[llvm] r292835 - [libFuzzer] make sure we use the feedback from std::string operator ==

[Kostya Serebryany via llvm-commits]

Author: kcc
Date: Mon Jan 23 16:11:04 2017
New Revision: 292835

URL: http://llvm.org/viewvc/llvm-project?rev=292835&view=rev
Log:
[libFuzzer] make sure we use the feedback from std::string operator ==

Added:
    llvm/trunk/lib/Fuzzer/test/CxxStringEqTest.cpp
    llvm/trunk/lib/Fuzzer/test/cxxstring.test
Modified:
    llvm/trunk/lib/Fuzzer/FuzzerTracePC.cpp
    llvm/trunk/lib/Fuzzer/test/CMakeLists.txt

Modified: llvm/trunk/lib/Fuzzer/FuzzerTracePC.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Fuzzer/FuzzerTracePC.cpp?rev=292835&r1=292834&r2=292835&view=diff
==============================================================================
--- llvm/trunk/lib/Fuzzer/FuzzerTracePC.cpp (original)
+++ llvm/trunk/lib/Fuzzer/FuzzerTracePC.cpp Mon Jan 23 16:11:04 2017
@@ -214,9 +214,12 @@ void TracePC::AddValueForMemcmp(void *ca
   uint8_t B2[Word::kMaxSize];
   // Copy the data into locals in this non-msan-instrumented function
   // to avoid msan complaining further.
+  size_t Hash = 0;  // Compute some simple hash of both strings.
   for (size_t i = 0; i < Len; i++) {
     B1[i] = A1[i];
     B2[i] = A2[i];
+    size_t T = B1[i];
+    Hash ^= (T << 8) | B2[i];
   }
   size_t I = 0;
   for (; I < Len; I++)
@@ -225,7 +228,7 @@ void TracePC::AddValueForMemcmp(void *ca
   size_t PC = reinterpret_cast<size_t>(caller_pc);
   size_t Idx = (PC & 4095) | (I << 12);
   TPC.HandleValueProfile(Idx);
-  TORCW.Insert(Idx, Word(B1, Len), Word(B2, Len));
+  TORCW.Insert(Idx ^ Hash, Word(B1, Len), Word(B2, Len));
 }
 
 template <class T>

Modified: llvm/trunk/lib/Fuzzer/test/CMakeLists.txt
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Fuzzer/test/CMakeLists.txt?rev=292835&r1=292834&r2=292835&view=diff
==============================================================================
--- llvm/trunk/lib/Fuzzer/test/CMakeLists.txt (original)
+++ llvm/trunk/lib/Fuzzer/test/CMakeLists.txt Mon Jan 23 16:11:04 2017
@@ -83,6 +83,7 @@ set(Tests
   CounterTest
   CustomCrossOverTest
   CustomMutatorTest
+  CxxStringEqTest
   DivTest
   EmptyTest
   EquivalenceATest

Added: llvm/trunk/lib/Fuzzer/test/CxxStringEqTest.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Fuzzer/test/CxxStringEqTest.cpp?rev=292835&view=auto
==============================================================================
--- llvm/trunk/lib/Fuzzer/test/CxxStringEqTest.cpp (added)
+++ llvm/trunk/lib/Fuzzer/test/CxxStringEqTest.cpp Mon Jan 23 16:11:04 2017
@@ -0,0 +1,24 @@
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+
+// Simple test for a fuzzer. Must find a specific string
+// used in std::string operator ==.
+#include <cstdint>
+#include <cstdlib>
+#include <cstddef>
+#include <string>
+#include <iostream>
+
+static volatile int Sink;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  std::string Str((const char*)Data, Size);
+  bool Eq = Str == "FooBar";
+  Sink = Str == "123456";   // Try to confuse the fuzzer
+  if (Eq) {
+    std::cout << "BINGO; Found the target, exiting\n";
+    abort();
+  }
+  return 0;
+}
+

Added: llvm/trunk/lib/Fuzzer/test/cxxstring.test
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Fuzzer/test/cxxstring.test?rev=292835&view=auto
==============================================================================
--- llvm/trunk/lib/Fuzzer/test/cxxstring.test (added)
+++ llvm/trunk/lib/Fuzzer/test/cxxstring.test Mon Jan 23 16:11:04 2017
@@ -0,0 +1,2 @@
+RUN: not LLVMFuzzer-CxxStringEqTest -seed=1 -runs=1000000 2>&1 | FileCheck %s
+CHECK: BINGO