Add argument name mangling to llvm-mc-assemble-fuzzer

[BrandonTJones]

Summary

This is one of the only fuzzers that has an untraditional command line in context of argument parsing. A part of this is the number of different arguments llvm-mc itself can take. To help make this binary OSS-Fuzz compatible I have added -mtarget name mangling to this binary.

llvm/tools/llvm-mc-assemble-fuzzer/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
     AllTargetsAsmPrinters
     AllTargetsAsmParsers
     AllTargetsDescs
     AllTargetsInfos
     MC
     MCParser
     Support
+    FuzzMutate
 )
 add_llvm_fuzzer(llvm-mc-assemble-fuzzer
   llvm-mc-assemble-fuzzer.cpp
   )

llvm/tools/llvm-mc-assemble-fuzzer/llvm-mc-assemble-fuzzer.cpp

 //===--- llvm-mc-fuzzer.cpp - Fuzzer for the MC layer ---------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 //===----------------------------------------------------------------------===//
 
+#include "llvm/FuzzMutate/FuzzerCLI.h"
+#include "llvm/FuzzMutate/IRMutator.h"
 #include "llvm-c/Target.h"
 #include "llvm/MC/SubtargetFeature.h"
 #include "llvm/MC/MCAsmBackend.h"
 #include "llvm/MC/MCAsmInfo.h"
 #include "llvm/MC/MCCodeEmitter.h"
 #include "llvm/MC/MCContext.h"
 #include "llvm/MC/MCInstPrinter.h"
 #include "llvm/MC/MCInstrInfo.h"

 #include "llvm/Support/raw_ostream.h"
 #include "llvm/Support/SourceMgr.h"
 #include "llvm/Support/TargetSelect.h"
 #include "llvm/Support/TargetRegistry.h"
 #include "llvm/Support/ToolOutputFile.h"
 
 using namespace llvm;
 
+// This is used for overriding target triple through name mangling in the binary name.
+static cl::opt<std::string>
+    TargetTripleStr("mtriple", cl::desc("Override target triple for module"));
+
 static cl::opt<std::string>
     TripleName("triple", cl::desc("Target triple to assemble for, "
                                   "see -version for available targets"));
 
 static cl::opt<std::string>
     MCPU("mcpu",
          cl::desc("Target a specific cpu type (-mcpu=help for details)"),
          cl::value_desc("cpu-name"), cl::init(""));
 
 // This is useful for variable-length instruction sets.
 static cl::opt<unsigned> InsnLimit(
     "insn-limit",
     cl::desc("Limit the number of instructions to process (0 for no limit)"),
     cl::value_desc("count"), cl::init(0));
 
 static cl::list<std::string>
     MAttrs("mattr", cl::CommaSeparated,
            cl::desc("Target specific attributes (-mattr=help for details)"),
            cl::value_desc("a1,+a2,-a3,..."));
+
 // The feature string derived from -mattr's values.
 std::string FeaturesStr;
 
 static cl::list<std::string>
     FuzzerArgs("fuzzer-args", cl::Positional,
                cl::desc("Options to pass to the fuzzer"), cl::ZeroOrMore,
                cl::PositionalEatsArgs);
+
 static std::vector<char *> ModifiedArgv;
 
 enum OutputFileType {
   OFT_Null,
   OFT_AssemblyFile,
   OFT_ObjectFile
 };
 static cl::opt<OutputFileType>

 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
   return AssembleOneInput(Data, Size);
 }
 
 extern "C" LLVM_ATTRIBUTE_USED int LLVMFuzzerInitialize(int *argc,
                                                         char ***argv) {
   // The command line is unusual compared to other fuzzers due to the need to
-  // specify the target. Options like -triple, -mcpu, and -mattr work like
-  // their counterparts in llvm-mc, while -fuzzer-args collects options for the
-  // fuzzer itself.
+  // specify more than just the target. Options like -triple, -mcpu,
+  // and -mattr work like their counterparts in llvm-mc, while -fuzzer-args
+  // collects options for the fuzzer itself.
+  // Like other fuzzers though, you may mangle the target argument into
+  // file name of the binary itself. If you do this it will override the
+  // -triple argument.
   //
   // Examples:
   //
   // Fuzz the big-endian MIPS32R6 disassembler using 100,000 inputs of up to
   // 4-bytes each and use the contents of ./corpus as the test corpus:
   //   llvm-mc-fuzzer -triple mips-linux-gnu -mcpu=mips32r6 -disassemble \
   //       -fuzzer-args -max_len=4 -runs=100000 ./corpus
   //
extern "C" LLVM_ATTRIBUTE_USED int LLVMFuzzerInitialize(int *argc,
   // there will be considerable redundancy in the corpus.
 
   char **OriginalArgv = *argv;
 
   LLVMInitializeAllTargetInfos();
   LLVMInitializeAllTargetMCs();
   LLVMInitializeAllAsmParsers();
 
+  // Parse any arguments mangled into the file name.
+  llvm::handleExecNameEncodedOptimizerOpts(*argv[0]);
+  parseFuzzerCLOpts(*argc, *argv);
+
   cl::ParseCommandLineOptions(*argc, OriginalArgv);
 
   // Rebuild the argv without the arguments llvm-mc-fuzzer consumed so that
   // the driver can parse its arguments.
   //
   // FuzzerArgs cannot provide the non-const pointer that OriginalArgv needs.
   // Re-use the strings from OriginalArgv instead of copying FuzzerArg to a
   // non-const buffer to avoid the need to clean up when the fuzzer terminates.
extern "C" LLVM_ATTRIBUTE_USED int LLVMFuzzerInitialize(int *argc,
   // permit any user data.
   if (MAttrs.size()) {
     SubtargetFeatures Features;
     for (unsigned i = 0; i != MAttrs.size(); ++i)
       Features.AddFeature(MAttrs[i]);
     FeaturesStr = Features.getString();
   }
 
-  if (TripleName.empty())
+  // If the binary name has a target triple mangled into it, overwride the triple
+  // argument with it.
+  if (!TargetTripleStr.empty()){
+    TripleName.setValue(TargetTripleStr.getValue());
+  }
+  else if (TripleName.empty()){
     TripleName = sys::getDefaultTargetTriple();
+  }
 
   return 0;
 }