add std::string and bcmp to dictionary functions
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -28,7 +28,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
- not overriding -Ox or -fno-unroll-loops anymore
- new llvm pass: dict2file via AFL_LLVM_DICT2FILE, create afl-fuzz
-x dictionary of string comparisons found during compilation
- - LTO autodict now also collects interesting cmp comparisons
+ - LTO autodict now also collects interesting cmp comparisons,
+ std::string compare + find + ==, bcmp
### Version ++2.68c (release)

MODIFY
instrumentation/SanitizerCoverageLTO.so.cc
instrumentation/SanitizerCoverageLTO.so.cc
@@ -197,7 +197,8 @@ class ModuleSanitizerCoverage {
void CreateFunctionLocalArrays(Function &F, ArrayRef<BasicBlock *> AllBlocks);
void InjectCoverageAtBlock(Function &F, BasicBlock &BB, size_t Idx,
bool IsLeafFunc = true);
-// std::pair<Value *, Value *> CreateSecStartEnd(Module &M, const char *Section,
+ // std::pair<Value *, Value *> CreateSecStartEnd(Module &M, const char
+ // *Section,
// Type *Ty);
void SetNoSanitizeMetadata(Instruction *I) {
@@ -374,6 +375,7 @@ std::pair<Value *, Value *> ModuleSanitizerCoverage::CreateSecStartEnd(
return std::make_pair(IRB.CreatePointerCast(GEP, Ty), SecEndPtr);
}
+
*/
bool ModuleSanitizerCoverage::instrumentModule(
@@ -612,6 +614,7 @@ bool ModuleSanitizerCoverage::instrumentModule(
bool isStrcasecmp = true;
bool isStrncasecmp = true;
bool isIntMemcpy = true;
+ bool isStdString = true;
bool addedNull = false;
size_t optLen = 0;
@@ -624,7 +627,13 @@ bool ModuleSanitizerCoverage::instrumentModule(
isStrncmp &= !FuncName.compare("strncmp");
isStrcasecmp &= !FuncName.compare("strcasecmp");
isStrncasecmp &= !FuncName.compare("strncasecmp");
- isIntMemcpy &= !FuncName.compare("llvm.memcpy.p0i8.p0i8.i64");
+ isIntMemcpy &= (!FuncName.compare("llvm.memcpy.p0i8.p0i8.i64") ||
+ !FuncName.compare("bcmp"));
+ isStdString &=
+ ((FuncName.find("basic_string") != std::string::npos &&
+ FuncName.find("compare") != std::string::npos) ||
+ (FuncName.find("basic_string") != std::string::npos &&
+ FuncName.find("find") != std::string::npos));
/* we do something different here, putting this BB and the
successors in a block map */
@@ -642,7 +651,7 @@ bool ModuleSanitizerCoverage::instrumentModule(
}
if (!isStrcmp && !isMemcmp && !isStrncmp && !isStrcasecmp &&
- !isStrncasecmp && !isIntMemcpy)
+ !isStrncasecmp && !isIntMemcpy && !isStdString)
continue;
/* Verify the strcmp/memcmp/strncmp/strcasecmp/strncasecmp function
@@ -676,9 +685,12 @@ bool ModuleSanitizerCoverage::instrumentModule(
FT->getParamType(0) ==
IntegerType::getInt8PtrTy(M.getContext()) &&
FT->getParamType(2)->isIntegerTy();
+ isStdString &= FT->getNumParams() >= 2 &&
+ FT->getParamType(0)->isPointerTy() &&
+ FT->getParamType(1)->isPointerTy();
if (!isStrcmp && !isMemcmp && !isStrncmp && !isStrcasecmp &&
- !isStrncasecmp && !isIntMemcpy)
+ !isStrncasecmp && !isIntMemcpy && !isStdString)
continue;
/* is a str{n,}{case,}cmp/memcmp, check if we have
@@ -1556,6 +1568,7 @@ std::string ModuleSanitizerCoverage::getSectionEnd(
return "__stop___" + Section;
}
+
*/
char ModuleSanitizerCoverageLegacyPass::ID = 0;

MODIFY
instrumentation/afl-llvm-dict2file.so.cc
instrumentation/afl-llvm-dict2file.so.cc
@@ -283,6 +283,7 @@ bool AFLdict2filePass::runOnModule(Module &M) {
bool isStrcasecmp = true;
bool isStrncasecmp = true;
bool isIntMemcpy = true;
+ bool isStdString = true;
bool addedNull = false;
size_t optLen = 0;
@@ -295,10 +296,15 @@ bool AFLdict2filePass::runOnModule(Module &M) {
isStrncmp &= !FuncName.compare("strncmp");
isStrcasecmp &= !FuncName.compare("strcasecmp");
isStrncasecmp &= !FuncName.compare("strncasecmp");
- isIntMemcpy &= !FuncName.compare("llvm.memcpy.p0i8.p0i8.i64");
+ isIntMemcpy &= (!FuncName.compare("llvm.memcpy.p0i8.p0i8.i64") ||
+ !FuncName.compare("bcmp"));
+ isStdString &= ((FuncName.find("basic_string") != std::string::npos &&
+ FuncName.find("compare") != std::string::npos) ||
+ (FuncName.find("basic_string") != std::string::npos &&
+ FuncName.find("find") != std::string::npos));
if (!isStrcmp && !isMemcmp && !isStrncmp && !isStrcasecmp &&
- !isStrncasecmp && !isIntMemcpy)
+ !isStrncasecmp && !isIntMemcpy && !isStdString)
continue;
/* Verify the strcmp/memcmp/strncmp/strcasecmp/strncasecmp function
@@ -330,9 +336,12 @@ bool AFLdict2filePass::runOnModule(Module &M) {
FT->getParamType(0) ==
IntegerType::getInt8PtrTy(M.getContext()) &&
FT->getParamType(2)->isIntegerTy();
+ isStdString &= FT->getNumParams() >= 2 &&
+ FT->getParamType(0)->isPointerTy() &&
+ FT->getParamType(1)->isPointerTy();
if (!isStrcmp && !isMemcmp && !isStrncmp && !isStrcasecmp &&
- !isStrncasecmp && !isIntMemcpy)
+ !isStrncasecmp && !isIntMemcpy && !isStdString)
continue;
/* is a str{n,}{case,}cmp/memcmp, check if we have

MODIFY
instrumentation/afl-llvm-lto-instrumentation.so.cc
instrumentation/afl-llvm-lto-instrumentation.so.cc
@@ -381,6 +381,7 @@ bool AFLLTOPass::runOnModule(Module &M) {
bool isStrcasecmp = true;
bool isStrncasecmp = true;
bool isIntMemcpy = true;
+ bool isStdString = true;
bool addedNull = false;
size_t optLen = 0;
@@ -393,7 +394,13 @@ bool AFLLTOPass::runOnModule(Module &M) {
isStrncmp &= !FuncName.compare("strncmp");
isStrcasecmp &= !FuncName.compare("strcasecmp");
isStrncasecmp &= !FuncName.compare("strncasecmp");
- isIntMemcpy &= !FuncName.compare("llvm.memcpy.p0i8.p0i8.i64");
+ isIntMemcpy &= (!FuncName.compare("llvm.memcpy.p0i8.p0i8.i64") ||
+ !FuncName.compare("bcmp"));
+ isStdString &=
+ ((FuncName.find("basic_string") != std::string::npos &&
+ FuncName.find("compare") != std::string::npos) ||
+ (FuncName.find("basic_string") != std::string::npos &&
+ FuncName.find("find") != std::string::npos));
/* we do something different here, putting this BB and the
successors in a block map */
@@ -414,7 +421,7 @@ bool AFLLTOPass::runOnModule(Module &M) {
}
if (!isStrcmp && !isMemcmp && !isStrncmp && !isStrcasecmp &&
- !isStrncasecmp && !isIntMemcpy)
+ !isStrncasecmp && !isIntMemcpy && !isStdString)
continue;
/* Verify the strcmp/memcmp/strncmp/strcasecmp/strncasecmp function
@@ -448,9 +455,12 @@ bool AFLLTOPass::runOnModule(Module &M) {
FT->getParamType(0) ==
IntegerType::getInt8PtrTy(M.getContext()) &&
FT->getParamType(2)->isIntegerTy();
+ isStdString &= FT->getNumParams() >= 2 &&
+ FT->getParamType(0)->isPointerTy() &&
+ FT->getParamType(1)->isPointerTy();
if (!isStrcmp && !isMemcmp && !isStrncmp && !isStrcasecmp &&
- !isStrncasecmp && !isIntMemcpy)
+ !isStrncasecmp && !isIntMemcpy && !isStdString)
continue;
/* is a str{n,}{case,}cmp/memcmp, check if we have

add std::string and bcmp to dictionary functions