[libFuzzer] Link libFuzzer's own interceptors when other compiler runtimes are not linked.

[dokyungs]

Summary

libFuzzer intercepts certain library functions such as memcmp/strcmp by defining weak hooks. Weak hooks, however, are called only when other runtimes such as ASan is linked. This patch defines libFuzzer's own interceptors, which is linked into the libFuzzer executable when other runtimes are not linked, i.e., when -fsanitize=fuzzer is given, but not others.

The patch once landed but was reverted in 8ef9e2bf355d05bc81d8b0fe1e5333eec59a0a91 due to an assertion failure caused by calling an intercepted function, strncmp, while initializing the interceptors in fuzzerInit(). This issue is now fixed by calling internal_strncmp() when the fuzzer has not been initialized yet, instead of recursively calling fuzzerInit() again.

[morehouse]

Seems like the general approach we want.

Could you:

• Fix the lint warnings
• Find out why the unit tests failed
• Add strcmp
• Modify the memcmp/strcmp unit tests to show that we can solve them with/without ASan

After that I'll take a closer look.

[dokyungs]

Add interceptors for all the functions libFuzzer has a weak interceptor for, and duplicate existing interceptor test cases with new compiler flags (-fno-sanitize=address).

Builtin libfunc optimizations may transform memcmp and strcmp-like functions. To disable such optimizations, -fno-builtin= flag was additionally added in compiling new test cases. FWIW, the original test cases didn't require such flags since other sanitizers including ASan disables those optimizations in their LLVM pass by dropping libfunc attribute in the call instructions.

[hctim]

In D83494#2147608, @dokyungs wrote:

Builtin libfunc optimizations may transform memcmp and strcmp-like functions. To disable such optimizations, -fno-builtin= flag was additionally added in compiling new test cases. FWIW, the original test cases didn't require such flags since other sanitizers including ASan disables those optimizations in their LLVM pass by dropping libfunc attribute in the call instructions.

It sounds like we need to add -fno-builtin in the clang driver when building with sancov as well. Otherwise, users won't get any benefit of this patch without doing clang++ -fsanitize=fuzzer my_fuzz_target.cpp -fno-builtin-strstr -fno-builtin-strncmp -fno-builtin-strcmp -fno-builtin-memcmp?

[dokyungs]

In D83494#2148043, @hctim wrote:

In D83494#2147608, @dokyungs wrote:

Builtin libfunc optimizations may transform memcmp and strcmp-like functions. To disable such optimizations, -fno-builtin= flag was additionally added in compiling new test cases. FWIW, the original test cases didn't require such flags since other sanitizers including ASan disables those optimizations in their LLVM pass by dropping libfunc attribute in the call instructions.

It sounds like we need to add -fno-builtin in the clang driver when building with sancov as well. Otherwise, users won't get any benefit of this patch without doing clang++ -fsanitize=fuzzer my_fuzz_target.cpp -fno-builtin-strstr -fno-builtin-strncmp -fno-builtin-strcmp -fno-builtin-memcmp?

Right. Apparently with -O2 many calls to memcmp-like functions are removed. I just wondered, though, what makes more sense: disabling such optimization when building (i) with sancov, or (ii) with -fsanitize=fuzzer? If we go for (i), would it make sense to do it in the SanitizerCoverage module pass like other sanitizers do? What do you think? Also, can it be addressed in a follow-up patch?

[morehouse]

In D83494#2148164, @dokyungs wrote:

In D83494#2148043, @hctim wrote:

In D83494#2147608, @dokyungs wrote:

Builtin libfunc optimizations may transform memcmp and strcmp-like functions. To disable such optimizations, -fno-builtin= flag was additionally added in compiling new test cases. FWIW, the original test cases didn't require such flags since other sanitizers including ASan disables those optimizations in their LLVM pass by dropping libfunc attribute in the call instructions.

It sounds like we need to add -fno-builtin in the clang driver when building with sancov as well. Otherwise, users won't get any benefit of this patch without doing clang++ -fsanitize=fuzzer my_fuzz_target.cpp -fno-builtin-strstr -fno-builtin-strncmp -fno-builtin-strcmp -fno-builtin-memcmp?

Right. Apparently with -O2 many calls to memcmp-like functions are removed. I just wondered, though, what makes more sense: disabling such optimization when building (i) with sancov, or (ii) with -fsanitize=fuzzer? If we go for (i), would it make sense to do it in the SanitizerCoverage module pass like other sanitizers do? What do you think? Also, can it be addressed in a follow-up patch?

My opinion is to make it part of -fsanitize=fuzzer, or maybe disable parts of the builtin optimization pass for functions with the OptForFuzzing attribute.

And I think a follow-up patch is easier to review.

[dokyungs]

Fixed a few LINT warnings by defining some macros that resemble the ones used in other sanitizer interception code.

[hctim]

In D83494#2148180, @morehouse wrote:

In D83494#2148164, @dokyungs wrote:

Right. Apparently with -O2 many calls to memcmp-like functions are removed. I just wondered, though, what makes more sense: disabling such optimization when building (i) with sancov, or (ii) with -fsanitize=fuzzer? If we go for (i), would it make sense to do it in the SanitizerCoverage module pass like other sanitizers do? What do you think? Also, can it be addressed in a follow-up patch?

My opinion is to make it part of -fsanitize=fuzzer, or maybe disable parts of the builtin optimization pass for functions with the OptForFuzzing attribute.

And I think a follow-up patch is easier to review.

Agreed with Matt on all of the above.

[morehouse]

compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp

15

We should include FuzzerDefs.h to use this, not FuzzerBuiltins.h.

26

Any reason not to use uintptr_t instead?

42

Nit: I think we should prefer C++ constructs, so reinterpret_cast<uintptr_t> here.

117

Why extern "C++"? I don't think we want that here.

124

Also why extern "C++" here?

141

Nit: reinterpret_cast<uintptr_t>()

160

Nit: Please add this comment:

} // extern "C"

compiler-rt/test/fuzzer/no-asan-strstr.test

5 ↗

(On Diff #277530)

Since these "no-asan" cases are pretty small, can we just add them to the existing *cmp tests?

[dokyungs]

Addressed Matt's comments.

A major change in this round that needs explanation is introduction of FuzzerPlatform.h. Previously I defined strstr and strcasestr with extern "C++" to workaround conflicting definition errors resulting from including <string.h>. But since including it is not necessary when compiling this interceptor module, this patch now separates out platform related macros from FuzzerDef.h into FuzzerPlatform.h, and the module includes FuzzerPlatform.h, not FuzzerDef.h.

[dokyungs]

compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp

117

Removed by not including #include <string>.

124

Removed by not including #include <string>.

[dokyungs]

strncmp test should include -fno-builtin-strncmp, not -fno-builtin-strcmp

[dokyungs]

Use unique output file name for each subtest, and add no-asan subtest in memcmp64.test

[morehouse]

In D83494#2148868, @dokyungs wrote:

Addressed Matt's comments.

A major change in this round that needs explanation is introduction of FuzzerPlatform.h. Previously I defined strstr and strcasestr with extern "C++" to workaround conflicting definition errors resulting from including <string.h>. But since including it is not necessary when compiling this interceptor module, this patch now separates out platform related macros from FuzzerDef.h into FuzzerPlatform.h, and the module includes FuzzerPlatform.h, not FuzzerDef.h.

What was the conflicting definition error? Does string.h have inline definitions for those functions?

compiler-rt/test/fuzzer/memcmp.test

8

CHECK1 and CHECK2 is unnecessary. Let's use the same CHECK for both.

[hctim]

clang/lib/Driver/SanitizerArgs.cpp

242

HWASan doesn't have interceptors - we actually want fuzzer interceptors under needsFuzzer() && needsHwasanRt() (just remove the !needsHwasanRt()).

compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp

52

Why not #include <sanitizer/common_interface_defs.h> (and below)?

compiler-rt/lib/fuzzer/FuzzerPlatform.h

1

Nit - name change

8

Nit - remove blank comment

compiler-rt/test/fuzzer/memcmp.test

8

No need to have different CHECK's throughout this patchset (in both tests we're checking for the same thing.

UNSUPPORTED: freebsd
RUN: %cpp_compiler %S/MemcmpTest.cpp -o %t-MemcmpTest
RUN: not %run %t-MemcmpTest               -seed=1 -runs=10000000   2>&1 | FileCheck %s

RUN: %cpp_compiler -fno-sanitize=address -fno-builtin-memcmp %S/MemcmpTest.cpp -o %t-NoAsanMemcmpTest
RUN: not %run %t-MemcmpTest               -seed=1 -runs=10000000   2>&1 | FileCheck %s

CHECK: BINGO

[dokyungs]

In D83494#2150643, @morehouse wrote:

In D83494#2148868, @dokyungs wrote:

Addressed Matt's comments.

A major change in this round that needs explanation is introduction of FuzzerPlatform.h. Previously I defined strstr and strcasestr with extern "C++" to workaround conflicting definition errors resulting from including <string.h>. But since including it is not necessary when compiling this interceptor module, this patch now separates out platform related macros from FuzzerDef.h into FuzzerPlatform.h, and the module includes FuzzerPlatform.h, not FuzzerDef.h.

What was the conflicting definition error? Does string.h have inline definitions for those functions?

I was misled; the error is actually ambiguating new "declarations", not definitions. The exact error message goes like:

error: ambiguating new declaration of ‘char* strcasestr(const char*, const char*)’
  104 | ATTRIBUTE_INTERFACE char *strcasestr(const char *s1, const char *s2) {
      |                           ^~~~~~~~~~
In file included from include/c++/v1/string.h:60,
                 from include/c++/v1/cstring:60,
                 from include/c++/v1/algorithm:641,
                 from include/c++/v1/__string:57,
                 from include/c++/v1/string_view:175,
                 from include/c++/v1/string:506,
                 from FuzzerInterceptors.cpp:14:
/usr/include/string.h:356:26: note: old declaration ‘const char* strcasestr(const char*, const char*)’
  356 | extern "C++" const char *strcasestr (const char *__haystack,
      |                          ^~~~~~~~~~

C++'s declarations of strstr/strcasestr each have two different versions (const v. non const), and neither of them matches C's strstr/strcasestr declarations. So I could either (i) make libFuzzer's declarations of strstr/strcasestr match one of C++ versions (for this reason there was "extern C++ ..."), or (ii) make them match C declarations of strstr/strcasestr and remove C++ declarations by not including string.h. I realized that (ii) is a simpler solution, so I changed the code that way.

[dokyungs]

Addressed comments.

[morehouse]

In D83494#2150946, @dokyungs wrote:

I was misled; the error is actually ambiguating new "declarations", not definitions. The exact error message goes like:

error: ambiguating new declaration of ‘char* strcasestr(const char*, const char*)’
  104 | ATTRIBUTE_INTERFACE char *strcasestr(const char *s1, const char *s2) {
      |                           ^~~~~~~~~~
In file included from include/c++/v1/string.h:60,
                 from include/c++/v1/cstring:60,
                 from include/c++/v1/algorithm:641,
                 from include/c++/v1/__string:57,
                 from include/c++/v1/string_view:175,
                 from include/c++/v1/string:506,
                 from FuzzerInterceptors.cpp:14:
/usr/include/string.h:356:26: note: old declaration ‘const char* strcasestr(const char*, const char*)’
  356 | extern "C++" const char *strcasestr (const char *__haystack,
      |                          ^~~~~~~~~~

C++'s declarations of strstr/strcasestr each have two different versions (const v. non const), and neither of them matches C's strstr/strcasestr declarations. So I could either (i) make libFuzzer's declarations of strstr/strcasestr match one of C++ versions (for this reason there was "extern C++ ..."), or (ii) make them match C declarations of strstr/strcasestr and remove C++ declarations by not including string.h. I realized that (ii) is a simpler solution, so I changed the code that way.

Got it. We only need to intercept the libc version of strstr. We don't care about libc++ since that one just forwards to libc. So I think this is the right approach.

compiler-rt/lib/fuzzer/FuzzerDefs.h

23

Nit: we should really not include this here. Instead, we should include it directly in any libFuzzer file that needs the platform macros.

Of course, that will add some noise to this patch. Could you splice this change into a separate patch that we can submit first?

[dokyungs]

Use one CHECK for two subtests

[dokyungs]

Addressed comments.

[morehouse]

LGTM

[hctim]

LGTM

compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp

52

The comment above is obsolete - please mark as done before closing out the patch.

[morehouse]

I applied this patch locally and ran the fuzzer tests. I get a segfault:

$ clang++ -fsanitize=fuzzer -g -m32 SimpleHashTest.cpp
$ gdb --args ./a.out -seed=1
...
(gdb) run
...
Program received signal SIGSEGV, Segmentation fault. 
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x080800b5 in strstr () at /usr/local/google/home/mascasa/code/llvm-project/compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp:96
#2  0xf7cc7bf5 in __pthread_initialize_minimal () from /lib/i386-linux-gnu/libpthread.so.0
#3  0xf7cc7014 in _init () from /lib/i386-linux-gnu/libpthread.so.0
#4  0x00000055 in ?? ()
#5  0xf7fcc6a0 in ?? ()

It looks like the REAL(strstr) isn't set up before it's called. Could you please take a look?

[dokyungs]

Ensure the fuzzer RT module is initialized at the beginning of the interceptors.

Interceptors can be called before __fuzzer_init is called. So I added a check at the beginning of the interceptors, which ensures that __fuzzer_init has been called before proceeding.

[morehouse]

compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp

54

These are in the global namespace, and have C mangling, which is unnecessary. Please either put them in a namespace or make them static.

56

This also doesn't need C mangling.

64

Let's prefer a function rather than a macro for this.

144

Let's use true/false rather than 1/0 for bools.

[morehouse]

compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp

18

Nit: Let's move this down with the other defines.

31

Nit: Can we move the other includes down by this one?

[dokyungs]

Addressed comments.

[morehouse]

compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp

52

Sorry, one last nit:

If we're preferring LLVM style, let's capitalize variable names.

[dokyungs]

Addressed comments.

[dokyungs]

Introduce internal_(memcmp|strncmp|strstr) and use them before interceptors are fully initialized.

[morehouse]

compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp

63

Can we use size_t instead of uintptr_t?

78

Can we use uint8_t and static_cast?

120

I think ensureFuzzerInited is no longer useful here.

compiler-rt/test/fuzzer/CustomAllocatorTest.cpp

15 ↗

(On Diff #278892)

Do we need this file? Can we use EmptyTest.cpp instead?

compiler-rt/test/fuzzer/custom-allocator.test

2 ↗

(On Diff #278892)

Why do we need each of these flags?

compiler-rt/test/fuzzer/memcmp.test

8

Why is the custom allocator test here useful?

[dokyungs]

Addressed comments.

[dokyungs]

Removed CustomAllocatorTest.cpp. Instead, use EmptyTest.cpp.

[dokyungs]

compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp

120

Fixed also in strncmp and strstr interceptors.

compiler-rt/test/fuzzer/custom-allocator.test

2 ↗

(On Diff #278892)

With all the flags, I designed this test for the recent failure scenario in which tcmalloc calls strncmp (+memcmp/strstr) when the fuzzer interceptor library is linked into the libFuzzer executable.

As such, we need to turn off ASan (-fno-sanitize=address) when building the executable to let the fuzzer interceptor library be linked.

As to the flags used to build the allocator shared library, I wanted to disable ASan and Fuzzer (via -fno-sanitize=all) because allocator libraries are typically not instrumented for OOB/UAF errors or coverage. I also wanted to prevent the compiler from optimizing out our calls to strncmp(+memcmp/strstr) by giving -fno-builtin; calls to these functions must go to the fuzzer interceptor library to comply with the scenario.

compiler-rt/test/fuzzer/memcmp.test

8

To make sure exercise the path where memcmp is called (i) in the calloc context, and (ii) then again in the LLVMFuzzerTestOneInput context. %t-NoAsanCustomAllocatorTest only tests (i), and %t-NoAsanMemcmpTest only tests (ii).

[morehouse]

compiler-rt/test/fuzzer/custom-allocator.test

2 ↗

(On Diff #278892)

Yes, those flags make sense. What about -fPIC %ld_flags_rpath_so1 -O0 -shared?

[dokyungs]

Introduce internal_strcmp and update tests accordingly.

[dokyungs]

compiler-rt/test/fuzzer/custom-allocator.test

2 ↗

(On Diff #278892)

Removed unnecessary use of a shared library for testing custom allocator. Instead, compile and statically link the allocator into the test.

[morehouse]

compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp

87

Lot's of common code with internal_strncmp. Let's factor it out into a helper function.

[dokyungs]

Introduced a helper function to reduce duplicated code.

[dokyungs]

compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp

87

Factored it out into a new function: internal_strcmp_strncmp

[morehouse]

LGTM

[dmajor]

After this commit, several of our builds are failing with FuzzerInterceptors.cpp:30:10: fatal error: 'sanitizer/common_interface_defs.h' file not found. This is odd because the file certainly seems like it exists. Is there a missing include path somewhere, perhaps?

[dokyungs]

In D83494#2170838, @dmajor wrote:

After this commit, several of our builds are failing with FuzzerInterceptors.cpp:30:10: fatal error: 'sanitizer/common_interface_defs.h' file not found. This is odd because the file certainly seems like it exists. Is there a missing include path somewhere, perhaps?

There seems to be a missing include_directories in CMakeLists.txt. I will send out a patch for review shortly.

clang/include/clang/Driver/SanitizerArgs.h

public:
   bool needsTsanRt() const { return Sanitizers.has(SanitizerKind::Thread); }
   bool needsMsanRt() const { return Sanitizers.has(SanitizerKind::Memory); }
   bool needsFuzzer() const { return Sanitizers.has(SanitizerKind::Fuzzer); }
   bool needsLsanRt() const {
     return Sanitizers.has(SanitizerKind::Leak) &&
            !Sanitizers.has(SanitizerKind::Address) &&
            !Sanitizers.has(SanitizerKind::HWAddress);
   }
+  bool needsFuzzerInterceptors() const;
   bool needsUbsanRt() const;
   bool requiresMinimalRuntime() const { return MinimalRuntime; }
   bool needsDfsanRt() const { return Sanitizers.has(SanitizerKind::DataFlow); }
   bool needsSafeStackRt() const { return SafeStackRuntime; }
   bool needsCfiRt() const;
   bool needsCfiDiagRt() const;
   bool needsStatsRt() const { return Stats; }
   bool needsScudoRt() const { return Sanitizers.has(SanitizerKind::Scudo); }

clang/lib/Driver/SanitizerArgs.cpp

static SanitizerMask parseSanitizeTrapArgs(const Driver &D,
   }
 
   // Apply default trapping behavior.
   TrappingKinds |= TrappingDefault & ~TrapRemove;
 
   return TrappingKinds;
 }
 
+bool SanitizerArgs::needsFuzzerInterceptors() const {
+  return needsFuzzer() && !needsAsanRt() && !needsHwasanRt() &&
+         !needsTsanRt() && !needsMsanRt();
+}
+
 bool SanitizerArgs::needsUbsanRt() const {
   // All of these include ubsan.
   if (needsAsanRt() || needsMsanRt() || needsHwasanRt() || needsTsanRt() ||
       needsDfsanRt() || needsLsanRt() || needsCfiDiagRt() ||
       (needsScudoRt() && !requiresMinimalRuntime()))
     return false;
 
   return (Sanitizers.Mask & NeedsUbsanRt & ~TrapSanitizers.Mask) ||

clang/lib/Driver/ToolChains/CommonArgs.cpp

collectSanitizerRuntimes(TC, Args, SharedRuntimes, StaticRuntimes,
                            RequiredSymbols);
 
   const SanitizerArgs &SanArgs = TC.getSanitizerArgs();
   // Inject libfuzzer dependencies.
   if (SanArgs.needsFuzzer() && SanArgs.linkRuntimes() &&
       !Args.hasArg(options::OPT_shared)) {
 
     addSanitizerRuntime(TC, Args, CmdArgs, "fuzzer", false, true);
+    if (SanArgs.needsFuzzerInterceptors())
+      addSanitizerRuntime(TC, Args, CmdArgs, "fuzzer_interceptors", false,
+                          true);
     if (!Args.hasArg(clang::driver::options::OPT_nostdlibxx))
       TC.AddCXXStdlibLibArgs(Args, CmdArgs);
   }
 
   for (auto RT : SharedRuntimes)
     addSanitizerRuntime(TC, Args, CmdArgs, RT, true, false);
   for (auto RT : HelperStaticRuntimes)
     addSanitizerRuntime(TC, Args, CmdArgs, RT, false, true);

compiler-rt/lib/fuzzer/CMakeLists.txt

 
 add_compiler_rt_object_libraries(RTfuzzer_main
   OS ${FUZZER_SUPPORTED_OS}
   ARCHS ${FUZZER_SUPPORTED_ARCH}
   SOURCES FuzzerMain.cpp
   CFLAGS ${LIBFUZZER_CFLAGS}
   DEPS ${LIBFUZZER_DEPS})
 
+add_compiler_rt_object_libraries(RTfuzzer_interceptors
+  OS ${FUZZER_SUPPORTED_OS}
+  ARCHS ${FUZZER_SUPPORTED_ARCH}
+  SOURCES FuzzerInterceptors.cpp
+  CFLAGS ${LIBFUZZER_CFLAGS}
+  DEPS ${LIBFUZZER_DEPS})
+
 add_compiler_rt_runtime(clang_rt.fuzzer
   STATIC
   OS ${FUZZER_SUPPORTED_OS}
   ARCHS ${FUZZER_SUPPORTED_ARCH}
   OBJECT_LIBS RTfuzzer RTfuzzer_main
   CFLAGS ${LIBFUZZER_CFLAGS}
   PARENT_TARGET fuzzer)
 
 add_compiler_rt_runtime(clang_rt.fuzzer_no_main
   STATIC
   OS ${FUZZER_SUPPORTED_OS}
   ARCHS ${FUZZER_SUPPORTED_ARCH}
   OBJECT_LIBS RTfuzzer
   CFLAGS ${LIBFUZZER_CFLAGS}
   PARENT_TARGET fuzzer)
 
+add_compiler_rt_runtime(clang_rt.fuzzer_interceptors
+  STATIC
+  OS ${FUZZER_SUPPORTED_OS}
+  ARCHS ${FUZZER_SUPPORTED_ARCH}
+  OBJECT_LIBS RTfuzzer_interceptors
+  CFLAGS ${LIBFUZZER_CFLAGS}
+  PARENT_TARGET fuzzer)
+
 if(OS_NAME MATCHES "Linux|Fuchsia" AND
    COMPILER_RT_LIBCXX_PATH AND
    COMPILER_RT_LIBCXXABI_PATH)
   macro(partially_link_libcxx name dir arch)
     if(${arch} MATCHES "i386")
       set(EMULATION_ARGUMENT "-m" "elf_i386")
     else()
       set(EMULATION_ARGUMENT "")
add_custom_libcxx(libcxx_fuzzer_${arch} ${LIBCXX_${arch}_PREFIX}
       CMAKE_ARGS -DCMAKE_CXX_COMPILER_WORKS=ON
                  -DCMAKE_POSITION_INDEPENDENT_CODE=ON
                  -DLIBCXXABI_ENABLE_EXCEPTIONS=OFF
                  -DLIBCXX_ABI_NAMESPACE=__Fuzzer)
     target_compile_options(RTfuzzer.${arch} PRIVATE -isystem ${LIBCXX_${arch}_PREFIX}/include/c++/v1)
     add_dependencies(RTfuzzer.${arch} libcxx_fuzzer_${arch}-build)
     target_compile_options(RTfuzzer_main.${arch} PRIVATE -isystem ${LIBCXX_${arch}_PREFIX}/include/c++/v1)
     add_dependencies(RTfuzzer_main.${arch} libcxx_fuzzer_${arch}-build)
+    target_compile_options(RTfuzzer_interceptors.${arch} PRIVATE -isystem ${LIBCXX_${arch}_PREFIX}/include/c++/v1)
+    add_dependencies(RTfuzzer_interceptors.${arch} libcxx_fuzzer_${arch}-build)
     partially_link_libcxx(fuzzer_no_main ${LIBCXX_${arch}_PREFIX} ${arch})
+    partially_link_libcxx(fuzzer_interceptors ${LIBCXX_${arch}_PREFIX} ${arch})
     partially_link_libcxx(fuzzer ${LIBCXX_${arch}_PREFIX} ${arch})
   endforeach()
 endif()
 
 if(COMPILER_RT_INCLUDE_TESTS)
   add_subdirectory(tests)
 endif()

compiler-rt/lib/fuzzer/FuzzerDefs.h

 #include <cstddef>
 #include <cstdint>
 #include <cstring>
 #include <memory>
 #include <set>
 #include <string>
 #include <vector>
 
-
-// Platform detection.
-#ifdef __linux__
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_FUCHSIA 0
-#define LIBFUZZER_LINUX 1
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
-#define LIBFUZZER_WINDOWS 0
-#define LIBFUZZER_EMSCRIPTEN 0
-#elif __APPLE__
-#define LIBFUZZER_APPLE 1
-#define LIBFUZZER_FUCHSIA 0
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
-#define LIBFUZZER_WINDOWS 0
-#define LIBFUZZER_EMSCRIPTEN 0
-#elif __NetBSD__
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_FUCHSIA 0
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_NETBSD 1
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
-#define LIBFUZZER_WINDOWS 0
-#define LIBFUZZER_EMSCRIPTEN 0
-#elif __FreeBSD__
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_FUCHSIA 0
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 1
-#define LIBFUZZER_OPENBSD 0
-#define LIBFUZZER_WINDOWS 0
-#define LIBFUZZER_EMSCRIPTEN 0
-#elif __OpenBSD__
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_FUCHSIA 0
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 1
-#define LIBFUZZER_WINDOWS 0
-#define LIBFUZZER_EMSCRIPTEN 0
-#elif _WIN32
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_FUCHSIA 0
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
-#define LIBFUZZER_WINDOWS 1
-#define LIBFUZZER_EMSCRIPTEN 0
-#elif __Fuchsia__
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_FUCHSIA 1
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
-#define LIBFUZZER_WINDOWS 0
-#define LIBFUZZER_EMSCRIPTEN 0
-#elif __EMSCRIPTEN__
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_FUCHSIA 0
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
-#define LIBFUZZER_WINDOWS 0
-#define LIBFUZZER_EMSCRIPTEN 1
-#else
-#error "Support for your platform has not been implemented"
-#endif
-
-#if defined(_MSC_VER) && !defined(__clang__)
-// MSVC compiler is being used.
-#define LIBFUZZER_MSVC 1
-#else
-#define LIBFUZZER_MSVC 0
-#endif
-
-#ifndef __has_attribute
-#  define __has_attribute(x) 0
-#endif
-
-#define LIBFUZZER_POSIX                                                        \
-  (LIBFUZZER_APPLE || LIBFUZZER_LINUX || LIBFUZZER_NETBSD ||                   \
-   LIBFUZZER_FREEBSD || LIBFUZZER_OPENBSD || LIBFUZZER_EMSCRIPTEN)
-
-#ifdef __x86_64
-#  if __has_attribute(target)
-#    define ATTRIBUTE_TARGET_POPCNT __attribute__((target("popcnt")))
-#  else
-#    define ATTRIBUTE_TARGET_POPCNT
-#  endif
-#else
-#  define ATTRIBUTE_TARGET_POPCNT
-#endif
-
-
-#ifdef __clang__  // avoid gcc warning.
-#  if __has_attribute(no_sanitize)
-#    define ATTRIBUTE_NO_SANITIZE_MEMORY __attribute__((no_sanitize("memory")))
-#  else
-#    define ATTRIBUTE_NO_SANITIZE_MEMORY
-#  endif
-#  define ALWAYS_INLINE __attribute__((always_inline))
-#else
-#  define ATTRIBUTE_NO_SANITIZE_MEMORY
-#  define ALWAYS_INLINE
-#endif // __clang__
-
-#if LIBFUZZER_WINDOWS
-#define ATTRIBUTE_NO_SANITIZE_ADDRESS
-#else
-#define ATTRIBUTE_NO_SANITIZE_ADDRESS __attribute__((no_sanitize_address))
-#endif
-
-#if LIBFUZZER_WINDOWS
-#define ATTRIBUTE_ALIGNED(X) __declspec(align(X))
-#define ATTRIBUTE_INTERFACE __declspec(dllexport)
-// This is used for __sancov_lowest_stack which is needed for
-// -fsanitize-coverage=stack-depth. That feature is not yet available on
-// Windows, so make the symbol static to avoid linking errors.
-#define ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC static
-#define ATTRIBUTE_NOINLINE __declspec(noinline)
-#else
-#define ATTRIBUTE_ALIGNED(X) __attribute__((aligned(X)))
-#define ATTRIBUTE_INTERFACE __attribute__((visibility("default")))
-#define ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC \
-  ATTRIBUTE_INTERFACE __attribute__((tls_model("initial-exec"))) thread_local
-
-#define ATTRIBUTE_NOINLINE __attribute__((noinline))
-#endif
-
-#if defined(__has_feature)
-#  if __has_feature(address_sanitizer)
-#    define ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_NO_SANITIZE_ADDRESS
-#  elif __has_feature(memory_sanitizer)
-#    define ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_NO_SANITIZE_MEMORY
-#  else
-#    define ATTRIBUTE_NO_SANITIZE_ALL
-#  endif
-#else
-#  define ATTRIBUTE_NO_SANITIZE_ALL
-#endif
+#include "FuzzerPlatform.h"
 
 namespace fuzzer {
 
 template <class T> T Min(T a, T b) { return a < b ? a : b; }
 template <class T> T Max(T a, T b) { return a > b ? a : b; }
 
 class Random;
 class Dictionary;

compiler-rt/lib/fuzzer/FuzzerInterceptors.cpp

+//===-- FuzzerInterceptors.cpp --------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+// Intercept certain libc functions to aid fuzzing.
+// Linked only when other RTs that define their own interceptors are not linked.
+//===----------------------------------------------------------------------===//
+
+#include <cstdint>
+
+#include "FuzzerPlatform.h"
+
+#define GET_CALLER_PC() __builtin_return_address(0)
+
+#if LIBFUZZER_LINUX
+
+#define PTR_TO_REAL(x) real_##x
+#define REAL(x) __interception::PTR_TO_REAL(x)
+#define FUNC_TYPE(x) x##_type
+#define DEFINE_REAL(ret_type, func, ...)                                       \
+  typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__);                            \
+  namespace __interception {                                                   \
+  FUNC_TYPE(func) PTR_TO_REAL(func);                                           \
+  }
+
+#include <dlfcn.h> // for dlsym()
+
+static void *GetFuncAddr(const char *name, uintptr_t wrapper_addr) {
+  void *addr = dlsym(RTLD_NEXT, name);
+  if (!addr) {
+    // If the lookup using RTLD_NEXT failed, the sanitizer runtime library is
+    // later in the library search order than the DSO that we are trying to
+    // intercept, which means that we cannot intercept this function. We still
+    // want the address of the real definition, though, so look it up using
+    // RTLD_DEFAULT.
+    addr = dlsym(RTLD_DEFAULT, name);
+
+    // In case `name' is not loaded, dlsym ends up finding the actual wrapper.
+    // We don't want to intercept the wrapper and have it point to itself.
+    if (reinterpret_cast<uintptr_t>(addr) == wrapper_addr)
+      addr = nullptr;
+  }
+  return addr;
+}
+
+extern "C" {
+
+// NOLINTNEXTLINE
+void __sanitizer_weak_hook_memcmp(void *, const void *, const void *, size_t,
+                                  int);
+// NOLINTNEXTLINE
+void __sanitizer_weak_hook_strncmp(void *, const char *, const char *, size_t,
+                                   int);
+// NOLINTNEXTLINE
+void __sanitizer_weak_hook_strcmp(void *, const char *, const char *, int);
+// NOLINTNEXTLINE
+void __sanitizer_weak_hook_strncasecmp(void *, const char *, const char *,
+                                       size_t, int);
+// NOLINTNEXTLINE
+void __sanitizer_weak_hook_strcasecmp(void *, const char *, const char *, int);
+// NOLINTNEXTLINE
+void __sanitizer_weak_hook_strstr(void *, const char *, const char *, char *);
+// NOLINTNEXTLINE
+void __sanitizer_weak_hook_strcasestr(void *, const char *, const char *,
+                                      char *);
+// NOLINTNEXTLINE
+void __sanitizer_weak_hook_memmem(void *, const void *, size_t, const void *,
+                                  size_t, void *);
+
+DEFINE_REAL(int, memcmp, const void *, const void *, size_t)
+DEFINE_REAL(int, strncmp, const char *, const char *, size_t)
+DEFINE_REAL(int, strcmp, const char *, const char *)
+DEFINE_REAL(int, strncasecmp, const char *, const char *, size_t)
+DEFINE_REAL(int, strcasecmp, const char *, const char *)
+DEFINE_REAL(char *, strstr, const char *, const char *)
+DEFINE_REAL(char *, strcasestr, const char *, const char *)
+DEFINE_REAL(void *, memmem, const void *, size_t, const void *, size_t)
+
+ATTRIBUTE_INTERFACE int memcmp(const void *s1, const void *s2, size_t n) {
+  int result = REAL(memcmp)(s1, s2, n);
+  __sanitizer_weak_hook_memcmp(GET_CALLER_PC(), s1, s2, n, result);
+
+  return result;
+}
+
+ATTRIBUTE_INTERFACE int strncmp(const char *s1, const char *s2, size_t n) {
+  int result = REAL(strncmp)(s1, s2, n);
+  __sanitizer_weak_hook_strncmp(GET_CALLER_PC(), s1, s2, n, result);
+
+  return result;
+}
+
+ATTRIBUTE_INTERFACE int strcmp(const char *s1, const char *s2) {
+  int result = REAL(strcmp)(s1, s2);
+  __sanitizer_weak_hook_strcmp(GET_CALLER_PC(), s1, s2, result);
+
+  return result;
+}
+
+ATTRIBUTE_INTERFACE int strncasecmp(const char *s1, const char *s2, size_t n) {
+  int result = REAL(strncasecmp)(s1, s2, n);
+  __sanitizer_weak_hook_strncasecmp(GET_CALLER_PC(), s1, s2, n, result);
+
+  return result;
+}
+
+ATTRIBUTE_INTERFACE int strcasecmp(const char *s1, const char *s2) {
+  int result = REAL(strcasecmp)(s1, s2);
+  __sanitizer_weak_hook_strcasecmp(GET_CALLER_PC(), s1, s2, result);
+
+  return result;
+}
+
+ATTRIBUTE_INTERFACE char *strstr(const char *s1, const char *s2) {
+  char *result = REAL(strstr)(s1, s2);
+  __sanitizer_weak_hook_strstr(GET_CALLER_PC(), s1, s2, result);
+
+  return result;
+}
+
+ATTRIBUTE_INTERFACE char *strcasestr(const char *s1, const char *s2) {
+  char *result = REAL(strcasestr)(s1, s2);
+  __sanitizer_weak_hook_strcasestr(GET_CALLER_PC(), s1, s2, result);
+
+  return result;
+}
+
+ATTRIBUTE_INTERFACE
+void *memmem(const void *s1, size_t len1, const void *s2, size_t len2) {
+  void *result = REAL(memmem)(s1, len1, s2, len2);
+  __sanitizer_weak_hook_memmem(GET_CALLER_PC(), s1, len1, s2, len2, result);
+
+  return result;
+}
+
+static void __fuzzer_init() {
+  REAL(memcmp) = reinterpret_cast<memcmp_type>(
+      GetFuncAddr("memcmp", reinterpret_cast<uintptr_t>(&memcmp)));
+  REAL(strncmp) = reinterpret_cast<strncmp_type>(
+      GetFuncAddr("strncmp", reinterpret_cast<uintptr_t>(&strncmp)));
+  REAL(strcmp) = reinterpret_cast<strcmp_type>(
+      GetFuncAddr("strcmp", reinterpret_cast<uintptr_t>(&strcmp)));
+  REAL(strncasecmp) = reinterpret_cast<strncasecmp_type>(
+      GetFuncAddr("strncasecmp", reinterpret_cast<uintptr_t>(&strncasecmp)));
+  REAL(strcasecmp) = reinterpret_cast<strcasecmp_type>(
+      GetFuncAddr("strcasecmp", reinterpret_cast<uintptr_t>(&strcasecmp)));
+  REAL(strstr) = reinterpret_cast<strstr_type>(
+      GetFuncAddr("strstr", reinterpret_cast<uintptr_t>(&strstr)));
+  REAL(strcasestr) = reinterpret_cast<strcasestr_type>(
+      GetFuncAddr("strcasestr", reinterpret_cast<uintptr_t>(&strcasestr)));
+  REAL(memmem) = reinterpret_cast<memmem_type>(
+      GetFuncAddr("memmem", reinterpret_cast<uintptr_t>(&memmem)));
+}
+
+__attribute__((section(".preinit_array"), used)) static void (
+    *__local_fuzzer_preinit)(void) = __fuzzer_init;
+
+} // extern "C"
+
+#endif

compiler-rt/lib/fuzzer/FuzzerPlatform.h

-//===- FuzzerDefs.h - Internal header for the Fuzzer ------------*- C++ -* ===//
+//===-- FuzzerInterceptors.cpp --------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
-// Basic definitions.
+//
+// Common platform macros.
 //===----------------------------------------------------------------------===//
 
-#ifndef LLVM_FUZZER_DEFS_H
-#define LLVM_FUZZER_DEFS_H
-
-#include <cassert>
-#include <cstddef>
-#include <cstdint>
-#include <cstring>
-#include <memory>
-#include <set>
-#include <string>
-#include <vector>
-
+#ifndef LLVM_FUZZER_PLATFORM_H
+#define LLVM_FUZZER_PLATFORM_H
 
 // Platform detection.
 #ifdef __linux__
 #define LIBFUZZER_APPLE 0
 #define LIBFUZZER_FUCHSIA 0
 #define LIBFUZZER_LINUX 1
 #define LIBFUZZER_NETBSD 0
 #define LIBFUZZER_FREEBSD 0

 #if defined(_MSC_VER) && !defined(__clang__)
 // MSVC compiler is being used.
 #define LIBFUZZER_MSVC 1
 #else
 #define LIBFUZZER_MSVC 0
 #endif
 
 #ifndef __has_attribute
-#  define __has_attribute(x) 0
+#define __has_attribute(x) 0
 #endif
 
 #define LIBFUZZER_POSIX                                                        \
   (LIBFUZZER_APPLE || LIBFUZZER_LINUX || LIBFUZZER_NETBSD ||                   \
    LIBFUZZER_FREEBSD || LIBFUZZER_OPENBSD || LIBFUZZER_EMSCRIPTEN)
 
 #ifdef __x86_64
-#  if __has_attribute(target)
-#    define ATTRIBUTE_TARGET_POPCNT __attribute__((target("popcnt")))
-#  else
-#    define ATTRIBUTE_TARGET_POPCNT
-#  endif
+#if __has_attribute(target)
+#define ATTRIBUTE_TARGET_POPCNT __attribute__((target("popcnt")))
+#else
+#define ATTRIBUTE_TARGET_POPCNT
+#endif
 #else
-#  define ATTRIBUTE_TARGET_POPCNT
+#define ATTRIBUTE_TARGET_POPCNT
 #endif
 
-
-#ifdef __clang__  // avoid gcc warning.
-#  if __has_attribute(no_sanitize)
-#    define ATTRIBUTE_NO_SANITIZE_MEMORY __attribute__((no_sanitize("memory")))
-#  else
-#    define ATTRIBUTE_NO_SANITIZE_MEMORY
-#  endif
-#  define ALWAYS_INLINE __attribute__((always_inline))
+#ifdef __clang__ // avoid gcc warning.
+#if __has_attribute(no_sanitize)
+#define ATTRIBUTE_NO_SANITIZE_MEMORY __attribute__((no_sanitize("memory")))
+#else
+#define ATTRIBUTE_NO_SANITIZE_MEMORY
+#endif
+#define ALWAYS_INLINE __attribute__((always_inline))
 #else
-#  define ATTRIBUTE_NO_SANITIZE_MEMORY
-#  define ALWAYS_INLINE
+#define ATTRIBUTE_NO_SANITIZE_MEMORY
+#define ALWAYS_INLINE
 #endif // __clang__
 
 #if LIBFUZZER_WINDOWS
 #define ATTRIBUTE_NO_SANITIZE_ADDRESS
 #else
 #define ATTRIBUTE_NO_SANITIZE_ADDRESS __attribute__((no_sanitize_address))
 #endif
 
 #if LIBFUZZER_WINDOWS
 #define ATTRIBUTE_ALIGNED(X) __declspec(align(X))
 #define ATTRIBUTE_INTERFACE __declspec(dllexport)
 // This is used for __sancov_lowest_stack which is needed for
 // -fsanitize-coverage=stack-depth. That feature is not yet available on
 // Windows, so make the symbol static to avoid linking errors.
 #define ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC static
 #define ATTRIBUTE_NOINLINE __declspec(noinline)
 #else
 #define ATTRIBUTE_ALIGNED(X) __attribute__((aligned(X)))
 #define ATTRIBUTE_INTERFACE __attribute__((visibility("default")))
-#define ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC \
+#define ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC                                  \
   ATTRIBUTE_INTERFACE __attribute__((tls_model("initial-exec"))) thread_local
 
 #define ATTRIBUTE_NOINLINE __attribute__((noinline))
 #endif
 
 #if defined(__has_feature)
-#  if __has_feature(address_sanitizer)
-#    define ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_NO_SANITIZE_ADDRESS
-#  elif __has_feature(memory_sanitizer)
-#    define ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_NO_SANITIZE_MEMORY
-#  else
-#    define ATTRIBUTE_NO_SANITIZE_ALL
-#  endif
+#if __has_feature(address_sanitizer)
+#define ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_NO_SANITIZE_ADDRESS
+#elif __has_feature(memory_sanitizer)
+#define ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_NO_SANITIZE_MEMORY
+#else
+#define ATTRIBUTE_NO_SANITIZE_ALL
+#endif
 #else
-#  define ATTRIBUTE_NO_SANITIZE_ALL
+#define ATTRIBUTE_NO_SANITIZE_ALL
 #endif
 
-namespace fuzzer {
-
-template <class T> T Min(T a, T b) { return a < b ? a : b; }
-template <class T> T Max(T a, T b) { return a > b ? a : b; }
-
-class Random;
-class Dictionary;
-class DictionaryEntry;
-class MutationDispatcher;
-struct FuzzingOptions;
-class InputCorpus;
-struct InputInfo;
-struct ExternalFunctions;
-
-// Global interface to functions that may or may not be available.
-extern ExternalFunctions *EF;
-
-// We are using a custom allocator to give a different symbol name to STL
-// containers in order to avoid ODR violations.
-template<typename T>
-  class fuzzer_allocator: public std::allocator<T> {
-    public:
-      fuzzer_allocator() = default;
-
-      template<class U>
-      fuzzer_allocator(const fuzzer_allocator<U>&) {}
-
-      template<class Other>
-      struct rebind { typedef fuzzer_allocator<Other> other;  };
-  };
-
-template<typename T>
-using Vector = std::vector<T, fuzzer_allocator<T>>;
-
-template<typename T>
-using Set = std::set<T, std::less<T>, fuzzer_allocator<T>>;
-
-typedef Vector<uint8_t> Unit;
-typedef Vector<Unit> UnitVector;
-typedef int (*UserCallback)(const uint8_t *Data, size_t Size);
-
-int FuzzerDriver(int *argc, char ***argv, UserCallback Callback);
-
-uint8_t *ExtraCountersBegin();
-uint8_t *ExtraCountersEnd();
-void ClearExtraCounters();
-
-extern bool RunningUserCallback;
-
-}  // namespace fuzzer
-
-#endif  // LLVM_FUZZER_DEFS_H
+#endif // LLVM_FUZZER_PLATFORM_H

compiler-rt/test/fuzzer/memcmp.test

 UNSUPPORTED: freebsd
 RUN: %cpp_compiler %S/MemcmpTest.cpp -o %t-MemcmpTest
-RUN: not %run %t-MemcmpTest               -seed=1 -runs=10000000   2>&1 | FileCheck %s
-CHECK: BINGO
+RUN: not %run %t-MemcmpTest               -seed=1 -runs=10000000   2>&1 | FileCheck %s --check-prefix=CHECK1
+CHECK1: BINGO
+
+RUN: %cpp_compiler -fno-sanitize=address -fno-builtin-memcmp %S/MemcmpTest.cpp -o %t-NoAsanMemcmpTest
+RUN: not %run %t-MemcmpTest               -seed=1 -runs=10000000   2>&1 | FileCheck %s --check-prefix=CHECK2
+CHECK2: BINGO

compiler-rt/test/fuzzer/memcmp64.test

 UNSUPPORTED: freebsd
 RUN: %cpp_compiler %S/Memcmp64BytesTest.cpp -o %t-Memcmp64BytesTest
-RUN: not %run %t-Memcmp64BytesTest        -seed=1 -runs=1000000   2>&1 | FileCheck %s
-CHECK: BINGO
+RUN: not %run %t-Memcmp64BytesTest        -seed=1 -runs=1000000   2>&1 | FileCheck %s --check-prefix=CHECK1
+CHECK1: BINGO
+
+RUN: %cpp_compiler -fno-sanitize=address -fno-builtin-memcmp %S/Memcmp64BytesTest.cpp -o %t-NoAsanMemcmp64BytesTest
+RUN: not %run %t-Memcmp64BytesTest        -seed=1 -runs=1000000   2>&1 | FileCheck %s --check-prefix=CHECK2
+CHECK2: BINGO

compiler-rt/test/fuzzer/strcmp.test

 UNSUPPORTED: freebsd
 RUN: %cpp_compiler %S/StrcmpTest.cpp -o %t-StrcmpTest
-RUN: not %run %t-StrcmpTest               -seed=1 -runs=2000000   2>&1 | FileCheck %s
-CHECK: BINGO
+RUN: not %run %t-StrcmpTest               -seed=1 -runs=2000000   2>&1 | FileCheck %s --check-prefix=CHECK1
+CHECK1: BINGO
 
+RUN: %cpp_compiler -fno-sanitize=address -fno-builtin-strcmp %S/StrcmpTest.cpp -o %t-NoAsanStrcmpTest
+RUN: not %run %t-StrcmpTest               -seed=1 -runs=2000000   2>&1 | FileCheck %s --check-prefix=CHECK2
+CHECK2: BINGO

compiler-rt/test/fuzzer/strncmp.test

 UNSUPPORTED: freebsd
 RUN: %cpp_compiler %S/StrncmpTest.cpp -o %t-StrncmpTest
-RUN: not %run %t-StrncmpTest              -seed=2 -runs=10000000   2>&1 | FileCheck %s
-CHECK: BINGO
+RUN: not %run %t-StrncmpTest              -seed=2 -runs=10000000   2>&1 | FileCheck %s --check-prefix=CHECK1
+CHECK1: BINGO
+
+RUN: %cpp_compiler -fno-sanitize=address -fno-builtin-strncmp %S/StrncmpTest.cpp -o %t-NoAsanStrncmpTest
+RUN: not %run %t-StrncmpTest              -seed=2 -runs=10000000   2>&1 | FileCheck %s --check-prefix=CHECK2
+CHECK2: BINGO
 

compiler-rt/test/fuzzer/strstr.test

 UNSUPPORTED: freebsd
 RUN: %cpp_compiler %S/StrstrTest.cpp -o %t-StrstrTest
-RUN: not %run %t-StrstrTest               -seed=1 -runs=2000000   2>&1 | FileCheck %s
-CHECK: BINGO
+RUN: not %run %t-StrstrTest               -seed=1 -runs=2000000   2>&1 | FileCheck %s --check-prefix=CHECK1
+CHECK1: BINGO
+
+RUN: %cpp_compiler -fno-sanitize=address -fno-builtin-strstr %S/StrstrTest.cpp -o %t-NoAsanStrstrTest
+RUN: not %run %t-StrstrTest               -seed=1 -runs=2000000   2>&1 | FileCheck %s --check-prefix=CHECK2
+CHECK2: BINGO