[libfuzzer] Replace memmem with strstr.

[metzman]

Summary

Memmem is not available on Windows.

[metzman]

Replace memmem with strstr

[metzman]

• remove comment

[metzman]

@morehouse
Please take a look.
This patch replaces use of memmem with strstr so that the two tests that use this code can compile on Windows (they still fail because LLVMFuzzerInitialize isn't working, but I have a fix for that, patch on the way).

cc @george.karpenkov who switched this to memmem initially.

[george.karpenkov]

I'm fine with the change. I don't remember why it was switched initially, probably because the previous version was not working on macOS.

[morehouse]

Maybe memcmp would be cleaner here.

[metzman]

In D51692#1225110, @morehouse wrote:

Maybe memcmp would be cleaner here.

I tried using memcmp and I had to limit the size (to around ~50 chars) or else the test would run forever. I can't say I know exactly why though.

[metzman]

Actually, I think I know why.
It looks like exact match was too difficult for LF (was lit not always used for tests?).
This is why a search function was first added by @george.karpenkov
See
https://github.com/llvm-mirror/llvm/commit/6795f26af554ad58aaca056db03657653b2e4e60#diff-1034b931b86661aee0b11db45658a8b5

[morehouse]

That patch broke the behavior of this test. Looks like we used to print "BINGO" when the input matched the binary name. Now we print "BINGO" when the input size matches but the names do not.

[metzman]

In D51692#1225180, @morehouse wrote:

That patch broke the behavior of this test. Looks like we used to print "BINGO" when the input matched the binary name. Now we print "BINGO" when the input size matches but the names do not.

It definitely changed the behavior, but I'm not sure it broke it. Since that patch we print BINGO if Data contained argv[0].
Do you want to go back to exact match?
libFuzzer seems to have a hard time with this on any platform (the path names can get extremely long).
Also, being able to pass an exact match doesn't seem to be relevant to the purpose of this test (it seems intended to test that LLVMFuzzerInitialize is called).

[morehouse]

Maybe I'm misunderstanding something, but I'm pretty sure memmem returns non-null on a match while strncmp returns 0 on match. Which would mean the ! should have been removed.

[metzman]

Sorry, Matt you had a better understanding of what my patch does than I did.
You are right that the if-body is taken when the lengths are the same but the string is different.
In any case though, I think testing if we can match strings is unnecessary anyway right? Can we just test that argv0 was set?

[metzman]

My first diff did an exact match on part of argv[0], doing the entire thing was too difficult: https://reviews.llvm.org/D51692?vs=on&id=164071&whitespace=ignore-most#toc
Do you think that solution is better than testing if argv0 was set?

[george.karpenkov]

That patch broke the behavior of this test

Are you referring to https://reviews.llvm.org/D36242 ?
Yes, it seems it had a bug and ! should have been dropped.

[morehouse]

It seems reasonable to just check that argv is set, since this test is intended to check for LLVMFuzzerInitialize being called. There's plenty of other tests where libFuzzer must find a string.

[metzman]

• use different comparison and check pointer is not null

[metzman]

In my newest diff, we enter the if-body if argv0 was set by LLVMFuzzerInitialize and Data begins with "fuzz", which should be easy enough for most any test to pass.

We cant just enter the body if argv0 was set since standalone.test depends on the body not being entered (the print of BINGO causes the test to fail).

compiler-rt/trunk/test/fuzzer/InitializeTest.cpp

 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 
 // Make sure LLVMFuzzerInitialize is called.
 #include <assert.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
-static char *argv0;
+static char *argv0 = NULL;
 
 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) {
   assert(*argc > 0);
   argv0 = **argv;
   fprintf(stderr, "LLVMFuzzerInitialize: %s\n", argv0);
   return 0;
 }
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
   assert(argv0);
-  if (Size == strlen(argv0) &&
-      !memmem(Data, Size, argv0, Size)) {
+  if (argv0 && Size >= 4 && !memcmp(Data, "fuzz", 4)) {
     fprintf(stderr, "BINGO %s\n", argv0);
     exit(1);
   }
   return 0;
 }

compiler-rt/trunk/test/fuzzer/initialize.test

-# FIXME: Disabled on Windows because memmem is a GNU extension.
+# FIXME: Disabled on Windows since LLVMFuzzerInitialize does not yet work.
 UNSUPPORTED: windows
 CHECK: BINGO
 RUN: %cpp_compiler %S/InitializeTest.cpp -o %t-InitializeTest
 RUN: not %run %t-InitializeTest -use_value_profile=1 2>&1 | FileCheck %s