1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
|
//===-- lldb-target-fuzzer.cpp --------------------------------------------===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
#include "utils/TempFile.h"
#include "Plugins/Platform/Linux/PlatformLinux.h"
#include "lldb/Core/Debugger.h"
#include "lldb/Core/Value.h"
#include "lldb/Expression/DWARFExpression.h"
#include "lldb/Host/FileSystem.h"
#include "lldb/Host/HostInfo.h"
#include "lldb/Target/Target.h"
using namespace lldb;
using namespace lldb_private;
using namespace lldb_private::plugin::dwarf;
using namespace lldb_fuzzer;
extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) {
FileSystem::Initialize();
HostInfo::Initialize();
platform_linux::PlatformLinux::Initialize();
return 0;
}
static void Evaluate(llvm::ArrayRef<uint8_t> expr,
lldb::ModuleSP module_sp = {}, DWARFUnit *unit = nullptr,
ExecutionContext *exe_ctx = nullptr) {
DataExtractor extractor(expr.data(), expr.size(), lldb::eByteOrderLittle,
/*addr_size*/ 4);
llvm::Expected<Value> result =
DWARFExpression::Evaluate(exe_ctx, /*reg_ctx*/ nullptr, module_sp,
extractor, unit, lldb::eRegisterKindLLDB,
/*initial_value_ptr*/ nullptr,
/*object_address_ptr*/ nullptr);
if (!result)
llvm::consumeError(result.takeError());
}
class MockTarget : public Target {
public:
MockTarget(Debugger &debugger, const ArchSpec &target_arch,
const lldb::PlatformSP &platform_sp, llvm::ArrayRef<uint8_t> data)
: Target(debugger, target_arch, platform_sp, true), m_data(data) {}
size_t ReadMemory(const Address &addr, void *dst, size_t dst_len,
Status &error, bool force_live_memory = false,
lldb::addr_t *load_addr_ptr = nullptr) override {
std::memcpy(dst, m_data.data(), m_data.size());
return m_data.size();
}
private:
llvm::ArrayRef<uint8_t> m_data;
};
extern "C" int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
// We're going to use the first half of the input data as the DWARF expression
// and the second half as memory.
const size_t partition = size / 2;
llvm::ArrayRef expression_data(data, partition);
llvm::ArrayRef memory_data(data + partition, size - partition);
// Create a mock target for reading memory.
ArchSpec arch("i386-pc-linux");
Platform::SetHostPlatform(
platform_linux::PlatformLinux::CreateInstance(true, &arch));
lldb::DebuggerSP debugger_sp = Debugger::CreateInstance();
lldb::PlatformSP platform_sp;
auto target_sp = std::make_shared<MockTarget>(*debugger_sp, arch, platform_sp,
memory_data);
ExecutionContext exe_ctx(static_cast<lldb::TargetSP>(target_sp), false);
Evaluate(expression_data);
return 0;
}
|
