fuzz-target-recorder.cpp@ 100594

Last change on this file since 100594 was 99739, checked in by vboxsync, 21 months ago
*: doxygen corrections (mostly about removing @returns from functions returning void).
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 25.6 KB

Line
1	/* $Id: fuzz-target-recorder.cpp 99739 2023-05-11 01:01:08Z vboxsync $ */
2	/** @file
3	* IPRT - Fuzzing framework API, target state recorder.
4	*/
5
6	/*
7	* Copyright (C) 2019-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* The contents of this file may alternatively be used under the terms
26	* of the Common Development and Distribution License Version 1.0
27	* (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28	* in the VirtualBox distribution, in which case the provisions of the
29	* CDDL are applicable instead of those of the GPL.
30	*
31	* You may elect to license modified versions of this file under the
32	* terms and conditions of either the GPL or the CDDL or both.
33	*
34	* SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35	*/
36
37
38	/*********************************************************************************************************************************
39	* Header Files *
40	*********************************************************************************************************************************/
41	#include <iprt/fuzz.h>
42	#include "internal/iprt.h"
43
44	#include <iprt/asm.h>
45	#include <iprt/assert.h>
46	#include <iprt/avl.h>
47	#include <iprt/crc.h>
48	#include <iprt/ctype.h>
49	#include <iprt/err.h>
50	#include <iprt/file.h>
51	#include <iprt/list.h>
52	#include <iprt/mem.h>
53	#include <iprt/path.h>
54	#include <iprt/pipe.h>
55	#include <iprt/process.h>
56	#include <iprt/semaphore.h>
57	#include <iprt/string.h>
58
59
60
61	/*********************************************************************************************************************************
62	* Structures and Typedefs *
63	*********************************************************************************************************************************/
64	/** Pointer to the internal fuzzed target recorder state. */
65	typedef struct RTFUZZTGTRECINT *PRTFUZZTGTRECINT;
66
67
68	/**
69	* Stdout/Stderr buffer.
70	*/
71	typedef struct RTFUZZTGTSTDOUTERRBUF
72	{
73	/** Current amount buffered. */
74	size_t cbBuf;
75	/** Maxmium amount to buffer. */
76	size_t cbBufMax;
77	/** Base pointer to the data buffer. */
78	uint8_t *pbBase;
79	} RTFUZZTGTSTDOUTERRBUF;
80	/** Pointer to a stdout/stderr buffer. */
81	typedef RTFUZZTGTSTDOUTERRBUF *PRTFUZZTGTSTDOUTERRBUF;
82
83
84	/**
85	* Internal fuzzed target state.
86	*/
87	typedef struct RTFUZZTGTSTATEINT
88	{
89	/** Node for the list of states. */
90	RTLISTNODE NdStates;
91	/** Checksum for the state. */
92	uint64_t uChkSum;
93	/** Magic identifying the structure. */
94	uint32_t u32Magic;
95	/** Reference counter. */
96	volatile uint32_t cRefs;
97	/** The owning recorder instance. */
98	PRTFUZZTGTRECINT pTgtRec;
99	/** Flag whether the state is finalized. */
100	bool fFinalized;
101	/** Flag whether the state is contained in the recorded set. */
102	bool fInRecSet;
103	/** The stdout data buffer. */
104	RTFUZZTGTSTDOUTERRBUF StdOutBuf;
105	/** The stderr data buffer. */
106	RTFUZZTGTSTDOUTERRBUF StdErrBuf;
107	/** Process status. */
108	RTPROCSTATUS ProcSts;
109	/** Coverage report buffer. */
110	void *pvCovReport;
111	/** Size of the coverage report in bytes. */
112	size_t cbCovReport;
113	/** Number of traced edges. */
114	size_t cEdges;
115	} RTFUZZTGTSTATEINT;
116	/** Pointer to an internal fuzzed target state. */
117	typedef RTFUZZTGTSTATEINT *PRTFUZZTGTSTATEINT;
118
119
120	/**
121	* Recorder states node in the AVL tree.
122	*/
123	typedef struct RTFUZZTGTRECNODE
124	{
125	/** The AVL tree core (keyed by checksum). */
126	AVLU64NODECORE Core;
127	/** The list anchor for the individual states. */
128	RTLISTANCHOR LstStates;
129	} RTFUZZTGTRECNODE;
130	/** Pointer to a recorder states node. */
131	typedef RTFUZZTGTRECNODE *PRTFUZZTGTRECNODE;
132
133
134	/**
135	* Edge information node.
136	*/
137	typedef struct RTFUZZTGTEDGE
138	{
139	/** The AVL tree core (keyed by offset). */
140	AVLU64NODECORE Core;
141	/** Number of times the edge was hit. */
142	volatile uint64_t cHits;
143	} RTFUZZTGTEDGE;
144	/** Pointer to a edge information node. */
145	typedef RTFUZZTGTEDGE *PRTFUZZTGTEDGE;
146
147
148	/**
149	* Internal fuzzed target recorder state.
150	*/
151	typedef struct RTFUZZTGTRECINT
152	{
153	/** Magic value for identification. */
154	uint32_t u32Magic;
155	/** Reference counter. */
156	volatile uint32_t cRefs;
157	/** Flags passed when the recorder was created. */
158	uint32_t fRecFlags;
159	/** Semaphore protecting the states tree. */
160	RTSEMRW hSemRwStates;
161	/** The AVL tree for indexing the recorded state (keyed by stdout/stderr buffer size). */
162	AVLU64TREE TreeStates;
163	/** Semaphore protecting the edges tree. */
164	RTSEMRW hSemRwEdges;
165	/** The AVL tree for discovered edges when coverage reports are collected. */
166	AVLU64TREE TreeEdges;
167	/** Number of edges discovered so far. */
168	volatile uint64_t cEdges;
169	/** The discovered offset width. */
170	volatile uint32_t cbCovOff;
171	} RTFUZZTGTRECINT;
172
173
174	/** SanCov magic for 64bit offsets. */
175	#define SANCOV_MAGIC_64 UINT64_C(0xc0bfffffffffff64)
176	/** SanCov magic for 32bit offsets. */
177	#define SANCOV_MAGIC_32 UINT64_C(0xc0bfffffffffff32)
178
179
180	/*********************************************************************************************************************************
181	* Internal Functions *
182	*********************************************************************************************************************************/
183
184	/**
185	* Initializes the given stdout/stderr buffer.
186	*
187	* @param pBuf The buffer to initialize.
188	*/
189	static void rtFuzzTgtStdOutErrBufInit(PRTFUZZTGTSTDOUTERRBUF pBuf)
190	{
191	pBuf->cbBuf = 0;
192	pBuf->cbBufMax = 0;
193	pBuf->pbBase = NULL;
194	}
195
196
197	/**
198	* Frees all allocated resources in the given stdout/stderr buffer.
199	*
200	* @param pBuf The buffer to free.
201	*/
202	static void rtFuzzTgtStdOutErrBufFree(PRTFUZZTGTSTDOUTERRBUF pBuf)
203	{
204	if (pBuf->pbBase)
205	RTMemFree(pBuf->pbBase);
206	}
207
208
209	/**
210	* Fills the given stdout/stderr buffer from the given pipe.
211	*
212	* @returns IPRT status code.
213	* @param pBuf The buffer to fill.
214	* @param hPipeRead The pipe to read from.
215	*/
216	static int rtFuzzTgtStdOutErrBufFillFromPipe(PRTFUZZTGTSTDOUTERRBUF pBuf, RTPIPE hPipeRead)
217	{
218	int rc = VINF_SUCCESS;
219
220	size_t cbRead = 0;
221	size_t cbThisRead = 0;
222	do
223	{
224	cbThisRead = pBuf->cbBufMax - pBuf->cbBuf;
225	if (!cbThisRead)
226	{
227	/* Try to increase the buffer. */
228	uint8_t pbNew = (uint8_t )RTMemRealloc(pBuf->pbBase, pBuf->cbBufMax + _4K);
229	if (RT_LIKELY(pbNew))
230	{
231	pBuf->cbBufMax += _4K;
232	pBuf->pbBase = pbNew;
233	}
234	cbThisRead = pBuf->cbBufMax - pBuf->cbBuf;
235	}
236
237	if (cbThisRead)
238	{
239	rc = RTPipeRead(hPipeRead, pBuf->pbBase + pBuf->cbBuf, cbThisRead, &cbRead);
240	if (RT_SUCCESS(rc))
241	pBuf->cbBuf += cbRead;
242	}
243	else
244	rc = VERR_NO_MEMORY;
245	} while ( RT_SUCCESS(rc)
246	&& cbRead == cbThisRead);
247
248	return rc;
249	}
250
251
252	/**
253	* Writes the given buffer to the given file.
254	*
255	* @returns IPRT status code.
256	* @param pBuf The buffer to write.
257	* @param pszFilename Where to write the buffer.
258	*/
259	static int rtFuzzTgtStateStdOutErrBufWriteToFile(PRTFUZZTGTSTDOUTERRBUF pBuf, const char *pszFilename)
260	{
261	RTFILE hFile;
262	int rc = RTFileOpen(&hFile, pszFilename, RTFILE_O_CREATE \| RTFILE_O_WRITE \| RTFILE_O_DENY_NONE);
263	if (RT_SUCCESS(rc))
264	{
265	rc = RTFileWrite(hFile, pBuf->pbBase, pBuf->cbBuf, NULL);
266	AssertRC(rc);
267	RTFileClose(hFile);
268
269	if (RT_FAILURE(rc))
270	RTFileDelete(pszFilename);
271	}
272
273	return rc;
274	}
275
276
277	/**
278	* Scans the given target state for newly discovered edges in the coverage report.
279	*
280	* @returns IPRT status code.
281	* @param pThis The fuzzer target recorder instance.
282	* @param pTgtState The target state to check.
283	*/
284	static int rtFuzzTgtRecScanStateForNewEdges(PRTFUZZTGTRECINT pThis, PRTFUZZTGTSTATEINT pTgtState)
285	{
286	int rc = VINF_SUCCESS;
287
288	if (pTgtState->pvCovReport)
289	{
290	rc = RTSemRWRequestRead(pThis->hSemRwEdges, RT_INDEFINITE_WAIT); AssertRC(rc);
291
292	uint32_t cbCovOff = ASMAtomicReadU32(&pThis->cbCovOff);
293	Assert(cbCovOff != 0);
294
295	uint8_t pbCovCur = (uint8_t )pTgtState->pvCovReport;
296	size_t cEdgesLeft = pTgtState->cbCovReport / cbCovOff;
297	while (cEdgesLeft)
298	{
299	uint64_t offCur = cbCovOff == sizeof(uint64_t)
300	? (uint64_t )pbCovCur
301	: (uint32_t )pbCovCur;
302
303	PRTFUZZTGTEDGE pEdge = (PRTFUZZTGTEDGE)RTAvlU64Get(&pThis->TreeEdges, offCur);
304	if (!pEdge)
305	{
306	/* New edge discovered, allocate and add. */
307	rc = RTSemRWReleaseRead(pThis->hSemRwEdges); AssertRC(rc);
308
309	pEdge = (PRTFUZZTGTEDGE)RTMemAllocZ(sizeof(RTFUZZTGTEDGE));
310	if (RT_LIKELY(pEdge))
311	{
312	pEdge->Core.Key = offCur;
313	pEdge->cHits = 1;
314	rc = RTSemRWRequestWrite(pThis->hSemRwEdges, RT_INDEFINITE_WAIT); AssertRC(rc);
315
316	bool fIns = RTAvlU64Insert(&pThis->TreeEdges, &pEdge->Core);
317	if (!fIns)
318	{
319	/* Someone raced us, free and query again. */
320	RTMemFree(pEdge);
321	pEdge = (PRTFUZZTGTEDGE)RTAvlU64Get(&pThis->TreeEdges, offCur);
322	AssertPtr(pEdge);
323
324	ASMAtomicIncU64(&pEdge->cHits);
325	}
326	else
327	ASMAtomicIncU64(&pThis->cEdges);
328
329	rc = RTSemRWReleaseWrite(pThis->hSemRwEdges); AssertRC(rc);
330	rc = RTSemRWRequestRead(pThis->hSemRwEdges, RT_INDEFINITE_WAIT); AssertRC(rc);
331	}
332	else
333	{
334	rc = RTSemRWRequestRead(pThis->hSemRwEdges, RT_INDEFINITE_WAIT);
335	AssertRC(rc);
336
337	rc = VERR_NO_MEMORY;
338	break;
339	}
340	}
341	else
342	ASMAtomicIncU64(&pEdge->cHits);
343
344	pbCovCur += cbCovOff;
345	cEdgesLeft--;
346	}
347
348	rc = RTSemRWReleaseRead(pThis->hSemRwEdges); AssertRC(rc);
349	}
350
351	return rc;
352	}
353
354
355	/**
356	* Destorys the given fuzzer target recorder freeing all allocated resources.
357	*
358	* @param pThis The fuzzer target recorder instance.
359	*/
360	static void rtFuzzTgtRecDestroy(PRTFUZZTGTRECINT pThis)
361	{
362	RT_NOREF(pThis);
363	}
364
365
366	/**
367	* Destroys the given fuzzer target state freeing all allocated resources.
368	*
369	* @param pThis The fuzzed target state instance.
370	*/
371	static void rtFuzzTgtStateDestroy(PRTFUZZTGTSTATEINT pThis)
372	{
373	pThis->u32Magic = ~(uint32_t)0; /** @todo Dead magic */
374	rtFuzzTgtStdOutErrBufFree(&pThis->StdOutBuf);
375	rtFuzzTgtStdOutErrBufFree(&pThis->StdErrBuf);
376	RTMemFree(pThis);
377	}
378
379
380	/**
381	* Compares two given target states, checking whether they match.
382	*
383	* @returns Flag whether the states are identical.
384	* @param pThis Target state 1.
385	* @param pThat Target state 2.
386	*/
387	static bool rtFuzzTgtStateDoMatch(PRTFUZZTGTSTATEINT pThis, PRTFUZZTGTSTATEINT pThat)
388	{
389	PRTFUZZTGTRECINT pTgtRec = pThis->pTgtRec;
390	Assert(pTgtRec == pThat->pTgtRec);
391
392	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDOUT)
393	&& ( pThis->StdOutBuf.cbBuf != pThat->StdOutBuf.cbBuf
394	\|\| ( pThis->StdOutBuf.cbBuf > 0
395	&& memcmp(pThis->StdOutBuf.pbBase, pThat->StdOutBuf.pbBase, pThis->StdOutBuf.cbBuf))))
396	return false;
397
398	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDERR)
399	&& ( pThis->StdErrBuf.cbBuf != pThat->StdErrBuf.cbBuf
400	\|\| ( pThis->StdErrBuf.cbBuf > 0
401	&& memcmp(pThis->StdErrBuf.pbBase, pThat->StdErrBuf.pbBase, pThis->StdErrBuf.cbBuf))))
402	return false;
403
404	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_PROCSTATUS)
405	&& memcmp(&pThis->ProcSts, &pThat->ProcSts, sizeof(RTPROCSTATUS)))
406	return false;
407
408	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_SANCOV)
409	&& ( pThis->cbCovReport != pThat->cbCovReport
410	\|\| ( pThis->cbCovReport > 0
411	&& memcmp(pThis->pvCovReport, pThat->pvCovReport, pThis->cbCovReport))))
412	return false;
413
414	return true;
415	}
416
417
418	RTDECL(int) RTFuzzTgtRecorderCreate(PRTFUZZTGTREC phFuzzTgtRec, uint32_t fRecFlags)
419	{
420	AssertPtrReturn(phFuzzTgtRec, VERR_INVALID_POINTER);
421	AssertReturn(!(fRecFlags & ~RTFUZZTGT_REC_STATE_F_VALID), VERR_INVALID_PARAMETER);
422
423	int rc;
424	PRTFUZZTGTRECINT pThis = (PRTFUZZTGTRECINT)RTMemAllocZ(sizeof(*pThis));
425	if (RT_LIKELY(pThis))
426	{
427	pThis->u32Magic = 0; /** @todo */
428	pThis->cRefs = 1;
429	pThis->TreeStates = NULL;
430	pThis->TreeEdges = NULL;
431	pThis->cbCovOff = 0;
432	pThis->fRecFlags = fRecFlags;
433
434	rc = RTSemRWCreate(&pThis->hSemRwStates);
435	if (RT_SUCCESS(rc))
436	{
437	rc = RTSemRWCreate(&pThis->hSemRwEdges);
438	if (RT_SUCCESS(rc))
439	{
440	*phFuzzTgtRec = pThis;
441	return VINF_SUCCESS;
442	}
443
444	RTSemRWDestroy(pThis->hSemRwStates);
445	}
446
447	RTMemFree(pThis);
448	}
449	else
450	rc = VERR_NO_MEMORY;
451
452	return rc;
453	}
454
455
456	RTDECL(uint32_t) RTFuzzTgtRecorderRetain(RTFUZZTGTREC hFuzzTgtRec)
457	{
458	PRTFUZZTGTRECINT pThis = hFuzzTgtRec;
459
460	AssertPtrReturn(pThis, UINT32_MAX);
461
462	uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
463	AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pThis));
464	return cRefs;
465	}
466
467
468	RTDECL(uint32_t) RTFuzzTgtRecorderRelease(RTFUZZTGTREC hFuzzTgtRec)
469	{
470	PRTFUZZTGTRECINT pThis = hFuzzTgtRec;
471	if (pThis == NIL_RTFUZZTGTREC)
472	return 0;
473	AssertPtrReturn(pThis, UINT32_MAX);
474
475	uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
476	AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pThis));
477	if (cRefs == 0)
478	rtFuzzTgtRecDestroy(pThis);
479	return cRefs;
480	}
481
482
483	RTDECL(int) RTFuzzTgtRecorderCreateNewState(RTFUZZTGTREC hFuzzTgtRec, PRTFUZZTGTSTATE phFuzzTgtState)
484	{
485	PRTFUZZTGTRECINT pThis = hFuzzTgtRec;
486	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
487	AssertPtrReturn(phFuzzTgtState, VERR_INVALID_POINTER);
488
489	int rc = VINF_SUCCESS;
490	PRTFUZZTGTSTATEINT pState = (PRTFUZZTGTSTATEINT)RTMemAllocZ(sizeof(*pState));
491	if (RT_LIKELY(pState))
492	{
493	pState->u32Magic = 0; /** @todo */
494	pState->cRefs = 1;
495	pState->pTgtRec = pThis;
496	pState->fFinalized = false;
497	rtFuzzTgtStdOutErrBufInit(&pState->StdOutBuf);
498	rtFuzzTgtStdOutErrBufInit(&pState->StdErrBuf);
499	*phFuzzTgtState = pState;
500	}
501	else
502	rc = VERR_NO_MEMORY;
503
504	return rc;
505	}
506
507
508	RTDECL(uint32_t) RTFuzzTgtStateRetain(RTFUZZTGTSTATE hFuzzTgtState)
509	{
510	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
511
512	AssertPtrReturn(pThis, UINT32_MAX);
513
514	uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
515	AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pThis));
516	return cRefs;
517	}
518
519
520	RTDECL(uint32_t) RTFuzzTgtStateRelease(RTFUZZTGTSTATE hFuzzTgtState)
521	{
522	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
523	if (pThis == NIL_RTFUZZTGTSTATE)
524	return 0;
525	AssertPtrReturn(pThis, UINT32_MAX);
526
527	uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
528	AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pThis));
529	if (cRefs == 0 && !pThis->fInRecSet)
530	rtFuzzTgtStateDestroy(pThis);
531	return cRefs;
532	}
533
534
535	RTDECL(int) RTFuzzTgtStateReset(RTFUZZTGTSTATE hFuzzTgtState)
536	{
537	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
538	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
539
540	/* Clear the buffers. */
541	pThis->StdOutBuf.cbBuf = 0;
542	pThis->StdErrBuf.cbBuf = 0;
543	RT_ZERO(pThis->ProcSts);
544	if (pThis->pvCovReport)
545	RTMemFree(pThis->pvCovReport);
546	pThis->pvCovReport = NULL;
547	pThis->fFinalized = false;
548	return VINF_SUCCESS;
549	}
550
551
552	RTDECL(int) RTFuzzTgtStateFinalize(RTFUZZTGTSTATE hFuzzTgtState)
553	{
554	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
555	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
556
557	/* Create the checksum. */
558	PRTFUZZTGTRECINT pTgtRec = pThis->pTgtRec;
559	uint64_t uChkSum = RTCrc64Start();
560	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDOUT)
561	&& pThis->StdOutBuf.cbBuf)
562	uChkSum = RTCrc64Process(uChkSum, pThis->StdOutBuf.pbBase, pThis->StdOutBuf.cbBuf);
563	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDERR)
564	&& pThis->StdErrBuf.cbBuf)
565	uChkSum = RTCrc64Process(uChkSum, pThis->StdErrBuf.pbBase, pThis->StdErrBuf.cbBuf);
566	if (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_PROCSTATUS)
567	uChkSum = RTCrc64Process(uChkSum, &pThis->ProcSts, sizeof(RTPROCSTATUS));
568	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_SANCOV)
569	&& pThis->pvCovReport)
570	uChkSum = RTCrc64Process(uChkSum, pThis->pvCovReport, pThis->cbCovReport);
571
572	pThis->uChkSum = RTCrc64Finish(uChkSum);
573	pThis->fFinalized = true;
574	return VINF_SUCCESS;
575	}
576
577
578	RTDECL(int) RTFuzzTgtStateAddToRecorder(RTFUZZTGTSTATE hFuzzTgtState)
579	{
580	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
581	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
582
583	if (!pThis->fFinalized)
584	{
585	int rc = RTFuzzTgtStateFinalize(pThis);
586	if (RT_FAILURE(rc))
587	return rc;
588	}
589
590	PRTFUZZTGTRECINT pTgtRec = pThis->pTgtRec;
591
592	/* Try to find a node matching the stdout and sterr sizes first. */
593	int rc = RTSemRWRequestRead(pTgtRec->hSemRwStates, RT_INDEFINITE_WAIT); AssertRC(rc);
594	PRTFUZZTGTRECNODE pNode = (PRTFUZZTGTRECNODE)RTAvlU64Get(&pTgtRec->TreeStates, pThis->uChkSum);
595	if (pNode)
596	{
597	/* Traverse the states and check if any matches the stdout and stderr buffers exactly. */
598	PRTFUZZTGTSTATEINT pIt;
599	bool fMatchFound = false;
600	RTListForEach(&pNode->LstStates, pIt, RTFUZZTGTSTATEINT, NdStates)
601	{
602	if (rtFuzzTgtStateDoMatch(pThis, pIt))
603	{
604	fMatchFound = true;
605	break;
606	}
607	}
608
609	rc = RTSemRWReleaseRead(pTgtRec->hSemRwStates); AssertRC(rc);
610	if (!fMatchFound)
611	{
612	rc = RTSemRWRequestWrite(pTgtRec->hSemRwStates, RT_INDEFINITE_WAIT); AssertRC(rc);
613	RTListAppend(&pNode->LstStates, &pThis->NdStates);
614	rc = RTSemRWReleaseWrite(pTgtRec->hSemRwStates); AssertRC(rc);
615	pThis->fInRecSet = true;
616	}
617	else
618	rc = VERR_ALREADY_EXISTS;
619	}
620	else
621	{
622	rc = RTSemRWReleaseRead(pTgtRec->hSemRwStates); AssertRC(rc);
623
624	/* No node found, create new one and insert in to the tree right away. */
625	pNode = (PRTFUZZTGTRECNODE)RTMemAllocZ(sizeof(*pNode));
626	if (RT_LIKELY(pNode))
627	{
628	pNode->Core.Key = pThis->uChkSum;
629	RTListInit(&pNode->LstStates);
630	RTListAppend(&pNode->LstStates, &pThis->NdStates);
631	rc = RTSemRWRequestWrite(pTgtRec->hSemRwStates, RT_INDEFINITE_WAIT); AssertRC(rc);
632	bool fIns = RTAvlU64Insert(&pTgtRec->TreeStates, &pNode->Core);
633	if (!fIns)
634	{
635	/* Someone raced us, get the new node and append there. */
636	RTMemFree(pNode);
637	pNode = (PRTFUZZTGTRECNODE)RTAvlU64Get(&pTgtRec->TreeStates, pThis->uChkSum);
638	AssertPtr(pNode);
639	RTListAppend(&pNode->LstStates, &pThis->NdStates);
640	}
641	rc = RTSemRWReleaseWrite(pTgtRec->hSemRwStates); AssertRC(rc);
642	pThis->fInRecSet = true;
643	}
644	else
645	rc = VERR_NO_MEMORY;
646	}
647
648	if ( RT_SUCCESS(rc)
649	&& pThis->fInRecSet)
650	rc = rtFuzzTgtRecScanStateForNewEdges(pTgtRec, pThis);
651
652	return rc;
653	}
654
655
656	RTDECL(int) RTFuzzTgtStateAppendStdoutFromBuf(RTFUZZTGTSTATE hFuzzTgtState, const void *pvStdOut, size_t cbStdOut)
657	{
658	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
659	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
660	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
661
662	RT_NOREF(pvStdOut, cbStdOut);
663	return VERR_NOT_IMPLEMENTED;
664	}
665
666
667	RTDECL(int) RTFuzzTgtStateAppendStderrFromBuf(RTFUZZTGTSTATE hFuzzTgtState, const void *pvStdErr, size_t cbStdErr)
668	{
669	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
670	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
671	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
672
673	RT_NOREF(pvStdErr, cbStdErr);
674	return VERR_NOT_IMPLEMENTED;
675	}
676
677
678	RTDECL(int) RTFuzzTgtStateAppendStdoutFromPipe(RTFUZZTGTSTATE hFuzzTgtState, RTPIPE hPipe)
679	{
680	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
681	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
682	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
683
684	return rtFuzzTgtStdOutErrBufFillFromPipe(&pThis->StdOutBuf, hPipe);
685	}
686
687
688	RTDECL(int) RTFuzzTgtStateAppendStderrFromPipe(RTFUZZTGTSTATE hFuzzTgtState, RTPIPE hPipe)
689	{
690	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
691	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
692	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
693
694	return rtFuzzTgtStdOutErrBufFillFromPipe(&pThis->StdErrBuf, hPipe);
695	}
696
697
698	RTDECL(int) RTFuzzTgtStateAddSanCovReportFromFile(RTFUZZTGTSTATE hFuzzTgtState, const char *pszFilename)
699	{
700	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
701	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
702	AssertPtrReturn(pszFilename, VERR_INVALID_POINTER);
703	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
704
705	uint8_t *pbSanCov = NULL;
706	size_t cbSanCov = 0;
707	int rc = RTFileReadAll(pszFilename, (void **)&pbSanCov, &cbSanCov);
708	if (RT_SUCCESS(rc))
709	{
710	/* Check for the magic identifying whether the offsets are 32bit or 64bit. */
711	if ( cbSanCov >= sizeof(uint64_t)
712	&& ( (uint64_t )pbSanCov == SANCOV_MAGIC_64
713	\|\| (uint64_t )pbSanCov == SANCOV_MAGIC_32))
714	{
715	uint32_t cbCovOff = sizeof(uint32_t);
716	if ((uint64_t )pbSanCov == SANCOV_MAGIC_64)
717	cbCovOff = sizeof(uint64_t);
718
719	uint32_t cbCovDet = ASMAtomicReadU32(&pThis->pTgtRec->cbCovOff);
720	if (!cbCovDet)
721	{
722	/* Set the detected offset width. */
723	if (!ASMAtomicCmpXchgU32(&pThis->pTgtRec->cbCovOff, cbCovOff, 0))
724	{
725	/* Someone raced us, check again. */
726	cbCovDet = ASMAtomicReadU32(&pThis->pTgtRec->cbCovOff);
727	Assert(cbCovDet != 0);
728	}
729	else
730	cbCovDet = cbCovOff;
731	}
732
733	if (cbCovDet == cbCovOff)
734	{
735	/*
736	* Just copy the offsets into the state for now. Now further analysis
737	* is happening right now, just checking whether the content changed for
738	* the states.to spot newly discovered edges.
739	*/
740	pThis->cbCovReport = cbSanCov - sizeof(uint64_t);
741	pThis->pvCovReport = RTMemDup(pbSanCov + sizeof(uint64_t), pThis->cbCovReport);
742	if (!pThis->pvCovReport)
743	{
744	pThis->cbCovReport = 0;
745	rc = VERR_NO_MEMORY;
746	}
747	}
748	else
749	rc = VERR_INVALID_STATE; /* Mixing 32bit and 64bit offsets shouldn't happen, is not supported. */
750	}
751	else
752	rc = VERR_INVALID_STATE;
753	RTFileReadAllFree(pbSanCov, cbSanCov);
754	}
755	return rc;
756	}
757
758
759	RTDECL(int) RTFuzzTgtStateAddProcSts(RTFUZZTGTSTATE hFuzzTgtState, PCRTPROCSTATUS pProcSts)
760	{
761	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
762	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
763	AssertPtrReturn(pProcSts, VERR_INVALID_POINTER);
764	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
765
766	pThis->ProcSts = *pProcSts;
767	return VINF_SUCCESS;
768	}
769
770
771	RTDECL(int) RTFuzzTgtStateDumpToDir(RTFUZZTGTSTATE hFuzzTgtState, const char *pszDirPath)
772	{
773	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
774	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
775	AssertPtrReturn(pszDirPath, VERR_INVALID_POINTER);
776	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
777
778	int rc = VINF_SUCCESS;
779	char szPath[RTPATH_MAX];
780	if (pThis->StdOutBuf.cbBuf)
781	{
782	rc = RTPathJoin(szPath, sizeof(szPath), pszDirPath, "stdout"); AssertRC(rc);
783	if (RT_SUCCESS(rc))
784	rc = rtFuzzTgtStateStdOutErrBufWriteToFile(&pThis->StdOutBuf, &szPath[0]);
785	}
786
787	if ( RT_SUCCESS(rc)
788	&& pThis->StdErrBuf.cbBuf)
789	{
790	rc = RTPathJoin(szPath, sizeof(szPath), pszDirPath, "stderr"); AssertRC(rc);
791	if (RT_SUCCESS(rc))
792	rc = rtFuzzTgtStateStdOutErrBufWriteToFile(&pThis->StdErrBuf, &szPath[0]);
793	}
794
795	return rc;
796	}
797

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Runtime/common/fuzz/fuzz-target-recorder.cpp@ 100594

Download in other formats: