[Lldb-commits] [lldb] 61efe14 - [lldb] Add a fuzzer for target creation

Jonas Devlieghere via lldb-commits lldb-commits at lists.llvm.org
Fri Mar 25 09:34:06 PDT 2022


Author: Jonas Devlieghere
Date: 2022-03-25T09:34:00-07:00
New Revision: 61efe14e21b2c47a848f6d7500ed05af17c64a9a

URL: https://github.com/llvm/llvm-project/commit/61efe14e21b2c47a848f6d7500ed05af17c64a9a
DIFF: https://github.com/llvm/llvm-project/commit/61efe14e21b2c47a848f6d7500ed05af17c64a9a.diff

LOG: [lldb] Add a fuzzer for target creation

This patch adds a generic fuzzer that interprets inputs as object files
and uses them to create a target in lldb. It is very similar to the
llvm-dwarfdump fuzzer which found a bunch of issues in libObject.

Differential revision: https://reviews.llvm.org/D122461

Added: 
    lldb/tools/lldb-fuzzer/CMakeLists.txt
    lldb/tools/lldb-fuzzer/lldb-target-fuzzer.cpp
    lldb/tools/lldb-fuzzer/utils/CMakeLists.txt
    lldb/tools/lldb-fuzzer/utils/TempFile.cpp
    lldb/tools/lldb-fuzzer/utils/TempFile.h

Modified: 
    lldb/tools/CMakeLists.txt
    llvm/docs/FuzzingLLVM.rst

Removed: 
    


################################################################################
diff  --git a/lldb/tools/CMakeLists.txt b/lldb/tools/CMakeLists.txt
index 1585fd4dc4b9e..16a2c7956aeff 100644
--- a/lldb/tools/CMakeLists.txt
+++ b/lldb/tools/CMakeLists.txt
@@ -6,6 +6,7 @@ add_subdirectory(intel-features)
 # i.e. if a target requires it as dependency. The typical
 # example is `check-lldb`. So, we pass EXCLUDE_FROM_ALL here.
 add_subdirectory(lldb-test EXCLUDE_FROM_ALL)
+add_subdirectory(lldb-fuzzer EXCLUDE_FROM_ALL)
 
 add_lldb_tool_subdirectory(lldb-instr)
 add_lldb_tool_subdirectory(lldb-vscode)

diff  --git a/lldb/tools/lldb-fuzzer/CMakeLists.txt b/lldb/tools/lldb-fuzzer/CMakeLists.txt
new file mode 100644
index 0000000000000..44df5f193b44a
--- /dev/null
+++ b/lldb/tools/lldb-fuzzer/CMakeLists.txt
@@ -0,0 +1,17 @@
+add_subdirectory(utils)
+
+set(LLVM_LINK_COMPONENTS
+  Support
+  )
+
+add_llvm_fuzzer(lldb-target-fuzzer
+  EXCLUDE_FROM_ALL
+  lldb-target-fuzzer.cpp
+  )
+
+target_link_libraries(lldb-target-fuzzer
+  PRIVATE
+  liblldb
+  lldbFuzzerUtils
+  )
+

diff  --git a/lldb/tools/lldb-fuzzer/lldb-target-fuzzer.cpp b/lldb/tools/lldb-fuzzer/lldb-target-fuzzer.cpp
new file mode 100644
index 0000000000000..82487bb224f09
--- /dev/null
+++ b/lldb/tools/lldb-fuzzer/lldb-target-fuzzer.cpp
@@ -0,0 +1,35 @@
+//===-- lldb-target-fuzzer.cpp - Fuzz target creation ---------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include <utils/TempFile.h>
+
+#include "lldb/API/SBDebugger.h"
+#include "lldb/API/SBTarget.h"
+
+using namespace lldb;
+using namespace lldb_fuzzer;
+using namespace llvm;
+
+extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) {
+  SBDebugger::Initialize();
+  return 0;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
+  std::unique_ptr<TempFile> file = TempFile::Create(data, size);
+  if (!file)
+    return 1;
+
+  SBDebugger debugger = SBDebugger::Create(false);
+  SBTarget target = debugger.CreateTarget(file->GetPath().data());
+  debugger.DeleteTarget(target);
+  SBDebugger::Destroy(debugger);
+  SBModule::GarbageCollectAllocatedModules();
+
+  return 0;
+}

diff  --git a/lldb/tools/lldb-fuzzer/utils/CMakeLists.txt b/lldb/tools/lldb-fuzzer/utils/CMakeLists.txt
new file mode 100644
index 0000000000000..2c99c79e8aefe
--- /dev/null
+++ b/lldb/tools/lldb-fuzzer/utils/CMakeLists.txt
@@ -0,0 +1,6 @@
+add_lldb_library(lldbFuzzerUtils
+  TempFile.cpp
+
+  LINK_COMPONENTS
+    Support
+  )

diff  --git a/lldb/tools/lldb-fuzzer/utils/TempFile.cpp b/lldb/tools/lldb-fuzzer/utils/TempFile.cpp
new file mode 100644
index 0000000000000..c5c16ec19df7a
--- /dev/null
+++ b/lldb/tools/lldb-fuzzer/utils/TempFile.cpp
@@ -0,0 +1,33 @@
+//===-- TempFile.cpp ------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "llvm/Support/FileSystem.h"
+#include <TempFile.h>
+
+using namespace lldb_fuzzer;
+using namespace llvm;
+
+TempFile::~TempFile() {
+  if (!m_path.empty())
+    sys::fs::remove(m_path.str(), true);
+}
+
+std::unique_ptr<TempFile> TempFile::Create(uint8_t *data, size_t size) {
+  int fd;
+  std::unique_ptr<TempFile> temp_file = std::make_unique<TempFile>();
+  std::error_code ec = sys::fs::createTemporaryFile("lldb-fuzzer", "input", fd,
+                                                    temp_file->m_path);
+  if (ec)
+    return nullptr;
+
+  raw_fd_ostream os(fd, true);
+  os.write(reinterpret_cast<const char *>(data), size);
+  os.close();
+
+  return temp_file;
+}

diff  --git a/lldb/tools/lldb-fuzzer/utils/TempFile.h b/lldb/tools/lldb-fuzzer/utils/TempFile.h
new file mode 100644
index 0000000000000..27453b0c62d20
--- /dev/null
+++ b/lldb/tools/lldb-fuzzer/utils/TempFile.h
@@ -0,0 +1,27 @@
+//===-- TempFile.h ----------------------------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "llvm/ADT/SmallString.h"
+#include "llvm/ADT/StringRef.h"
+#include "llvm/Support/Error.h"
+
+namespace lldb_fuzzer {
+
+class TempFile {
+public:
+  TempFile() = default;
+  ~TempFile();
+
+  static std::unique_ptr<TempFile> Create(uint8_t *data, size_t size);
+  llvm::StringRef GetPath() { return m_path.str(); }
+
+private:
+  llvm::SmallString<128> m_path;
+};
+
+} // namespace lldb_fuzzer

diff  --git a/llvm/docs/FuzzingLLVM.rst b/llvm/docs/FuzzingLLVM.rst
index e471020aab761..6b32eeab1241d 100644
--- a/llvm/docs/FuzzingLLVM.rst
+++ b/llvm/docs/FuzzingLLVM.rst
@@ -158,6 +158,11 @@ compatible with all of libFuzzer's features. See the notes above about
 .. |LLVM IR fuzzer|
    replace:: :ref:`structured LLVM IR fuzzer <fuzzing-llvm-ir>`
 
+lldb-target-fuzzer
+---------------------
+
+A |generic fuzzer| that interprets inputs as object files and uses them to
+create a target in lldb.
 
 Mutators and Input Generators
 =============================


        


More information about the lldb-commits mailing list