llvm/compiler-rt/lib/fuzzer/FuzzerMerge.cpp

//===- FuzzerMerge.cpp - merging corpora ----------------------------------===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
// Merging corpora.
//===----------------------------------------------------------------------===//

#include "FuzzerCommand.h"
#include "FuzzerMerge.h"
#include "FuzzerIO.h"
#include "FuzzerInternal.h"
#include "FuzzerTracePC.h"
#include "FuzzerUtil.h"

#include <fstream>
#include <iterator>
#include <set>
#include <sstream>
#include <unordered_set>

namespace fuzzer {

bool Merger::Parse(const std::string &Str, bool ParseCoverage) { … }

void Merger::ParseOrExit(std::istream &IS, bool ParseCoverage) { … }

// The control file example:
//
// 3 # The number of inputs
// 1 # The number of inputs in the first corpus, <= the previous number
// file0
// file1
// file2  # One file name per line.
// STARTED 0 123  # FileID, file size
// FT 0 1 4 6 8  # FileID COV1 COV2 ...
// COV 0 7 8 9 # FileID COV1 COV1
// STARTED 1 456  # If FT is missing, the input crashed while processing.
// STARTED 2 567
// FT 2 8 9
// COV 2 11 12
bool Merger::Parse(std::istream &IS, bool ParseCoverage) { … }

size_t Merger::ApproximateMemoryConsumption() const  { … }

// Decides which files need to be merged (add those to NewFiles).
// Returns the number of new features added.
size_t Merger::Merge(const std::set<uint32_t> &InitialFeatures,
                     std::set<uint32_t> *NewFeatures,
                     const std::set<uint32_t> &InitialCov,
                     std::set<uint32_t> *NewCov,
                     std::vector<std::string> *NewFiles) { … }

std::set<uint32_t> Merger::AllFeatures() const { … }

// Inner process. May crash if the target crashes.
void Fuzzer::CrashResistantMergeInternalStep(const std::string &CFPath,
                                             bool IsSetCoverMerge) { … }

// Merges all corpora into the first corpus. A file is added into
// the first corpus only if it adds new features. Unlike `Merger::Merge`,
// this implementation calculates an approximation of the minimum set
// of corpora files, that cover all known features (set cover problem).
// Generally, this means that files with more features are preferred for
// merge into the first corpus. When two files have the same number of
// features, the smaller one is preferred.
size_t Merger::SetCoverMerge(const std::set<uint32_t> &InitialFeatures,
                             std::set<uint32_t> *NewFeatures,
                             const std::set<uint32_t> &InitialCov,
                             std::set<uint32_t> *NewCov,
                             std::vector<std::string> *NewFiles) { … }

static size_t
WriteNewControlFile(const std::string &CFPath,
                    const std::vector<SizedFile> &OldCorpus,
                    const std::vector<SizedFile> &NewCorpus,
                    const std::vector<MergeFileInfo> &KnownFiles) { … }

// Outer process. Does not call the target code and thus should not fail.
void CrashResistantMerge(const std::vector<std::string> &Args,
                         const std::vector<SizedFile> &OldCorpus,
                         const std::vector<SizedFile> &NewCorpus,
                         std::vector<std::string> *NewFiles,
                         const std::set<uint32_t> &InitialFeatures,
                         std::set<uint32_t> *NewFeatures,
                         const std::set<uint32_t> &InitialCov,
                         std::set<uint32_t> *NewCov, const std::string &CFPath,
                         bool V, /*Verbose*/
                         bool IsSetCoverMerge) { … }

} // namespace fuzzer