compiler-rt/test/fuzzer/OutOfProcessFuzzTarget.cpp

   1 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   2 // See https://llvm.org/LICENSE.txt for license information.
   3 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   4
   5 // This is a fuzz target for running out-of-process fuzzing for a
   6 // binary specified via environment variable LIBFUZZER_OOP_TARGET.
   7 // libFuzzer is not designed for out-of-process fuzzing and so this
   8 // ad-hoc rig lacks many of the in-process libFuzzer features, and is slow,
   9 // but it does provide the basic functionality, which is to run the target
  10 // many times in parallel, feeding in the mutants, and expanding the corpus.
  11 // Use this only for very slow targets (slower than ~ 10 exec/s)
  12 // that you can't convert to conventional libFuzzer fuzz targets.
  13 //
  14 // The target binary (which could be a shell script, or anything),
  15 // consumes one file as an input and produces the file with coverage counters
  16 // as the output (output path is passed via SANCOV_OUT).
  17 // One way to produce a valid binary target is to build it with
  18 // -fsanitize-coverage=inline-8bit-counters and link it with SanCovDump.cpp,
  19 // found in the same directory.
  20 //
  21 // Example usage:
  22 /*
  23  clang -fsanitize=fuzzer OutOfProcessFuzzTarget.cpp -o oop-fuzz &&
  24  clang -c -fsanitize-coverage=inline-8bit-counters SimpleTest.cpp &&
  25  clang -c ../../lib/fuzzer/standalone/StandaloneFuzzTargetMain.c &&
  26  clang -c SanCovDump.cpp &&
  27  clang++ SanCovDump.o SimpleTest.o  StandaloneFuzzTargetMain.o -o oop-target &&
  28  rm -rf CORPUS && mkdir CORPUS && echo > CORPUS/seed &&
  29  LIBFUZZER_OOP_TARGET="./oop-target > /dev/null 2>&1 " ./oop-fuzz CORPUS -jobs=42
  30
  31 */
  32 #include <fcntl.h>
  33 #include <stdint.h>
  34 #include <stdio.h>
  35 #include <sys/stat.h>
  36 #include <sys/types.h>
  37 #include <unistd.h>
  38
  39 #include <string>
  40
  41 // An arbitrary large number.
  42 // If your target is so large that it has more than this number of coverage
  43 // edges, you may want to increase this number to match your binary,
  44 // otherwise part of the coverage will be lost.
  45 // For small targets there is no reason to reduce this number.
  46 static const size_t kCountersSize = 1 << 20;
  47
  48 __attribute__((section(
  49     "__libfuzzer_extra_counters"))) static uint8_t Counters[kCountersSize];
  50
  51 static std::string *Run, *IN, *COV;
  52
  53 void TearDown() {
  54   unlink(COV->c_str());
  55   unlink(IN->c_str());
  56 }
  57
  58 bool Initialize() {
  59   IN = new std::string("lf-oop-in-" + std::to_string(getpid()));
  60   COV = new std::string("lf-oop-cov-" + std::to_string(getpid()));
  61   const char *TargetEnv = getenv("LIBFUZZER_OOP_TARGET");
  62   if (!TargetEnv) {
  63     fprintf(stderr, "Please define LIBFUZZER_OOP_TARGET\n");
  64     exit(1);
  65   }
  66   Run = new std::string("SANCOV_OUT=" + *COV + " " + TargetEnv + " " + *IN);
  67   fprintf(stderr, "libFuzzer: OOP command: %s\n", Run->c_str());
  68   atexit(TearDown);
  69   return true;
  70 }
  71
  72 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  73   static bool Inited = Initialize();
  74   if (size == 0)
  75     return 0;
  76   if (FILE *f = fopen(IN->c_str(), "w")) {
  77     fwrite(data, 1, size, f);
  78     fclose(f);
  79   }
  80   system(Run->c_str());
  81   if (FILE *f = fopen(COV->c_str(), "r")) {
  82     fread(Counters, 1, kCountersSize, f);
  83     fclose(f);
  84   }
  85   return 0;
  86 }