compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp

   1 //===-- FuzzerInterceptors.cpp --------------------------------------------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 // Intercept certain libc functions to aid fuzzing.
   9 // Linked only when other RTs that define their own interceptors are not linked.
  10 //===----------------------------------------------------------------------===//
  11
  12 #include "FuzzerPlatform.h"
  13
  14 #if LIBFUZZER_LINUX
  15
  16 #define GET_CALLER_PC() __builtin_return_address(0)
  17
  18 #define PTR_TO_REAL(x) real_##x
  19 #define REAL(x) __interception::PTR_TO_REAL(x)
  20 #define FUNC_TYPE(x) x##_type
  21 #define DEFINE_REAL(ret_type, func, ...)                                       \
  22   typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__);                            \
  23   namespace __interception {                                                   \
  24   FUNC_TYPE(func) PTR_TO_REAL(func);                                           \
  25   }
  26
  27 #include <cassert>
  28 #include <cstddef> // for size_t
  29 #include <cstdint>
  30 #include <dlfcn.h> // for dlsym()
  31
  32 static void *getFuncAddr(const char *name, uintptr_t wrapper_addr) {
  33   void *addr = dlsym(RTLD_NEXT, name);
  34   if (!addr) {
  35     // If the lookup using RTLD_NEXT failed, the sanitizer runtime library is
  36     // later in the library search order than the DSO that we are trying to
  37     // intercept, which means that we cannot intercept this function. We still
  38     // want the address of the real definition, though, so look it up using
  39     // RTLD_DEFAULT.
  40     addr = dlsym(RTLD_DEFAULT, name);
  41
  42     // In case `name' is not loaded, dlsym ends up finding the actual wrapper.
  43     // We don't want to intercept the wrapper and have it point to itself.
  44     if (reinterpret_cast<uintptr_t>(addr) == wrapper_addr)
  45       addr = nullptr;
  46   }
  47   return addr;
  48 }
  49
  50 static int FuzzerInited = 0;
  51 static bool FuzzerInitIsRunning;
  52
  53 static void fuzzerInit();
  54
  55 static void ensureFuzzerInited() {
  56   assert(!FuzzerInitIsRunning);
  57   if (!FuzzerInited) {
  58     fuzzerInit();
  59   }
  60 }
  61
  62 static int internal_strcmp_strncmp(const char *s1, const char *s2, bool strncmp,
  63                                    size_t n) {
  64   size_t i = 0;
  65   while (true) {
  66     if (strncmp) {
  67       if (i == n)
  68         break;
  69       i++;
  70     }
  71     unsigned c1 = *s1;
  72     unsigned c2 = *s2;
  73     if (c1 != c2)
  74       return (c1 < c2) ? -1 : 1;
  75     if (c1 == 0)
  76       break;
  77     s1++;
  78     s2++;
  79   }
  80   return 0;
  81 }
  82
  83 static int internal_strncmp(const char *s1, const char *s2, size_t n) {
  84   return internal_strcmp_strncmp(s1, s2, true, n);
  85 }
  86
  87 static int internal_strcmp(const char *s1, const char *s2) {
  88   return internal_strcmp_strncmp(s1, s2, false, 0);
  89 }
  90
  91 static int internal_memcmp(const void *s1, const void *s2, size_t n) {
  92   const uint8_t *t1 = static_cast<const uint8_t *>(s1);
  93   const uint8_t *t2 = static_cast<const uint8_t *>(s2);
  94   for (size_t i = 0; i < n; ++i, ++t1, ++t2)
  95     if (*t1 != *t2)
  96       return *t1 < *t2 ? -1 : 1;
  97   return 0;
  98 }
  99
 100 static size_t internal_strlen(const char *s) {
 101   size_t i = 0;
 102   while (s[i])
 103     i++;
 104   return i;
 105 }
 106
 107 static char *internal_strstr(const char *haystack, const char *needle) {
 108   // This is O(N^2), but we are not using it in hot places.
 109   size_t len1 = internal_strlen(haystack);
 110   size_t len2 = internal_strlen(needle);
 111   if (len1 < len2)
 112     return nullptr;
 113   for (size_t pos = 0; pos <= len1 - len2; pos++) {
 114     if (internal_memcmp(haystack + pos, needle, len2) == 0)
 115       return const_cast<char *>(haystack) + pos;
 116   }
 117   return nullptr;
 118 }
 119
 120 extern "C" {
 121
 122 // Weak hooks forward-declared to avoid dependency on
 123 // <sanitizer/common_interface_defs.h>.
 124 void __sanitizer_weak_hook_memcmp(void *called_pc, const void *s1,
 125                                   const void *s2, size_t n, int result);
 126 void __sanitizer_weak_hook_strncmp(void *called_pc, const char *s1,
 127                                    const char *s2, size_t n, int result);
 128 void __sanitizer_weak_hook_strncasecmp(void *called_pc, const char *s1,
 129                                        const char *s2, size_t n, int result);
 130 void __sanitizer_weak_hook_strcmp(void *called_pc, const char *s1,
 131                                   const char *s2, int result);
 132 void __sanitizer_weak_hook_strcasecmp(void *called_pc, const char *s1,
 133                                       const char *s2, int result);
 134 void __sanitizer_weak_hook_strstr(void *called_pc, const char *s1,
 135                                   const char *s2, char *result);
 136 void __sanitizer_weak_hook_strcasestr(void *called_pc, const char *s1,
 137                                       const char *s2, char *result);
 138 void __sanitizer_weak_hook_memmem(void *called_pc, const void *s1, size_t len1,
 139                                   const void *s2, size_t len2, void *result);
 140
 141 DEFINE_REAL(int, bcmp, const void *, const void *, size_t)
 142 DEFINE_REAL(int, memcmp, const void *, const void *, size_t)
 143 DEFINE_REAL(int, strncmp, const char *, const char *, size_t)
 144 DEFINE_REAL(int, strcmp, const char *, const char *)
 145 DEFINE_REAL(int, strncasecmp, const char *, const char *, size_t)
 146 DEFINE_REAL(int, strcasecmp, const char *, const char *)
 147 DEFINE_REAL(char *, strstr, const char *, const char *)
 148 DEFINE_REAL(char *, strcasestr, const char *, const char *)
 149 DEFINE_REAL(void *, memmem, const void *, size_t, const void *, size_t)
 150
 151 ATTRIBUTE_INTERFACE int bcmp(const char *s1, const char *s2, size_t n) {
 152   if (!FuzzerInited)
 153     return internal_memcmp(s1, s2, n);
 154   int result = REAL(bcmp)(s1, s2, n);
 155   __sanitizer_weak_hook_memcmp(GET_CALLER_PC(), s1, s2, n, result);
 156   return result;
 157 }
 158
 159 ATTRIBUTE_INTERFACE int memcmp(const void *s1, const void *s2, size_t n) {
 160   if (!FuzzerInited)
 161     return internal_memcmp(s1, s2, n);
 162   int result = REAL(memcmp)(s1, s2, n);
 163   __sanitizer_weak_hook_memcmp(GET_CALLER_PC(), s1, s2, n, result);
 164   return result;
 165 }
 166
 167 ATTRIBUTE_INTERFACE int strncmp(const char *s1, const char *s2, size_t n) {
 168   if (!FuzzerInited)
 169     return internal_strncmp(s1, s2, n);
 170   int result = REAL(strncmp)(s1, s2, n);
 171   __sanitizer_weak_hook_strncmp(GET_CALLER_PC(), s1, s2, n, result);
 172   return result;
 173 }
 174
 175 ATTRIBUTE_INTERFACE int strcmp(const char *s1, const char *s2) {
 176   if (!FuzzerInited)
 177     return internal_strcmp(s1, s2);
 178   int result = REAL(strcmp)(s1, s2);
 179   __sanitizer_weak_hook_strcmp(GET_CALLER_PC(), s1, s2, result);
 180   return result;
 181 }
 182
 183 ATTRIBUTE_INTERFACE int strncasecmp(const char *s1, const char *s2, size_t n) {
 184   ensureFuzzerInited();
 185   int result = REAL(strncasecmp)(s1, s2, n);
 186   __sanitizer_weak_hook_strncasecmp(GET_CALLER_PC(), s1, s2, n, result);
 187   return result;
 188 }
 189
 190 ATTRIBUTE_INTERFACE int strcasecmp(const char *s1, const char *s2) {
 191   ensureFuzzerInited();
 192   int result = REAL(strcasecmp)(s1, s2);
 193   __sanitizer_weak_hook_strcasecmp(GET_CALLER_PC(), s1, s2, result);
 194   return result;
 195 }
 196
 197 ATTRIBUTE_INTERFACE char *strstr(const char *s1, const char *s2) {
 198   if (!FuzzerInited)
 199     return internal_strstr(s1, s2);
 200   char *result = REAL(strstr)(s1, s2);
 201   __sanitizer_weak_hook_strstr(GET_CALLER_PC(), s1, s2, result);
 202   return result;
 203 }
 204
 205 ATTRIBUTE_INTERFACE char *strcasestr(const char *s1, const char *s2) {
 206   ensureFuzzerInited();
 207   char *result = REAL(strcasestr)(s1, s2);
 208   __sanitizer_weak_hook_strcasestr(GET_CALLER_PC(), s1, s2, result);
 209   return result;
 210 }
 211
 212 ATTRIBUTE_INTERFACE
 213 void *memmem(const void *s1, size_t len1, const void *s2, size_t len2) {
 214   ensureFuzzerInited();
 215   void *result = REAL(memmem)(s1, len1, s2, len2);
 216   __sanitizer_weak_hook_memmem(GET_CALLER_PC(), s1, len1, s2, len2, result);
 217   return result;
 218 }
 219
 220 __attribute__((section(".preinit_array"),
 221                used)) static void (*__local_fuzzer_preinit)(void) = fuzzerInit;
 222
 223 } // extern "C"
 224
 225 static void fuzzerInit() {
 226   assert(!FuzzerInitIsRunning);
 227   if (FuzzerInited)
 228     return;
 229   FuzzerInitIsRunning = true;
 230
 231   REAL(bcmp) = reinterpret_cast<memcmp_type>(
 232       getFuncAddr("bcmp", reinterpret_cast<uintptr_t>(&bcmp)));
 233   REAL(memcmp) = reinterpret_cast<memcmp_type>(
 234       getFuncAddr("memcmp", reinterpret_cast<uintptr_t>(&memcmp)));
 235   REAL(strncmp) = reinterpret_cast<strncmp_type>(
 236       getFuncAddr("strncmp", reinterpret_cast<uintptr_t>(&strncmp)));
 237   REAL(strcmp) = reinterpret_cast<strcmp_type>(
 238       getFuncAddr("strcmp", reinterpret_cast<uintptr_t>(&strcmp)));
 239   REAL(strncasecmp) = reinterpret_cast<strncasecmp_type>(
 240       getFuncAddr("strncasecmp", reinterpret_cast<uintptr_t>(&strncasecmp)));
 241   REAL(strcasecmp) = reinterpret_cast<strcasecmp_type>(
 242       getFuncAddr("strcasecmp", reinterpret_cast<uintptr_t>(&strcasecmp)));
 243   REAL(strstr) = reinterpret_cast<strstr_type>(
 244       getFuncAddr("strstr", reinterpret_cast<uintptr_t>(&strstr)));
 245   REAL(strcasestr) = reinterpret_cast<strcasestr_type>(
 246       getFuncAddr("strcasestr", reinterpret_cast<uintptr_t>(&strcasestr)));
 247   REAL(memmem) = reinterpret_cast<memmem_type>(
 248       getFuncAddr("memmem", reinterpret_cast<uintptr_t>(&memmem)));
 249
 250   FuzzerInitIsRunning = false;
 251   FuzzerInited = 1;
 252 }
 253
 254 #endif