1//===- FuzzerLoop.cpp - Fuzzer's main loop --------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8// Fuzzer's main loop.
9//===----------------------------------------------------------------------===//
10
11#include "FuzzerCorpus.h"
12#include "FuzzerIO.h"
13#include "FuzzerInternal.h"
14#include "FuzzerMutate.h"
15#include "FuzzerPlatform.h"
16#include "FuzzerRandom.h"
17#include "FuzzerTracePC.h"
18#include <algorithm>
19#include <cstring>
20#include <memory>
21#include <mutex>
22#include <set>
23
24#if defined(__has_include)
25#if __has_include(<sanitizer / lsan_interface.h>)
26#include <sanitizer/lsan_interface.h>
27#endif
28#endif
29
30#define NO_SANITIZE_MEMORY
31#if defined(__has_feature)
32#if __has_feature(memory_sanitizer)
33#undef NO_SANITIZE_MEMORY
34#define NO_SANITIZE_MEMORY __attribute__((no_sanitize_memory))
35#endif
36#endif
37
38namespace fuzzer {
39static const size_t kMaxUnitSizeToPrint = 256;
40
41thread_local bool Fuzzer::IsMyThread;
42
43bool RunningUserCallback = false;
44
45// Only one Fuzzer per process.
46static Fuzzer *F;
47
48// Leak detection is expensive, so we first check if there were more mallocs
49// than frees (using the sanitizer malloc hooks) and only then try to call lsan.
50struct MallocFreeTracer {
51  void Start(int TraceLevel) {
52    this->TraceLevel = TraceLevel;
53    if (TraceLevel)
54      Printf("MallocFreeTracer: START\n");
55    Mallocs = 0;
56    Frees = 0;
57  }
58  // Returns true if there were more mallocs than frees.
59  bool Stop() {
60    if (TraceLevel)
61      Printf("MallocFreeTracer: STOP %zd %zd (%s)\n", Mallocs.load(),
62             Frees.load(), Mallocs == Frees ? "same" : "DIFFERENT");
63    bool Result = Mallocs > Frees;
64    Mallocs = 0;
65    Frees = 0;
66    TraceLevel = 0;
67    return Result;
68  }
69  std::atomic<size_t> Mallocs;
70  std::atomic<size_t> Frees;
71  int TraceLevel = 0;
72
73  std::recursive_mutex TraceMutex;
74  bool TraceDisabled = false;
75};
76
77static MallocFreeTracer AllocTracer;
78
79// Locks printing and avoids nested hooks triggered from mallocs/frees in
80// sanitizer.
81class TraceLock {
82public:
83  TraceLock() : Lock(AllocTracer.TraceMutex) {
84    AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled;
85  }
86  ~TraceLock() { AllocTracer.TraceDisabled = !AllocTracer.TraceDisabled; }
87
88  bool IsDisabled() const {
89    // This is already inverted value.
90    return !AllocTracer.TraceDisabled;
91  }
92
93private:
94  std::lock_guard<std::recursive_mutex> Lock;
95};
96
97ATTRIBUTE_NO_SANITIZE_MEMORY
98void MallocHook(const volatile void *ptr, size_t size) {
99  size_t N = AllocTracer.Mallocs++;
100  F->HandleMalloc(size);
101  if (int TraceLevel = AllocTracer.TraceLevel) {
102    TraceLock Lock;
103    if (Lock.IsDisabled())
104      return;
105    Printf("MALLOC[%zd] %p %zd\n", N, ptr, size);
106    if (TraceLevel >= 2 && EF)
107      PrintStackTrace();
108  }
109}
110
111ATTRIBUTE_NO_SANITIZE_MEMORY
112void FreeHook(const volatile void *ptr) {
113  size_t N = AllocTracer.Frees++;
114  if (int TraceLevel = AllocTracer.TraceLevel) {
115    TraceLock Lock;
116    if (Lock.IsDisabled())
117      return;
118    Printf("FREE[%zd]   %p\n", N, ptr);
119    if (TraceLevel >= 2 && EF)
120      PrintStackTrace();
121  }
122}
123
124// Crash on a single malloc that exceeds the rss limit.
125void Fuzzer::HandleMalloc(size_t Size) {
126  if (!Options.MallocLimitMb || (Size >> 20) < (size_t)Options.MallocLimitMb)
127    return;
128  Printf("==%d== ERROR: libFuzzer: out-of-memory (malloc(%zd))\n", GetPid(),
129         Size);
130  Printf("   To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
131  PrintStackTrace();
132  DumpCurrentUnit("oom-");
133  Printf("SUMMARY: libFuzzer: out-of-memory\n");
134  PrintFinalStats();
135  _Exit(Options.OOMExitCode); // Stop right now.
136}
137
138Fuzzer::Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD,
139               FuzzingOptions Options)
140    : CB(CB), Corpus(Corpus), MD(MD), Options(Options) {
141  if (EF->__sanitizer_set_death_callback)
142    EF->__sanitizer_set_death_callback(StaticDeathCallback);
143  assert(!F);
144  F = this;
145  TPC.ResetMaps();
146  IsMyThread = true;
147  if (Options.DetectLeaks && EF->__sanitizer_install_malloc_and_free_hooks)
148    EF->__sanitizer_install_malloc_and_free_hooks(MallocHook, FreeHook);
149  TPC.SetUseCounters(Options.UseCounters);
150  TPC.SetUseValueProfileMask(Options.UseValueProfile);
151
152  if (Options.Verbosity)
153    TPC.PrintModuleInfo();
154  if (!Options.OutputCorpus.empty() && Options.ReloadIntervalSec)
155    EpochOfLastReadOfOutputCorpus = GetEpoch(Options.OutputCorpus);
156  MaxInputLen = MaxMutationLen = Options.MaxLen;
157  TmpMaxMutationLen = 0;  // Will be set once we load the corpus.
158  AllocateCurrentUnitData();
159  CurrentUnitSize = 0;
160  memset(BaseSha1, 0, sizeof(BaseSha1));
161}
162
163Fuzzer::~Fuzzer() {}
164
165void Fuzzer::AllocateCurrentUnitData() {
166  if (CurrentUnitData || MaxInputLen == 0)
167    return;
168  CurrentUnitData = new uint8_t[MaxInputLen];
169}
170
171void Fuzzer::StaticDeathCallback() {
172  assert(F);
173  F->DeathCallback();
174}
175
176void Fuzzer::DumpCurrentUnit(const char *Prefix) {
177  if (!CurrentUnitData)
178    return; // Happens when running individual inputs.
179  ScopedDisableMsanInterceptorChecks S;
180  MD.PrintMutationSequence();
181  Printf("; base unit: %s\n", Sha1ToString(BaseSha1).c_str());
182  size_t UnitSize = CurrentUnitSize;
183  if (UnitSize <= kMaxUnitSizeToPrint) {
184    PrintHexArray(CurrentUnitData, UnitSize, "\n");
185    PrintASCII(CurrentUnitData, UnitSize, "\n");
186  }
187  WriteUnitToFileWithPrefix({CurrentUnitData, CurrentUnitData + UnitSize},
188                            Prefix);
189}
190
191NO_SANITIZE_MEMORY
192void Fuzzer::DeathCallback() {
193  DumpCurrentUnit("crash-");
194  PrintFinalStats();
195}
196
197void Fuzzer::StaticAlarmCallback() {
198  assert(F);
199  F->AlarmCallback();
200}
201
202void Fuzzer::StaticCrashSignalCallback() {
203  assert(F);
204  F->CrashCallback();
205}
206
207void Fuzzer::StaticExitCallback() {
208  assert(F);
209  F->ExitCallback();
210}
211
212void Fuzzer::StaticInterruptCallback() {
213  assert(F);
214  F->InterruptCallback();
215}
216
217void Fuzzer::StaticGracefulExitCallback() {
218  assert(F);
219  F->GracefulExitRequested = true;
220  Printf("INFO: signal received, trying to exit gracefully\n");
221}
222
223void Fuzzer::StaticFileSizeExceedCallback() {
224  Printf("==%lu== ERROR: libFuzzer: file size exceeded\n", GetPid());
225  exit(1);
226}
227
228void Fuzzer::CrashCallback() {
229  if (EF->__sanitizer_acquire_crash_state &&
230      !EF->__sanitizer_acquire_crash_state())
231    return;
232  Printf("==%lu== ERROR: libFuzzer: deadly signal\n", GetPid());
233  PrintStackTrace();
234  Printf("NOTE: libFuzzer has rudimentary signal handlers.\n"
235         "      Combine libFuzzer with AddressSanitizer or similar for better "
236         "crash reports.\n");
237  Printf("SUMMARY: libFuzzer: deadly signal\n");
238  DumpCurrentUnit("crash-");
239  PrintFinalStats();
240  _Exit(Options.ErrorExitCode); // Stop right now.
241}
242
243void Fuzzer::ExitCallback() {
244  if (!RunningUserCallback)
245    return; // This exit did not come from the user callback
246  if (EF->__sanitizer_acquire_crash_state &&
247      !EF->__sanitizer_acquire_crash_state())
248    return;
249  Printf("==%lu== ERROR: libFuzzer: fuzz target exited\n", GetPid());
250  PrintStackTrace();
251  Printf("SUMMARY: libFuzzer: fuzz target exited\n");
252  DumpCurrentUnit("crash-");
253  PrintFinalStats();
254  _Exit(Options.ErrorExitCode);
255}
256
257void Fuzzer::MaybeExitGracefully() {
258  if (!F->GracefulExitRequested) return;
259  Printf("==%lu== INFO: libFuzzer: exiting as requested\n", GetPid());
260  RmDirRecursive(TempPath("FuzzWithFork", ".dir"));
261  F->PrintFinalStats();
262  _Exit(0);
263}
264
265void Fuzzer::InterruptCallback() {
266  Printf("==%lu== libFuzzer: run interrupted; exiting\n", GetPid());
267  PrintFinalStats();
268  ScopedDisableMsanInterceptorChecks S; // RmDirRecursive may call opendir().
269  RmDirRecursive(TempPath("FuzzWithFork", ".dir"));
270  // Stop right now, don't perform any at-exit actions.
271  _Exit(Options.InterruptExitCode);
272}
273
274NO_SANITIZE_MEMORY
275void Fuzzer::AlarmCallback() {
276  assert(Options.UnitTimeoutSec > 0);
277  // In Windows and Fuchsia, Alarm callback is executed by a different thread.
278  // NetBSD's current behavior needs this change too.
279#if !LIBFUZZER_WINDOWS && !LIBFUZZER_NETBSD && !LIBFUZZER_FUCHSIA
280  if (!InFuzzingThread())
281    return;
282#endif
283  if (!RunningUserCallback)
284    return; // We have not started running units yet.
285  size_t Seconds =
286      duration_cast<seconds>(system_clock::now() - UnitStartTime).count();
287  if (Seconds == 0)
288    return;
289  if (Options.Verbosity >= 2)
290    Printf("AlarmCallback %zd\n", Seconds);
291  if (Seconds >= (size_t)Options.UnitTimeoutSec) {
292    if (EF->__sanitizer_acquire_crash_state &&
293        !EF->__sanitizer_acquire_crash_state())
294      return;
295    Printf("ALARM: working on the last Unit for %zd seconds\n", Seconds);
296    Printf("       and the timeout value is %d (use -timeout=N to change)\n",
297           Options.UnitTimeoutSec);
298    DumpCurrentUnit("timeout-");
299    Printf("==%lu== ERROR: libFuzzer: timeout after %d seconds\n", GetPid(),
300           Seconds);
301    PrintStackTrace();
302    Printf("SUMMARY: libFuzzer: timeout\n");
303    PrintFinalStats();
304    _Exit(Options.TimeoutExitCode); // Stop right now.
305  }
306}
307
308void Fuzzer::RssLimitCallback() {
309  if (EF->__sanitizer_acquire_crash_state &&
310      !EF->__sanitizer_acquire_crash_state())
311    return;
312  Printf(
313      "==%lu== ERROR: libFuzzer: out-of-memory (used: %zdMb; limit: %zdMb)\n",
314      GetPid(), GetPeakRSSMb(), Options.RssLimitMb);
315  Printf("   To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
316  PrintMemoryProfile();
317  DumpCurrentUnit("oom-");
318  Printf("SUMMARY: libFuzzer: out-of-memory\n");
319  PrintFinalStats();
320  _Exit(Options.OOMExitCode); // Stop right now.
321}
322
323void Fuzzer::PrintStats(const char *Where, const char *End, size_t Units,
324                        size_t Features) {
325  size_t ExecPerSec = execPerSec();
326  if (!Options.Verbosity)
327    return;
328  Printf("#%zd\t%s", TotalNumberOfRuns, Where);
329  if (size_t N = TPC.GetTotalPCCoverage())
330    Printf(" cov: %zd", N);
331  if (size_t N = Features ? Features : Corpus.NumFeatures())
332    Printf(" ft: %zd", N);
333  if (!Corpus.empty()) {
334    Printf(" corp: %zd", Corpus.NumActiveUnits());
335    if (size_t N = Corpus.SizeInBytes()) {
336      if (N < (1 << 14))
337        Printf("/%zdb", N);
338      else if (N < (1 << 24))
339        Printf("/%zdKb", N >> 10);
340      else
341        Printf("/%zdMb", N >> 20);
342    }
343    if (size_t FF = Corpus.NumInputsThatTouchFocusFunction())
344      Printf(" focus: %zd", FF);
345  }
346  if (TmpMaxMutationLen)
347    Printf(" lim: %zd", TmpMaxMutationLen);
348  if (Units)
349    Printf(" units: %zd", Units);
350
351  Printf(" exec/s: %zd", ExecPerSec);
352  Printf(" rss: %zdMb", GetPeakRSSMb());
353  Printf("%s", End);
354}
355
356void Fuzzer::PrintFinalStats() {
357  if (Options.PrintCoverage)
358    TPC.PrintCoverage();
359  if (Options.PrintCorpusStats)
360    Corpus.PrintStats();
361  if (!Options.PrintFinalStats)
362    return;
363  size_t ExecPerSec = execPerSec();
364  Printf("stat::number_of_executed_units: %zd\n", TotalNumberOfRuns);
365  Printf("stat::average_exec_per_sec:     %zd\n", ExecPerSec);
366  Printf("stat::new_units_added:          %zd\n", NumberOfNewUnitsAdded);
367  Printf("stat::slowest_unit_time_sec:    %zd\n", TimeOfLongestUnitInSeconds);
368  Printf("stat::peak_rss_mb:              %zd\n", GetPeakRSSMb());
369}
370
371void Fuzzer::SetMaxInputLen(size_t MaxInputLen) {
372  assert(this->MaxInputLen == 0); // Can only reset MaxInputLen from 0 to non-0.
373  assert(MaxInputLen);
374  this->MaxInputLen = MaxInputLen;
375  this->MaxMutationLen = MaxInputLen;
376  AllocateCurrentUnitData();
377  Printf("INFO: -max_len is not provided; "
378         "libFuzzer will not generate inputs larger than %zd bytes\n",
379         MaxInputLen);
380}
381
382void Fuzzer::SetMaxMutationLen(size_t MaxMutationLen) {
383  assert(MaxMutationLen && MaxMutationLen <= MaxInputLen);
384  this->MaxMutationLen = MaxMutationLen;
385}
386
387void Fuzzer::CheckExitOnSrcPosOrItem() {
388  if (!Options.ExitOnSrcPos.empty()) {
389    static auto *PCsSet = new Set<uintptr_t>;
390    auto HandlePC = [&](const TracePC::PCTableEntry *TE) {
391      if (!PCsSet->insert(TE->PC).second)
392        return;
393      std::string Descr = DescribePC("%F %L", TE->PC + 1);
394      if (Descr.find(Options.ExitOnSrcPos) != std::string::npos) {
395        Printf("INFO: found line matching '%s', exiting.\n",
396               Options.ExitOnSrcPos.c_str());
397        _Exit(0);
398      }
399    };
400    TPC.ForEachObservedPC(HandlePC);
401  }
402  if (!Options.ExitOnItem.empty()) {
403    if (Corpus.HasUnit(Options.ExitOnItem)) {
404      Printf("INFO: found item with checksum '%s', exiting.\n",
405             Options.ExitOnItem.c_str());
406      _Exit(0);
407    }
408  }
409}
410
411void Fuzzer::RereadOutputCorpus(size_t MaxSize) {
412  if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec)
413    return;
414  Vector<Unit> AdditionalCorpus;
415  ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus,
416                         &EpochOfLastReadOfOutputCorpus, MaxSize,
417                         /*ExitOnError*/ false);
418  if (Options.Verbosity >= 2)
419    Printf("Reload: read %zd new units.\n", AdditionalCorpus.size());
420  bool Reloaded = false;
421  for (auto &U : AdditionalCorpus) {
422    if (U.size() > MaxSize)
423      U.resize(MaxSize);
424    if (!Corpus.HasUnit(U)) {
425      if (RunOne(U.data(), U.size())) {
426        CheckExitOnSrcPosOrItem();
427        Reloaded = true;
428      }
429    }
430  }
431  if (Reloaded)
432    PrintStats("RELOAD");
433}
434
435void Fuzzer::PrintPulseAndReportSlowInput(const uint8_t *Data, size_t Size) {
436  auto TimeOfUnit =
437      duration_cast<seconds>(UnitStopTime - UnitStartTime).count();
438  if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) &&
439      secondsSinceProcessStartUp() >= 2)
440    PrintStats("pulse ");
441  if (TimeOfUnit > TimeOfLongestUnitInSeconds * 1.1 &&
442      TimeOfUnit >= Options.ReportSlowUnits) {
443    TimeOfLongestUnitInSeconds = TimeOfUnit;
444    Printf("Slowest unit: %zd s:\n", TimeOfLongestUnitInSeconds);
445    WriteUnitToFileWithPrefix({Data, Data + Size}, "slow-unit-");
446  }
447}
448
449static void WriteFeatureSetToFile(const std::string &FeaturesDir,
450                                  const std::string &FileName,
451                                  const Vector<uint32_t> &FeatureSet) {
452  if (FeaturesDir.empty() || FeatureSet.empty()) return;
453  WriteToFile(reinterpret_cast<const uint8_t *>(FeatureSet.data()),
454              FeatureSet.size() * sizeof(FeatureSet[0]),
455              DirPlusFile(FeaturesDir, FileName));
456}
457
458static void RenameFeatureSetFile(const std::string &FeaturesDir,
459                                 const std::string &OldFile,
460                                 const std::string &NewFile) {
461  if (FeaturesDir.empty()) return;
462  RenameFile(DirPlusFile(FeaturesDir, OldFile),
463             DirPlusFile(FeaturesDir, NewFile));
464}
465
466bool Fuzzer::RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile,
467                    InputInfo *II, bool *FoundUniqFeatures) {
468  if (!Size)
469    return false;
470
471  ExecuteCallback(Data, Size);
472
473  UniqFeatureSetTmp.clear();
474  size_t FoundUniqFeaturesOfII = 0;
475  size_t NumUpdatesBefore = Corpus.NumFeatureUpdates();
476  TPC.CollectFeatures([&](size_t Feature) {
477    if (Corpus.AddFeature(Feature, Size, Options.Shrink))
478      UniqFeatureSetTmp.push_back(Feature);
479    if (Options.Entropic)
480      Corpus.UpdateFeatureFrequency(II, Feature);
481    if (Options.ReduceInputs && II)
482      if (std::binary_search(II->UniqFeatureSet.begin(),
483                             II->UniqFeatureSet.end(), Feature))
484        FoundUniqFeaturesOfII++;
485  });
486  if (FoundUniqFeatures)
487    *FoundUniqFeatures = FoundUniqFeaturesOfII;
488  PrintPulseAndReportSlowInput(Data, Size);
489  size_t NumNewFeatures = Corpus.NumFeatureUpdates() - NumUpdatesBefore;
490  if (NumNewFeatures) {
491    TPC.UpdateObservedPCs();
492    auto NewII = Corpus.AddToCorpus({Data, Data + Size}, NumNewFeatures,
493                                    MayDeleteFile, TPC.ObservedFocusFunction(),
494                                    UniqFeatureSetTmp, DFT, II);
495    WriteFeatureSetToFile(Options.FeaturesDir, Sha1ToString(NewII->Sha1),
496                          NewII->UniqFeatureSet);
497    return true;
498  }
499  if (II && FoundUniqFeaturesOfII &&
500      II->DataFlowTraceForFocusFunction.empty() &&
501      FoundUniqFeaturesOfII == II->UniqFeatureSet.size() &&
502      II->U.size() > Size) {
503    auto OldFeaturesFile = Sha1ToString(II->Sha1);
504    Corpus.Replace(II, {Data, Data + Size});
505    RenameFeatureSetFile(Options.FeaturesDir, OldFeaturesFile,
506                         Sha1ToString(II->Sha1));
507    return true;
508  }
509  return false;
510}
511
512size_t Fuzzer::GetCurrentUnitInFuzzingThead(const uint8_t **Data) const {
513  assert(InFuzzingThread());
514  *Data = CurrentUnitData;
515  return CurrentUnitSize;
516}
517
518void Fuzzer::CrashOnOverwrittenData() {
519  Printf("==%d== ERROR: libFuzzer: fuzz target overwrites its const input\n",
520         GetPid());
521  PrintStackTrace();
522  Printf("SUMMARY: libFuzzer: overwrites-const-input\n");
523  DumpCurrentUnit("crash-");
524  PrintFinalStats();
525  _Exit(Options.ErrorExitCode); // Stop right now.
526}
527
528// Compare two arrays, but not all bytes if the arrays are large.
529static bool LooseMemeq(const uint8_t *A, const uint8_t *B, size_t Size) {
530  const size_t Limit = 64;
531  if (Size <= 64)
532    return !memcmp(A, B, Size);
533  // Compare first and last Limit/2 bytes.
534  return !memcmp(A, B, Limit / 2) &&
535         !memcmp(A + Size - Limit / 2, B + Size - Limit / 2, Limit / 2);
536}
537
538void Fuzzer::ExecuteCallback(const uint8_t *Data, size_t Size) {
539  TPC.RecordInitialStack();
540  TotalNumberOfRuns++;
541  assert(InFuzzingThread());
542  // We copy the contents of Unit into a separate heap buffer
543  // so that we reliably find buffer overflows in it.
544  uint8_t *DataCopy = new uint8_t[Size];
545  memcpy(DataCopy, Data, Size);
546  if (EF->__msan_unpoison)
547    EF->__msan_unpoison(DataCopy, Size);
548  if (EF->__msan_unpoison_param)
549    EF->__msan_unpoison_param(2);
550  if (CurrentUnitData && CurrentUnitData != Data)
551    memcpy(CurrentUnitData, Data, Size);
552  CurrentUnitSize = Size;
553  {
554    ScopedEnableMsanInterceptorChecks S;
555    AllocTracer.Start(Options.TraceMalloc);
556    UnitStartTime = system_clock::now();
557    TPC.ResetMaps();
558    RunningUserCallback = true;
559    int Res = CB(DataCopy, Size);
560    RunningUserCallback = false;
561    UnitStopTime = system_clock::now();
562    (void)Res;
563    assert(Res == 0);
564    HasMoreMallocsThanFrees = AllocTracer.Stop();
565  }
566  if (!LooseMemeq(DataCopy, Data, Size))
567    CrashOnOverwrittenData();
568  CurrentUnitSize = 0;
569  delete[] DataCopy;
570}
571
572std::string Fuzzer::WriteToOutputCorpus(const Unit &U) {
573  if (Options.OnlyASCII)
574    assert(IsASCII(U));
575  if (Options.OutputCorpus.empty())
576    return "";
577  std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U));
578  WriteToFile(U, Path);
579  if (Options.Verbosity >= 2)
580    Printf("Written %zd bytes to %s\n", U.size(), Path.c_str());
581  return Path;
582}
583
584void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) {
585  if (!Options.SaveArtifacts)
586    return;
587  std::string Path = Options.ArtifactPrefix + Prefix + Hash(U);
588  if (!Options.ExactArtifactPath.empty())
589    Path = Options.ExactArtifactPath; // Overrides ArtifactPrefix.
590  WriteToFile(U, Path);
591  Printf("artifact_prefix='%s'; Test unit written to %s\n",
592         Options.ArtifactPrefix.c_str(), Path.c_str());
593  if (U.size() <= kMaxUnitSizeToPrint)
594    Printf("Base64: %s\n", Base64(U).c_str());
595}
596
597void Fuzzer::PrintStatusForNewUnit(const Unit &U, const char *Text) {
598  if (!Options.PrintNEW)
599    return;
600  PrintStats(Text, "");
601  if (Options.Verbosity) {
602    Printf(" L: %zd/%zd ", U.size(), Corpus.MaxInputSize());
603    MD.PrintMutationSequence();
604    Printf("\n");
605  }
606}
607
608void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) {
609  II->NumSuccessfullMutations++;
610  MD.RecordSuccessfulMutationSequence();
611  PrintStatusForNewUnit(U, II->Reduced ? "REDUCE" : "NEW   ");
612  WriteToOutputCorpus(U);
613  NumberOfNewUnitsAdded++;
614  CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus.
615  LastCorpusUpdateRun = TotalNumberOfRuns;
616}
617
618// Tries detecting a memory leak on the particular input that we have just
619// executed before calling this function.
620void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
621                                     bool DuringInitialCorpusExecution) {
622  if (!HasMoreMallocsThanFrees)
623    return; // mallocs==frees, a leak is unlikely.
624  if (!Options.DetectLeaks)
625    return;
626  if (!DuringInitialCorpusExecution &&
627      TotalNumberOfRuns >= Options.MaxNumberOfRuns)
628    return;
629  if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) ||
630      !(EF->__lsan_do_recoverable_leak_check))
631    return; // No lsan.
632  // Run the target once again, but with lsan disabled so that if there is
633  // a real leak we do not report it twice.
634  EF->__lsan_disable();
635  ExecuteCallback(Data, Size);
636  EF->__lsan_enable();
637  if (!HasMoreMallocsThanFrees)
638    return; // a leak is unlikely.
639  if (NumberOfLeakDetectionAttempts++ > 1000) {
640    Options.DetectLeaks = false;
641    Printf("INFO: libFuzzer disabled leak detection after every mutation.\n"
642           "      Most likely the target function accumulates allocated\n"
643           "      memory in a global state w/o actually leaking it.\n"
644           "      You may try running this binary with -trace_malloc=[12]"
645           "      to get a trace of mallocs and frees.\n"
646           "      If LeakSanitizer is enabled in this process it will still\n"
647           "      run on the process shutdown.\n");
648    return;
649  }
650  // Now perform the actual lsan pass. This is expensive and we must ensure
651  // we don't call it too often.
652  if (EF->__lsan_do_recoverable_leak_check()) { // Leak is found, report it.
653    if (DuringInitialCorpusExecution)
654      Printf("\nINFO: a leak has been found in the initial corpus.\n\n");
655    Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n");
656    CurrentUnitSize = Size;
657    DumpCurrentUnit("leak-");
658    PrintFinalStats();
659    _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on.
660  }
661}
662
663void Fuzzer::MutateAndTestOne() {
664  MD.StartMutationSequence();
665
666  auto &II = Corpus.ChooseUnitToMutate(MD.GetRand());
667  if (Options.DoCrossOver)
668    MD.SetCrossOverWith(&Corpus.ChooseUnitToMutate(MD.GetRand()).U);
669  const auto &U = II.U;
670  memcpy(BaseSha1, II.Sha1, sizeof(BaseSha1));
671  assert(CurrentUnitData);
672  size_t Size = U.size();
673  assert(Size <= MaxInputLen && "Oversized Unit");
674  memcpy(CurrentUnitData, U.data(), Size);
675
676  assert(MaxMutationLen > 0);
677
678  size_t CurrentMaxMutationLen =
679      Min(MaxMutationLen, Max(U.size(), TmpMaxMutationLen));
680  assert(CurrentMaxMutationLen > 0);
681
682  for (int i = 0; i < Options.MutateDepth; i++) {
683    if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
684      break;
685    MaybeExitGracefully();
686    size_t NewSize = 0;
687    if (II.HasFocusFunction && !II.DataFlowTraceForFocusFunction.empty() &&
688        Size <= CurrentMaxMutationLen)
689      NewSize = MD.MutateWithMask(CurrentUnitData, Size, Size,
690                                  II.DataFlowTraceForFocusFunction);
691
692    // If MutateWithMask either failed or wasn't called, call default Mutate.
693    if (!NewSize)
694      NewSize = MD.Mutate(CurrentUnitData, Size, CurrentMaxMutationLen);
695    assert(NewSize > 0 && "Mutator returned empty unit");
696    assert(NewSize <= CurrentMaxMutationLen && "Mutator return oversized unit");
697    Size = NewSize;
698    II.NumExecutedMutations++;
699    Corpus.IncrementNumExecutedMutations();
700
701    bool FoundUniqFeatures = false;
702    bool NewCov = RunOne(CurrentUnitData, Size, /*MayDeleteFile=*/true, &II,
703                         &FoundUniqFeatures);
704    TryDetectingAMemoryLeak(CurrentUnitData, Size,
705                            /*DuringInitialCorpusExecution*/ false);
706    if (NewCov) {
707      ReportNewCoverage(&II, {CurrentUnitData, CurrentUnitData + Size});
708      break;  // We will mutate this input more in the next rounds.
709    }
710    if (Options.ReduceDepth && !FoundUniqFeatures)
711      break;
712  }
713
714  II.NeedsEnergyUpdate = true;
715}
716
717void Fuzzer::PurgeAllocator() {
718  if (Options.PurgeAllocatorIntervalSec < 0 || !EF->__sanitizer_purge_allocator)
719    return;
720  if (duration_cast<seconds>(system_clock::now() -
721                             LastAllocatorPurgeAttemptTime)
722          .count() < Options.PurgeAllocatorIntervalSec)
723    return;
724
725  if (Options.RssLimitMb <= 0 ||
726      GetPeakRSSMb() > static_cast<size_t>(Options.RssLimitMb) / 2)
727    EF->__sanitizer_purge_allocator();
728
729  LastAllocatorPurgeAttemptTime = system_clock::now();
730}
731
732void Fuzzer::ReadAndExecuteSeedCorpora(Vector<SizedFile> &CorporaFiles) {
733  const size_t kMaxSaneLen = 1 << 20;
734  const size_t kMinDefaultLen = 4096;
735  size_t MaxSize = 0;
736  size_t MinSize = -1;
737  size_t TotalSize = 0;
738  for (auto &File : CorporaFiles) {
739    MaxSize = Max(File.Size, MaxSize);
740    MinSize = Min(File.Size, MinSize);
741    TotalSize += File.Size;
742  }
743  if (Options.MaxLen == 0)
744    SetMaxInputLen(std::min(std::max(kMinDefaultLen, MaxSize), kMaxSaneLen));
745  assert(MaxInputLen > 0);
746
747  // Test the callback with empty input and never try it again.
748  uint8_t dummy = 0;
749  ExecuteCallback(&dummy, 0);
750
751  if (CorporaFiles.empty()) {
752    Printf("INFO: A corpus is not provided, starting from an empty corpus\n");
753    Unit U({'\n'}); // Valid ASCII input.
754    RunOne(U.data(), U.size());
755  } else {
756    Printf("INFO: seed corpus: files: %zd min: %zdb max: %zdb total: %zdb"
757           " rss: %zdMb\n",
758           CorporaFiles.size(), MinSize, MaxSize, TotalSize, GetPeakRSSMb());
759    if (Options.ShuffleAtStartUp)
760      std::shuffle(CorporaFiles.begin(), CorporaFiles.end(), MD.GetRand());
761
762    if (Options.PreferSmall) {
763      std::stable_sort(CorporaFiles.begin(), CorporaFiles.end());
764      assert(CorporaFiles.front().Size <= CorporaFiles.back().Size);
765    }
766
767    // Load and execute inputs one by one.
768    for (auto &SF : CorporaFiles) {
769      auto U = FileToVector(SF.File, MaxInputLen, /*ExitOnError=*/false);
770      assert(U.size() <= MaxInputLen);
771      RunOne(U.data(), U.size());
772      CheckExitOnSrcPosOrItem();
773      TryDetectingAMemoryLeak(U.data(), U.size(),
774                              /*DuringInitialCorpusExecution*/ true);
775    }
776  }
777
778  PrintStats("INITED");
779  if (!Options.FocusFunction.empty()) {
780    Printf("INFO: %zd/%zd inputs touch the focus function\n",
781           Corpus.NumInputsThatTouchFocusFunction(), Corpus.size());
782    if (!Options.DataFlowTrace.empty())
783      Printf("INFO: %zd/%zd inputs have the Data Flow Trace\n",
784             Corpus.NumInputsWithDataFlowTrace(),
785             Corpus.NumInputsThatTouchFocusFunction());
786  }
787
788  if (Corpus.empty() && Options.MaxNumberOfRuns) {
789    Printf("ERROR: no interesting inputs were found. "
790           "Is the code instrumented for coverage? Exiting.\n");
791    exit(1);
792  }
793}
794
795void Fuzzer::Loop(Vector<SizedFile> &CorporaFiles) {
796  auto FocusFunctionOrAuto = Options.FocusFunction;
797  DFT.Init(Options.DataFlowTrace, &FocusFunctionOrAuto, CorporaFiles,
798           MD.GetRand());
799  TPC.SetFocusFunction(FocusFunctionOrAuto);
800  ReadAndExecuteSeedCorpora(CorporaFiles);
801  DFT.Clear();  // No need for DFT any more.
802  TPC.SetPrintNewPCs(Options.PrintNewCovPcs);
803  TPC.SetPrintNewFuncs(Options.PrintNewCovFuncs);
804  system_clock::time_point LastCorpusReload = system_clock::now();
805
806  TmpMaxMutationLen =
807      Min(MaxMutationLen, Max(size_t(4), Corpus.MaxInputSize()));
808
809  while (true) {
810    auto Now = system_clock::now();
811    if (!Options.StopFile.empty() &&
812        !FileToVector(Options.StopFile, 1, false).empty())
813      break;
814    if (duration_cast<seconds>(Now - LastCorpusReload).count() >=
815        Options.ReloadIntervalSec) {
816      RereadOutputCorpus(MaxInputLen);
817      LastCorpusReload = system_clock::now();
818    }
819    if (TotalNumberOfRuns >= Options.MaxNumberOfRuns)
820      break;
821    if (TimedOut())
822      break;
823
824    // Update TmpMaxMutationLen
825    if (Options.LenControl) {
826      if (TmpMaxMutationLen < MaxMutationLen &&
827          TotalNumberOfRuns - LastCorpusUpdateRun >
828              Options.LenControl * Log(TmpMaxMutationLen)) {
829        TmpMaxMutationLen =
830            Min(MaxMutationLen, TmpMaxMutationLen + Log(TmpMaxMutationLen));
831        LastCorpusUpdateRun = TotalNumberOfRuns;
832      }
833    } else {
834      TmpMaxMutationLen = MaxMutationLen;
835    }
836
837    // Perform several mutations and runs.
838    MutateAndTestOne();
839
840    PurgeAllocator();
841  }
842
843  PrintStats("DONE  ", "\n");
844  MD.PrintRecommendedDictionary();
845}
846
847void Fuzzer::MinimizeCrashLoop(const Unit &U) {
848  if (U.size() <= 1)
849    return;
850  while (!TimedOut() && TotalNumberOfRuns < Options.MaxNumberOfRuns) {
851    MD.StartMutationSequence();
852    memcpy(CurrentUnitData, U.data(), U.size());
853    for (int i = 0; i < Options.MutateDepth; i++) {
854      size_t NewSize = MD.Mutate(CurrentUnitData, U.size(), MaxMutationLen);
855      assert(NewSize > 0 && NewSize <= MaxMutationLen);
856      ExecuteCallback(CurrentUnitData, NewSize);
857      PrintPulseAndReportSlowInput(CurrentUnitData, NewSize);
858      TryDetectingAMemoryLeak(CurrentUnitData, NewSize,
859                              /*DuringInitialCorpusExecution*/ false);
860    }
861  }
862}
863
864} // namespace fuzzer
865
866extern "C" {
867
868ATTRIBUTE_INTERFACE size_t
869LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
870  assert(fuzzer::F);
871  return fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize);
872}
873
874} // extern "C"
875