<div dir="ltr">Wrong license header. I'll fix this one.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jan 24, 2019 at 1:08 PM Kostya Serebryany via llvm-commits <<a href="mailto:llvm-commits@lists.llvm.org">llvm-commits@lists.llvm.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Author: kcc<br>
Date: Thu Jan 24 13:08:54 2019<br>
New Revision: 352107<br>
<br>
URL: <a href="http://llvm.org/viewvc/llvm-project?rev=352107&view=rev" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-project?rev=352107&view=rev</a><br>
Log:<br>
[libFuzzer] more agressive value profiling and CMP tracing for switch statements<br>
<br>
Added:<br>
compiler-rt/trunk/test/fuzzer/Switch3Test.cpp<br>
Modified:<br>
compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.cpp<br>
compiler-rt/trunk/test/fuzzer/value-profile-switch.test<br>
<br>
Modified: compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.cpp<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.cpp?rev=352107&r1=352106&r2=352107&view=diff" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.cpp?rev=352107&r1=352106&r2=352107&view=diff</a><br>
==============================================================================<br>
--- compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.cpp (original)<br>
+++ compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.cpp Thu Jan 24 13:08:54 2019<br>
@@ -536,24 +536,44 @@ void __sanitizer_cov_trace_switch(uint64<br>
uint64_t N = Cases[0];<br>
uint64_t ValSizeInBits = Cases[1];<br>
uint64_t *Vals = Cases + 2;<br>
- // Skip the most common and the most boring case.<br>
- if (Vals[N - 1] < 256 && Val < 256)<br>
+ // Skip the most common and the most boring case: all switch values are small.<br>
+ // We may want to skip this at compile-time, but it will make the<br>
+ // instrumentation less general.<br>
+ if (Vals[N - 1] < 256)<br>
+ return;<br>
+ // Also skip small inputs values, they won't give good signal.<br>
+ if (Val < 256)<br>
return;<br>
uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());<br>
size_t i;<br>
- uint64_t Token = 0;<br>
+ uint64_t Smaller = 0;<br>
+ uint64_t Larger = ~(uint64_t)0;<br>
+ // Find two switch values such that Smaller < Val < Larger.<br>
+ // Use 0 and 0xfff..f as the defaults.<br>
for (i = 0; i < N; i++) {<br>
- Token = Val ^ Vals[i];<br>
- if (Val < Vals[i])<br>
+ if (Val < Vals[i]) {<br>
+ Larger = Vals[i];<br>
break;<br>
+ }<br>
+ if (Val > Vals[i]) Smaller = Vals[i];<br>
}<br>
<br>
- if (ValSizeInBits == 16)<br>
- fuzzer::TPC.HandleCmp(PC + i, static_cast<uint16_t>(Token), (uint16_t)(0));<br>
- else if (ValSizeInBits == 32)<br>
- fuzzer::TPC.HandleCmp(PC + i, static_cast<uint32_t>(Token), (uint32_t)(0));<br>
- else<br>
- fuzzer::TPC.HandleCmp(PC + i, Token, (uint64_t)(0));<br>
+ // Apply HandleCmp to {Val,Smaller} and {Val, Larger},<br>
+ // use i as the PC modifier for HandleCmp.<br>
+ if (ValSizeInBits == 16) {<br>
+ fuzzer::TPC.HandleCmp(PC + 2 * i, static_cast<uint16_t>(Val),<br>
+ (uint16_t)(Smaller));<br>
+ fuzzer::TPC.HandleCmp(PC + 2 * i + 1, static_cast<uint16_t>(Val),<br>
+ (uint16_t)(Larger));<br>
+ } else if (ValSizeInBits == 32) {<br>
+ fuzzer::TPC.HandleCmp(PC + 2 * i, static_cast<uint32_t>(Val),<br>
+ (uint32_t)(Smaller));<br>
+ fuzzer::TPC.HandleCmp(PC + 2 * i + 1, static_cast<uint32_t>(Val),<br>
+ (uint32_t)(Larger));<br>
+ } else {<br>
+ fuzzer::TPC.HandleCmp(PC + 2*i, Val, Smaller);<br>
+ fuzzer::TPC.HandleCmp(PC + 2*i + 1, Val, Larger);<br>
+ }<br>
}<br>
<br>
ATTRIBUTE_INTERFACE<br>
<br>
Added: compiler-rt/trunk/test/fuzzer/Switch3Test.cpp<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/test/fuzzer/Switch3Test.cpp?rev=352107&view=auto" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/test/fuzzer/Switch3Test.cpp?rev=352107&view=auto</a><br>
==============================================================================<br>
--- compiler-rt/trunk/test/fuzzer/Switch3Test.cpp (added)<br>
+++ compiler-rt/trunk/test/fuzzer/Switch3Test.cpp Thu Jan 24 13:08:54 2019<br>
@@ -0,0 +1,24 @@<br>
+// This file is distributed under the University of Illinois Open Source<br>
+// License. See LICENSE.TXT for details.<br>
+<br>
+// Simple test for a fuzzer. The fuzzer must find the interesting switch value.<br>
+#include <cstddef><br>
+#include <cstdint><br>
+#include <cstdio><br>
+#include <cstdlib><br>
+#include <cstring><br>
+<br>
+static volatile int Sink;<br>
+<br>
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {<br>
+ uint32_t v;<br>
+ if (Size < 100) return 0;<br>
+ memcpy(&v, Data + Size / 2, sizeof(v));<br>
+ switch(v) {<br>
+ case 0x47524159: abort();<br>
+ case 0x52474220: abort();<br>
+ default:;<br>
+ }<br>
+ return 0;<br>
+}<br>
+<br>
<br>
Modified: compiler-rt/trunk/test/fuzzer/value-profile-switch.test<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/test/fuzzer/value-profile-switch.test?rev=352107&r1=352106&r2=352107&view=diff" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/test/fuzzer/value-profile-switch.test?rev=352107&r1=352106&r2=352107&view=diff</a><br>
==============================================================================<br>
--- compiler-rt/trunk/test/fuzzer/value-profile-switch.test (original)<br>
+++ compiler-rt/trunk/test/fuzzer/value-profile-switch.test Thu Jan 24 13:08:54 2019<br>
@@ -2,5 +2,7 @@ UNSUPPORTED: ios<br>
CHECK: BINGO<br>
RUN: %cpp_compiler %S/SwitchTest.cpp -o %t-SwitchTest<br>
RUN: %cpp_compiler %S/Switch2Test.cpp -o %t-Switch2Test<br>
+RUN: %cpp_compiler %S/Switch3Test.cpp -o %t-Switch3Test<br>
RUN: not %run %t-SwitchTest -use_cmp=0 -use_value_profile=1 -runs=100000000 -seed=1 2>&1 | FileCheck %s<br>
RUN: not %run %t-Switch2Test -use_cmp=0 -use_value_profile=1 -runs=100000000 -seed=1 2>&1 | FileCheck %s<br>
+RUN: not %run %t-Switch3Test -use_cmp=0 -use_value_profile=1 -runs=100000000 -seed=1 2>&1<br>
<br>
<br>
_______________________________________________<br>
llvm-commits mailing list<br>
<a href="mailto:llvm-commits@lists.llvm.org" target="_blank">llvm-commits@lists.llvm.org</a><br>
<a href="https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-commits" rel="noreferrer" target="_blank">https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-commits</a><br>
</blockquote></div>