1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167
|
#!/usr/bin/env python3
# To use:
# 1) Update the 'decls' list below with your fuzzing configuration.
# 2) Run with the clang binary as the command-line argument.
from __future__ import absolute_import, division, print_function
import random
import subprocess
import sys
import os
clang = sys.argv[1]
none_opts = 0.3
class Decl(object):
def __init__(self, text, depends=[], provides=[], conflicts=[]):
self.text = text
self.depends = depends
self.provides = provides
self.conflicts = conflicts
def valid(self, model):
for i in self.depends:
if i not in model.decls:
return False
for i in self.conflicts:
if i in model.decls:
return False
return True
def apply(self, model, name):
for i in self.provides:
model.decls[i] = True
model.source += self.text % {'name': name}
decls = [
Decl('struct X { int n; };\n', provides=['X'], conflicts=['X']),
Decl('static_assert(X{.n=1}.n == 1, "");\n', depends=['X']),
Decl('X %(name)s;\n', depends=['X']),
]
class FS(object):
def __init__(self):
self.fs = {}
self.prevfs = {}
def write(self, path, contents):
self.fs[path] = contents
def done(self):
for f, s in self.fs.items():
if self.prevfs.get(f) != s:
f = file(f, 'w')
f.write(s)
f.close()
for f in self.prevfs:
if f not in self.fs:
os.remove(f)
self.prevfs, self.fs = self.fs, {}
fs = FS()
class CodeModel(object):
def __init__(self):
self.source = ''
self.modules = {}
self.decls = {}
self.i = 0
def make_name(self):
self.i += 1
return 'n' + str(self.i)
def fails(self):
fs.write('module.modulemap',
''.join('module %s { header "%s.h" export * }\n' % (m, m)
for m in self.modules.keys()))
for m, (s, _) in self.modules.items():
fs.write('%s.h' % m, s)
fs.write('main.cc', self.source)
fs.done()
return subprocess.call([clang, '-std=c++11', '-c', '-fmodules', 'main.cc', '-o', '/dev/null']) != 0
def generate():
model = CodeModel()
m = []
try:
for d in mutations(model):
d(model)
m.append(d)
if not model.fails():
return
except KeyboardInterrupt:
print()
return True
sys.stdout.write('\nReducing:\n')
sys.stdout.flush()
try:
while True:
assert m, 'got a failure with no steps; broken clang binary?'
i = random.choice(list(range(len(m))))
x = m[0:i] + m[i+1:]
m2 = CodeModel()
for d in x:
d(m2)
if m2.fails():
m = x
model = m2
else:
sys.stdout.write('.')
sys.stdout.flush()
except KeyboardInterrupt:
# FIXME: Clean out output directory first.
model.fails()
return model
def choose(options):
while True:
i = int(random.uniform(0, len(options) + none_opts))
if i >= len(options):
break
yield options[i]
def mutations(model):
options = [create_module, add_top_level_decl]
for opt in choose(options):
yield opt(model, options)
def create_module(model, options):
n = model.make_name()
def go(model):
model.modules[n] = (model.source, model.decls)
(model.source, model.decls) = ('', {})
options += [lambda model, options: add_import(model, options, n)]
return go
def add_top_level_decl(model, options):
n = model.make_name()
d = random.choice([decl for decl in decls if decl.valid(model)])
def go(model):
if not d.valid(model):
return
d.apply(model, n)
return go
def add_import(model, options, module_name):
def go(model):
if module_name in model.modules:
model.source += '#include "%s.h"\n' % module_name
model.decls.update(model.modules[module_name][1])
return go
sys.stdout.write('Finding bug: ')
while True:
if generate():
break
sys.stdout.write('.')
sys.stdout.flush()
|