fuzz-target-recorder.cpp@ 104549

最後變更在這個檔案從104549是 104549,由 vboxsync 提交於 11 月前
Runtime/common/fuzz: Some parfait warning fixes, bugref:3409
屬性 svn:eol-style 設為 `native` 屬性 svn:keywords 設為 `Author Date Id Revision`
檔案大小: 25.7 KB

行
1	/* $Id: fuzz-target-recorder.cpp 104549 2024-05-08 12:27:24Z vboxsync $ */
2	/** @file
3	* IPRT - Fuzzing framework API, target state recorder.
4	*/
5
6	/*
7	* Copyright (C) 2019-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.alldomusa.eu.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* The contents of this file may alternatively be used under the terms
26	* of the Common Development and Distribution License Version 1.0
27	* (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28	* in the VirtualBox distribution, in which case the provisions of the
29	* CDDL are applicable instead of those of the GPL.
30	*
31	* You may elect to license modified versions of this file under the
32	* terms and conditions of either the GPL or the CDDL or both.
33	*
34	* SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35	*/
36
37
38	/*********************************************************************************************************************************
39	* Header Files *
40	*********************************************************************************************************************************/
41	#include <iprt/fuzz.h>
42	#include "internal/iprt.h"
43
44	#include <iprt/asm.h>
45	#include <iprt/assert.h>
46	#include <iprt/avl.h>
47	#include <iprt/crc.h>
48	#include <iprt/ctype.h>
49	#include <iprt/err.h>
50	#include <iprt/file.h>
51	#include <iprt/list.h>
52	#include <iprt/mem.h>
53	#include <iprt/path.h>
54	#include <iprt/pipe.h>
55	#include <iprt/process.h>
56	#include <iprt/semaphore.h>
57	#include <iprt/string.h>
58
59
60
61	/*********************************************************************************************************************************
62	* Structures and Typedefs *
63	*********************************************************************************************************************************/
64	/** Pointer to the internal fuzzed target recorder state. */
65	typedef struct RTFUZZTGTRECINT *PRTFUZZTGTRECINT;
66
67
68	/**
69	* Stdout/Stderr buffer.
70	*/
71	typedef struct RTFUZZTGTSTDOUTERRBUF
72	{
73	/** Current amount buffered. */
74	size_t cbBuf;
75	/** Maxmium amount to buffer. */
76	size_t cbBufMax;
77	/** Base pointer to the data buffer. */
78	uint8_t *pbBase;
79	} RTFUZZTGTSTDOUTERRBUF;
80	/** Pointer to a stdout/stderr buffer. */
81	typedef RTFUZZTGTSTDOUTERRBUF *PRTFUZZTGTSTDOUTERRBUF;
82
83
84	/**
85	* Internal fuzzed target state.
86	*/
87	typedef struct RTFUZZTGTSTATEINT
88	{
89	/** Node for the list of states. */
90	RTLISTNODE NdStates;
91	/** Checksum for the state. */
92	uint64_t uChkSum;
93	/** Magic identifying the structure. */
94	uint32_t u32Magic;
95	/** Reference counter. */
96	volatile uint32_t cRefs;
97	/** The owning recorder instance. */
98	PRTFUZZTGTRECINT pTgtRec;
99	/** Flag whether the state is finalized. */
100	bool fFinalized;
101	/** Flag whether the state is contained in the recorded set. */
102	bool fInRecSet;
103	/** The stdout data buffer. */
104	RTFUZZTGTSTDOUTERRBUF StdOutBuf;
105	/** The stderr data buffer. */
106	RTFUZZTGTSTDOUTERRBUF StdErrBuf;
107	/** Process status. */
108	RTPROCSTATUS ProcSts;
109	/** Coverage report buffer. */
110	void *pvCovReport;
111	/** Size of the coverage report in bytes. */
112	size_t cbCovReport;
113	/** Number of traced edges. */
114	size_t cEdges;
115	} RTFUZZTGTSTATEINT;
116	/** Pointer to an internal fuzzed target state. */
117	typedef RTFUZZTGTSTATEINT *PRTFUZZTGTSTATEINT;
118
119
120	/**
121	* Recorder states node in the AVL tree.
122	*/
123	typedef struct RTFUZZTGTRECNODE
124	{
125	/** The AVL tree core (keyed by checksum). */
126	AVLU64NODECORE Core;
127	/** The list anchor for the individual states. */
128	RTLISTANCHOR LstStates;
129	} RTFUZZTGTRECNODE;
130	/** Pointer to a recorder states node. */
131	typedef RTFUZZTGTRECNODE *PRTFUZZTGTRECNODE;
132
133
134	/**
135	* Edge information node.
136	*/
137	typedef struct RTFUZZTGTEDGE
138	{
139	/** The AVL tree core (keyed by offset). */
140	AVLU64NODECORE Core;
141	/** Number of times the edge was hit. */
142	volatile uint64_t cHits;
143	} RTFUZZTGTEDGE;
144	/** Pointer to a edge information node. */
145	typedef RTFUZZTGTEDGE *PRTFUZZTGTEDGE;
146
147
148	/**
149	* Internal fuzzed target recorder state.
150	*/
151	typedef struct RTFUZZTGTRECINT
152	{
153	/** Magic value for identification. */
154	uint32_t u32Magic;
155	/** Reference counter. */
156	volatile uint32_t cRefs;
157	/** Flags passed when the recorder was created. */
158	uint32_t fRecFlags;
159	/** Semaphore protecting the states tree. */
160	RTSEMRW hSemRwStates;
161	/** The AVL tree for indexing the recorded state (keyed by stdout/stderr buffer size). */
162	AVLU64TREE TreeStates;
163	/** Semaphore protecting the edges tree. */
164	RTSEMRW hSemRwEdges;
165	/** The AVL tree for discovered edges when coverage reports are collected. */
166	AVLU64TREE TreeEdges;
167	/** Number of edges discovered so far. */
168	volatile uint64_t cEdges;
169	/** The discovered offset width. */
170	volatile uint32_t cbCovOff;
171	} RTFUZZTGTRECINT;
172
173
174	/** SanCov magic for 64bit offsets. */
175	#define SANCOV_MAGIC_64 UINT64_C(0xc0bfffffffffff64)
176	/** SanCov magic for 32bit offsets. */
177	#define SANCOV_MAGIC_32 UINT64_C(0xc0bfffffffffff32)
178
179
180	/*********************************************************************************************************************************
181	* Internal Functions *
182	*********************************************************************************************************************************/
183
184	/**
185	* Initializes the given stdout/stderr buffer.
186	*
187	* @param pBuf The buffer to initialize.
188	*/
189	static void rtFuzzTgtStdOutErrBufInit(PRTFUZZTGTSTDOUTERRBUF pBuf)
190	{
191	pBuf->cbBuf = 0;
192	pBuf->cbBufMax = 0;
193	pBuf->pbBase = NULL;
194	}
195
196
197	/**
198	* Frees all allocated resources in the given stdout/stderr buffer.
199	*
200	* @param pBuf The buffer to free.
201	*/
202	static void rtFuzzTgtStdOutErrBufFree(PRTFUZZTGTSTDOUTERRBUF pBuf)
203	{
204	if (pBuf->pbBase)
205	RTMemFree(pBuf->pbBase);
206	}
207
208
209	/**
210	* Fills the given stdout/stderr buffer from the given pipe.
211	*
212	* @returns IPRT status code.
213	* @param pBuf The buffer to fill.
214	* @param hPipeRead The pipe to read from.
215	*/
216	static int rtFuzzTgtStdOutErrBufFillFromPipe(PRTFUZZTGTSTDOUTERRBUF pBuf, RTPIPE hPipeRead)
217	{
218	int rc = VINF_SUCCESS;
219
220	size_t cbRead = 0;
221	size_t cbThisRead = 0;
222	do
223	{
224	cbThisRead = pBuf->cbBufMax - pBuf->cbBuf;
225	if (!cbThisRead)
226	{
227	/* Try to increase the buffer. */
228	uint8_t pbNew = (uint8_t )RTMemRealloc(pBuf->pbBase, pBuf->cbBufMax + _4K);
229	if (RT_LIKELY(pbNew))
230	{
231	pBuf->cbBufMax += _4K;
232	pBuf->pbBase = pbNew;
233	}
234	cbThisRead = pBuf->cbBufMax - pBuf->cbBuf;
235	}
236
237	if (cbThisRead)
238	{
239	rc = RTPipeRead(hPipeRead, pBuf->pbBase + pBuf->cbBuf, cbThisRead, &cbRead);
240	if (RT_SUCCESS(rc))
241	pBuf->cbBuf += cbRead;
242	}
243	else
244	rc = VERR_NO_MEMORY;
245	} while ( RT_SUCCESS(rc)
246	&& cbRead == cbThisRead);
247
248	return rc;
249	}
250
251
252	/**
253	* Writes the given buffer to the given file.
254	*
255	* @returns IPRT status code.
256	* @param pBuf The buffer to write.
257	* @param pszFilename Where to write the buffer.
258	*/
259	static int rtFuzzTgtStateStdOutErrBufWriteToFile(PRTFUZZTGTSTDOUTERRBUF pBuf, const char *pszFilename)
260	{
261	RTFILE hFile;
262	int rc = RTFileOpen(&hFile, pszFilename, RTFILE_O_CREATE \| RTFILE_O_WRITE \| RTFILE_O_DENY_NONE);
263	if (RT_SUCCESS(rc))
264	{
265	rc = RTFileWrite(hFile, pBuf->pbBase, pBuf->cbBuf, NULL);
266	AssertRC(rc);
267	RTFileClose(hFile);
268
269	if (RT_FAILURE(rc))
270	RTFileDelete(pszFilename);
271	}
272
273	return rc;
274	}
275
276
277	/**
278	* Scans the given target state for newly discovered edges in the coverage report.
279	*
280	* @returns IPRT status code.
281	* @param pThis The fuzzer target recorder instance.
282	* @param pTgtState The target state to check.
283	*/
284	static int rtFuzzTgtRecScanStateForNewEdges(PRTFUZZTGTRECINT pThis, PRTFUZZTGTSTATEINT pTgtState)
285	{
286	int rc = VINF_SUCCESS;
287
288	if (pTgtState->pvCovReport)
289	{
290	rc = RTSemRWRequestRead(pThis->hSemRwEdges, RT_INDEFINITE_WAIT); AssertRC(rc);
291
292	uint32_t cbCovOff = ASMAtomicReadU32(&pThis->cbCovOff);
293	Assert(cbCovOff != 0);
294
295	uint8_t pbCovCur = (uint8_t )pTgtState->pvCovReport;
296	size_t cEdgesLeft = pTgtState->cbCovReport / cbCovOff;
297	while (cEdgesLeft)
298	{
299	uint64_t offCur = cbCovOff == sizeof(uint64_t)
300	? (uint64_t )pbCovCur
301	: (uint32_t )pbCovCur;
302
303	PRTFUZZTGTEDGE pEdge = (PRTFUZZTGTEDGE)RTAvlU64Get(&pThis->TreeEdges, offCur);
304	if (!pEdge)
305	{
306	/* New edge discovered, allocate and add. */
307	rc = RTSemRWReleaseRead(pThis->hSemRwEdges); AssertRC(rc);
308
309	pEdge = (PRTFUZZTGTEDGE)RTMemAllocZ(sizeof(RTFUZZTGTEDGE));
310	if (RT_LIKELY(pEdge))
311	{
312	pEdge->Core.Key = offCur;
313	pEdge->cHits = 1;
314	rc = RTSemRWRequestWrite(pThis->hSemRwEdges, RT_INDEFINITE_WAIT); AssertRC(rc);
315
316	bool fIns = RTAvlU64Insert(&pThis->TreeEdges, &pEdge->Core);
317	if (!fIns)
318	{
319	/* Someone raced us, free and query again. */
320	RTMemFree(pEdge);
321	pEdge = (PRTFUZZTGTEDGE)RTAvlU64Get(&pThis->TreeEdges, offCur);
322	AssertPtr(pEdge);
323
324	ASMAtomicIncU64(&pEdge->cHits);
325	}
326	else
327	ASMAtomicIncU64(&pThis->cEdges);
328
329	rc = RTSemRWReleaseWrite(pThis->hSemRwEdges); AssertRC(rc);
330	rc = RTSemRWRequestRead(pThis->hSemRwEdges, RT_INDEFINITE_WAIT); AssertRC(rc);
331	}
332	else
333	{
334	rc = RTSemRWRequestRead(pThis->hSemRwEdges, RT_INDEFINITE_WAIT);
335	AssertRC(rc);
336
337	rc = VERR_NO_MEMORY;
338	break;
339	}
340	}
341	else
342	ASMAtomicIncU64(&pEdge->cHits);
343
344	pbCovCur += cbCovOff;
345	cEdgesLeft--;
346	}
347
348	int rc2 = RTSemRWReleaseRead(pThis->hSemRwEdges); AssertRC(rc2);
349	if ( RT_FAILURE(rc2)
350	&& RT_SUCCESS(rc))
351	rc = rc2;
352	}
353
354	return rc;
355	}
356
357
358	/**
359	* Destorys the given fuzzer target recorder freeing all allocated resources.
360	*
361	* @param pThis The fuzzer target recorder instance.
362	*/
363	static void rtFuzzTgtRecDestroy(PRTFUZZTGTRECINT pThis)
364	{
365	RT_NOREF(pThis);
366	}
367
368
369	/**
370	* Destroys the given fuzzer target state freeing all allocated resources.
371	*
372	* @param pThis The fuzzed target state instance.
373	*/
374	static void rtFuzzTgtStateDestroy(PRTFUZZTGTSTATEINT pThis)
375	{
376	pThis->u32Magic = ~(uint32_t)0; /** @todo Dead magic */
377	rtFuzzTgtStdOutErrBufFree(&pThis->StdOutBuf);
378	rtFuzzTgtStdOutErrBufFree(&pThis->StdErrBuf);
379	RTMemFree(pThis);
380	}
381
382
383	/**
384	* Compares two given target states, checking whether they match.
385	*
386	* @returns Flag whether the states are identical.
387	* @param pThis Target state 1.
388	* @param pThat Target state 2.
389	*/
390	static bool rtFuzzTgtStateDoMatch(PRTFUZZTGTSTATEINT pThis, PRTFUZZTGTSTATEINT pThat)
391	{
392	PRTFUZZTGTRECINT pTgtRec = pThis->pTgtRec;
393	Assert(pTgtRec == pThat->pTgtRec);
394
395	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDOUT)
396	&& ( pThis->StdOutBuf.cbBuf != pThat->StdOutBuf.cbBuf
397	\|\| ( pThis->StdOutBuf.cbBuf > 0
398	&& memcmp(pThis->StdOutBuf.pbBase, pThat->StdOutBuf.pbBase, pThis->StdOutBuf.cbBuf))))
399	return false;
400
401	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDERR)
402	&& ( pThis->StdErrBuf.cbBuf != pThat->StdErrBuf.cbBuf
403	\|\| ( pThis->StdErrBuf.cbBuf > 0
404	&& memcmp(pThis->StdErrBuf.pbBase, pThat->StdErrBuf.pbBase, pThis->StdErrBuf.cbBuf))))
405	return false;
406
407	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_PROCSTATUS)
408	&& memcmp(&pThis->ProcSts, &pThat->ProcSts, sizeof(RTPROCSTATUS)))
409	return false;
410
411	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_SANCOV)
412	&& ( pThis->cbCovReport != pThat->cbCovReport
413	\|\| ( pThis->cbCovReport > 0
414	&& memcmp(pThis->pvCovReport, pThat->pvCovReport, pThis->cbCovReport))))
415	return false;
416
417	return true;
418	}
419
420
421	RTDECL(int) RTFuzzTgtRecorderCreate(PRTFUZZTGTREC phFuzzTgtRec, uint32_t fRecFlags)
422	{
423	AssertPtrReturn(phFuzzTgtRec, VERR_INVALID_POINTER);
424	AssertReturn(!(fRecFlags & ~RTFUZZTGT_REC_STATE_F_VALID), VERR_INVALID_PARAMETER);
425
426	int rc;
427	PRTFUZZTGTRECINT pThis = (PRTFUZZTGTRECINT)RTMemAllocZ(sizeof(*pThis));
428	if (RT_LIKELY(pThis))
429	{
430	pThis->u32Magic = 0; /** @todo */
431	pThis->cRefs = 1;
432	pThis->TreeStates = NULL;
433	pThis->TreeEdges = NULL;
434	pThis->cbCovOff = 0;
435	pThis->fRecFlags = fRecFlags;
436
437	rc = RTSemRWCreate(&pThis->hSemRwStates);
438	if (RT_SUCCESS(rc))
439	{
440	rc = RTSemRWCreate(&pThis->hSemRwEdges);
441	if (RT_SUCCESS(rc))
442	{
443	*phFuzzTgtRec = pThis;
444	return VINF_SUCCESS;
445	}
446
447	RTSemRWDestroy(pThis->hSemRwStates);
448	}
449
450	RTMemFree(pThis);
451	}
452	else
453	rc = VERR_NO_MEMORY;
454
455	return rc;
456	}
457
458
459	RTDECL(uint32_t) RTFuzzTgtRecorderRetain(RTFUZZTGTREC hFuzzTgtRec)
460	{
461	PRTFUZZTGTRECINT pThis = hFuzzTgtRec;
462
463	AssertPtrReturn(pThis, UINT32_MAX);
464
465	uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
466	AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pThis));
467	return cRefs;
468	}
469
470
471	RTDECL(uint32_t) RTFuzzTgtRecorderRelease(RTFUZZTGTREC hFuzzTgtRec)
472	{
473	PRTFUZZTGTRECINT pThis = hFuzzTgtRec;
474	if (pThis == NIL_RTFUZZTGTREC)
475	return 0;
476	AssertPtrReturn(pThis, UINT32_MAX);
477
478	uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
479	AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pThis));
480	if (cRefs == 0)
481	rtFuzzTgtRecDestroy(pThis);
482	return cRefs;
483	}
484
485
486	RTDECL(int) RTFuzzTgtRecorderCreateNewState(RTFUZZTGTREC hFuzzTgtRec, PRTFUZZTGTSTATE phFuzzTgtState)
487	{
488	PRTFUZZTGTRECINT pThis = hFuzzTgtRec;
489	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
490	AssertPtrReturn(phFuzzTgtState, VERR_INVALID_POINTER);
491
492	int rc = VINF_SUCCESS;
493	PRTFUZZTGTSTATEINT pState = (PRTFUZZTGTSTATEINT)RTMemAllocZ(sizeof(*pState));
494	if (RT_LIKELY(pState))
495	{
496	pState->u32Magic = 0; /** @todo */
497	pState->cRefs = 1;
498	pState->pTgtRec = pThis;
499	pState->fFinalized = false;
500	rtFuzzTgtStdOutErrBufInit(&pState->StdOutBuf);
501	rtFuzzTgtStdOutErrBufInit(&pState->StdErrBuf);
502	*phFuzzTgtState = pState;
503	}
504	else
505	rc = VERR_NO_MEMORY;
506
507	return rc;
508	}
509
510
511	RTDECL(uint32_t) RTFuzzTgtStateRetain(RTFUZZTGTSTATE hFuzzTgtState)
512	{
513	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
514
515	AssertPtrReturn(pThis, UINT32_MAX);
516
517	uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
518	AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pThis));
519	return cRefs;
520	}
521
522
523	RTDECL(uint32_t) RTFuzzTgtStateRelease(RTFUZZTGTSTATE hFuzzTgtState)
524	{
525	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
526	if (pThis == NIL_RTFUZZTGTSTATE)
527	return 0;
528	AssertPtrReturn(pThis, UINT32_MAX);
529
530	uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
531	AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pThis));
532	if (cRefs == 0 && !pThis->fInRecSet)
533	rtFuzzTgtStateDestroy(pThis);
534	return cRefs;
535	}
536
537
538	RTDECL(int) RTFuzzTgtStateReset(RTFUZZTGTSTATE hFuzzTgtState)
539	{
540	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
541	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
542
543	/* Clear the buffers. */
544	pThis->StdOutBuf.cbBuf = 0;
545	pThis->StdErrBuf.cbBuf = 0;
546	RT_ZERO(pThis->ProcSts);
547	if (pThis->pvCovReport)
548	RTMemFree(pThis->pvCovReport);
549	pThis->pvCovReport = NULL;
550	pThis->fFinalized = false;
551	return VINF_SUCCESS;
552	}
553
554
555	RTDECL(int) RTFuzzTgtStateFinalize(RTFUZZTGTSTATE hFuzzTgtState)
556	{
557	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
558	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
559
560	/* Create the checksum. */
561	PRTFUZZTGTRECINT pTgtRec = pThis->pTgtRec;
562	uint64_t uChkSum = RTCrc64Start();
563	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDOUT)
564	&& pThis->StdOutBuf.cbBuf)
565	uChkSum = RTCrc64Process(uChkSum, pThis->StdOutBuf.pbBase, pThis->StdOutBuf.cbBuf);
566	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_STDERR)
567	&& pThis->StdErrBuf.cbBuf)
568	uChkSum = RTCrc64Process(uChkSum, pThis->StdErrBuf.pbBase, pThis->StdErrBuf.cbBuf);
569	if (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_PROCSTATUS)
570	uChkSum = RTCrc64Process(uChkSum, &pThis->ProcSts, sizeof(RTPROCSTATUS));
571	if ( (pTgtRec->fRecFlags & RTFUZZTGT_REC_STATE_F_SANCOV)
572	&& pThis->pvCovReport)
573	uChkSum = RTCrc64Process(uChkSum, pThis->pvCovReport, pThis->cbCovReport);
574
575	pThis->uChkSum = RTCrc64Finish(uChkSum);
576	pThis->fFinalized = true;
577	return VINF_SUCCESS;
578	}
579
580
581	RTDECL(int) RTFuzzTgtStateAddToRecorder(RTFUZZTGTSTATE hFuzzTgtState)
582	{
583	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
584	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
585
586	if (!pThis->fFinalized)
587	{
588	int rc = RTFuzzTgtStateFinalize(pThis);
589	if (RT_FAILURE(rc))
590	return rc;
591	}
592
593	PRTFUZZTGTRECINT pTgtRec = pThis->pTgtRec;
594
595	/* Try to find a node matching the stdout and sterr sizes first. */
596	int rc = RTSemRWRequestRead(pTgtRec->hSemRwStates, RT_INDEFINITE_WAIT); AssertRC(rc);
597	PRTFUZZTGTRECNODE pNode = (PRTFUZZTGTRECNODE)RTAvlU64Get(&pTgtRec->TreeStates, pThis->uChkSum);
598	if (pNode)
599	{
600	/* Traverse the states and check if any matches the stdout and stderr buffers exactly. */
601	PRTFUZZTGTSTATEINT pIt;
602	bool fMatchFound = false;
603	RTListForEach(&pNode->LstStates, pIt, RTFUZZTGTSTATEINT, NdStates)
604	{
605	if (rtFuzzTgtStateDoMatch(pThis, pIt))
606	{
607	fMatchFound = true;
608	break;
609	}
610	}
611
612	rc = RTSemRWReleaseRead(pTgtRec->hSemRwStates); AssertRC(rc);
613	if (!fMatchFound)
614	{
615	rc = RTSemRWRequestWrite(pTgtRec->hSemRwStates, RT_INDEFINITE_WAIT); AssertRC(rc);
616	RTListAppend(&pNode->LstStates, &pThis->NdStates);
617	rc = RTSemRWReleaseWrite(pTgtRec->hSemRwStates); AssertRC(rc);
618	pThis->fInRecSet = true;
619	}
620	else
621	rc = VERR_ALREADY_EXISTS;
622	}
623	else
624	{
625	rc = RTSemRWReleaseRead(pTgtRec->hSemRwStates); AssertRC(rc);
626
627	/* No node found, create new one and insert in to the tree right away. */
628	pNode = (PRTFUZZTGTRECNODE)RTMemAllocZ(sizeof(*pNode));
629	if (RT_LIKELY(pNode))
630	{
631	pNode->Core.Key = pThis->uChkSum;
632	RTListInit(&pNode->LstStates);
633	RTListAppend(&pNode->LstStates, &pThis->NdStates);
634	rc = RTSemRWRequestWrite(pTgtRec->hSemRwStates, RT_INDEFINITE_WAIT); AssertRC(rc);
635	bool fIns = RTAvlU64Insert(&pTgtRec->TreeStates, &pNode->Core);
636	if (!fIns)
637	{
638	/* Someone raced us, get the new node and append there. */
639	RTMemFree(pNode);
640	pNode = (PRTFUZZTGTRECNODE)RTAvlU64Get(&pTgtRec->TreeStates, pThis->uChkSum);
641	AssertPtr(pNode);
642	RTListAppend(&pNode->LstStates, &pThis->NdStates);
643	}
644	rc = RTSemRWReleaseWrite(pTgtRec->hSemRwStates); AssertRC(rc);
645	pThis->fInRecSet = true;
646	}
647	else
648	rc = VERR_NO_MEMORY;
649	}
650
651	if ( RT_SUCCESS(rc)
652	&& pThis->fInRecSet)
653	rc = rtFuzzTgtRecScanStateForNewEdges(pTgtRec, pThis);
654
655	return rc;
656	}
657
658
659	RTDECL(int) RTFuzzTgtStateAppendStdoutFromBuf(RTFUZZTGTSTATE hFuzzTgtState, const void *pvStdOut, size_t cbStdOut)
660	{
661	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
662	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
663	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
664
665	RT_NOREF(pvStdOut, cbStdOut);
666	return VERR_NOT_IMPLEMENTED;
667	}
668
669
670	RTDECL(int) RTFuzzTgtStateAppendStderrFromBuf(RTFUZZTGTSTATE hFuzzTgtState, const void *pvStdErr, size_t cbStdErr)
671	{
672	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
673	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
674	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
675
676	RT_NOREF(pvStdErr, cbStdErr);
677	return VERR_NOT_IMPLEMENTED;
678	}
679
680
681	RTDECL(int) RTFuzzTgtStateAppendStdoutFromPipe(RTFUZZTGTSTATE hFuzzTgtState, RTPIPE hPipe)
682	{
683	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
684	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
685	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
686
687	return rtFuzzTgtStdOutErrBufFillFromPipe(&pThis->StdOutBuf, hPipe);
688	}
689
690
691	RTDECL(int) RTFuzzTgtStateAppendStderrFromPipe(RTFUZZTGTSTATE hFuzzTgtState, RTPIPE hPipe)
692	{
693	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
694	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
695	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
696
697	return rtFuzzTgtStdOutErrBufFillFromPipe(&pThis->StdErrBuf, hPipe);
698	}
699
700
701	RTDECL(int) RTFuzzTgtStateAddSanCovReportFromFile(RTFUZZTGTSTATE hFuzzTgtState, const char *pszFilename)
702	{
703	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
704	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
705	AssertPtrReturn(pszFilename, VERR_INVALID_POINTER);
706	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
707
708	uint8_t *pbSanCov = NULL;
709	size_t cbSanCov = 0;
710	int rc = RTFileReadAll(pszFilename, (void **)&pbSanCov, &cbSanCov);
711	if (RT_SUCCESS(rc))
712	{
713	/* Check for the magic identifying whether the offsets are 32bit or 64bit. */
714	if ( cbSanCov >= sizeof(uint64_t)
715	&& ( (uint64_t )pbSanCov == SANCOV_MAGIC_64
716	\|\| (uint64_t )pbSanCov == SANCOV_MAGIC_32))
717	{
718	uint32_t cbCovOff = sizeof(uint32_t);
719	if ((uint64_t )pbSanCov == SANCOV_MAGIC_64)
720	cbCovOff = sizeof(uint64_t);
721
722	uint32_t cbCovDet = ASMAtomicReadU32(&pThis->pTgtRec->cbCovOff);
723	if (!cbCovDet)
724	{
725	/* Set the detected offset width. */
726	if (!ASMAtomicCmpXchgU32(&pThis->pTgtRec->cbCovOff, cbCovOff, 0))
727	{
728	/* Someone raced us, check again. */
729	cbCovDet = ASMAtomicReadU32(&pThis->pTgtRec->cbCovOff);
730	Assert(cbCovDet != 0);
731	}
732	else
733	cbCovDet = cbCovOff;
734	}
735
736	if (cbCovDet == cbCovOff)
737	{
738	/*
739	* Just copy the offsets into the state for now. Now further analysis
740	* is happening right now, just checking whether the content changed for
741	* the states.to spot newly discovered edges.
742	*/
743	pThis->cbCovReport = cbSanCov - sizeof(uint64_t);
744	pThis->pvCovReport = RTMemDup(pbSanCov + sizeof(uint64_t), pThis->cbCovReport);
745	if (!pThis->pvCovReport)
746	{
747	pThis->cbCovReport = 0;
748	rc = VERR_NO_MEMORY;
749	}
750	}
751	else
752	rc = VERR_INVALID_STATE; /* Mixing 32bit and 64bit offsets shouldn't happen, is not supported. */
753	}
754	else
755	rc = VERR_INVALID_STATE;
756	RTFileReadAllFree(pbSanCov, cbSanCov);
757	}
758	return rc;
759	}
760
761
762	RTDECL(int) RTFuzzTgtStateAddProcSts(RTFUZZTGTSTATE hFuzzTgtState, PCRTPROCSTATUS pProcSts)
763	{
764	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
765	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
766	AssertPtrReturn(pProcSts, VERR_INVALID_POINTER);
767	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
768
769	pThis->ProcSts = *pProcSts;
770	return VINF_SUCCESS;
771	}
772
773
774	RTDECL(int) RTFuzzTgtStateDumpToDir(RTFUZZTGTSTATE hFuzzTgtState, const char *pszDirPath)
775	{
776	PRTFUZZTGTSTATEINT pThis = hFuzzTgtState;
777	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
778	AssertPtrReturn(pszDirPath, VERR_INVALID_POINTER);
779	AssertReturn(!pThis->fFinalized, VERR_WRONG_ORDER);
780
781	int rc = VINF_SUCCESS;
782	char szPath[RTPATH_MAX];
783	if (pThis->StdOutBuf.cbBuf)
784	{
785	rc = RTPathJoin(szPath, sizeof(szPath), pszDirPath, "stdout"); AssertRC(rc);
786	if (RT_SUCCESS(rc))
787	rc = rtFuzzTgtStateStdOutErrBufWriteToFile(&pThis->StdOutBuf, &szPath[0]);
788	}
789
790	if ( RT_SUCCESS(rc)
791	&& pThis->StdErrBuf.cbBuf)
792	{
793	rc = RTPathJoin(szPath, sizeof(szPath), pszDirPath, "stderr"); AssertRC(rc);
794	if (RT_SUCCESS(rc))
795	rc = rtFuzzTgtStateStdOutErrBufWriteToFile(&pThis->StdErrBuf, &szPath[0]);
796	}
797
798	return rc;
799	}
800

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/VBox/Runtime/common/fuzz/fuzz-target-recorder.cpp@ 104549

以其他格式下載: