[LibFuzzer] test_single_input option to run a single test case.

[aizatsky]

Summary

-test_single_input flag specifies a file name with test data.

[kcc]

Also, please add a test to test/fuzzer.test, e.g. using LLVMFuzzer-SimpleTest

lib/Fuzzer/FuzzerDriver.cpp

284

this code does not use {} in such cases.

lib/Fuzzer/FuzzerFlags.def

69

I would call it "test_single_input".
Description:

Use specified file as a single test input end exit

[aizatsky]

• answering review
• test file

[aizatsky]

all done and added the test.

[kcc]

Good. Now I think this flag deserves to be in $LLVM/docs/LibFuzzer.rst

[aizatsky]

• added flag documentation

[kcc]

LGTM, please ask someone else to commit, I may not have time today.
(assuming you did ninja check-fuzzer)

[krasin]

Committed as r249096: http://reviews.llvm.org/rL249096

docs/LibFuzzer.rst

The most important flags are::
   help                                0 Print help.
   save_minimized_corpus               0 If 1, the minimized corpus is saved into the first input directory. Example: ./fuzzer -save_minimized_corpus=1 NEW_EMPTY_DIR OLD_CORPUS
   jobs                                0 Number of jobs to run. If jobs >= 1 we spawn this number of jobs in separate worker processes with stdout/stderr redirected to fuzz-JOB.log.
   workers                             0 Number of simultaneous worker processes to run the jobs. If zero, "min(jobs,NumberOfCpuCores()/2)" is used.
   sync_command                        0 Execute an external command "<sync_command> <test_corpus>" to synchronize the test corpus.
   sync_timeout                        600 Minimum timeout between syncs.
   use_traces                            0       Experimental: use instruction traces
   only_ascii                            0       If 1, generate only ASCII (isprint+isspace) inputs.
+  test_single_input                     ""      Use specified file content as test input. Test will be run only once. Useful for debugging a particular case.
 
 
 For the full list of flags run the fuzzer binary with ``-help=1``.
 
 Usage examples
 ==============
 
 Toy example

lib/Fuzzer/FuzzerDriver.cpp

 int ApplyTokens(const Fuzzer &F, const char *InputFilePath) {
   Unit U = FileToVector(InputFilePath);
   auto T = F.SubstituteTokens(U);
   T.push_back(0);
   Printf("%s", T.data());
   return 0;
 }
 
+int RunOneTest(Fuzzer *F, const char *InputFilePath) {
+  Unit U = FileToVector(InputFilePath);
+  F->ExecuteCallback(U);
+  return 0;
+}
+
 int FuzzerDriver(int argc, char **argv, UserCallback Callback) {
   FuzzerRandomLibc Rand(0);
   SimpleUserSuppliedFuzzer SUSF(&Rand, Callback);
   return FuzzerDriver(argc, argv, SUSF);
 }
 
 int FuzzerDriver(int argc, char **argv, UserSuppliedFuzzer &USF) {
   std::vector<std::string> Args(argv, argv + argc);
int FuzzerDriver(const std::vector<std::string> &Args,
   if (Flags.verbosity > 0 && !Options.Dictionary.empty())
     Printf("Dictionary: %zd entries\n", Options.Dictionary.size());
 
   Fuzzer F(USF, Options);
 
   if (Flags.apply_tokens)
     return ApplyTokens(F, Flags.apply_tokens);
 
+  if (Flags.test_single_input)
+    return RunOneTest(&F, Flags.test_single_input);
+
   unsigned Seed = Flags.seed;
   // Initialize Seed.
   if (Seed == 0)
     Seed = time(0) * 10000 + getpid();
   if (Flags.verbosity)
     Printf("Seed: %u\n", Seed);
   USF.GetRand().ResetSeed(Seed);
 

lib/Fuzzer/FuzzerFlags.def

FUZZER_FLAG_INT(report_slow_units, 10,
     "Report slowest units if they run for more than this number of seconds.")
 FUZZER_FLAG_INT(only_ascii, 0,
                 "If 1, generate only ASCII (isprint+isspace) inputs.")
 FUZZER_FLAG_STRING(dict, "Experimental. Use the dictionary file.")
 FUZZER_FLAG_INT(tbm_depth, 5, "Apply at most this number of consecutive"
                                "trace-based-mutations (tbm).")
 FUZZER_FLAG_INT(tbm_width, 5, "Apply at most this number of independent"
                                "trace-based-mutations (tbm)")
+FUZZER_FLAG_STRING(test_single_input, "Use specified file as test input.")
 No newline at end of file

lib/Fuzzer/FuzzerInternal.h

return duration_cast<seconds>(system_clock::now() - ProcessStartTime)
         .count();
   }
 
   size_t getTotalNumberOfRuns() { return TotalNumberOfRuns; }
 
   static void StaticAlarmCallback();
 
   Unit SubstituteTokens(const Unit &U) const;
+  void ExecuteCallback(const Unit &U);
 
  private:
   void AlarmCallback();
-  void ExecuteCallback(const Unit &U);
   void MutateAndTestOne(Unit *U);
   void ReportNewCoverage(size_t NewCoverage, const Unit &U);
   size_t RunOne(const Unit &U);
   void RunOneAndUpdateCorpus(Unit &U);
   size_t RunOneMaximizeTotalCoverage(const Unit &U);
   size_t RunOneMaximizeFullCoverageSet(const Unit &U);
   size_t RunOneMaximizeCoveragePairs(const Unit &U);
   void WriteToOutputCorpus(const Unit &U);

lib/Fuzzer/test/fuzzer.test

 CHECK: BINGO
 
 RUN: LLVMFuzzer-SimpleTest 2>&1 | FileCheck %s
+RUN: LLVMFuzzer-SimpleTest -test_single_input=%S/hi.txt 2>&1 | FileCheck %s 
 
 RUN: not LLVMFuzzer-InfiniteTest -timeout=2 2>&1 | FileCheck %s --check-prefix=InfiniteTest
 InfiniteTest: ALARM: working on the last Unit for
 InfiniteTest: Test unit written to timeout-
 
 RUN: not LLVMFuzzer-TimeoutTest -timeout=5 2>&1 | FileCheck %s --check-prefix=TimeoutTest
 TimeoutTest: ALARM: working on the last Unit for
 TimeoutTest: Test unit written to timeout-

lib/Fuzzer/test/hi.txt

+Hi!
 No newline at end of file