Index: lib/fuzzer/FuzzerLoop.cpp =================================================================== --- lib/fuzzer/FuzzerLoop.cpp +++ lib/fuzzer/FuzzerLoop.cpp @@ -135,10 +135,11 @@ memset(BaseSha1, 0, sizeof(BaseSha1)); } -Fuzzer::~Fuzzer() { } +Fuzzer::~Fuzzer() {} void Fuzzer::AllocateCurrentUnitData() { - if (CurrentUnitData || MaxInputLen == 0) return; + if (CurrentUnitData || MaxInputLen == 0) + return; CurrentUnitData = new uint8_t[MaxInputLen]; } @@ -148,7 +149,8 @@ } void Fuzzer::DumpCurrentUnit(const char *Prefix) { - if (!CurrentUnitData) return; // Happens when running individual inputs. + if (!CurrentUnitData) + return; // Happens when running individual inputs. MD.PrintMutationSequence(); Printf("; base unit: %s\n", Sha1ToString(BaseSha1).c_str()); size_t UnitSize = CurrentUnitSize; @@ -201,7 +203,7 @@ Printf("SUMMARY: libFuzzer: deadly signal\n"); DumpCurrentUnit("crash-"); PrintFinalStats(); - _Exit(Options.ErrorExitCode); // Stop right now. + _Exit(Options.ErrorExitCode); // Stop right now. } void Fuzzer::ExitCallback() { @@ -216,11 +218,10 @@ _Exit(Options.ErrorExitCode); } - void Fuzzer::InterruptCallback() { Printf("==%lu== libFuzzer: run interrupted; exiting\n", GetPid()); PrintFinalStats(); - _Exit(0); // Stop right now, don't perform any at-exit actions. + _Exit(0); // Stop right now, don't perform any at-exit actions. } NO_SANITIZE_MEMORY @@ -228,7 +229,8 @@ assert(Options.UnitTimeoutSec > 0); // In Windows Alarm callback is executed by a different thread. #if !LIBFUZZER_WINDOWS - if (!InFuzzingThread()) return; + if (!InFuzzingThread()) + return; #endif if (!RunningCB) return; // We have not started running units yet. @@ -274,11 +276,11 @@ if (size_t N = TPC.GetTotalPCCoverage()) Printf(" cov: %zd", N); if (size_t N = Corpus.NumFeatures()) - Printf( " ft: %zd", N); + Printf(" ft: %zd", N); if (!Corpus.empty()) { Printf(" corp: %zd", Corpus.NumActiveUnits()); if (size_t N = Corpus.SizeInBytes()) { - if (N < (1<<14)) + if (N < (1 << 14)) Printf("/%zdb", N); else if (N < (1 << 24)) Printf("/%zdKb", N >> 10); @@ -301,7 +303,8 @@ TPC.DumpCoverage(); if (Options.PrintCorpusStats) Corpus.PrintStats(); - if (!Options.PrintFinalStats) return; + if (!Options.PrintFinalStats) + return; size_t ExecPerSec = execPerSec(); Printf("stat::number_of_executed_units: %zd\n", TotalNumberOfRuns); Printf("stat::average_exec_per_sec: %zd\n", ExecPerSec); @@ -330,7 +333,8 @@ if (!Options.ExitOnSrcPos.empty()) { static auto *PCsSet = new Set; auto HandlePC = [&](uintptr_t PC) { - if (!PCsSet->insert(PC).second) return; + if (!PCsSet->insert(PC).second) + return; std::string Descr = DescribePC("%F %L", PC + 1); if (Descr.find(Options.ExitOnSrcPos) != std::string::npos) { Printf("INFO: found line matching '%s', exiting.\n", @@ -350,7 +354,8 @@ } void Fuzzer::RereadOutputCorpus(size_t MaxSize) { - if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec) return; + if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec) + return; Vector AdditionalCorpus; ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus, &EpochOfLastReadOfOutputCorpus, MaxSize, @@ -388,7 +393,8 @@ bool Fuzzer::RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile, InputInfo *II) { - if (!Size) return false; + if (!Size) + return false; ExecuteCallback(Data, Size); @@ -512,11 +518,10 @@ void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) { II->NumSuccessfullMutations++; MD.RecordSuccessfulMutationSequence(); - PrintStatusForNewUnit(U, II->Reduced ? "REDUCE" : - "NEW "); + PrintStatusForNewUnit(U, II->Reduced ? "REDUCE" : "NEW "); WriteToOutputCorpus(U); NumberOfNewUnitsAdded++; - CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus. + CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus. LastCorpusUpdateRun = TotalNumberOfRuns; LastCorpusUpdateTime = system_clock::now(); } @@ -525,19 +530,23 @@ // executed before calling this function. void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size, bool DuringInitialCorpusExecution) { - if (!HasMoreMallocsThanFrees) return; // mallocs==frees, a leak is unlikely. - if (!Options.DetectLeaks) return; + if (!HasMoreMallocsThanFrees) + return; // mallocs==frees, a leak is unlikely. + if (!Options.DetectLeaks) + return; if (!DuringInitialCorpusExecution && - TotalNumberOfRuns >= Options.MaxNumberOfRuns) return; + TotalNumberOfRuns >= Options.MaxNumberOfRuns) + return; if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) || !(EF->__lsan_do_recoverable_leak_check)) - return; // No lsan. + return; // No lsan. // Run the target once again, but with lsan disabled so that if there is // a real leak we do not report it twice. EF->__lsan_disable(); ExecuteCallback(Data, Size); EF->__lsan_enable(); - if (!HasMoreMallocsThanFrees) return; // a leak is unlikely. + if (!HasMoreMallocsThanFrees) + return; // a leak is unlikely. if (NumberOfLeakDetectionAttempts++ > 1000) { Options.DetectLeaks = false; Printf("INFO: libFuzzer disabled leak detection after every mutation.\n" @@ -558,7 +567,7 @@ CurrentUnitSize = Size; DumpCurrentUnit("leak-"); PrintFinalStats(); - _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on. + _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on. } } @@ -599,20 +608,16 @@ } void Fuzzer::PurgeAllocator() { - if (Options.PurgeAllocatorIntervalSec < 0 || - !EF->__sanitizer_purge_allocator) { + if (Options.PurgeAllocatorIntervalSec < 0 || !EF->__sanitizer_purge_allocator) return; - } if (duration_cast(system_clock::now() - - LastAllocatorPurgeAttemptTime).count() < - Options.PurgeAllocatorIntervalSec) { + LastAllocatorPurgeAttemptTime) + .count() < Options.PurgeAllocatorIntervalSec) return; - } if (Options.RssLimitMb <= 0 || - GetPeakRSSMb() > static_cast(Options.RssLimitMb) / 2) { + GetPeakRSSMb() > static_cast(Options.RssLimitMb) / 2) EF->__sanitizer_purge_allocator(); - } LastAllocatorPurgeAttemptTime = system_clock::now(); } @@ -671,7 +676,6 @@ } } - PrintStats("INITED"); if (Corpus.empty()) { Printf("ERROR: no interesting inputs were found. " @@ -696,13 +700,14 @@ } if (TotalNumberOfRuns >= Options.MaxNumberOfRuns) break; - if (TimedOut()) break; + if (TimedOut()) + break; // Update TmpMaxMutationLen if (Options.ExperimentalLenControl) { if (TmpMaxMutationLen < MaxMutationLen && - (TotalNumberOfRuns - LastCorpusUpdateRun > 1000 && - duration_cast(Now - LastCorpusUpdateTime).count() >= 1)) { + (TotalNumberOfRuns - LastCorpusUpdateRun > 1000 && + duration_cast(Now - LastCorpusUpdateTime).count() >= 1)) { LastCorpusUpdateRun = TotalNumberOfRuns; LastCorpusUpdateTime = Now; TmpMaxMutationLen = @@ -727,7 +732,8 @@ } void Fuzzer::MinimizeCrashLoop(const Unit &U) { - if (U.size() <= 1) return; + if (U.size() <= 1) + return; while (!TimedOut() && TotalNumberOfRuns < Options.MaxNumberOfRuns) { MD.StartMutationSequence(); memcpy(CurrentUnitData, U.data(), U.size()); @@ -756,7 +762,8 @@ if (Data[i] != OtherData[i]) break; Printf("==%lu== ERROR: libFuzzer: equivalence-mismatch. Sizes: %zd %zd; " - "offset %zd\n", GetPid(), Size, OtherSize, i); + "offset %zd\n", + GetPid(), Size, OtherSize, i); DumpCurrentUnit("mismatch-"); Printf("SUMMARY: libFuzzer: equivalence-mismatch\n"); PrintFinalStats(); @@ -779,4 +786,4 @@ assert(fuzzer::F); fuzzer::F->AnnounceOutput(Data, Size); } -} // extern "C" +} // extern "C"