Google Git
Sign in
llvm / libfuzzer / 046365864e20b00edef1cd5520115b1c8f2bbce7
commit046365864e20b00edef1cd5520115b1c8f2bbce7[log] [tgz]
authorMax Moroz <mmoroz@chromium.org>Mon Jul 23 14:20:52 2018 +0000
committerCopybara-Service <copybara-worker@google.com>Thu Mar 25 23:17:47 2021 -0700
tree473f67d1dcfaa57b6c4006d5b753782368e13f95
parent353e633f31515f26cbd5eac1511d3c23af8f4b9e [diff]
[libFuzzer] Handle unstable edges by using minimum hit counts

Summary:
Created unstable_handle flag that takes 1 or 2, depending on the handling type.
Modified RunOne to accommodate the following heuristic:
    Use the first CollectFeatures to count how many features there are.
    If no new features, CollectFeatures like before.
    If there is new feature, we run CB 2 more times,
        Check which edges are unstable per input and we store the least amount of hit counts for each edge.
        Apply these hit counts back to inline8bitcounters so that CollectFeatures can work as intended.
Modified UnstableCounters to 8int_t and created a bitset UnstableSet to tell which edges are unstable.

Patch by Kyungtak Woo (@kevinwkt).

Reviewers: Dor1s, metzman, morehouse

Reviewed By: Dor1s, morehouse

Subscribers: delcypher, #sanitizers, llvm-commits, kcc

Differential Revision: https://reviews.llvm.org/D49525

llvm-svn: 337696
GitOrigin-RevId: 1e954f78d1d74bc5d59d30f46a1453c05d343a8d
7 files changed
tree: 473f67d1dcfaa57b6c4006d5b753782368e13f95
  1. afl/
  2. dataflow/
  3. scripts/
  4. standalone/
  5. tests/
  6. build.sh
  7. FuzzerCommand.h
  8. FuzzerCorpus.h
  9. FuzzerCrossOver.cpp
  10. FuzzerDataFlowTrace.cpp
  11. FuzzerDataFlowTrace.h
  12. FuzzerDefs.h
  13. FuzzerDictionary.h
  14. FuzzerDriver.cpp
  15. FuzzerExtFunctions.def
  16. FuzzerExtFunctions.h
  17. FuzzerExtFunctionsDlsym.cpp
  18. FuzzerExtFunctionsDlsymWin.cpp
  19. FuzzerExtFunctionsWeak.cpp
  20. FuzzerExtFunctionsWeakAlias.cpp
  21. FuzzerExtraCounters.cpp
  22. FuzzerFlags.def
  23. FuzzerInterface.h
  24. FuzzerInternal.h
  25. FuzzerIO.cpp
  26. FuzzerIO.h
  27. FuzzerIOPosix.cpp
  28. FuzzerIOWindows.cpp
  29. FuzzerLoop.cpp
  30. FuzzerMain.cpp
  31. FuzzerMerge.cpp
  32. FuzzerMerge.h
  33. FuzzerMutate.cpp
  34. FuzzerMutate.h
  35. FuzzerOptions.h
  36. FuzzerRandom.h
  37. FuzzerSHA1.cpp
  38. FuzzerSHA1.h
  39. FuzzerShmem.h
  40. FuzzerShmemFuchsia.cpp
  41. FuzzerShmemPosix.cpp
  42. FuzzerShmemWindows.cpp
  43. FuzzerTracePC.cpp
  44. FuzzerTracePC.h
  45. FuzzerUtil.cpp
  46. FuzzerUtil.h
  47. FuzzerUtilDarwin.cpp
  48. FuzzerUtilFuchsia.cpp
  49. FuzzerUtilLinux.cpp
  50. FuzzerUtilPosix.cpp
  51. FuzzerUtilWindows.cpp
  52. FuzzerValueBitMap.h
  53. LICENSE.TXT
  54. README.txt