Changeset 77564 in vbox for trunk/src/VBox/Runtime/common/fuzz/fuzzclientcmd.cpp

Timestamp:

Mar 5, 2019 10:30:33 AM (6 years ago)

Author:

vboxsync

Message:

Runtime/fuzz: Add libFuzzer compatible wrapper to be able to evaluate our fuzzer against others

File:

• trunk/src/VBox/Runtime/common/fuzz/fuzzclientcmd.cpp (modified) (11 diffs)

trunk/src/VBox/Runtime/common/fuzz/fuzzclientcmd.cpp

@@ -35 +35 @@
 #include <iprt/buildconfig.h>
 #include <iprt/errcore.h>
+#include <iprt/file.h>
 #include <iprt/getopt.h>
+#include <iprt/ldr.h>
 #include <iprt/mem.h>
 #include <iprt/message.h>
@@ -44 +46 @@
 
 
+
+typedef DECLCALLBACK(int) FNLLVMFUZZERTESTONEINPUT(const uint8_t *pbData, size_t cbData);
+typedef FNLLVMFUZZERTESTONEINPUT *PFNLLVMFUZZERTESTONEINPUT;
+
+
 /**
  * Fuzzing client command state.
@@ -50 +57 @@
 {
     /** Our own fuzzing context containing all the data. */
-    RTFUZZCTX               hFuzzCtx;
+    RTFUZZCTX                 hFuzzCtx;
     /** Consumption callback. */
-    PFNFUZZCLIENTCONSUME    pfnConsume;
+    PFNFUZZCLIENTCONSUME      pfnConsume;
     /** Opaque user data to pass to the consumption callback. */
-    void                    *pvUser;
+    void                      *pvUser;
+    /** The LLVM libFuzzer compatible entry point if configured */
+    PFNLLVMFUZZERTESTONEINPUT pfnLlvmFuzzerTestOneInput;
+    /** The selected input channel. */
+    RTFUZZOBSINPUTCHAN        enmInputChan;
     /** Standard input VFS handle. */
-    RTVFSIOSTREAM           hVfsStdIn;
+    RTVFSIOSTREAM             hVfsStdIn;
     /** Standard output VFS handle. */
-    RTVFSIOSTREAM           hVfsStdOut;
+    RTVFSIOSTREAM             hVfsStdOut;
 } RTFUZZCMDCLIENT;
 /** Pointer to a fuzzing client command state. */
 typedef RTFUZZCMDCLIENT *PRTFUZZCMDCLIENT;
+
+
+
+/**
+ * Runs the appropriate consumption callback with the provided data.
+ *
+ * @returns Status code, 0 for success.
+ * @param   pThis               The fuzzing client command state.
+ * @param   pvData              The data to consume.
+ * @param   cbData              Size of the data in bytes.
+ */
+static int rtFuzzCmdClientConsume(PRTFUZZCMDCLIENT pThis, const void *pvData, size_t cbData)
+{
+    if (pThis->pfnLlvmFuzzerTestOneInput)
+        return pThis->pfnLlvmFuzzerTestOneInput((const uint8_t *)pvData, cbData);
+    else
+        return pThis->pfnConsume(pvData, cbData, pThis->pvUser);
+}
 
 
@@ -89 +118 @@
             {
                 char bResp = '.';
-                int rc2 = pThis->pfnConsume(pv, cb, pThis->pvUser);
+                int rc2 = rtFuzzCmdClientConsume(pThis, pv, cb);
                 if (RT_SUCCESS(rc2))
                 {
@@ -153 +182 @@
 
 
+/**
+ * Run a single iteration of the fuzzing client and return.
+ *
+ * @returns Process exit status.
+ * @param   pThis               The fuzzing client command state.
+ */
+static RTEXITCODE rtFuzzCmdClientRunFile(PRTFUZZCMDCLIENT pThis, const char *pszFilename)
+{
+    void *pv = NULL;
+    size_t cbFile = 0;
+    int rc = RTFileReadAll(pszFilename, &pv, &cbFile);
+    if (RT_SUCCESS(rc))
+    {
+        rtFuzzCmdClientConsume(pThis, pv, cbFile);
+        RTFileReadAllFree(pv, cbFile);
+        return RTEXITCODE_SUCCESS;
+    }
+
+    return RTEXITCODE_FAILURE;
+}
+
+
 RTR3DECL(RTEXITCODE) RTFuzzCmdFuzzingClient(unsigned cArgs, char **papszArgs, PFNFUZZCLIENTCONSUME pfnConsume, void *pvUser)
 {
@@ -162 +213 @@
         { "--help",                            'h', RTGETOPT_REQ_NOTHING },
         { "--version",                         'V', RTGETOPT_REQ_NOTHING },
+        { "--llvm-input",                      'l', RTGETOPT_REQ_STRING  },
+        { "--file",                            'f', RTGETOPT_REQ_STRING  },
     };
 
@@ -172 +225 @@
         /* Option variables:  */
         RTFUZZCMDCLIENT This;
-
-        This.pfnConsume = pfnConsume;
-        This.pvUser     = pvUser;
+        RTLDRMOD hLlvmMod = NIL_RTLDRMOD;
+        const char *pszFilename = NULL;
+
+        This.pfnConsume   = pfnConsume;
+        This.pvUser       = pvUser;
+        This.enmInputChan = RTFUZZOBSINPUTCHAN_FUZZING_AWARE_CLIENT;
 
         /* Argument parsing loop. */
         bool fContinue = true;
+        bool fExit = false;
         do
         {
@@ -188 +245 @@
                     break;
 
+                case 'f':
+                {
+                    pszFilename = ValueUnion.psz;
+                    This.enmInputChan = RTFUZZOBSINPUTCHAN_FILE;
+                    break;
+                }
+
+                case 'l':
+                {
+                    /*
+                     * Load the indicated library and try to resolve LLVMFuzzerTestOneInput,
+                     * which will act as the input callback.
+                     */
+                    rc = RTLdrLoad(ValueUnion.psz, &hLlvmMod);
+                    if (RT_SUCCESS(rc))
+                    {
+                        rc = RTLdrGetSymbol(hLlvmMod, "LLVMFuzzerTestOneInput", (void **)&This.pfnLlvmFuzzerTestOneInput);
+                        if (RT_FAILURE(rc))
+                            rcExit = RTMsgErrorExit(RTEXITCODE_FAILURE, "Failed to query '%s' from '%s': %Rrc",
+                                                    "LLVMFuzzerTestOneInput",
+                                                    ValueUnion.psz,
+                                                    rc);
+                    }
+                    break;
+                }
+
                 case 'h':
                     RTPrintf("Usage: to be written\nOption dump:\n");
@@ -193 +276 @@
                         RTPrintf(" -%c,%s\n", s_aOptions[i].iShort, s_aOptions[i].pszLong);
                     fContinue = false;
+                    fExit = true;
                     break;
 
@@ -198 +282 @@
                     RTPrintf("%sr%d\n", RTBldCfgVersion(), RTBldCfgRevision());
                     fContinue = false;
+                    fExit = true;
                     break;
 
@@ -207 +292 @@
         } while (fContinue);
 
-        if (rcExit == RTEXITCODE_SUCCESS)
-            rcExit = rtFuzzCmdClientRun(&This);
+        if (   rcExit == RTEXITCODE_SUCCESS
+            && !fExit)
+        {
+            switch (This.enmInputChan)
+            {
+                case RTFUZZOBSINPUTCHAN_FUZZING_AWARE_CLIENT:
+                    rcExit = rtFuzzCmdClientRun(&This);
+                    break;
+                case RTFUZZOBSINPUTCHAN_FILE:
+                    rcExit = rtFuzzCmdClientRunFile(&This, pszFilename);
+                    break;
+                default:
+                    rcExit = RTMsgErrorExit(RTEXITCODE_SYNTAX, "Input channel unknown/not implemented yet");
+            }
+        }
+
+        if (hLlvmMod != NIL_RTLDRMOD)
+            RTLdrClose(hLlvmMod);
     }
     else