1//===- FuzzerMutate.h - Internal header for the Fuzzer ----------*- C++ -* ===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9// fuzzer::MutationDispatcher
10//===----------------------------------------------------------------------===//
11
12#ifndef LLVM_FUZZER_MUTATE_H
13#define LLVM_FUZZER_MUTATE_H
14
15#include "FuzzerDefs.h"
16#include "FuzzerDictionary.h"
17#include "FuzzerOptions.h"
18#include "FuzzerRandom.h"
19
20namespace fuzzer {
21
22class MutationDispatcher {
23public:
24  MutationDispatcher(Random &Rand, const FuzzingOptions &Options);
25  ~MutationDispatcher() {}
26  /// Indicate that we are about to start a new sequence of mutations.
27  void StartMutationSequence();
28  /// Print the current sequence of mutations.
29  void PrintMutationSequence();
30  /// Indicate that the current sequence of mutations was successful.
31  void RecordSuccessfulMutationSequence();
32  /// Mutates data by invoking user-provided mutator.
33  size_t Mutate_Custom(uint8_t *Data, size_t Size, size_t MaxSize);
34  /// Mutates data by invoking user-provided crossover.
35  size_t Mutate_CustomCrossOver(uint8_t *Data, size_t Size, size_t MaxSize);
36  /// Mutates data by shuffling bytes.
37  size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize);
38  /// Mutates data by erasing bytes.
39  size_t Mutate_EraseBytes(uint8_t *Data, size_t Size, size_t MaxSize);
40  /// Mutates data by inserting a byte.
41  size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize);
42  /// Mutates data by inserting several repeated bytes.
43  size_t Mutate_InsertRepeatedBytes(uint8_t *Data, size_t Size, size_t MaxSize);
44  /// Mutates data by chanding one byte.
45  size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize);
46  /// Mutates data by chanding one bit.
47  size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize);
48  /// Mutates data by copying/inserting a part of data into a different place.
49  size_t Mutate_CopyPart(uint8_t *Data, size_t Size, size_t MaxSize);
50
51  /// Mutates data by adding a word from the manual dictionary.
52  size_t Mutate_AddWordFromManualDictionary(uint8_t *Data, size_t Size,
53                                            size_t MaxSize);
54
55  /// Mutates data by adding a word from the TORC.
56  size_t Mutate_AddWordFromTORC(uint8_t *Data, size_t Size, size_t MaxSize);
57
58  /// Mutates data by adding a word from the persistent automatic dictionary.
59  size_t Mutate_AddWordFromPersistentAutoDictionary(uint8_t *Data, size_t Size,
60                                                    size_t MaxSize);
61
62  /// Tries to find an ASCII integer in Data, changes it to another ASCII int.
63  size_t Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MaxSize);
64  /// Change a 1-, 2-, 4-, or 8-byte integer in interesting ways.
65  size_t Mutate_ChangeBinaryInteger(uint8_t *Data, size_t Size, size_t MaxSize);
66
67  /// CrossOver Data with some other element of the corpus.
68  size_t Mutate_CrossOver(uint8_t *Data, size_t Size, size_t MaxSize);
69
70  /// Applies one of the configured mutations.
71  /// Returns the new size of data which could be up to MaxSize.
72  size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize);
73
74  /// Applies one of the configured mutations to the bytes of Data
75  /// that have '1' in Mask.
76  /// Mask.size() should be >= Size.
77  size_t MutateWithMask(uint8_t *Data, size_t Size, size_t MaxSize,
78                        const Vector<uint8_t> &Mask);
79
80  /// Applies one of the default mutations. Provided as a service
81  /// to mutation authors.
82  size_t DefaultMutate(uint8_t *Data, size_t Size, size_t MaxSize);
83
84  /// Creates a cross-over of two pieces of Data, returns its size.
85  size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2,
86                   size_t Size2, uint8_t *Out, size_t MaxOutSize);
87
88  void AddWordToManualDictionary(const Word &W);
89
90  void PrintRecommendedDictionary();
91
92  void SetCorpus(const InputCorpus *Corpus) { this->Corpus = Corpus; }
93
94  Random &GetRand() { return Rand; }
95
96 private:
97  struct Mutator {
98    size_t (MutationDispatcher::*Fn)(uint8_t *Data, size_t Size, size_t Max);
99    const char *Name;
100  };
101
102  size_t AddWordFromDictionary(Dictionary &D, uint8_t *Data, size_t Size,
103                               size_t MaxSize);
104  size_t MutateImpl(uint8_t *Data, size_t Size, size_t MaxSize,
105                    Vector<Mutator> &Mutators);
106
107  size_t InsertPartOf(const uint8_t *From, size_t FromSize, uint8_t *To,
108                      size_t ToSize, size_t MaxToSize);
109  size_t CopyPartOf(const uint8_t *From, size_t FromSize, uint8_t *To,
110                    size_t ToSize);
111  size_t ApplyDictionaryEntry(uint8_t *Data, size_t Size, size_t MaxSize,
112                              DictionaryEntry &DE);
113
114  template <class T>
115  DictionaryEntry MakeDictionaryEntryFromCMP(T Arg1, T Arg2,
116                                             const uint8_t *Data, size_t Size);
117  DictionaryEntry MakeDictionaryEntryFromCMP(const Word &Arg1, const Word &Arg2,
118                                             const uint8_t *Data, size_t Size);
119  DictionaryEntry MakeDictionaryEntryFromCMP(const void *Arg1, const void *Arg2,
120                                             const void *Arg1Mutation,
121                                             const void *Arg2Mutation,
122                                             size_t ArgSize,
123                                             const uint8_t *Data, size_t Size);
124
125  Random &Rand;
126  const FuzzingOptions Options;
127
128  // Dictionary provided by the user via -dict=DICT_FILE.
129  Dictionary ManualDictionary;
130  // Temporary dictionary modified by the fuzzer itself,
131  // recreated periodically.
132  Dictionary TempAutoDictionary;
133  // Persistent dictionary modified by the fuzzer, consists of
134  // entries that led to successful discoveries in the past mutations.
135  Dictionary PersistentAutoDictionary;
136
137  Vector<DictionaryEntry *> CurrentDictionaryEntrySequence;
138
139  static const size_t kCmpDictionaryEntriesDequeSize = 16;
140  DictionaryEntry CmpDictionaryEntriesDeque[kCmpDictionaryEntriesDequeSize];
141  size_t CmpDictionaryEntriesDequeIdx = 0;
142
143  const InputCorpus *Corpus = nullptr;
144  Vector<uint8_t> MutateInPlaceHere;
145  Vector<uint8_t> MutateWithMaskTemp;
146  // CustomCrossOver needs its own buffer as a custom implementation may call
147  // LLVMFuzzerMutate, which in turn may resize MutateInPlaceHere.
148  Vector<uint8_t> CustomCrossOverInPlaceHere;
149
150  Vector<Mutator> Mutators;
151  Vector<Mutator> DefaultMutators;
152  Vector<Mutator> CurrentMutatorSequence;
153};
154
155}  // namespace fuzzer
156
157#endif  // LLVM_FUZZER_MUTATE_H
158