Enable libFuzzer's afl_driver to append stderr to a file.

[metzman]

Summary

[libFuzzer] Enable afl_driver to append stderr to a user specified file.

Append stderr of afl_driver to the file specified by the environmental variable
AFL_DRIVER_STDERR_DUPLICATE_FILENAME if it is set. This lets users see outputs
on crashes without rerunning crashing test cases (which won't work for crashes
that are difficult to reproduce). Before this patch, stderr would only be sent to afl-fuzz
and users would have no way of seeing it.

[kcc]

lib/Fuzzer/test/FuzzerUnittest.cpp

455 ↗

(On Diff #60213)

This test does not belong here.
Make it a separate lit-style test (like all other libFuzzer tests).
As the result, you will not need afl/afl_driver.h

[metzman]

Remove afl_driver.h, move tests to afl-driver.test

[kcc]

Please upload the patches with context (use the 'arc' command line tool).

lib/Fuzzer/afl/afl_driver.cpp

64 ↗

(On Diff #60356)

static void maybe_duplicate_stderr() {

lib/Fuzzer/test/afl-driver.test

1 ↗

(On Diff #60356)

I afraid it's not that simple.
You can not expect clang++ to be in PATH, so you actually need to have a cmake
rule to build this binary

8 ↗

(On Diff #60356)

and of course you can not expect ~/llvm to exist

[metzman]

Build the test binary using cmake and remove use of a hardcoded path.

[metzman]

Rename duplicate_stderr to maybe_duplicate_stderr().

[kcc]

LGTM with nits.
You don't have commit access, do you?
Please ask Vitaly to land this for you

lib/Fuzzer/afl/afl_driver.cpp

74 ↗

(On Diff #60699)

assert is not good here as we may compile this w/o assertions.
use

if (!...stream) {
    fprintf(stderr,...);
    abort();
}

lib/Fuzzer/test/afl-driver.test

11 ↗

(On Diff #60699)

no need for this

[metzman]

Replace assertion and fix test case.

1. Replace assertion with print to stderr and abort().
2. Remove call to unset() environmental variable in test case.

[vitalybuka]

Sure, I will this CL.
Also could you please mark addressed comments as "done" in future?

[vitalybuka]

I had to revert this as it fails on this bot:
http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-fuzzer/builds/9924/steps/annotate/logs/stdio

[vitalybuka]

Please let me know if you need help with this.

llvm/trunk/lib/Fuzzer/afl/afl_driver.cpp

 static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
 extern "C" void  __afl_manual_init();
 static volatile char suppress_warning1 = AFL_DEFER_FORKSVR[0];
 
 // Input buffer.
 static const size_t kMaxAflInputSize = 1 << 20;
 static uint8_t AflInputBuf[kMaxAflInputSize];
 
+// If the user asks us to duplicate stderr, then do it.
+static void maybe_duplicate_stderr() {
+  char* stderr_duplicate_filename =
+      getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
+
+  if (!stderr_duplicate_filename)
+    return;
+
+  FILE* stderr_duplicate_stream =
+      freopen(stderr_duplicate_filename, "a+", stderr);
+
+  if (!stderr_duplicate_stream) {
+    fprintf(stderr,
+            "Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME"
+            );
+    abort();
+  }
+}
+
 int main(int argc, char **argv) {
   fprintf(stderr, "Running in AFl-fuzz mode\nUsage:\n"
                   "afl-fuzz [afl-flags] %s [N] "
                   "-- run N fuzzing iterations before "
                   "re-spawning the process (default: 1000)\n",
           argv[0]);
   if (LLVMFuzzerInitialize)
     LLVMFuzzerInitialize(&argc, &argv);
   // Do any other expensive one-time initialization here.
 
+  maybe_duplicate_stderr();
+
   __afl_manual_init();
 
   int N = 1000;
   if (argc >= 2)
     N = atoi(argv[1]);
   assert(N > 0);
   while (__afl_persistent_loop(N)) {
     ssize_t n_read = read(0, AflInputBuf, kMaxAflInputSize);

llvm/trunk/lib/Fuzzer/test/AFLDriverTest.cpp

+#include <stdint.h>
+#include <stdlib.h>
+
+extern "C" void __afl_manual_init() {}
+
+extern "C" int __afl_persistent_loop(unsigned int) {
+  return 0;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  return 0;
+}

llvm/trunk/lib/Fuzzer/test/CMakeLists.txt

else()
   set(HAS_LSAN 1)
 endif()
 
 foreach(Test ${Tests})
   add_libfuzzer_test(${Test} SOURCES ${Test}.cpp)
 endforeach()
 
 ###############################################################################
+# AFL Driver test
+###############################################################################
+
+add_executable(AFLDriverTest
+  AFLDriverTest.cpp ../afl/afl_driver.cpp)
+
+set_target_properties(AFLDriverTest
+    PROPERTIES RUNTIME_OUTPUT_DIRECTORY
+    "${CMAKE_BINARY_DIR}/lib/Fuzzer/test"
+    )
+set(TestBinaries ${TestBinaries} AFLDriverTest)
+
+###############################################################################
 # Unit tests
 ###############################################################################
 
 add_executable(LLVMFuzzer-Unittest
   FuzzerUnittest.cpp
   FuzzerFnAdapterUnittest.cpp
   )
 

llvm/trunk/lib/Fuzzer/test/afl-driver.test

+; Test that not specifying a file isn't broken.
+RUN: unset AFL_DRIVER_STDERR_DUPLICATE_FILENAME
+RUN: AFLDriverTest
+
+; Test that specifying an invalid file causes a crash.
+RUN: AFL_DRIVER_STDERR_DUPLICATE_FILENAME="%T" not --crash AFLDriverTest
+
+; Test that a file is created when specified as the duplicate stderr.
+RUN: AFL_DRIVER_STDERR_DUPLICATE_FILENAME=%t AFLDriverTest
+RUN: stat %t