Add option for afl_driver.cpp to duplicate stderr to the file that the environmental variable AFL_DRIVER_STDERR_DUPLICATE_FILENAME is set to.

[metzman]

Summary

Add option for afl_driver.cpp to duplicate stderr to the file that the environmental variable AFL_DRIVER_STDERR_DUPLICATE_FILENAME is set to.

Build test binary using cmake and fix path issues in afl-driver.test.

lib/Fuzzer/afl/afl_driver.cpp

 static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
 extern "C" void  __afl_manual_init();
 static volatile char suppress_warning1 = AFL_DEFER_FORKSVR[0];
 
 // Input buffer.
 static const size_t kMaxAflInputSize = 1 << 20;
 static uint8_t AflInputBuf[kMaxAflInputSize];
 
+// If the user asks us to duplicate stderr, then do it.
+void duplicate_stderr() {
+  char* stderr_duplicate_filename =
+      getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
+
+  if (!stderr_duplicate_filename)
+    return;
+
+  FILE* stderr_duplicate_stream =
+      freopen(stderr_duplicate_filename, "a+", stderr);
+
+  assert(stderr_duplicate_stream &&
+         "Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
+}
+
 int main(int argc, char **argv) {
   fprintf(stderr, "Running in AFl-fuzz mode\nUsage:\n"
                   "afl-fuzz [afl-flags] %s [N] "
                   "-- run N fuzzing iterations before "
                   "re-spawning the process (default: 1000)\n",
           argv[0]);
   if (LLVMFuzzerInitialize)
     LLVMFuzzerInitialize(&argc, &argv);
   // Do any other expensive one-time initialization here.
 
+  duplicate_stderr();
+
   __afl_manual_init();
 
   int N = 1000;
   if (argc >= 2)
     N = atoi(argv[1]);
   assert(N > 0);
   while (__afl_persistent_loop(N)) {
     ssize_t n_read = read(0, AflInputBuf, kMaxAflInputSize);

lib/Fuzzer/test/AFLDriverTest.cpp

+#include <stdint.h>
+#include <stdlib.h>
+
+extern "C" void __afl_manual_init() {}
+
+extern "C" int __afl_persistent_loop(unsigned int) {
+  return 0;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  return 0;
+}

lib/Fuzzer/test/CMakeLists.txt

else()
   set(HAS_LSAN 1)
 endif()
 
 foreach(Test ${Tests})
   add_libfuzzer_test(${Test} SOURCES ${Test}.cpp)
 endforeach()
 
 ###############################################################################
+# AFL Driver test
+###############################################################################
+
+add_executable(AFLDriverTest
+  AFLDriverTest.cpp ../afl/afl_driver.cpp)
+
+set_target_properties(AFLDriverTest
+    PROPERTIES RUNTIME_OUTPUT_DIRECTORY
+    "${CMAKE_BINARY_DIR}/lib/Fuzzer/test"
+    )
+set(TestBinaries ${TestBinaries} AFLDriverTest)
+
+###############################################################################
 # Unit tests
 ###############################################################################
 
 add_executable(LLVMFuzzer-Unittest
   FuzzerUnittest.cpp
   FuzzerFnAdapterUnittest.cpp
   )
 

lib/Fuzzer/test/afl-driver.test

+; Test that not specifying a file isn't broken.
+RUN: unset AFL_DRIVER_STDERR_DUPLICATE_FILENAME
+RUN: AFLDriverTest
+
+; Test that specifying an invalid file causes a crash.
+RUN: AFL_DRIVER_STDERR_DUPLICATE_FILENAME="%T" not --crash AFLDriverTest
+
+; Test that a file is created when specified as the duplicate stderr.
+RUN: AFL_DRIVER_STDERR_DUPLICATE_FILENAME=%t AFLDriverTest
+RUN: stat %t
+RUN: unset AFL_DRIVER_STDERR_DUPLICATE_FILENAME