lib/fuzzer/FuzzerMutate.cpp

68 size_t MutationDispatcher::Mutate_Custom(uint8_t *Data, size_t Size,
70   return EF->LLVMFuzzerCustomMutator(Data, Size, MaxSize, Rand.Rand());
73 size_t MutationDispatcher::Mutate_CustomCrossOver(uint8_t *Data, size_t Size,
75   if (Size == 0)
84       Data, Size, Other.data(), Other.size(), U.data(), U.size(), Rand.Rand());
92 size_t MutationDispatcher::Mutate_ShuffleBytes(uint8_t *Data, size_t Size,
94   if (Size > MaxSize || Size == 0) return 0;
96       Rand(std::min(Size, (size_t)8)) + 1; // [1,8] and <= Size.
97   size_t ShuffleStart = Rand(Size - ShuffleAmount);
98   assert(ShuffleStart + ShuffleAmount <= Size);
100   return Size;
103 size_t MutationDispatcher::Mutate_EraseBytes(uint8_t *Data, size_t Size,
105   if (Size <= 1) return 0;
106   size_t N = Rand(Size / 2) + 1;
107   assert(N < Size);
108   size_t Idx = Rand(Size - N + 1);
110   memmove(Data + Idx, Data + Idx + N, Size - Idx - N);
111   // Printf("Erase: %zd %zd => %zd; Idx %zd\n", N, Size, Size - N, Idx);
112   return Size - N;
115 size_t MutationDispatcher::Mutate_InsertByte(uint8_t *Data, size_t Size,
117   if (Size >= MaxSize) return 0;
118   size_t Idx = Rand(Size + 1);
120   memmove(Data + Idx + 1, Data + Idx, Size - Idx);
122   return Size + 1;
126                                                       size_t Size,
129   if (Size + kMinBytesToInsert >= MaxSize) return 0;
130   size_t MaxBytesToInsert = std::min(MaxSize - Size, (size_t)128);
132   assert(Size + N <= MaxSize && N);
133   size_t Idx = Rand(Size + 1);
135   memmove(Data + Idx + N, Data + Idx, Size - Idx);
140   return Size + N;
143 size_t MutationDispatcher::Mutate_ChangeByte(uint8_t *Data, size_t Size,
145   if (Size > MaxSize) return 0;
146   size_t Idx = Rand(Size);
148   return Size;
151 size_t MutationDispatcher::Mutate_ChangeBit(uint8_t *Data, size_t Size,
153   if (Size > MaxSize) return 0;
154   size_t Idx = Rand(Size);
156   return Size;
160                                                               size_t Size,
162   return AddWordFromDictionary(ManualDictionary, Data, Size, MaxSize);
165 size_t MutationDispatcher::ApplyDictionaryEntry(uint8_t *Data, size_t Size,
170                          DE.GetPositionHint() + W.size() < Size &&
173     if (Size + W.size() > MaxSize) return 0;
174     size_t Idx = UsePositionHint ? DE.GetPositionHint() : Rand(Size + 1);
175     memmove(Data + Idx + W.size(), Data + Idx, Size - Idx);
177     Size += W.size();
179     if (W.size() > Size) return 0;
180     size_t Idx = UsePositionHint ? DE.GetPositionHint() : Rand(Size - W.size());
183   return Size;
196     size_t Size) {
200   const uint8_t *End = Data + Size;
226     T Arg1, T Arg2, const uint8_t *Data, size_t Size) {
232                                     sizeof(Arg1), Data, Size);
236     const Word &Arg1, const Word &Arg2, const uint8_t *Data, size_t Size) {
238                                     Arg2.data(), Arg1.size(), Data, Size);
242     uint8_t *Data, size_t Size, size_t MaxSize) {
248     DE = MakeDictionaryEntryFromCMP(X.A, X.B, Data, Size);
253       DE = MakeDictionaryEntryFromCMP((uint16_t)X.A, (uint16_t)X.B, Data, Size);
255       DE = MakeDictionaryEntryFromCMP(X.A, X.B, Data, Size);
259     DE = MakeDictionaryEntryFromCMP(X.A, X.B, Data, Size);
269   Size = ApplyDictionaryEntry(Data, Size, MaxSize, DE);
270   if (!Size) return 0;
276   return Size;
280     uint8_t *Data, size_t Size, size_t MaxSize) {
281   return AddWordFromDictionary(PersistentAutoDictionary, Data, Size, MaxSize);
285                                                  size_t Size, size_t MaxSize) {
286   if (Size > MaxSize) return 0;
289   Size = ApplyDictionaryEntry(Data, Size, MaxSize, DE);
290   if (!Size) return 0;
293   return Size;
337 size_t MutationDispatcher::Mutate_CopyPart(uint8_t *Data, size_t Size,
339   if (Size > MaxSize || Size == 0) return 0;
340   // If Size == MaxSize, `InsertPartOf(...)` will
342   if (Size == MaxSize || Rand.RandBool())
343     return CopyPartOf(Data, Size, Data, Size);
345     return InsertPartOf(Data, Size, Data, Size, MaxSize);
348 size_t MutationDispatcher::Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size,
350   if (Size > MaxSize) return 0;
351   size_t B = Rand(Size);
352   while (B < Size && !isdigit(Data[B])) B++;
353   if (B == Size) return 0;
355   while (E < Size && isdigit(Data[E])) E++;
379   return Size;
383 size_t ChangeBinaryInteger(uint8_t *Data, size_t Size, Random &Rand) {
384   if (Size < sizeof(T)) return 0;
385   size_t Off = Rand(Size - sizeof(T) + 1);
386   assert(Off + sizeof(T) <= Size);
389     Val = Size;
404   return Size;
408                                                       size_t Size,
410   if (Size > MaxSize) return 0;
412     case 3: return ChangeBinaryInteger<uint64_t>(Data, Size, Rand);
413     case 2: return ChangeBinaryInteger<uint32_t>(Data, Size, Rand);
414     case 1: return ChangeBinaryInteger<uint16_t>(Data, Size, Rand);
415     case 0: return ChangeBinaryInteger<uint8_t>(Data, Size, Rand);
421 size_t MutationDispatcher::Mutate_CrossOver(uint8_t *Data, size_t Size,
423   if (Size > MaxSize) return 0;
424   if (Size == 0) return 0;
433       NewSize = CrossOver(Data, Size, O.data(), O.size(), U.data(), U.size());
497 size_t MutationDispatcher::Mutate(uint8_t *Data, size_t Size, size_t MaxSize) {
498   return MutateImpl(Data, Size, MaxSize, Mutators);
501 size_t MutationDispatcher::DefaultMutate(uint8_t *Data, size_t Size,
503   return MutateImpl(Data, Size, MaxSize, DefaultMutators);
507 size_t MutationDispatcher::MutateImpl(uint8_t *Data, size_t Size,
511   // Some mutations may fail (e.g. can't insert more bytes if Size == MaxSize),
516     size_t NewSize = (this->*(M.Fn))(Data, Size, MaxSize);
529 size_t MutationDispatcher::MutateWithMask(uint8_t *Data, size_t Size,
532   size_t MaskedSize = std::min(Size, Mask.size());
538   if (T.size() < Size)
539     T.resize(Size);
554   return Size;