[LibFuzzer] Declare and use sanitizer functions in `fuzzer::ExternalFunctions`

[delcypher]

Summary

[LibFuzzer] Declare and use sanitizer functions in fuzzer::ExternalFunctions

This fixes linking problems on OSX.

Unfortunately it turns out we need to use an instance of the
fuzzer::ExternalFunctions object in several places so this
commit also replaces all instances with a single global instance.

It also turns out initializing a global fuzzer::ExternalFunctions
before main is entered (i.e. letting the object be initialised by the
global initializers) is not safe (on OSX the call to Printf() in the
CTOR crashes if it is called from a global initializer) so we instead
have a global fuzzer::ExternalFunctions* and initialize it inside
FuzzerDriver().

Multiple unit tests depend also depend on the
fuzzer::ExternalFunctions* global so each unit test that needs
it initializes it for itself.

[delcypher]

@kcc: There are a bunch of problems here that need resolving

• I've hacked the CHECK_WEAK_API_FUNCTION macro so that the tests pass on Linux but this is really bad. I'm thinking that it would be better to change the last argument `EXT_FUNC to be an enum value (enum { OK, WARN, ERROR};) to indicate how a missing function should be handled and then change the implementations of ExternalFunction::ExternalFunction` to abort as appropriate. That way we could get rid of the CHECK_WEAK_API_FUNCTION macro.

• I'm not 100% sure which external functions are required and which are just nice to have. I've just made educated guesses about what to warn about but I'm not sure If I have this right.

• There's still a linking issue on OSX. The LLVMFuzzer-FourIndependentBranchesTest-TracePC test (and probably other tests) fail to link due to having undefined reference to _sanitizer_cov_trace_pc_indir. I'm guessing LibFuzzer ought to provide an implementation but I'm surprised we don't hit this on Linux.

Thoughts?

[delcypher]

• There's still a linking issue on OSX. The LLVMFuzzer-FourIndependentBranchesTest-TracePC test (and probably other tests) fail to link due to having undefined reference to _sanitizer_cov_trace_pc_indir. I'm guessing LibFuzzer ought to provide an implementation but I'm surprised we don't hit this on Linux.

Actually I guess the difference here is the use of libcxx on OSX based on the error message from the linker

[100%] Linking CXX executable ../LLVMFuzzer-FourIndependentBranchesTest-TracePC
Undefined symbols for architecture x86_64:
  "___sanitizer_cov_trace_pc_indir", referenced from:
      std::__1::basic_ostream<char, std::__1::char_traits<char> >& std::__1::__put_character_sequence<char, std::__1::char_traits
<char> >(std::__1::basic_ostream<char, std::__1::char_traits<char> >&, char const*, unsigned long) in FourIndependentBranchesTest
.cpp.o
      std::__1::ostreambuf_iterator<char, std::__1::char_traits<char> > std::__1::__pad_and_output<char, std::__1::char_traits<ch
ar> >(std::__1::ostreambuf_iterator<char, std::__1::char_traits<char> >, char const*, char const*, char const*, std::__1::ios_bas
e&, char) in FourIndependentBranchesTest.cpp.o
ld: symbol(s) not found for architecture x86_64

[kcc]

lib/Fuzzer/FuzzerExtFunctions.def

24

This last boolean argument is hard to reason about.
BTW, I don't know why you need it at all.
We must be able to link w./o any of those symbols (see test/UninstrumentedTest.cpp)

lib/Fuzzer/FuzzerIO.cpp

126

Ouch. That's becoming too annoying.
Let's just have a singleton global object "fuzzer::ExternalFunctions *EF" that we initialized at startup
and delete all private instances.

lib/Fuzzer/FuzzerLoop.cpp

49

what do you want to fix here?

[delcypher]

lib/Fuzzer/FuzzerExtFunctions.def

24

The meaning of the last boolean argument is whether or not to emit a warning during initialization of ExternalFunctions if the function cannot be found at runtime.

What I was suggesting is that this last argument could be turned into an enum to indicate what to do when function cannot be found at runtime during initialization. This could be one of three things.

• Do Nothing
• Emit a warning
• Emit an error and exit

This does not affect the compile time linking, it affects what happens at run time.

What this would change is that we would immediately exit at runtime if the essential functions are not available rather than waiting until they are called (the currently behaviour). This would then allow the CHECK_WEAK_API_FUNCTION macro to be removed.

How do you feel about this proposal?

lib/Fuzzer/FuzzerLoop.cpp

49

• The name of the macro is now wrong for OSX (we don't use weak symbols)
• The suggestion I have made to check for function availability in the ExternalFunctions CTOR means we could get rid of this macro entirely.
• What I've done is a hack to keep the tests passing because the stringified name #fn gets given to MissingWeakApiFunction(const char *FnName) I had to have users of the macro do

CHECK_WEAK_API_FUNCTION(__sanitizer_reset_coverage)

rather than

CHECK_WEAK_API_FUNCTION(EF.__sanitizer_reset_coverage)

[kcc]

lib/Fuzzer/FuzzerExtFunctions.def

24

At the very least that's a change in behavior.
Try not to combine refactoring and changing the behavior it complicates reasoning during the code review.
If you will this functionality is needed let's do it separately.
In this change, please just drop this.

lib/Fuzzer/FuzzerLoop.cpp

49

Remove the FIXME for now.

[delcypher]

lib/Fuzzer/FuzzerIO.cpp

126

Do you want this change to be in this patch or a subsequent patch?

[kcc]

lib/Fuzzer/FuzzerIO.cpp

126

I don't want you to introduce one more EF here, so yes, in this patch.

[delcypher]

Rework patch.

[delcypher]

@kcc: Sorry for the delay in reworking the patch. I've tested this on Linux and OSX. The tests continue to pass on Linux and on OSX all the tests successfully compile and link although they don't all pass.

[kcc]

lib/Fuzzer/FuzzerDriver.cpp

272 ↗

(On Diff #59799)

remove the comment, it makes little sense to me

428 ↗

(On Diff #59799)

make this ExternalFunctions *EF

lib/Fuzzer/FuzzerExtFunctions.h

23 ↗

(On Diff #59799)

Leave the CTOR, initialize with

EF = new ...

[delcypher]

lib/Fuzzer/FuzzerDriver.cpp

272 ↗

(On Diff #59799)

The comment is stating something fairly important. It's stating that Init should be called after main(). It how is also stated in the ExternalFunctions.h header so I guess this is probably redundant. I'll remove it.

[delcypher]

lib/Fuzzer/FuzzerDriver.cpp

428 ↗

(On Diff #59799)

We could also use std::unique_ptr<ExternalFunctions> instead or are you fine with an explicit delete?

[kcc]

lib/Fuzzer/FuzzerDriver.cpp

428 ↗

(On Diff #59799)

I am *not* ok with std::unique_ptr<ExternalFunctions>
And there is no need for an explicit delete.
Just

EF = new  .... ;

in main is enough

In tests you may have new/delete or even

std::unique_ptr<ExternalFunctions> t;
EF = t.get()

[delcypher]

lib/Fuzzer/FuzzerDriver.cpp

428 ↗

(On Diff #59799)

I am *not* ok with std::unique_ptr<ExternalFunctions>
And there is no need for an explicit delete.
Just

EF = new .... ;
in main is enough

I don't understand. Why do you want a deliberate leak?

In tests you may have new/delete or even

std::unique_ptr<ExternalFunctions> t;
EF = t.get()

Again I don't understand. Why would I want to assign nullptr (that is what t.get() would return here) to EF?

[kcc]

lib/Fuzzer/FuzzerDriver.cpp

428 ↗

(On Diff #59799)

This won't be a leak. It will be a global variable which is alive throughout the process.

I meant, in test you could either do

FE = new ...
 ....
 delete EF;
 EF = nullptr; // just in case

or, better

       
std::unique_ptr<ExternalFunctions> t(new ...);
EF = t.get()
...
EF = nullptr;  // just tin case

[delcypher]

• Use global pointer for EF
• Add main() to unit tests to initialize EF.

[kcc]

lib/Fuzzer/FuzzerExtFunctions.h

21 ↗

(On Diff #59831)

Why you can't call this before main()?
Just curious.

lib/Fuzzer/test/FuzzerUnittest.cpp

430 ↗

(On Diff #59831)

Are you sure you need to do that?
Have you seen an lsan report of you don't?

When you do

global_var = new ...

there is no leak from lsan POV because the memory is reachable.

[delcypher]

lib/Fuzzer/FuzzerExtFunctions.h

21 ↗

(On Diff #59831)

It is probably possible to call somewhere before main() but on OSX when running the uninstrumented test ExternalFunctions::ExternalFunctions tries to use the Printf() function to report that a function is missing. It seems the Printf() call crashes (trying to access an invalid address) when it is invoked from a global initializer. The crash happens when calling vfprintf()

I suspect something wasn't correctly initialized when the Printf() was called leading to the crash. So for safety I thought it best to leave a note saying not to try calling it before entering main().

lib/Fuzzer/test/FuzzerUnittest.cpp

430 ↗

(On Diff #59831)

@kcc: Good catch.

Originally the implementation of main() was like this

int main(int argc, char **argv) {
  fuzzer::EF = new ExternalFunctions();
  ::testing::InitGoogleTest(&argc, argv);
  int result =  RUN_ALL_TESTS();
  fuzzer::EF = nullptr;
  return result;
}

In this implementation LSan will fire because I set fuzzer::EF to nullptr. Because of that I started using a std::unique_ptr<ExternalFunctions> but then later I simplified the main() function to not set fuzzer::EF to nullptr. After doing that I forgot to check if the std::unique_ptr<ExternalFunction> was still needed. It isn't really needed anymore.

Would you like me to remove it?

[delcypher]

• Rebase to support (r272054) @aizatsky.

[kcc]

lib/Fuzzer/FuzzerExtFunctions.h

21 ↗

(On Diff #59961)

That's quite strange, but ok...

lib/Fuzzer/test/FuzzerUnittest.cpp

430 ↗

(On Diff #59961)

Of course, if you do

EF = new ... 
 ...
EF = nullptr

lsan will bark.

Ideally, I want to not add main()
Can you create and destroy EF in every test that needs it?

std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
EF = t.get();
...

[delcypher]

• Modify each unittest that needs fuzzer::EF to be initialized to initialize it instead of implementing our main() function.

[kcc]

LGTM

[delcypher]

In D20943#451689, @kcc wrote:

LGTM

Great! With this patch all link failures under OSX are gone :)

lib/Fuzzer/FuzzerExtFunctions.def

 //===----------------------------------------------------------------------===//
 
 // Optional user functions
 EXT_FUNC(LLVMFuzzerInitialize, int, (int *argc, char ***argv), false);
 EXT_FUNC(LLVMFuzzerCustomMutator, size_t,
          (uint8_t * Data, size_t Size, size_t MaxSize, unsigned int Seed),
          false);
 
-// TODO: Sanitizer functions
+// Sanitizer functions
+EXT_FUNC(__sanitizer_print_stack_trace, void, (), true);
+EXT_FUNC(__sanitizer_reset_coverage, void, (), true);
+EXT_FUNC(__sanitizer_get_total_unique_caller_callee_pairs, size_t, (), false);
+EXT_FUNC(__sanitizer_get_total_unique_coverage, size_t, (), true);
+EXT_FUNC(__sanitizer_set_death_callback, void, (void (*)(void)), false);
+EXT_FUNC(__sanitizer_get_number_of_counters, size_t, (), true);
+EXT_FUNC(__sanitizer_update_counter_bitset_and_clear_counters, uintptr_t,
+  (uint8_t*), true);
+EXT_FUNC(__sanitizer_get_coverage_pc_buffer, uintptr_t, (uintptr_t**), true);
+EXT_FUNC(__lsan_enable, void, (), false);
+EXT_FUNC(__lsan_disable, void, (), false);
+EXT_FUNC(__lsan_do_recoverable_leak_check, int, (), false);
+EXT_FUNC(__sanitizer_print_memory_profile, int, (size_t), false);
+EXT_FUNC(__sanitizer_set_report_fd, void, (void*), false);

lib/Fuzzer/FuzzerIO.cpp

 //===- FuzzerIO.cpp - IO utils. -------------------------------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 // IO functions.
 //===----------------------------------------------------------------------===//
+#include "FuzzerExtFunctions.h"
 #include "FuzzerInternal.h"
 #include <iterator>
 #include <fstream>
 #include <dirent.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
 #include <cstdarg>
 #include <cstdio>
 
-extern "C" {
-__attribute__((weak)) void __sanitizer_set_report_fd(void *);
-}
-
 namespace fuzzer {
 
 static FILE *OutputFile = stderr;
 
 bool IsFile(const std::string &Path) {
   struct stat St;
   if (stat(Path.c_str(), &St))
     return false;

 }
 
 void DupAndCloseStderr() {
   int OutputFd = dup(2);
   if (OutputFd > 0) {
     FILE *NewOutputFile = fdopen(OutputFd, "w");
     if (NewOutputFile) {
       OutputFile = NewOutputFile;
-      if (__sanitizer_set_report_fd)
-        __sanitizer_set_report_fd(reinterpret_cast<void*>(OutputFd));
+      fuzzer::ExternalFunctions EF;
+      if (EF.__sanitizer_set_report_fd)
+        EF.__sanitizer_set_report_fd(reinterpret_cast<void*>(OutputFd));
       close(2);
     }
   }
 }
 
 void CloseStdout() { close(1); }
 
 void Printf(const char *Fmt, ...) {
   va_list ap;
   va_start(ap, Fmt);
   vfprintf(OutputFile, Fmt, ap);
   va_end(ap);
   fflush(OutputFile);
 }
 
 }  // namespace fuzzer

lib/Fuzzer/FuzzerLoop.cpp

 #define NO_SANITIZE_MEMORY
 #if defined(__has_feature)
 #if __has_feature(memory_sanitizer)
 #undef NO_SANITIZE_MEMORY
 #define NO_SANITIZE_MEMORY __attribute__((no_sanitize_memory))
 #endif
 #endif
 
-extern "C" {
-// Re-declare some of the sanitizer functions as "weak" so that
-// libFuzzer can be linked w/o the sanitizers and sanitizer-coverage
-// (in which case it will complain at start-up time).
-__attribute__((weak)) void __sanitizer_print_stack_trace();
-__attribute__((weak)) void __sanitizer_reset_coverage();
-__attribute__((weak)) size_t __sanitizer_get_total_unique_caller_callee_pairs();
-__attribute__((weak)) size_t __sanitizer_get_total_unique_coverage();
-__attribute__((weak)) void
-__sanitizer_set_death_callback(void (*callback)(void));
-__attribute__((weak)) size_t __sanitizer_get_number_of_counters();
-__attribute__((weak)) uintptr_t
-__sanitizer_update_counter_bitset_and_clear_counters(uint8_t *bitset);
-__attribute__((weak)) uintptr_t
-__sanitizer_get_coverage_pc_buffer(uintptr_t **data);
-
-__attribute__((weak)) void __sanitizer_malloc_hook(void *ptr, size_t size);
-__attribute__((weak)) void __sanitizer_free_hook(void *ptr);
-__attribute__((weak)) void __lsan_enable();
-__attribute__((weak)) void __lsan_disable();
-__attribute__((weak)) int __lsan_do_recoverable_leak_check();
-__attribute__((weak)) int __sanitizer_print_memory_profile(size_t);
-}
-
 namespace fuzzer {
 static const size_t kMaxUnitSizeToPrint = 256;
 static const size_t TruncateMaxRuns = 1000;
 
 thread_local bool Fuzzer::IsMyThread;
 
 static void MissingWeakApiFunction(const char *FnName) {
   Printf("ERROR: %s is not defined. Exiting.\n"
          "Did you use -fsanitize-coverage=... to build your code?\n",
          FnName);
   exit(1);
 }
 
 #define CHECK_WEAK_API_FUNCTION(fn)                                            \
   do {                                                                         \
-    if (!fn)                                                                   \
+    /* FIXME: What a hack!*/                                                   \
+    if (!EF.fn)                                                                \
       MissingWeakApiFunction(#fn);                                             \
   } while (false)
 
 // Only one Fuzzer per process.
 static Fuzzer *F;
 
 struct CoverageController {
-  static void Reset() {
+  static void Reset(const ExternalFunctions &EF) {
     CHECK_WEAK_API_FUNCTION(__sanitizer_reset_coverage);
-    __sanitizer_reset_coverage();
+    EF.__sanitizer_reset_coverage();
     PcMapResetCurrent();
   }
 
-  static void ResetCounters(const Fuzzer::FuzzingOptions &Options) {
+  static void ResetCounters(const Fuzzer::FuzzingOptions &Options,
+                            const ExternalFunctions &EF) {
     if (Options.UseCounters) {
-      __sanitizer_update_counter_bitset_and_clear_counters(0);
+      EF.__sanitizer_update_counter_bitset_and_clear_counters(0);
     }
   }
 
   static void Prepare(const Fuzzer::FuzzingOptions &Options,
-                      Fuzzer::Coverage *C) {
+                      Fuzzer::Coverage *C, const ExternalFunctions &EF) {
     if (Options.UseCounters) {
-      size_t NumCounters = __sanitizer_get_number_of_counters();
+      size_t NumCounters = EF.__sanitizer_get_number_of_counters();
       C->CounterBitmap.resize(NumCounters);
     }
   }
 
   // Records data to a maximum coverage tracker. Returns true if additional
   // coverage was discovered.
   static bool RecordMax(const Fuzzer::FuzzingOptions &Options,
-                        Fuzzer::Coverage *C) {
+                        Fuzzer::Coverage *C, const ExternalFunctions &EF) {
     bool Res = false;
 
-    uint64_t NewBlockCoverage = __sanitizer_get_total_unique_coverage();
+    uint64_t NewBlockCoverage = EF.__sanitizer_get_total_unique_coverage();
     if (NewBlockCoverage > C->BlockCoverage) {
       Res = true;
       C->BlockCoverage = NewBlockCoverage;
     }
 
     if (Options.UseIndirCalls &&
-        __sanitizer_get_total_unique_caller_callee_pairs) {
+        EF.__sanitizer_get_total_unique_caller_callee_pairs) {
       uint64_t NewCallerCalleeCoverage =
-          __sanitizer_get_total_unique_caller_callee_pairs();
+          EF.__sanitizer_get_total_unique_caller_callee_pairs();
       if (NewCallerCalleeCoverage > C->CallerCalleeCoverage) {
         Res = true;
         C->CallerCalleeCoverage = NewCallerCalleeCoverage;
       }
     }
 
     if (Options.UseCounters) {
       uint64_t CounterDelta =
-          __sanitizer_update_counter_bitset_and_clear_counters(
+          EF.__sanitizer_update_counter_bitset_and_clear_counters(
               C->CounterBitmap.data());
       if (CounterDelta > 0) {
         Res = true;
         C->CounterBitmapBits += CounterDelta;
       }
     }
 
     uint64_t NewPcMapBits = PcMapMergeInto(&C->PCMap);
     if (NewPcMapBits > C->PcMapBits) {
       Res = true;
       C->PcMapBits = NewPcMapBits;
     }
 
     uintptr_t *CoverageBuf;
-    uint64_t NewPcBufferLen = __sanitizer_get_coverage_pc_buffer(&CoverageBuf);
+    uint64_t NewPcBufferLen =
+        EF.__sanitizer_get_coverage_pc_buffer(&CoverageBuf);
     if (NewPcBufferLen > C->PcBufferLen) {
       Res = true;
       C->PcBufferLen = NewPcBufferLen;
     }
 
     return Res;
   }
 };

 
 void Fuzzer::LazyAllocateCurrentUnitData() {
   if (CurrentUnitData || Options.MaxLen == 0) return;
   CurrentUnitData = new uint8_t[Options.MaxLen];
 }
 
 void Fuzzer::SetDeathCallback() {
   CHECK_WEAK_API_FUNCTION(__sanitizer_set_death_callback);
-  __sanitizer_set_death_callback(StaticDeathCallback);
+  EF.__sanitizer_set_death_callback(StaticDeathCallback);
 }
 
 void Fuzzer::StaticDeathCallback() {
   assert(F);
   F->DeathCallback();
 }
 
 void Fuzzer::DumpCurrentUnit(const char *Prefix) {

 
 void Fuzzer::StaticInterruptCallback() {
   assert(F);
   F->InterruptCallback();
 }
 
 void Fuzzer::CrashCallback() {
   Printf("==%d== ERROR: libFuzzer: deadly signal\n", GetPid());
-  if (__sanitizer_print_stack_trace)
-    __sanitizer_print_stack_trace();
+  if (EF.__sanitizer_print_stack_trace)
+    EF.__sanitizer_print_stack_trace();
   Printf("NOTE: libFuzzer has rudimentary signal handlers.\n"
          "      Combine libFuzzer with AddressSanitizer or similar for better "
          "crash reports.\n");
   Printf("SUMMARY: libFuzzer: deadly signal\n");
   DumpCurrentUnit("crash-");
   PrintFinalStats();
   exit(Options.ErrorExitCode);
 }
if (Options.Verbosity >= 2)
     Printf("AlarmCallback %zd\n", Seconds);
   if (Seconds >= (size_t)Options.UnitTimeoutSec) {
     Printf("ALARM: working on the last Unit for %zd seconds\n", Seconds);
     Printf("       and the timeout value is %d (use -timeout=N to change)\n",
            Options.UnitTimeoutSec);
     DumpCurrentUnit("timeout-");
     Printf("==%d== ERROR: libFuzzer: timeout after %d seconds\n", GetPid(),
            Seconds);
-    if (__sanitizer_print_stack_trace)
-      __sanitizer_print_stack_trace();
+    if (EF.__sanitizer_print_stack_trace)
+      EF.__sanitizer_print_stack_trace();
     Printf("SUMMARY: libFuzzer: timeout\n");
     PrintFinalStats();
     _Exit(Options.TimeoutExitCode); // Stop right now.
   }
 }
 
 void Fuzzer::RssLimitCallback() {
   Printf(
       "==%d== ERROR: libFuzzer: out-of-memory (used: %zdMb; limit: %zdMb)\n",
       GetPid(), GetPeakRSSMb(), Options.RssLimitMb);
   Printf("   To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
-  if (__sanitizer_print_memory_profile)
-    __sanitizer_print_memory_profile(50);
+  if (EF.__sanitizer_print_memory_profile)
+    EF.__sanitizer_print_memory_profile(50);
   DumpCurrentUnit("oom-");
   Printf("SUMMARY: libFuzzer: out-of-memory\n");
   PrintFinalStats();
   _Exit(Options.ErrorExitCode); // Stop right now.
 }
 
 void Fuzzer::PrintStats(const char *Where, const char *End) {
   size_t ExecPerSec = execPerSec();
void Fuzzer::ShuffleAndMinimize() {
   UpdateCorpusDistribution();
   for (auto &X : Corpus)
     UnitHashesAddedToCorpus.insert(Hash(X));
   PrintStats("INITED");
 }
 
 bool Fuzzer::UpdateMaxCoverage() {
   uintptr_t PrevBufferLen = MaxCoverage.PcBufferLen;
-  bool Res = CoverageController::RecordMax(Options, &MaxCoverage);
+  bool Res = CoverageController::RecordMax(Options, &MaxCoverage, EF);
 
   if (Options.PrintNewCovPcs && PrevBufferLen != MaxCoverage.PcBufferLen) {
     uintptr_t *CoverageBuf;
-    __sanitizer_get_coverage_pc_buffer(&CoverageBuf);
+    EF.__sanitizer_get_coverage_pc_buffer(&CoverageBuf);
     assert(CoverageBuf);
     for (size_t I = PrevBufferLen; I < MaxCoverage.PcBufferLen; ++I) {
       Printf("%p\n", CoverageBuf[I]);
     }
   }
 
   return Res;
 }
 
 bool Fuzzer::RunOne(const uint8_t *Data, size_t Size) {
   TotalNumberOfRuns++;
 
   // TODO(aizatsky): this Reset call seems to be not needed.
-  CoverageController::ResetCounters(Options);
+  CoverageController::ResetCounters(Options, EF);
   ExecuteCallback(Data, Size);
   bool Res = UpdateMaxCoverage();
 
   auto UnitStopTime = system_clock::now();
   auto TimeOfUnit =
       duration_cast<seconds>(UnitStopTime - UnitStartTime).count();
   if (!(TotalNumberOfRuns & (TotalNumberOfRuns - 1)) &&
       secondsSinceProcessStartUp() >= 2)

 }
 
 // Tries detecting a memory leak on the particular input that we have just
 // executed before calling this function.
 void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
                                      bool DuringInitialCorpusExecution) {
   if (!HasMoreMallocsThanFrees) return;  // mallocs==frees, a leak is unlikely.
   if (!Options.DetectLeaks) return;
-  if (!&__lsan_enable || !&__lsan_disable || !__lsan_do_recoverable_leak_check)
+  if (!&(EF.__lsan_enable) || !&(EF.__lsan_disable) ||
+      !(EF.__lsan_do_recoverable_leak_check))
     return;  // No lsan.
   // Run the target once again, but with lsan disabled so that if there is
   // a real leak we do not report it twice.
-  __lsan_disable();
+  EF.__lsan_disable();
   RunOne(Data, Size);
-  __lsan_enable();
+  EF.__lsan_enable();
   if (!HasMoreMallocsThanFrees) return;  // a leak is unlikely.
   if (NumberOfLeakDetectionAttempts++ > 1000) {
     Options.DetectLeaks = false;
     Printf("INFO: libFuzzer disabled leak detection after every mutation.\n"
            "      Most likely the target function accumulates allocated\n"
            "      memory in a global state w/o actually leaking it.\n"
            "      If LeakSanitizer is enabled in this process it will still\n"
            "      run on the process shutdown.\n");
     return;
   }
   // Now perform the actual lsan pass. This is expensive and we must ensure
   // we don't call it too often.
-  if (__lsan_do_recoverable_leak_check()) {  // Leak is found, report it.
+  if (EF.__lsan_do_recoverable_leak_check()) { // Leak is found, report it.
     if (DuringInitialCorpusExecution)
       Printf("\nINFO: a leak has been found in the initial corpus.\n\n");
     Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n");
     CurrentUnitSize = Size;
     DumpCurrentUnit("leak-");
     PrintFinalStats();
     _Exit(Options.ErrorExitCode);  // not exit() to disable lsan further on.
   }

 size_t Fuzzer::ChooseUnitIdxToMutate() {
   size_t Idx =
       static_cast<size_t>(CorpusDistribution(MD.GetRand().Get_mt19937()));
   assert(Idx < Corpus.size());
   return Idx;
 }
 
 void Fuzzer::ResetCoverage() {
-  CoverageController::Reset();
+  CoverageController::Reset(EF);
   MaxCoverage.Reset();
-  CoverageController::Prepare(Options, &MaxCoverage);
+  CoverageController::Prepare(Options, &MaxCoverage, EF);
 }
 
 // Experimental search heuristic: drilling.
 // - Read, shuffle, execute and minimize the corpus.
 // - Choose one random unit.
 // - Reset the coverage.
 // - Start fuzzing as if the chosen unit was the only element of the corpus.
 // - When done, reset the coverage again.