689 lines · cpp
1//===- FuzzerTracePC.cpp - PC tracing--------------------------------------===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8// Trace PCs.9// This module implements __sanitizer_cov_trace_pc_guard[_init],10// the callback required for -fsanitize-coverage=trace-pc-guard instrumentation.11//12//===----------------------------------------------------------------------===//13 14#include "FuzzerTracePC.h"15#include "FuzzerBuiltins.h"16#include "FuzzerBuiltinsMsvc.h"17#include "FuzzerCorpus.h"18#include "FuzzerDefs.h"19#include "FuzzerDictionary.h"20#include "FuzzerExtFunctions.h"21#include "FuzzerIO.h"22#include "FuzzerPlatform.h"23#include "FuzzerUtil.h"24#include "FuzzerValueBitMap.h"25#include <set>26 27// Used by -fsanitize-coverage=stack-depth to track stack depth28ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC uintptr_t __sancov_lowest_stack;29 30namespace fuzzer {31 32TracePC TPC;33 34size_t TracePC::GetTotalPCCoverage() {35 return ObservedPCs.size();36}37 38 39void TracePC::HandleInline8bitCountersInit(uint8_t *Start, uint8_t *Stop) {40 if (Start == Stop) return;41 if (NumModules &&42 Modules[NumModules - 1].Start() == Start)43 return;44 assert(NumModules <45 sizeof(Modules) / sizeof(Modules[0]));46 auto &M = Modules[NumModules++];47 uint8_t *AlignedStart = RoundUpByPage(Start);48 uint8_t *AlignedStop = RoundDownByPage(Stop);49 size_t NumFullPages = AlignedStop > AlignedStart ?50 (AlignedStop - AlignedStart) / PageSize() : 0;51 bool NeedFirst = Start < AlignedStart || !NumFullPages;52 bool NeedLast = Stop > AlignedStop && AlignedStop >= AlignedStart;53 M.NumRegions = NumFullPages + NeedFirst + NeedLast;;54 assert(M.NumRegions > 0);55 M.Regions = new Module::Region[M.NumRegions];56 assert(M.Regions);57 size_t R = 0;58 if (NeedFirst)59 M.Regions[R++] = {Start, std::min(Stop, AlignedStart), true, false};60 for (uint8_t *P = AlignedStart; P < AlignedStop; P += PageSize())61 M.Regions[R++] = {P, P + PageSize(), true, true};62 if (NeedLast)63 M.Regions[R++] = {AlignedStop, Stop, true, false};64 assert(R == M.NumRegions);65 assert(M.Size() == (size_t)(Stop - Start));66 assert(M.Stop() == Stop);67 assert(M.Start() == Start);68 NumInline8bitCounters += M.Size();69}70 71void TracePC::HandlePCsInit(const uintptr_t *Start, const uintptr_t *Stop) {72 if (Start == Stop) {73 return;74 }75 const PCTableEntry *B = reinterpret_cast<const PCTableEntry *>(Start);76 const PCTableEntry *E = reinterpret_cast<const PCTableEntry *>(Stop);77 if (NumPCTables && ModulePCTable[NumPCTables - 1].Start == B) return;78 assert(NumPCTables < sizeof(ModulePCTable) / sizeof(ModulePCTable[0]));79 ModulePCTable[NumPCTables++] = {B, E};80 NumPCsInPCTables += E - B;81}82 83void TracePC::PrintModuleInfo() {84 if (NumModules) {85 Printf("INFO: Loaded %zd modules (%zd inline 8-bit counters): ",86 NumModules, NumInline8bitCounters);87 for (size_t i = 0; i < NumModules; i++)88 Printf("%zd [%p, %p), ", Modules[i].Size(), Modules[i].Start(),89 Modules[i].Stop());90 Printf("\n");91 }92 if (NumPCTables) {93 Printf("INFO: Loaded %zd PC tables (%zd PCs): ", NumPCTables,94 NumPCsInPCTables);95 for (size_t i = 0; i < NumPCTables; i++) {96 Printf("%zd [%p,%p), ", ModulePCTable[i].Stop - ModulePCTable[i].Start,97 ModulePCTable[i].Start, ModulePCTable[i].Stop);98 }99 Printf("\n");100 101 if (NumInline8bitCounters && NumInline8bitCounters != NumPCsInPCTables) {102 Printf("ERROR: The size of coverage PC tables does not match the\n"103 "number of instrumented PCs. This might be a compiler bug,\n"104 "please contact the libFuzzer developers.\n"105 "Also check https://bugs.llvm.org/show_bug.cgi?id=34636\n"106 "for possible workarounds (tl;dr: don't use the old GNU ld)\n");107 _Exit(1);108 }109 }110 if (size_t NumExtraCounters = ExtraCountersEnd() - ExtraCountersBegin())111 Printf("INFO: %zd Extra Counters\n", NumExtraCounters);112 113 size_t MaxFeatures = CollectFeatures([](uint32_t) {});114 if (MaxFeatures > std::numeric_limits<uint32_t>::max())115 Printf("WARNING: The coverage PC tables may produce up to %zu features.\n"116 "This exceeds the maximum 32-bit value. Some features may be\n"117 "ignored, and fuzzing may become less precise. If possible,\n"118 "consider refactoring the fuzzer into several smaller fuzzers\n"119 "linked against only a portion of the current target.\n",120 MaxFeatures);121}122 123ATTRIBUTE_NO_SANITIZE_ALL124void TracePC::HandleCallerCallee(uintptr_t Caller, uintptr_t Callee) {125 const uintptr_t kBits = 12;126 const uintptr_t kMask = (1 << kBits) - 1;127 uintptr_t Idx = (Caller & kMask) | ((Callee & kMask) << kBits);128 ValueProfileMap.AddValueModPrime(Idx);129}130 131/// \return the address of the previous instruction.132/// Note: the logic is copied from `sanitizer_common/sanitizer_stacktrace.h`133inline ALWAYS_INLINE uintptr_t GetPreviousInstructionPc(uintptr_t PC) {134#if defined(__arm__)135 // T32 (Thumb) branch instructions might be 16 or 32 bit long,136 // so we return (pc-2) in that case in order to be safe.137 // For A32 mode we return (pc-4) because all instructions are 32 bit long.138 return (PC - 3) & (~1);139#elif defined(__sparc__) || defined(__mips__)140 return PC - 8;141#elif defined(__riscv__)142 return PC - 2;143#elif defined(__i386__) || defined(__x86_64__) || defined(_M_IX86) || defined(_M_X64)144 return PC - 1;145#else146 return PC - 4;147#endif148}149 150/// \return the address of the next instruction.151/// Note: the logic is copied from `sanitizer_common/sanitizer_stacktrace.cpp`152ALWAYS_INLINE uintptr_t TracePC::GetNextInstructionPc(uintptr_t PC) {153#if defined(__mips__)154 return PC + 8;155#elif defined(__powerpc__) || defined(__sparc__) || defined(__arm__) || \156 defined(__aarch64__) || defined(__loongarch__)157 return PC + 4;158#else159 return PC + 1;160#endif161}162 163void TracePC::UpdateObservedPCs() {164 std::vector<uintptr_t> CoveredFuncs;165 auto ObservePC = [&](const PCTableEntry *TE) {166 if (ObservedPCs.insert(TE).second && DoPrintNewPCs) {167 PrintPC("\tNEW_PC: %p %F %L", "\tNEW_PC: %p",168 GetNextInstructionPc(TE->PC));169 Printf("\n");170 }171 };172 173 auto Observe = [&](const PCTableEntry *TE) {174 if (PcIsFuncEntry(TE))175 if (++ObservedFuncs[TE->PC] == 1 && NumPrintNewFuncs)176 CoveredFuncs.push_back(TE->PC);177 ObservePC(TE);178 };179 180 if (NumPCsInPCTables) {181 if (NumInline8bitCounters == NumPCsInPCTables) {182 for (size_t i = 0; i < NumModules; i++) {183 auto &M = Modules[i];184 assert(M.Size() ==185 (size_t)(ModulePCTable[i].Stop - ModulePCTable[i].Start));186 for (size_t r = 0; r < M.NumRegions; r++) {187 auto &R = M.Regions[r];188 if (!R.Enabled) continue;189 for (uint8_t *P = R.Start; P < R.Stop; P++)190 if (*P)191 Observe(&ModulePCTable[i].Start[M.Idx(P)]);192 }193 }194 }195 }196 197 for (size_t i = 0, N = Min(CoveredFuncs.size(), NumPrintNewFuncs); i < N;198 i++) {199 Printf("\tNEW_FUNC[%zd/%zd]: ", i + 1, CoveredFuncs.size());200 PrintPC("%p %F %L", "%p", GetNextInstructionPc(CoveredFuncs[i]));201 Printf("\n");202 }203}204 205uintptr_t TracePC::PCTableEntryIdx(const PCTableEntry *TE) {206 size_t TotalTEs = 0;207 for (size_t i = 0; i < NumPCTables; i++) {208 auto &M = ModulePCTable[i];209 if (TE >= M.Start && TE < M.Stop)210 return TotalTEs + TE - M.Start;211 TotalTEs += M.Stop - M.Start;212 }213 assert(0);214 return 0;215}216 217const TracePC::PCTableEntry *TracePC::PCTableEntryByIdx(uintptr_t Idx) {218 for (size_t i = 0; i < NumPCTables; i++) {219 auto &M = ModulePCTable[i];220 size_t Size = M.Stop - M.Start;221 if (Idx < Size) return &M.Start[Idx];222 Idx -= Size;223 }224 return nullptr;225}226 227static std::string GetModuleName(uintptr_t PC) {228 char ModulePathRaw[4096] = ""; // What's PATH_MAX in portable C++?229 void *OffsetRaw = nullptr;230 if (!EF->__sanitizer_get_module_and_offset_for_pc(231 reinterpret_cast<void *>(PC), ModulePathRaw,232 sizeof(ModulePathRaw), &OffsetRaw))233 return "";234 return ModulePathRaw;235}236 237template<class CallBack>238void TracePC::IterateCoveredFunctions(CallBack CB) {239 for (size_t i = 0; i < NumPCTables; i++) {240 auto &M = ModulePCTable[i];241 assert(M.Start < M.Stop);242 auto ModuleName = GetModuleName(M.Start->PC);243 for (auto NextFE = M.Start; NextFE < M.Stop; ) {244 auto FE = NextFE;245 assert(PcIsFuncEntry(FE) && "Not a function entry point");246 do {247 NextFE++;248 } while (NextFE < M.Stop && !(PcIsFuncEntry(NextFE)));249 CB(FE, NextFE, ObservedFuncs[FE->PC]);250 }251 }252}253 254void TracePC::SetFocusFunction(const std::string &FuncName) {255 // This function should be called once.256 assert(!FocusFunctionCounterPtr);257 // "auto" is not a valid function name. If this function is called with "auto"258 // that means the auto focus functionality failed.259 if (FuncName.empty() || FuncName == "auto")260 return;261 for (size_t M = 0; M < NumModules; M++) {262 auto &PCTE = ModulePCTable[M];263 size_t N = PCTE.Stop - PCTE.Start;264 for (size_t I = 0; I < N; I++) {265 if (!(PcIsFuncEntry(&PCTE.Start[I]))) continue; // not a function entry.266 auto Name = DescribePC("%F", GetNextInstructionPc(PCTE.Start[I].PC));267 if (Name[0] == 'i' && Name[1] == 'n' && Name[2] == ' ')268 Name = Name.substr(3, std::string::npos);269 if (FuncName != Name) continue;270 Printf("INFO: Focus function is set to '%s'\n", Name.c_str());271 FocusFunctionCounterPtr = Modules[M].Start() + I;272 return;273 }274 }275 276 Printf("ERROR: Failed to set focus function. Make sure the function name is "277 "valid (%s) and symbolization is enabled.\n", FuncName.c_str());278 exit(1);279}280 281bool TracePC::ObservedFocusFunction() {282 return FocusFunctionCounterPtr && *FocusFunctionCounterPtr;283}284 285void TracePC::PrintCoverage(bool PrintAllCounters) {286 if (!EF->__sanitizer_symbolize_pc ||287 !EF->__sanitizer_get_module_and_offset_for_pc) {288 Printf("INFO: __sanitizer_symbolize_pc or "289 "__sanitizer_get_module_and_offset_for_pc is not available,"290 " not printing coverage\n");291 return;292 }293 Printf(PrintAllCounters ? "FULL COVERAGE:\n" : "COVERAGE:\n");294 auto CoveredFunctionCallback = [&](const PCTableEntry *First,295 const PCTableEntry *Last,296 uintptr_t Counter) {297 assert(First < Last);298 auto VisualizePC = GetNextInstructionPc(First->PC);299 std::string FileStr = DescribePC("%s", VisualizePC);300 if (!IsInterestingCoverageFile(FileStr))301 return;302 std::string FunctionStr = DescribePC("%F", VisualizePC);303 if (FunctionStr.find("in ") == 0)304 FunctionStr = FunctionStr.substr(3);305 std::string LineStr = DescribePC("%l", VisualizePC);306 size_t NumEdges = Last - First;307 std::vector<uintptr_t> UncoveredPCs;308 std::vector<uintptr_t> CoveredPCs;309 for (auto TE = First; TE < Last; TE++)310 if (!ObservedPCs.count(TE))311 UncoveredPCs.push_back(TE->PC);312 else313 CoveredPCs.push_back(TE->PC);314 315 if (PrintAllCounters) {316 Printf("U");317 for (auto PC : UncoveredPCs)318 Printf(DescribePC(" %l", GetNextInstructionPc(PC)).c_str());319 Printf("\n");320 321 Printf("C");322 for (auto PC : CoveredPCs)323 Printf(DescribePC(" %l", GetNextInstructionPc(PC)).c_str());324 Printf("\n");325 } else {326 Printf("%sCOVERED_FUNC: hits: %zd", Counter ? "" : "UN", Counter);327 Printf(" edges: %zd/%zd", NumEdges - UncoveredPCs.size(), NumEdges);328 Printf(" %s %s:%s\n", FunctionStr.c_str(), FileStr.c_str(),329 LineStr.c_str());330 if (Counter)331 for (auto PC : UncoveredPCs)332 Printf(" UNCOVERED_PC: %s\n",333 DescribePC("%s:%l", GetNextInstructionPc(PC)).c_str());334 }335 };336 337 IterateCoveredFunctions(CoveredFunctionCallback);338}339 340// Value profile.341// We keep track of various values that affect control flow.342// These values are inserted into a bit-set-based hash map.343// Every new bit in the map is treated as a new coverage.344//345// For memcmp/strcmp/etc the interesting value is the length of the common346// prefix of the parameters.347// For cmp instructions the interesting value is a XOR of the parameters.348// The interesting value is mixed up with the PC and is then added to the map.349 350ATTRIBUTE_NO_SANITIZE_ALL351void TracePC::AddValueForMemcmp(void *caller_pc, const void *s1, const void *s2,352 size_t n, bool StopAtZero) {353 if (!n) return;354 size_t Len = std::min(n, Word::GetMaxSize());355 const uint8_t *A1 = reinterpret_cast<const uint8_t *>(s1);356 const uint8_t *A2 = reinterpret_cast<const uint8_t *>(s2);357 uint8_t B1[Word::kMaxSize];358 uint8_t B2[Word::kMaxSize];359 // Copy the data into locals in this non-msan-instrumented function360 // to avoid msan complaining further.361 size_t Hash = 0; // Compute some simple hash of both strings.362 for (size_t i = 0; i < Len; i++) {363 B1[i] = A1[i];364 B2[i] = A2[i];365 size_t T = B1[i];366 Hash ^= (T << 8) | B2[i];367 }368 size_t I = 0;369 uint8_t HammingDistance = 0;370 for (; I < Len; I++) {371 if (B1[I] != B2[I] || (StopAtZero && B1[I] == 0)) {372 HammingDistance = static_cast<uint8_t>(Popcountll(B1[I] ^ B2[I]));373 break;374 }375 }376 size_t PC = reinterpret_cast<size_t>(caller_pc);377 size_t Idx = (PC & 4095) | (I << 12);378 Idx += HammingDistance;379 ValueProfileMap.AddValue(Idx);380 TORCW.Insert(Idx ^ Hash, Word(B1, Len), Word(B2, Len));381}382 383template <class T>384ATTRIBUTE_TARGET_POPCNT ALWAYS_INLINE385ATTRIBUTE_NO_SANITIZE_ALL386void TracePC::HandleCmp(uintptr_t PC, T Arg1, T Arg2) {387 uint64_t ArgXor = Arg1 ^ Arg2;388 if (sizeof(T) == 4)389 TORC4.Insert(ArgXor, Arg1, Arg2);390 else if (sizeof(T) == 8)391 TORC8.Insert(ArgXor, Arg1, Arg2);392 uint64_t HammingDistance = Popcountll(ArgXor); // [0,64]393 uint64_t AbsoluteDistance = (Arg1 == Arg2 ? 0 : Clzll(Arg1 - Arg2) + 1);394 ValueProfileMap.AddValue(PC * 128 + HammingDistance);395 ValueProfileMap.AddValue(PC * 128 + 64 + AbsoluteDistance);396}397 398ATTRIBUTE_NO_SANITIZE_MEMORY399static size_t InternalStrnlen(const char *S, size_t MaxLen) {400 size_t Len = 0;401 for (; Len < MaxLen && S[Len]; Len++) {}402 return Len;403}404 405// Finds min of (strlen(S1), strlen(S2)).406// Needed because one of these strings may actually be non-zero terminated.407ATTRIBUTE_NO_SANITIZE_MEMORY408static size_t InternalStrnlen2(const char *S1, const char *S2) {409 size_t Len = 0;410 for (; S1[Len] && S2[Len]; Len++) {}411 return Len;412}413 414void TracePC::ClearInlineCounters() {415 IterateCounterRegions([](const Module::Region &R){416 if (R.Enabled)417 memset(R.Start, 0, R.Stop - R.Start);418 });419}420 421ATTRIBUTE_NO_SANITIZE_ALL422void TracePC::RecordInitialStack() {423 int stack;424 __sancov_lowest_stack = InitialStack = reinterpret_cast<uintptr_t>(&stack);425}426 427uintptr_t TracePC::GetMaxStackOffset() const {428 return InitialStack - __sancov_lowest_stack; // Stack grows down429}430 431void WarnAboutDeprecatedInstrumentation(const char *flag) {432 // Use RawPrint because Printf cannot be used on Windows before OutputFile is433 // initialized.434 RawPrint(flag);435 RawPrint(436 " is no longer supported by libFuzzer.\n"437 "Please either migrate to a compiler that supports -fsanitize=fuzzer\n"438 "or use an older version of libFuzzer\n");439 exit(1);440}441 442} // namespace fuzzer443 444extern "C" {445ATTRIBUTE_INTERFACE446ATTRIBUTE_NO_SANITIZE_ALL447void __sanitizer_cov_trace_pc_guard(uint32_t *Guard) {448 fuzzer::WarnAboutDeprecatedInstrumentation(449 "-fsanitize-coverage=trace-pc-guard");450}451 452// Best-effort support for -fsanitize-coverage=trace-pc, which is available453// in both Clang and GCC.454ATTRIBUTE_INTERFACE455ATTRIBUTE_NO_SANITIZE_ALL456void __sanitizer_cov_trace_pc() {457 fuzzer::WarnAboutDeprecatedInstrumentation("-fsanitize-coverage=trace-pc");458}459 460ATTRIBUTE_INTERFACE461void __sanitizer_cov_trace_pc_guard_init(uint32_t *Start, uint32_t *Stop) {462 fuzzer::WarnAboutDeprecatedInstrumentation(463 "-fsanitize-coverage=trace-pc-guard");464}465 466ATTRIBUTE_INTERFACE467void __sanitizer_cov_8bit_counters_init(uint8_t *Start, uint8_t *Stop) {468 fuzzer::TPC.HandleInline8bitCountersInit(Start, Stop);469}470 471ATTRIBUTE_INTERFACE472void __sanitizer_cov_pcs_init(const uintptr_t *pcs_beg,473 const uintptr_t *pcs_end) {474 fuzzer::TPC.HandlePCsInit(pcs_beg, pcs_end);475}476 477ATTRIBUTE_INTERFACE478ATTRIBUTE_NO_SANITIZE_ALL479void __sanitizer_cov_trace_pc_indir(uintptr_t Callee) {480 uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());481 fuzzer::TPC.HandleCallerCallee(PC, Callee);482}483 484ATTRIBUTE_INTERFACE485ATTRIBUTE_NO_SANITIZE_ALL486ATTRIBUTE_TARGET_POPCNT487void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) {488 uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());489 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);490}491 492ATTRIBUTE_INTERFACE493ATTRIBUTE_NO_SANITIZE_ALL494ATTRIBUTE_TARGET_POPCNT495// Now the __sanitizer_cov_trace_const_cmp[1248] callbacks just mimic496// the behaviour of __sanitizer_cov_trace_cmp[1248] ones. This, however,497// should be changed later to make full use of instrumentation.498void __sanitizer_cov_trace_const_cmp8(uint64_t Arg1, uint64_t Arg2) {499 uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());500 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);501}502 503ATTRIBUTE_INTERFACE504ATTRIBUTE_NO_SANITIZE_ALL505ATTRIBUTE_TARGET_POPCNT506void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) {507 uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());508 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);509}510 511ATTRIBUTE_INTERFACE512ATTRIBUTE_NO_SANITIZE_ALL513ATTRIBUTE_TARGET_POPCNT514void __sanitizer_cov_trace_const_cmp4(uint32_t Arg1, uint32_t Arg2) {515 uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());516 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);517}518 519ATTRIBUTE_INTERFACE520ATTRIBUTE_NO_SANITIZE_ALL521ATTRIBUTE_TARGET_POPCNT522void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) {523 uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());524 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);525}526 527ATTRIBUTE_INTERFACE528ATTRIBUTE_NO_SANITIZE_ALL529ATTRIBUTE_TARGET_POPCNT530void __sanitizer_cov_trace_const_cmp2(uint16_t Arg1, uint16_t Arg2) {531 uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());532 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);533}534 535ATTRIBUTE_INTERFACE536ATTRIBUTE_NO_SANITIZE_ALL537ATTRIBUTE_TARGET_POPCNT538void __sanitizer_cov_trace_cmp1(uint8_t Arg1, uint8_t Arg2) {539 uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());540 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);541}542 543ATTRIBUTE_INTERFACE544ATTRIBUTE_NO_SANITIZE_ALL545ATTRIBUTE_TARGET_POPCNT546void __sanitizer_cov_trace_const_cmp1(uint8_t Arg1, uint8_t Arg2) {547 uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());548 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);549}550 551ATTRIBUTE_INTERFACE552ATTRIBUTE_NO_SANITIZE_ALL553ATTRIBUTE_TARGET_POPCNT554void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases) {555 uint64_t N = Cases[0];556 uint64_t ValSizeInBits = Cases[1];557 uint64_t *Vals = Cases + 2;558 // Skip the most common and the most boring case: all switch values are small.559 // We may want to skip this at compile-time, but it will make the560 // instrumentation less general.561 if (Vals[N - 1] < 256)562 return;563 // Also skip small inputs values, they won't give good signal.564 if (Val < 256)565 return;566 uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());567 size_t i;568 uint64_t Smaller = 0;569 uint64_t Larger = ~(uint64_t)0;570 // Find two switch values such that Smaller < Val < Larger.571 // Use 0 and 0xfff..f as the defaults.572 for (i = 0; i < N; i++) {573 if (Val < Vals[i]) {574 Larger = Vals[i];575 break;576 }577 if (Val > Vals[i]) Smaller = Vals[i];578 }579 580 // Apply HandleCmp to {Val,Smaller} and {Val, Larger},581 // use i as the PC modifier for HandleCmp.582 if (ValSizeInBits == 16) {583 fuzzer::TPC.HandleCmp(PC + 2 * i, static_cast<uint16_t>(Val),584 (uint16_t)(Smaller));585 fuzzer::TPC.HandleCmp(PC + 2 * i + 1, static_cast<uint16_t>(Val),586 (uint16_t)(Larger));587 } else if (ValSizeInBits == 32) {588 fuzzer::TPC.HandleCmp(PC + 2 * i, static_cast<uint32_t>(Val),589 (uint32_t)(Smaller));590 fuzzer::TPC.HandleCmp(PC + 2 * i + 1, static_cast<uint32_t>(Val),591 (uint32_t)(Larger));592 } else {593 fuzzer::TPC.HandleCmp(PC + 2*i, Val, Smaller);594 fuzzer::TPC.HandleCmp(PC + 2*i + 1, Val, Larger);595 }596}597 598ATTRIBUTE_INTERFACE599ATTRIBUTE_NO_SANITIZE_ALL600ATTRIBUTE_TARGET_POPCNT601void __sanitizer_cov_trace_div4(uint32_t Val) {602 uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());603 fuzzer::TPC.HandleCmp(PC, Val, (uint32_t)0);604}605 606ATTRIBUTE_INTERFACE607ATTRIBUTE_NO_SANITIZE_ALL608ATTRIBUTE_TARGET_POPCNT609void __sanitizer_cov_trace_div8(uint64_t Val) {610 uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());611 fuzzer::TPC.HandleCmp(PC, Val, (uint64_t)0);612}613 614ATTRIBUTE_INTERFACE615ATTRIBUTE_NO_SANITIZE_ALL616ATTRIBUTE_TARGET_POPCNT617void __sanitizer_cov_trace_gep(uintptr_t Idx) {618 uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());619 fuzzer::TPC.HandleCmp(PC, Idx, (uintptr_t)0);620}621 622ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY623void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1,624 const void *s2, size_t n, int result) {625 if (!fuzzer::RunningUserCallback) return;626 if (result == 0) return; // No reason to mutate.627 if (n <= 1) return; // Not interesting.628 fuzzer::TPC.AddValueForMemcmp(caller_pc, s1, s2, n, /*StopAtZero*/false);629}630 631ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY632void __sanitizer_weak_hook_strncmp(void *caller_pc, const char *s1,633 const char *s2, size_t n, int result) {634 if (!fuzzer::RunningUserCallback) return;635 if (result == 0) return; // No reason to mutate.636 size_t Len1 = fuzzer::InternalStrnlen(s1, n);637 size_t Len2 = fuzzer::InternalStrnlen(s2, n);638 n = std::min(n, Len1);639 n = std::min(n, Len2);640 if (n <= 1) return; // Not interesting.641 fuzzer::TPC.AddValueForMemcmp(caller_pc, s1, s2, n, /*StopAtZero*/true);642}643 644ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY645void __sanitizer_weak_hook_strcmp(void *caller_pc, const char *s1,646 const char *s2, int result) {647 if (!fuzzer::RunningUserCallback) return;648 if (result == 0) return; // No reason to mutate.649 size_t N = fuzzer::InternalStrnlen2(s1, s2);650 if (N <= 1) return; // Not interesting.651 fuzzer::TPC.AddValueForMemcmp(caller_pc, s1, s2, N, /*StopAtZero*/true);652}653 654ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY655void __sanitizer_weak_hook_strncasecmp(void *called_pc, const char *s1,656 const char *s2, size_t n, int result) {657 if (!fuzzer::RunningUserCallback) return;658 return __sanitizer_weak_hook_strncmp(called_pc, s1, s2, n, result);659}660 661ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY662void __sanitizer_weak_hook_strcasecmp(void *called_pc, const char *s1,663 const char *s2, int result) {664 if (!fuzzer::RunningUserCallback) return;665 return __sanitizer_weak_hook_strcmp(called_pc, s1, s2, result);666}667 668ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY669void __sanitizer_weak_hook_strstr(void *called_pc, const char *s1,670 const char *s2, char *result) {671 if (!fuzzer::RunningUserCallback) return;672 fuzzer::TPC.MMT.Add(reinterpret_cast<const uint8_t *>(s2), strlen(s2));673}674 675ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY676void __sanitizer_weak_hook_strcasestr(void *called_pc, const char *s1,677 const char *s2, char *result) {678 if (!fuzzer::RunningUserCallback) return;679 fuzzer::TPC.MMT.Add(reinterpret_cast<const uint8_t *>(s2), strlen(s2));680}681 682ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY683void __sanitizer_weak_hook_memmem(void *called_pc, const void *s1, size_t len1,684 const void *s2, size_t len2, void *result) {685 if (!fuzzer::RunningUserCallback) return;686 fuzzer::TPC.MMT.Add(reinterpret_cast<const uint8_t *>(s2), len2);687}688} // extern "C"689