Changeset 77693 in vbox for trunk/include/iprt

Timestamp:

Mar 13, 2019 9:24:29 PM (6 years ago)

Author:

vboxsync

Message:

Runtime/fuzz: Some more statistics, add possibility to configure the environment of the target process through the job config, add possibility to read SanitizerCoverage generated reports to scan for changes in executed paths for inputs to evaluate which mutations are interesting for further use

Location:

trunk/include/iprt

Files:

• fuzz.h (modified) (3 diffs)
• mangling.h (modified) (2 diffs)

trunk/include/iprt/fuzz.h

@@ -116 +116 @@
 
 
+/** @name RTFUZZOBS_SANITIZER_F_XXX - Flags for RTFuzzObsSetTestBinarySanitizers().
+ * @{ */
+/** ASAN is compiled and enabled (observer needs to configure to abort on error to catch memory errors). */
+#define RTFUZZOBS_SANITIZER_F_ASAN                 UINT32_C(0x00000001)
+/** A converage sanitizer is compiled in which can be used to produce coverage reports aiding in the
+ * fuzzing process. */
+#define RTFUZZOBS_SANITIZER_F_SANCOV               UINT32_C(0x00000002)
+/** @} */
+
+
 /**
  * Fuzzing context state export callback.
@@ -537 +547 @@
  */
 RTDECL(int) RTFuzzTgtStateAppendStderrFromPipe(RTFUZZTGTSTATE hFuzzTgtState, RTPIPE hPipe);
+
+/**
+ * Adds the SanCov coverage information from the given file to the given target state.
+ *
+ * @returns IPRT status code.
+ * @param   hFuzzTgtState       The fuzzed target state handle.
+ * @param   pszFilename         Filename of the coverage report.
+ */
+RTDECL(int) RTFuzzTgtStateAddSanCovReportFromFile(RTFUZZTGTSTATE hFuzzTgtState, const char *pszFilename);
 
 
@@ -658 +677 @@
 
 /**
+ * Sets an environment block to run the binary in.
+ *
+ * @returns IPRT status code.
+ * @param   hFuzzObs            The fuzzing observer handle.
+ * @param   hEnv                The environment block to set for the test binary.
+ *                              Use RTENV_DEFAULT for the default process environment or
+ *                              NULL for an empty environment.
+ *
+ * @note Upon successful return of this function the observer has taken ownership over the
+ *       environment block and can alter it in unexpected ways. It also destroys the environment
+ *       block when the observer gets destroyed. So don't touch the environment block after
+ *       calling this function.
+ */
+RTDECL(int) RTFuzzObsSetTestBinaryEnv(RTFUZZOBS hFuzzObs, RTENV hEnv);
+
+/**
+ * Makes the observer aware of any configured sanitizers for the test binary.
+ *
+ * @returns IPRT status code.
+ * @param   hFuzzObs            The fuzzing observer handle.
+ * @param   fSanitizers         Bitmask of compiled and enabled sanitiziers in the
+ *                              target binary.
+ */
+RTDECL(int) RTFuzzObsSetTestBinarySanitizers(RTFUZZOBS hFuzzObs, uint32_t fSanitizers);
+
+/**
+ * Sets maximum timeout until a process is considered hung and killed.
+ *
+ * @returns IPRT status code.
+ * @param   hFuzzObs            The fuzzing observer handle.
+ * @param   papszArgs           Pointer to the array of arguments.
+ * @param   cArgs               Number of arguments.
+ */
+RTDECL(int) RTFuzzObsSetTestBinaryTimeout(RTFUZZOBS hFuzzObs, RTMSINTERVAL msTimeoutMax);
+
+/**
  * Starts fuzzing the set binary.
  *

trunk/include/iprt/mangling.h

@@ -1066 +1066 @@
 # define RTFuzzObsSetTestBinary                         RT_MANGLER(RTFuzzObsSetTestBinary)
 # define RTFuzzObsSetTestBinaryArgs                     RT_MANGLER(RTFuzzObsSetTestBinaryArgs)
+# define RTFuzzObsSetTestBinaryEnv                      RT_MANGLER(RTFuzzObsSetTestBinaryEnv)
+# define RTFuzzObsSetTestBinarySanitizers               RT_MANGLER(RTFuzzObsSetTestBinarySanitizers)
+# define RTFuzzObsSetTestBinaryTimeout                  RT_MANGLER(RTFuzzObsSetTestBinaryTimeout)
 # define RTFuzzObsSetTmpDirectory                       RT_MANGLER(RTFuzzObsSetTmpDirectory)
 # define RTFuzzTgtRecorderCreate                        RT_MANGLER(RTFuzzTgtRecorderCreate)
@@ -1071 +1074 @@
 # define RTFuzzTgtRecorderRelease                       RT_MANGLER(RTFuzzTgtRecorderRelease)
 # define RTFuzzTgtRecorderRetain                        RT_MANGLER(RTFuzzTgtRecorderRetain)
+# define RTFuzzTgtStateAddSanCovReportFromFile          RT_MANGLER(RTFuzzTgtStateAddSanCovReportFromFile)
 # define RTFuzzTgtStateAddToRecorder                    RT_MANGLER(RTFuzzTgtStateAddToRecorder)
 # define RTFuzzTgtStateAppendStderrFromBuf              RT_MANGLER(RTFuzzTgtStateAppendStderrFromBuf)