VirtualBox

source: vbox/trunk/src/VBox/Runtime/common/fuzz/fuzz-target-recorder.cpp

Last change on this file was 99739, checked in by vboxsync, 13 months ago

*: doxygen corrections (mostly about removing @returns from functions returning void).
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 25.6 KB
Line 
1/* $Id: fuzz-target-recorder.cpp 99739 2023-05-11 01:01:08Z vboxsync $ */
2/** @file
3 * IPRT - Fuzzing framework API, target state recorder.
4 */
5
6/*
7 * Copyright (C) 2019-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * The contents of this file may alternatively be used under the terms
26 * of the Common Development and Distribution License Version 1.0
27 * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28 * in the VirtualBox distribution, in which case the provisions of the
29 * CDDL are applicable instead of those of the GPL.
30 *
31 * You may elect to license modified versions of this file under the
32 * terms and conditions of either the GPL or the CDDL or both.
33 *
34 * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35 */
36
37
38/*********************************************************************************************************************************
39* Header Files *
40*********************************************************************************************************************************/
41#include <iprt/fuzz.h>
42#include "internal/iprt.h"
43
44#include <iprt/asm.h>
45#include <iprt/assert.h>
46#include <iprt/avl.h>
47#include <iprt/crc.h>
48#include <iprt/ctype.h>
49#include <iprt/err.h>
50#include <iprt/file.h>
51#include <iprt/list.h>
52#include <iprt/mem.h>
53#include <iprt/path.h>
54#include <iprt/pipe.h>
55#include <iprt/process.h>
56#include <iprt/semaphore.h>
57#include <iprt/string.h>
58
59
60
61/*********************************************************************************************************************************
62* Structures and Typedefs *
63*********************************************************************************************************************************/
64/** Pointer to the internal fuzzed target recorder state. */
65typedef struct RTFUZZTGTRECINT *PRTFUZZTGTRECINT;
66
67
68/**
69 * Stdout/Stderr buffer.
70 */
71typedef struct RTFUZZTGTSTDOUTERRBUF
72{
73 /** Current amount buffered. */
74 size_t cbBuf;
75 /** Maxmium amount to buffer. */
76 size_t cbBufMax;
77 /** Base pointer to the data buffer. */
78 uint8_t *pbBase;
79} RTFUZZTGTSTDOUTERRBUF;
80/** Pointer to a stdout/stderr buffer. */
81typedef RTFUZZTGTSTDOUTERRBUF *PRTFUZZTGTSTDOUTERRBUF;
82
83
84/**
85 * Internal fuzzed target state.
86 */
87typedef struct RTFUZZTGTSTATEINT
88{
89 /** Node for the list of states. */
90 RTLISTNODE NdStates;
91 /** Checksum for the state. */
92 uint64_t uChkSum;
93 /** Magic identifying the structure. */
94 uint32_t u32Magic;
95 /** Reference counter. */
96 volatile uint32_t cRefs;
97 /** The owning recorder instance. */
98 PRTFUZZTGTRECINT pTgtRec;
99 /** Flag whether the state is finalized. */
100 bool fFinalized;
101 /** Flag whether the state is contained in the recorded set. */
102 bool fInRecSet;
103 /** The stdout data buffer. */
104 RTFUZZTGTSTDOUTERRBUF StdOutBuf;
105 /** The stderr data buffer. */
106 RTFUZZTGTSTDOUTERRBUF StdErrBuf;
107 /** Process status. */
108 RTPROCSTATUS ProcSts;
109 /** Coverage report buffer. */
110 void *pvCovReport;
111 /** Size of the coverage report in bytes. */
112 size_t cbCovReport;
113 /** Number of traced edges. */
114 size_t cEdges;
115} RTFUZZTGTSTATEINT;
116/** Pointer to an internal fuzzed target state. */
117typedef RTFUZZTGTSTATEINT *PRTFUZZTGTSTATEINT;
118
119
120/**
121 * Recorder states node in the AVL tree.
122 */
123typedef struct RTFUZZTGTRECNODE
124{
125 /** The AVL tree core (keyed by checksum). */
126 AVLU64NODECORE Core;
127 /** The list anchor for the individual states. */
128 RTLISTANCHOR LstStates;
129} RTFUZZTGTRECNODE;
130/** Pointer to a recorder states node. */
131typedef RTFUZZTGTRECNODE *PRTFUZZTGTRECNODE;
132
133
134/**
135 * Edge information node.
136 */
137typedef struct RTFUZZTGTEDGE
138{
139 /** The AVL tree core (keyed by offset). */
140 AVLU64NODECORE Core;
141 /** Number of times the edge was hit. */
142 volatile uint64_t cHits;
143} RTFUZZTGTEDGE;
144/** Pointer to a edge information node. */
145typedef RTFUZZTGTEDGE *PRTFUZZTGTEDGE;
146
147
148/**
149 * Internal fuzzed target recorder state.
150 */
151typedef struct RTFUZZTGTRECINT
152{
153 /** Magic value for identification. */
154 uint32_t u32Magic;
155 /** Reference counter. */
156 volatile uint32_t cRefs;
157 /** Flags passed when the recorder was created. */
158 uint32_t fRecFlags;
159 /** Semaphore protecting the states tree. */
160 RTSEMRW hSemRwStates;
161 /** The AVL tree for indexing the recorded state (keyed by stdout/stderr buffer size). */
162 AVLU64TREE TreeStates;
163 /** Semaphore protecting the edges tree. */
164 RTSEMRW hSemRwEdges;
165 /** The AVL tree for discovered edges when coverage reports are collected. */
166 AVLU64TREE TreeEdges;
167 /** Number of edges discovered so far. */
168 volatile uint64_t cEdges;
169 /** The discovered offset width. */
170 volatile uint32_t cbCovOff;
171} RTFUZZTGTRECINT;
172
173
174/** SanCov magic for 64bit offsets. */
175#define SANCOV_MAGIC_64 UINT64_C(0xc0bfffffffffff64)
176/** SanCov magic for 32bit offsets. */
177#define SANCOV_MAGIC_32 UINT64_C(0xc0bfffffffffff32)
178
179
180/*********************************************************************************************************************************
181* Internal Functions *
182*********************************************************************************************************************************/
183
184/**
185 * Initializes the given stdout/stderr buffer.
186 *
187 * @param pBuf The buffer to initialize.
188 */
189static void rtFuzzTgtStdOutErrBufInit(PRTFUZZTGTSTDOUTERRBUF pBuf)
190{
191 pBuf->cbBuf = 0;
192 pBuf->cbBufMax = 0;
193 pBuf->pbBase = NULL;
194}
195
196
197/**
198 * Frees all allocated resources in the given stdout/stderr buffer.
199 *
200 * @param pBuf The buffer to free.
201 */
202static void rtFuzzTgtStdOutErrBufFree(PRTFUZZTGTSTDOUTERRBUF pBuf)
203{
204 if (pBuf->pbBase)
205 RTMemFree(pBuf->pbBase);
206}
207
208
209/**
210 * Fills the given stdout/stderr buffer from the given pipe.
211 *
212 * @returns IPRT status code.
213 * @param pBuf The buffer to fill.
214 * @param hPipeRead The pipe to read from.
215 */
216static int rtFuzzTgtStdOutErrBufFillFromPipe(PRTFUZZTGTSTDOUTERRBUF pBuf, RTPIPE hPipeRead)
217{
218 int rc = VINF_SUCCESS;
219
220 size_t cbRead = 0;
221 size_t cbThisRead = 0;
222 do
223 {
224 cbThisRead = pBuf->cbBufMax - pBuf->cbBuf;
225 if (!cbThisRead)
226 {
227 /* Try to increase the buffer. */
228 uint8_t *pbNew = (uint8_t *)RTMemRealloc(pBuf->pbBase, pBuf->cbBufMax + _4K);
229 if (RT_LIKELY(pbNew))
230 {
231 pBuf->cbBufMax += _4K;
232 pBuf->pbBase = pbNew;
233 }
234 cbThisRead = pBuf->cbBufMax - pBuf->cbBuf;
235 }
236
237 if (cbThisRead)
238 {
239 rc = RTPipeRead(hPipeRead, pBuf->pbBase + pBuf->cbBuf, cbThisRead, &cbRead);
240 if (RT_SUCCESS(rc))
241 pBuf->cbBuf += cbRead;
242 }
243 else
244 rc = VERR_NO_MEMORY;
245 } while ( RT_SUCCESS(rc)
246 && cbRead == cbThisRead);
247
248 return rc;
249}
250
251
252/**
253 * Writes the given buffer to the given file.
254 *
255 * @returns IPRT status code.
256 * @param pBuf The buffer to write.
257 * @param pszFilename Where to write the buffer.
258 */
259static int rtFuzzTgtStateStdOutErrBufWriteToFile(PRTFUZZTGTSTDOUTERRBUF pBuf, const char *pszFilename)
260{
261 RTFILE hFile;
262 int rc = RTFileOpen(&hFile, pszFilename, RTFILE_O_CREATE | RTFILE_O_WRITE | RTFILE_O_DENY_NONE);
263 if (RT_SUCCESS(rc))
264 {
265 rc = RTFileWrite(hFile, pBuf->pbBase, pBuf->cbBuf, NULL);
266 AssertRC(rc);
267 RTFileClose(hFile);
268
269 if (RT_FAILURE(rc))
270 RTFileDelete(pszFilename);
271 }
272
273 return rc;
274}
275
276
277/**
278 * Scans the given target state for newly discovered edges in the coverage report.
279 *
280 * @returns IPRT status code.
281 * @param pThis The fuzzer target recorder instance.
282 * @param pTgtState The target state to check.
283 */
284static int rtFuzzTgtRecScanStateForNewEdges(PRTFUZZTGTRECINT pThis, PRTFUZZTGTSTATEINT pTgtState)
285{
286 int rc = VINF_SUCCESS;
287
288 if (pTgtState->pvCovReport)
289 {
290 rc = RTSemRWRequestRead(pThis->hSemRwEdges, RT_INDEFINITE_WAIT); AssertRC(rc);
291
292 uint32_t cbCovOff = ASMAtomicReadU32(&pThis->cbCovOff);
293 Assert(cbCovOff != 0);
294
295 uint8_t *pbCovCur = (uint8_t *)pTgtState->pvCovReport;
296 size_t cEdgesLeft = pTgtState->cbCovReport / cbCovOff;
297 while (cEdgesLeft)
298 {
299 uint64_t offCur = cbCovOff == sizeof(uint64_t)
300 ? *(uint64_t *)pbCovCur
301 : *(uint32_t *)pbCovCur;
302
303 PRTFUZZTGTEDGE pEdge = (PRTFUZZTGTEDGE)RTAvlU64Get(&pThis->TreeEdges, offCur);
304 if (!pEdge)
305 {
306 /* New edge discovered, allocate and add. */
307 rc = RTSemRWReleaseRead(pThis->hSemRwEdges); AssertRC(rc);
308
309 pEdge = (PRTFUZZTGTEDGE)RTMemAllocZ(sizeof(RTFUZZTGTEDGE));
310 if (RT_LIKELY(pEdge))
311 {
312 pEdge->Core.Key = offCur;
313 pEdge->cHits = 1;
314 rc = RTSemRWRequestWrite(pThis->hSemRwEdges, RT_INDEFINITE_WAIT); AssertRC(rc);
315
316 bool fIns = RTAvlU64Insert(&pThis->TreeEdges, &pEdge->Core);
317 if (!fIns)
318 {
319 /* Someone raced us, free and query again. */
320 RTMemFree(pEdge);
321 pEdge = (PRTFUZZTGTEDGE)RTAvlU64Get(&pThis->TreeEdges, offCur);
322 AssertPtr(pEdge);
323
324 ASMAtomicIncU64(&pEdge->cHits);
325 }
326 else
327 ASMAtomicIncU64(&pThis->cEdges);
328
329 rc = RTSemRWReleaseWrite(pThis->hSemRwEdges); AssertRC(rc);
330 rc = RTSemRWRequestRead(pThis->hSemRwEdges, RT_INDEFINITE_WAIT); AssertRC(rc);
331 }
332 else
333 {
334 rc = RTSemRWRequestRead(pThis->hSemRwEdges, RT_INDEFINITE_WAIT);
335 AssertRC(rc);
336
337 rc = VERR_NO_MEMORY;
338 break;
339 }
340 }
341 else
342 ASMAtomicIncU64(&pEdge->cHits);
343
344 pbCovCur += cbCovOff;
345 cEdgesLeft--;
346 }
347
348 rc = RTSemRWReleaseRead(pThis->hSemRwEdges); AssertRC(rc);
349 }
350
351 return rc;
352}
353
354
355/**
356 * Destorys the given fuzzer target recorder freeing all allocated resources.
357 *
358 * @param pThis The fuzzer target recorder instance.
359 */
360static void rtFuzzTgtRecDestroy(PRTFUZZTGTRECINT pThis)
361{
362 RT_NOREF(pThis);
363}
364
365
366/**
367 * Destroys the given fuzzer target state freeing all allocated resources.
368 *
369 * @param pThis The fuzzed target state instance.
370 */
371static void rtFuzzTgtStateDestroy(PRTFUZZTGTSTATEINT pThis)
372{
373 pThis->u32Magic = ~(uint32_t)0; /** @todo Dead magic */
374 rtFuzzTgtStdOutErrBufFree(&pThis->StdOutBuf);
375 rtFuzzTgtStdOutErrBufFree(&pThis->StdErrBuf);
376 RTMemFree(pThis);
377}
378
379
380/**
381 * Compares two given target states, checking whether they match.
382 *
383 * @returns Flag whether the states are identical.
384 * @param pThis Target state 1.
385 * @param pThat Target state 2.
386 */
387static bool rtFuzzTgtStateDoMatch(PRTFUZZTGTSTATEINT pThis, PRTFUZZTGTSTATEINT pThat)
388{
389 PRTFUZZTGTRECINT pTgtRec = pThis->pTgtRec;
390 Assert(pTgtRec == pThat->pTgtRec);
391
392 if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDOUT)
393 && ( pThis->StdOutBuf.cbBuf != pThat->StdOutBuf.cbBuf
394 || ( pThis->StdOutBuf.cbBuf > 0
395 && memcmp(pThis->StdOutBuf.pbBase, pThat->StdOutBuf.pbBase, pThis->StdOutBuf.cbBuf))))
396 return false;
397
398 if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDERR)
399 && ( pThis->StdErrBuf.cbBuf != pThat->StdErrBuf.cbBuf
400 || ( pThis->StdErrBuf.cbBuf > 0
401 && memcmp(pThis->StdErrBuf.pbBase, pThat->StdErrBuf.pbBase, pThis->StdErrBuf.cbBuf))))
402 return false;
403
404 if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_PROCSTATUS)
405 && memcmp(&pThis->ProcSts, &pThat->ProcSts, sizeof(RTPROCSTATUS)))
406 return false;
407
408 if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_SANCOV)
409 && ( pThis->cbCovReport != pThat->cbCovReport
410 || ( pThis->cbCovReport > 0
411 && memcmp(pThis->pvCovReport, pThat->pvCovReport, pThis->cbCovReport))))
412 return false;
413
414 return true;
415}
416
417
418RTDECL(int) RTFuzzTgtRecorderCreate(PRTFUZZTGTREC phFuzzTgtRec, uint32_t fRecFlags)
419{
420 AssertPtrReturn(phFuzzTgtRec, VERR_INVALID_POINTER);
421 AssertReturn(!(fRecFlags & ~RTFUZZTGT_REC_STATE_F_VALID), VERR_INVALID_PARAMETER);
422
423 int rc;
424 PRTFUZZTGTRECINT pThis = (PRTFUZZTGTRECINT)RTMemAllocZ(sizeof(*pThis));
425 if (RT_LIKELY(pThis))
426 {
427 pThis->u32Magic = 0; /** @todo */
428 pThis->cRefs = 1;
429 pThis->TreeStates = NULL;
430 pThis->TreeEdges = NULL;
431 pThis->cbCovOff = 0;
432 pThis->fRecFlags = fRecFlags;
433
434 rc = RTSemRWCreate(&pThis->hSemRwStates);
435 if (RT_SUCCESS(rc))
436 {
437 rc = RTSemRWCreate(&pThis->hSemRwEdges);
438 if (RT_SUCCESS(rc))
439 {
440 *phFuzzTgtRec = pThis;
441 return VINF_SUCCESS;
442 }
443
444 RTSemRWDestroy(pThis->hSemRwStates);
445 }
446
447 RTMemFree(pThis);
448 }
449 else
450 rc = VERR_NO_MEMORY;
451
452 return rc;
453}
454
455
456RTDECL(uint32_t) RTFuzzTgtRecorderRetain(RTFUZZTGTREC hFuzzTgtRec)
457{
458 PRTFUZZTGTRECINT pThis = hFuzzTgtRec;
459
460 AssertPtrReturn(pThis, UINT32_MAX);
461
462 uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
463 AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pThis));
464 return cRefs;
465}
466
467
468RTDECL(uint32_t) RTFuzzTgtRecorderRelease(RTFUZZTGTREC hFuzzTgtRec)
469{
470 PRTFUZZTGTRECINT pThis = hFuzzTgtRec;
471 if (pThis == NIL_RTFUZZTGTREC)
472 return 0;
473 AssertPtrReturn(pThis, UINT32_MAX);
474
475 uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
476 AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pThis));
477 if (cRefs == 0)
478 rtFuzzTgtRecDestroy(pThis);
479 return cRefs;
480}
481
482
483RTDECL(int) RTFuzzTgtRecorderCreateNewState(RTFUZZTGTREC hFuzzTgtRec, PRTFUZZTGTSTATE phFuzzTgtState)
484{
485 PRTFUZZTGTRECINT pThis = hFuzzTgtRec;
486 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
487 AssertPtrReturn(phFuzzTgtState, VERR_INVALID_POINTER);
488
489 int rc = VINF_SUCCESS;
490 PRTFUZZTGTSTATEINT pState = (PRTFUZZTGTSTATEINT)RTMemAllocZ(sizeof(*pState));
491 if (RT_LIKELY(pState))
492 {
493 pState->u32Magic = 0; /** @todo */
494 pState->cRefs = 1;
495 pState->pTgtRec = pThis;
496 pState->fFinalized = false;
497 rtFuzzTgtStdOutErrBufInit(&pState->StdOutBuf);
498 rtFuzzTgtStdOutErrBufInit(&pState->StdErrBuf);
499 *phFuzzTgtState = pState;
500 }
501 else
502 rc = VERR_NO_MEMORY;
503
504 return rc;
505}
506
507
508RTDECL(uint32_t) RTFuzzTgtStateRetain(RTFUZZTGTSTATE hFuzzTgtState)
509{
510 PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
511
512 AssertPtrReturn(pThis, UINT32_MAX);
513
514 uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
515 AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pThis));
516 return cRefs;
517}
518
519
520RTDECL(uint32_t) RTFuzzTgtStateRelease(RTFUZZTGTSTATE hFuzzTgtState)
521{
522 PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
523 if (pThis == NIL_RTFUZZTGTSTATE)
524 return 0;
525 AssertPtrReturn(pThis, UINT32_MAX);
526
527 uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
528 AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pThis));
529 if (cRefs == 0 && !pThis->fInRecSet)
530 rtFuzzTgtStateDestroy(pThis);
531 return cRefs;
532}
533
534
535RTDECL(int) RTFuzzTgtStateReset(RTFUZZTGTSTATE hFuzzTgtState)
536{
537 PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
538 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
539
540 /* Clear the buffers. */
541 pThis->StdOutBuf.cbBuf = 0;
542 pThis->StdErrBuf.cbBuf = 0;
543 RT_ZERO(pThis->ProcSts);
544 if (pThis->pvCovReport)
545 RTMemFree(pThis->pvCovReport);
546 pThis->pvCovReport = NULL;
547 pThis->fFinalized = false;
548 return VINF_SUCCESS;
549}
550
551
552RTDECL(int) RTFuzzTgtStateFinalize(RTFUZZTGTSTATE hFuzzTgtState)
553{
554 PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
555 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
556
557 /* Create the checksum. */
558 PRTFUZZTGTRECINT pTgtRec = pThis->pTgtRec;
559 uint64_t uChkSum = RTCrc64Start();
560 if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDOUT)
561 && pThis->StdOutBuf.cbBuf)
562 uChkSum = RTCrc64Process(uChkSum, pThis->StdOutBuf.pbBase, pThis->StdOutBuf.cbBuf);
563 if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDERR)
564 && pThis->StdErrBuf.cbBuf)
565 uChkSum = RTCrc64Process(uChkSum, pThis->StdErrBuf.pbBase, pThis->StdErrBuf.cbBuf);
566 if (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_PROCSTATUS)
567 uChkSum = RTCrc64Process(uChkSum, &pThis->ProcSts, sizeof(RTPROCSTATUS));
568 if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_SANCOV)
569 && pThis->pvCovReport)
570 uChkSum = RTCrc64Process(uChkSum, pThis->pvCovReport, pThis->cbCovReport);
571
572 pThis->uChkSum = RTCrc64Finish(uChkSum);
573 pThis->fFinalized = true;
574 return VINF_SUCCESS;
575}
576
577
578RTDECL(int) RTFuzzTgtStateAddToRecorder(RTFUZZTGTSTATE hFuzzTgtState)
579{
580 PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
581 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
582
583 if (!pThis->fFinalized)
584 {
585 int rc = RTFuzzTgtStateFinalize(pThis);
586 if (RT_FAILURE(rc))
587 return rc;
588 }
589
590 PRTFUZZTGTRECINT pTgtRec = pThis->pTgtRec;
591
592 /* Try to find a node matching the stdout and sterr sizes first. */
593 int rc = RTSemRWRequestRead(pTgtRec->hSemRwStates, RT_INDEFINITE_WAIT); AssertRC(rc);
594 PRTFUZZTGTRECNODE pNode = (PRTFUZZTGTRECNODE)RTAvlU64Get(&pTgtRec->TreeStates, pThis->uChkSum);
595 if (pNode)
596 {
597 /* Traverse the states and check if any matches the stdout and stderr buffers exactly. */
598 PRTFUZZTGTSTATEINT pIt;
599 bool fMatchFound = false;
600 RTListForEach(&pNode->LstStates, pIt, RTFUZZTGTSTATEINT, NdStates)
601 {
602 if (rtFuzzTgtStateDoMatch(pThis, pIt))
603 {
604 fMatchFound = true;
605 break;
606 }
607 }
608
609 rc = RTSemRWReleaseRead(pTgtRec->hSemRwStates); AssertRC(rc);
610 if (!fMatchFound)
611 {
612 rc = RTSemRWRequestWrite(pTgtRec->hSemRwStates, RT_INDEFINITE_WAIT); AssertRC(rc);
613 RTListAppend(&pNode->LstStates, &pThis->NdStates);
614 rc = RTSemRWReleaseWrite(pTgtRec->hSemRwStates); AssertRC(rc);
615 pThis->fInRecSet = true;
616 }
617 else
618 rc = VERR_ALREADY_EXISTS;
619 }
620 else
621 {
622 rc = RTSemRWReleaseRead(pTgtRec->hSemRwStates); AssertRC(rc);
623
624 /* No node found, create new one and insert in to the tree right away. */
625 pNode = (PRTFUZZTGTRECNODE)RTMemAllocZ(sizeof(*pNode));
626 if (RT_LIKELY(pNode))
627 {
628 pNode->Core.Key = pThis->uChkSum;
629 RTListInit(&pNode->LstStates);
630 RTListAppend(&pNode->LstStates, &pThis->NdStates);
631 rc = RTSemRWRequestWrite(pTgtRec->hSemRwStates, RT_INDEFINITE_WAIT); AssertRC(rc);
632 bool fIns = RTAvlU64Insert(&pTgtRec->TreeStates, &pNode->Core);
633 if (!fIns)
634 {
635 /* Someone raced us, get the new node and append there. */
636 RTMemFree(pNode);
637 pNode = (PRTFUZZTGTRECNODE)RTAvlU64Get(&pTgtRec->TreeStates, pThis->uChkSum);
638 AssertPtr(pNode);
639 RTListAppend(&pNode->LstStates, &pThis->NdStates);
640 }
641 rc = RTSemRWReleaseWrite(pTgtRec->hSemRwStates); AssertRC(rc);
642 pThis->fInRecSet = true;
643 }
644 else
645 rc = VERR_NO_MEMORY;
646 }
647
648 if ( RT_SUCCESS(rc)
649 && pThis->fInRecSet)
650 rc = rtFuzzTgtRecScanStateForNewEdges(pTgtRec, pThis);
651
652 return rc;
653}
654
655
656RTDECL(int) RTFuzzTgtStateAppendStdoutFromBuf(RTFUZZTGTSTATE hFuzzTgtState, const void *pvStdOut, size_t cbStdOut)
657{
658 PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
659 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
660 AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
661
662 RT_NOREF(pvStdOut, cbStdOut);
663 return VERR_NOT_IMPLEMENTED;
664}
665
666
667RTDECL(int) RTFuzzTgtStateAppendStderrFromBuf(RTFUZZTGTSTATE hFuzzTgtState, const void *pvStdErr, size_t cbStdErr)
668{
669 PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
670 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
671 AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
672
673 RT_NOREF(pvStdErr, cbStdErr);
674 return VERR_NOT_IMPLEMENTED;
675}
676
677
678RTDECL(int) RTFuzzTgtStateAppendStdoutFromPipe(RTFUZZTGTSTATE hFuzzTgtState, RTPIPE hPipe)
679{
680 PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
681 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
682 AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
683
684 return rtFuzzTgtStdOutErrBufFillFromPipe(&pThis->StdOutBuf, hPipe);
685}
686
687
688RTDECL(int) RTFuzzTgtStateAppendStderrFromPipe(RTFUZZTGTSTATE hFuzzTgtState, RTPIPE hPipe)
689{
690 PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
691 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
692 AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
693
694 return rtFuzzTgtStdOutErrBufFillFromPipe(&pThis->StdErrBuf, hPipe);
695}
696
697
698RTDECL(int) RTFuzzTgtStateAddSanCovReportFromFile(RTFUZZTGTSTATE hFuzzTgtState, const char *pszFilename)
699{
700 PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
701 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
702 AssertPtrReturn(pszFilename, VERR_INVALID_POINTER);
703 AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
704
705 uint8_t *pbSanCov = NULL;
706 size_t cbSanCov = 0;
707 int rc = RTFileReadAll(pszFilename, (void **)&pbSanCov, &cbSanCov);
708 if (RT_SUCCESS(rc))
709 {
710 /* Check for the magic identifying whether the offsets are 32bit or 64bit. */
711 if ( cbSanCov >= sizeof(uint64_t)
712 && ( *(uint64_t *)pbSanCov == SANCOV_MAGIC_64
713 || *(uint64_t *)pbSanCov == SANCOV_MAGIC_32))
714 {
715 uint32_t cbCovOff = sizeof(uint32_t);
716 if (*(uint64_t *)pbSanCov == SANCOV_MAGIC_64)
717 cbCovOff = sizeof(uint64_t);
718
719 uint32_t cbCovDet = ASMAtomicReadU32(&pThis->pTgtRec->cbCovOff);
720 if (!cbCovDet)
721 {
722 /* Set the detected offset width. */
723 if (!ASMAtomicCmpXchgU32(&pThis->pTgtRec->cbCovOff, cbCovOff, 0))
724 {
725 /* Someone raced us, check again. */
726 cbCovDet = ASMAtomicReadU32(&pThis->pTgtRec->cbCovOff);
727 Assert(cbCovDet != 0);
728 }
729 else
730 cbCovDet = cbCovOff;
731 }
732
733 if (cbCovDet == cbCovOff)
734 {
735 /*
736 * Just copy the offsets into the state for now. Now further analysis
737 * is happening right now, just checking whether the content changed for
738 * the states.to spot newly discovered edges.
739 */
740 pThis->cbCovReport = cbSanCov - sizeof(uint64_t);
741 pThis->pvCovReport = RTMemDup(pbSanCov + sizeof(uint64_t), pThis->cbCovReport);
742 if (!pThis->pvCovReport)
743 {
744 pThis->cbCovReport = 0;
745 rc = VERR_NO_MEMORY;
746 }
747 }
748 else
749 rc = VERR_INVALID_STATE; /* Mixing 32bit and 64bit offsets shouldn't happen, is not supported. */
750 }
751 else
752 rc = VERR_INVALID_STATE;
753 RTFileReadAllFree(pbSanCov, cbSanCov);
754 }
755 return rc;
756}
757
758
759RTDECL(int) RTFuzzTgtStateAddProcSts(RTFUZZTGTSTATE hFuzzTgtState, PCRTPROCSTATUS pProcSts)
760{
761 PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
762 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
763 AssertPtrReturn(pProcSts, VERR_INVALID_POINTER);
764 AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
765
766 pThis->ProcSts = *pProcSts;
767 return VINF_SUCCESS;
768}
769
770
771RTDECL(int) RTFuzzTgtStateDumpToDir(RTFUZZTGTSTATE hFuzzTgtState, const char *pszDirPath)
772{
773 PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
774 AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
775 AssertPtrReturn(pszDirPath, VERR_INVALID_POINTER);
776 AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
777
778 int rc = VINF_SUCCESS;
779 char szPath[RTPATH_MAX];
780 if (pThis->StdOutBuf.cbBuf)
781 {
782 rc = RTPathJoin(szPath, sizeof(szPath), pszDirPath, "stdout"); AssertRC(rc);
783 if (RT_SUCCESS(rc))
784 rc = rtFuzzTgtStateStdOutErrBufWriteToFile(&pThis->StdOutBuf, &szPath[0]);
785 }
786
787 if ( RT_SUCCESS(rc)
788 && pThis->StdErrBuf.cbBuf)
789 {
790 rc = RTPathJoin(szPath, sizeof(szPath), pszDirPath, "stderr"); AssertRC(rc);
791 if (RT_SUCCESS(rc))
792 rc = rtFuzzTgtStateStdOutErrBufWriteToFile(&pThis->StdErrBuf, &szPath[0]);
793 }
794
795 return rc;
796}
797
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use