fuzz-target-recorder.cpp@ 80346

Last change on this file since 80346 was 77758, checked in by vboxsync, 6 years ago
Runtime/common/fuzz: Updates, add possiblity to dump the recorded target state and make it configurable what to include when comparing target states for equality
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 25.4 KB

Line
1	/* $Id: fuzz-target-recorder.cpp 77758 2019-03-18 13:17:30Z vboxsync $ */
2	/** @file
3	* IPRT - Fuzzing framework API, target state recorder.
4	*/
5
6	/*
7	* Copyright (C) 2019 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27
28	/*********************************************************************************************************************************
29	* Header Files *
30	*********************************************************************************************************************************/
31	#include <iprt/fuzz.h>
32	#include "internal/iprt.h"
33
34	#include <iprt/asm.h>
35	#include <iprt/assert.h>
36	#include <iprt/avl.h>
37	#include <iprt/crc.h>
38	#include <iprt/ctype.h>
39	#include <iprt/err.h>
40	#include <iprt/file.h>
41	#include <iprt/list.h>
42	#include <iprt/mem.h>
43	#include <iprt/path.h>
44	#include <iprt/pipe.h>
45	#include <iprt/process.h>
46	#include <iprt/semaphore.h>
47	#include <iprt/string.h>
48
49
50
51	/*********************************************************************************************************************************
52	* Structures and Typedefs *
53	*********************************************************************************************************************************/
54	/** Pointer to the internal fuzzed target recorder state. */
55	typedef struct RTFUZZTGTRECINT *PRTFUZZTGTRECINT;
56
57
58	/**
59	* Stdout/Stderr buffer.
60	*/
61	typedef struct RTFUZZTGTSTDOUTERRBUF
62	{
63	/** Current amount buffered. */
64	size_t cbBuf;
65	/** Maxmium amount to buffer. */
66	size_t cbBufMax;
67	/** Base pointer to the data buffer. */
68	uint8_t *pbBase;
69	} RTFUZZTGTSTDOUTERRBUF;
70	/** Pointer to a stdout/stderr buffer. */
71	typedef RTFUZZTGTSTDOUTERRBUF *PRTFUZZTGTSTDOUTERRBUF;
72
73
74	/**
75	* Internal fuzzed target state.
76	*/
77	typedef struct RTFUZZTGTSTATEINT
78	{
79	/** Node for the list of states. */
80	RTLISTNODE NdStates;
81	/** Checksum for the state. */
82	uint64_t uChkSum;
83	/** Magic identifying the structure. */
84	uint32_t u32Magic;
85	/** Reference counter. */
86	volatile uint32_t cRefs;
87	/** The owning recorder instance. */
88	PRTFUZZTGTRECINT pTgtRec;
89	/** Flag whether the state is finalized. */
90	bool fFinalized;
91	/** Flag whether the state is contained in the recorded set. */
92	bool fInRecSet;
93	/** The stdout data buffer. */
94	RTFUZZTGTSTDOUTERRBUF StdOutBuf;
95	/** The stderr data buffer. */
96	RTFUZZTGTSTDOUTERRBUF StdErrBuf;
97	/** Process status. */
98	RTPROCSTATUS ProcSts;
99	/** Coverage report buffer. */
100	void *pvCovReport;
101	/** Size of the coverage report in bytes. */
102	size_t cbCovReport;
103	/** Number of traced edges. */
104	size_t cEdges;
105	} RTFUZZTGTSTATEINT;
106	/** Pointer to an internal fuzzed target state. */
107	typedef RTFUZZTGTSTATEINT *PRTFUZZTGTSTATEINT;
108
109
110	/**
111	* Recorder states node in the AVL tree.
112	*/
113	typedef struct RTFUZZTGTRECNODE
114	{
115	/** The AVL tree core (keyed by checksum). */
116	AVLU64NODECORE Core;
117	/** The list anchor for the individual states. */
118	RTLISTANCHOR LstStates;
119	} RTFUZZTGTRECNODE;
120	/** Pointer to a recorder states node. */
121	typedef RTFUZZTGTRECNODE *PRTFUZZTGTRECNODE;
122
123
124	/**
125	* Edge information node.
126	*/
127	typedef struct RTFUZZTGTEDGE
128	{
129	/** The AVL tree core (keyed by offset). */
130	AVLU64NODECORE Core;
131	/** Number of times the edge was hit. */
132	volatile uint64_t cHits;
133	} RTFUZZTGTEDGE;
134	/** Pointer to a edge information node. */
135	typedef RTFUZZTGTEDGE *PRTFUZZTGTEDGE;
136
137
138	/**
139	* Internal fuzzed target recorder state.
140	*/
141	typedef struct RTFUZZTGTRECINT
142	{
143	/** Magic value for identification. */
144	uint32_t u32Magic;
145	/** Reference counter. */
146	volatile uint32_t cRefs;
147	/** Flags passed when the recorder was created. */
148	uint32_t fRecFlags;
149	/** Semaphore protecting the states tree. */
150	RTSEMRW hSemRwStates;
151	/** The AVL tree for indexing the recorded state (keyed by stdout/stderr buffer size). */
152	AVLU64TREE TreeStates;
153	/** Semaphore protecting the edges tree. */
154	RTSEMRW hSemRwEdges;
155	/** The AVL tree for discovered edges when coverage reports are collected. */
156	AVLU64TREE TreeEdges;
157	/** Number of edges discovered so far. */
158	volatile uint64_t cEdges;
159	/** The discovered offset width. */
160	volatile uint32_t cbCovOff;
161	} RTFUZZTGTRECINT;
162
163
164	/** SanCov magic for 64bit offsets. */
165	#define SANCOV_MAGIC_64 UINT64_C(0xc0bfffffffffff64)
166	/** SanCov magic for 32bit offsets. */
167	#define SANCOV_MAGIC_32 UINT64_C(0xc0bfffffffffff32)
168
169
170	/*********************************************************************************************************************************
171	* Internal Functions *
172	*********************************************************************************************************************************/
173
174	/**
175	* Initializes the given stdout/stderr buffer.
176	*
177	* @returns nothing.
178	* @param pBuf The buffer to initialize.
179	*/
180	static void rtFuzzTgtStdOutErrBufInit(PRTFUZZTGTSTDOUTERRBUF pBuf)
181	{
182	pBuf->cbBuf = 0;
183	pBuf->cbBufMax = 0;
184	pBuf->pbBase = NULL;
185	}
186
187
188	/**
189	* Frees all allocated resources in the given stdout/stderr buffer.
190	*
191	* @returns nothing.
192	* @param pBuf The buffer to free.
193	*/
194	static void rtFuzzTgtStdOutErrBufFree(PRTFUZZTGTSTDOUTERRBUF pBuf)
195	{
196	if (pBuf->pbBase)
197	RTMemFree(pBuf->pbBase);
198	}
199
200
201	/**
202	* Fills the given stdout/stderr buffer from the given pipe.
203	*
204	* @returns IPRT status code.
205	* @param pBuf The buffer to fill.
206	* @param hPipeRead The pipe to read from.
207	*/
208	static int rtFuzzTgtStdOutErrBufFillFromPipe(PRTFUZZTGTSTDOUTERRBUF pBuf, RTPIPE hPipeRead)
209	{
210	int rc = VINF_SUCCESS;
211
212	size_t cbRead = 0;
213	size_t cbThisRead = 0;
214	do
215	{
216	cbThisRead = pBuf->cbBufMax - pBuf->cbBuf;
217	if (!cbThisRead)
218	{
219	/* Try to increase the buffer. */
220	uint8_t pbNew = (uint8_t )RTMemRealloc(pBuf->pbBase, pBuf->cbBufMax + _4K);
221	if (RT_LIKELY(pbNew))
222	{
223	pBuf->cbBufMax += _4K;
224	pBuf->pbBase = pbNew;
225	}
226	cbThisRead = pBuf->cbBufMax - pBuf->cbBuf;
227	}
228
229	if (cbThisRead)
230	{
231	rc = RTPipeRead(hPipeRead, pBuf->pbBase + pBuf->cbBuf, cbThisRead, &cbRead);
232	if (RT_SUCCESS(rc))
233	pBuf->cbBuf += cbRead;
234	}
235	else
236	rc = VERR_NO_MEMORY;
237	} while ( RT_SUCCESS(rc)
238	&& cbRead == cbThisRead);
239
240	return rc;
241	}
242
243
244	/**
245	* Writes the given buffer to the given file.
246	*
247	* @returns IPRT status code.
248	* @param pBuf The buffer to write.
249	* @param pszFilename Where to write the buffer.
250	*/
251	static int rtFuzzTgtStateStdOutErrBufWriteToFile(PRTFUZZTGTSTDOUTERRBUF pBuf, const char *pszFilename)
252	{
253	RTFILE hFile;
254	int rc = RTFileOpen(&hFile, pszFilename, RTFILE_O_CREATE \| RTFILE_O_WRITE \| RTFILE_O_DENY_NONE);
255	if (RT_SUCCESS(rc))
256	{
257	rc = RTFileWrite(hFile, pBuf->pbBase, pBuf->cbBuf, NULL);
258	AssertRC(rc);
259	RTFileClose(hFile);
260
261	if (RT_FAILURE(rc))
262	RTFileDelete(pszFilename);
263	}
264
265	return rc;
266	}
267
268
269	/**
270	* Scans the given target state for newly discovered edges in the coverage report.
271	*
272	* @returns IPRT status code.
273	* @param pThis The fuzzer target recorder instance.
274	* @param pTgtState The target state to check.
275	*/
276	static int rtFuzzTgtRecScanStateForNewEdges(PRTFUZZTGTRECINT pThis, PRTFUZZTGTSTATEINT pTgtState)
277	{
278	int rc = VINF_SUCCESS;
279
280	if (pTgtState->pvCovReport)
281	{
282	rc = RTSemRWRequestRead(pThis->hSemRwEdges, RT_INDEFINITE_WAIT); AssertRC(rc);
283
284	uint32_t cbCovOff = ASMAtomicReadU32(&pThis->cbCovOff);
285	Assert(cbCovOff != 0);
286
287	uint8_t pbCovCur = (uint8_t )pTgtState->pvCovReport;
288	size_t cEdgesLeft = pTgtState->cbCovReport / cbCovOff;
289	while (cEdgesLeft)
290	{
291	uint64_t offCur = cbCovOff == sizeof(uint64_t)
292	? (uint64_t )pbCovCur
293	: (uint32_t )pbCovCur;
294
295	PRTFUZZTGTEDGE pEdge = (PRTFUZZTGTEDGE)RTAvlU64Get(&pThis->TreeEdges, offCur);
296	if (!pEdge)
297	{
298	/* New edge discovered, allocate and add. */
299	rc = RTSemRWReleaseRead(pThis->hSemRwEdges); AssertRC(rc);
300
301	pEdge = (PRTFUZZTGTEDGE)RTMemAllocZ(sizeof(RTFUZZTGTEDGE));
302	if (RT_LIKELY(pEdge))
303	{
304	pEdge->Core.Key = offCur;
305	pEdge->cHits = 1;
306	rc = RTSemRWRequestWrite(pThis->hSemRwEdges, RT_INDEFINITE_WAIT); AssertRC(rc);
307
308	bool fIns = RTAvlU64Insert(&pThis->TreeEdges, &pEdge->Core);
309	if (!fIns)
310	{
311	/* Someone raced us, free and query again. */
312	RTMemFree(pEdge);
313	pEdge = (PRTFUZZTGTEDGE)RTAvlU64Get(&pThis->TreeEdges, offCur);
314	AssertPtr(pEdge);
315
316	ASMAtomicIncU64(&pEdge->cHits);
317	}
318	else
319	ASMAtomicIncU64(&pThis->cEdges);
320
321	rc = RTSemRWReleaseWrite(pThis->hSemRwEdges); AssertRC(rc);
322	rc = RTSemRWRequestRead(pThis->hSemRwEdges, RT_INDEFINITE_WAIT); AssertRC(rc);
323	}
324	else
325	{
326	rc = RTSemRWRequestRead(pThis->hSemRwEdges, RT_INDEFINITE_WAIT);
327	AssertRC(rc);
328
329	rc = VERR_NO_MEMORY;
330	break;
331	}
332	}
333	else
334	ASMAtomicIncU64(&pEdge->cHits);
335
336	pbCovCur += cbCovOff;
337	cEdgesLeft--;
338	}
339
340	rc = RTSemRWReleaseRead(pThis->hSemRwEdges); AssertRC(rc);
341	}
342
343	return rc;
344	}
345
346
347	/**
348	* Destorys the given fuzzer target recorder freeing all allocated resources.
349	*
350	* @returns nothing.
351	* @param pThis The fuzzer target recorder instance.
352	*/
353	static void rtFuzzTgtRecDestroy(PRTFUZZTGTRECINT pThis)
354	{
355	RT_NOREF(pThis);
356	}
357
358
359	/**
360	* Destroys the given fuzzer target state freeing all allocated resources.
361	*
362	* @returns nothing.
363	* @param pThis The fuzzed target state instance.
364	*/
365	static void rtFuzzTgtStateDestroy(PRTFUZZTGTSTATEINT pThis)
366	{
367	pThis->u32Magic = ~(uint32_t)0; /** @todo Dead magic */
368	rtFuzzTgtStdOutErrBufFree(&pThis->StdOutBuf);
369	rtFuzzTgtStdOutErrBufFree(&pThis->StdErrBuf);
370	RTMemFree(pThis);
371	}
372
373
374	/**
375	* Compares two given target states, checking whether they match.
376	*
377	* @returns Flag whether the states are identical.
378	* @param pThis Target state 1.
379	* @param pThat Target state 2.
380	*/
381	static bool rtFuzzTgtStateDoMatch(PRTFUZZTGTSTATEINT pThis, PRTFUZZTGTSTATEINT pThat)
382	{
383	PRTFUZZTGTRECINT pTgtRec = pThis->pTgtRec;
384	Assert(pTgtRec == pThat->pTgtRec);
385
386	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDOUT)
387	&& ( pThis->StdOutBuf.cbBuf != pThat->StdOutBuf.cbBuf
388	\|\| ( pThis->StdOutBuf.cbBuf > 0
389	&& memcmp(pThis->StdOutBuf.pbBase, pThat->StdOutBuf.pbBase, pThis->StdOutBuf.cbBuf))))
390	return false;
391
392	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDERR)
393	&& ( pThis->StdErrBuf.cbBuf != pThat->StdErrBuf.cbBuf
394	\|\| ( pThis->StdErrBuf.cbBuf > 0
395	&& memcmp(pThis->StdErrBuf.pbBase, pThat->StdErrBuf.pbBase, pThis->StdErrBuf.cbBuf))))
396	return false;
397
398	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_PROCSTATUS)
399	&& memcmp(&pThis->ProcSts, &pThat->ProcSts, sizeof(RTPROCSTATUS)))
400	return false;
401
402	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_SANCOV)
403	&& ( pThis->cbCovReport != pThat->cbCovReport
404	\|\| ( pThis->cbCovReport > 0
405	&& memcmp(pThis->pvCovReport, pThat->pvCovReport, pThis->cbCovReport))))
406	return false;
407
408	return true;
409	}
410
411
412	RTDECL(int) RTFuzzTgtRecorderCreate(PRTFUZZTGTREC phFuzzTgtRec, uint32_t fRecFlags)
413	{
414	AssertPtrReturn(phFuzzTgtRec, VERR_INVALID_POINTER);
415	AssertReturn(!(fRecFlags & ~RTFUZZTGT_REC_STATE_F_VALID), VERR_INVALID_PARAMETER);
416
417	int rc;
418	PRTFUZZTGTRECINT pThis = (PRTFUZZTGTRECINT)RTMemAllocZ(sizeof(*pThis));
419	if (RT_LIKELY(pThis))
420	{
421	pThis->u32Magic = 0; /** @todo */
422	pThis->cRefs = 1;
423	pThis->TreeStates = NULL;
424	pThis->TreeEdges = NULL;
425	pThis->cbCovOff = 0;
426	pThis->fRecFlags = fRecFlags;
427
428	rc = RTSemRWCreate(&pThis->hSemRwStates);
429	if (RT_SUCCESS(rc))
430	{
431	rc = RTSemRWCreate(&pThis->hSemRwEdges);
432	if (RT_SUCCESS(rc))
433	{
434	*phFuzzTgtRec = pThis;
435	return VINF_SUCCESS;
436	}
437
438	RTSemRWDestroy(pThis->hSemRwStates);
439	}
440
441	RTMemFree(pThis);
442	}
443	else
444	rc = VERR_NO_MEMORY;
445
446	return rc;
447	}
448
449
450	RTDECL(uint32_t) RTFuzzTgtRecorderRetain(RTFUZZTGTREC hFuzzTgtRec)
451	{
452	PRTFUZZTGTRECINT pThis = hFuzzTgtRec;
453
454	AssertPtrReturn(pThis, UINT32_MAX);
455
456	uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
457	AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pThis));
458	return cRefs;
459	}
460
461
462	RTDECL(uint32_t) RTFuzzTgtRecorderRelease(RTFUZZTGTREC hFuzzTgtRec)
463	{
464	PRTFUZZTGTRECINT pThis = hFuzzTgtRec;
465	if (pThis == NIL_RTFUZZTGTREC)
466	return 0;
467	AssertPtrReturn(pThis, UINT32_MAX);
468
469	uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
470	AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pThis));
471	if (cRefs == 0)
472	rtFuzzTgtRecDestroy(pThis);
473	return cRefs;
474	}
475
476
477	RTDECL(int) RTFuzzTgtRecorderCreateNewState(RTFUZZTGTREC hFuzzTgtRec, PRTFUZZTGTSTATE phFuzzTgtState)
478	{
479	PRTFUZZTGTRECINT pThis = hFuzzTgtRec;
480	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
481	AssertPtrReturn(phFuzzTgtState, VERR_INVALID_POINTER);
482
483	int rc = VINF_SUCCESS;
484	PRTFUZZTGTSTATEINT pState = (PRTFUZZTGTSTATEINT)RTMemAllocZ(sizeof(*pState));
485	if (RT_LIKELY(pState))
486	{
487	pState->u32Magic = 0; /** @todo */
488	pState->cRefs = 1;
489	pState->pTgtRec = pThis;
490	pState->fFinalized = false;
491	rtFuzzTgtStdOutErrBufInit(&pState->StdOutBuf);
492	rtFuzzTgtStdOutErrBufInit(&pState->StdErrBuf);
493	*phFuzzTgtState = pState;
494	}
495	else
496	rc = VERR_NO_MEMORY;
497
498	return rc;
499	}
500
501
502	RTDECL(uint32_t) RTFuzzTgtStateRetain(RTFUZZTGTSTATE hFuzzTgtState)
503	{
504	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
505
506	AssertPtrReturn(pThis, UINT32_MAX);
507
508	uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
509	AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pThis));
510	return cRefs;
511	}
512
513
514	RTDECL(uint32_t) RTFuzzTgtStateRelease(RTFUZZTGTSTATE hFuzzTgtState)
515	{
516	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
517	if (pThis == NIL_RTFUZZTGTSTATE)
518	return 0;
519	AssertPtrReturn(pThis, UINT32_MAX);
520
521	uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
522	AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pThis));
523	if (cRefs == 0 && !pThis->fInRecSet)
524	rtFuzzTgtStateDestroy(pThis);
525	return cRefs;
526	}
527
528
529	RTDECL(int) RTFuzzTgtStateReset(RTFUZZTGTSTATE hFuzzTgtState)
530	{
531	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
532	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
533
534	/* Clear the buffers. */
535	pThis->StdOutBuf.cbBuf = 0;
536	pThis->StdErrBuf.cbBuf = 0;
537	RT_ZERO(pThis->ProcSts);
538	if (pThis->pvCovReport)
539	RTMemFree(pThis->pvCovReport);
540	pThis->pvCovReport = NULL;
541	pThis->fFinalized = false;
542	return VINF_SUCCESS;
543	}
544
545
546	RTDECL(int) RTFuzzTgtStateFinalize(RTFUZZTGTSTATE hFuzzTgtState)
547	{
548	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
549	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
550
551	/* Create the checksum. */
552	PRTFUZZTGTRECINT pTgtRec = pThis->pTgtRec;
553	uint64_t uChkSum = RTCrc64Start();
554	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDOUT)
555	&& pThis->StdOutBuf.cbBuf)
556	uChkSum = RTCrc64Process(uChkSum, pThis->StdOutBuf.pbBase, pThis->StdOutBuf.cbBuf);
557	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDERR)
558	&& pThis->StdErrBuf.cbBuf)
559	uChkSum = RTCrc64Process(uChkSum, pThis->StdErrBuf.pbBase, pThis->StdErrBuf.cbBuf);
560	if (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_PROCSTATUS)
561	uChkSum = RTCrc64Process(uChkSum, &pThis->ProcSts, sizeof(RTPROCSTATUS));
562	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_SANCOV)
563	&& pThis->pvCovReport)
564	uChkSum = RTCrc64Process(uChkSum, pThis->pvCovReport, pThis->cbCovReport);
565
566	pThis->uChkSum = RTCrc64Finish(uChkSum);
567	pThis->fFinalized = true;
568	return VINF_SUCCESS;
569	}
570
571
572	RTDECL(int) RTFuzzTgtStateAddToRecorder(RTFUZZTGTSTATE hFuzzTgtState)
573	{
574	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
575	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
576
577	if (!pThis->fFinalized)
578	{
579	int rc = RTFuzzTgtStateFinalize(pThis);
580	if (RT_FAILURE(rc))
581	return rc;
582	}
583
584	PRTFUZZTGTRECINT pTgtRec = pThis->pTgtRec;
585
586	/* Try to find a node matching the stdout and sterr sizes first. */
587	int rc = RTSemRWRequestRead(pTgtRec->hSemRwStates, RT_INDEFINITE_WAIT); AssertRC(rc);
588	PRTFUZZTGTRECNODE pNode = (PRTFUZZTGTRECNODE)RTAvlU64Get(&pTgtRec->TreeStates, pThis->uChkSum);
589	if (pNode)
590	{
591	/* Traverse the states and check if any matches the stdout and stderr buffers exactly. */
592	PRTFUZZTGTSTATEINT pIt;
593	bool fMatchFound = false;
594	RTListForEach(&pNode->LstStates, pIt, RTFUZZTGTSTATEINT, NdStates)
595	{
596	if (rtFuzzTgtStateDoMatch(pThis, pIt))
597	{
598	fMatchFound = true;
599	break;
600	}
601	}
602
603	rc = RTSemRWReleaseRead(pTgtRec->hSemRwStates); AssertRC(rc);
604	if (!fMatchFound)
605	{
606	rc = RTSemRWRequestWrite(pTgtRec->hSemRwStates, RT_INDEFINITE_WAIT); AssertRC(rc);
607	RTListAppend(&pNode->LstStates, &pThis->NdStates);
608	rc = RTSemRWReleaseWrite(pTgtRec->hSemRwStates); AssertRC(rc);
609	pThis->fInRecSet = true;
610	}
611	else
612	rc = VERR_ALREADY_EXISTS;
613	}
614	else
615	{
616	rc = RTSemRWReleaseRead(pTgtRec->hSemRwStates); AssertRC(rc);
617
618	/* No node found, create new one and insert in to the tree right away. */
619	pNode = (PRTFUZZTGTRECNODE)RTMemAllocZ(sizeof(*pNode));
620	if (RT_LIKELY(pNode))
621	{
622	pNode->Core.Key = pThis->uChkSum;
623	RTListInit(&pNode->LstStates);
624	RTListAppend(&pNode->LstStates, &pThis->NdStates);
625	rc = RTSemRWRequestWrite(pTgtRec->hSemRwStates, RT_INDEFINITE_WAIT); AssertRC(rc);
626	bool fIns = RTAvlU64Insert(&pTgtRec->TreeStates, &pNode->Core);
627	if (!fIns)
628	{
629	/* Someone raced us, get the new node and append there. */
630	RTMemFree(pNode);
631	pNode = (PRTFUZZTGTRECNODE)RTAvlU64Get(&pTgtRec->TreeStates, pThis->uChkSum);
632	AssertPtr(pNode);
633	RTListAppend(&pNode->LstStates, &pThis->NdStates);
634	}
635	rc = RTSemRWReleaseWrite(pTgtRec->hSemRwStates); AssertRC(rc);
636	pThis->fInRecSet = true;
637	}
638	else
639	rc = VERR_NO_MEMORY;
640	}
641
642	if ( RT_SUCCESS(rc)
643	&& pThis->fInRecSet)
644	rc = rtFuzzTgtRecScanStateForNewEdges(pTgtRec, pThis);
645
646	return rc;
647	}
648
649
650	RTDECL(int) RTFuzzTgtStateAppendStdoutFromBuf(RTFUZZTGTSTATE hFuzzTgtState, const void *pvStdOut, size_t cbStdOut)
651	{
652	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
653	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
654	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
655
656	RT_NOREF(pvStdOut, cbStdOut);
657	return VERR_NOT_IMPLEMENTED;
658	}
659
660
661	RTDECL(int) RTFuzzTgtStateAppendStderrFromBuf(RTFUZZTGTSTATE hFuzzTgtState, const void *pvStdErr, size_t cbStdErr)
662	{
663	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
664	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
665	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
666
667	RT_NOREF(pvStdErr, cbStdErr);
668	return VERR_NOT_IMPLEMENTED;
669	}
670
671
672	RTDECL(int) RTFuzzTgtStateAppendStdoutFromPipe(RTFUZZTGTSTATE hFuzzTgtState, RTPIPE hPipe)
673	{
674	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
675	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
676	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
677
678	return rtFuzzTgtStdOutErrBufFillFromPipe(&pThis->StdOutBuf, hPipe);
679	}
680
681
682	RTDECL(int) RTFuzzTgtStateAppendStderrFromPipe(RTFUZZTGTSTATE hFuzzTgtState, RTPIPE hPipe)
683	{
684	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
685	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
686	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
687
688	return rtFuzzTgtStdOutErrBufFillFromPipe(&pThis->StdErrBuf, hPipe);
689	}
690
691
692	RTDECL(int) RTFuzzTgtStateAddSanCovReportFromFile(RTFUZZTGTSTATE hFuzzTgtState, const char *pszFilename)
693	{
694	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
695	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
696	AssertPtrReturn(pszFilename, VERR_INVALID_POINTER);
697	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
698
699	uint8_t *pbSanCov = NULL;
700	size_t cbSanCov = 0;
701	int rc = RTFileReadAll(pszFilename, (void **)&pbSanCov, &cbSanCov);
702	if (RT_SUCCESS(rc))
703	{
704	/* Check for the magic identifying whether the offsets are 32bit or 64bit. */
705	if ( cbSanCov >= sizeof(uint64_t)
706	&& ( (uint64_t )pbSanCov == SANCOV_MAGIC_64
707	\|\| (uint64_t )pbSanCov == SANCOV_MAGIC_32))
708	{
709	uint32_t cbCovOff = sizeof(uint32_t);
710	if ((uint64_t )pbSanCov == SANCOV_MAGIC_64)
711	cbCovOff = sizeof(uint64_t);
712
713	uint32_t cbCovDet = ASMAtomicReadU32(&pThis->pTgtRec->cbCovOff);
714	if (!cbCovDet)
715	{
716	/* Set the detected offset width. */
717	if (!ASMAtomicCmpXchgU32(&pThis->pTgtRec->cbCovOff, cbCovOff, 0))
718	{
719	/* Someone raced us, check again. */
720	cbCovDet = ASMAtomicReadU32(&pThis->pTgtRec->cbCovOff);
721	Assert(cbCovDet != 0);
722	}
723	else
724	cbCovDet = cbCovOff;
725	}
726
727	if (cbCovDet == cbCovOff)
728	{
729	/*
730	* Just copy the offsets into the state for now. Now further analysis
731	* is happening right now, just checking whether the content changed for
732	* the states.to spot newly discovered edges.
733	*/
734	pThis->cbCovReport = cbSanCov - sizeof(uint64_t);
735	pThis->pvCovReport = RTMemDup(pbSanCov + sizeof(uint64_t), pThis->cbCovReport);
736	if (!pThis->pvCovReport)
737	{
738	pThis->cbCovReport = 0;
739	rc = VERR_NO_MEMORY;
740	}
741	}
742	else
743	rc = VERR_INVALID_STATE; /* Mixing 32bit and 64bit offsets shouldn't happen, is not supported. */
744	}
745	else
746	rc = VERR_INVALID_STATE;
747	RTFileReadAllFree(pbSanCov, cbSanCov);
748	}
749	return rc;
750	}
751
752
753	RTDECL(int) RTFuzzTgtStateAddProcSts(RTFUZZTGTSTATE hFuzzTgtState, PCRTPROCSTATUS pProcSts)
754	{
755	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
756	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
757	AssertPtrReturn(pProcSts, VERR_INVALID_POINTER);
758	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
759
760	pThis->ProcSts = *pProcSts;
761	return VINF_SUCCESS;
762	}
763
764
765	RTDECL(int) RTFuzzTgtStateDumpToDir(RTFUZZTGTSTATE hFuzzTgtState, const char *pszDirPath)
766	{
767	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
768	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
769	AssertPtrReturn(pszDirPath, VERR_INVALID_POINTER);
770	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
771
772	int rc = VINF_SUCCESS;
773	char szPath[RTPATH_MAX];
774	if (pThis->StdOutBuf.cbBuf)
775	{
776	rc = RTPathJoin(szPath, sizeof(szPath), pszDirPath, "stdout"); AssertRC(rc);
777	if (RT_SUCCESS(rc))
778	rc = rtFuzzTgtStateStdOutErrBufWriteToFile(&pThis->StdOutBuf, &szPath[0]);
779	}
780
781	if ( RT_SUCCESS(rc)
782	&& pThis->StdErrBuf.cbBuf)
783	{
784	rc = RTPathJoin(szPath, sizeof(szPath), pszDirPath, "stderr"); AssertRC(rc);
785	if (RT_SUCCESS(rc))
786	rc = rtFuzzTgtStateStdOutErrBufWriteToFile(&pThis->StdErrBuf, &szPath[0]);
787	}
788
789	return rc;
790	}
791

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/common/fuzz/fuzz-target-recorder.cpp@ 80346

Download in other formats: