Skip to content

Commit e5f4a9f

Browse files
committedJun 22, 2018
Implemented proto to LLVM conversion and LLVM fuzz target
Differential Revision: https://reviews.llvm.org/D48106 llvm-svn: 335374
1 parent cd18bb5 commit e5f4a9f

14 files changed

+430
-36
lines changed
 

‎clang/tools/clang-fuzzer/CMakeLists.txt

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ set(LLVM_OPTIONAL_SOURCES
1515
DummyClangFuzzer.cpp
1616
ExampleClangProtoFuzzer.cpp
1717
ExampleClangLoopProtoFuzzer.cpp
18+
ExampleClangLLVMProtoFuzzer.cpp
1819
)
1920

2021
if(CLANG_ENABLE_PROTO_FUZZER)
@@ -49,6 +50,9 @@ if(CLANG_ENABLE_PROTO_FUZZER)
4950

5051
# Build the protobuf->C++ translation library and driver.
5152
add_clang_subdirectory(proto-to-cxx)
53+
54+
# Build the protobuf->LLVM IR translation library and driver.
55+
add_clang_subdirectory(proto-to-llvm)
5256

5357
# Build the fuzzer initialization library.
5458
add_clang_subdirectory(fuzzer-initialize)
@@ -65,29 +69,45 @@ if(CLANG_ENABLE_PROTO_FUZZER)
6569
ExampleClangLoopProtoFuzzer.cpp
6670
)
6771

72+
# Build the llvm protobuf fuzzer
73+
add_clang_executable(clang-llvm-proto-fuzzer
74+
${DUMMY_MAIN}
75+
ExampleClangLLVMProtoFuzzer.cpp
76+
)
77+
6878
set(COMMON_PROTO_FUZZ_LIBRARIES
6979
${ProtobufMutator_LIBRARIES}
7080
${PROTOBUF_LIBRARIES}
7181
${LLVM_LIB_FUZZING_ENGINE}
7282
clangFuzzerInitialize
73-
clangHandleCXX
7483
)
7584

7685
target_link_libraries(clang-proto-fuzzer
7786
PRIVATE
7887
${COMMON_PROTO_FUZZ_LIBRARIES}
88+
clangHandleCXX
7989
clangCXXProto
8090
clangProtoToCXX
8191
)
8292
target_link_libraries(clang-loop-proto-fuzzer
8393
PRIVATE
8494
${COMMON_PROTO_FUZZ_LIBRARIES}
95+
clangHandleCXX
8596
clangCXXLoopProto
8697
clangLoopProtoToCXX
8798
)
99+
target_link_libraries(clang-llvm-proto-fuzzer
100+
PRIVATE
101+
${COMMON_PROTO_FUZZ_LIBRARIES}
102+
clangHandleLLVM
103+
clangCXXLoopProto
104+
clangLoopProtoToLLVM
105+
)
106+
88107
endif()
89108

90109
add_clang_subdirectory(handle-cxx)
110+
add_clang_subdirectory(handle-llvm)
91111

92112
add_clang_executable(clang-fuzzer
93113
EXCLUDE_FROM_ALL
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
//===-- ExampleClangLLVMProtoFuzzer.cpp - Fuzz Clang ----------------------===//
2+
//
3+
// The LLVM Compiler Infrastructure
4+
//
5+
// This file is distributed under the University of Illinois Open Source
6+
// License. See LICENSE.TXT for details.
7+
//
8+
//===----------------------------------------------------------------------===//
9+
///
10+
/// \file
11+
/// This file implements a function that compiles a single LLVM IR string as
12+
/// input and uses libprotobuf-mutator to find new inputs. This function is
13+
/// then linked into the Fuzzer library.
14+
///
15+
//===----------------------------------------------------------------------===//
16+
17+
#include "cxx_loop_proto.pb.h"
18+
#include "fuzzer-initialize/fuzzer_initialize.h"
19+
#include "handle-llvm/handle_llvm.h"
20+
#include "proto-to-llvm/loop_proto_to_llvm.h"
21+
#include "src/libfuzzer/libfuzzer_macro.h"
22+
23+
using namespace clang_fuzzer;
24+
25+
DEFINE_BINARY_PROTO_FUZZER(const LoopFunction &input) {
26+
auto S = LoopFunctionToLLVMString(input);
27+
HandleLLVM(S, GetCLArgs());
28+
}

‎clang/tools/clang-fuzzer/cxx_loop_proto.proto

Lines changed: 9 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -37,17 +37,15 @@ message BinaryOp {
3737
PLUS = 0;
3838
MINUS = 1;
3939
MUL = 2;
40-
DIV = 3;
41-
MOD = 4;
42-
XOR = 5;
43-
AND = 6;
44-
OR = 7;
45-
EQ = 8;
46-
NE = 9;
47-
LE = 10;
48-
GE = 11;
49-
LT = 12;
50-
GT = 13;
40+
XOR = 3;
41+
AND = 4;
42+
OR = 5;
43+
EQ = 6;
44+
NE = 7;
45+
LE = 8;
46+
GE = 9;
47+
LT = 10;
48+
GT = 11;
5149
};
5250
required Op op = 1;
5351
required Rvalue left = 2;
@@ -67,12 +65,6 @@ message AssignmentStatement {
6765
required Rvalue rvalue = 2;
6866
}
6967

70-
message IfElse {
71-
required Rvalue cond = 1;
72-
required StatementSeq if_body = 2;
73-
required StatementSeq else_body = 3;
74-
}
75-
7668
message Statement {
7769
required AssignmentStatement assignment = 1;
7870
}

‎clang/tools/clang-fuzzer/fuzzer-initialize/fuzzer_initialize.cpp

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@
1515
//===----------------------------------------------------------------------===//
1616

1717
#include "fuzzer_initialize.h"
18+
19+
#include "llvm/Support/TargetSelect.h"
1820
#include <cstring>
1921

2022
using namespace clang_fuzzer;
@@ -31,6 +33,11 @@ const std::vector<const char *>& GetCLArgs() {
3133
}
3234

3335
extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) {
36+
llvm::InitializeAllTargets();
37+
llvm::InitializeAllTargetMCs();
38+
llvm::InitializeAllAsmPrinters();
39+
llvm::InitializeAllAsmParsers();
40+
3441
CLArgs.push_back("-O2");
3542
for (int I = 1; I < *argc; I++) {
3643
if (strcmp((*argv)[I], "-ignore_remaining_args=1") == 0) {

‎clang/tools/clang-fuzzer/handle-cxx/handle_cxx.cpp

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,11 @@
1818
#include "clang/Lex/PreprocessorOptions.h"
1919
#include "clang/Tooling/Tooling.h"
2020
#include "llvm/Option/Option.h"
21-
#include "llvm/Support/TargetSelect.h"
2221

2322
using namespace clang;
2423

2524
void clang_fuzzer::HandleCXX(const std::string &S,
2625
const std::vector<const char *> &ExtraArgs) {
27-
llvm::InitializeAllTargets();
28-
llvm::InitializeAllTargetMCs();
29-
llvm::InitializeAllAsmPrinters();
30-
llvm::InitializeAllAsmParsers();
31-
3226
llvm::opt::ArgStringList CC1Args;
3327
CC1Args.push_back("-cc1");
3428
for (auto &A : ExtraArgs)
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
set(LLVM_LINK_COMPONENTS ${LLVM_TARGETS_TO_BUILD} Support)
2+
3+
add_clang_library(clangHandleLLVM
4+
handle_llvm.cpp
5+
)
Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
//==-- handle_llvm.cpp - Helper function for Clang fuzzers -----------------==//
2+
//
3+
// The LLVM Compiler Infrastructure
4+
//
5+
// This file is distributed under the University of Illinois Open Source
6+
// License. See LICENSE.TXT for details.
7+
//
8+
//===----------------------------------------------------------------------===//
9+
//
10+
// Implements HandleLLVM for use by the Clang fuzzers. Mimics the llc tool to
11+
// compile an LLVM IR file to X86_64 assembly.
12+
//
13+
//===----------------------------------------------------------------------===//
14+
15+
#include "handle_llvm.h"
16+
17+
#include "llvm/ADT/Triple.h"
18+
#include "llvm/Analysis/TargetLibraryInfo.h"
19+
#include "llvm/CodeGen/CommandFlags.inc"
20+
#include "llvm/CodeGen/MachineModuleInfo.h"
21+
#include "llvm/IR/LegacyPassManager.h"
22+
#include "llvm/IR/LLVMContext.h"
23+
#include "llvm/IR/Module.h"
24+
#include "llvm/IR/Verifier.h"
25+
#include "llvm/IRReader/IRReader.h"
26+
#include "llvm/PassRegistry.h"
27+
#include "llvm/Support/InitLLVM.h"
28+
#include "llvm/Support/MemoryBuffer.h"
29+
#include "llvm/Support/SourceMgr.h"
30+
#include "llvm/Support/TargetRegistry.h"
31+
#include "llvm/Target/TargetMachine.h"
32+
33+
#include <cstdlib>
34+
35+
using namespace llvm;
36+
37+
static void getOptLevel(const std::vector<const char *> &ExtraArgs,
38+
CodeGenOpt::Level &OLvl) {
39+
// Find the optimization level from the command line args
40+
OLvl = CodeGenOpt::Default;
41+
for (auto &A : ExtraArgs) {
42+
if (A[0] == '-' && A[1] == 'O') {
43+
switch(A[2]) {
44+
case '0': OLvl = CodeGenOpt::None; break;
45+
case '1': OLvl = CodeGenOpt::Less; break;
46+
case '2': OLvl = CodeGenOpt::Default; break;
47+
case '3': OLvl = CodeGenOpt::Aggressive; break;
48+
default:
49+
errs() << "error: opt level must be between 0 and 3.\n";
50+
std::exit(1);
51+
}
52+
}
53+
}
54+
}
55+
56+
void clang_fuzzer::HandleLLVM(const std::string &S,
57+
const std::vector<const char *> &ExtraArgs) {
58+
// Parse ExtraArgs to set the optimization level
59+
CodeGenOpt::Level OLvl;
60+
getOptLevel(ExtraArgs, OLvl);
61+
62+
// Set the Module to include the the IR code to be compiled
63+
SMDiagnostic Err;
64+
65+
LLVMContext Context;
66+
std::unique_ptr<Module> M = parseIR(MemoryBufferRef(S, "IR"), Err, Context);
67+
if (!M) {
68+
errs() << "error: could not parse IR!\n";
69+
std::exit(1);
70+
}
71+
72+
// Create a new Target
73+
std::string Error;
74+
const Target *TheTarget = TargetRegistry::lookupTarget(
75+
sys::getDefaultTargetTriple(), Error);
76+
if (!TheTarget) {
77+
errs() << Error;
78+
std::exit(1);
79+
}
80+
81+
TargetOptions Options = InitTargetOptionsFromCodeGenFlags();
82+
83+
// Create a new Machine
84+
std::string CPUStr = getCPUStr();
85+
std::string FeaturesStr = getFeaturesStr();
86+
std::unique_ptr<TargetMachine> Target(TheTarget->createTargetMachine(
87+
sys::getDefaultTargetTriple(), CPUStr, FeaturesStr, Options,
88+
getRelocModel(), getCodeModel(), OLvl));
89+
90+
// Create a new PassManager
91+
legacy::PassManager PM;
92+
TargetLibraryInfoImpl TLII(Triple(M->getTargetTriple()));
93+
PM.add(new TargetLibraryInfoWrapperPass(TLII));
94+
M->setDataLayout(Target->createDataLayout());
95+
96+
// Make sure the Module has no errors
97+
if (verifyModule(*M, &errs())) {
98+
errs() << "error: input module is broken!\n";
99+
std::exit(1);
100+
}
101+
102+
setFunctionAttributes(CPUStr, FeaturesStr, *M);
103+
104+
raw_null_ostream OS;
105+
Target->addPassesToEmitFile(PM, OS, nullptr, TargetMachine::CGFT_ObjectFile,
106+
false);
107+
PM.run(*M);
108+
109+
return;
110+
}
111+
Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
//==-- handle_llvm.h - Helper function for Clang fuzzers -------------------==//
2+
//
3+
// The LLVM Compiler Infrastructure
4+
//
5+
// This file is distributed under the University of Illinois Open Source
6+
// License. See LICENSE.TXT for details.
7+
//
8+
//===----------------------------------------------------------------------===//
9+
//
10+
// Defines HandleLLVM for use by the Clang fuzzers.
11+
//
12+
//===----------------------------------------------------------------------===//
13+
14+
#ifndef LLVM_CLANG_TOOLS_CLANG_FUZZER_HANDLE_LLVM_HANDLELLVM_H
15+
#define LLVM_CLANG_TOOLS_CLANG_FUZZER_HANDLE_LLVM_HANDLELLVM_H
16+
17+
#include <string>
18+
#include <vector>
19+
20+
namespace clang_fuzzer {
21+
void HandleLLVM(const std::string &S,
22+
const std::vector<const char *> &ExtraArgs);
23+
} // namespace clang_fuzzer
24+
25+
#endif

‎clang/tools/clang-fuzzer/proto-to-cxx/loop_proto_to_cxx.cpp

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -67,12 +67,6 @@ std::ostream &operator<<(std::ostream &os, const BinaryOp &x) {
6767
case BinaryOp::MUL:
6868
os << "*";
6969
break;
70-
case BinaryOp::DIV:
71-
os << "/";
72-
break;
73-
case BinaryOp::MOD:
74-
os << "%";
75-
break;
7670
case BinaryOp::XOR:
7771
os << "^";
7872
break;
@@ -106,11 +100,6 @@ std::ostream &operator<<(std::ostream &os, const BinaryOp &x) {
106100
std::ostream &operator<<(std::ostream &os, const AssignmentStatement &x) {
107101
return os << x.varref() << "=" << x.rvalue() << ";\n";
108102
}
109-
std::ostream &operator<<(std::ostream &os, const IfElse &x) {
110-
return os << "if (" << x.cond() << "){\n"
111-
<< x.if_body() << "} else { \n"
112-
<< x.else_body() << "}\n";
113-
}
114103
std::ostream &operator<<(std::ostream &os, const Statement &x) {
115104
return os << x.assignment();
116105
}

‎clang/tools/clang-fuzzer/proto-to-cxx/loop_proto_to_cxx_main.cpp

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111
//
1212
//===----------------------------------------------------------------------===//
1313

14-
// This is a copy and will be updated later to introduce changes
1514

1615
#include <fstream>
1716
#include <iostream>
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
set(LLVM_LINK_COMPONENTS ${LLVM_TARGETS_TO_BUILD})
2+
set(CMAKE_CXX_FLAGS ${CXX_FLAGS_NOFUZZ})
3+
4+
# Needed by LLVM's CMake checks because this file defines multiple targets.
5+
set(LLVM_OPTIONAL_SOURCES loop_proto_to_llvm.cpp loop_proto_to_llvm_main.cpp)
6+
7+
add_clang_library(clangLoopProtoToLLVM loop_proto_to_llvm.cpp
8+
DEPENDS clangCXXLoopProto
9+
LINK_LIBS clangCXXLoopProto ${PROTOBUF_LIBRARIES}
10+
)
11+
12+
add_clang_executable(clang-loop-proto-to-llvm loop_proto_to_llvm_main.cpp)
13+
14+
target_link_libraries(clang-loop-proto-to-llvm PRIVATE clangLoopProtoToLLVM)
Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
//==-- loop_proto_to_llvm.cpp - Protobuf-C++ conversion
2+
//---------------------==//
3+
//
4+
// The LLVM Compiler Infrastructure
5+
//
6+
// This file is distributed under the University of Illinois Open Source
7+
// License. See LICENSE.TXT for details.
8+
//
9+
//===----------------------------------------------------------------------===//
10+
//
11+
// Implements functions for converting between protobufs and LLVM IR.
12+
//
13+
//
14+
//===----------------------------------------------------------------------===//
15+
16+
#include "loop_proto_to_llvm.h"
17+
#include "cxx_loop_proto.pb.h"
18+
19+
// The following is needed to convert protos in human-readable form
20+
#include <google/protobuf/text_format.h>
21+
22+
#include <ostream>
23+
#include <sstream>
24+
25+
namespace clang_fuzzer {
26+
27+
// Forward decls
28+
std::string BinopToString(std::ostream &os, const BinaryOp &x);
29+
std::string StateSeqToString(std::ostream &os, const StatementSeq &x);
30+
31+
// Counter variable to generate new LLVM IR variable names and wrapper function
32+
std::string get_var() {
33+
static int ctr = 0;
34+
return "%var" + std::to_string(ctr++);
35+
}
36+
37+
// Proto to LLVM.
38+
39+
std::string ConstToString(const Const &x) {
40+
return std::to_string(x.val());
41+
}
42+
std::string VarRefToString(std::ostream &os, const VarRef &x) {
43+
std::string arr;
44+
switch(x.arr()) {
45+
case VarRef::ARR_A:
46+
arr = "%a";
47+
break;
48+
case VarRef::ARR_B:
49+
arr = "%b";
50+
break;
51+
case VarRef::ARR_C:
52+
arr = "%c";
53+
break;
54+
}
55+
std::string ptr_var = get_var();
56+
os << ptr_var << " = getelementptr i32, i32* " << arr << ", i64 %ct\n";
57+
return ptr_var;
58+
}
59+
std::string RvalueToString(std::ostream &os, const Rvalue &x) {
60+
if(x.has_cons())
61+
return ConstToString(x.cons());
62+
if(x.has_binop())
63+
return BinopToString(os, x.binop());
64+
if(x.has_varref()) {
65+
std::string var_ref = VarRefToString(os, x.varref());
66+
std::string val_var = get_var();
67+
os << val_var << " = load i32, i32* " << var_ref << "\n";
68+
return val_var;
69+
}
70+
return "1";
71+
72+
}
73+
std::string BinopToString(std::ostream &os, const BinaryOp &x) {
74+
std::string left = RvalueToString(os, x.left());
75+
std::string right = RvalueToString(os, x.right());
76+
std::string op;
77+
switch (x.op()) {
78+
case BinaryOp::PLUS:
79+
op = "add";
80+
break;
81+
case BinaryOp::MINUS:
82+
op = "sub";
83+
break;
84+
case BinaryOp::MUL:
85+
op = "mul";
86+
break;
87+
case BinaryOp::XOR:
88+
op = "xor";
89+
break;
90+
case BinaryOp::AND:
91+
op = "and";
92+
break;
93+
case BinaryOp::OR:
94+
op = "or";
95+
break;
96+
// Support for Boolean operators will be added later
97+
case BinaryOp::EQ:
98+
case BinaryOp::NE:
99+
case BinaryOp::LE:
100+
case BinaryOp::GE:
101+
case BinaryOp::LT:
102+
case BinaryOp::GT:
103+
op = "add";
104+
break;
105+
}
106+
std::string val_var = get_var();
107+
os << val_var << " = " << op << " i32 " << left << ", " << right << "\n";
108+
return val_var;
109+
}
110+
std::ostream &operator<<(std::ostream &os, const AssignmentStatement &x) {
111+
std::string rvalue = RvalueToString(os, x.rvalue());
112+
std::string var_ref = VarRefToString(os, x.varref());
113+
return os << "store i32 " << rvalue << ", i32* " << var_ref << "\n";
114+
}
115+
std::ostream &operator<<(std::ostream &os, const Statement &x) {
116+
return os << x.assignment();
117+
}
118+
std::ostream &operator<<(std::ostream &os, const StatementSeq &x) {
119+
for (auto &st : x.statements()) {
120+
os << st;
121+
}
122+
return os;
123+
}
124+
std::ostream &operator<<(std::ostream &os, const LoopFunction &x) {
125+
return os << "define void @foo(i32* %a, i32* %b, i32* noalias %c, i64 %s) {\n"
126+
<< "%i = alloca i64\n"
127+
<< "store i64 0, i64* %i\n"
128+
<< "br label %loop\n\n"
129+
<< "loop:\n"
130+
<< "%ct = load i64, i64* %i\n"
131+
<< "%comp = icmp eq i64 %ct, %s\n"
132+
<< "br i1 %comp, label %endloop, label %body\n\n"
133+
<< "body:\n"
134+
<< x.statements()
135+
<< "%z = add i64 1, %ct\n"
136+
<< "store i64 %z, i64* %i\n"
137+
<< "br label %loop\n\n"
138+
<< "endloop:\n"
139+
<< "ret void\n}\n";
140+
}
141+
142+
// ---------------------------------
143+
144+
std::string LoopFunctionToLLVMString(const LoopFunction &input) {
145+
std::ostringstream os;
146+
os << input;
147+
return os.str();
148+
}
149+
std::string LoopProtoToLLVM(const uint8_t *data, size_t size) {
150+
LoopFunction message;
151+
if (!message.ParsePartialFromArray(data, size))
152+
return "#error invalid proto\n";
153+
return LoopFunctionToLLVMString(message);
154+
}
155+
156+
} // namespace clang_fuzzer
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
//==-- loop_proto_to_llvm.h - Protobuf-C++ conversion ----------------------------==//
2+
//
3+
// The LLVM Compiler Infrastructure
4+
//
5+
// This file is distributed under the University of Illinois Open Source
6+
// License. See LICENSE.TXT for details.
7+
//
8+
//===----------------------------------------------------------------------===//
9+
//
10+
// Defines functions for converting between protobufs and LLVM IR.
11+
//
12+
//===----------------------------------------------------------------------===//
13+
14+
#include <cstdint>
15+
#include <cstddef>
16+
#include <string>
17+
18+
namespace clang_fuzzer {
19+
class LoopFunction;
20+
21+
std::string LoopFunctionToLLVMString(const LoopFunction &input);
22+
std::string LoopProtoToLLVM(const uint8_t *data, size_t size);
23+
}
Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
//==-- loop_proto_to_llvm_main.cpp - Driver for protobuf-LLVM conversion----==//
2+
//
3+
// The LLVM Compiler Infrastructure
4+
//
5+
// This file is distributed under the University of Illinois Open Source
6+
// License. See LICENSE.TXT for details.
7+
//
8+
//===----------------------------------------------------------------------===//
9+
//
10+
// Implements a simple driver to print a LLVM program from a protobuf with loops
11+
//
12+
//===----------------------------------------------------------------------===//
13+
14+
15+
#include <fstream>
16+
#include <iostream>
17+
#include <streambuf>
18+
#include <string>
19+
20+
#include "loop_proto_to_llvm.h"
21+
22+
int main(int argc, char **argv) {
23+
for (int i = 1; i < argc; i++) {
24+
std::fstream in(argv[i]);
25+
std::string str((std::istreambuf_iterator<char>(in)),
26+
std::istreambuf_iterator<char>());
27+
std::cout << ";; " << argv[i] << std::endl;
28+
std::cout << clang_fuzzer::LoopProtoToLLVM(
29+
reinterpret_cast<const uint8_t *>(str.data()), str.size());
30+
}
31+
}

0 commit comments

Comments
 (0)
Please sign in to comment.