[libFuzzer] Extend the fuzz target intarface to allow -1 return value.

[kcc]

Summary

With this change, fuzz targets may choose to return -1
to indicate that the input should not be added to the corpus
regardless of the coverage it generated.

[kcc]

fix typo

[morehouse]

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

615–616

Since CBRes is used in the return, I think we can remove this void cast.

[kcc]

removed unneeded (void)CBRes;

compiler-rt/lib/fuzzer/FuzzerInternal.h

public:
 
   static void StaticAlarmCallback();
   static void StaticCrashSignalCallback();
   static void StaticExitCallback();
   static void StaticInterruptCallback();
   static void StaticFileSizeExceedCallback();
   static void StaticGracefulExitCallback();
 
-  void ExecuteCallback(const uint8_t *Data, size_t Size);
+  // Executes the target callback on {Data, Size} once.
+  // Returns false if the input was rejected by the target (target returned -1),
+  // and true otherwise.
+  bool ExecuteCallback(const uint8_t *Data, size_t Size);
   bool RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile = false,
               InputInfo *II = nullptr, bool ForceAddToCorpus = false,
               bool *FoundUniqFeatures = nullptr);
   void TPCUpdateObservedPCs();
 
   // Merge Corpora[1:] into Corpora[0].
   void Merge(const std::vector<std::string> &Corpora);
   void CrashResistantMergeInternalStep(const std::string &ControlFilePath,

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

 bool Fuzzer::RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile,
                     InputInfo *II, bool ForceAddToCorpus,
                     bool *FoundUniqFeatures) {
   if (!Size)
     return false;
   // Largest input length should be INT_MAX.
   assert(Size < std::numeric_limits<uint32_t>::max());
 
-  ExecuteCallback(Data, Size);
+  if(!ExecuteCallback(Data, Size)) return false;
   auto TimeOfUnit = duration_cast<microseconds>(UnitStopTime - UnitStartTime);
 
   UniqFeatureSetTmp.clear();
   size_t FoundUniqFeaturesOfII = 0;
   size_t NumUpdatesBefore = Corpus.NumFeatureUpdates();
   TPC.CollectFeatures([&](uint32_t Feature) {
     if (Corpus.AddFeature(Feature, static_cast<uint32_t>(Size), Options.Shrink))
       UniqFeatureSetTmp.push_back(Feature);
if (Size <= 64)
     return !memcmp(A, B, Size);
   // Compare first and last Limit/2 bytes.
   return !memcmp(A, B, Limit / 2) &&
          !memcmp(A + Size - Limit / 2, B + Size - Limit / 2, Limit / 2);
 }
 
 // This method is not inlined because it would cause a test to fail where it
 // is part of the stack unwinding. See D97975 for details.
-ATTRIBUTE_NOINLINE void Fuzzer::ExecuteCallback(const uint8_t *Data,
+ATTRIBUTE_NOINLINE bool Fuzzer::ExecuteCallback(const uint8_t *Data,
                                                 size_t Size) {
   TPC.RecordInitialStack();
   TotalNumberOfRuns++;
   assert(InFuzzingThread());
   // We copy the contents of Unit into a separate heap buffer
   // so that we reliably find buffer overflows in it.
   uint8_t *DataCopy = new uint8_t[Size];
   memcpy(DataCopy, Data, Size);
   if (EF->__msan_unpoison)
     EF->__msan_unpoison(DataCopy, Size);
   if (EF->__msan_unpoison_param)
     EF->__msan_unpoison_param(2);
   if (CurrentUnitData && CurrentUnitData != Data)
     memcpy(CurrentUnitData, Data, Size);
   CurrentUnitSize = Size;
+  int CBRes = 0;
   {
     ScopedEnableMsanInterceptorChecks S;
     AllocTracer.Start(Options.TraceMalloc);
     UnitStartTime = system_clock::now();
     TPC.ResetMaps();
     RunningUserCallback = true;
-    int Res = CB(DataCopy, Size);
+    CBRes = CB(DataCopy, Size);
     RunningUserCallback = false;
     UnitStopTime = system_clock::now();
-    (void)Res;
-    assert(Res == 0);
+    (void)CBRes;
+    assert(CBRes == 0 || CBRes == -1);
     HasMoreMallocsThanFrees = AllocTracer.Stop();
   }
   if (!LooseMemeq(DataCopy, Data, Size))
     CrashOnOverwrittenData();
   CurrentUnitSize = 0;
   delete[] DataCopy;
+  return CBRes == 0;
 }
 
 std::string Fuzzer::WriteToOutputCorpus(const Unit &U) {
   if (Options.OnlyASCII)
     assert(IsASCII(U));
   if (Options.OutputCorpus.empty())
     return "";
   std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U));
Printf("INFO: %zd/%zd inputs touch the focus function\n",
            Corpus.NumInputsThatTouchFocusFunction(), Corpus.size());
     if (!Options.DataFlowTrace.empty())
       Printf("INFO: %zd/%zd inputs have the Data Flow Trace\n",
              Corpus.NumInputsWithDataFlowTrace(),
              Corpus.NumInputsThatTouchFocusFunction());
   }
 
   if (Corpus.empty() && Options.MaxNumberOfRuns) {
-    Printf("ERROR: no interesting inputs were found. "
-           "Is the code instrumented for coverage? Exiting.\n");
-    exit(1);
+    Printf("WARNING: no interesting inputs were found so far. "
+           "Is the code instrumented for coverage?\n"
+           "This may also happen if the target rejected all inputs we tried so "
+           "far\n");
+    // The remaining logic requires that the corpus is not empty,
+    // so we add one fake input to the in-memory corpus.
+    Corpus.AddToCorpus({'\n'}, /*NumFeatures=*/1, /*MayDeleteFile=*/true,
+                       /*HasFocusFunction=*/false, /*NeverReduce=*/false,
+                       /*TimeOfUnit=*/duration_cast<microseconds>(0s), {0}, DFT,
+                       /*BaseII*/ nullptr);
   }
 }
 
 void Fuzzer::Loop(std::vector<SizedFile> &CorporaFiles) {
   auto FocusFunctionOrAuto = Options.FocusFunction;
   DFT.Init(Options.DataFlowTrace, &FocusFunctionOrAuto, CorporaFiles,
            MD.GetRand());
   TPC.SetFocusFunction(FocusFunctionOrAuto);

compiler-rt/test/fuzzer/Reject.cpp

+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+// Tests how the fuzzer rejects inputs if the target returns -1.
+#include <cstddef>
+#include <cstdint>
+
+static volatile int Sink;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  if (Size != 3)
+    return -1; // Reject anyting that's not 3 bytes long.
+  // Reject 'rej'.
+  if (Data[0] == 'r' && Data[1] == 'e' && Data[2] == 'j')
+    return -1;
+  // Accept 'acc'.
+  if (Data[0] == 'a' && Data[1] == 'c' && Data[2] == 'c') {
+    Sink = 1;
+    return 0;
+  }
+  return 0;
+}

compiler-rt/test/fuzzer/not-instrumented.test

 RUN: %cpp_compiler %S/NotinstrumentedTest.cpp -fsanitize-coverage=0 -o %t-NotinstrumentedTest-NoCoverage
-RUN: not %run %t-NotinstrumentedTest-NoCoverage 2>&1 | FileCheck %s --check-prefix=NO_COVERAGE
+RUN: %run %t-NotinstrumentedTest-NoCoverage -runs=100 2>&1 | FileCheck %s --check-prefix=NO_COVERAGE
 
-NO_COVERAGE: ERROR: no interesting inputs were found. Is the code instrumented for coverage? Exiting
+NO_COVERAGE: WARNING: no interesting inputs were found so far. Is the code instrumented for coverage?

compiler-rt/test/fuzzer/reject.test

+# Runs the Reject.cpp test,
+# ensures that the input 'acc' is present in the corpus,
+# and the input 'rej' is not.
+
+RUN: rm -rf %t-corpus && mkdir %t-corpus
+RUN: %cpp_compiler %S/Reject.cpp -o %t-Reject
+RUN: %run %t-Reject -runs=1000000 %t-corpus
+RUN: grep 'acc' %t-corpus/*
+RUN: not grep 'rej' %t-corpus/*

llvm/docs/LibFuzzer.rst

 does something interesting with these bytes using the API under test.
 Like this:
 
 .. code-block:: c++
 
   // fuzz_target.cc
   extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
     DoSomethingInterestingWithMyAPI(Data, Size);
-    return 0;  // Non-zero return values are reserved for future use.
+    return 0;  // Values other than 0 and -1 are reserved for future use.
   }
 
 Note that this fuzz target does not depend on libFuzzer in any way
 and so it is possible and even desirable to use it with other fuzzing engines
 e.g. AFL_ and/or Radamsa_.
 
 Some important things to remember about fuzz targets:
 

 `LLVMFuzzerTestOneInput`, and has the same signature.
 
 .. code-block:: c++
 
   extern "C" int LLVMFuzzerRunDriver(int *argc, char ***argv,
                     int (*UserCb)(const uint8_t *Data, size_t Size));
 
 
+Rejecting unwanted inpuits
+--------------------------
+
+It may be desirable to reject some inputs, i.e. to not add them to the corpus.
+
+For example, when fuzzing an API consisting of parsing and other logic,
+one may want to allow only those inputs into the corpus that parse successfully.
+
+If the fuzz target returns -1 on a given input,
+libFuzzer will not add that input top the corpus, regardless of what coverage
+it triggers.
+
+
+.. code-block:: c++
+
+  extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+    if (auto *Obj = ParseMe(Data, Size)) {
+      Obj->DoSomethingInteresting();
+      return 0;  // Accept. The input may be added to the corpus.
+    }
+    return -1;  // Reject; The input will not be added to the corpus.
+  }
 
 Leaks
 -----
 
 Binaries built with AddressSanitizer_ or LeakSanitizer_ will try to detect
 memory leaks at the process shutdown.
 For in-process fuzzing this is inconvenient
 since the fuzzer needs to report a leak with a reproducer as soon as the leaky