Enable libFuzzer's afl_driver to append stderr to a file.

[metzman]

Summary

[libFuzzer] Enable afl_driver to append stderr to a user specified file.

Append stderr of afl_driver to the file specified by the environmental variable
AFL_DRIVER_STDERR_DUPLICATE_FILENAME if it is set. This lets users see outputs
on crashes without rerunning crashing test cases (which won't work for crashes
that are difficult to reproduce). Before this patch, stderr would only be sent to afl-fuzz
and users would have no way of seeing it.

[kcc]

lib/Fuzzer/test/FuzzerUnittest.cpp

455

This test does not belong here.
Make it a separate lit-style test (like all other libFuzzer tests).
As the result, you will not need afl/afl_driver.h

[metzman]

Remove afl_driver.h, move tests to afl-driver.test

[kcc]

Please upload the patches with context (use the 'arc' command line tool).

lib/Fuzzer/afl/afl_driver.cpp

64

static void maybe_duplicate_stderr() {

lib/Fuzzer/test/afl-driver.test

1 ↗

(On Diff #60356)

I afraid it's not that simple.
You can not expect clang++ to be in PATH, so you actually need to have a cmake
rule to build this binary

8 ↗

(On Diff #60356)

and of course you can not expect ~/llvm to exist

[metzman]

Build the test binary using cmake and remove use of a hardcoded path.

[metzman]

Rename duplicate_stderr to maybe_duplicate_stderr().

[kcc]

LGTM with nits.
You don't have commit access, do you?
Please ask Vitaly to land this for you

lib/Fuzzer/afl/afl_driver.cpp

94

assert is not good here as we may compile this w/o assertions.
use

if (!...stream) {
    fprintf(stderr,...);
    abort();
}

lib/Fuzzer/test/afl-driver.test

11 ↗

(On Diff #60699)

no need for this

[metzman]

Replace assertion and fix test case.

1. Replace assertion with print to stderr and abort().
2. Remove call to unset() environmental variable in test case.

[vitalybuka]

Sure, I will this CL.
Also could you please mark addressed comments as "done" in future?

[vitalybuka]

I had to revert this as it fails on this bot:
http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-fuzzer/builds/9924/steps/annotate/logs/stdio

[vitalybuka]

Please let me know if you need help with this.

lib/Fuzzer/afl/afl_driver.h

+//===- afl_driver.h - Header for the driver ---------------------*- C++ -* ===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//Header for (test) source files that use functions from afl_driver.cpp
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_FUZZER_AFL_AFL_DRIVER_H_
+#define LLVM_FUZZER_AFL_AFL_DRIVER_H_
+
+void duplicate_stderr();
+
+#endif  // LLVM_FUZZER_AFL_AFL_DRIVER_H_

lib/Fuzzer/afl/afl_driver.cpp

 clang -c -w $AFL_HOME/llvm_mode/afl-llvm-rt.o.c
 # Build this file, link it with afl-llvm-rt.o.o and the target code.
 clang++ afl_driver.cpp test_fuzzer.o afl-llvm-rt.o.o
 # Run AFL:
 rm -rf IN OUT; mkdir IN OUT; echo z > IN/z;
 $AFL_HOME/afl-fuzz -i IN -o OUT ./a.out
 ################################################################################
 */
+
 #include <assert.h>
-#include <stdio.h>
 #include <stdint.h>
+#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 extern "C" {
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
 __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
 }
 
 // Notify AFL about persistent mode.
 static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##";
 extern "C" int __afl_persistent_loop(unsigned int);
 static volatile char suppress_warning2 = AFL_PERSISTENT[0];
 
 // Notify AFL about deferred forkserver.
 static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
 extern "C" void  __afl_manual_init();
 static volatile char suppress_warning1 = AFL_DEFER_FORKSVR[0];
 
+#ifndef AFL_DRIVER_TEST  // Silence unused variable warnings when testing.
 // Input buffer.
 static const size_t kMaxAflInputSize = 1 << 20;
 static uint8_t AflInputBuf[kMaxAflInputSize];
+#endif
+
+// If the user asks us to duplicate stderr, then do it.
+void duplicate_stderr() {
+  char* stderr_duplicate_filename =
+      getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
+
+  if (!stderr_duplicate_filename)
+    return;
+
+  FILE* stderr_duplicate_stream =
+      freopen(stderr_duplicate_filename, "a+", stderr);
+
+  assert(stderr_duplicate_stream &&
+         "Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
+}
+
+#ifndef AFL_DRIVER_TEST
 
 int main(int argc, char **argv) {
   fprintf(stderr, "Running in AFl-fuzz mode\nUsage:\n"
                   "afl-fuzz [afl-flags] %s [N] "
                   "-- run N fuzzing iterations before "
                   "re-spawning the process (default: 1000)\n",
           argv[0]);
   if (LLVMFuzzerInitialize)
     LLVMFuzzerInitialize(&argc, &argv);
   // Do any other expensive one-time initialization here.
 
+  duplicate_stderr();
+
   __afl_manual_init();
 
   int N = 1000;
   if (argc >= 2)
     N = atoi(argv[1]);
   assert(N > 0);
   while (__afl_persistent_loop(N)) {
     ssize_t n_read = read(0, AflInputBuf, kMaxAflInputSize);
     if (n_read > 0) {
       // Copy AflInputBuf into a separate buffer to let asan find buffer
       // overflows. Don't use unique_ptr/etc to avoid extra dependencies.
       uint8_t *copy = new uint8_t[n_read];
       memcpy(copy, AflInputBuf, n_read);
       LLVMFuzzerTestOneInput(copy, n_read);
       delete[] copy;
     }
   }
 }
+
+#endif

lib/Fuzzer/test/CMakeLists.txt

 
 ###############################################################################
 # Unit tests
 ###############################################################################
 
 add_executable(LLVMFuzzer-Unittest
   FuzzerUnittest.cpp
   FuzzerFnAdapterUnittest.cpp
+  ../afl/afl_driver.cpp
   )
 
+target_compile_definitions(LLVMFuzzer-Unittest PRIVATE AFL_DRIVER_TEST=1)
+
 target_link_libraries(LLVMFuzzer-Unittest
   gtest
   gtest_main
   LLVMFuzzerNoMain
   )
 
 target_include_directories(LLVMFuzzer-Unittest PRIVATE
   "${LLVM_MAIN_SRC_DIR}/utils/unittest/googletest/include"

lib/Fuzzer/test/FuzzerUnittest.cpp

 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 
 #include "FuzzerInternal.h"
+#include "afl/afl_driver.h"
 #include "gtest/gtest.h"
+#include <stdlib.h>
+#include <unistd.h>
 #include <memory>
 #include <set>
 
+#define TEST_DATA "testdata\n"
+
 using namespace fuzzer;
 
 // For now, have LLVMFuzzerTestOneInput just to make it link.
 // Later we may want to make unittests that actually call LLVMFuzzerTestOneInput.
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
   abort();
 }
 
TEST(Corpus, Distribution) {
   for (size_t i = 0; i < N * TriesPerUnit; i++) {
     Hist[Fuzz.ChooseUnitIdxToMutate()]++;
   }
   for (size_t i = 0; i < N; i++) {
     // A weak sanity check that every unit gets invoked.
     EXPECT_GT(Hist[i], TriesPerUnit / N / 3);
   }
 }
+
+// Test that duplicate_stderr() duplicates stderr to a file when
+// AFL_DRIVER_STDERR_DUPLICATE_FILENAME is set to the name of a valid file.
+TEST(DuplicateStderrTest, DuplicatesToValidFile) {
+  const char* DUPLICATE_FILENAME = "duplicated-stderr";
+  // Setup: make sure the duplicate file is fresh and save a copy of stderr
+  // to restore.
+  unlink(DUPLICATE_FILENAME);
+  int stderr_backup_fd = dup(STDERR_FILENO);
+
+  // Duplicate it.
+  setenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME", DUPLICATE_FILENAME, 1);
+  duplicate_stderr();
+
+  // Write TEST_DATA to duplicated stderr.
+  fprintf(stderr, TEST_DATA);
+  fflush(stderr);
+
+  // Verify the test data was written.
+  FILE* duplicate_file = fopen(DUPLICATE_FILENAME, "r");
+  ASSERT_TRUE(duplicate_file);
+  char file_data[sizeof(TEST_DATA) + 1] = {0};
+  fread(file_data, 1, sizeof(TEST_DATA) + 1, duplicate_file);
+  ASSERT_EQ(strcmp(file_data, TEST_DATA), 0);
+
+  // Tear down: Unset the duplicate setderr's environmental variable,
+  // close the files handles, restore stderr and delete the file.
+  unsetenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
+  fclose(duplicate_file);
+  close(STDERR_FILENO);
+  dup2(stderr_backup_fd, STDERR_FILENO);
+  unlink(DUPLICATE_FILENAME);
+}
+
+// Test that calling duplicate_stderr() causes an assertion to fail
+// when AFL_DRIVER_STDERR_DUPLICATE_FILENAME is set to a path that cannot be
+// written to.
+TEST(DuplicateStderrTest, DiesWhenInvalidFilenameSet) {
+  // The root directory is not a valid file path for stderr to be duplicated
+  // to.
+  const char* INVALID_DUPLICATE_FILE = "/";
+
+  setenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME", INVALID_DUPLICATE_FILE, 1);
+  ASSERT_DEATH(duplicate_stderr(), ".*");
+
+  // Tear down: Unset the duplicate setderr's environmental variable.
+  unsetenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
+}
+
+// Return the number of open file descriptors.
+int get_num_open_fds() {
+  int num_fds = 0;
+  int dtablesize = getdtablesize();
+
+  // Try to open every file descriptor.
+  for (int idx = 0; idx < dtablesize; idx++) {
+    int pos_fd = dup(idx);
+    // If a descriptor isn't associated with an open file, dup() will return -1.
+    if (pos_fd != -1) {
+      // If -1 isn't returned then we've opened a duplicate descriptor: close
+      // it.
+      close(pos_fd);
+     num_fds += 1;
+    }
+  }
+  return num_fds;
+}
+
+// Test that duplicate_stderr() does not duplicate stderr when
+// AFL_DRIVER_STDERR_DUPLICATE_FILENAME is not set.
+TEST(DuplicateStderrTest, DoesNothingWhenNoFilenameSet) {
+  unsetenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
+  // The number of open file descriptors should be the same if
+  // calling duplicate_stderr() does nothing.
+  int pre_call_fd_count =  get_num_open_fds();
+  duplicate_stderr();
+  ASSERT_EQ(get_num_open_fds(), pre_call_fd_count);
+}