[fuzzer] Print reloaded file paths

[SweetVishnya]

Summary

In order to integrate libFuzzer with a dynamic symbolic execution tool
Sydr we need to print loaded file paths.

[SweetVishnya]

Should I reformat the code outside of my patch to make build green?

[morehouse]

What are you trying to do with symbolic execution that requires this patch?

In D100303#2688144, @SweetVishnya wrote:

Should I reformat the code outside of my patch to make build green?

Not a big deal either way, but feel free to delete the extra line if you want.

[SweetVishnya]

We integrated our dynamic symbolic execution tool (Sydr) with libFuzzer. We feed generated inputs from Sydr to libFuzzer corpus. We need to know loaded (good) inputs to:

1. Evaluate symbolic execution profit. We want to know which files were taken from Sydr.
2. We should delete files that were not loaded by libFuzzer to keep corpus neat.
3. Also, we want to know which files exactly made the profit (RELOAD -> +cov/+feature).

[SweetVishnya]

We mostly lean on fuzzer to detect crashes and estimate inputs. We want to delete discarded inputs. So, they won't be given to DSE as inputs.

[morehouse]

In D100303#2689282, @SweetVishnya wrote:

We integrated our dynamic symbolic execution tool (Sydr) with libFuzzer. We feed generated inputs from Sydr to libFuzzer corpus. We need to know loaded (good) inputs to:

1. Evaluate symbolic execution profit. We want to know which files were taken from Sydr.
2. We should delete files that were not loaded by libFuzzer to keep corpus neat.
3. Also, we want to know which files exactly made the profit (RELOAD -> +cov/+feature).

Very cool, makes sense. Any plans to open source this work? I would be very interested in your results.

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

418

426

Since we need the index anyway now, let's refactor the loop to use the index for both AdditionalCorpus and AdditionalCorpusPaths.

[SweetVishnya]

Fix all review issues

[SweetVishnya]

Very cool, makes sense. Any plans to open source this work? I would be very interested in your results.

It is a closed source project for now, but we have a paper [1] and going to write a new one this Fall. We still try to open source the underlying parts in open source projects like Triton, DynamoRIO, and now LLVM. We are still undecided about the future. Maybe we will open source it partially.

[1] https://arxiv.org/abs/2011.09269

[morehouse]

LGTM

compiler-rt/lib/fuzzer/FuzzerIO.h

 void WriteToFile(const uint8_t *Data, size_t Size, const std::string &Path);
 // Write Data.c_str() to the file without terminating null character.
 void WriteToFile(const std::string &Data, const std::string &Path);
 void WriteToFile(const Unit &U, const std::string &Path);
 
 void AppendToFile(const uint8_t *Data, size_t Size, const std::string &Path);
 void AppendToFile(const std::string &Data, const std::string &Path);
 
-void ReadDirToVectorOfUnits(const char *Path, Vector<Unit> *V,
-                            long *Epoch, size_t MaxSize, bool ExitOnError);
+void ReadDirToVectorOfUnits(const char *Path, Vector<Unit> *V, long *Epoch,
+                            size_t MaxSize, bool ExitOnError,
+                            Vector<std::string> *VPaths = 0);
 
 // Returns "Dir/FileName" or equivalent for the current OS.
 std::string DirPlusFile(const std::string &DirPath,
                         const std::string &FileName);
 
 // Returns the name of the dir, similar to the 'dirname' utility.
 std::string DirName(const std::string &FileName);
 

compiler-rt/lib/fuzzer/FuzzerIO.cpp

 void AppendToFile(const uint8_t *Data, size_t Size, const std::string &Path) {
   FILE *Out = fopen(Path.c_str(), "a");
   if (!Out)
     return;
   fwrite(Data, sizeof(Data[0]), Size, Out);
   fclose(Out);
 }
 
-void ReadDirToVectorOfUnits(const char *Path, Vector<Unit> *V,
-                            long *Epoch, size_t MaxSize, bool ExitOnError) {
+void ReadDirToVectorOfUnits(const char *Path, Vector<Unit> *V, long *Epoch,
+                            size_t MaxSize, bool ExitOnError,
+                            Vector<std::string> *VPaths) {
   long E = Epoch ? *Epoch : 0;
   Vector<std::string> Files;
   ListFilesInDirRecursive(Path, Epoch, &Files, /*TopDir*/true);
   size_t NumLoaded = 0;
   for (size_t i = 0; i < Files.size(); i++) {
     auto &X = Files[i];
     if (Epoch && GetEpoch(X) < E) continue;
     NumLoaded++;
     if ((NumLoaded & (NumLoaded - 1)) == 0 && NumLoaded >= 1024)
       Printf("Loaded %zd/%zd files from %s\n", NumLoaded, Files.size(), Path);
     auto S = FileToVector(X, MaxSize, ExitOnError);
-    if (!S.empty())
+    if (!S.empty()) {
       V->push_back(S);
+      if (VPaths)
+        VPaths->push_back(X);
+    }
   }
 }
-
 
 void GetSizedFilesFromDir(const std::string &Dir, Vector<SizedFile> *V) {
   Vector<std::string> Files;
   ListFilesInDirRecursive(Dir, 0, &Files, /*TopDir*/true);
   for (auto &File : Files)
     if (size_t Size = FileSize(File))
       V->push_back({File, Size});
 }

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

if (!Options.ExitOnItem.empty()) {
     }
   }
 }
 
 void Fuzzer::RereadOutputCorpus(size_t MaxSize) {
   if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec)
     return;
   Vector<Unit> AdditionalCorpus;
-  ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus,
-                         &EpochOfLastReadOfOutputCorpus, MaxSize,
-                         /*ExitOnError*/ false);
+  Vector<std::string> AdditionalCorpusPaths;
+  ReadDirToVectorOfUnits(
+      Options.OutputCorpus.c_str(), &AdditionalCorpus,
+      /*ExitOnError*/ false,
+      (Options.Verbosity >= 2 ? &AdditionalCorpusPaths : nullptr));
   if (Options.Verbosity >= 2)
     Printf("Reload: read %zd new units.\n", AdditionalCorpus.size());
   bool Reloaded = false;
-  for (auto &U : AdditionalCorpus) {
+  for (size_t i = 0; i != AdditionalCorpus.size(); ++i) {
+    auto &U = AdditionalCorpus[i];
     if (U.size() > MaxSize)
       U.resize(MaxSize);
     if (!Corpus.HasUnit(U)) {
       if (RunOne(U.data(), U.size())) {
         CheckExitOnSrcPosOrItem();
         Reloaded = true;
+        if (Options.Verbosity >= 2)
+          Printf("Reloaded %s\n", AdditionalCorpusPaths[i].c_str());
       }
     }
   }
   if (Reloaded)
     PrintStats("RELOAD");
 }
 
 void Fuzzer::PrintPulseAndReportSlowInput(const uint8_t *Data, size_t Size) {