Index: compiler-rt/trunk/lib/fuzzer/FuzzerDriver.cpp =================================================================== --- compiler-rt/trunk/lib/fuzzer/FuzzerDriver.cpp +++ compiler-rt/trunk/lib/fuzzer/FuzzerDriver.cpp @@ -182,7 +182,8 @@ } // We don't use any library to minimize dependencies. -static void ParseFlags(const Vector &Args) { +static void ParseFlags(const Vector &Args, + const ExternalFunctions *EF) { for (size_t F = 0; F < kNumFlags; F++) { if (FlagDescriptions[F].IntFlag) *FlagDescriptions[F].IntFlag = FlagDescriptions[F].Default; @@ -192,6 +193,11 @@ if (FlagDescriptions[F].StrFlag) *FlagDescriptions[F].StrFlag = nullptr; } + + // Disable len_control by default, if LLVMFuzzerCustomMutator is used. + if (EF->LLVMFuzzerCustomMutator) + Flags.len_control = 0; + Inputs = new Vector; for (size_t A = 1; A < Args.size(); A++) { if (ParseOneFlag(Args[A].c_str())) { @@ -616,7 +622,7 @@ Printf("ERROR: argv[0] has been modified in LLVMFuzzerInitialize\n"); exit(1); } - ParseFlags(Args); + ParseFlags(Args, EF); if (Flags.help) { PrintHelp(); return 0; Index: compiler-rt/trunk/lib/fuzzer/FuzzerFlags.def =================================================================== --- compiler-rt/trunk/lib/fuzzer/FuzzerFlags.def +++ compiler-rt/trunk/lib/fuzzer/FuzzerFlags.def @@ -19,7 +19,7 @@ FUZZER_FLAG_INT(len_control, 100, "Try generating small inputs first, " "then try larger inputs over time. Specifies the rate at which the length " "limit is increased (smaller == faster). If 0, immediately try inputs with " - "size up to max_len.") + "size up to max_len. Default value is 0, if LLVMFuzzerCustomMutator is used.") FUZZER_FLAG_STRING(seed_inputs, "A comma-separated list of input files " "to use as an additional seed corpus. Alternatively, an \"@\" followed by " "the name of a file containing the comma-seperated list.") Index: compiler-rt/trunk/test/fuzzer/fuzzer-custommutator.test =================================================================== --- compiler-rt/trunk/test/fuzzer/fuzzer-custommutator.test +++ compiler-rt/trunk/test/fuzzer/fuzzer-custommutator.test @@ -1,5 +1,11 @@ RUN: %cpp_compiler %S/CustomMutatorTest.cpp -o %t-CustomMutatorTest RUN: not %run %t-CustomMutatorTest 2>&1 | FileCheck %s --check-prefix=LLVMFuzzerCustomMutator LLVMFuzzerCustomMutator: In LLVMFuzzerCustomMutator +LLVMFuzzerCustomMutator: {{.*}} lim: 4096 {{.*}} LLVMFuzzerCustomMutator: BINGO +# len_control is disabled for custom mutators by default, test that it can be enabled. +RUN: not %run %t-CustomMutatorTest -len_control=100 2>&1 | FileCheck %s --check-prefix=LLVMFuzzerCustomMutatorWithLenControl +LLVMFuzzerCustomMutatorWithLenControl: In LLVMFuzzerCustomMutator +LLVMFuzzerCustomMutatorWithLenControl: {{.*}} lim: {{[1-9][0-9]?}} {{.*}} +LLVMFuzzerCustomMutatorWithLenControl: BINGO