[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v2 07/15] fuzz: Add support for custom crossover functions
From: |
Alexander Bulekov |
Subject: |
[PATCH v2 07/15] fuzz: Add support for custom crossover functions |
Date: |
Wed, 19 Aug 2020 02:11:02 -0400 |
libfuzzer supports a "custom crossover function". Libfuzzer often tries
to blend two inputs to create a new interesting input. Sometimes, we
have a better idea about how to blend inputs together. This change
allows fuzzers to specify a custom function for blending two inputs
together.
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
---
tests/qtest/fuzz/fuzz.c | 13 +++++++++++++
tests/qtest/fuzz/fuzz.h | 26 ++++++++++++++++++++++++++
2 files changed, 39 insertions(+)
diff --git a/tests/qtest/fuzz/fuzz.c b/tests/qtest/fuzz/fuzz.c
index 8234b68754..248fab5f37 100644
--- a/tests/qtest/fuzz/fuzz.c
+++ b/tests/qtest/fuzz/fuzz.c
@@ -118,6 +118,19 @@ static FuzzTarget *fuzz_get_target(char* name)
}
+/* Sometimes called by libfuzzer to mutate two inputs into one */
+size_t LLVMFuzzerCustomCrossOver(const uint8_t *data1, size_t size1,
+ const uint8_t *data2, size_t size2,
+ uint8_t *out, size_t max_out_size,
+ unsigned int seed)
+{
+ if(fuzz_target->crossover) {
+ return fuzz_target->crossover(data1, size1, data2, size2, out,
+ max_out_size, seed);
+ }
+ return 0;
+}
+
/* Executed for each fuzzing-input */
int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size)
{
diff --git a/tests/qtest/fuzz/fuzz.h b/tests/qtest/fuzz/fuzz.h
index 9ca3d107c5..d36642b5ec 100644
--- a/tests/qtest/fuzz/fuzz.h
+++ b/tests/qtest/fuzz/fuzz.h
@@ -77,6 +77,28 @@ typedef struct FuzzTarget {
*/
void(*fuzz)(QTestState *, const unsigned char *, size_t);
+ /*
+ * The fuzzer can specify a "Custom Crossover" function for combining two
+ * inputs from the corpus. This function is sometimes called by libfuzzer
+ * when mutating inputs.
+ *
+ * data1: location of first input
+ * size1: length of first input
+ * data1: location of second input
+ * size1: length of second input
+ * out: where to place the resulting, mutated input
+ * max_out_size: the maximum length of the input that can be placed in out
+ * seed: the seed that should be used to make mutations deterministic,
when needed
+ *
+ * See libfuzzer's LLVMFuzzerCustomCrossOver API for more info.
+ *
+ * Can be NULL
+ */
+ size_t(*crossover)(const uint8_t *data1, size_t size1,
+ const uint8_t *data2, size_t size2,
+ uint8_t *out, size_t max_out_size,
+ unsigned int seed);
+
} FuzzTarget;
void flush_events(QTestState *);
@@ -91,6 +113,10 @@ void fuzz_qtest_set_serialize(bool option);
*/
void fuzz_add_target(const FuzzTarget *target);
+size_t LLVMFuzzerCustomCrossOver(const uint8_t *data1, size_t size1,
+ const uint8_t *data2, size_t size2,
+ uint8_t *out, size_t max_out_size,
+ unsigned int seed);
int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size);
int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp);
--
2.27.0
- [PATCH v2 08/15] fuzz: add a DISABLE_PCI op to general-fuzzer, (continued)
- [PATCH v2 08/15] fuzz: add a DISABLE_PCI op to general-fuzzer, Alexander Bulekov, 2020/08/19
- [PATCH v2 03/15] fuzz: Add PCI features to the general fuzzer, Alexander Bulekov, 2020/08/19
- [PATCH v2 09/15] fuzz: add a crossover function to generic-fuzzer, Alexander Bulekov, 2020/08/19
- [PATCH v2 04/15] fuzz: Add DMA support to the generic-fuzzer, Alexander Bulekov, 2020/08/19
- [PATCH v2 10/15] scripts/oss-fuzz: Add wrapper program for generic fuzzer, Alexander Bulekov, 2020/08/19
- [PATCH v2 11/15] scripts/oss-fuzz: Add general-fuzzer build script, Alexander Bulekov, 2020/08/19
- [PATCH v2 05/15] fuzz: Declare DMA Read callback function, Alexander Bulekov, 2020/08/19
- [PATCH v2 06/15] fuzz: Add fuzzer callbacks to DMA-read functions, Alexander Bulekov, 2020/08/19
- [PATCH v2 13/15] scripts/oss-fuzz: build the general-fuzzer configs, Alexander Bulekov, 2020/08/19
- [PATCH v2 12/15] scripts/oss-fuzz: Add general-fuzzer configs for oss-fuzz, Alexander Bulekov, 2020/08/19
- [PATCH v2 07/15] fuzz: Add support for custom crossover functions,
Alexander Bulekov <=
- [PATCH v2 14/15] scripts/oss-fuzz: Add script to reorder a general-fuzzer trace, Alexander Bulekov, 2020/08/19
- [PATCH v2 15/15] scripts/oss-fuzz: Add crash trace minimization script, Alexander Bulekov, 2020/08/19
- Re: [PATCH v2 00/15] Add a General Virtual Device Fuzzer, no-reply, 2020/08/19