Use custom allocators for STL containers in libFuzzer

[george.karpenkov]

Summary

Avoids ODR violations causing spurious ASAN warnings.

[george.karpenkov]

The fuzzer:: qualifier is often spurious, but might be a helpful indication that some magic is going on.

[george.karpenkov]

Suggestions for a better test are welcome.

[kcc]

Nice. Did this help?

lib/fuzzer/FuzzerDefs.h

22

Why do you need this?

test/fuzzer/VectorTest.cpp

6 ↗

(On Diff #112483)

Do some push_backs and pop_backs, just having a CTOR is not enough to trigger a warning.
Or maybe simply abandon the test and rely on having this tested with the rest of clang build.

[george.karpenkov]

@kcc removed the test, I couldn't reproducibly get an error in this test. Let's just rely on fuzzers being able to run.

[george.karpenkov]

@kcc is it good to go?

lib/fuzzer/FuzzerDefs.h

22

to use std::allocator and std::set

[kcc]

lib/fuzzer/FuzzerDefs.h

22

I am asking only about #include <iostream>
Isn't std::allocator defined in <memory>?

[george.karpenkov]

@kcc seems to work either way.

[kcc]

In D37086#853140, @george.karpenkov wrote:

@kcc seems to work either way.

<memory> is fine, <iostream> is not -- it brings too much unrelated stuff.

[kcc]

LGTM

[vitalybuka]

compiler-rt/trunk/lib/fuzzer/FuzzerMutate.h

145 ↗

(On Diff #112793)

It would be nicer with fuzzer::vector -> Vector

[george.karpenkov]

compiler-rt/trunk/lib/fuzzer/FuzzerMutate.h

145 ↗

(On Diff #112793)

I am not sure, Vector to me implies another datastructure. In any case, I have already committed the revision.

[george.karpenkov]

@vitalybuka @kcc It seems it breaks build with GCC: http://lab.llvm.org:8011/builders/clang-x86_64-debian-fast/builds/6318/steps/build/logs/stdio
Any ideas before rollback?

[vitalybuka]

In D37086#853332, @george.karpenkov wrote:

@vitalybuka @kcc It seems it breaks build with GCC: http://lab.llvm.org:8011/builders/clang-x86_64-debian-fast/builds/6318/steps/build/logs/stdio
Any ideas before rollback?

Maybe you need to do the same with string?

compiler-rt/trunk/lib/fuzzer/FuzzerMutate.h

145 ↗

(On Diff #112793)

It is another data structure and we use camel style for them.
So shorter more consistent naming would be nicer, but I will not insist.

[george.karpenkov]

Reverted. The error message seems to be about const/non-const, but I couldn't figure it out right now.

[george.karpenkov]

Maybe you need to do the same with string?

Why would it fail only under GCC though?

[george.karpenkov]

@vitalybuka @kcc Got it down to:

#include<memory>
#include<vector>

template<typename T>
class my_allocator : public std::allocator<T> {};


template<typename T>
using Vector = std::vector<T, my_allocator<T>>;

int main() {
    Vector<Vector<uint8_t>> v;
    Vector<uint8_t> v2;
    v.push_back(v2);
}

which fails under Linux with:

In file included from allocators.cc:3:
In file included from /usr/bin/../lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/vector:64:
/usr/bin/../lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_vector.h:319:9: error: no matching
      constructor for initialization of '_Vector_base<unsigned char, my_allocator<unsigned char> >'
      : _Base(__x.size(),

[george.karpenkov]

Got it working under GCC, struct rebind was missing.

[kcc]

LGTM
wow!

[george.karpenkov]

actually, even that was not sufficient: we seem to lose the ability to use initializer lists.

lib/fuzzer/FuzzerCorpus.h

struct InputInfo {
   // Number of features that this input has and no smaller input has.
   size_t NumFeatures = 0;
   size_t Tmp = 0; // Used by ValidateFeatureSet.
   // Stats.
   size_t NumExecutedMutations = 0;
   size_t NumSuccessfullMutations = 0;
   bool MayDeleteFile = false;
   bool Reduced = false;
-  std::vector<uint32_t> UniqFeatureSet;
+  fuzzer::vector<uint32_t> UniqFeatureSet;
 };
 
 class InputCorpus {
   static const size_t kFeatureSetSize = 1 << 21;
  public:
   InputCorpus(const std::string &OutputCorpus) : OutputCorpus(OutputCorpus) {
     memset(InputSizesPerFeature, 0, sizeof(InputSizesPerFeature));
     memset(SmallestElementPerFeature, 0, sizeof(SmallestElementPerFeature));
size_t MaxInputSize() const {
     size_t Res = 0;
     for (auto II : Inputs)
         Res = std::max(Res, II->U.size());
     return Res;
   }
   bool empty() const { return Inputs.empty(); }
   const Unit &operator[] (size_t Idx) const { return Inputs[Idx]->U; }
   void AddToCorpus(const Unit &U, size_t NumFeatures, bool MayDeleteFile,
-                   const std::vector<uint32_t> &FeatureSet) {
+                   const fuzzer::vector<uint32_t> &FeatureSet) {
     assert(!U.empty());
     if (FeatureDebug)
       Printf("ADD_TO_CORPUS %zd NF %zd\n", Inputs.size(), NumFeatures);
     Inputs.push_back(new InputInfo());
     InputInfo &II = *Inputs.back();
     II.U = U;
     II.NumFeatures = NumFeatures;
     II.MayDeleteFile = MayDeleteFile;
void PrintUnit(const Unit &U) {
     for (uint8_t C : U) {
       if (C != 'F' && C != 'U' && C != 'Z')
         C = '.';
       Printf("%c", C);
     }
   }
 
   // Debug-only
-  void PrintFeatureSet(const std::vector<uint32_t> &FeatureSet) {
+  void PrintFeatureSet(const fuzzer::vector<uint32_t> &FeatureSet) {
     if (!FeatureDebug) return;
     Printf("{");
     for (uint32_t Feature: FeatureSet)
       Printf("%u,", Feature);
     Printf("}");
   }
 
   // Debug-only
void UpdateCorpusDistribution() {
     std::iota(Intervals.begin(), Intervals.end(), 0);
     for (size_t i = 0; i < N; i++)
       Weights[i] = Inputs[i]->NumFeatures * (i + 1);
     CorpusDistribution = std::piecewise_constant_distribution<double>(
         Intervals.begin(), Intervals.end(), Weights.begin());
   }
   std::piecewise_constant_distribution<double> CorpusDistribution;
 
-  std::vector<double> Intervals;
-  std::vector<double> Weights;
+  fuzzer::vector<double> Intervals;
+  fuzzer::vector<double> Weights;
 
   std::unordered_set<std::string> Hashes;
-  std::vector<InputInfo*> Inputs;
+  fuzzer::vector<InputInfo*> Inputs;
 
   size_t NumAddedFeatures = 0;
   size_t NumUpdatedFeatures = 0;
   uint32_t InputSizesPerFeature[kFeatureSetSize];
   uint32_t SmallestElementPerFeature[kFeatureSetSize];
 
   std::string OutputCorpus;
 };
 
 }  // namespace fuzzer
 
 #endif  // LLVM_FUZZER_CORPUS

lib/fuzzer/FuzzerDefs.h

 #define LLVM_FUZZER_DEFS_H
 
 #include <cassert>
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
 #include <string>
 #include <vector>
+#include <set>
+#include <memory>
 
 // Platform detection.
 #ifdef __linux__
 #define LIBFUZZER_APPLE 0
 #define LIBFUZZER_LINUX 1
 #define LIBFUZZER_WINDOWS 0
 #elif __APPLE__
 #define LIBFUZZER_APPLE 1

 struct FuzzingOptions;
 class InputCorpus;
 struct InputInfo;
 struct ExternalFunctions;
 
 // Global interface to functions that may or may not be available.
 extern ExternalFunctions *EF;
 
-typedef std::vector<uint8_t> Unit;
-typedef std::vector<Unit> UnitVector;
+// We are using a custom allocator to give a different symbol name to STL
+// containers in order to avoid ODR violations.
+template<typename T>
+class fuzzer_allocator: public std::allocator<T> {};
+
+template<typename T>
+using vector = std::vector<T, fuzzer_allocator<T>>;
+
+template<typename T>
+using set = std::set<T, std::less<T>, fuzzer_allocator<T>>;
+
+typedef fuzzer::vector<uint8_t> Unit;
+typedef fuzzer::vector<Unit> UnitVector;
 typedef int (*UserCallback)(const uint8_t *Data, size_t Size);
 
 int FuzzerDriver(int *argc, char ***argv, UserCallback Callback);
 
 struct ScopedDoingMyOwnMemOrStr {
   ScopedDoingMyOwnMemOrStr() { DoingMyOwnMemOrStr++; }
   ~ScopedDoingMyOwnMemOrStr() { DoingMyOwnMemOrStr--; }
   static int DoingMyOwnMemOrStr;

lib/fuzzer/FuzzerDictionary.h

 };
 
 // Parses one dictionary entry.
 // If successfull, write the enty to Unit and returns true,
 // otherwise returns false.
 bool ParseOneDictionaryEntry(const std::string &Str, Unit *U);
 // Parses the dictionary file, fills Units, returns true iff all lines
 // were parsed succesfully.
-bool ParseDictionaryFile(const std::string &Text, std::vector<Unit> *Units);
+bool ParseDictionaryFile(const std::string &Text, fuzzer::vector<Unit> *Units);
 
 }  // namespace fuzzer
 
 #endif  // LLVM_FUZZER_DICTIONARY_H

lib/fuzzer/FuzzerDriver.cpp

 #undef FUZZER_FLAG_INT
 #undef FUZZER_FLAG_UNSIGNED
 #undef FUZZER_FLAG_STRING
 };
 
 static const size_t kNumFlags =
     sizeof(FlagDescriptions) / sizeof(FlagDescriptions[0]);
 
-static std::vector<std::string> *Inputs;
+static fuzzer::vector<std::string> *Inputs;
 static std::string *ProgName;
 
 static void PrintHelp() {
   Printf("Usage:\n");
   auto Prog = ProgName->c_str();
   Printf("\nTo run fuzzing pass 0 or more directories.\n");
   Printf("%s [-flag1=val1 [-flag2=val2 ...] ] [dir1 [dir2 ...] ]\n", Prog);
 
for (size_t F = 0; F < kNumFlags; F++) {
     }
   }
   Printf("\n\nWARNING: unrecognized flag '%s'; "
          "use -help=1 to list all flags\n\n", Param);
   return true;
 }
 
 // We don't use any library to minimize dependencies.
-static void ParseFlags(const std::vector<std::string> &Args) {
+static void ParseFlags(const fuzzer::vector<std::string> &Args) {
   for (size_t F = 0; F < kNumFlags; F++) {
     if (FlagDescriptions[F].IntFlag)
       *FlagDescriptions[F].IntFlag = FlagDescriptions[F].Default;
     if (FlagDescriptions[F].UIntFlag)
       *FlagDescriptions[F].UIntFlag =
           static_cast<unsigned int>(FlagDescriptions[F].Default);
     if (FlagDescriptions[F].StrFlag)
       *FlagDescriptions[F].StrFlag = nullptr;
   }
-  Inputs = new std::vector<std::string>;
+  Inputs = new fuzzer::vector<std::string>;
   for (size_t A = 1; A < Args.size(); A++) {
     if (ParseOneFlag(Args[A].c_str())) {
       if (Flags.ignore_remaining_args)
         break;
       continue;
     }
     Inputs->push_back(Args[A]);
   }
if (ExitCode != 0)
       *HasErrors = true;
     std::lock_guard<std::mutex> Lock(Mu);
     Printf("================== Job %u exited with exit code %d ============\n",
            C, ExitCode);
     fuzzer::CopyFileToErr(Log);
   }
 }
 
-std::string CloneArgsWithoutX(const std::vector<std::string> &Args,
+std::string CloneArgsWithoutX(const fuzzer::vector<std::string> &Args,
                               const char *X1, const char *X2) {
   std::string Cmd;
   for (auto &S : Args) {
     if (FlagValue(S.c_str(), X1) || FlagValue(S.c_str(), X2))
       continue;
     Cmd += S + " ";
   }
   return Cmd;
 }
 
-static int RunInMultipleProcesses(const std::vector<std::string> &Args,
+static int RunInMultipleProcesses(const fuzzer::vector<std::string> &Args,
                                   unsigned NumWorkers, unsigned NumJobs) {
   std::atomic<unsigned> Counter(0);
   std::atomic<bool> HasErrors(false);
   std::string Cmd = CloneArgsWithoutX(Args, "jobs", "workers");
-  std::vector<std::thread> V;
+  fuzzer::vector<std::thread> V;
   std::thread Pulse(PulseThread);
   Pulse.detach();
   for (unsigned i = 0; i < NumWorkers; i++)
     V.push_back(std::thread(WorkerThread, Cmd, &Counter, NumJobs, &HasErrors));
   for (auto &T : V)
     T.join();
   return HasErrors ? 1 : 0;
 }
static std::string GetDedupTokenFromFile(const std::string &Path) {
   if (Beg == std::string::npos)
     return "";
   auto End = S.find('\n', Beg);
   if (End == std::string::npos)
     return "";
   return S.substr(Beg, End - Beg);
 }
 
-int CleanseCrashInput(const std::vector<std::string> &Args,
+int CleanseCrashInput(const fuzzer::vector<std::string> &Args,
                        const FuzzingOptions &Options) {
   if (Inputs->size() != 1 || !Flags.exact_artifact_path) {
     Printf("ERROR: -cleanse_crash should be given one input file and"
           " -exact_artifact_path\n");
     exit(1);
   }
   std::string InputFilePath = Inputs->at(0);
   std::string OutputFilePath = Flags.exact_artifact_path;
int CleanseCrashInput(const fuzzer::vector<std::string> &Args,
   auto LogFileRedirect = " > " + LogFilePath + " 2>&1 ";
 
   auto Cmd = BaseCmd + " " + TmpFilePath + LogFileRedirect;
 
   std::string CurrentFilePath = InputFilePath;
   auto U = FileToVector(CurrentFilePath);
   size_t Size = U.size();
 
-  const std::vector<uint8_t> ReplacementBytes = {' ', 0xff};
+  const fuzzer::vector<uint8_t> ReplacementBytes = {' ', 0xff};
   for (int NumAttempts = 0; NumAttempts < 5; NumAttempts++) {
     bool Changed = false;
     for (size_t Idx = 0; Idx < Size; Idx++) {
       Printf("CLEANSE[%d]: Trying to replace byte %zd of %zd\n", NumAttempts,
              Idx, Size);
       uint8_t OriginalByte = U[Idx];
       if (ReplacementBytes.end() != std::find(ReplacementBytes.begin(),
                                               ReplacementBytes.end(),
for (size_t Idx = 0; Idx < Size; Idx++) {
       }
     }
     if (!Changed) break;
   }
   RemoveFile(LogFilePath);
   return 0;
 }
 
-int MinimizeCrashInput(const std::vector<std::string> &Args,
+int MinimizeCrashInput(const fuzzer::vector<std::string> &Args,
                        const FuzzingOptions &Options) {
   if (Inputs->size() != 1) {
     Printf("ERROR: -minimize_crash should be given one input file\n");
     exit(1);
   }
   std::string InputFilePath = Inputs->at(0);
   auto BaseCmd = SplitBefore(
       "-ignore_remaining_args=1",
int MinimizeCrashInputInternalStep(Fuzzer *F, InputCorpus *Corpus) {
   F->SetMaxInputLen(U.size());
   F->SetMaxMutationLen(U.size() - 1);
   F->MinimizeCrashLoop(U);
   Printf("INFO: Done MinimizeCrashInputInternalStep, no crashes found\n");
   exit(0);
   return 0;
 }
 
-int AnalyzeDictionary(Fuzzer *F, const std::vector<Unit>& Dict,
+int AnalyzeDictionary(Fuzzer *F, const fuzzer::vector<Unit>& Dict,
                       UnitVector& Corpus) {
   Printf("Started dictionary minimization (up to %d tests)\n",
          Dict.size() * Corpus.size() * 2);
 
   // Scores and usage count for each dictionary unit.
-  std::vector<int> Scores(Dict.size());
-  std::vector<int> Usages(Dict.size());
+  fuzzer::vector<int> Scores(Dict.size());
+  fuzzer::vector<int> Usages(Dict.size());
 
-  std::vector<size_t> InitialFeatures;
-  std::vector<size_t> ModifiedFeatures;
+  fuzzer::vector<size_t> InitialFeatures;
+  fuzzer::vector<size_t> ModifiedFeatures;
   for (auto &C : Corpus) {
     // Get coverage for the testcase without modifications.
     F->ExecuteCallback(C.data(), C.size());
     InitialFeatures.clear();
     TPC.CollectFeatures([&](size_t Feature) -> bool {
       InitialFeatures.push_back(Feature);
       return true;
     });

 
 int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
   using namespace fuzzer;
   assert(argc && argv && "Argument pointers cannot be nullptr");
   std::string Argv0((*argv)[0]);
   EF = new ExternalFunctions();
   if (EF->LLVMFuzzerInitialize)
     EF->LLVMFuzzerInitialize(argc, argv);
-  const std::vector<std::string> Args(*argv, *argv + *argc);
+  const fuzzer::vector<std::string> Args(*argv, *argv + *argc);
   assert(!Args.empty());
   ProgName = new std::string(Args[0]);
   if (Argv0 != *ProgName) {
     Printf("ERROR: argv[0] has been modified in LLVMFuzzerInitialize\n");
     exit(1);
   }
   ParseFlags(Args);
   if (Flags.help) {
if (Flags.runs >= 0)
     Options.MaxNumberOfRuns = Flags.runs;
   if (!Inputs->empty() && !Flags.minimize_crash_internal_step)
     Options.OutputCorpus = (*Inputs)[0];
   Options.ReportSlowUnits = Flags.report_slow_units;
   if (Flags.artifact_prefix)
     Options.ArtifactPrefix = Flags.artifact_prefix;
   if (Flags.exact_artifact_path)
     Options.ExactArtifactPath = Flags.exact_artifact_path;
-  std::vector<Unit> Dictionary;
+  fuzzer::vector<Unit> Dictionary;
   if (Flags.dict)
     if (!ParseDictionaryFile(FileToString(Flags.dict), &Dictionary))
       return 1;
   if (Flags.verbosity > 0 && !Dictionary.empty())
     Printf("Dictionary: %zd entries\n", Dictionary.size());
   bool DoPlainRun = AllInputsAreFiles();
   Options.SaveArtifacts =
       !DoPlainRun || Flags.minimize_crash_internal_step;

lib/fuzzer/FuzzerIO.h

Unit FileToVector(const std::string &Path, size_t MaxSize = 0,
                   bool ExitOnError = true);
 
 std::string FileToString(const std::string &Path);
 
 void CopyFileToErr(const std::string &Path);
 
 void WriteToFile(const Unit &U, const std::string &Path);
 
-void ReadDirToVectorOfUnits(const char *Path, std::vector<Unit> *V,
+void ReadDirToVectorOfUnits(const char *Path, fuzzer::vector<Unit> *V,
                             long *Epoch, size_t MaxSize, bool ExitOnError);
 
 // Returns "Dir/FileName" or equivalent for the current OS.
 std::string DirPlusFile(const std::string &DirPath,
                         const std::string &FileName);
 
 // Returns the name of the dir, similar to the 'dirname' utility.
 std::string DirName(const std::string &FileName);

 
 // Print using raw syscalls, useful when printing at early init stages.
 void RawPrint(const char *Str);
 
 // Platform specific functions:
 bool IsFile(const std::string &Path);
 
 void ListFilesInDirRecursive(const std::string &Dir, long *Epoch,
-                             std::vector<std::string> *V, bool TopDir);
+                             fuzzer::vector<std::string> *V, bool TopDir);
 
 char GetSeparator();
 
 FILE* OpenFile(int Fd, const char *Mode);
 
 int CloseFile(int Fd);
 
 int DuplicateFile(int Fd);

lib/fuzzer/FuzzerIO.cpp

 void WriteToFile(const Unit &U, const std::string &Path) {
   // Use raw C interface because this function may be called from a sig handler.
   FILE *Out = fopen(Path.c_str(), "w");
   if (!Out) return;
   fwrite(U.data(), sizeof(U[0]), U.size(), Out);
   fclose(Out);
 }
 
-void ReadDirToVectorOfUnits(const char *Path, std::vector<Unit> *V,
+void ReadDirToVectorOfUnits(const char *Path, fuzzer::vector<Unit> *V,
                             long *Epoch, size_t MaxSize, bool ExitOnError) {
   long E = Epoch ? *Epoch : 0;
-  std::vector<std::string> Files;
+  fuzzer::vector<std::string> Files;
   ListFilesInDirRecursive(Path, Epoch, &Files, /*TopDir*/true);
   size_t NumLoaded = 0;
   for (size_t i = 0; i < Files.size(); i++) {
     auto &X = Files[i];
     if (Epoch && GetEpoch(X) < E) continue;
     NumLoaded++;
     if ((NumLoaded & (NumLoaded - 1)) == 0 && NumLoaded >= 1024)
       Printf("Loaded %zd/%zd files from %s\n", NumLoaded, Files.size(), Path);

lib/fuzzer/FuzzerIOPosix.cpp

 bool IsFile(const std::string &Path) {
   struct stat St;
   if (stat(Path.c_str(), &St))
     return false;
   return S_ISREG(St.st_mode);
 }
 
 void ListFilesInDirRecursive(const std::string &Dir, long *Epoch,
-                             std::vector<std::string> *V, bool TopDir) {
+                             fuzzer::vector<std::string> *V, bool TopDir) {
   auto E = GetEpoch(Dir);
   if (Epoch)
     if (E && *Epoch >= E) return;
 
   DIR *D = opendir(Dir.c_str());
   if (!D) {
     Printf("No such directory: %s; exiting\n", Dir.c_str());
     exit(1);

lib/fuzzer/FuzzerIOWindows.cpp

Printf("GetFileAttributesA() failed for \"%s\" (Error code: %lu).\n",
         Path.c_str(), GetLastError());
     return false;
   }
 
   return IsFile(Path, Att);
 }
 
 void ListFilesInDirRecursive(const std::string &Dir, long *Epoch,
-                             std::vector<std::string> *V, bool TopDir) {
+                             fuzzer::vector<std::string> *V, bool TopDir) {
   auto E = GetEpoch(Dir);
   if (Epoch)
     if (E && *Epoch >= E) return;
 
   std::string Path(Dir);
   assert(!Path.empty());
   if (Path.back() != '\\')
       Path.push_back('\\');

lib/fuzzer/FuzzerInternal.h

public:
   static void StaticInterruptCallback();
   static void StaticFileSizeExceedCallback();
 
   void ExecuteCallback(const uint8_t *Data, size_t Size);
   bool RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile = false,
               InputInfo *II = nullptr);
 
   // Merge Corpora[1:] into Corpora[0].
-  void Merge(const std::vector<std::string> &Corpora);
-  void CrashResistantMerge(const std::vector<std::string> &Args,
-                           const std::vector<std::string> &Corpora,
+  void Merge(const fuzzer::vector<std::string> &Corpora);
+  void CrashResistantMerge(const fuzzer::vector<std::string> &Args,
+                           const fuzzer::vector<std::string> &Corpora,
                            const char *CoverageSummaryInputPathOrNull,
                            const char *CoverageSummaryOutputPathOrNull);
   void CrashResistantMergeInternalStep(const std::string &ControlFilePath);
   MutationDispatcher &GetMD() { return MD; }
   void PrintFinalStats();
   void SetMaxInputLen(size_t MaxInputLen);
   void SetMaxMutationLen(size_t MaxMutationLen);
   void RssLimitCallback();
private:
   system_clock::time_point UnitStartTime, UnitStopTime;
   long TimeOfLongestUnitInSeconds = 0;
   long EpochOfLastReadOfOutputCorpus = 0;
 
   size_t MaxInputLen = 0;
   size_t MaxMutationLen = 0;
   size_t TmpMaxMutationLen = 0;
 
-  std::vector<uint32_t> UniqFeatureSetTmp;
+  fuzzer::vector<uint32_t> UniqFeatureSetTmp;
 
   // Need to know our own thread.
   static thread_local bool IsMyThread;
 };
 
 } // namespace fuzzer
 
 #endif // LLVM_FUZZER_INTERNAL_H

lib/fuzzer/FuzzerLoop.cpp

if (Corpus.HasUnit(Options.ExitOnItem)) {
              Options.ExitOnItem.c_str());
       _Exit(0);
     }
   }
 }
 
 void Fuzzer::RereadOutputCorpus(size_t MaxSize) {
   if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec) return;
-  std::vector<Unit> AdditionalCorpus;
+  fuzzer::vector<Unit> AdditionalCorpus;
   ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus,
                          &EpochOfLastReadOfOutputCorpus, MaxSize,
                          /*ExitOnError*/ false);
   if (Options.Verbosity >= 2)
     Printf("Reload: read %zd new units.\n", AdditionalCorpus.size());
   bool Reloaded = false;
   for (auto &U : AdditionalCorpus) {
     if (U.size() > MaxSize)

lib/fuzzer/FuzzerMerge.h

 #include <set>
 #include <vector>
 
 namespace fuzzer {
 
 struct MergeFileInfo {
   std::string Name;
   size_t Size = 0;
-  std::vector<uint32_t> Features;
+  fuzzer::vector<uint32_t> Features;
 };
 
 struct Merger {
-  std::vector<MergeFileInfo> Files;
+  fuzzer::vector<MergeFileInfo> Files;
   size_t NumFilesInFirstCorpus = 0;
   size_t FirstNotProcessedFile = 0;
   std::string LastFailure;
 
   bool Parse(std::istream &IS, bool ParseCoverage);
   bool Parse(const std::string &Str, bool ParseCoverage);
   void ParseOrExit(std::istream &IS, bool ParseCoverage);
   void PrintSummary(std::ostream &OS);
   std::set<uint32_t> ParseSummary(std::istream &IS);
   size_t Merge(const std::set<uint32_t> &InitialFeatures,
-               std::vector<std::string> *NewFiles);
-  size_t Merge(std::vector<std::string> *NewFiles) {
+               fuzzer::vector<std::string> *NewFiles);
+  size_t Merge(fuzzer::vector<std::string> *NewFiles) {
     return Merge(std::set<uint32_t>{}, NewFiles);
   }
   size_t ApproximateMemoryConsumption() const;
   std::set<uint32_t> AllFeatures() const;
 };
 
 }  // namespace fuzzer
 
 #endif  // LLVM_FUZZER_MERGE_H

lib/fuzzer/FuzzerMerge.cpp

bool Merger::Parse(std::istream &IS, bool ParseCoverage) {
   for (size_t i = 0; i < NumFiles; i++)
     if (!std::getline(IS, Files[i].Name, '\n'))
       return false;
 
   // Parse STARTED and DONE lines.
   size_t ExpectedStartMarker = 0;
   const size_t kInvalidStartMarker = -1;
   size_t LastSeenStartMarker = kInvalidStartMarker;
-  std::vector<uint32_t> TmpFeatures;
+  fuzzer::vector<uint32_t> TmpFeatures;
   while (std::getline(IS, Line, '\n')) {
     std::istringstream ISS1(Line);
     std::string Marker;
     size_t N;
     ISS1 >> Marker;
     ISS1 >> N;
     if (Marker == "STARTED") {
       // STARTED FILE_ID FILE_SIZE
size_t Merger::ApproximateMemoryConsumption() const  {
   for (const auto &F: Files)
     Res += sizeof(F) + F.Features.size() * sizeof(F.Features[0]);
   return Res;
 }
 
 // Decides which files need to be merged (add thost to NewFiles).
 // Returns the number of new features added.
 size_t Merger::Merge(const std::set<uint32_t> &InitialFeatures,
-                     std::vector<std::string> *NewFiles) {
+                     fuzzer::vector<std::string> *NewFiles) {
   NewFiles->clear();
   assert(NumFilesInFirstCorpus <= Files.size());
   std::set<uint32_t> AllFeatures(InitialFeatures);
 
   // What features are in the initial corpus?
   for (size_t i = 0; i < NumFilesInFirstCorpus; i++) {
     auto &Cur = Files[i].Features;
     AllFeatures.insert(Cur.begin(), Cur.end());
   }
   size_t InitialNumFeatures = AllFeatures.size();
 
   // Remove all features that we already know from all other inputs.
   for (size_t i = NumFilesInFirstCorpus; i < Files.size(); i++) {
     auto &Cur = Files[i].Features;
-    std::vector<uint32_t> Tmp;
+    fuzzer::vector<uint32_t> Tmp;
     std::set_difference(Cur.begin(), Cur.end(), AllFeatures.begin(),
                         AllFeatures.end(), std::inserter(Tmp, Tmp.begin()));
     Cur.swap(Tmp);
   }
 
   // Sort. Give preference to
   //   * smaller files
   //   * files with more features.
for (size_t i = M.FirstNotProcessedFile; i < M.Files.size(); i++) {
     OF << "DONE " << i;
     for (size_t F : Features)
       OF << " " << std::hex << F;
     OF << "\n";
   }
 }
 
 // Outer process. Does not call the target code and thus sohuld not fail.
-void Fuzzer::CrashResistantMerge(const std::vector<std::string> &Args,
-                                 const std::vector<std::string> &Corpora,
+void Fuzzer::CrashResistantMerge(const fuzzer::vector<std::string> &Args,
+                                 const fuzzer::vector<std::string> &Corpora,
                                  const char *CoverageSummaryInputPathOrNull,
                                  const char *CoverageSummaryOutputPathOrNull) {
   if (Corpora.size() <= 1) {
     Printf("Merge requires two or more corpus dirs\n");
     return;
   }
-  std::vector<std::string> AllFiles;
+  fuzzer::vector<std::string> AllFiles;
   ListFilesInDirRecursive(Corpora[0], nullptr, &AllFiles, /*TopDir*/true);
   size_t NumFilesInFirstCorpus = AllFiles.size();
   for (size_t i = 1; i < Corpora.size(); i++)
     ListFilesInDirRecursive(Corpora[i], nullptr, &AllFiles, /*TopDir*/true);
   Printf("MERGE-OUTER: %zd files, %zd in the initial corpus\n",
          AllFiles.size(), NumFilesInFirstCorpus);
   auto CFPath = DirPlusFile(TmpDir(),
                        "libFuzzerTemp." + std::to_string(GetPid()) + ".txt");
void Fuzzer::CrashResistantMerge(const fuzzer::vector<std::string> &Args,
   Printf("MERGE-OUTER: consumed %zdMb (%zdMb rss) to parse the control file\n",
          M.ApproximateMemoryConsumption() >> 20, GetPeakRSSMb());
   if (CoverageSummaryOutputPathOrNull) {
     Printf("MERGE-OUTER: writing coverage summary for %zd files to %s\n",
            M.Files.size(), CoverageSummaryOutputPathOrNull);
     std::ofstream SummaryOut(CoverageSummaryOutputPathOrNull);
     M.PrintSummary(SummaryOut);
   }
-  std::vector<std::string> NewFiles;
+  fuzzer::vector<std::string> NewFiles;
   std::set<uint32_t> InitialFeatures;
   if (CoverageSummaryInputPathOrNull) {
     std::ifstream SummaryIn(CoverageSummaryInputPathOrNull);
     InitialFeatures = M.ParseSummary(SummaryIn);
     Printf("MERGE-OUTER: coverage summary loaded from %s, %zd features found\n",
            CoverageSummaryInputPathOrNull, InitialFeatures.size());
   }
   size_t NumNewFeatures = M.Merge(InitialFeatures, &NewFiles);

lib/fuzzer/FuzzerMutate.h

private:
   struct Mutator {
     size_t (MutationDispatcher::*Fn)(uint8_t *Data, size_t Size, size_t Max);
     const char *Name;
   };
 
   size_t AddWordFromDictionary(Dictionary &D, uint8_t *Data, size_t Size,
                                size_t MaxSize);
   size_t MutateImpl(uint8_t *Data, size_t Size, size_t MaxSize,
-                    const std::vector<Mutator> &Mutators);
+                    const fuzzer::vector<Mutator> &Mutators);
 
   size_t InsertPartOf(const uint8_t *From, size_t FromSize, uint8_t *To,
                       size_t ToSize, size_t MaxToSize);
   size_t CopyPartOf(const uint8_t *From, size_t FromSize, uint8_t *To,
                     size_t ToSize);
   size_t ApplyDictionaryEntry(uint8_t *Data, size_t Size, size_t MaxSize,
                               DictionaryEntry &DE);
 
private:
   Dictionary ManualDictionary;
   // Temporary dictionary modified by the fuzzer itself,
   // recreated periodically.
   Dictionary TempAutoDictionary;
   // Persistent dictionary modified by the fuzzer, consists of
   // entries that led to successfull discoveries in the past mutations.
   Dictionary PersistentAutoDictionary;
 
-  std::vector<Mutator> CurrentMutatorSequence;
-  std::vector<DictionaryEntry *> CurrentDictionaryEntrySequence;
+  fuzzer::vector<Mutator> CurrentMutatorSequence;
+  fuzzer::vector<DictionaryEntry *> CurrentDictionaryEntrySequence;
 
   static const size_t kCmpDictionaryEntriesDequeSize = 16;
   DictionaryEntry CmpDictionaryEntriesDeque[kCmpDictionaryEntriesDequeSize];
   size_t CmpDictionaryEntriesDequeIdx = 0;
 
   const InputCorpus *Corpus = nullptr;
-  std::vector<uint8_t> MutateInPlaceHere;
+  fuzzer::vector<uint8_t> MutateInPlaceHere;
   // CustomCrossOver needs its own buffer as a custom implementation may call
   // LLVMFuzzerMutate, which in turn may resize MutateInPlaceHere.
-  std::vector<uint8_t> CustomCrossOverInPlaceHere;
+  fuzzer::vector<uint8_t> CustomCrossOverInPlaceHere;
 
-  std::vector<Mutator> Mutators;
-  std::vector<Mutator> DefaultMutators;
+  fuzzer::vector<Mutator> Mutators;
+  fuzzer::vector<Mutator> DefaultMutators;
 };
 
 }  // namespace fuzzer
 
 #endif  // LLVM_FUZZER_MUTATE_H

lib/fuzzer/FuzzerMutate.cpp

for (auto DE : CurrentDictionaryEntrySequence) {
     assert(DE->GetW().size());
     // Linear search is fine here as this happens seldom.
     if (!PersistentAutoDictionary.ContainsWord(DE->GetW()))
       PersistentAutoDictionary.push_back({DE->GetW(), 1});
   }
 }
 
 void MutationDispatcher::PrintRecommendedDictionary() {
-  std::vector<DictionaryEntry> V;
+  fuzzer::vector<DictionaryEntry> V;
   for (auto &DE : PersistentAutoDictionary)
     if (!ManualDictionary.ContainsWord(DE.GetW()))
       V.push_back(DE);
   if (V.empty()) return;
   Printf("###### Recommended dictionary. ######\n");
   for (auto &DE: V) {
     assert(DE.GetW().size());
     Printf("\"");

 size_t MutationDispatcher::DefaultMutate(uint8_t *Data, size_t Size,
                                          size_t MaxSize) {
   return MutateImpl(Data, Size, MaxSize, DefaultMutators);
 }
 
 // Mutates Data in place, returns new size.
 size_t MutationDispatcher::MutateImpl(uint8_t *Data, size_t Size,
                                       size_t MaxSize,
-                                      const std::vector<Mutator> &Mutators) {
+                                      const fuzzer::vector<Mutator> &Mutators) {
   assert(MaxSize > 0);
   // Some mutations may fail (e.g. can't insert more bytes if Size == MaxSize),
   // in which case they will return 0.
   // Try several times before returning un-mutated data.
   for (int Iter = 0; Iter < 100; Iter++) {
     auto M = Mutators[Rand(Mutators.size())];
     size_t NewSize = (this->*(M.Fn))(Data, Size, MaxSize);
     if (NewSize && NewSize <= MaxSize) {

lib/fuzzer/FuzzerTracePC.cpp

for (auto Ptr = M.Start; Ptr < M.Stop; Ptr++) {
         UncoveredLines.insert(Line);
     }
   }
   FunctionEndCallback("", "");
 }
 
 void TracePC::DumpCoverage() {
   if (EF->__sanitizer_dump_coverage) {
-    std::vector<uintptr_t> PCsCopy(GetNumPCs());
+    fuzzer::vector<uintptr_t> PCsCopy(GetNumPCs());
     for (size_t i = 0; i < GetNumPCs(); i++)
       PCsCopy[i] = PCs()[i] ? GetPreviousInstructionPc(PCs()[i]) : 0;
     EF->__sanitizer_dump_coverage(PCsCopy.data(), PCsCopy.size());
   }
 }
 
 // Value profile.
 // We keep track of various values that affect control flow.

lib/fuzzer/FuzzerUtil.h

 
 int ExecuteCommand(const std::string &Command);
 
 FILE *OpenProcessPipe(const char *Command, const char *Mode);
 
 const void *SearchMemory(const void *haystack, size_t haystacklen,
                          const void *needle, size_t needlelen);
 
-std::string CloneArgsWithoutX(const std::vector<std::string> &Args,
+std::string CloneArgsWithoutX(const fuzzer::vector<std::string> &Args,
                               const char *X1, const char *X2);
 
-inline std::string CloneArgsWithoutX(const std::vector<std::string> &Args,
+inline std::string CloneArgsWithoutX(const fuzzer::vector<std::string> &Args,
                                      const char *X) {
   return CloneArgsWithoutX(Args, X, X);
 }
 
 inline std::pair<std::string, std::string> SplitBefore(std::string X,
                                                        std::string S) {
   auto Pos = S.find(X);
   if (Pos == std::string::npos)

lib/fuzzer/FuzzerUtil.cpp

for (size_t Pos = L; Pos <= R; Pos++) {
     } else {
       // Any other character.
       U->push_back(V);
     }
   }
   return true;
 }
 
-bool ParseDictionaryFile(const std::string &Text, std::vector<Unit> *Units) {
+bool ParseDictionaryFile(const std::string &Text, fuzzer::vector<Unit> *Units) {
   if (Text.empty()) {
     Printf("ParseDictionaryFile: file does not exist or is empty\n");
     return false;
   }
   std::istringstream ISS(Text);
   Units->clear();
   Unit U;
   int LineNo = 0;

lib/fuzzer/tests/FuzzerUnittest.cpp

TEST(FuzzerDictionary, ParseOneDictionaryEntry) {
   EXPECT_EQ(U, Unit({0xAB, 'z', 0xDE}));
   EXPECT_TRUE(ParseOneDictionaryEntry("\"#\"", &U));
   EXPECT_EQ(U, Unit({'#'}));
   EXPECT_TRUE(ParseOneDictionaryEntry("\"\\\"\"", &U));
   EXPECT_EQ(U, Unit({'"'}));
 }
 
 TEST(FuzzerDictionary, ParseDictionaryFile) {
-  std::vector<Unit> Units;
+  fuzzer::vector<Unit> Units;
   EXPECT_FALSE(ParseDictionaryFile("zzz\n", &Units));
   EXPECT_FALSE(ParseDictionaryFile("", &Units));
   EXPECT_TRUE(ParseDictionaryFile("\n", &Units));
   EXPECT_EQ(Units.size(), 0U);
   EXPECT_TRUE(ParseDictionaryFile("#zzzz a b c d\n", &Units));
   EXPECT_EQ(Units.size(), 0U);
   EXPECT_TRUE(ParseDictionaryFile(" #zzzz\n", &Units));
   EXPECT_EQ(Units.size(), 0U);
   EXPECT_TRUE(ParseDictionaryFile("  #zzzz\n", &Units));
   EXPECT_EQ(Units.size(), 0U);
   EXPECT_TRUE(ParseDictionaryFile("  #zzzz\naaa=\"aa\"", &Units));
-  EXPECT_EQ(Units, std::vector<Unit>({Unit({'a', 'a'})}));
+  EXPECT_EQ(Units, fuzzer::vector<Unit>({Unit({'a', 'a'})}));
   EXPECT_TRUE(
       ParseDictionaryFile("  #zzzz\naaa=\"aa\"\n\nabc=\"abc\"", &Units));
   EXPECT_EQ(Units,
-            std::vector<Unit>({Unit({'a', 'a'}), Unit({'a', 'b', 'c'})}));
+            fuzzer::vector<Unit>({Unit({'a', 'a'}), Unit({'a', 'b', 'c'})}));
 }
 
 TEST(FuzzerUtil, Base64) {
   EXPECT_EQ("", Base64({}));
   EXPECT_EQ("YQ==", Base64({'a'}));
   EXPECT_EQ("eA==", Base64({'x'}));
   EXPECT_EQ("YWI=", Base64({'a', 'b'}));
   EXPECT_EQ("eHk=", Base64({'x', 'y'}));
   EXPECT_EQ("YWJj", Base64({'a', 'b', 'c'}));
   EXPECT_EQ("eHl6", Base64({'x', 'y', 'z'}));
   EXPECT_EQ("YWJjeA==", Base64({'a', 'b', 'c', 'x'}));
   EXPECT_EQ("YWJjeHk=", Base64({'a', 'b', 'c', 'x', 'y'}));
   EXPECT_EQ("YWJjeHl6", Base64({'a', 'b', 'c', 'x', 'y', 'z'}));
 }
 
 TEST(Corpus, Distribution) {
   Random Rand(0);
   std::unique_ptr<InputCorpus> C(new InputCorpus(""));
   size_t N = 10;
   size_t TriesPerUnit = 1<<16;
   for (size_t i = 0; i < N; i++)
     C->AddToCorpus(Unit{ static_cast<uint8_t>(i) }, 1, false, {});
 
-  std::vector<size_t> Hist(N);
+  fuzzer::vector<size_t> Hist(N);
   for (size_t i = 0; i < N * TriesPerUnit; i++) {
     Hist[C->ChooseUnitIdxToMutate(Rand)]++;
   }
   for (size_t i = 0; i < N; i++) {
     // A weak sanity check that every unit gets invoked.
     EXPECT_GT(Hist[i], TriesPerUnit / N / 3);
   }
 }
TEST(Merge, Bad) {
   };
   Merger M;
   for (auto S : kInvalidInputs) {
     // fprintf(stderr, "TESTING:\n%s\n", S);
     EXPECT_FALSE(M.Parse(S, false));
   }
 }
 
-void EQ(const std::vector<uint32_t> &A, const std::vector<uint32_t> &B) {
+void EQ(const fuzzer::vector<uint32_t> &A, const fuzzer::vector<uint32_t> &B) {
   EXPECT_EQ(A, B);
 }
 
-void EQ(const std::vector<std::string> &A, const std::vector<std::string> &B) {
+void EQ(const fuzzer::vector<std::string> &A, const fuzzer::vector<std::string> &B) {
   std::set<std::string> a(A.begin(), A.end());
   std::set<std::string> b(B.begin(), B.end());
   EXPECT_EQ(a, b);
 }
 
 static void Merge(const std::string &Input,
-                  const std::vector<std::string> Result,
+                  const fuzzer::vector<std::string> Result,
                   size_t NumNewFeatures) {
   Merger M;
-  std::vector<std::string> NewFiles;
+  fuzzer::vector<std::string> NewFiles;
   EXPECT_TRUE(M.Parse(Input, true));
   std::stringstream SS;
   M.PrintSummary(SS);
   EXPECT_EQ(NumNewFeatures, M.Merge(&NewFiles));
   EXPECT_EQ(M.AllFeatures(), M.ParseSummary(SS));
   EQ(NewFiles, Result);
 }
 
TEST(Merge, Good) {
   EXPECT_EQ(M.Files[2].Name, "C");
   EXPECT_EQ(M.Files[2].Size, 1002U);
   EXPECT_EQ(M.LastFailure, "C");
   EXPECT_EQ(M.FirstNotProcessedFile, 3U);
   EQ(M.Files[0].Features, {1, 2, 3});
   EQ(M.Files[1].Features, {4, 5, 6});
 
 
-  std::vector<std::string> NewFiles;
+  fuzzer::vector<std::string> NewFiles;
 
   EXPECT_TRUE(M.Parse("3\n2\nAA\nBB\nC\n"
                         "STARTED 0 1000\nDONE 0 1 2 3\n"
                         "STARTED 1 1001\nDONE 1 4 5 6 \n"
                         "STARTED 2 1002\nDONE 2 6 1 3 \n"
                         "", true));
   EXPECT_EQ(M.Files.size(), 3U);
   EXPECT_EQ(M.NumFilesInFirstCorpus, 2U);
alignas(64) uint8_t Ar[N + 8] = {
     0, 0, 3, 0, 4, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 5, 0, 6, 0, 0,
     0, 0, 0, 0, 0, 0, 7, 0,
     0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 8,
     9, 9, 9, 9, 9, 9, 9, 9,
   };
-  typedef std::vector<std::pair<size_t, uint8_t> > Vec;
+  typedef fuzzer::vector<std::pair<size_t, uint8_t> > Vec;
   Vec Res, Expected;
   auto CB = [&](size_t FirstFeature, size_t Idx, uint8_t V) {
     Res.push_back({FirstFeature + Idx, V});
   };
   ForEachNonZeroByte(Ar, Ar + N, 100, CB);
   Expected = {{108, 1}, {109, 2}, {118, 3}, {120, 4},
               {135, 5}, {137, 6}, {146, 7}, {163, 8}};
   EXPECT_EQ(Res, Expected);