diff --git a/compiler-rt/lib/fuzzer/FuzzerDriver.cpp b/compiler-rt/lib/fuzzer/FuzzerDriver.cpp --- a/compiler-rt/lib/fuzzer/FuzzerDriver.cpp +++ b/compiler-rt/lib/fuzzer/FuzzerDriver.cpp @@ -763,16 +763,22 @@ exit(0); } - // Parse -seed_inputs=file1,file2,... + // Parse -seed_inputs=file1,file2,... or -seed_inputs=@seed_inputs_file Vector ExtraSeedFiles; + if (Flags.seed_inputs) { - std::string s = Flags.seed_inputs; - size_t comma_pos; - while ((comma_pos = s.find_last_of(',')) != std::string::npos) { - ExtraSeedFiles.push_back(s.substr(comma_pos + 1)); - s = s.substr(0, comma_pos); + std::string SeedInputs; + if (Flags.seed_inputs[0] == '@') + SeedInputs = FileToString(Flags.seed_inputs + 1); // File contains list. + else + SeedInputs = Flags.seed_inputs; // seed_inputs contains the list. + // Parse SeedInputs. + size_t comma_pos = 0; + while ((comma_pos = SeedInputs.find_last_of(',')) != std::string::npos) { + ExtraSeedFiles.push_back(SeedInputs.substr(comma_pos + 1)); + SeedInputs = SeedInputs.substr(0, comma_pos); } - ExtraSeedFiles.push_back(s); + ExtraSeedFiles.push_back(SeedInputs); } F->Loop(*Inputs, ExtraSeedFiles); diff --git a/compiler-rt/lib/fuzzer/FuzzerFlags.def b/compiler-rt/lib/fuzzer/FuzzerFlags.def --- a/compiler-rt/lib/fuzzer/FuzzerFlags.def +++ b/compiler-rt/lib/fuzzer/FuzzerFlags.def @@ -21,7 +21,8 @@ "limit is increased (smaller == faster). If 0, immediately try inputs with " "size up to max_len.") FUZZER_FLAG_STRING(seed_inputs, "A comma-separated list of input files " - "to use as an additional seed corpus") + "to use as an additional seed corpus. Alternatively, an \"@\" followed by " + "the name of a file containing the comma-seperated list.") FUZZER_FLAG_INT(cross_over, 1, "If 1, cross over inputs.") FUZZER_FLAG_INT(mutate_depth, 5, "Apply this number of consecutive mutations to each input.") diff --git a/compiler-rt/lib/fuzzer/FuzzerFork.cpp b/compiler-rt/lib/fuzzer/FuzzerFork.cpp --- a/compiler-rt/lib/fuzzer/FuzzerFork.cpp +++ b/compiler-rt/lib/fuzzer/FuzzerFork.cpp @@ -66,6 +66,7 @@ std::string CorpusDir; std::string FeaturesDir; std::string LogPath; + std::string SeedListPath; std::string CFPath; // Fuzzing Outputs. @@ -74,6 +75,7 @@ ~FuzzJob() { RemoveFile(CFPath); RemoveFile(LogPath); + RemoveFile(SeedListPath); RmDirRecursive(CorpusDir); RmDirRecursive(FeaturesDir); } @@ -121,8 +123,11 @@ for (size_t i = 0; i < CorpusSubsetSize; i++) Seeds += (Seeds.empty() ? "" : ",") + Files[Rand->SkewTowardsLast(Files.size())]; - if (!Seeds.empty()) - Cmd.addFlag("seed_inputs", Seeds); + if (!Seeds.empty()) { + Job->SeedListPath = std::to_string(JobId) + ".seeds"; + WriteToFile(Seeds, Job->SeedListPath); + Cmd.addFlag("seed_inputs", Job->SeedListPath); + } Job->LogPath = DirPlusFile(TempDir, std::to_string(JobId) + ".log"); Job->CorpusDir = DirPlusFile(TempDir, "C" + std::to_string(JobId)); Job->FeaturesDir = DirPlusFile(TempDir, "F" + std::to_string(JobId)); diff --git a/compiler-rt/lib/fuzzer/FuzzerIO.h b/compiler-rt/lib/fuzzer/FuzzerIO.h --- a/compiler-rt/lib/fuzzer/FuzzerIO.h +++ b/compiler-rt/lib/fuzzer/FuzzerIO.h @@ -25,6 +25,8 @@ void CopyFileToErr(const std::string &Path); void WriteToFile(const uint8_t *Data, size_t Size, const std::string &Path); +// Write Data.c_str() to the file without terminating null character. +void WriteToFile(const std::string &Data, const std::string &Path); void WriteToFile(const Unit &U, const std::string &Path); void ReadDirToVectorOfUnits(const char *Path, Vector *V, diff --git a/compiler-rt/lib/fuzzer/FuzzerIO.cpp b/compiler-rt/lib/fuzzer/FuzzerIO.cpp --- a/compiler-rt/lib/fuzzer/FuzzerIO.cpp +++ b/compiler-rt/lib/fuzzer/FuzzerIO.cpp @@ -64,6 +64,11 @@ WriteToFile(U.data(), U.size(), Path); } +void WriteToFile(const std::string &Data, const std::string &Path) { + WriteToFile(reinterpret_cast(Data.c_str()), Data.size(), + Path); +} + void WriteToFile(const uint8_t *Data, size_t Size, const std::string &Path) { // Use raw C interface because this function may be called from a sig handler. FILE *Out = fopen(Path.c_str(), "wb"); diff --git a/compiler-rt/test/fuzzer/seed_inputs.test b/compiler-rt/test/fuzzer/seed_inputs.test new file mode 100644 --- /dev/null +++ b/compiler-rt/test/fuzzer/seed_inputs.test @@ -0,0 +1,17 @@ +RUN: %cpp_compiler %S/SimpleTest.cpp -o %t-SimpleTest + +USE-1: INFO: seed corpus: files: 1 +RUN: echo -n "%t-SimpleTest" > %t.seed-inputs +# Test both formats of -seed_inputs argument. +RUN: %run %t-SimpleTest -runs=1 -seed_inputs=@%t.seed-inputs 2>&1 | FileCheck %s --check-prefix=USE-1 +RUN: %run %t-SimpleTest -runs=1 -seed_inputs=%t-SimpleTest 2>&1 | FileCheck %s --check-prefix=USE-1 + +USE-2: INFO: seed corpus: files: 2 +RUN: echo -n "%t-SimpleTest,%t-SimpleTest" > %t.seed-inputs +RUN: %run %t-SimpleTest -runs=1 -seed_inputs=@%t.seed-inputs 2>&1 | FileCheck %s --check-prefix=USE-2 +RUN: %run %t-SimpleTest -runs=1 -seed_inputs=%t-SimpleTest,%t-SimpleTest 2>&1 | FileCheck %s --check-prefix=USE-2 + +# Test that missing files and trailing commas are tolerated. +RUN: echo -n "%t-SimpleTest,%t-SimpleTest,nonexistent-file," > %t.seed-inputs +RUN: %run %t-SimpleTest -runs=1 -seed_inputs=@%t.seed-inputs 2>&1 | FileCheck %s --check-prefix=USE-2 +RUN: %run %t-SimpleTest -runs=1 -seed_inputs=%t-SimpleTest,%t-SimpleTest,nonexistent-file, 2>&1 | FileCheck %s --check-prefix=USE-2