|
150
|
1 # Tests the data flow tracer.
|
|
|
2 REQUIRES: linux, x86_64
|
|
|
3
|
|
223
|
4 # Disabling due to dfs$ prefix to .dfsan suffix change in DFSan.
|
|
|
5 # TODO(kcc): re-enable.
|
|
|
6 RUN: false
|
|
|
7 XFAIL: *
|
|
|
8
|
|
150
|
9 # Build the tracer and the test.
|
|
223
|
10 DISABLED: %no_fuzzer_cpp_compiler -c -fno-sanitize=all -fsanitize=dataflow %S/../../lib/fuzzer/dataflow/DataFlow.cpp -o %t-DataFlow.o
|
|
|
11 DISABLED: %no_fuzzer_cpp_compiler -c -fno-sanitize=all -fPIC %S/../../lib/fuzzer/dataflow/DataFlowCallbacks.cpp -o %t-DataFlowCallbacks.o
|
|
|
12 DISABLED: %no_fuzzer_cpp_compiler -fno-sanitize=all -fsanitize=dataflow -fsanitize-coverage=trace-pc-guard,pc-table,bb,trace-cmp %S/OnlySomeBytesTest.cpp %t-DataFlow*.o -o %t-DFT
|
|
|
13 DISABLED: %cpp_compiler %S/OnlySomeBytesTest.cpp -o %t-Fuzz
|
|
150
|
14
|
|
|
15 # Prepare the inputs.
|
|
223
|
16 DISABLED: rm -rf %t/*
|
|
|
17 DISABLED: mkdir -p %t/IN
|
|
|
18 DISABLED: echo -n 0123456789012345678901234567890123456789012345678901234567891234 > %t/IN/6
|
|
|
19 DISABLED: cat %t/IN/6 %t/IN/6 %t/IN/6 %t/IN/6 > %t/IN/8
|
|
|
20 DISABLED: cat %t/IN/8 %t/IN/8 %t/IN/8 %t/IN/8 > %t/IN/10
|
|
|
21 DISABLED: cat %t/IN/10 %t/IN/10 %t/IN/10 %t/IN/10 > %t/IN/12
|
|
150
|
22 # %t/IN/12 is 4096 bytes-long.
|
|
|
23
|
|
223
|
24 DISABLED: %t-Fuzz -focus_function='fB(unsigned char const*)' -runs=0 %t/IN 2>&1 | FileCheck %s --check-prefix=FOCUS_fB
|
|
150
|
25 FOCUS_fB: Focus function is set to 'fB(unsigned char const*)'
|
|
|
26
|
|
223
|
27 DISABLED: %t-Fuzz -focus_function=f0 -runs=0 %t/IN 2>&1 | FileCheck %s --check-prefix=NO_FOCUSED_INPUT
|
|
150
|
28 NO_FOCUSED_INPUT: Focus function is set to 'f0'
|
|
|
29 NO_FOCUSED_INPUT: INFO: 0/2 inputs touch the focus function
|
|
|
30
|
|
223
|
31 DISABLED: (echo -n ABC; cat %t/IN/12) > %t/IN/ABC
|
|
|
32 DISABLED: %t-Fuzz -focus_function=f0 -runs=0 %t/IN 2>&1 | FileCheck %s --check-prefix=ONE_FOCUSED_INPUT
|
|
150
|
33 ONE_FOCUSED_INPUT: INFO: 1/3 inputs touch the focus function
|
|
|
34
|
|
223
|
35 DISABLED: rm -rf %t/IN_DFT
|
|
|
36 DISABLED: %t-Fuzz -collect_data_flow=%t-DFT %t/IN -data_flow_trace=%t/IN_DFT > /dev/null 2>&1
|
|
150
|
37
|
|
|
38 # Repeat twice to make sure that the inputs with DFT are not removed from the corpus.
|
|
223
|
39 DISABLED: %t-Fuzz -focus_function=f0 -data_flow_trace=%t/IN_DFT -runs=100 %t/IN 2>&1 | FileCheck %s --check-prefix=HAVE_DFT
|
|
|
40 DISABLED: %t-Fuzz -focus_function=f0 -data_flow_trace=%t/IN_DFT -runs=100 %t/IN 2>&1 | FileCheck %s --check-prefix=HAVE_DFT
|
|
150
|
41 HAVE_DFT: INFO: 1/{{.*}} inputs have the Data Flow Trace
|
|
|
42
|
|
|
43 # Collect DFT, then use it.
|
|
223
|
44 DISABLED: rm -rf %t/C %t/C1 && mkdir %t/C %t/C1 && cp %t/IN/* %t/C
|
|
|
45 DISABLED: rm -rf %t/C_DFT && %t-Fuzz -collect_data_flow=%t-DFT %t/C -data_flow_trace=%t/C_DFT > /dev/null 2>&1
|
|
|
46 DISABLED: not %t-Fuzz -focus_function=f0 -data_flow_trace=%t/C_DFT -seed=1 -runs=1000000 -use_value_profile=1 %t/C1 %t/C 2> %t/log
|
|
|
47 DISABLED: grep BINGO %t/log
|
|
150
|
48
|
|
|
49 # Test -focus_function=auto: run 100 times and verify that
|
|
|
50 # * 'f0' is the most frequent focus function.
|
|
|
51 # * the second most frequent is one of fA/fB/fC in a de-mangled form.
|
|
223
|
52 DISABLED: %t-Fuzz -focus_function=auto -data_flow_trace=%t/C_DFT -runs=0 %t/C -jobs=100 2>&1 | grep AUTOFOCUS | sort | uniq -c | sort -g -r | head -n 2 | FileCheck %s --check-prefix=AUTOFOCUS
|
|
150
|
53 AUTOFOCUS: INFO: AUTOFOCUS: {{.*}} f0
|
|
|
54 AUTOFOCUS: INFO: AUTOFOCUS: {{.*f[ABC]}}(unsigned char const*)
|
|
|
55
|
|
|
56 # Actually execute 50 fuzzing processes with a small number of runs, to test -focus_function=auto for real.
|
|
|
57 # We can not test data_flow_trace=auto in just a single run, because it may choose to focus on a wrong function.
|
|
223
|
58 DISABLED: not %t-Fuzz -focus_function=auto -data_flow_trace=%t/C_DFT %t/C -jobs=50 -runs=200000 -use_value_profile=1 2> %t/log
|
|
|
59 DISABLED: grep BINGO %t/log
|
