50 lines · cpp
1// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.2// See https://llvm.org/LICENSE.txt for license information.3// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception4 5// Make sure the fuzzer eventually finds all possible values of a variable6// within a range.7#include <cassert>8#include <cstdint>9#include <cstdio>10#include <cstdlib>11#include <cstring>12#include <set>13 14const size_t N = 1 << 12;15 16// Define an array of counters that will be understood by libFuzzer17// as extra coverage signal. The array must be:18// * uint8_t19// * in the section named __libfuzzer_extra_counters.20// The target code may declare more than one such array.21//22// Use either `Counters[Idx] = 1` or `Counters[Idx]++;`23// depending on whether multiple occurrences of the event 'Idx'24// is important to distinguish from one occurrence.25#if defined(__linux__) || defined(__FreeBSD__)26__attribute__((section("__libfuzzer_extra_counters")))27#endif28#ifdef _WIN3229# pragma section(".data$__libfuzzer_extra_counters")30__declspec(allocate(".data$__libfuzzer_extra_counters"))31#endif32 static uint8_t Counters[N];33 34extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {35 static std::set<uint16_t> SeenIdx;36 if (Size != 4) return 0;37 uint32_t Idx;38 memcpy(&Idx, Data, 4);39 Idx %= N;40 assert(Counters[Idx] == 0); // libFuzzer should reset these between the runs.41 // Or Counters[Idx]=1 if we don't care how many times this happened.42 Counters[Idx]++;43 SeenIdx.insert(Idx);44 if (SeenIdx.size() == N) {45 fprintf(stderr, "BINGO: found all values\n");46 abort();47 }48 return 0;49}50