Kostya Serebryany
b30ba817ce
[libFuzzer] add -shuffle flag
...
llvm-svn: 250603
2015-10-17 04:38:26 +00:00
Kostya Serebryany
e3d637a4af
[libFuzzer] add -artifact_prefix flag
...
llvm-svn: 249807
2015-10-09 03:57:59 +00:00
Kostya Serebryany
20a00e008b
[libFuzzer] remove experimental flag and functionality
...
llvm-svn: 249194
2015-10-02 22:00:32 +00:00
Kostya Serebryany
70f0401f05
[libFuzzer] add a flag -max_total_time
...
llvm-svn: 249181
2015-10-02 20:47:55 +00:00
Ivan Krasin
b941371206
[LibFuzzer] test_single_input option to run a single test case.
...
-test_single_input flag specifies a file name with test data.
Review URL: http://reviews.llvm.org/D13359
Patch by Mike Aizatsky!
llvm-svn: 249096
2015-10-01 23:23:06 +00:00
Kostya Serebryany
2d2cfbe976
[libFuzzer] better documentatio for -save_minimized_corpus=1
...
llvm-svn: 247033
2015-09-08 17:43:51 +00:00
Kostya Serebryany
28b0d0ab37
[libFuzzer] remove -iterations as redundant (there is also -num_runs)
...
llvm-svn: 247030
2015-09-08 17:30:35 +00:00
Kostya Serebryany
3b60fc1204
[libFuzzer] adding a parser for AFL-style dictionaries + tests.
...
llvm-svn: 246800
2015-09-03 20:23:46 +00:00
Kostya Serebryany
d4b7d4667f
[libFuzzer] deprecate the -tokens flag. This was a bad idea because the corpus with this flag contains encrypted inputs, not the real inputs, which complicates interoperation with other fuzzers. Instead we'll need to implement AFL dictionary support
...
llvm-svn: 246734
2015-09-02 23:27:39 +00:00
Lenny Maiorani
1850ddfeb6
Fix missing space in libfuzzer's help text.
...
llvm-svn: 244800
2015-08-12 20:00:10 +00:00
Kostya Serebryany
a9d3e6b2dc
[libFuzzer] add two flags, -tbm_depth and -tbm_width to control how the trace-based-mutations are applied
...
llvm-svn: 244712
2015-08-12 01:55:37 +00:00
Kostya Serebryany
1c2b96fda9
[libFuzzer] add -only_ascii flag
...
llvm-svn: 244559
2015-08-11 01:44:42 +00:00
Kostya Serebryany
80051e17c0
[libFuzzer] add option -report_slow_units=Nsec to control when slow units are printed
...
llvm-svn: 244152
2015-08-05 21:43:48 +00:00
Kostya Serebryany
dd85a5b4fc
[lib/Fuzzer] make the fuzzing timeout 1200 seconds by default (was: infinity)
...
llvm-svn: 238251
2015-05-26 20:57:47 +00:00
Kostya Serebryany
6903bb7921
[lib/Fuzzer] fix docs
...
llvm-svn: 238236
2015-05-26 19:32:52 +00:00
Kostya Serebryany
3afd2456cd
[lib/Fuzzer] remove -use_coverage_pairs=1, an experimental feature that is unlikely to ever scale
...
llvm-svn: 238063
2015-05-22 22:47:03 +00:00
Kostya Serebryany
46c887ece3
[lib/Fuzzer] change the meaning of -timeout flag: now timeout is applied to every unit of work separately
...
llvm-svn: 237735
2015-05-19 22:12:57 +00:00
Kostya Serebryany
a98902fdfc
[lib/Fuzzer] when -sync_command=<CMD> is given, periodically execute 'CMD CORPUS' to synchronize with other processes
...
llvm-svn: 237617
2015-05-18 21:34:20 +00:00
Kostya Serebryany
31389337e7
[lib/Fuzzer] enable -use_counters=1 by default
...
llvm-svn: 237272
2015-05-13 18:31:46 +00:00
Kostya Serebryany
354905a212
[lib/Fuzzer] guess the right number of workers if -jobs=N is given but -workers=M is not. Update the docs.
...
llvm-svn: 237163
2015-05-12 18:51:57 +00:00
Kostya Serebryany
933c6b41dd
[lib/Fuzzer] remove the -dfsan=1 flag, just use -use_traces=1 (w/ or w/o dfsan)
...
llvm-svn: 237083
2015-05-12 01:58:34 +00:00
Kostya Serebryany
528387038e
[lib/Fuzzer] add a trace-based mutatation logic. Same idea as with DFSan-based mutator, but instead of relying on taint tracking, try to find the data directly in the input. More (logic and comments) to go.
...
llvm-svn: 237043
2015-05-11 20:51:19 +00:00
Kostya Serebryany
9387837867
[lib/Fuzzer] use -fsanitize-coverage=trace-cmp when building LLVM with LLVM_USE_SANITIZE_COVERAGE; in lib/Fuzzer try to reload the corpus to pick up new units from other processes
...
llvm-svn: 236906
2015-05-08 21:30:55 +00:00
Kostya Serebryany
c69c3a7d4e
[fuzzer] Add support for token-based fuzzing (e.g. for C++). Allow string flags.
...
llvm-svn: 233745
2015-03-31 20:13:20 +00:00
Kostya Serebryany
bf919ef6ab
DFSan-based fuzzer (proof of concept).
...
Summary:
This adds a simple DFSan-based (i.e. taint-guided) fuzzer mutator,
see the comments for details.
Test Plan: a test added
Reviewers: samsonov, pcc
Reviewed By: samsonov, pcc
Subscribers: llvm-commits
Differential Revision: http://reviews.llvm.org/D8669
llvm-svn: 233613
2015-03-30 22:09:51 +00:00
Kostya Serebryany
285f1f0e41
[sanitizer/coverage] Add AFL-style coverage counters (search heuristic for fuzzing).
...
Introduce -mllvm -sanitizer-coverage-8bit-counters=1
which adds imprecise thread-unfriendly 8-bit coverage counters.
The run-time library maps these 8-bit counters to 8-bit bitsets in the same way
AFL (http://lcamtuf.coredump.cx/afl/technical_details.txt ) does:
counter values are divided into 8 ranges and based on the counter
value one of the bits in the bitset is set.
The AFL ranges are used here: 1, 2, 3, 4-7, 8-15, 16-31, 32-127, 128+.
These counters provide a search heuristic for single-threaded
coverage-guided fuzzers, we do not expect them to be useful for other purposes.
Depending on the value of -fsanitize-coverage=[123] flag,
these counters will be added to the function entry blocks (=1),
every basic block (=2), or every edge (=3).
Use these counters as an optional search heuristic in the Fuzzer library.
Add a test where this heuristic is critical.
llvm-svn: 231166
2015-03-03 23:27:02 +00:00
Kostya Serebryany
543d4cfda0
[fuzzer] one more experimental search mode: -use_coverage_pairs=1
...
llvm-svn: 229957
2015-02-20 03:02:37 +00:00
Kostya Serebryany
64c4d4b6ad
[fuzzer] add flag prefer_small_during_initial_shuffle, be a bit more verbose
...
llvm-svn: 228235
2015-02-04 23:42:42 +00:00
Kostya Serebryany
bef8a9c563
[fuzzer] add -runs=N to limit the number of runs per session. Also, make sure we do some mutations w/o cross over.
...
llvm-svn: 228214
2015-02-04 22:20:09 +00:00
Kostya Serebryany
31b6858756
[fuzzer] make multi-process execution more verbose; fix mutation to actually respect mutation depth and to never produce empty units
...
llvm-svn: 228170
2015-02-04 19:10:20 +00:00
Kostya Serebryany
e1dd7778a1
[fuzzer] add flags to run fuzzer in multiple parallel processes
...
llvm-svn: 227664
2015-01-31 01:14:40 +00:00
Kostya Serebryany
9658f61dfd
[fuzzer] add -use_full_coverage_set=1 which solves FullCoverageSetTest. This does not scale very well yet, but might be a good start.
...
llvm-svn: 227507
2015-01-29 23:01:07 +00:00
Aaron Ballman
ea7bb26fdf
Reverting r227452, which adds back the fuzzer library. Now excluding the fuzzer library based on LLVM_USE_SANITIZE_COVERAGE being set or unset.
...
llvm-svn: 227464
2015-01-29 16:58:29 +00:00
Aaron Ballman
28eea44386
Temporarily reverting the fuzzer library as it causes too many build issues for MSVC users. This reverts: 227445, 227395, 227389, 227357, 227254, 227252
...
llvm-svn: 227452
2015-01-29 15:49:22 +00:00
Kostya Serebryany
940c7a3149
[fuzzer] add option -save_minimized_corpus
...
llvm-svn: 227395
2015-01-28 23:48:39 +00:00
Kostya Serebryany
87931c3355
Add a Fuzzer library
...
Summary:
A simple genetic in-process coverage-guided fuzz testing library.
I've used this fuzzer to test clang-format
(it found 12+ bugs, thanks djasper@ for the fixes!)
and it may also help us test other parts of LLVM.
So why not keep it in the LLVM repository?
I plan to add the cmake build rules later (in a separate patch, if that's ok)
and also add a clang-format-fuzzer target.
See README.txt for details.
Test Plan: Tests will follow separately.
Reviewers: djasper, chandlerc, rnk
Reviewed By: rnk
Subscribers: majnemer, ygribov, dblaikie, llvm-commits
Differential Revision: http://reviews.llvm.org/D7184
llvm-svn: 227252
2015-01-27 22:08:41 +00:00