[libfuzzer] arbitrary function adapter

[aizatsky]

Summary

The adapter automates converting sequence of bytes into arbitrary arguments.

[aizatsky]

• implemented UnpackAndApply.

[aizatsky]

finished implementation.

[eugenis]

I'm not sure about the whole idea of splitting an array of bytes into multiple arguments. It seems like a lot of mutations in the input byte array would result in very non-local changes to the argument list, ex. inserting a byte at the beginning would shift all arguments to the right which could give them an entirely different meaning.

Would it be better to expose individual arguments to the fuzzing engine?

lib/Fuzzer/FuzzerFnAdapter.h

104 ↗

(On Diff #49693)

Space around "<" in "N<std::tuple_size" would greatly help readability.
Did you run this through clang-format?

[aizatsky]

I'm not sure about the whole idea of splitting an array of bytes into multiple arguments. It seems like a lot of mutations in the input byte array would result in very non-local changes to the argument list, ex. inserting a byte at the beginning would shift all arguments to the right which could give them an entirely different meaning.

Would it be better to expose individual arguments to the fuzzing engine?

I don't think libfuzzer would do something different if it new anything about arguments. Yes, it could shift, but you can look at it as creating an interesting permutation.

lib/Fuzzer/FuzzerFnAdapter.h

104 ↗

(On Diff #49693)

Yes, this file is 100% clang-formatted. I'll fix this line manually and try to remember to refix it after format.

lib/Fuzzer/test/AdapterUnittest.cpp

+#include "gtest/gtest.h"
+#include "gtest/gtest-spi.h"
+
+namespace fuzzer {
+
+template<typename T>
+size_t UnpackPrimitive(const uint8_t *Data, size_t Size, T* Value) {
+  if (Size < sizeof(T)) 
+    return Size;
+  *Value = *reinterpret_cast<const T*>(Data);
+  return Size - sizeof(T);
+}
+
+template<typename T>
+size_t UnpackSingle(const uint8_t *Data, size_t Size, T* Value);
+
+template<>
+size_t UnpackSingle<bool>(const uint8_t *Data, size_t Size, bool* Value) {
+  return UnpackPrimitive(Data, Size, Value);
+}
+
+template<>
+size_t UnpackSingle<int>(const uint8_t *Data, size_t Size, int* Value) {
+  return UnpackPrimitive(Data, Size, Value);
+}
+
+template<int N, typename TupleT>
+typename std::enable_if<N == std::tuple_size<TupleT>::value, bool>::type
+UnpackImpl(const uint8_t *Data, size_t Size, TupleT* Tuple) {
+  return true;
+}
+
+template<int N, typename TupleT>
+typename std::enable_if<N < std::tuple_size<TupleT>::value, bool>::type
+UnpackImpl(const uint8_t *Data, size_t Size, TupleT* Tuple) {
+  size_t NewSize = UnpackSingle(Data, Size, &std::get<N>(*Tuple));
+  if (NewSize == Size) {
+    return false;
+  }
+
+  return UnpackImpl<N + 1, TupleT>(Data + (Size - NewSize), NewSize, Tuple);
+}
+
+template<typename...Args>
+bool Unpack(const uint8_t *Data, size_t Size, std::tuple<Args...>* Tuple) {
+  return UnpackImpl<0, std::tuple<Args...>>(Data, Size, Tuple);
+}
+
+template<typename...Args>
+bool Unpack(std::tuple<Args...>* Tuple, std::initializer_list<uint8_t> data) {
+  std::vector<uint8_t> v(data);
+  return Unpack(v.data(), v.size(), Tuple);
+}
+
+TEST(Unpack, Bool) {
+  std::tuple<bool> T;
+  EXPECT_TRUE(Unpack(&T, {1}));
+  EXPECT_TRUE(std::get<0>(T));
+
+  EXPECT_TRUE(Unpack(&T, {0}));
+  EXPECT_FALSE(std::get<0>(T));
+
+  EXPECT_FALSE(Unpack(&T, {}));
+}
+
+TEST(Unpack, BoolBool) {
+  std::tuple<bool, bool> T;
+  EXPECT_TRUE(Unpack(&T, {1, 0}));
+  EXPECT_TRUE(std::get<0>(T));
+  EXPECT_FALSE(std::get<1>(T));
+
+  EXPECT_TRUE(Unpack(&T, {0, 1}));
+  EXPECT_FALSE(std::get<0>(T));
+  EXPECT_TRUE(std::get<1>(T));
+
+  EXPECT_FALSE(Unpack(&T, {}));
+  EXPECT_FALSE(Unpack(&T, {10}));
+}
+
+TEST(Unpack, BoolInt) {
+  std::tuple<bool, int> T;
+  EXPECT_TRUE(Unpack(&T, {1, 16, 2, 0, 0}));
+  EXPECT_TRUE(std::get<0>(T));
+  EXPECT_EQ(528, std::get<1>(T));
+
+  EXPECT_FALSE(Unpack(&T, {1, 2}));
+}
+
+template <typename T>
+struct function_traits {};
+
+template <typename ReturnType, typename... Args>
+struct function_traits<ReturnType(*)(Args...)> {
+  enum { Arity = sizeof...(Args) };
+  typedef std::tuple<Args...> ArgsTupleT;
+};
+
+template <typename Fn>
+bool UnpackArguments(Fn F, const uint8_t *Data, size_t Size, typename function_traits<Fn>::ArgsTupleT* Tuple) {
+  return Unpack(Data, Size, Tuple);
+}
+
+template <typename Fn>
+bool UnpackArguments(Fn F, typename function_traits<Fn>::ArgsTupleT* Tuple,
+    std::initializer_list<uint8_t> Data) {
+  std::vector<uint8_t> V(Data);
+  return UnpackArguments(F, V.data(), V.size(), Tuple);
+}
+
+void fnBool(bool b) {
+}
+
+TEST(UnpackArguments, Bool) {
+  std::tuple<bool> T;
+  EXPECT_TRUE(UnpackArguments(fnBool, &T, {1}));
+  EXPECT_TRUE(std::get<0>(T));
+}
+
+template<int ...>
+struct seq { };
+
+template<int N, int ...S>
+struct gens : gens<N-1, N-1, S...> { };
+
+template<int ...S>
+struct gens<0, S...> {
+    typedef seq<S...> type;
+};
+
+
+template<typename Fn, int...S>
+void ApplyImpl(Fn F, const typename function_traits<Fn>::ArgsTupleT& Params, seq<S...>) {
+  F(std::get<S>(Params)...);
+}
+
+template<typename Fn>
+void Apply(Fn F, const typename function_traits<Fn>::ArgsTupleT& Params) {
+  ApplyImpl(F, Params, typename gens<function_traits<Fn>::Arity>::type());
+}
+
+template <typename Fn>
+bool UnpackAndApply(Fn F, const uint8_t *Data, size_t Size) {
+  typename function_traits<Fn>::ArgsTupleT Tuple;
+  if (!UnpackArguments(F, Data, Size, &Tuple))
+    return false;
+
+  Apply(F, Tuple);
+  return true;
+}
+
+template <typename Fn>
+bool UnpackAndApply(Fn F, std::initializer_list<uint8_t> Data) {
+  std::vector<uint8_t> V(Data);
+  return UnpackAndApply(F, V.data(), V.size());
+}
+
+void fnInt(int i) {
+  EXPECT_EQ(42, i);
+}
+
+TEST(Apply, Int) {
+  EXPECT_FALSE(UnpackAndApply(fnInt, {}));
+  EXPECT_TRUE(UnpackAndApply(fnInt, {42, 0, 0, 0}));
+  EXPECT_NONFATAL_FAILURE(UnpackAndApply(fnInt, {10, 0, 0, 0}), "Expected: 42");
+}
+
+}  // namespace fuzzer

lib/Fuzzer/test/CMakeLists.txt

configure_lit_site_cfg(
   ${CMAKE_CURRENT_BINARY_DIR}/unit/lit.site.cfg
   )
 
 include_directories(..)
 include_directories(${LLVM_MAIN_SRC_DIR}/utils/unittest/googletest/include)
 
 add_executable(LLVMFuzzer-Unittest
   FuzzerUnittest.cpp
+  AdapterUnittest.cpp
   $<TARGET_OBJECTS:LLVMFuzzerNoMainObjects>
   )
 
 target_link_libraries(LLVMFuzzer-Unittest
   gtest
   gtest_main
   )