[libFuzzer] Diff 16 - Fix bug in detecting timeouts when input string is empty.

[mpividori]

Summary

I added a new flag RunningCB to know if the Fuzzer's main thread is running the CB function, instead of using (! CurrentUnitSize). (! CurrentUnitSize) doesn't work properly. For example, in FuzzerLoop.cpp, inside ShuffleAndMinimize() function, we execute the callback with an empty string (size=0). Previous implementation failed to detect timeouts in that execution.
Also, I add a regression test for that case.

[kcc]

LGTM with a nit

lib/Fuzzer/test/TimeoutEmptyTest.cpp

9 ↗

(On Diff #80343)

This is fragile and may be optimized away.
Instead do this:

static volatile int zero = 0;
if (!size)
  while(!zero) 
     ;

[mpividori]

@kcc, Done. Thanks.

llvm/trunk/lib/Fuzzer/FuzzerInternal.h

private:
   void ResetCounters();
   void PrepareCounters(Fuzzer::Coverage *C);
   bool RecordMaxCoverage(Fuzzer::Coverage *C);
 
   void AllocateCurrentUnitData();
   uint8_t *CurrentUnitData = nullptr;
   std::atomic<size_t> CurrentUnitSize;
   uint8_t BaseSha1[kSHA1NumBytes];  // Checksum of the base unit.
+  bool RunningCB = false;
 
   size_t TotalNumberOfRuns = 0;
   size_t NumberOfNewUnitsAdded = 0;
 
   bool HasMoreMallocsThanFrees = false;
   size_t NumberOfLeakDetectionAttempts = 0;
 
   UserCallback CB;

llvm/trunk/lib/Fuzzer/FuzzerLoop.cpp

void Fuzzer::InterruptCallback() {
   PrintFinalStats();
   _Exit(0);  // Stop right now, don't perform any at-exit actions.
 }
 
 NO_SANITIZE_MEMORY
 void Fuzzer::AlarmCallback() {
   assert(Options.UnitTimeoutSec > 0);
   if (!InFuzzingThread()) return;
-  if (!CurrentUnitSize)
+  if (!RunningCB)
     return; // We have not started running units yet.
   size_t Seconds =
       duration_cast<seconds>(system_clock::now() - UnitStartTime).count();
   if (Seconds == 0)
     return;
   if (Options.Verbosity >= 2)
     Printf("AlarmCallback %zd\n", Seconds);
   if (Seconds >= (size_t)Options.UnitTimeoutSec) {
void Fuzzer::ExecuteCallback(const uint8_t *Data, size_t Size) {
   memcpy(DataCopy, Data, Size);
   if (CurrentUnitData && CurrentUnitData != Data)
     memcpy(CurrentUnitData, Data, Size);
   CurrentUnitSize = Size;
   AllocTracer.Start(Options.TraceMalloc);
   UnitStartTime = system_clock::now();
   ResetCounters();  // Reset coverage right before the callback.
   TPC.ResetMaps();
+  RunningCB = true;
   int Res = CB(DataCopy, Size);
+  RunningCB = false;
   UnitStopTime = system_clock::now();
   (void)Res;
   assert(Res == 0);
   HasMoreMallocsThanFrees = AllocTracer.Stop();
   CurrentUnitSize = 0;
   delete[] DataCopy;
 }
 

llvm/trunk/lib/Fuzzer/test/CMakeLists.txt

set(Tests
   StrncmpTest
   StrstrTest
   SwapCmpTest
   SwitchTest
   Switch2Test
   ThreadedLeakTest
   ThreadedTest
   TimeoutTest
+  TimeoutEmptyTest
   TraceMallocTest
   )
 
 if(APPLE)
   # LeakSanitizer is not supported on OSX right now
   set(HAS_LSAN 0)
   message(WARNING "LeakSanitizer is not supported on Apple platforms."
     " Building and running LibFuzzer LeakSanitizer tests is disabled."

llvm/trunk/lib/Fuzzer/test/TimeoutEmptyTest.cpp

+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+
+// Simple test for a fuzzer. The fuzzer must find the empty string.
+#include <cstdint>
+#include <cstddef>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  static volatile int Zero = 0;
+  if (!Size)
+    while(!Zero)
+      ;
+  return 0;
+}

llvm/trunk/lib/Fuzzer/test/fuzzer-timeout.test

 RUN: not LLVMFuzzer-TimeoutTest -timeout=1 2>&1 | FileCheck %s --check-prefix=TimeoutTest
 TimeoutTest: ALARM: working on the last Unit for
 TimeoutTest: Test unit written to ./timeout-
 TimeoutTest: == ERROR: libFuzzer: timeout after
 TimeoutTest: #0
 TimeoutTest: #1
 TimeoutTest: #2
 TimeoutTest: SUMMARY: libFuzzer: timeout
 
 RUN: not LLVMFuzzer-TimeoutTest -timeout=1 %S/hi.txt 2>&1 | FileCheck %s --check-prefix=SingleInputTimeoutTest
 SingleInputTimeoutTest: ALARM: working on the last Unit for {{[1-3]}} seconds
 SingleInputTimeoutTest-NOT: Test unit written to ./timeout-
 
 RUN: LLVMFuzzer-TimeoutTest -timeout=1 -timeout_exitcode=0
+
+RUN: not LLVMFuzzer-TimeoutEmptyTest -timeout=1 2>&1 | FileCheck %s --check-prefix=TimeoutEmptyTest
+TimeoutEmptyTest: ALARM: working on the last Unit for
+TimeoutEmptyTest: == ERROR: libFuzzer: timeout after
+TimeoutEmptyTest: SUMMARY: libFuzzer: timeout