FuzzerMutate.h revision 1.1.1.1
1286908Sloos//===- FuzzerMutate.h - Internal header for the Fuzzer ----------*- C++ -* ===// 2286908Sloos// 3286908Sloos// The LLVM Compiler Infrastructure 4286908Sloos// 5286908Sloos// This file is distributed under the University of Illinois Open Source 6286908Sloos// License. See LICENSE.TXT for details. 7286908Sloos// 8286908Sloos//===----------------------------------------------------------------------===// 9286908Sloos// fuzzer::MutationDispatcher 10286908Sloos//===----------------------------------------------------------------------===// 11286908Sloos 12286908Sloos#ifndef LLVM_FUZZER_MUTATE_H 13286908Sloos#define LLVM_FUZZER_MUTATE_H 14286908Sloos 15286908Sloos#include "FuzzerDefs.h" 16286908Sloos#include "FuzzerDictionary.h" 17286908Sloos#include "FuzzerOptions.h" 18286908Sloos#include "FuzzerRandom.h" 19286908Sloos 20286908Sloosnamespace fuzzer { 21286908Sloos 22286908Sloosclass MutationDispatcher { 23286908Sloospublic: 24286908Sloos MutationDispatcher(Random &Rand, const FuzzingOptions &Options); 25286908Sloos ~MutationDispatcher() {} 26286908Sloos /// Indicate that we are about to start a new sequence of mutations. 27286908Sloos void StartMutationSequence(); 28286908Sloos /// Print the current sequence of mutations. 29286908Sloos void PrintMutationSequence(); 30286908Sloos /// Indicate that the current sequence of mutations was successful. 31286908Sloos void RecordSuccessfulMutationSequence(); 32286908Sloos /// Mutates data by invoking user-provided mutator. 33286908Sloos size_t Mutate_Custom(uint8_t *Data, size_t Size, size_t MaxSize); 34286908Sloos /// Mutates data by invoking user-provided crossover. 35286908Sloos size_t Mutate_CustomCrossOver(uint8_t *Data, size_t Size, size_t MaxSize); 36286908Sloos /// Mutates data by shuffling bytes. 37286908Sloos size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize); 38286908Sloos /// Mutates data by erasing bytes. 39286908Sloos size_t Mutate_EraseBytes(uint8_t *Data, size_t Size, size_t MaxSize); 40286908Sloos /// Mutates data by inserting a byte. 41286908Sloos size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize); 42286908Sloos /// Mutates data by inserting several repeated bytes. 43286908Sloos size_t Mutate_InsertRepeatedBytes(uint8_t *Data, size_t Size, size_t MaxSize); 44286908Sloos /// Mutates data by chanding one byte. 45286908Sloos size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize); 46286908Sloos /// Mutates data by chanding one bit. 47286908Sloos size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize); 48286908Sloos /// Mutates data by copying/inserting a part of data into a different place. 49286908Sloos size_t Mutate_CopyPart(uint8_t *Data, size_t Size, size_t MaxSize); 50286908Sloos 51286908Sloos /// Mutates data by adding a word from the manual dictionary. 52286908Sloos size_t Mutate_AddWordFromManualDictionary(uint8_t *Data, size_t Size, 53286908Sloos size_t MaxSize); 54286908Sloos 55286908Sloos /// Mutates data by adding a word from the TORC. 56286908Sloos size_t Mutate_AddWordFromTORC(uint8_t *Data, size_t Size, size_t MaxSize); 57286908Sloos 58286908Sloos /// Mutates data by adding a word from the persistent automatic dictionary. 59286908Sloos size_t Mutate_AddWordFromPersistentAutoDictionary(uint8_t *Data, size_t Size, 60286908Sloos size_t MaxSize); 61286908Sloos 62286908Sloos /// Tries to find an ASCII integer in Data, changes it to another ASCII int. 63286908Sloos size_t Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MaxSize); 64 /// Change a 1-, 2-, 4-, or 8-byte integer in interesting ways. 65 size_t Mutate_ChangeBinaryInteger(uint8_t *Data, size_t Size, size_t MaxSize); 66 67 /// CrossOver Data with some other element of the corpus. 68 size_t Mutate_CrossOver(uint8_t *Data, size_t Size, size_t MaxSize); 69 70 /// Applies one of the configured mutations. 71 /// Returns the new size of data which could be up to MaxSize. 72 size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize); 73 74 /// Applies one of the configured mutations to the bytes of Data 75 /// that have '1' in Mask. 76 /// Mask.size() should be >= Size. 77 size_t MutateWithMask(uint8_t *Data, size_t Size, size_t MaxSize, 78 const Vector<uint8_t> &Mask); 79 80 /// Applies one of the default mutations. Provided as a service 81 /// to mutation authors. 82 size_t DefaultMutate(uint8_t *Data, size_t Size, size_t MaxSize); 83 84 /// Creates a cross-over of two pieces of Data, returns its size. 85 size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2, 86 size_t Size2, uint8_t *Out, size_t MaxOutSize); 87 88 void AddWordToManualDictionary(const Word &W); 89 90 void PrintRecommendedDictionary(); 91 92 void SetCorpus(const InputCorpus *Corpus) { this->Corpus = Corpus; } 93 94 Random &GetRand() { return Rand; } 95 96 private: 97 struct Mutator { 98 size_t (MutationDispatcher::*Fn)(uint8_t *Data, size_t Size, size_t Max); 99 const char *Name; 100 }; 101 102 size_t AddWordFromDictionary(Dictionary &D, uint8_t *Data, size_t Size, 103 size_t MaxSize); 104 size_t MutateImpl(uint8_t *Data, size_t Size, size_t MaxSize, 105 Vector<Mutator> &Mutators); 106 107 size_t InsertPartOf(const uint8_t *From, size_t FromSize, uint8_t *To, 108 size_t ToSize, size_t MaxToSize); 109 size_t CopyPartOf(const uint8_t *From, size_t FromSize, uint8_t *To, 110 size_t ToSize); 111 size_t ApplyDictionaryEntry(uint8_t *Data, size_t Size, size_t MaxSize, 112 DictionaryEntry &DE); 113 114 template <class T> 115 DictionaryEntry MakeDictionaryEntryFromCMP(T Arg1, T Arg2, 116 const uint8_t *Data, size_t Size); 117 DictionaryEntry MakeDictionaryEntryFromCMP(const Word &Arg1, const Word &Arg2, 118 const uint8_t *Data, size_t Size); 119 DictionaryEntry MakeDictionaryEntryFromCMP(const void *Arg1, const void *Arg2, 120 const void *Arg1Mutation, 121 const void *Arg2Mutation, 122 size_t ArgSize, 123 const uint8_t *Data, size_t Size); 124 125 Random &Rand; 126 const FuzzingOptions Options; 127 128 // Dictionary provided by the user via -dict=DICT_FILE. 129 Dictionary ManualDictionary; 130 // Temporary dictionary modified by the fuzzer itself, 131 // recreated periodically. 132 Dictionary TempAutoDictionary; 133 // Persistent dictionary modified by the fuzzer, consists of 134 // entries that led to successful discoveries in the past mutations. 135 Dictionary PersistentAutoDictionary; 136 137 Vector<DictionaryEntry *> CurrentDictionaryEntrySequence; 138 139 static const size_t kCmpDictionaryEntriesDequeSize = 16; 140 DictionaryEntry CmpDictionaryEntriesDeque[kCmpDictionaryEntriesDequeSize]; 141 size_t CmpDictionaryEntriesDequeIdx = 0; 142 143 const InputCorpus *Corpus = nullptr; 144 Vector<uint8_t> MutateInPlaceHere; 145 Vector<uint8_t> MutateWithMaskTemp; 146 // CustomCrossOver needs its own buffer as a custom implementation may call 147 // LLVMFuzzerMutate, which in turn may resize MutateInPlaceHere. 148 Vector<uint8_t> CustomCrossOverInPlaceHere; 149 150 Vector<Mutator> Mutators; 151 Vector<Mutator> DefaultMutators; 152 Vector<Mutator> CurrentMutatorSequence; 153}; 154 155} // namespace fuzzer 156 157#endif // LLVM_FUZZER_MUTATE_H 158