added more hooks for fuzzing into DFSan

[farahhariri]

Summary

added more hooks into dfsan, mostly used for fuzzing with libFuzzer

[kcc]

are tests possible here?

[farahhariri]

In D36477#835621, @kcc wrote:

are tests possible here?

my first thought on testing is that I could add a dummy code that
has a strcpy call for example, and define dfsan_weak_hook_strcpy
such that it sets some boolean to true (initially false). And then
assert that the value is changed to true.
But do you think we should have a test for every single hook?
like even the already existing ones (which don't have any tests
as far as I can tell)?

[kcc]

In D36477#836027, @farahhariri wrote:

In D36477#835621, @kcc wrote:

are tests possible here?

my first thought on testing is that I could add a dummy code that
has a strcpy call for example, and define dfsan_weak_hook_strcpy
such that it sets some boolean to true (initially false). And then
assert that the value is changed to true.

Yep, something of this kind.

But do you think we should have a test for every single hook?

Yes.

like even the already existing ones (which don't have any tests
as far as I can tell)?

Correct. This is probably my fault. The existing hooks were done as an experiment and later all their uses were removed.

include/sanitizer/dfsan_interface.h

 /// Whenever a dfsan's custom function is called the corresponding
 /// hook is called it non-zero. The hooks should be defined by the user.
 /// The primary use case is taint-guided fuzzing, where the fuzzer
 /// needs to see the parameters of the function and the labels.
 /// FIXME: implement more hooks.
 void dfsan_weak_hook_memcmp(void *caller_pc, const void *s1, const void *s2,
                             size_t n, dfsan_label s1_label,
                             dfsan_label s2_label, dfsan_label n_label);
+void dfsan_weak_hook_strcmp(void *caller_pc, const char *s1, const char *s2,
+                            dfsan_label s1_label, dfsan_label s2_label);
 void dfsan_weak_hook_strncmp(void *caller_pc, const char *s1, const char *s2,
                              size_t n, dfsan_label s1_label,
                              dfsan_label s2_label, dfsan_label n_label);
+void dfsan_weak_hook_strchr( void *caller_pc, const char *s,
+                             int c, dfsan_label s_label,
+                             dfsan_label c_label);
+void dfsan_weak_hook_strncasecmp(void *caller_pc, const char *s1,
+                                 const char *s2, size_t n, dfsan_label s1_label,
+                                 dfsan_label s2_label, dfsan_label n_label);
+void dfsan_weak_hook_strcasecmp(void *caller_pc, const char *s1, const char *s2,
+                                dfsan_label s1_label, dfsan_label s2_label);
+void dfsan_weak_hook_strlen(void *caller_pc, const char *s, dfsan_label s_label);
+void dfsan_weak_hook_memcpy(void *caller_pc, void *dest, const void *src, size_t n,
+                            dfsan_label dest_label, dfsan_label src_label,
+                            dfsan_label n_label);
+void dfsan_weak_hook_memset(void *caller_pc, void *s, int c, size_t n,
+                            dfsan_label s_label, dfsan_label c_label,
+                            dfsan_label n_label);
+void dfsan_weak_hook_strncpy(void *caller_pc, char *s1, const char *s2, size_t n,
+                             dfsan_label s1_label, dfsan_label s2_label,
+                             dfsan_label n_label);
+void dfsan_weak_hook_strcpy(void *caller_pc, char *dest, const char *src,
+                            dfsan_label dst_label, dfsan_label src_label);
+
 #ifdef __cplusplus
 }  // extern "C"
 
 template <typename T>
 void dfsan_set_label(dfsan_label label, T &data) {  // NOLINT
   dfsan_set_label(label, (void *)&data, sizeof(T));
 }
 
 #endif
 
 #endif  // DFSAN_INTERFACE_H

lib/dfsan/dfsan_custom.cc

 #include <sys/stat.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <time.h>
 #include <unistd.h>
 
 using namespace __dfsan;
 
-#define CALL_WEAK_INTERCEPTOR_HOOK(f, ...)                                     \
+#define  CALL_WEAK_INTERCEPTOR_HOOK(f, ...)                                     \
   do {                                                                         \
     if (f)                                                                     \
       f(__VA_ARGS__);                                                          \
   } while (false)
 #define DECLARE_WEAK_INTERCEPTOR_HOOK(f, ...) \
 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE void f(__VA_ARGS__);
 
 extern "C" {
SANITIZER_INTERFACE_ATTRIBUTE int __dfsw_fstat(int fd, struct stat *buf,
                                                dfsan_label *ret_label) {
   int ret = fstat(fd, buf);
   if (ret == 0)
     dfsan_set_label(0, buf, sizeof(struct stat));
   *ret_label = 0;
   return ret;
 }
 
+DECLARE_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strchr, uptr caller_pc,
+                              const char *s, int c, dfsan_label s_label,
+                              dfsan_label c_label)
+
 SANITIZER_INTERFACE_ATTRIBUTE char *__dfsw_strchr(const char *s, int c,
                                                   dfsan_label s_label,
                                                   dfsan_label c_label,
                                                   dfsan_label *ret_label) {
+
+  CALL_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strchr, GET_CALLER_PC(), s, c,
+                             s_label, c_label);
   for (size_t i = 0;; ++i) {
     if (s[i] == c || s[i] == 0) {
       if (flags().strict_data_dependencies) {
         *ret_label = s_label;
       } else {
         *ret_label = dfsan_union(dfsan_read_label(s, i + 1),
                                  dfsan_union(s_label, c_label));
       }
if (s1[i] != s2[i] || s1[i] == 0 || s2[i] == 0) {
                                  dfsan_read_label(s2, i + 1));
       }
       return s1[i] - s2[i];
     }
   }
   return 0;
 }
 
+DECLARE_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strcasecmp, uptr caller_pc,
+                              const char *s1, const char *s2,
+                              dfsan_label s1_label, dfsan_label s2_label)
+
 SANITIZER_INTERFACE_ATTRIBUTE int
 __dfsw_strcasecmp(const char *s1, const char *s2, dfsan_label s1_label,
                   dfsan_label s2_label, dfsan_label *ret_label) {
+  CALL_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strcasecmp, GET_CALLER_PC(),
+                             s1, s2, s1_label, s2_label);
   for (size_t i = 0;; ++i) {
     if (tolower(s1[i]) != tolower(s2[i]) || s1[i] == 0 || s2[i] == 0) {
       if (flags().strict_data_dependencies) {
         *ret_label = 0;
       } else {
         *ret_label = dfsan_union(dfsan_read_label(s1, i + 1),
                                  dfsan_read_label(s2, i + 1));
       }
if (s1[i] != s2[i] || s1[i] == 0 || s2[i] == 0 || i == n - 1) {
                                  dfsan_read_label(s2, i + 1));
       }
       return s1[i] - s2[i];
     }
   }
   return 0;
 }
 
+DECLARE_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strncasecmp, uptr caller_pc,
+                              const char *s1, const char *s2, size_t n,
+                              dfsan_label s1_label, dfsan_label s2_label,
+                              dfsan_label n_label)
+
 SANITIZER_INTERFACE_ATTRIBUTE int
 __dfsw_strncasecmp(const char *s1, const char *s2, size_t n,
                    dfsan_label s1_label, dfsan_label s2_label,
                    dfsan_label n_label, dfsan_label *ret_label) {
+  CALL_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strncasecmp, GET_CALLER_PC(),
+                             s1, s2, n, s1_label, s2_label, n_label);
+
   if (n == 0) {
     *ret_label = 0;
     return 0;
   }
 
   for (size_t i = 0;; ++i) {
     if (tolower(s1[i]) != tolower(s2[i]) || s1[i] == 0 || s2[i] == 0 ||
         i == n - 1) {
SANITIZER_INTERFACE_ATTRIBUTE void *__dfsw_calloc(size_t nmemb, size_t size,
                                                   dfsan_label size_label,
                                                   dfsan_label *ret_label) {
   void *p = calloc(nmemb, size);
   dfsan_set_label(0, p, nmemb * size);
   *ret_label = 0;
   return p;
 }
 
+DECLARE_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strlen, uptr caller_pc,
+                              const char *s, dfsan_label s_label)
+
 SANITIZER_INTERFACE_ATTRIBUTE size_t
 __dfsw_strlen(const char *s, dfsan_label s_label, dfsan_label *ret_label) {
+  CALL_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strlen, GET_CALLER_PC(),
+                             s, s_label);
   size_t ret = strlen(s);
   if (flags().strict_data_dependencies) {
     *ret_label = 0;
   } else {
     *ret_label = dfsan_read_label(s, ret + 1);
   }
   return ret;
 }
 
-
 static void *dfsan_memcpy(void *dest, const void *src, size_t n) {
   dfsan_label *sdest = shadow_for(dest);
   const dfsan_label *ssrc = shadow_for(src);
   internal_memcpy((void *)sdest, (const void *)ssrc, n * sizeof(dfsan_label));
   return internal_memcpy(dest, src, n);
 }
 
 static void dfsan_memset(void *s, int c, dfsan_label c_label, size_t n) {
   internal_memset(s, c, n);
   dfsan_set_label(c_label, s, n);
 }
 
+DECLARE_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_memcpy, uptr caller_pc,
+                              void *dest, const void *src, size_t n,
+                              dfsan_label dest_label, dfsan_label src_label,
+                              dfsan_label n_label)
+
 SANITIZER_INTERFACE_ATTRIBUTE
 void *__dfsw_memcpy(void *dest, const void *src, size_t n,
                     dfsan_label dest_label, dfsan_label src_label,
                     dfsan_label n_label, dfsan_label *ret_label) {
+  CALL_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_memcpy, GET_CALLER_PC(), dest, src,
+                 n, dest_label, src_label, n_label);
   *ret_label = dest_label;
   return dfsan_memcpy(dest, src, n);
 }
 
+DECLARE_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_memset, uptr caller_pc,
+                              void *s, int c, size_t n,
+                              dfsan_label s_label, dfsan_label c_label,
+                              dfsan_label n_label)
+
 SANITIZER_INTERFACE_ATTRIBUTE
 void *__dfsw_memset(void *s, int c, size_t n,
                     dfsan_label s_label, dfsan_label c_label,
                     dfsan_label n_label, dfsan_label *ret_label) {
+  CALL_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_memset, GET_CALLER_PC(),
+                             s, c, n, s_label, c_label, n_label);
   dfsan_memset(s, c, c_label, n);
   *ret_label = s_label;
   return s;
 }
 
+DECLARE_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strdup, uptr caller_pc,
+                              const char *s, dfsan_label s_label)
+
 SANITIZER_INTERFACE_ATTRIBUTE char *
 __dfsw_strdup(const char *s, dfsan_label s_label, dfsan_label *ret_label) {
+  CALL_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strdup, GET_CALLER_PC(), s, s_label);
   size_t len = strlen(s);
   void *p = malloc(len+1);
   dfsan_memcpy(p, s, len+1);
   *ret_label = 0;
   return static_cast<char *>(p);
 }
 
+DECLARE_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strncpy, uptr caller_pc,
+                              char *s1, const char *s2, size_t n, dfsan_label s1_label,
+                              dfsan_label s2_label, dfsan_label n_label)
+
 SANITIZER_INTERFACE_ATTRIBUTE char *
 __dfsw_strncpy(char *s1, const char *s2, size_t n, dfsan_label s1_label,
                dfsan_label s2_label, dfsan_label n_label,
                dfsan_label *ret_label) {
+  CALL_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strncpy, GET_CALLER_PC(), s1, s2, n, s1_label,
+                             s2_label, n_label);
   size_t len = strlen(s2);
   if (len < n) {
     dfsan_memcpy(s1, s2, len+1);
     dfsan_memset(s1+len+1, 0, 0, n-len-1);
   } else {
     dfsan_memcpy(s1, s2, n);
   }
 
int __dfsw_getrusage(int who, struct rusage *usage, dfsan_label who_label,
   int ret = getrusage(who, usage);
   if (ret == 0) {
     dfsan_set_label(0, usage, sizeof(struct rusage));
   }
   *ret_label = 0;
   return ret;
 }
 
+DECLARE_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strcpy, uptr caller_pc, char *dest,
+                             const char *src, dfsan_label dst_label,
+                             dfsan_label src_label)
+
 SANITIZER_INTERFACE_ATTRIBUTE
 char *__dfsw_strcpy(char *dest, const char *src, dfsan_label dst_label,
                     dfsan_label src_label, dfsan_label *ret_label) {
+  CALL_WEAK_INTERCEPTOR_HOOK(dfsan_weak_hook_strcpy, GET_CALLER_PC(), dest, src, dst_label,
+                             src_label);
   char *ret = strcpy(dest, src);
   if (ret) {
     internal_memcpy(shadow_for(dest), shadow_for(src),
                     sizeof(dfsan_label) * (strlen(src) + 1));
   }
   *ret_label = dst_label;
   return ret;
 }