138 lines · plain
1# Tests the data flow tracer.2REQUIRES: linux, x86_643 4# Disable, like other dataflow tests.5RUN: false6XFAIL: *7 8# Build the tracer and the test.9RUN: %no_fuzzer_cpp_compiler -c -fno-sanitize=all -fsanitize=dataflow %S/../../lib/fuzzer/dataflow/DataFlow.cpp -o %t-DataFlow.o10RUN: %no_fuzzer_cpp_compiler -c -fno-sanitize=all -fPIC %S/../../lib/fuzzer/dataflow/DataFlowCallbacks.cpp -o %t-DataFlowCallbacks.o11RUN: %no_fuzzer_cpp_compiler -fno-sanitize=all -fsanitize=dataflow -fsanitize-coverage=trace-pc-guard,pc-table,bb,trace-cmp %S/ThreeFunctionsTest.cpp %t-DataFlow*.o -o %t-ThreeFunctionsTestDF12RUN: %no_fuzzer_cpp_compiler -fno-sanitize=all -fsanitize=dataflow -fsanitize-coverage=trace-pc-guard,pc-table,bb,trace-cmp %S/Labels20Test.cpp %t-DataFlow*.o -o %t-Labels20TestDF13RUN: %cpp_compiler %S/ThreeFunctionsTest.cpp -o %t-ThreeFunctionsTest14 15# Dump the function list.16RUN: %t-ThreeFunctionsTestDF 2>&1 | FileCheck %s --check-prefix=FUNC_LIST17FUNC_LIST-DAG: LLVMFuzzerTestOneInput18FUNC_LIST-DAG: Func119FUNC_LIST-DAG: Func220 21# Prepare the inputs.22RUN: rm -rf %t/IN %t/IN2023RUN: mkdir -p %t/IN %t/IN2024RUN: echo -n ABC > %t/IN/ABC25RUN: echo -n FUABC > %t/IN/FUABC26RUN: echo -n FUZZR > %t/IN/FUZZR27RUN: echo -n FUZZM > %t/IN/FUZZM28RUN: echo -n FUZZMU > %t/IN/FUZZMU29RUN: echo -n 1234567890123456 > %t/IN/123456789012345630 31RUN: echo -n FUZZxxxxxxxxxxxxxxxx > %t/IN20/FUZZxxxxxxxxxxxxxxxx32RUN: echo -n FUZZxxxxxxxxxxxxMxxx > %t/IN20/FUZZxxxxxxxxxxxxMxxx33RUN: echo -n FUZxxxxxxxxxxxxxxxxx > %t/IN20/FUZxxxxxxxxxxxxxxxxx34RUN: echo -n FUxxxxxxxxxxxxxxxxxx > %t/IN20/FUxxxxxxxxxxxxxxxxxx35 36 37RUN: export DFSAN_OPTIONS=warn_unimplemented=038 39# This test assumes that the functions in ThreeFunctionsTestDF are instrumented40# in a specific order:41# LLVMFuzzerTestOneInput: F042# Func1: F143# Func2: F244 45# ABC: No data is used46RUN:%t-ThreeFunctionsTestDF %t/IN/ABC | FileCheck %s --check-prefix=IN_ABC47IN_ABC-NOT: F048IN_ABC: C049IN_ABC-NOT: C50 51# FUABC: First 3 bytes are checked, Func1/Func2 are not called.52RUN:%t-ThreeFunctionsTestDF %t/IN/FUABC | FileCheck %s --check-prefix=IN_FUABC53IN_FUABC: F0 11100{{$}}54IN_FUABC-NOT: F55IN_FUABC-NEXT: C056IN_FUABC-NOT: C57 58# FUZZR: 5 bytes are used (4 in one function, 5-th in the other), Func2 is not called.59RUN:%t-ThreeFunctionsTestDF %t/IN/FUZZR | FileCheck %s --check-prefix=IN_FUZZR60IN_FUZZR: F0 1111061IN_FUZZR: F1 0000162IN_FUZZR-NOT: F63IN_FUZZR: C064IN_FUZZR: C165IN_FUZZR-NOT: C66 67# FUZZM: 5 bytes are used, both Func1 and Func2 are called, Func2 depends only on size.68RUN:%t-ThreeFunctionsTestDF %t/IN/FUZZM | FileCheck %s --check-prefix=IN_FUZZM69IN_FUZZM: F0 1111070IN_FUZZM: F1 0000171IN_FUZZM-NOT: F272IN_FUZZM: C073IN_FUZZM: C174IN_FUZZM: C275 76# FUZZMU: 6 bytes are used, both Func1 and Func2 are called, Func2 depends on byte 6 and size.77RUN:%t-ThreeFunctionsTestDF %t/IN/FUZZMU | FileCheck %s --check-prefix=IN_FUZZMU78 79 80# Test Labels20TestDF81RUN:%t-Labels20TestDF %t/IN20/FUxxxxxxxxxxxxxxxxxx | FileCheck %s --check-prefix=L20_FU82L20_FU: F0 11100000000000000000{{$}}83L20_FU-NOT: F84 85RUN:%t-Labels20TestDF %t/IN20/FUZxxxxxxxxxxxxxxxxx | FileCheck %s --check-prefix=L20_FUZ86L20_FUZ: F0 11110000000000000000{{$}}87L20_FUZ-NOT: F88 89RUN:%t-Labels20TestDF %t/IN20/FUZZxxxxxxxxxxxxxxxx | FileCheck %s --check-prefix=L20_FUZZ90L20_FUZZ: F0 11110000000000000000{{$}}91L20_FUZZ-NEXT: F1 00000000000000001000{{$}}92L20_FUZZ-NOT: F93 94RUN:%t-Labels20TestDF %t/IN20/FUZZxxxxxxxxxxxxMxxx | FileCheck %s --check-prefix=L20_FUZZM95L20_FUZZM: F0 11110000000000000000{{$}}96L20_FUZZM-NEXT: F1 00000000000000001000{{$}}97L20_FUZZM-NEXT: F2 00000000000000000001{{$}}98L20_FUZZM-NOT: F99 100# Don't crash with missing data_flow args.101RUN: rm -rf %t-DFT102RUN: %t-ThreeFunctionsTest -collect_data_flow=%t-ThreeFunctionsTestDF103RUN: %t-ThreeFunctionsTest -data_flow_trace=%t-DFT %t/IN/FUZZMU104 105# Test libFuzzer's built in DFT collection.106RUN: rm -rf %t-DFT107RUN: %t-ThreeFunctionsTest -collect_data_flow=%t-ThreeFunctionsTestDF -data_flow_trace=%t-DFT %t/IN/FUZZMU108RUN: cat %t-DFT/* | sort | FileCheck %s --check-prefix=IN_FUZZMU109 110IN_FUZZMU: F0 111100111IN_FUZZMU: F1 000010112IN_FUZZMU: F2 000001113 114# Test that we can run collect_data_flow on the entire corpus dir115RUN: rm -rf %t/OUT116RUN: %t-ThreeFunctionsTest -collect_data_flow=%t-ThreeFunctionsTestDF -data_flow_trace=%t/OUT %t/IN117RUN: %t-ThreeFunctionsTest -data_flow_trace=%t/OUT -runs=0 -focus_function=Func2 %t/IN 2>&1 | FileCheck %s --check-prefix=USE_DATA_FLOW_TRACE118 119USE_DATA_FLOW_TRACE: INFO: DataFlowTrace: reading from {{.*}}/OUT120USE_DATA_FLOW_TRACE: d28cb407e8e1a702c72d25473f0553d3ec172262 => |000001|121USE_DATA_FLOW_TRACE: INFO: DataFlowTrace: 6 trace files, 3 functions, 1 traces with focus function122USE_DATA_FLOW_TRACE: INFO: Focus function is set to 'Func2'123USE_DATA_FLOW_TRACE: INITED124USE_DATA_FLOW_TRACE: INFO: 2/6 inputs touch the focus function125USE_DATA_FLOW_TRACE: INFO: 1/2 inputs have the Data Flow Trace126 127# Test that we can run collect_data_flow on a long input (>2**16 bytes)128RUN: printf "%0.sA" {1..150001} > %t/IN/very_long_input129RUN: rm -rf %t/OUT130RUN: %t-ThreeFunctionsTest -collect_data_flow=%t-ThreeFunctionsTestDF -data_flow_trace=%t/OUT %t/IN/very_long_input131RUN: rm %t/IN/very_long_input132 133# Test that it fails explicitly when an empty corpus is provided.134RUN: rm -rf %t/IN && mkdir %t/IN135RUN: not %t-ThreeFunctionsTest -collect_data_flow=%t-ThreeFunctionsTestDF -data_flow_trace=%t/OUT %t/IN 2>&1 | FileCheck %s --check-prefix=EMPTY_CORPUS136 137EMPTY_CORPUS: ERROR: can't collect data flow without corpus provided138