[libFuzzer] Replace -seed_corpus to better support fork mode on Win
Summary:
Pass seed corpus list in a file to get around argument length limits on Windows.
This limit was preventing many uses of fork mode on Windows.
Reviewers: kcc, morehouse
Reviewed By: kcc
Subscribers: #sanitizers, llvm-commits
Tags: #sanitizers, #llvm
Differential Revision: https://reviews.llvm.org/D60980
llvm-svn: 359610
GitOrigin-RevId: f3ee97731eb524e9c7bc6911c205a38e643dfff4
diff --git a/FuzzerDriver.cpp b/FuzzerDriver.cpp
index a51ac93..b9c8927 100644
--- a/FuzzerDriver.cpp
+++ b/FuzzerDriver.cpp
@@ -763,16 +763,25 @@
exit(0);
}
- // Parse -seed_inputs=file1,file2,...
+ // Parse -seed_inputs=file1,file2,... or -seed_inputs=@seed_inputs_file
Vector<std::string> ExtraSeedFiles;
if (Flags.seed_inputs) {
- std::string s = Flags.seed_inputs;
- size_t comma_pos;
- while ((comma_pos = s.find_last_of(',')) != std::string::npos) {
- ExtraSeedFiles.push_back(s.substr(comma_pos + 1));
- s = s.substr(0, comma_pos);
+ std::string SeedInputs;
+ if (Flags.seed_inputs[0] == '@')
+ SeedInputs = FileToString(Flags.seed_inputs + 1); // File contains list.
+ else
+ SeedInputs = Flags.seed_inputs; // seed_inputs contains the list.
+ if (SeedInputs.empty()) {
+ Printf("seed_inputs is empty or @file does not exist.\n");
+ exit(1);
}
- ExtraSeedFiles.push_back(s);
+ // Parse SeedInputs.
+ size_t comma_pos = 0;
+ while ((comma_pos = SeedInputs.find_last_of(',')) != std::string::npos) {
+ ExtraSeedFiles.push_back(SeedInputs.substr(comma_pos + 1));
+ SeedInputs = SeedInputs.substr(0, comma_pos);
+ }
+ ExtraSeedFiles.push_back(SeedInputs);
}
F->Loop(*Inputs, ExtraSeedFiles);
diff --git a/FuzzerFlags.def b/FuzzerFlags.def
index d3da3e5..b4ec5f2 100644
--- a/FuzzerFlags.def
+++ b/FuzzerFlags.def
@@ -21,7 +21,8 @@
"limit is increased (smaller == faster). If 0, immediately try inputs with "
"size up to max_len.")
FUZZER_FLAG_STRING(seed_inputs, "A comma-separated list of input files "
- "to use as an additional seed corpus")
+ "to use as an additional seed corpus. Alternatively, an \"@\" followed by "
+ "the name of a file containing the comma-seperated list.")
FUZZER_FLAG_INT(cross_over, 1, "If 1, cross over inputs.")
FUZZER_FLAG_INT(mutate_depth, 5,
"Apply this number of consecutive mutations to each input.")
diff --git a/FuzzerFork.cpp b/FuzzerFork.cpp
index 9d338aa..dd16ec1 100644
--- a/FuzzerFork.cpp
+++ b/FuzzerFork.cpp
@@ -66,6 +66,7 @@
std::string CorpusDir;
std::string FeaturesDir;
std::string LogPath;
+ std::string SeedListPath;
std::string CFPath;
// Fuzzing Outputs.
@@ -74,6 +75,7 @@
~FuzzJob() {
RemoveFile(CFPath);
RemoveFile(LogPath);
+ RemoveFile(SeedListPath);
RmDirRecursive(CorpusDir);
RmDirRecursive(FeaturesDir);
}
@@ -121,8 +123,11 @@
for (size_t i = 0; i < CorpusSubsetSize; i++)
Seeds += (Seeds.empty() ? "" : ",") +
Files[Rand->SkewTowardsLast(Files.size())];
- if (!Seeds.empty())
- Cmd.addFlag("seed_inputs", Seeds);
+ if (!Seeds.empty()) {
+ Job->SeedListPath = std::to_string(JobId) + ".seeds";
+ WriteToFile(Seeds, Job->SeedListPath);
+ Cmd.addFlag("seed_inputs", "@" + Job->SeedListPath);
+ }
Job->LogPath = DirPlusFile(TempDir, std::to_string(JobId) + ".log");
Job->CorpusDir = DirPlusFile(TempDir, "C" + std::to_string(JobId));
Job->FeaturesDir = DirPlusFile(TempDir, "F" + std::to_string(JobId));
diff --git a/FuzzerIO.cpp b/FuzzerIO.cpp
index a8140b6..7e5ba30 100644
--- a/FuzzerIO.cpp
+++ b/FuzzerIO.cpp
@@ -64,6 +64,11 @@
WriteToFile(U.data(), U.size(), Path);
}
+void WriteToFile(const std::string &Data, const std::string &Path) {
+ WriteToFile(reinterpret_cast<const uint8_t *>(Data.c_str()), Data.size(),
+ Path);
+}
+
void WriteToFile(const uint8_t *Data, size_t Size, const std::string &Path) {
// Use raw C interface because this function may be called from a sig handler.
FILE *Out = fopen(Path.c_str(), "wb");
diff --git a/FuzzerIO.h b/FuzzerIO.h
index cbfafa5..fe0d7b4 100644
--- a/FuzzerIO.h
+++ b/FuzzerIO.h
@@ -25,6 +25,8 @@
void CopyFileToErr(const std::string &Path);
void WriteToFile(const uint8_t *Data, size_t Size, const std::string &Path);
+// Write Data.c_str() to the file without terminating null character.
+void WriteToFile(const std::string &Data, const std::string &Path);
void WriteToFile(const Unit &U, const std::string &Path);
void ReadDirToVectorOfUnits(const char *Path, Vector<Unit> *V,
