61 lines · cpp
1// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.2// See https://llvm.org/LICENSE.txt for license information.3// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception4 5// Like SimpleTest, but simulates an "empty" module (i.e. one without any functions to instrument).6// This reproduces a previous bug (when libFuzzer is compiled with assertions enabled).7 8#include <assert.h>9#include <cstddef>10#include <cstdint>11#include <cstdlib>12#include <iostream>13#include <ostream>14 15extern "C" {16void __sanitizer_cov_8bit_counters_init(uint8_t *Start, uint8_t *Stop);17void __sanitizer_cov_pcs_init(const uintptr_t *pcs_beg,18 const uintptr_t *pcs_end);19}20 21void dummy_func() {}22 23uint8_t empty_8bit_counters[0];24uintptr_t empty_pcs[0];25 26uint8_t fake_8bit_counters[1] = {0};27uintptr_t fake_pcs[2] = {reinterpret_cast<uintptr_t>(&dummy_func),28 reinterpret_cast<uintptr_t>(&dummy_func)};29 30// Register two modules at program launch (same time they'd normally be registered).31// Triggering the bug requires loading an empty module, then a non-empty module after it.32bool dummy = []() {33 // First, simulate loading an empty module.34 __sanitizer_cov_8bit_counters_init(empty_8bit_counters, empty_8bit_counters);35 __sanitizer_cov_pcs_init(empty_pcs, empty_pcs);36 37 // Next, simulate loading a non-empty module.38 __sanitizer_cov_8bit_counters_init(fake_8bit_counters,39 fake_8bit_counters + 1);40 __sanitizer_cov_pcs_init(fake_pcs, fake_pcs + 2);41 42 return true;43}();44 45static volatile int Sink;46 47extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {48 assert(Data);49 if (Size > 0 && Data[0] == 'H') {50 Sink = 1;51 if (Size > 1 && Data[1] == 'i') {52 Sink = 2;53 if (Size > 2 && Data[2] == '!') {54 std::cout << "BINGO; Found the target, exiting\n" << std::flush;55 exit(0);56 }57 }58 }59 return 0;60}61