77 lines · cpp
1//===-- llvm-as-fuzzer.cpp - Fuzzer for llvm-as using lib/Fuzzer ----------===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8//9// Build tool to fuzz the LLVM assembler (llvm-as) using10// lib/Fuzzer. The main reason for using this tool is that it is much11// faster than using afl-fuzz, since it is run in-process.12//13//===----------------------------------------------------------------------===//14 15#include "llvm/ADT/StringRef.h"16#include "llvm/AsmParser/Parser.h"17#include "llvm/IR/LLVMContext.h"18#include "llvm/IR/Module.h"19#include "llvm/IR/Verifier.h"20#include "llvm/Support/ErrorHandling.h"21#include "llvm/Support/MemoryBuffer.h"22#include "llvm/Support/SourceMgr.h"23#include "llvm/Support/raw_ostream.h"24 25#include <csetjmp>26 27using namespace llvm;28 29static jmp_buf JmpBuf;30 31namespace {32 33void MyFatalErrorHandler(void *user_data, const char *reason,34 bool gen_crash_diag) {35 // Don't bother printing reason, just return to the test function,36 // since a fatal error represents a successful parse (i.e. it correctly37 // terminated with an error message to the user).38 longjmp(JmpBuf, 1);39}40 41static bool InstalledHandler = false;42 43} // end of anonymous namespace44 45extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {46 47 // Allocate space for locals before setjmp so that memory can be collected48 // if parse exits prematurely (via longjmp).49 StringRef Input((const char *)Data, Size);50 // Note: We need to create a buffer to add a null terminator to the51 // end of the input string. The parser assumes that the string52 // parsed is always null terminated.53 std::unique_ptr<MemoryBuffer> MemBuf = MemoryBuffer::getMemBufferCopy(Input);54 SMDiagnostic Err;55 LLVMContext Context;56 std::unique_ptr<Module> M;57 58 if (setjmp(JmpBuf))59 // If reached, we have returned with non-zero status, so exit.60 return 0;61 62 // TODO(kschimpf) Write a main to do this initialization.63 if (!InstalledHandler) {64 llvm::install_fatal_error_handler(::MyFatalErrorHandler, nullptr);65 InstalledHandler = true;66 }67 68 M = parseAssembly(MemBuf->getMemBufferRef(), Err, Context);69 70 if (!M.get())71 return 0;72 73 if (verifyModule(*M.get(), &errs()))74 report_fatal_error("Broken module");75 return 0;76}77