#include "libhfuzz/libhfuzz.h"
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
#include <signal.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include "honggfuzz.h"
#include "libcommon/common.h"
#include "libcommon/files.h"
#include "libcommon/log.h"
__attribute__((weak)) int LLVMFuzzerTestOneInput(const uint8_t* buf, size_t len);
__attribute__((weak)) int LLVMFuzzerInitialize(int* argc UNUSED, char*** argv UNUSED) { return 0; }
/* FIXME(robertswiecki): Make it call mangle_Mangle() */
__attribute__((weak)) size_t LLVMFuzzerMutate(
uint8_t* Data UNUSED, size_t Size UNUSED, size_t MaxSize UNUSED) {
LOG_F("LLVMFuzzerMutate() is not supported in honggfuzz yet");
return 0;
}
static uint8_t buf[_HF_PERF_BITMAP_SIZE_16M] = {0};
void HF_ITER(const uint8_t** buf_ptr, size_t* len_ptr) {
/*
* Send the 'done' marker to the parent
*/
static bool initialized = false;
if (initialized == true) {
static const uint8_t readyTag = 'A';
if (files_writeToFd(_HF_PERSISTENT_FD, &readyTag, sizeof(readyTag)) == false) {
LOG_F("writeToFd(size=%zu) failed", sizeof(readyTag));
}
}
initialized = true;
uint32_t rlen;
if (files_readFromFd(_HF_PERSISTENT_FD, (uint8_t*)&rlen, sizeof(rlen)) !=
(ssize_t)sizeof(rlen)) {
LOG_F("readFromFd(size=%zu) failed", sizeof(rlen));
}
size_t len = (size_t)rlen;
if (len > _HF_PERF_BITMAP_SIZE_16M) {
LOG_F("len (%zu) > buf_size (%zu)\n", len, (size_t)_HF_PERF_BITMAP_SIZE_16M);
}
if (files_readFromFd(_HF_PERSISTENT_FD, buf, len) != (ssize_t)len) {
LOG_F("readFromFd(size=%zu) failed", len);
}
*buf_ptr = buf;
*len_ptr = len;
}
static void runOneInput(const uint8_t* buf, size_t len) {
int ret = LLVMFuzzerTestOneInput(buf, len);
if (ret != 0) {
LOG_F("LLVMFuzzerTestOneInput() returned '%d' instead of '0'", ret);
}
}
/*
* Declare it 'weak', so it can be safely linked with regular binaries which
* implement their own main()
*/
#if !defined(__CYGWIN__)
__attribute__((weak))
#endif /* !defined(__CYGWIN__) */
int main(int argc, char** argv) {
LLVMFuzzerInitialize(&argc, &argv);
if (LLVMFuzzerTestOneInput == NULL) {
LOG_F(
"Define 'int LLVMFuzzerTestOneInput(uint8_t * buf, size_t len)' in your "
"code to make it work");
extern int hfuzz_module_instrument;
extern int hfuzz_module_memorycmp;
LOG_F(
"This won't be displayed, it's used just to reference other modules in this archive: "
"%d",
hfuzz_module_instrument + hfuzz_module_memorycmp);
}
if (fcntl(_HF_PERSISTENT_FD, F_GETFD) == -1 && errno == EBADF) {
int in_fd = STDIN_FILENO;
const char* fname = "[STDIN]";
if (argc > 1) {
fname = argv[argc - 1];
if ((in_fd = open(argv[argc - 1], O_RDONLY)) == -1) {
PLOG_W("Cannot open '%s' as input, using stdin", argv[argc - 1]);
in_fd = STDIN_FILENO;
fname = "[STDIN]";
}
}
LOG_I(
"Accepting input from '%s'\n"
"Usage for fuzzing: honggfuzz -P [flags] -- %s",
fname, argv[0]);
ssize_t len = files_readFromFd(in_fd, buf, sizeof(buf));
if (len < 0) {
LOG_E("Couldn't read data from stdin: %s", strerror(errno));
return -1;
}
runOneInput(buf, len);
return 0;
}
for (;;) {
size_t len;
const uint8_t* buf;
HF_ITER(&buf, &len);
runOneInput(buf, len);
}
}