| // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
| // See https://llvm.org/LICENSE.txt for license information. |
| // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
| |
| // Avoid ODR violations (LibFuzzer is built without ASan and this test is built |
| // with ASan) involving C++ standard library types when using libcxx. |
| #define _LIBCPP_HAS_NO_ASAN |
| |
| // Do not attempt to use LLVM ostream etc from gtest. |
| #define GTEST_NO_LLVM_SUPPORT 1 |
| |
| #include "FuzzerCorpus.h" |
| #include "FuzzerDictionary.h" |
| #include "FuzzerInternal.h" |
| #include "FuzzerMerge.h" |
| #include "FuzzerMutate.h" |
| #include "FuzzerRandom.h" |
| #include "FuzzerTracePC.h" |
| #include "gtest/gtest.h" |
| #include <memory> |
| #include <set> |
| #include <sstream> |
| |
| using namespace fuzzer; |
| |
| // For now, have LLVMFuzzerTestOneInput just to make it link. |
| // Later we may want to make unittests that actually call |
| // LLVMFuzzerTestOneInput. |
| extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { |
| abort(); |
| } |
| |
| TEST(Fuzzer, Basename) { |
| EXPECT_EQ(Basename("foo/bar"), "bar"); |
| EXPECT_EQ(Basename("bar"), "bar"); |
| EXPECT_EQ(Basename("/bar"), "bar"); |
| EXPECT_EQ(Basename("foo/x"), "x"); |
| EXPECT_EQ(Basename("foo/"), ""); |
| #if LIBFUZZER_WINDOWS |
| EXPECT_EQ(Basename("foo\\bar"), "bar"); |
| EXPECT_EQ(Basename("foo\\bar/baz"), "baz"); |
| EXPECT_EQ(Basename("\\bar"), "bar"); |
| EXPECT_EQ(Basename("foo\\x"), "x"); |
| EXPECT_EQ(Basename("foo\\"), ""); |
| #endif |
| } |
| |
| TEST(Fuzzer, CrossOver) { |
| std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); |
| fuzzer::EF = t.get(); |
| Random Rand(0); |
| std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); |
| Unit A({0, 1, 2}), B({5, 6, 7}); |
| Unit C; |
| Unit Expected[] = { |
| { 0 }, |
| { 0, 1 }, |
| { 0, 5 }, |
| { 0, 1, 2 }, |
| { 0, 1, 5 }, |
| { 0, 5, 1 }, |
| { 0, 5, 6 }, |
| { 0, 1, 2, 5 }, |
| { 0, 1, 5, 2 }, |
| { 0, 1, 5, 6 }, |
| { 0, 5, 1, 2 }, |
| { 0, 5, 1, 6 }, |
| { 0, 5, 6, 1 }, |
| { 0, 5, 6, 7 }, |
| { 0, 1, 2, 5, 6 }, |
| { 0, 1, 5, 2, 6 }, |
| { 0, 1, 5, 6, 2 }, |
| { 0, 1, 5, 6, 7 }, |
| { 0, 5, 1, 2, 6 }, |
| { 0, 5, 1, 6, 2 }, |
| { 0, 5, 1, 6, 7 }, |
| { 0, 5, 6, 1, 2 }, |
| { 0, 5, 6, 1, 7 }, |
| { 0, 5, 6, 7, 1 }, |
| { 0, 1, 2, 5, 6, 7 }, |
| { 0, 1, 5, 2, 6, 7 }, |
| { 0, 1, 5, 6, 2, 7 }, |
| { 0, 1, 5, 6, 7, 2 }, |
| { 0, 5, 1, 2, 6, 7 }, |
| { 0, 5, 1, 6, 2, 7 }, |
| { 0, 5, 1, 6, 7, 2 }, |
| { 0, 5, 6, 1, 2, 7 }, |
| { 0, 5, 6, 1, 7, 2 }, |
| { 0, 5, 6, 7, 1, 2 } |
| }; |
| for (size_t Len = 1; Len < 8; Len++) { |
| std::set<Unit> FoundUnits, ExpectedUnitsWitThisLength; |
| for (int Iter = 0; Iter < 3000; Iter++) { |
| C.resize(Len); |
| size_t NewSize = MD->CrossOver(A.data(), A.size(), B.data(), B.size(), |
| C.data(), C.size()); |
| C.resize(NewSize); |
| FoundUnits.insert(C); |
| } |
| for (const Unit &U : Expected) |
| if (U.size() <= Len) |
| ExpectedUnitsWitThisLength.insert(U); |
| EXPECT_EQ(ExpectedUnitsWitThisLength, FoundUnits); |
| } |
| } |
| |
| TEST(Fuzzer, Hash) { |
| uint8_t A[] = {'a', 'b', 'c'}; |
| fuzzer::Unit U(A, A + sizeof(A)); |
| EXPECT_EQ("a9993e364706816aba3e25717850c26c9cd0d89d", fuzzer::Hash(U)); |
| U.push_back('d'); |
| EXPECT_EQ("81fe8bfe87576c3ecb22426f8e57847382917acf", fuzzer::Hash(U)); |
| } |
| |
| typedef size_t (MutationDispatcher::*Mutator)(uint8_t *Data, size_t Size, |
| size_t MaxSize); |
| |
| void TestEraseBytes(Mutator M, int NumIter) { |
| std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); |
| fuzzer::EF = t.get(); |
| uint8_t REM0[8] = {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t REM1[8] = {0x00, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t REM2[8] = {0x00, 0x11, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t REM3[8] = {0x00, 0x11, 0x22, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t REM4[8] = {0x00, 0x11, 0x22, 0x33, 0x55, 0x66, 0x77}; |
| uint8_t REM5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x66, 0x77}; |
| uint8_t REM6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x77}; |
| uint8_t REM7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; |
| |
| uint8_t REM8[6] = {0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t REM9[6] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55}; |
| uint8_t REM10[6] = {0x00, 0x11, 0x22, 0x55, 0x66, 0x77}; |
| |
| uint8_t REM11[5] = {0x33, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t REM12[5] = {0x00, 0x11, 0x22, 0x33, 0x44}; |
| uint8_t REM13[5] = {0x00, 0x44, 0x55, 0x66, 0x77}; |
| |
| |
| Random Rand(0); |
| std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); |
| int FoundMask = 0; |
| for (int i = 0; i < NumIter; i++) { |
| uint8_t T[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| size_t NewSize = (*MD.*M)(T, sizeof(T), sizeof(T)); |
| if (NewSize == 7 && !memcmp(REM0, T, 7)) FoundMask |= 1 << 0; |
| if (NewSize == 7 && !memcmp(REM1, T, 7)) FoundMask |= 1 << 1; |
| if (NewSize == 7 && !memcmp(REM2, T, 7)) FoundMask |= 1 << 2; |
| if (NewSize == 7 && !memcmp(REM3, T, 7)) FoundMask |= 1 << 3; |
| if (NewSize == 7 && !memcmp(REM4, T, 7)) FoundMask |= 1 << 4; |
| if (NewSize == 7 && !memcmp(REM5, T, 7)) FoundMask |= 1 << 5; |
| if (NewSize == 7 && !memcmp(REM6, T, 7)) FoundMask |= 1 << 6; |
| if (NewSize == 7 && !memcmp(REM7, T, 7)) FoundMask |= 1 << 7; |
| |
| if (NewSize == 6 && !memcmp(REM8, T, 6)) FoundMask |= 1 << 8; |
| if (NewSize == 6 && !memcmp(REM9, T, 6)) FoundMask |= 1 << 9; |
| if (NewSize == 6 && !memcmp(REM10, T, 6)) FoundMask |= 1 << 10; |
| |
| if (NewSize == 5 && !memcmp(REM11, T, 5)) FoundMask |= 1 << 11; |
| if (NewSize == 5 && !memcmp(REM12, T, 5)) FoundMask |= 1 << 12; |
| if (NewSize == 5 && !memcmp(REM13, T, 5)) FoundMask |= 1 << 13; |
| } |
| EXPECT_EQ(FoundMask, (1 << 14) - 1); |
| } |
| |
| TEST(FuzzerMutate, EraseBytes1) { |
| TestEraseBytes(&MutationDispatcher::Mutate_EraseBytes, 200); |
| } |
| TEST(FuzzerMutate, EraseBytes2) { |
| TestEraseBytes(&MutationDispatcher::Mutate, 2000); |
| } |
| |
| void TestInsertByte(Mutator M, int NumIter) { |
| std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); |
| fuzzer::EF = t.get(); |
| Random Rand(0); |
| std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); |
| int FoundMask = 0; |
| uint8_t INS0[8] = {0xF1, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; |
| uint8_t INS1[8] = {0x00, 0xF2, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; |
| uint8_t INS2[8] = {0x00, 0x11, 0xF3, 0x22, 0x33, 0x44, 0x55, 0x66}; |
| uint8_t INS3[8] = {0x00, 0x11, 0x22, 0xF4, 0x33, 0x44, 0x55, 0x66}; |
| uint8_t INS4[8] = {0x00, 0x11, 0x22, 0x33, 0xF5, 0x44, 0x55, 0x66}; |
| uint8_t INS5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0xF6, 0x55, 0x66}; |
| uint8_t INS6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0xF7, 0x66}; |
| uint8_t INS7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xF8}; |
| for (int i = 0; i < NumIter; i++) { |
| uint8_t T[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; |
| size_t NewSize = (*MD.*M)(T, 7, 8); |
| if (NewSize == 8 && !memcmp(INS0, T, 8)) FoundMask |= 1 << 0; |
| if (NewSize == 8 && !memcmp(INS1, T, 8)) FoundMask |= 1 << 1; |
| if (NewSize == 8 && !memcmp(INS2, T, 8)) FoundMask |= 1 << 2; |
| if (NewSize == 8 && !memcmp(INS3, T, 8)) FoundMask |= 1 << 3; |
| if (NewSize == 8 && !memcmp(INS4, T, 8)) FoundMask |= 1 << 4; |
| if (NewSize == 8 && !memcmp(INS5, T, 8)) FoundMask |= 1 << 5; |
| if (NewSize == 8 && !memcmp(INS6, T, 8)) FoundMask |= 1 << 6; |
| if (NewSize == 8 && !memcmp(INS7, T, 8)) FoundMask |= 1 << 7; |
| } |
| EXPECT_EQ(FoundMask, 255); |
| } |
| |
| TEST(FuzzerMutate, InsertByte1) { |
| TestInsertByte(&MutationDispatcher::Mutate_InsertByte, 1 << 15); |
| } |
| TEST(FuzzerMutate, InsertByte2) { |
| TestInsertByte(&MutationDispatcher::Mutate, 1 << 17); |
| } |
| |
| void TestInsertRepeatedBytes(Mutator M, int NumIter) { |
| std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); |
| fuzzer::EF = t.get(); |
| Random Rand(0); |
| std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); |
| int FoundMask = 0; |
| uint8_t INS0[7] = {0x00, 0x11, 0x22, 0x33, 'a', 'a', 'a'}; |
| uint8_t INS1[7] = {0x00, 0x11, 0x22, 'a', 'a', 'a', 0x33}; |
| uint8_t INS2[7] = {0x00, 0x11, 'a', 'a', 'a', 0x22, 0x33}; |
| uint8_t INS3[7] = {0x00, 'a', 'a', 'a', 0x11, 0x22, 0x33}; |
| uint8_t INS4[7] = {'a', 'a', 'a', 0x00, 0x11, 0x22, 0x33}; |
| |
| uint8_t INS5[8] = {0x00, 0x11, 0x22, 0x33, 'b', 'b', 'b', 'b'}; |
| uint8_t INS6[8] = {0x00, 0x11, 0x22, 'b', 'b', 'b', 'b', 0x33}; |
| uint8_t INS7[8] = {0x00, 0x11, 'b', 'b', 'b', 'b', 0x22, 0x33}; |
| uint8_t INS8[8] = {0x00, 'b', 'b', 'b', 'b', 0x11, 0x22, 0x33}; |
| uint8_t INS9[8] = {'b', 'b', 'b', 'b', 0x00, 0x11, 0x22, 0x33}; |
| |
| for (int i = 0; i < NumIter; i++) { |
| uint8_t T[8] = {0x00, 0x11, 0x22, 0x33}; |
| size_t NewSize = (*MD.*M)(T, 4, 8); |
| if (NewSize == 7 && !memcmp(INS0, T, 7)) FoundMask |= 1 << 0; |
| if (NewSize == 7 && !memcmp(INS1, T, 7)) FoundMask |= 1 << 1; |
| if (NewSize == 7 && !memcmp(INS2, T, 7)) FoundMask |= 1 << 2; |
| if (NewSize == 7 && !memcmp(INS3, T, 7)) FoundMask |= 1 << 3; |
| if (NewSize == 7 && !memcmp(INS4, T, 7)) FoundMask |= 1 << 4; |
| |
| if (NewSize == 8 && !memcmp(INS5, T, 8)) FoundMask |= 1 << 5; |
| if (NewSize == 8 && !memcmp(INS6, T, 8)) FoundMask |= 1 << 6; |
| if (NewSize == 8 && !memcmp(INS7, T, 8)) FoundMask |= 1 << 7; |
| if (NewSize == 8 && !memcmp(INS8, T, 8)) FoundMask |= 1 << 8; |
| if (NewSize == 8 && !memcmp(INS9, T, 8)) FoundMask |= 1 << 9; |
| |
| } |
| EXPECT_EQ(FoundMask, (1 << 10) - 1); |
| } |
| |
| TEST(FuzzerMutate, InsertRepeatedBytes1) { |
| TestInsertRepeatedBytes(&MutationDispatcher::Mutate_InsertRepeatedBytes, |
| 10000); |
| } |
| TEST(FuzzerMutate, InsertRepeatedBytes2) { |
| TestInsertRepeatedBytes(&MutationDispatcher::Mutate, 300000); |
| } |
| |
| void TestChangeByte(Mutator M, int NumIter) { |
| std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); |
| fuzzer::EF = t.get(); |
| Random Rand(0); |
| std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); |
| int FoundMask = 0; |
| uint8_t CH0[8] = {0xF0, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t CH1[8] = {0x00, 0xF1, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t CH2[8] = {0x00, 0x11, 0xF2, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t CH3[8] = {0x00, 0x11, 0x22, 0xF3, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t CH4[8] = {0x00, 0x11, 0x22, 0x33, 0xF4, 0x55, 0x66, 0x77}; |
| uint8_t CH5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0xF5, 0x66, 0x77}; |
| uint8_t CH6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0xF5, 0x77}; |
| uint8_t CH7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xF7}; |
| for (int i = 0; i < NumIter; i++) { |
| uint8_t T[9] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| size_t NewSize = (*MD.*M)(T, 8, 9); |
| if (NewSize == 8 && !memcmp(CH0, T, 8)) FoundMask |= 1 << 0; |
| if (NewSize == 8 && !memcmp(CH1, T, 8)) FoundMask |= 1 << 1; |
| if (NewSize == 8 && !memcmp(CH2, T, 8)) FoundMask |= 1 << 2; |
| if (NewSize == 8 && !memcmp(CH3, T, 8)) FoundMask |= 1 << 3; |
| if (NewSize == 8 && !memcmp(CH4, T, 8)) FoundMask |= 1 << 4; |
| if (NewSize == 8 && !memcmp(CH5, T, 8)) FoundMask |= 1 << 5; |
| if (NewSize == 8 && !memcmp(CH6, T, 8)) FoundMask |= 1 << 6; |
| if (NewSize == 8 && !memcmp(CH7, T, 8)) FoundMask |= 1 << 7; |
| } |
| EXPECT_EQ(FoundMask, 255); |
| } |
| |
| TEST(FuzzerMutate, ChangeByte1) { |
| TestChangeByte(&MutationDispatcher::Mutate_ChangeByte, 1 << 15); |
| } |
| TEST(FuzzerMutate, ChangeByte2) { |
| TestChangeByte(&MutationDispatcher::Mutate, 1 << 17); |
| } |
| |
| void TestChangeBit(Mutator M, int NumIter) { |
| std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); |
| fuzzer::EF = t.get(); |
| Random Rand(0); |
| std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); |
| int FoundMask = 0; |
| uint8_t CH0[8] = {0x01, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t CH1[8] = {0x00, 0x13, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t CH2[8] = {0x00, 0x11, 0x02, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t CH3[8] = {0x00, 0x11, 0x22, 0x37, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t CH4[8] = {0x00, 0x11, 0x22, 0x33, 0x54, 0x55, 0x66, 0x77}; |
| uint8_t CH5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x54, 0x66, 0x77}; |
| uint8_t CH6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x76, 0x77}; |
| uint8_t CH7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xF7}; |
| for (int i = 0; i < NumIter; i++) { |
| uint8_t T[9] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| size_t NewSize = (*MD.*M)(T, 8, 9); |
| if (NewSize == 8 && !memcmp(CH0, T, 8)) FoundMask |= 1 << 0; |
| if (NewSize == 8 && !memcmp(CH1, T, 8)) FoundMask |= 1 << 1; |
| if (NewSize == 8 && !memcmp(CH2, T, 8)) FoundMask |= 1 << 2; |
| if (NewSize == 8 && !memcmp(CH3, T, 8)) FoundMask |= 1 << 3; |
| if (NewSize == 8 && !memcmp(CH4, T, 8)) FoundMask |= 1 << 4; |
| if (NewSize == 8 && !memcmp(CH5, T, 8)) FoundMask |= 1 << 5; |
| if (NewSize == 8 && !memcmp(CH6, T, 8)) FoundMask |= 1 << 6; |
| if (NewSize == 8 && !memcmp(CH7, T, 8)) FoundMask |= 1 << 7; |
| } |
| EXPECT_EQ(FoundMask, 255); |
| } |
| |
| TEST(FuzzerMutate, ChangeBit1) { |
| TestChangeBit(&MutationDispatcher::Mutate_ChangeBit, 1 << 16); |
| } |
| TEST(FuzzerMutate, ChangeBit2) { |
| TestChangeBit(&MutationDispatcher::Mutate, 1 << 18); |
| } |
| |
| void TestShuffleBytes(Mutator M, int NumIter) { |
| std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); |
| fuzzer::EF = t.get(); |
| Random Rand(0); |
| std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); |
| int FoundMask = 0; |
| uint8_t CH0[7] = {0x00, 0x22, 0x11, 0x33, 0x44, 0x55, 0x66}; |
| uint8_t CH1[7] = {0x11, 0x00, 0x33, 0x22, 0x44, 0x55, 0x66}; |
| uint8_t CH2[7] = {0x00, 0x33, 0x11, 0x22, 0x44, 0x55, 0x66}; |
| uint8_t CH3[7] = {0x00, 0x11, 0x22, 0x44, 0x55, 0x66, 0x33}; |
| uint8_t CH4[7] = {0x00, 0x11, 0x22, 0x33, 0x55, 0x44, 0x66}; |
| for (int i = 0; i < NumIter; i++) { |
| uint8_t T[7] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; |
| size_t NewSize = (*MD.*M)(T, 7, 7); |
| if (NewSize == 7 && !memcmp(CH0, T, 7)) FoundMask |= 1 << 0; |
| if (NewSize == 7 && !memcmp(CH1, T, 7)) FoundMask |= 1 << 1; |
| if (NewSize == 7 && !memcmp(CH2, T, 7)) FoundMask |= 1 << 2; |
| if (NewSize == 7 && !memcmp(CH3, T, 7)) FoundMask |= 1 << 3; |
| if (NewSize == 7 && !memcmp(CH4, T, 7)) FoundMask |= 1 << 4; |
| } |
| EXPECT_EQ(FoundMask, 31); |
| } |
| |
| TEST(FuzzerMutate, ShuffleBytes1) { |
| TestShuffleBytes(&MutationDispatcher::Mutate_ShuffleBytes, 1 << 17); |
| } |
| TEST(FuzzerMutate, ShuffleBytes2) { |
| TestShuffleBytes(&MutationDispatcher::Mutate, 1 << 20); |
| } |
| |
| void TestCopyPart(Mutator M, int NumIter) { |
| std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); |
| fuzzer::EF = t.get(); |
| Random Rand(0); |
| std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); |
| int FoundMask = 0; |
| uint8_t CH0[7] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x00, 0x11}; |
| uint8_t CH1[7] = {0x55, 0x66, 0x22, 0x33, 0x44, 0x55, 0x66}; |
| uint8_t CH2[7] = {0x00, 0x55, 0x66, 0x33, 0x44, 0x55, 0x66}; |
| uint8_t CH3[7] = {0x00, 0x11, 0x22, 0x00, 0x11, 0x22, 0x66}; |
| uint8_t CH4[7] = {0x00, 0x11, 0x11, 0x22, 0x33, 0x55, 0x66}; |
| |
| for (int i = 0; i < NumIter; i++) { |
| uint8_t T[7] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; |
| size_t NewSize = (*MD.*M)(T, 7, 7); |
| if (NewSize == 7 && !memcmp(CH0, T, 7)) FoundMask |= 1 << 0; |
| if (NewSize == 7 && !memcmp(CH1, T, 7)) FoundMask |= 1 << 1; |
| if (NewSize == 7 && !memcmp(CH2, T, 7)) FoundMask |= 1 << 2; |
| if (NewSize == 7 && !memcmp(CH3, T, 7)) FoundMask |= 1 << 3; |
| if (NewSize == 7 && !memcmp(CH4, T, 7)) FoundMask |= 1 << 4; |
| } |
| |
| uint8_t CH5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x00, 0x11, 0x22}; |
| uint8_t CH6[8] = {0x22, 0x33, 0x44, 0x00, 0x11, 0x22, 0x33, 0x44}; |
| uint8_t CH7[8] = {0x00, 0x11, 0x22, 0x00, 0x11, 0x22, 0x33, 0x44}; |
| uint8_t CH8[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x22, 0x33, 0x44}; |
| uint8_t CH9[8] = {0x00, 0x11, 0x22, 0x22, 0x33, 0x44, 0x33, 0x44}; |
| |
| for (int i = 0; i < NumIter; i++) { |
| uint8_t T[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| size_t NewSize = (*MD.*M)(T, 5, 8); |
| if (NewSize == 8 && !memcmp(CH5, T, 8)) FoundMask |= 1 << 5; |
| if (NewSize == 8 && !memcmp(CH6, T, 8)) FoundMask |= 1 << 6; |
| if (NewSize == 8 && !memcmp(CH7, T, 8)) FoundMask |= 1 << 7; |
| if (NewSize == 8 && !memcmp(CH8, T, 8)) FoundMask |= 1 << 8; |
| if (NewSize == 8 && !memcmp(CH9, T, 8)) FoundMask |= 1 << 9; |
| } |
| |
| EXPECT_EQ(FoundMask, 1023); |
| } |
| |
| TEST(FuzzerMutate, CopyPart1) { |
| TestCopyPart(&MutationDispatcher::Mutate_CopyPart, 1 << 10); |
| } |
| TEST(FuzzerMutate, CopyPart2) { |
| TestCopyPart(&MutationDispatcher::Mutate, 1 << 13); |
| } |
| TEST(FuzzerMutate, CopyPartNoInsertAtMaxSize) { |
| // This (non exhaustively) tests if `Mutate_CopyPart` tries to perform an |
| // insert on an input of size `MaxSize`. Performing an insert in this case |
| // will lead to the mutation failing. |
| std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); |
| fuzzer::EF = t.get(); |
| Random Rand(0); |
| std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); |
| uint8_t Data[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x00, 0x11, 0x22}; |
| size_t MaxSize = sizeof(Data); |
| for (int count = 0; count < (1 << 18); ++count) { |
| size_t NewSize = MD->Mutate_CopyPart(Data, MaxSize, MaxSize); |
| ASSERT_EQ(NewSize, MaxSize); |
| } |
| } |
| |
| void TestAddWordFromDictionary(Mutator M, int NumIter) { |
| std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); |
| fuzzer::EF = t.get(); |
| Random Rand(0); |
| std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); |
| uint8_t Word1[4] = {0xAA, 0xBB, 0xCC, 0xDD}; |
| uint8_t Word2[3] = {0xFF, 0xEE, 0xEF}; |
| MD->AddWordToManualDictionary(Word(Word1, sizeof(Word1))); |
| MD->AddWordToManualDictionary(Word(Word2, sizeof(Word2))); |
| int FoundMask = 0; |
| uint8_t CH0[7] = {0x00, 0x11, 0x22, 0xAA, 0xBB, 0xCC, 0xDD}; |
| uint8_t CH1[7] = {0x00, 0x11, 0xAA, 0xBB, 0xCC, 0xDD, 0x22}; |
| uint8_t CH2[7] = {0x00, 0xAA, 0xBB, 0xCC, 0xDD, 0x11, 0x22}; |
| uint8_t CH3[7] = {0xAA, 0xBB, 0xCC, 0xDD, 0x00, 0x11, 0x22}; |
| uint8_t CH4[6] = {0x00, 0x11, 0x22, 0xFF, 0xEE, 0xEF}; |
| uint8_t CH5[6] = {0x00, 0x11, 0xFF, 0xEE, 0xEF, 0x22}; |
| uint8_t CH6[6] = {0x00, 0xFF, 0xEE, 0xEF, 0x11, 0x22}; |
| uint8_t CH7[6] = {0xFF, 0xEE, 0xEF, 0x00, 0x11, 0x22}; |
| for (int i = 0; i < NumIter; i++) { |
| uint8_t T[7] = {0x00, 0x11, 0x22}; |
| size_t NewSize = (*MD.*M)(T, 3, 7); |
| if (NewSize == 7 && !memcmp(CH0, T, 7)) FoundMask |= 1 << 0; |
| if (NewSize == 7 && !memcmp(CH1, T, 7)) FoundMask |= 1 << 1; |
| if (NewSize == 7 && !memcmp(CH2, T, 7)) FoundMask |= 1 << 2; |
| if (NewSize == 7 && !memcmp(CH3, T, 7)) FoundMask |= 1 << 3; |
| if (NewSize == 6 && !memcmp(CH4, T, 6)) FoundMask |= 1 << 4; |
| if (NewSize == 6 && !memcmp(CH5, T, 6)) FoundMask |= 1 << 5; |
| if (NewSize == 6 && !memcmp(CH6, T, 6)) FoundMask |= 1 << 6; |
| if (NewSize == 6 && !memcmp(CH7, T, 6)) FoundMask |= 1 << 7; |
| } |
| EXPECT_EQ(FoundMask, 255); |
| } |
| |
| TEST(FuzzerMutate, AddWordFromDictionary1) { |
| TestAddWordFromDictionary( |
| &MutationDispatcher::Mutate_AddWordFromManualDictionary, 1 << 15); |
| } |
| |
| TEST(FuzzerMutate, AddWordFromDictionary2) { |
| TestAddWordFromDictionary(&MutationDispatcher::Mutate, 1 << 15); |
| } |
| |
| void TestChangeASCIIInteger(Mutator M, int NumIter) { |
| std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); |
| fuzzer::EF = t.get(); |
| Random Rand(0); |
| std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); |
| |
| uint8_t CH0[8] = {'1', '2', '3', '4', '5', '6', '7', '7'}; |
| uint8_t CH1[8] = {'1', '2', '3', '4', '5', '6', '7', '9'}; |
| uint8_t CH2[8] = {'2', '4', '6', '9', '1', '3', '5', '6'}; |
| uint8_t CH3[8] = {'0', '6', '1', '7', '2', '8', '3', '9'}; |
| int FoundMask = 0; |
| for (int i = 0; i < NumIter; i++) { |
| uint8_t T[8] = {'1', '2', '3', '4', '5', '6', '7', '8'}; |
| size_t NewSize = (*MD.*M)(T, 8, 8); |
| /**/ if (NewSize == 8 && !memcmp(CH0, T, 8)) FoundMask |= 1 << 0; |
| else if (NewSize == 8 && !memcmp(CH1, T, 8)) FoundMask |= 1 << 1; |
| else if (NewSize == 8 && !memcmp(CH2, T, 8)) FoundMask |= 1 << 2; |
| else if (NewSize == 8 && !memcmp(CH3, T, 8)) FoundMask |= 1 << 3; |
| else if (NewSize == 8) FoundMask |= 1 << 4; |
| } |
| EXPECT_EQ(FoundMask, 31); |
| } |
| |
| TEST(FuzzerMutate, ChangeASCIIInteger1) { |
| TestChangeASCIIInteger(&MutationDispatcher::Mutate_ChangeASCIIInteger, |
| 1 << 15); |
| } |
| |
| TEST(FuzzerMutate, ChangeASCIIInteger2) { |
| TestChangeASCIIInteger(&MutationDispatcher::Mutate, 1 << 15); |
| } |
| |
| void TestChangeBinaryInteger(Mutator M, int NumIter) { |
| std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); |
| fuzzer::EF = t.get(); |
| Random Rand(0); |
| std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {})); |
| |
| uint8_t CH0[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x79}; |
| uint8_t CH1[8] = {0x00, 0x11, 0x22, 0x31, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t CH2[8] = {0xff, 0x10, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t CH3[8] = {0x00, 0x11, 0x2a, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| uint8_t CH4[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x4f, 0x66, 0x77}; |
| uint8_t CH5[8] = {0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99, 0x88}; |
| uint8_t CH6[8] = {0x00, 0x11, 0x22, 0x00, 0x00, 0x00, 0x08, 0x77}; // Size |
| uint8_t CH7[8] = {0x00, 0x08, 0x00, 0x33, 0x44, 0x55, 0x66, 0x77}; // Sw(Size) |
| |
| int FoundMask = 0; |
| for (int i = 0; i < NumIter; i++) { |
| uint8_t T[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; |
| size_t NewSize = (*MD.*M)(T, 8, 8); |
| /**/ if (NewSize == 8 && !memcmp(CH0, T, 8)) FoundMask |= 1 << 0; |
| else if (NewSize == 8 && !memcmp(CH1, T, 8)) FoundMask |= 1 << 1; |
| else if (NewSize == 8 && !memcmp(CH2, T, 8)) FoundMask |= 1 << 2; |
| else if (NewSize == 8 && !memcmp(CH3, T, 8)) FoundMask |= 1 << 3; |
| else if (NewSize == 8 && !memcmp(CH4, T, 8)) FoundMask |= 1 << 4; |
| else if (NewSize == 8 && !memcmp(CH5, T, 8)) FoundMask |= 1 << 5; |
| else if (NewSize == 8 && !memcmp(CH6, T, 8)) FoundMask |= 1 << 6; |
| else if (NewSize == 8 && !memcmp(CH7, T, 8)) FoundMask |= 1 << 7; |
| } |
| EXPECT_EQ(FoundMask, 255); |
| } |
| |
| TEST(FuzzerMutate, ChangeBinaryInteger1) { |
| TestChangeBinaryInteger(&MutationDispatcher::Mutate_ChangeBinaryInteger, |
| 1 << 12); |
| } |
| |
| TEST(FuzzerMutate, ChangeBinaryInteger2) { |
| TestChangeBinaryInteger(&MutationDispatcher::Mutate, 1 << 15); |
| } |
| |
| |
| TEST(FuzzerDictionary, ParseOneDictionaryEntry) { |
| Unit U; |
| EXPECT_FALSE(ParseOneDictionaryEntry("", &U)); |
| EXPECT_FALSE(ParseOneDictionaryEntry(" ", &U)); |
| EXPECT_FALSE(ParseOneDictionaryEntry("\t ", &U)); |
| EXPECT_FALSE(ParseOneDictionaryEntry(" \" ", &U)); |
| EXPECT_FALSE(ParseOneDictionaryEntry(" zz\" ", &U)); |
| EXPECT_FALSE(ParseOneDictionaryEntry(" \"zz ", &U)); |
| EXPECT_FALSE(ParseOneDictionaryEntry(" \"\" ", &U)); |
| EXPECT_TRUE(ParseOneDictionaryEntry("\"a\"", &U)); |
| EXPECT_EQ(U, Unit({'a'})); |
| EXPECT_TRUE(ParseOneDictionaryEntry("\"abc\"", &U)); |
| EXPECT_EQ(U, Unit({'a', 'b', 'c'})); |
| EXPECT_TRUE(ParseOneDictionaryEntry("abc=\"abc\"", &U)); |
| EXPECT_EQ(U, Unit({'a', 'b', 'c'})); |
| EXPECT_FALSE(ParseOneDictionaryEntry("\"\\\"", &U)); |
| EXPECT_TRUE(ParseOneDictionaryEntry("\"\\\\\"", &U)); |
| EXPECT_EQ(U, Unit({'\\'})); |
| EXPECT_TRUE(ParseOneDictionaryEntry("\"\\xAB\"", &U)); |
| EXPECT_EQ(U, Unit({0xAB})); |
| EXPECT_TRUE(ParseOneDictionaryEntry("\"\\xABz\\xDE\"", &U)); |
| EXPECT_EQ(U, Unit({0xAB, 'z', 0xDE})); |
| EXPECT_TRUE(ParseOneDictionaryEntry("\"#\"", &U)); |
| EXPECT_EQ(U, Unit({'#'})); |
| EXPECT_TRUE(ParseOneDictionaryEntry("\"\\\"\"", &U)); |
| EXPECT_EQ(U, Unit({'"'})); |
| } |
| |
| TEST(FuzzerDictionary, ParseDictionaryFile) { |
| std::vector<Unit> Units; |
| EXPECT_FALSE(ParseDictionaryFile("zzz\n", &Units)); |
| EXPECT_FALSE(ParseDictionaryFile("", &Units)); |
| EXPECT_TRUE(ParseDictionaryFile("\n", &Units)); |
| EXPECT_EQ(Units.size(), 0U); |
| EXPECT_TRUE(ParseDictionaryFile("#zzzz a b c d\n", &Units)); |
| EXPECT_EQ(Units.size(), 0U); |
| EXPECT_TRUE(ParseDictionaryFile(" #zzzz\n", &Units)); |
| EXPECT_EQ(Units.size(), 0U); |
| EXPECT_TRUE(ParseDictionaryFile(" #zzzz\n", &Units)); |
| EXPECT_EQ(Units.size(), 0U); |
| EXPECT_TRUE(ParseDictionaryFile(" #zzzz\naaa=\"aa\"", &Units)); |
| EXPECT_EQ(Units, std::vector<Unit>({Unit({'a', 'a'})})); |
| EXPECT_TRUE( |
| ParseDictionaryFile(" #zzzz\naaa=\"aa\"\n\nabc=\"abc\"", &Units)); |
| EXPECT_EQ(Units, |
| std::vector<Unit>({Unit({'a', 'a'}), Unit({'a', 'b', 'c'})})); |
| } |
| |
| TEST(FuzzerUtil, Base64) { |
| EXPECT_EQ("", Base64({})); |
| EXPECT_EQ("YQ==", Base64({'a'})); |
| EXPECT_EQ("eA==", Base64({'x'})); |
| EXPECT_EQ("YWI=", Base64({'a', 'b'})); |
| EXPECT_EQ("eHk=", Base64({'x', 'y'})); |
| EXPECT_EQ("YWJj", Base64({'a', 'b', 'c'})); |
| EXPECT_EQ("eHl6", Base64({'x', 'y', 'z'})); |
| EXPECT_EQ("YWJjeA==", Base64({'a', 'b', 'c', 'x'})); |
| EXPECT_EQ("YWJjeHk=", Base64({'a', 'b', 'c', 'x', 'y'})); |
| EXPECT_EQ("YWJjeHl6", Base64({'a', 'b', 'c', 'x', 'y', 'z'})); |
| } |
| |
| #ifdef __GLIBC__ |
| class PrintfCapture { |
| public: |
| PrintfCapture() { |
| OldOutputFile = GetOutputFile(); |
| SetOutputFile(open_memstream(&Buffer, &Size)); |
| } |
| ~PrintfCapture() { |
| fclose(GetOutputFile()); |
| SetOutputFile(OldOutputFile); |
| free(Buffer); |
| } |
| std::string str() { return std::string(Buffer, Size); } |
| |
| private: |
| char *Buffer; |
| size_t Size; |
| FILE *OldOutputFile; |
| }; |
| |
| TEST(FuzzerUtil, PrintASCII) { |
| auto f = [](const char *Str, const char *PrintAfter = "") { |
| PrintfCapture Capture; |
| PrintASCII(reinterpret_cast<const uint8_t*>(Str), strlen(Str), PrintAfter); |
| return Capture.str(); |
| }; |
| EXPECT_EQ("hello", f("hello")); |
| EXPECT_EQ("c:\\\\", f("c:\\")); |
| EXPECT_EQ("\\\"hi\\\"", f("\"hi\"")); |
| EXPECT_EQ("\\011a", f("\ta")); |
| EXPECT_EQ("\\0111", f("\t1")); |
| EXPECT_EQ("hello\\012", f("hello\n")); |
| EXPECT_EQ("hello\n", f("hello", "\n")); |
| } |
| #endif |
| |
| TEST(Corpus, Distribution) { |
| DataFlowTrace DFT; |
| Random Rand(0); |
| struct EntropicOptions Entropic = {false, 0xFF, 100, false}; |
| std::unique_ptr<InputCorpus> C(new InputCorpus("", Entropic)); |
| size_t N = 10; |
| size_t TriesPerUnit = 1<<16; |
| for (size_t i = 0; i < N; i++) |
| C->AddToCorpus(Unit{static_cast<uint8_t>(i)}, /*NumFeatures*/ 1, |
| /*MayDeleteFile*/ false, /*HasFocusFunction*/ false, |
| /*ForceAddToCorpus*/ false, |
| /*TimeOfUnit*/ std::chrono::microseconds(0), |
| /*FeatureSet*/ {}, DFT, |
| /*BaseII*/ nullptr); |
| |
| std::vector<size_t> Hist(N); |
| for (size_t i = 0; i < N * TriesPerUnit; i++) { |
| Hist[C->ChooseUnitIdxToMutate(Rand)]++; |
| } |
| for (size_t i = 0; i < N; i++) { |
| // A weak sanity check that every unit gets invoked. |
| EXPECT_GT(Hist[i], TriesPerUnit / N / 3); |
| } |
| } |
| |
| TEST(Corpus, Replace) { |
| DataFlowTrace DFT; |
| struct EntropicOptions Entropic = {false, 0xFF, 100, false}; |
| std::unique_ptr<InputCorpus> C( |
| new InputCorpus(/*OutputCorpus*/ "", Entropic)); |
| InputInfo *FirstII = |
| C->AddToCorpus(Unit{0x01, 0x00}, /*NumFeatures*/ 1, |
| /*MayDeleteFile*/ false, /*HasFocusFunction*/ false, |
| /*ForceAddToCorpus*/ false, |
| /*TimeOfUnit*/ std::chrono::microseconds(1234), |
| /*FeatureSet*/ {}, DFT, |
| /*BaseII*/ nullptr); |
| InputInfo *SecondII = |
| C->AddToCorpus(Unit{0x02}, /*NumFeatures*/ 1, |
| /*MayDeleteFile*/ false, /*HasFocusFunction*/ false, |
| /*ForceAddToCorpus*/ false, |
| /*TimeOfUnit*/ std::chrono::microseconds(5678), |
| /*FeatureSet*/ {}, DFT, |
| /*BaseII*/ nullptr); |
| Unit ReplacedU = Unit{0x03}; |
| |
| C->Replace(FirstII, ReplacedU, |
| /*TimeOfUnit*/ std::chrono::microseconds(321)); |
| |
| // FirstII should be replaced. |
| EXPECT_EQ(FirstII->U, Unit{0x03}); |
| EXPECT_EQ(FirstII->Reduced, true); |
| EXPECT_EQ(FirstII->TimeOfUnit, std::chrono::microseconds(321)); |
| std::vector<uint8_t> ExpectedSha1(kSHA1NumBytes); |
| ComputeSHA1(ReplacedU.data(), ReplacedU.size(), ExpectedSha1.data()); |
| std::vector<uint8_t> IISha1(FirstII->Sha1, FirstII->Sha1 + kSHA1NumBytes); |
| EXPECT_EQ(IISha1, ExpectedSha1); |
| |
| // SecondII should not be replaced. |
| EXPECT_EQ(SecondII->U, Unit{0x02}); |
| EXPECT_EQ(SecondII->Reduced, false); |
| EXPECT_EQ(SecondII->TimeOfUnit, std::chrono::microseconds(5678)); |
| } |
| |
| template <typename T> |
| void EQ(const std::vector<T> &A, const std::vector<T> &B) { |
| EXPECT_EQ(A, B); |
| } |
| |
| template <typename T> void EQ(const std::set<T> &A, const std::vector<T> &B) { |
| EXPECT_EQ(A, std::set<T>(B.begin(), B.end())); |
| } |
| |
| void EQ(const std::vector<MergeFileInfo> &A, |
| const std::vector<std::string> &B) { |
| std::set<std::string> a; |
| for (const auto &File : A) |
| a.insert(File.Name); |
| std::set<std::string> b(B.begin(), B.end()); |
| EXPECT_EQ(a, b); |
| } |
| |
| #define TRACED_EQ(A, ...) \ |
| { \ |
| SCOPED_TRACE(#A); \ |
| EQ(A, __VA_ARGS__); \ |
| } |
| |
| TEST(Merger, Parse) { |
| Merger M; |
| |
| const char *kInvalidInputs[] = { |
| // Bad file numbers |
| "", |
| "x", |
| "0\n0", |
| "3\nx", |
| "2\n3", |
| "2\n2", |
| // Bad file names |
| "2\n2\nA\n", |
| "2\n2\nA\nB\nC\n", |
| // Unknown markers |
| "2\n1\nA\nSTARTED 0\nBAD 0 0x0", |
| // Bad file IDs |
| "1\n1\nA\nSTARTED 1", |
| "2\n1\nA\nSTARTED 0\nFT 1 0x0", |
| }; |
| for (auto S : kInvalidInputs) { |
| SCOPED_TRACE(S); |
| EXPECT_FALSE(M.Parse(S, false)); |
| } |
| |
| // Parse initial control file |
| EXPECT_TRUE(M.Parse("1\n0\nAA\n", false)); |
| ASSERT_EQ(M.Files.size(), 1U); |
| EXPECT_EQ(M.NumFilesInFirstCorpus, 0U); |
| EXPECT_EQ(M.Files[0].Name, "AA"); |
| EXPECT_TRUE(M.LastFailure.empty()); |
| EXPECT_EQ(M.FirstNotProcessedFile, 0U); |
| |
| // Parse control file that failed on first attempt |
| EXPECT_TRUE(M.Parse("2\n1\nAA\nBB\nSTARTED 0 42\n", false)); |
| ASSERT_EQ(M.Files.size(), 2U); |
| EXPECT_EQ(M.NumFilesInFirstCorpus, 1U); |
| EXPECT_EQ(M.Files[0].Name, "AA"); |
| EXPECT_EQ(M.Files[1].Name, "BB"); |
| EXPECT_EQ(M.LastFailure, "AA"); |
| EXPECT_EQ(M.FirstNotProcessedFile, 1U); |
| |
| // Parse control file that failed on later attempt |
| EXPECT_TRUE(M.Parse("3\n1\nAA\nBB\nC\n" |
| "STARTED 0 1000\n" |
| "FT 0 1 2 3\n" |
| "STARTED 1 1001\n" |
| "FT 1 4 5 6 \n" |
| "STARTED 2 1002\n" |
| "", |
| true)); |
| ASSERT_EQ(M.Files.size(), 3U); |
| EXPECT_EQ(M.NumFilesInFirstCorpus, 1U); |
| EXPECT_EQ(M.Files[0].Name, "AA"); |
| EXPECT_EQ(M.Files[0].Size, 1000U); |
| EXPECT_EQ(M.Files[1].Name, "BB"); |
| EXPECT_EQ(M.Files[1].Size, 1001U); |
| EXPECT_EQ(M.Files[2].Name, "C"); |
| EXPECT_EQ(M.Files[2].Size, 1002U); |
| EXPECT_EQ(M.LastFailure, "C"); |
| EXPECT_EQ(M.FirstNotProcessedFile, 3U); |
| TRACED_EQ(M.Files[0].Features, {1, 2, 3}); |
| TRACED_EQ(M.Files[1].Features, {4, 5, 6}); |
| |
| // Parse control file without features or PCs |
| EXPECT_TRUE(M.Parse("2\n0\nAA\nBB\n" |
| "STARTED 0 1000\n" |
| "FT 0\n" |
| "COV 0\n" |
| "STARTED 1 1001\n" |
| "FT 1\n" |
| "COV 1\n" |
| "", |
| true)); |
| ASSERT_EQ(M.Files.size(), 2U); |
| EXPECT_EQ(M.NumFilesInFirstCorpus, 0U); |
| EXPECT_TRUE(M.LastFailure.empty()); |
| EXPECT_EQ(M.FirstNotProcessedFile, 2U); |
| EXPECT_TRUE(M.Files[0].Features.empty()); |
| EXPECT_TRUE(M.Files[0].Cov.empty()); |
| EXPECT_TRUE(M.Files[1].Features.empty()); |
| EXPECT_TRUE(M.Files[1].Cov.empty()); |
| |
| // Parse features and PCs |
| EXPECT_TRUE(M.Parse("3\n2\nAA\nBB\nC\n" |
| "STARTED 0 1000\n" |
| "FT 0 1 2 3\n" |
| "COV 0 11 12 13\n" |
| "STARTED 1 1001\n" |
| "FT 1 4 5 6\n" |
| "COV 1 7 8 9\n" |
| "STARTED 2 1002\n" |
| "FT 2 6 1 3\n" |
| "COV 2 16 11 13\n" |
| "", |
| true)); |
| ASSERT_EQ(M.Files.size(), 3U); |
| EXPECT_EQ(M.NumFilesInFirstCorpus, 2U); |
| EXPECT_TRUE(M.LastFailure.empty()); |
| EXPECT_EQ(M.FirstNotProcessedFile, 3U); |
| TRACED_EQ(M.Files[0].Features, {1, 2, 3}); |
| TRACED_EQ(M.Files[0].Cov, {11, 12, 13}); |
| TRACED_EQ(M.Files[1].Features, {4, 5, 6}); |
| TRACED_EQ(M.Files[1].Cov, {7, 8, 9}); |
| TRACED_EQ(M.Files[2].Features, {1, 3, 6}); |
| TRACED_EQ(M.Files[2].Cov, {16}); |
| } |
| |
| TEST(Merger, Merge) { |
| Merger M; |
| std::set<uint32_t> Features, NewFeatures; |
| std::set<uint32_t> Cov, NewCov; |
| std::vector<std::string> NewFiles; |
| |
| // Adds new files and features |
| EXPECT_TRUE(M.Parse("3\n0\nA\nB\nC\n" |
| "STARTED 0 1000\n" |
| "FT 0 1 2 3\n" |
| "STARTED 1 1001\n" |
| "FT 1 4 5 6 \n" |
| "STARTED 2 1002\n" |
| "FT 2 6 1 3\n" |
| "", |
| true)); |
| EXPECT_EQ(M.Merge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), 6U); |
| TRACED_EQ(M.Files, {"A", "B", "C"}); |
| TRACED_EQ(NewFiles, {"A", "B"}); |
| TRACED_EQ(NewFeatures, {1, 2, 3, 4, 5, 6}); |
| |
| // Doesn't return features or files in the initial corpus. |
| EXPECT_TRUE(M.Parse("3\n1\nA\nB\nC\n" |
| "STARTED 0 1000\n" |
| "FT 0 1 2 3\n" |
| "STARTED 1 1001\n" |
| "FT 1 4 5 6 \n" |
| "STARTED 2 1002\n" |
| "FT 2 6 1 3\n" |
| "", |
| true)); |
| EXPECT_EQ(M.Merge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), 3U); |
| TRACED_EQ(M.Files, {"A", "B", "C"}); |
| TRACED_EQ(NewFiles, {"B"}); |
| TRACED_EQ(NewFeatures, {4, 5, 6}); |
| |
| // No new features, so no new files |
| EXPECT_TRUE(M.Parse("3\n2\nA\nB\nC\n" |
| "STARTED 0 1000\n" |
| "FT 0 1 2 3\n" |
| "STARTED 1 1001\n" |
| "FT 1 4 5 6 \n" |
| "STARTED 2 1002\n" |
| "FT 2 6 1 3\n" |
| "", |
| true)); |
| EXPECT_EQ(M.Merge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), 0U); |
| TRACED_EQ(M.Files, {"A", "B", "C"}); |
| TRACED_EQ(NewFiles, {}); |
| TRACED_EQ(NewFeatures, {}); |
| |
| // Can pass initial features and coverage. |
| Features = {1, 2, 3}; |
| Cov = {}; |
| EXPECT_TRUE(M.Parse("2\n0\nA\nB\n" |
| "STARTED 0 1000\n" |
| "FT 0 1 2 3\n" |
| "STARTED 1 1001\n" |
| "FT 1 4 5 6\n" |
| "", |
| true)); |
| EXPECT_EQ(M.Merge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), 3U); |
| TRACED_EQ(M.Files, {"A", "B"}); |
| TRACED_EQ(NewFiles, {"B"}); |
| TRACED_EQ(NewFeatures, {4, 5, 6}); |
| Features.clear(); |
| Cov.clear(); |
| |
| // Parse smaller files first |
| EXPECT_TRUE(M.Parse("3\n0\nA\nB\nC\n" |
| "STARTED 0 2000\n" |
| "FT 0 1 2 3\n" |
| "STARTED 1 1001\n" |
| "FT 1 4 5 6 \n" |
| "STARTED 2 1002\n" |
| "FT 2 6 1 3 \n" |
| "", |
| true)); |
| EXPECT_EQ(M.Merge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), 6U); |
| TRACED_EQ(M.Files, {"B", "C", "A"}); |
| TRACED_EQ(NewFiles, {"B", "C", "A"}); |
| TRACED_EQ(NewFeatures, {1, 2, 3, 4, 5, 6}); |
| |
| EXPECT_TRUE(M.Parse("4\n0\nA\nB\nC\nD\n" |
| "STARTED 0 2000\n" |
| "FT 0 1 2 3\n" |
| "STARTED 1 1101\n" |
| "FT 1 4 5 6 \n" |
| "STARTED 2 1102\n" |
| "FT 2 6 1 3 100 \n" |
| "STARTED 3 1000\n" |
| "FT 3 1 \n" |
| "", |
| true)); |
| EXPECT_EQ(M.Merge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), 7U); |
| TRACED_EQ(M.Files, {"A", "B", "C", "D"}); |
| TRACED_EQ(NewFiles, {"D", "B", "C", "A"}); |
| TRACED_EQ(NewFeatures, {1, 2, 3, 4, 5, 6, 100}); |
| |
| // For same sized file, parse more features first |
| EXPECT_TRUE(M.Parse("4\n1\nA\nB\nC\nD\n" |
| "STARTED 0 2000\n" |
| "FT 0 4 5 6 7 8\n" |
| "STARTED 1 1100\n" |
| "FT 1 1 2 3 \n" |
| "STARTED 2 1100\n" |
| "FT 2 2 3 \n" |
| "STARTED 3 1000\n" |
| "FT 3 1 \n" |
| "", |
| true)); |
| EXPECT_EQ(M.Merge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), 3U); |
| TRACED_EQ(M.Files, {"A", "B", "C", "D"}); |
| TRACED_EQ(NewFiles, {"D", "B"}); |
| TRACED_EQ(NewFeatures, {1, 2, 3}); |
| } |
| |
| TEST(Merger, SetCoverMerge) { |
| Merger M; |
| std::set<uint32_t> Features, NewFeatures; |
| std::set<uint32_t> Cov, NewCov; |
| std::vector<std::string> NewFiles; |
| |
| // Adds new files and features |
| EXPECT_TRUE(M.Parse("3\n0\nA\nB\nC\n" |
| "STARTED 0 1000\n" |
| "FT 0 1 2 3\n" |
| "STARTED 1 1001\n" |
| "FT 1 4 5 6 \n" |
| "STARTED 2 1002\n" |
| "FT 2 6 1 3\n" |
| "", |
| true)); |
| EXPECT_EQ(M.SetCoverMerge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), |
| 6U); |
| TRACED_EQ(M.Files, {"A", "B", "C"}); |
| TRACED_EQ(NewFiles, {"A", "B"}); |
| TRACED_EQ(NewFeatures, {1, 2, 3, 4, 5, 6}); |
| |
| // Doesn't return features or files in the initial corpus. |
| EXPECT_TRUE(M.Parse("3\n1\nA\nB\nC\n" |
| "STARTED 0 1000\n" |
| "FT 0 1 2 3\n" |
| "STARTED 1 1001\n" |
| "FT 1 4 5 6 \n" |
| "STARTED 2 1002\n" |
| "FT 2 6 1 3\n" |
| "", |
| true)); |
| EXPECT_EQ(M.SetCoverMerge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), |
| 3U); |
| TRACED_EQ(M.Files, {"A", "B", "C"}); |
| TRACED_EQ(NewFiles, {"B"}); |
| TRACED_EQ(NewFeatures, {4, 5, 6}); |
| |
| // No new features, so no new files |
| EXPECT_TRUE(M.Parse("3\n2\nA\nB\nC\n" |
| "STARTED 0 1000\n" |
| "FT 0 1 2 3\n" |
| "STARTED 1 1001\n" |
| "FT 1 4 5 6 \n" |
| "STARTED 2 1002\n" |
| "FT 2 6 1 3\n" |
| "", |
| true)); |
| EXPECT_EQ(M.SetCoverMerge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), |
| 0U); |
| TRACED_EQ(M.Files, {"A", "B", "C"}); |
| TRACED_EQ(NewFiles, {}); |
| TRACED_EQ(NewFeatures, {}); |
| |
| // Can pass initial features and coverage. |
| Features = {1, 2, 3}; |
| Cov = {}; |
| EXPECT_TRUE(M.Parse("2\n0\nA\nB\n" |
| "STARTED 0 1000\n" |
| "FT 0 1 2 3\n" |
| "STARTED 1 1001\n" |
| "FT 1 4 5 6\n" |
| "", |
| true)); |
| EXPECT_EQ(M.SetCoverMerge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), |
| 3U); |
| TRACED_EQ(M.Files, {"A", "B"}); |
| TRACED_EQ(NewFiles, {"B"}); |
| TRACED_EQ(NewFeatures, {4, 5, 6}); |
| Features.clear(); |
| Cov.clear(); |
| |
| // Prefer files with a lot of features first (C has 4 features) |
| // Then prefer B over A due to the smaller size. After choosing C and B, |
| // A and D have no new features to contribute. |
| EXPECT_TRUE(M.Parse("4\n0\nA\nB\nC\nD\n" |
| "STARTED 0 2000\n" |
| "FT 0 3 5 6\n" |
| "STARTED 1 1000\n" |
| "FT 1 4 5 6 \n" |
| "STARTED 2 1000\n" |
| "FT 2 1 2 3 4 \n" |
| "STARTED 3 500\n" |
| "FT 3 1 \n" |
| "", |
| true)); |
| EXPECT_EQ(M.SetCoverMerge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), |
| 6U); |
| TRACED_EQ(M.Files, {"A", "B", "C", "D"}); |
| TRACED_EQ(NewFiles, {"C", "B"}); |
| TRACED_EQ(NewFeatures, {1, 2, 3, 4, 5, 6}); |
| |
| // Only 1 file covers all features. |
| EXPECT_TRUE(M.Parse("4\n1\nA\nB\nC\nD\n" |
| "STARTED 0 2000\n" |
| "FT 0 4 5 6 7 8\n" |
| "STARTED 1 1100\n" |
| "FT 1 1 2 3 \n" |
| "STARTED 2 1100\n" |
| "FT 2 2 3 \n" |
| "STARTED 3 1000\n" |
| "FT 3 1 \n" |
| "", |
| true)); |
| EXPECT_EQ(M.SetCoverMerge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), |
| 3U); |
| TRACED_EQ(M.Files, {"A", "B", "C", "D"}); |
| TRACED_EQ(NewFiles, {"B"}); |
| TRACED_EQ(NewFeatures, {1, 2, 3}); |
| |
| // A Feature has a value greater than (1 << 21) and hence |
| // there are collisions in the underlying `covered features` |
| // bitvector. |
| EXPECT_TRUE(M.Parse("3\n0\nA\nB\nC\n" |
| "STARTED 0 2000\n" |
| "FT 0 1 2 3\n" |
| "STARTED 1 1000\n" |
| "FT 1 3 4 5 \n" |
| "STARTED 2 1000\n" |
| "FT 2 3 2097153 \n" // Last feature is (2^21 + 1). |
| "", |
| true)); |
| EXPECT_EQ(M.SetCoverMerge(Features, &NewFeatures, Cov, &NewCov, &NewFiles), |
| 5U); |
| TRACED_EQ(M.Files, {"A", "B", "C"}); |
| // File 'C' is not added because it's last feature is considered |
| // covered due to collision with feature 1. |
| TRACED_EQ(NewFiles, {"B", "A"}); |
| TRACED_EQ(NewFeatures, {1, 2, 3, 4, 5}); |
| } |
| |
| #undef TRACED_EQ |
| |
| TEST(DFT, BlockCoverage) { |
| BlockCoverage Cov; |
| // Assuming C0 has 5 instrumented blocks, |
| // C1: 7 blocks, C2: 4, C3: 9, C4 never covered, C5: 15, |
| |
| // Add C0 |
| EXPECT_TRUE(Cov.AppendCoverage("C0 5\n")); |
| EXPECT_EQ(Cov.GetCounter(0, 0), 1U); |
| EXPECT_EQ(Cov.GetCounter(0, 1), 0U); // not seen this BB yet. |
| EXPECT_EQ(Cov.GetCounter(0, 5), 0U); // BB ID out of bounds. |
| EXPECT_EQ(Cov.GetCounter(1, 0), 0U); // not seen this function yet. |
| |
| EXPECT_EQ(Cov.GetNumberOfBlocks(0), 5U); |
| EXPECT_EQ(Cov.GetNumberOfCoveredBlocks(0), 1U); |
| EXPECT_EQ(Cov.GetNumberOfBlocks(1), 0U); |
| |
| // Various errors. |
| EXPECT_FALSE(Cov.AppendCoverage("C0\n")); // No total number. |
| EXPECT_FALSE(Cov.AppendCoverage("C0 7\n")); // No total number. |
| EXPECT_FALSE(Cov.AppendCoverage("CZ\n")); // Wrong function number. |
| EXPECT_FALSE(Cov.AppendCoverage("C1 7 7")); // BB ID is too big. |
| EXPECT_FALSE(Cov.AppendCoverage("C1 100 7")); // BB ID is too big. |
| |
| // Add C0 more times. |
| EXPECT_TRUE(Cov.AppendCoverage("C0 5\n")); |
| EXPECT_EQ(Cov.GetCounter(0, 0), 2U); |
| EXPECT_TRUE(Cov.AppendCoverage("C0 1 2 5\n")); |
| EXPECT_EQ(Cov.GetCounter(0, 0), 3U); |
| EXPECT_EQ(Cov.GetCounter(0, 1), 1U); |
| EXPECT_EQ(Cov.GetCounter(0, 2), 1U); |
| EXPECT_EQ(Cov.GetCounter(0, 3), 0U); |
| EXPECT_EQ(Cov.GetCounter(0, 4), 0U); |
| EXPECT_EQ(Cov.GetNumberOfCoveredBlocks(0), 3U); |
| EXPECT_TRUE(Cov.AppendCoverage("C0 1 3 4 5\n")); |
| EXPECT_EQ(Cov.GetCounter(0, 0), 4U); |
| EXPECT_EQ(Cov.GetCounter(0, 1), 2U); |
| EXPECT_EQ(Cov.GetCounter(0, 2), 1U); |
| EXPECT_EQ(Cov.GetCounter(0, 3), 1U); |
| EXPECT_EQ(Cov.GetCounter(0, 4), 1U); |
| EXPECT_EQ(Cov.GetNumberOfCoveredBlocks(0), 5U); |
| |
| EXPECT_TRUE(Cov.AppendCoverage("C1 7\nC2 4\nC3 9\nC5 15\nC0 5\n")); |
| EXPECT_EQ(Cov.GetCounter(0, 0), 5U); |
| EXPECT_EQ(Cov.GetCounter(1, 0), 1U); |
| EXPECT_EQ(Cov.GetCounter(2, 0), 1U); |
| EXPECT_EQ(Cov.GetCounter(3, 0), 1U); |
| EXPECT_EQ(Cov.GetCounter(4, 0), 0U); |
| EXPECT_EQ(Cov.GetCounter(5, 0), 1U); |
| |
| EXPECT_TRUE(Cov.AppendCoverage("C3 4 5 9\nC5 11 12 15")); |
| EXPECT_EQ(Cov.GetCounter(0, 0), 5U); |
| EXPECT_EQ(Cov.GetCounter(1, 0), 1U); |
| EXPECT_EQ(Cov.GetCounter(2, 0), 1U); |
| EXPECT_EQ(Cov.GetCounter(3, 0), 2U); |
| EXPECT_EQ(Cov.GetCounter(3, 4), 1U); |
| EXPECT_EQ(Cov.GetCounter(3, 5), 1U); |
| EXPECT_EQ(Cov.GetCounter(3, 6), 0U); |
| EXPECT_EQ(Cov.GetCounter(4, 0), 0U); |
| EXPECT_EQ(Cov.GetCounter(5, 0), 2U); |
| EXPECT_EQ(Cov.GetCounter(5, 10), 0U); |
| EXPECT_EQ(Cov.GetCounter(5, 11), 1U); |
| EXPECT_EQ(Cov.GetCounter(5, 12), 1U); |
| } |
| |
| TEST(DFT, FunctionWeights) { |
| BlockCoverage Cov; |
| // unused function gets zero weight. |
| EXPECT_TRUE(Cov.AppendCoverage("C0 5\n")); |
| auto Weights = Cov.FunctionWeights(2); |
| EXPECT_GT(Weights[0], 0.); |
| EXPECT_EQ(Weights[1], 0.); |
| |
| // Less frequently used function gets less weight. |
| Cov.clear(); |
| EXPECT_TRUE(Cov.AppendCoverage("C0 5\nC1 5\nC1 5\n")); |
| Weights = Cov.FunctionWeights(2); |
| EXPECT_GT(Weights[0], Weights[1]); |
| |
| // A function with more uncovered blocks gets more weight. |
| Cov.clear(); |
| EXPECT_TRUE(Cov.AppendCoverage("C0 1 2 3 5\nC1 2 4\n")); |
| Weights = Cov.FunctionWeights(2); |
| EXPECT_GT(Weights[1], Weights[0]); |
| |
| // A function with DFT gets more weight than the function w/o DFT. |
| Cov.clear(); |
| EXPECT_TRUE(Cov.AppendCoverage("F1 111\nC0 3\nC1 1 2 3\n")); |
| Weights = Cov.FunctionWeights(2); |
| EXPECT_GT(Weights[1], Weights[0]); |
| } |
| |
| |
| TEST(Fuzzer, ForEachNonZeroByte) { |
| const size_t N = 64; |
| alignas(64) uint8_t Ar[N + 8] = { |
| 0, 0, 0, 0, 0, 0, 0, 0, |
| 1, 2, 0, 0, 0, 0, 0, 0, |
| 0, 0, 3, 0, 4, 0, 0, 0, |
| 0, 0, 0, 0, 0, 0, 0, 0, |
| 0, 0, 0, 5, 0, 6, 0, 0, |
| 0, 0, 0, 0, 0, 0, 7, 0, |
| 0, 0, 0, 0, 0, 0, 0, 0, |
| 0, 0, 0, 0, 0, 0, 0, 8, |
| 9, 9, 9, 9, 9, 9, 9, 9, |
| }; |
| typedef std::vector<std::pair<size_t, uint8_t>> Vec; |
| Vec Res, Expected; |
| auto CB = [&](size_t FirstFeature, size_t Idx, uint8_t V) { |
| Res.push_back({FirstFeature + Idx, V}); |
| }; |
| ForEachNonZeroByte(Ar, Ar + N, 100, CB); |
| Expected = {{108, 1}, {109, 2}, {118, 3}, {120, 4}, |
| {135, 5}, {137, 6}, {146, 7}, {163, 8}}; |
| EXPECT_EQ(Res, Expected); |
| |
| Res.clear(); |
| ForEachNonZeroByte(Ar + 9, Ar + N, 109, CB); |
| Expected = { {109, 2}, {118, 3}, {120, 4}, |
| {135, 5}, {137, 6}, {146, 7}, {163, 8}}; |
| EXPECT_EQ(Res, Expected); |
| |
| Res.clear(); |
| ForEachNonZeroByte(Ar + 9, Ar + N - 9, 109, CB); |
| Expected = { {109, 2}, {118, 3}, {120, 4}, |
| {135, 5}, {137, 6}, {146, 7}}; |
| EXPECT_EQ(Res, Expected); |
| } |
| |
| // FuzzerCommand unit tests. The arguments in the two helper methods below must |
| // match. |
| static void makeCommandArgs(std::vector<std::string> *ArgsToAdd) { |
| assert(ArgsToAdd); |
| ArgsToAdd->clear(); |
| ArgsToAdd->push_back("foo"); |
| ArgsToAdd->push_back("-bar=baz"); |
| ArgsToAdd->push_back("qux"); |
| ArgsToAdd->push_back(Command::ignoreRemainingArgs()); |
| ArgsToAdd->push_back("quux"); |
| ArgsToAdd->push_back("-grault=garply"); |
| } |
| |
| static std::string makeCmdLine(const char *separator, const char *suffix) { |
| std::string CmdLine("foo -bar=baz qux "); |
| if (strlen(separator) != 0) { |
| CmdLine += separator; |
| CmdLine += " "; |
| } |
| CmdLine += Command::ignoreRemainingArgs(); |
| CmdLine += " quux -grault=garply"; |
| if (strlen(suffix) != 0) { |
| CmdLine += " "; |
| CmdLine += suffix; |
| } |
| return CmdLine; |
| } |
| |
| TEST(FuzzerCommand, Create) { |
| std::string CmdLine; |
| |
| // Default constructor |
| Command DefaultCmd; |
| |
| CmdLine = DefaultCmd.toString(); |
| EXPECT_EQ(CmdLine, ""); |
| |
| // Explicit constructor |
| std::vector<std::string> ArgsToAdd; |
| makeCommandArgs(&ArgsToAdd); |
| Command InitializedCmd(ArgsToAdd); |
| |
| CmdLine = InitializedCmd.toString(); |
| EXPECT_EQ(CmdLine, makeCmdLine("", "")); |
| |
| // Compare each argument |
| auto InitializedArgs = InitializedCmd.getArguments(); |
| auto i = ArgsToAdd.begin(); |
| auto j = InitializedArgs.begin(); |
| while (i != ArgsToAdd.end() && j != InitializedArgs.end()) { |
| EXPECT_EQ(*i++, *j++); |
| } |
| EXPECT_EQ(i, ArgsToAdd.end()); |
| EXPECT_EQ(j, InitializedArgs.end()); |
| |
| // Copy constructor |
| Command CopiedCmd(InitializedCmd); |
| |
| CmdLine = CopiedCmd.toString(); |
| EXPECT_EQ(CmdLine, makeCmdLine("", "")); |
| |
| // Assignment operator |
| Command AssignedCmd; |
| AssignedCmd = CopiedCmd; |
| |
| CmdLine = AssignedCmd.toString(); |
| EXPECT_EQ(CmdLine, makeCmdLine("", "")); |
| } |
| |
| TEST(FuzzerCommand, ModifyArguments) { |
| std::vector<std::string> ArgsToAdd; |
| makeCommandArgs(&ArgsToAdd); |
| Command Cmd; |
| std::string CmdLine; |
| |
| Cmd.addArguments(ArgsToAdd); |
| CmdLine = Cmd.toString(); |
| EXPECT_EQ(CmdLine, makeCmdLine("", "")); |
| |
| Cmd.addArgument("waldo"); |
| EXPECT_TRUE(Cmd.hasArgument("waldo")); |
| |
| CmdLine = Cmd.toString(); |
| EXPECT_EQ(CmdLine, makeCmdLine("waldo", "")); |
| |
| Cmd.removeArgument("waldo"); |
| EXPECT_FALSE(Cmd.hasArgument("waldo")); |
| |
| CmdLine = Cmd.toString(); |
| EXPECT_EQ(CmdLine, makeCmdLine("", "")); |
| } |
| |
| TEST(FuzzerCommand, ModifyFlags) { |
| std::vector<std::string> ArgsToAdd; |
| makeCommandArgs(&ArgsToAdd); |
| Command Cmd(ArgsToAdd); |
| std::string Value, CmdLine; |
| ASSERT_FALSE(Cmd.hasFlag("fred")); |
| |
| Value = Cmd.getFlagValue("fred"); |
| EXPECT_EQ(Value, ""); |
| |
| CmdLine = Cmd.toString(); |
| EXPECT_EQ(CmdLine, makeCmdLine("", "")); |
| |
| Cmd.addFlag("fred", "plugh"); |
| EXPECT_TRUE(Cmd.hasFlag("fred")); |
| |
| Value = Cmd.getFlagValue("fred"); |
| EXPECT_EQ(Value, "plugh"); |
| |
| CmdLine = Cmd.toString(); |
| EXPECT_EQ(CmdLine, makeCmdLine("-fred=plugh", "")); |
| |
| Cmd.removeFlag("fred"); |
| EXPECT_FALSE(Cmd.hasFlag("fred")); |
| |
| Value = Cmd.getFlagValue("fred"); |
| EXPECT_EQ(Value, ""); |
| |
| CmdLine = Cmd.toString(); |
| EXPECT_EQ(CmdLine, makeCmdLine("", "")); |
| } |
| |
| TEST(FuzzerCommand, SetOutput) { |
| std::vector<std::string> ArgsToAdd; |
| makeCommandArgs(&ArgsToAdd); |
| Command Cmd(ArgsToAdd); |
| std::string CmdLine; |
| ASSERT_FALSE(Cmd.hasOutputFile()); |
| ASSERT_FALSE(Cmd.isOutAndErrCombined()); |
| |
| Cmd.combineOutAndErr(true); |
| EXPECT_TRUE(Cmd.isOutAndErrCombined()); |
| |
| CmdLine = Cmd.toString(); |
| EXPECT_EQ(CmdLine, makeCmdLine("", "2>&1")); |
| |
| Cmd.combineOutAndErr(false); |
| EXPECT_FALSE(Cmd.isOutAndErrCombined()); |
| |
| Cmd.setOutputFile("xyzzy"); |
| EXPECT_TRUE(Cmd.hasOutputFile()); |
| |
| CmdLine = Cmd.toString(); |
| EXPECT_EQ(CmdLine, makeCmdLine("", ">xyzzy")); |
| |
| Cmd.setOutputFile("thud"); |
| EXPECT_TRUE(Cmd.hasOutputFile()); |
| |
| CmdLine = Cmd.toString(); |
| EXPECT_EQ(CmdLine, makeCmdLine("", ">thud")); |
| |
| Cmd.combineOutAndErr(); |
| EXPECT_TRUE(Cmd.isOutAndErrCombined()); |
| |
| CmdLine = Cmd.toString(); |
| EXPECT_EQ(CmdLine, makeCmdLine("", ">thud 2>&1")); |
| } |
| |
| TEST(Entropic, UpdateFrequency) { |
| const size_t One = 1, Two = 2; |
| const size_t FeatIdx1 = 0, FeatIdx2 = 42, FeatIdx3 = 12, FeatIdx4 = 26; |
| size_t Index; |
| // Create input corpus with default entropic configuration |
| struct EntropicOptions Entropic = {true, 0xFF, 100, false}; |
| std::unique_ptr<InputCorpus> C(new InputCorpus("", Entropic)); |
| std::unique_ptr<InputInfo> II(new InputInfo()); |
| |
| C->AddRareFeature(FeatIdx1); |
| C->UpdateFeatureFrequency(II.get(), FeatIdx1); |
| EXPECT_EQ(II->FeatureFreqs.size(), One); |
| C->AddRareFeature(FeatIdx2); |
| C->UpdateFeatureFrequency(II.get(), FeatIdx1); |
| C->UpdateFeatureFrequency(II.get(), FeatIdx2); |
| EXPECT_EQ(II->FeatureFreqs.size(), Two); |
| EXPECT_EQ(II->FeatureFreqs[0].second, 2); |
| EXPECT_EQ(II->FeatureFreqs[1].second, 1); |
| |
| C->AddRareFeature(FeatIdx3); |
| C->AddRareFeature(FeatIdx4); |
| C->UpdateFeatureFrequency(II.get(), FeatIdx3); |
| C->UpdateFeatureFrequency(II.get(), FeatIdx3); |
| C->UpdateFeatureFrequency(II.get(), FeatIdx3); |
| C->UpdateFeatureFrequency(II.get(), FeatIdx4); |
| |
| for (Index = 1; Index < II->FeatureFreqs.size(); Index++) |
| EXPECT_LT(II->FeatureFreqs[Index - 1].first, II->FeatureFreqs[Index].first); |
| |
| II->DeleteFeatureFreq(FeatIdx3); |
| for (Index = 1; Index < II->FeatureFreqs.size(); Index++) |
| EXPECT_LT(II->FeatureFreqs[Index - 1].first, II->FeatureFreqs[Index].first); |
| } |
| |
| double SubAndSquare(double X, double Y) { |
| double R = X - Y; |
| R = R * R; |
| return R; |
| } |
| |
| TEST(Entropic, ComputeEnergy) { |
| const double Precision = 0.01; |
| struct EntropicOptions Entropic = {true, 0xFF, 100, false}; |
| std::unique_ptr<InputCorpus> C(new InputCorpus("", Entropic)); |
| std::unique_ptr<InputInfo> II(new InputInfo()); |
| std::vector<std::pair<uint32_t, uint16_t>> FeatureFreqs = { |
| {1, 3}, {2, 3}, {3, 3}}; |
| II->FeatureFreqs = FeatureFreqs; |
| II->NumExecutedMutations = 0; |
| II->UpdateEnergy(4, false, std::chrono::microseconds(0)); |
| EXPECT_LT(SubAndSquare(II->Energy, 1.450805), Precision); |
| |
| II->NumExecutedMutations = 9; |
| II->UpdateEnergy(5, false, std::chrono::microseconds(0)); |
| EXPECT_LT(SubAndSquare(II->Energy, 1.525496), Precision); |
| |
| II->FeatureFreqs[0].second++; |
| II->FeatureFreqs.push_back(std::pair<uint32_t, uint16_t>(42, 6)); |
| II->NumExecutedMutations = 20; |
| II->UpdateEnergy(10, false, std::chrono::microseconds(0)); |
| EXPECT_LT(SubAndSquare(II->Energy, 1.792831), Precision); |
| } |
| |
| int main(int argc, char **argv) { |
| testing::InitGoogleTest(&argc, argv); |
| return RUN_ALL_TESTS(); |
| } |
