 | return __sanitizer_weak_hook_strcmp(called_pc, s1, s2, result); |
| 676 | } |
| 677 | |
| 678 | ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY |
| 679 | void __sanitizer_weak_hook_strstr(void *called_pc, const char *s1, |
| 680 | const char *s2, char *result) { |
morehouse | c6ee875 | 2018-07-17 16:12:00 +0000 | [diff] [blame] | 681 | if (!fuzzer::RunningUserCallback) return; |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 682 | fuzzer::TPC.MMT.Add(reinterpret_cast<const uint8_t *>(s2), strlen(s2)); |
| 683 | } |
| 684 | |
| 685 | ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY |
| 686 | void __sanitizer_weak_hook_strcasestr(void *called_pc, const char *s1, |
| 687 | const char *s2, char *result) { |
morehouse | c6ee875 | 2018-07-17 16:12:00 +0000 | [diff] [blame] | 688 | if (!fuzzer::RunningUserCallback) return; |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 689 | fuzzer::TPC.MMT.Add(reinterpret_cast<const uint8_t *>(s2), strlen(s2)); |
| 690 | } |
| 691 | |
| 692 | ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY |
| 693 | void __sanitizer_weak_hook_memmem(void *called_pc, const void *s1, size_t len1, |
| 694 | const void *s2, size_t len2, void *result) { |
morehouse | c6ee875 | 2018-07-17 16:12:00 +0000 | [diff] [blame] | 695 | if (!fuzzer::RunningUserCallback) return; |
george.karpenkov | 29efa6d | 2017-08-21 23:25:50 +0000 | [diff] [blame] | 696 | fuzzer::TPC.MMT.Add(reinterpret_cast<const uint8_t *>(s2), len2); |
| 697 | } |
| 698 | } // extern "C" |