head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC6:1.1.1.1 netbsd-11-0-RC5:1.1.1.1 netbsd-11-0-RC4:1.1.1.1 netbsd-11-0-RC3:1.1.1.1 netbsd-11-0-RC2:1.1.1.1 netbsd-11-0-RC1:1.1.1.1 perseant-exfatfs-base-20250801:1.1.1.1 netbsd-11:1.1.1.1.0.42 netbsd-11-base:1.1.1.1 netbsd-10-1-RELEASE:1.1.1.1 perseant-exfatfs-base-20240630:1.1.1.1 perseant-exfatfs:1.1.1.1.0.40 perseant-exfatfs-base:1.1.1.1 netbsd-9-4-RELEASE:1.1.1.1 netbsd-10-0-RELEASE:1.1.1.1 netbsd-10-0-RC6:1.1.1.1 netbsd-10-0-RC5:1.1.1.1 netbsd-10-0-RC4:1.1.1.1 netbsd-10-0-RC3:1.1.1.1 netbsd-10-0-RC2:1.1.1.1 thorpej-ifq:1.1.1.1.0.38 thorpej-ifq-base:1.1.1.1 thorpej-altq-separation:1.1.1.1.0.36 thorpej-altq-separation-base:1.1.1.1 netbsd-10-0-RC1:1.1.1.1 netbsd-10:1.1.1.1.0.34 netbsd-10-base:1.1.1.1 bouyer-sunxi-drm:1.1.1.1.0.32 bouyer-sunxi-drm-base:1.1.1.1 netbsd-9-3-RELEASE:1.1.1.1 thorpej-i2c-spi-conf2:1.1.1.1.0.30 thorpej-i2c-spi-conf2-base:1.1.1.1 thorpej-futex2:1.1.1.1.0.28 thorpej-futex2-base:1.1.1.1 thorpej-cfargs2:1.1.1.1.0.26 thorpej-cfargs2-base:1.1.1.1 cjep_sun2x-base1:1.1.1.1 cjep_sun2x:1.1.1.1.0.24 cjep_sun2x-base:1.1.1.1 cjep_staticlib_x-base1:1.1.1.1 netbsd-9-2-RELEASE:1.1.1.1 cjep_staticlib_x:1.1.1.1.0.22 cjep_staticlib_x-base:1.1.1.1 thorpej-i2c-spi-conf:1.1.1.1.0.20 thorpej-i2c-spi-conf-base:1.1.1.1 thorpej-cfargs:1.1.1.1.0.18 thorpej-cfargs-base:1.1.1.1 thorpej-futex:1.1.1.1.0.16 thorpej-futex-base:1.1.1.1 netbsd-9-1-RELEASE:1.1.1.1 bouyer-xenpvh-base2:1.1.1.1 phil-wifi-20200421:1.1.1.1 bouyer-xenpvh-base1:1.1.1.1 phil-wifi-20200411:1.1.1.1 bouyer-xenpvh:1.1.1.1.0.14 bouyer-xenpvh-base:1.1.1.1 is-mlppp:1.1.1.1.0.12 is-mlppp-base:1.1.1.1 phil-wifi-20200406:1.1.1.1 ad-namecache-base3:1.1.1.1 netbsd-9-0-RELEASE:1.1.1.1 netbsd-9-0-RC2:1.1.1.1 ad-namecache-base2:1.1.1.1 ad-namecache-base1:1.1.1.1 ad-namecache:1.1.1.1.0.10 ad-namecache-base:1.1.1.1 netbsd-9-0-RC1:1.1.1.1 phil-wifi-20191119:1.1.1.1 netbsd-9:1.1.1.1.0.8 netbsd-9-base:1.1.1.1 phil-wifi:1.1.1.1.0.6 phil-wifi-20190609:1.1.1.1 isaki-audio2:1.1.1.1.0.4 isaki-audio2-base:1.1.1.1 pgoyette-compat-merge-20190127:1.1.1.1.2.2 pgoyette-compat-20190127:1.1.1.1 pgoyette-compat:1.1.1.1.0.2 pgoyette-compat-20190118:1.1.1.1 compiler-rt-350590:1.1.1.1 LLVM:1.1.1; locks; strict; comment @// @; 1.1 date 2019.01.08.05.40.28; author kamil; state Exp; branches 1.1.1.1; next ; commitid JxKaWKiFa0y4nW6B; 1.1.1.1 date 2019.01.08.05.40.28; author kamil; state Exp; branches 1.1.1.1.2.1 1.1.1.1.6.1; next ; commitid JxKaWKiFa0y4nW6B; 1.1.1.1.2.1 date 2019.01.08.05.40.28; author pgoyette; state dead; branches; next 1.1.1.1.2.2; commitid Lmlzg3OVT2cd6f8B; 1.1.1.1.2.2 date 2019.01.18.08.50.50; author pgoyette; state Exp; branches; next ; commitid Lmlzg3OVT2cd6f8B; 1.1.1.1.6.1 date 2019.01.08.05.40.28; author christos; state dead; branches; next 1.1.1.1.6.2; commitid jtc8rnCzWiEEHGqB; 1.1.1.1.6.2 date 2019.06.10.22.07.47; author christos; state Exp; branches; next ; commitid jtc8rnCzWiEEHGqB; desc @@ 1.1 log @Initial revision @ text @/*===- DataFlow.cpp - a standalone DataFlow tracer -------===// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // An experimental data-flow tracer for fuzz targets. // It is based on DFSan and SanitizerCoverage. // https://clang.llvm.org/docs/DataFlowSanitizer.html // https://clang.llvm.org/docs/SanitizerCoverage.html#tracing-data-flow // // It executes the fuzz target on the given input while monitoring the // data flow for every instrumented comparison instruction. // // The output shows which functions depend on which bytes of the input. // // Build: // 1. Compile this file with -fsanitize=dataflow // 2. Build the fuzz target with -g -fsanitize=dataflow // -fsanitize-coverage=trace-pc-guard,pc-table,func,trace-cmp // 3. Link those together with -fsanitize=dataflow // // -fsanitize-coverage=trace-cmp inserts callbacks around every comparison // instruction, DFSan modifies the calls to pass the data flow labels. // The callbacks update the data flow label for the current function. // See e.g. __dfsw___sanitizer_cov_trace_cmp1 below. // // -fsanitize-coverage=trace-pc-guard,pc-table,func instruments function // entries so that the comparison callback knows that current function. // // // Run: // # Collect data flow for INPUT_FILE, write to OUTPUT_FILE (default: stdout) // ./a.out INPUT_FILE [OUTPUT_FILE] // // # Print all instrumented functions. llvm-symbolizer must be present in PATH // ./a.out // // Example output: // =============== // F0 11111111111111 // F1 10000000000000 // =============== // "FN xxxxxxxxxx": tells what bytes of the input does the function N depend on. // The byte string is LEN+1 bytes. The last byte is set if the function // depends on the input length. //===----------------------------------------------------------------------===*/ #include #include #include #include #include #include // backtrace_symbols_fd #include extern "C" { extern int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size); __attribute__((weak)) extern int LLVMFuzzerInitialize(int *argc, char ***argv); } // extern "C" static size_t InputLen; static size_t NumFuncs; static const uintptr_t *FuncsBeg; static __thread size_t CurrentFunc; static dfsan_label *FuncLabels; // Array of NumFuncs elements. static char *PrintableStringForLabel; // InputLen + 2 bytes. static bool LabelSeen[1 << 8 * sizeof(dfsan_label)]; // Prints all instrumented functions. static int PrintFunctions() { // We don't have the symbolizer integrated with dfsan yet. // So use backtrace_symbols_fd and pipe it through llvm-symbolizer. // TODO(kcc): this is pretty ugly and may break in lots of ways. // We'll need to make a proper in-process symbolizer work with DFSan. FILE *Pipe = popen("sed 's/(+/ /g; s/).*//g' " "| llvm-symbolizer " "| grep 'dfs\\$' " "| sed 's/dfs\\$//g'", "w"); for (size_t I = 0; I < NumFuncs; I++) { uintptr_t PC = FuncsBeg[I * 2]; void *const Buf[1] = {(void*)PC}; backtrace_symbols_fd(Buf, 1, fileno(Pipe)); } pclose(Pipe); return 0; } extern "C" void SetBytesForLabel(dfsan_label L, char *Bytes) { if (LabelSeen[L]) return; LabelSeen[L] = true; assert(L); if (L <= InputLen + 1) { Bytes[L - 1] = '1'; } else { auto *DLI = dfsan_get_label_info(L); SetBytesForLabel(DLI->l1, Bytes); SetBytesForLabel(DLI->l2, Bytes); } } static char *GetPrintableStringForLabel(dfsan_label L) { memset(PrintableStringForLabel, '0', InputLen + 1); PrintableStringForLabel[InputLen + 1] = 0; memset(LabelSeen, 0, sizeof(LabelSeen)); SetBytesForLabel(L, PrintableStringForLabel); return PrintableStringForLabel; } static void PrintDataFlow(FILE *Out) { for (size_t I = 0; I < NumFuncs; I++) if (FuncLabels[I]) fprintf(Out, "F%zd %s\n", I, GetPrintableStringForLabel(FuncLabels[I])); } int main(int argc, char **argv) { if (LLVMFuzzerInitialize) LLVMFuzzerInitialize(&argc, &argv); if (argc == 1) return PrintFunctions(); assert(argc == 4 || argc == 5); size_t Beg = atoi(argv[1]); size_t End = atoi(argv[2]); assert(Beg < End); const char *Input = argv[3]; fprintf(stderr, "INFO: reading '%s'\n", Input); FILE *In = fopen(Input, "r"); assert(In); fseek(In, 0, SEEK_END); InputLen = ftell(In); fseek(In, 0, SEEK_SET); unsigned char *Buf = (unsigned char*)malloc(InputLen); size_t NumBytesRead = fread(Buf, 1, InputLen, In); assert(NumBytesRead == InputLen); PrintableStringForLabel = (char*)malloc(InputLen + 2); fclose(In); fprintf(stderr, "INFO: running '%s'\n", Input); for (size_t I = 1; I <= InputLen; I++) { dfsan_label L = dfsan_create_label("", nullptr); assert(L == I); size_t Idx = I - 1; if (Idx >= Beg && Idx < End) dfsan_set_label(L, Buf + Idx, 1); } dfsan_label SizeL = dfsan_create_label("", nullptr); assert(SizeL == InputLen + 1); dfsan_set_label(SizeL, &InputLen, sizeof(InputLen)); LLVMFuzzerTestOneInput(Buf, InputLen); free(Buf); bool OutIsStdout = argc == 4; fprintf(stderr, "INFO: writing dataflow to %s\n", OutIsStdout ? "" : argv[4]); FILE *Out = OutIsStdout ? stdout : fopen(argv[4], "w"); PrintDataFlow(Out); if (!OutIsStdout) fclose(Out); } extern "C" { void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) { assert(NumFuncs == 0 && "This tool does not support DSOs"); assert(start < stop && "The code is not instrumented for coverage"); if (start == stop || *start) return; // Initialize only once. for (uint32_t *x = start; x < stop; x++) *x = ++NumFuncs; // The first index is 1. FuncLabels = (dfsan_label*)calloc(NumFuncs, sizeof(dfsan_label)); fprintf(stderr, "INFO: %zd instrumented function(s) observed\n", NumFuncs); } void __sanitizer_cov_pcs_init(const uintptr_t *pcs_beg, const uintptr_t *pcs_end) { assert(NumFuncs == (pcs_end - pcs_beg) / 2); FuncsBeg = pcs_beg; } void __sanitizer_cov_trace_pc_indir(uint64_t x){} // unused. void __sanitizer_cov_trace_pc_guard(uint32_t *guard){ uint32_t FuncNum = *guard - 1; // Guards start from 1. assert(FuncNum < NumFuncs); CurrentFunc = FuncNum; } void __dfsw___sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases, dfsan_label L1, dfsan_label UnusedL) { assert(CurrentFunc < NumFuncs); FuncLabels[CurrentFunc] = dfsan_union(FuncLabels[CurrentFunc], L1); } #define HOOK(Name, Type) \ void Name(Type Arg1, Type Arg2, dfsan_label L1, dfsan_label L2) { \ assert(CurrentFunc < NumFuncs); \ FuncLabels[CurrentFunc] = \ dfsan_union(FuncLabels[CurrentFunc], dfsan_union(L1, L2)); \ } HOOK(__dfsw___sanitizer_cov_trace_const_cmp1, uint8_t) HOOK(__dfsw___sanitizer_cov_trace_const_cmp2, uint16_t) HOOK(__dfsw___sanitizer_cov_trace_const_cmp4, uint32_t) HOOK(__dfsw___sanitizer_cov_trace_const_cmp8, uint64_t) HOOK(__dfsw___sanitizer_cov_trace_cmp1, uint8_t) HOOK(__dfsw___sanitizer_cov_trace_cmp2, uint16_t) HOOK(__dfsw___sanitizer_cov_trace_cmp4, uint32_t) HOOK(__dfsw___sanitizer_cov_trace_cmp8, uint64_t) } // extern "C" @ 1.1.1.1 log @Import compiler-rt r350590. LLVM sanitizers on top of unmodified files from compiler-rt-259194. @ text @@ 1.1.1.1.6.1 log @file DataFlow.cpp was added on branch phil-wifi on 2019-06-10 22:07:47 +0000 @ text @d1 217 @ 1.1.1.1.6.2 log @Sync with HEAD @ text @a0 217 /*===- DataFlow.cpp - a standalone DataFlow tracer -------===// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // An experimental data-flow tracer for fuzz targets. // It is based on DFSan and SanitizerCoverage. // https://clang.llvm.org/docs/DataFlowSanitizer.html // https://clang.llvm.org/docs/SanitizerCoverage.html#tracing-data-flow // // It executes the fuzz target on the given input while monitoring the // data flow for every instrumented comparison instruction. // // The output shows which functions depend on which bytes of the input. // // Build: // 1. Compile this file with -fsanitize=dataflow // 2. Build the fuzz target with -g -fsanitize=dataflow // -fsanitize-coverage=trace-pc-guard,pc-table,func,trace-cmp // 3. Link those together with -fsanitize=dataflow // // -fsanitize-coverage=trace-cmp inserts callbacks around every comparison // instruction, DFSan modifies the calls to pass the data flow labels. // The callbacks update the data flow label for the current function. // See e.g. __dfsw___sanitizer_cov_trace_cmp1 below. // // -fsanitize-coverage=trace-pc-guard,pc-table,func instruments function // entries so that the comparison callback knows that current function. // // // Run: // # Collect data flow for INPUT_FILE, write to OUTPUT_FILE (default: stdout) // ./a.out INPUT_FILE [OUTPUT_FILE] // // # Print all instrumented functions. llvm-symbolizer must be present in PATH // ./a.out // // Example output: // =============== // F0 11111111111111 // F1 10000000000000 // =============== // "FN xxxxxxxxxx": tells what bytes of the input does the function N depend on. // The byte string is LEN+1 bytes. The last byte is set if the function // depends on the input length. //===----------------------------------------------------------------------===*/ #include #include #include #include #include #include // backtrace_symbols_fd #include extern "C" { extern int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size); __attribute__((weak)) extern int LLVMFuzzerInitialize(int *argc, char ***argv); } // extern "C" static size_t InputLen; static size_t NumFuncs; static const uintptr_t *FuncsBeg; static __thread size_t CurrentFunc; static dfsan_label *FuncLabels; // Array of NumFuncs elements. static char *PrintableStringForLabel; // InputLen + 2 bytes. static bool LabelSeen[1 << 8 * sizeof(dfsan_label)]; // Prints all instrumented functions. static int PrintFunctions() { // We don't have the symbolizer integrated with dfsan yet. // So use backtrace_symbols_fd and pipe it through llvm-symbolizer. // TODO(kcc): this is pretty ugly and may break in lots of ways. // We'll need to make a proper in-process symbolizer work with DFSan. FILE *Pipe = popen("sed 's/(+/ /g; s/).*//g' " "| llvm-symbolizer " "| grep 'dfs\\$' " "| sed 's/dfs\\$//g'", "w"); for (size_t I = 0; I < NumFuncs; I++) { uintptr_t PC = FuncsBeg[I * 2]; void *const Buf[1] = {(void*)PC}; backtrace_symbols_fd(Buf, 1, fileno(Pipe)); } pclose(Pipe); return 0; } extern "C" void SetBytesForLabel(dfsan_label L, char *Bytes) { if (LabelSeen[L]) return; LabelSeen[L] = true; assert(L); if (L <= InputLen + 1) { Bytes[L - 1] = '1'; } else { auto *DLI = dfsan_get_label_info(L); SetBytesForLabel(DLI->l1, Bytes); SetBytesForLabel(DLI->l2, Bytes); } } static char *GetPrintableStringForLabel(dfsan_label L) { memset(PrintableStringForLabel, '0', InputLen + 1); PrintableStringForLabel[InputLen + 1] = 0; memset(LabelSeen, 0, sizeof(LabelSeen)); SetBytesForLabel(L, PrintableStringForLabel); return PrintableStringForLabel; } static void PrintDataFlow(FILE *Out) { for (size_t I = 0; I < NumFuncs; I++) if (FuncLabels[I]) fprintf(Out, "F%zd %s\n", I, GetPrintableStringForLabel(FuncLabels[I])); } int main(int argc, char **argv) { if (LLVMFuzzerInitialize) LLVMFuzzerInitialize(&argc, &argv); if (argc == 1) return PrintFunctions(); assert(argc == 4 || argc == 5); size_t Beg = atoi(argv[1]); size_t End = atoi(argv[2]); assert(Beg < End); const char *Input = argv[3]; fprintf(stderr, "INFO: reading '%s'\n", Input); FILE *In = fopen(Input, "r"); assert(In); fseek(In, 0, SEEK_END); InputLen = ftell(In); fseek(In, 0, SEEK_SET); unsigned char *Buf = (unsigned char*)malloc(InputLen); size_t NumBytesRead = fread(Buf, 1, InputLen, In); assert(NumBytesRead == InputLen); PrintableStringForLabel = (char*)malloc(InputLen + 2); fclose(In); fprintf(stderr, "INFO: running '%s'\n", Input); for (size_t I = 1; I <= InputLen; I++) { dfsan_label L = dfsan_create_label("", nullptr); assert(L == I); size_t Idx = I - 1; if (Idx >= Beg && Idx < End) dfsan_set_label(L, Buf + Idx, 1); } dfsan_label SizeL = dfsan_create_label("", nullptr); assert(SizeL == InputLen + 1); dfsan_set_label(SizeL, &InputLen, sizeof(InputLen)); LLVMFuzzerTestOneInput(Buf, InputLen); free(Buf); bool OutIsStdout = argc == 4; fprintf(stderr, "INFO: writing dataflow to %s\n", OutIsStdout ? "" : argv[4]); FILE *Out = OutIsStdout ? stdout : fopen(argv[4], "w"); PrintDataFlow(Out); if (!OutIsStdout) fclose(Out); } extern "C" { void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) { assert(NumFuncs == 0 && "This tool does not support DSOs"); assert(start < stop && "The code is not instrumented for coverage"); if (start == stop || *start) return; // Initialize only once. for (uint32_t *x = start; x < stop; x++) *x = ++NumFuncs; // The first index is 1. FuncLabels = (dfsan_label*)calloc(NumFuncs, sizeof(dfsan_label)); fprintf(stderr, "INFO: %zd instrumented function(s) observed\n", NumFuncs); } void __sanitizer_cov_pcs_init(const uintptr_t *pcs_beg, const uintptr_t *pcs_end) { assert(NumFuncs == (pcs_end - pcs_beg) / 2); FuncsBeg = pcs_beg; } void __sanitizer_cov_trace_pc_indir(uint64_t x){} // unused. void __sanitizer_cov_trace_pc_guard(uint32_t *guard){ uint32_t FuncNum = *guard - 1; // Guards start from 1. assert(FuncNum < NumFuncs); CurrentFunc = FuncNum; } void __dfsw___sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases, dfsan_label L1, dfsan_label UnusedL) { assert(CurrentFunc < NumFuncs); FuncLabels[CurrentFunc] = dfsan_union(FuncLabels[CurrentFunc], L1); } #define HOOK(Name, Type) \ void Name(Type Arg1, Type Arg2, dfsan_label L1, dfsan_label L2) { \ assert(CurrentFunc < NumFuncs); \ FuncLabels[CurrentFunc] = \ dfsan_union(FuncLabels[CurrentFunc], dfsan_union(L1, L2)); \ } HOOK(__dfsw___sanitizer_cov_trace_const_cmp1, uint8_t) HOOK(__dfsw___sanitizer_cov_trace_const_cmp2, uint16_t) HOOK(__dfsw___sanitizer_cov_trace_const_cmp4, uint32_t) HOOK(__dfsw___sanitizer_cov_trace_const_cmp8, uint64_t) HOOK(__dfsw___sanitizer_cov_trace_cmp1, uint8_t) HOOK(__dfsw___sanitizer_cov_trace_cmp2, uint16_t) HOOK(__dfsw___sanitizer_cov_trace_cmp4, uint32_t) HOOK(__dfsw___sanitizer_cov_trace_cmp8, uint64_t) } // extern "C" @ 1.1.1.1.2.1 log @file DataFlow.cpp was added on branch pgoyette-compat on 2019-01-18 08:50:50 +0000 @ text @d1 217 @ 1.1.1.1.2.2 log @Synch with HEAD @ text @a0 217 /*===- DataFlow.cpp - a standalone DataFlow tracer -------===// // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // An experimental data-flow tracer for fuzz targets. // It is based on DFSan and SanitizerCoverage. // https://clang.llvm.org/docs/DataFlowSanitizer.html // https://clang.llvm.org/docs/SanitizerCoverage.html#tracing-data-flow // // It executes the fuzz target on the given input while monitoring the // data flow for every instrumented comparison instruction. // // The output shows which functions depend on which bytes of the input. // // Build: // 1. Compile this file with -fsanitize=dataflow // 2. Build the fuzz target with -g -fsanitize=dataflow // -fsanitize-coverage=trace-pc-guard,pc-table,func,trace-cmp // 3. Link those together with -fsanitize=dataflow // // -fsanitize-coverage=trace-cmp inserts callbacks around every comparison // instruction, DFSan modifies the calls to pass the data flow labels. // The callbacks update the data flow label for the current function. // See e.g. __dfsw___sanitizer_cov_trace_cmp1 below. // // -fsanitize-coverage=trace-pc-guard,pc-table,func instruments function // entries so that the comparison callback knows that current function. // // // Run: // # Collect data flow for INPUT_FILE, write to OUTPUT_FILE (default: stdout) // ./a.out INPUT_FILE [OUTPUT_FILE] // // # Print all instrumented functions. llvm-symbolizer must be present in PATH // ./a.out // // Example output: // =============== // F0 11111111111111 // F1 10000000000000 // =============== // "FN xxxxxxxxxx": tells what bytes of the input does the function N depend on. // The byte string is LEN+1 bytes. The last byte is set if the function // depends on the input length. //===----------------------------------------------------------------------===*/ #include #include #include #include #include #include // backtrace_symbols_fd #include extern "C" { extern int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size); __attribute__((weak)) extern int LLVMFuzzerInitialize(int *argc, char ***argv); } // extern "C" static size_t InputLen; static size_t NumFuncs; static const uintptr_t *FuncsBeg; static __thread size_t CurrentFunc; static dfsan_label *FuncLabels; // Array of NumFuncs elements. static char *PrintableStringForLabel; // InputLen + 2 bytes. static bool LabelSeen[1 << 8 * sizeof(dfsan_label)]; // Prints all instrumented functions. static int PrintFunctions() { // We don't have the symbolizer integrated with dfsan yet. // So use backtrace_symbols_fd and pipe it through llvm-symbolizer. // TODO(kcc): this is pretty ugly and may break in lots of ways. // We'll need to make a proper in-process symbolizer work with DFSan. FILE *Pipe = popen("sed 's/(+/ /g; s/).*//g' " "| llvm-symbolizer " "| grep 'dfs\\$' " "| sed 's/dfs\\$//g'", "w"); for (size_t I = 0; I < NumFuncs; I++) { uintptr_t PC = FuncsBeg[I * 2]; void *const Buf[1] = {(void*)PC}; backtrace_symbols_fd(Buf, 1, fileno(Pipe)); } pclose(Pipe); return 0; } extern "C" void SetBytesForLabel(dfsan_label L, char *Bytes) { if (LabelSeen[L]) return; LabelSeen[L] = true; assert(L); if (L <= InputLen + 1) { Bytes[L - 1] = '1'; } else { auto *DLI = dfsan_get_label_info(L); SetBytesForLabel(DLI->l1, Bytes); SetBytesForLabel(DLI->l2, Bytes); } } static char *GetPrintableStringForLabel(dfsan_label L) { memset(PrintableStringForLabel, '0', InputLen + 1); PrintableStringForLabel[InputLen + 1] = 0; memset(LabelSeen, 0, sizeof(LabelSeen)); SetBytesForLabel(L, PrintableStringForLabel); return PrintableStringForLabel; } static void PrintDataFlow(FILE *Out) { for (size_t I = 0; I < NumFuncs; I++) if (FuncLabels[I]) fprintf(Out, "F%zd %s\n", I, GetPrintableStringForLabel(FuncLabels[I])); } int main(int argc, char **argv) { if (LLVMFuzzerInitialize) LLVMFuzzerInitialize(&argc, &argv); if (argc == 1) return PrintFunctions(); assert(argc == 4 || argc == 5); size_t Beg = atoi(argv[1]); size_t End = atoi(argv[2]); assert(Beg < End); const char *Input = argv[3]; fprintf(stderr, "INFO: reading '%s'\n", Input); FILE *In = fopen(Input, "r"); assert(In); fseek(In, 0, SEEK_END); InputLen = ftell(In); fseek(In, 0, SEEK_SET); unsigned char *Buf = (unsigned char*)malloc(InputLen); size_t NumBytesRead = fread(Buf, 1, InputLen, In); assert(NumBytesRead == InputLen); PrintableStringForLabel = (char*)malloc(InputLen + 2); fclose(In); fprintf(stderr, "INFO: running '%s'\n", Input); for (size_t I = 1; I <= InputLen; I++) { dfsan_label L = dfsan_create_label("", nullptr); assert(L == I); size_t Idx = I - 1; if (Idx >= Beg && Idx < End) dfsan_set_label(L, Buf + Idx, 1); } dfsan_label SizeL = dfsan_create_label("", nullptr); assert(SizeL == InputLen + 1); dfsan_set_label(SizeL, &InputLen, sizeof(InputLen)); LLVMFuzzerTestOneInput(Buf, InputLen); free(Buf); bool OutIsStdout = argc == 4; fprintf(stderr, "INFO: writing dataflow to %s\n", OutIsStdout ? "" : argv[4]); FILE *Out = OutIsStdout ? stdout : fopen(argv[4], "w"); PrintDataFlow(Out); if (!OutIsStdout) fclose(Out); } extern "C" { void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) { assert(NumFuncs == 0 && "This tool does not support DSOs"); assert(start < stop && "The code is not instrumented for coverage"); if (start == stop || *start) return; // Initialize only once. for (uint32_t *x = start; x < stop; x++) *x = ++NumFuncs; // The first index is 1. FuncLabels = (dfsan_label*)calloc(NumFuncs, sizeof(dfsan_label)); fprintf(stderr, "INFO: %zd instrumented function(s) observed\n", NumFuncs); } void __sanitizer_cov_pcs_init(const uintptr_t *pcs_beg, const uintptr_t *pcs_end) { assert(NumFuncs == (pcs_end - pcs_beg) / 2); FuncsBeg = pcs_beg; } void __sanitizer_cov_trace_pc_indir(uint64_t x){} // unused. void __sanitizer_cov_trace_pc_guard(uint32_t *guard){ uint32_t FuncNum = *guard - 1; // Guards start from 1. assert(FuncNum < NumFuncs); CurrentFunc = FuncNum; } void __dfsw___sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases, dfsan_label L1, dfsan_label UnusedL) { assert(CurrentFunc < NumFuncs); FuncLabels[CurrentFunc] = dfsan_union(FuncLabels[CurrentFunc], L1); } #define HOOK(Name, Type) \ void Name(Type Arg1, Type Arg2, dfsan_label L1, dfsan_label L2) { \ assert(CurrentFunc < NumFuncs); \ FuncLabels[CurrentFunc] = \ dfsan_union(FuncLabels[CurrentFunc], dfsan_union(L1, L2)); \ } HOOK(__dfsw___sanitizer_cov_trace_const_cmp1, uint8_t) HOOK(__dfsw___sanitizer_cov_trace_const_cmp2, uint16_t) HOOK(__dfsw___sanitizer_cov_trace_const_cmp4, uint32_t) HOOK(__dfsw___sanitizer_cov_trace_const_cmp8, uint64_t) HOOK(__dfsw___sanitizer_cov_trace_cmp1, uint8_t) HOOK(__dfsw___sanitizer_cov_trace_cmp2, uint16_t) HOOK(__dfsw___sanitizer_cov_trace_cmp4, uint32_t) HOOK(__dfsw___sanitizer_cov_trace_cmp8, uint64_t) } // extern "C" @