Explorar el Código

[libFuzzer] add -shuffle flag

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@250603 91177308-0d34-0410-b5e6-96231b3b80d8
Kostya Serebryany hace 9 años
padre
commit
2a50aa48db

+ 1 - 0
lib/Fuzzer/FuzzerDriver.cpp

@@ -255,6 +255,7 @@ int FuzzerDriver(const std::vector<std::string> &Args,
   Options.ExitOnFirst = Flags.exit_on_first;
   Options.UseCounters = Flags.use_counters;
   Options.UseTraces = Flags.use_traces;
+  Options.ShuffleAtStartUp = Flags.shuffle;
   Options.PreferSmallDuringInitialShuffle =
       Flags.prefer_small_during_initial_shuffle;
   Options.Tokens = ReadTokensFile(Flags.deprecated_tokens);

+ 1 - 0
lib/Fuzzer/FuzzerFlags.def

@@ -18,6 +18,7 @@ FUZZER_FLAG_INT(max_len, 64, "Maximum length of the test input.")
 FUZZER_FLAG_INT(cross_over, 1, "If 1, cross over inputs.")
 FUZZER_FLAG_INT(mutate_depth, 5,
             "Apply this number of consecutive mutations to each input.")
+FUZZER_FLAG_INT(shuffle, 1, "Shuffle inputs at startup")
 FUZZER_FLAG_INT(
     prefer_small_during_initial_shuffle, -1,
     "If 1, always prefer smaller inputs during the initial corpus shuffle."

+ 1 - 0
lib/Fuzzer/FuzzerInternal.h

@@ -82,6 +82,7 @@ class Fuzzer {
     bool UseTraces = false;
     bool UseFullCoverageSet  = false;
     bool Reload = true;
+    bool ShuffleAtStartUp = true;
     int PreferSmallDuringInitialShuffle = -1;
     size_t MaxNumberOfRuns = ULONG_MAX;
     int SyncTimeout = 600;

+ 7 - 5
lib/Fuzzer/FuzzerLoop.cpp

@@ -137,11 +137,13 @@ void Fuzzer::ShuffleAndMinimize() {
     Printf("PreferSmall: %d\n", PreferSmall);
   PrintStats("READ  ", 0);
   std::vector<Unit> NewCorpus;
-  std::random_shuffle(Corpus.begin(), Corpus.end(), USF.GetRand());
-  if (PreferSmall)
-    std::stable_sort(
-        Corpus.begin(), Corpus.end(),
-        [](const Unit &A, const Unit &B) { return A.size() < B.size(); });
+  if (Options.ShuffleAtStartUp) {
+    std::random_shuffle(Corpus.begin(), Corpus.end(), USF.GetRand());
+    if (PreferSmall)
+      std::stable_sort(
+          Corpus.begin(), Corpus.end(),
+          [](const Unit &A, const Unit &B) { return A.size() < B.size(); });
+  }
   Unit &U = CurrentUnit;
   for (const auto &C : Corpus) {
     for (size_t First = 0; First < 1; First++) {