Skip to content

Commit e5ecba4

Browse files
DavidGoldmanDavidGoldman
committedOct 21, 2019
[clang-fuzzer] Add new fuzzer target for Objective-C
Summary: - Similar to that of `clang-fuzzer` itself but instead only targets Objective-C source files via cc1 - Also adds an example corpus directory containing some input for Objective-C Subscribers: mgorny, jfb, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D69171 llvm-svn: 375453
1 parent 6f0ae81 commit e5ecba4

11 files changed

+185
-7
lines changed
 

‎clang/tools/clang-fuzzer/CMakeLists.txt

+13
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ endif()
1212
# Needed by LLVM's CMake checks because this file defines multiple targets.
1313
set(LLVM_OPTIONAL_SOURCES
1414
ClangFuzzer.cpp
15+
ClangObjectiveCFuzzer.cpp
1516
DummyClangFuzzer.cpp
1617
ExampleClangProtoFuzzer.cpp
1718
ExampleClangLoopProtoFuzzer.cpp
@@ -120,3 +121,15 @@ target_link_libraries(clang-fuzzer
120121
${LLVM_LIB_FUZZING_ENGINE}
121122
clangHandleCXX
122123
)
124+
125+
add_clang_executable(clang-objc-fuzzer
126+
EXCLUDE_FROM_ALL
127+
${DUMMY_MAIN}
128+
ClangObjectiveCFuzzer.cpp
129+
)
130+
131+
target_link_libraries(clang-objc-fuzzer
132+
PRIVATE
133+
${LLVM_LIB_FUZZING_ENGINE}
134+
clangHandleCXX
135+
)

‎clang/tools/clang-fuzzer/ClangFuzzer.cpp

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,6 @@ extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) { return 0; }
2020

2121
extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
2222
std::string s((const char *)data, size);
23-
HandleCXX(s, {"-O2"});
23+
HandleCXX(s, "./test.cc", {"-O2"});
2424
return 0;
2525
}

‎clang/tools/clang-fuzzer/ClangObjectiveCFuzzer.cpp

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
//===-- ClangObjectiveCFuzzer.cpp - Fuzz Clang ----------------------------===//
2+
//
3+
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4+
// See https://llvm.org/LICENSE.txt for license information.
5+
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6+
//
7+
//===----------------------------------------------------------------------===//
8+
///
9+
/// \file
10+
/// This file implements a function that runs Clang on a single Objective-C
11+
/// input. This function is then linked into the Fuzzer library.
12+
///
13+
//===----------------------------------------------------------------------===//
14+
15+
#include "handle-cxx/handle_cxx.h"
16+
17+
using namespace clang_fuzzer;
18+
19+
extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
20+
std::string s(reinterpret_cast<const char *>(data), size);
21+
HandleCXX(s, "./test.m", {"-O2"});
22+
return 0;
23+
}
24+

‎clang/tools/clang-fuzzer/Dockerfile

+1
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ RUN mkdir build1 && cd build1 && cmake -GNinja -DCMAKE_BUILD_TYPE=Release ../llv
3232
-DLLVM_USE_SANITIZER=Address -DCLANG_ENABLE_PROTO_FUZZER=ON
3333
# Build the fuzzers
3434
RUN cd build1 && ninja clang-fuzzer
35+
RUN cd build1 && ninja clang-objc-fuzzer
3536
RUN cd build1 && ninja clang-proto-fuzzer
3637
RUN cd build1 && ninja clang-proto-to-cxx
3738
RUN cd build1 && ninja clang-loop-proto-to-cxx

‎clang/tools/clang-fuzzer/README.txt

+39-4
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,21 @@
1-
This directory contains two utilities for fuzzing Clang: clang-fuzzer and
2-
clang-proto-fuzzer. Both use libFuzzer to generate inputs to clang via
3-
coverage-guided mutation.
1+
This directory contains three utilities for fuzzing Clang: clang-fuzzer,
2+
clang-objc-fuzzer, and clang-proto-fuzzer. All use libFuzzer to generate inputs
3+
to clang via coverage-guided mutation.
44

5-
The two utilities differ, however, in how they structure inputs to Clang.
5+
The three utilities differ, however, in how they structure inputs to Clang.
66
clang-fuzzer makes no attempt to generate valid C++ programs and is therefore
77
primarily useful for stressing the surface layers of Clang (i.e. lexer, parser).
8+
9+
clang-objc-fuzzer is similar but for Objective-C: it makes no attempt to
10+
generate a valid Objective-C program.
11+
812
clang-proto-fuzzer uses a protobuf class to describe a subset of the C++
913
language and then uses libprotobuf-mutator to mutate instantiations of that
1014
class, producing valid C++ programs in the process. As a result,
1115
clang-proto-fuzzer is better at stressing deeper layers of Clang and LLVM.
1216

17+
Some of the fuzzers have example corpuses inside the corpus_examples directory.
18+
1319
===================================
1420
Building clang-fuzzer
1521
===================================
@@ -35,6 +41,35 @@ Example:
3541
bin/clang-fuzzer CORPUS_DIR
3642

3743

44+
===================================
45+
Building clang-objc-fuzzer
46+
===================================
47+
Within your LLVM build directory, run CMake with the following variable
48+
definitions:
49+
- CMAKE_C_COMPILER=clang
50+
- CMAKE_CXX_COMPILER=clang++
51+
- LLVM_USE_SANITIZE_COVERAGE=YES
52+
- LLVM_USE_SANITIZER=Address
53+
54+
Then build the clang-objc-fuzzer target.
55+
56+
Example:
57+
cd $LLVM_SOURCE_DIR
58+
mkdir build && cd build
59+
cmake .. -GNinja -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ \
60+
-DLLVM_USE_SANITIZE_COVERAGE=YES -DLLVM_USE_SANITIZER=Address
61+
ninja clang-objc-fuzzer
62+
63+
======================
64+
Running clang-objc-fuzzer
65+
======================
66+
bin/clang-objc-fuzzer CORPUS_DIR
67+
68+
e.g. using the example objc corpus,
69+
70+
bin/clang-objc-fuzzer <path to corpus_examples/objc> <path to new directory to store corpus findings>
71+
72+
3873
=======================================================
3974
Building clang-proto-fuzzer (Linux-only instructions)
4075
=======================================================

‎clang/tools/clang-fuzzer/corpus_examples/objc/BasicClass.m

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
@interface RootObject
2+
@end
3+
4+
@interface BasicClass : RootObject {
5+
int _foo;
6+
char _boolean;
7+
}
8+
9+
@property(nonatomic, assign) int bar;
10+
@property(atomic, retain) id objectField;
11+
@property(nonatomic, assign) id delegate;
12+
13+
- (void)someMethod;
14+
@end
15+
16+
@implementation BasicClass
17+
18+
@synthesize bar = _bar;
19+
@synthesize objectField = _objectField;
20+
@synthesize delegate = _delegate;
21+
22+
- (void)someMethod {
23+
int value = self.bar;
24+
_foo = (_boolean != 0) ? self.bar : [self.objectField bar];
25+
[self setBar:value];
26+
id obj = self.objectField;
27+
}
28+
@end
29+

‎clang/tools/clang-fuzzer/corpus_examples/objc/ClassCategory.m

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
@interface RootObject
2+
@end
3+
4+
@interface BaseClass : RootObject
5+
@property(atomic, assign, readonly) int field;
6+
@end
7+
8+
@interface BaseClass(Private)
9+
@property(atomic, assign, readwrite) int field;
10+
11+
- (int)something;
12+
@end
13+
14+
@implementation BaseClass
15+
- (int)something {
16+
self.field = self.field + 1;
17+
return self.field;
18+
}
19+
@end
20+

‎clang/tools/clang-fuzzer/corpus_examples/objc/ClassExtension.m

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
@interface RootObject
2+
@end
3+
4+
@interface BaseClass : RootObject
5+
@end
6+
7+
@interface BaseClass() {
8+
int _field1;
9+
}
10+
@property(atomic, assign, readonly) int field2;
11+
12+
- (int)addFields;
13+
@end
14+
15+
@implementation BaseClass
16+
- (int)addFields {
17+
return self->_field1 + [self field2];
18+
}
19+
@end
20+

‎clang/tools/clang-fuzzer/corpus_examples/objc/SharedInstance.m

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
@interface RootObject
2+
+ (instancetype)alloc;
3+
4+
- (instancetype)init;
5+
@end
6+
7+
@interface BaseClass : RootObject
8+
+ (instancetype)sharedInstance;
9+
10+
- (instancetype)initWithFoo:(int)foo;
11+
@end
12+
13+
static BaseClass *sharedInstance = (void *)0;
14+
static int counter = 0;
15+
16+
@implementation BaseClass
17+
+ (instancetype)sharedInstance {
18+
if (sharedInstance) {
19+
return sharedInstance;
20+
}
21+
sharedInstance = [[BaseClass alloc] initWithFoo:3];
22+
return sharedInstance;
23+
}
24+
25+
26+
- (instancetype)initWithFoo:(int)foo {
27+
self = [super init];
28+
if (self) {
29+
counter += foo;
30+
}
31+
return self;
32+
}
33+
@end
34+

‎clang/tools/clang-fuzzer/handle-cxx/handle_cxx.cpp

+3-2
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,13 @@
2121
using namespace clang;
2222

2323
void clang_fuzzer::HandleCXX(const std::string &S,
24+
const char *FileName,
2425
const std::vector<const char *> &ExtraArgs) {
2526
llvm::opt::ArgStringList CC1Args;
2627
CC1Args.push_back("-cc1");
2728
for (auto &A : ExtraArgs)
2829
CC1Args.push_back(A);
29-
CC1Args.push_back("./test.cc");
30+
CC1Args.push_back(FileName);
3031

3132
llvm::IntrusiveRefCntPtr<FileManager> Files(
3233
new FileManager(FileSystemOptions()));
@@ -39,7 +40,7 @@ void clang_fuzzer::HandleCXX(const std::string &S,
3940
tooling::newInvocation(&Diagnostics, CC1Args));
4041
std::unique_ptr<llvm::MemoryBuffer> Input =
4142
llvm::MemoryBuffer::getMemBuffer(S);
42-
Invocation->getPreprocessorOpts().addRemappedFile("./test.cc",
43+
Invocation->getPreprocessorOpts().addRemappedFile(FileName,
4344
Input.release());
4445
std::unique_ptr<tooling::ToolAction> action(
4546
tooling::newFrontendActionFactory<clang::EmitObjAction>());

‎clang/tools/clang-fuzzer/handle-cxx/handle_cxx.h

+1
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
namespace clang_fuzzer {
2020
void HandleCXX(const std::string &S,
21+
const char *FileName,
2122
const std::vector<const char *> &ExtraArgs);
2223
} // namespace clang_fuzzer
2324

0 commit comments

Comments
 (0)
Please sign in to comment.