Skip to content

Commit 831ae45

Browse files
committed
Recommit "[libFuzzer] Link libFuzzer's own interceptors when other compiler runtimes are not linked."
Summary: libFuzzer intercepts certain library functions such as memcmp/strcmp by defining weak hooks. Weak hooks, however, are called only when other runtimes such as ASan is linked. This patch defines libFuzzer's own interceptors, which is linked into the libFuzzer executable when other runtimes are not linked, i.e., when -fsanitize=fuzzer is given, but not others. The patch once landed but was reverted in 8ef9e2b due to an assertion failure caused by calling an intercepted function, strncmp, while initializing the interceptors in fuzzerInit(). This issue is now fixed by calling libFuzzer's own implementation of library functions (i.e., internal_*) when the fuzzer has not been initialized yet, instead of recursively calling fuzzerInit() again. Reviewers: kcc, morehouse, hctim Subscribers: #sanitizers, krytarowski, mgorny, cfe-commits Tags: #clang, #sanitizers Differential Revision: https://reviews.llvm.org/D83494
1 parent 84980b1 commit 831ae45

File tree

12 files changed

+337
-3
lines changed

12 files changed

+337
-3
lines changed

clang/include/clang/Driver/SanitizerArgs.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ class SanitizerArgs {
7474
!Sanitizers.has(SanitizerKind::Address) &&
7575
!Sanitizers.has(SanitizerKind::HWAddress);
7676
}
77+
bool needsFuzzerInterceptors() const;
7778
bool needsUbsanRt() const;
7879
bool requiresMinimalRuntime() const { return MinimalRuntime; }
7980
bool needsDfsanRt() const { return Sanitizers.has(SanitizerKind::DataFlow); }

clang/lib/Driver/SanitizerArgs.cpp

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,6 +240,10 @@ static SanitizerMask parseSanitizeTrapArgs(const Driver &D,
240240
return TrappingKinds;
241241
}
242242

243+
bool SanitizerArgs::needsFuzzerInterceptors() const {
244+
return needsFuzzer() && !needsAsanRt() && !needsTsanRt() && !needsMsanRt();
245+
}
246+
243247
bool SanitizerArgs::needsUbsanRt() const {
244248
// All of these include ubsan.
245249
if (needsAsanRt() || needsMsanRt() || needsHwasanRt() || needsTsanRt() ||

clang/lib/Driver/ToolChains/CommonArgs.cpp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -784,6 +784,9 @@ bool tools::addSanitizerRuntimes(const ToolChain &TC, const ArgList &Args,
784784
!Args.hasArg(options::OPT_shared)) {
785785

786786
addSanitizerRuntime(TC, Args, CmdArgs, "fuzzer", false, true);
787+
if (SanArgs.needsFuzzerInterceptors())
788+
addSanitizerRuntime(TC, Args, CmdArgs, "fuzzer_interceptors", false,
789+
true);
787790
if (!Args.hasArg(clang::driver::options::OPT_nostdlibxx))
788791
TC.AddCXXStdlibLibArgs(Args, CmdArgs);
789792
}

compiler-rt/lib/fuzzer/CMakeLists.txt

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,13 @@ add_compiler_rt_object_libraries(RTfuzzer_main
9999
CFLAGS ${LIBFUZZER_CFLAGS}
100100
DEPS ${LIBFUZZER_DEPS})
101101

102+
add_compiler_rt_object_libraries(RTfuzzer_interceptors
103+
OS ${FUZZER_SUPPORTED_OS}
104+
ARCHS ${FUZZER_SUPPORTED_ARCH}
105+
SOURCES FuzzerInterceptors.cpp
106+
CFLAGS ${LIBFUZZER_CFLAGS}
107+
DEPS ${LIBFUZZER_DEPS})
108+
102109
add_compiler_rt_runtime(clang_rt.fuzzer
103110
STATIC
104111
OS ${FUZZER_SUPPORTED_OS}
@@ -115,6 +122,14 @@ add_compiler_rt_runtime(clang_rt.fuzzer_no_main
115122
CFLAGS ${LIBFUZZER_CFLAGS}
116123
PARENT_TARGET fuzzer)
117124

125+
add_compiler_rt_runtime(clang_rt.fuzzer_interceptors
126+
STATIC
127+
OS ${FUZZER_SUPPORTED_OS}
128+
ARCHS ${FUZZER_SUPPORTED_ARCH}
129+
OBJECT_LIBS RTfuzzer_interceptors
130+
CFLAGS ${LIBFUZZER_CFLAGS}
131+
PARENT_TARGET fuzzer)
132+
118133
if(OS_NAME MATCHES "Linux|Fuchsia" AND
119134
COMPILER_RT_LIBCXX_PATH AND
120135
COMPILER_RT_LIBCXXABI_PATH)
@@ -148,7 +163,10 @@ if(OS_NAME MATCHES "Linux|Fuchsia" AND
148163
add_dependencies(RTfuzzer.${arch} libcxx_fuzzer_${arch}-build)
149164
target_compile_options(RTfuzzer_main.${arch} PRIVATE -isystem ${LIBCXX_${arch}_PREFIX}/include/c++/v1)
150165
add_dependencies(RTfuzzer_main.${arch} libcxx_fuzzer_${arch}-build)
166+
target_compile_options(RTfuzzer_interceptors.${arch} PRIVATE -isystem ${LIBCXX_${arch}_PREFIX}/include/c++/v1)
167+
add_dependencies(RTfuzzer_interceptors.${arch} libcxx_fuzzer_${arch}-build)
151168
partially_link_libcxx(fuzzer_no_main ${LIBCXX_${arch}_PREFIX} ${arch})
169+
partially_link_libcxx(fuzzer_interceptors ${LIBCXX_${arch}_PREFIX} ${arch})
152170
partially_link_libcxx(fuzzer ${LIBCXX_${arch}_PREFIX} ${arch})
153171
endforeach()
154172
endif()
Lines changed: 224 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
//===-- FuzzerInterceptors.cpp --------------------------------------------===//
2+
//
3+
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4+
// See https://llvm.org/LICENSE.txt for license information.
5+
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6+
//
7+
//===----------------------------------------------------------------------===//
8+
// Intercept certain libc functions to aid fuzzing.
9+
// Linked only when other RTs that define their own interceptors are not linked.
10+
//===----------------------------------------------------------------------===//
11+
12+
#include "FuzzerPlatform.h"
13+
14+
#if LIBFUZZER_LINUX
15+
16+
#define GET_CALLER_PC() __builtin_return_address(0)
17+
18+
#define PTR_TO_REAL(x) real_##x
19+
#define REAL(x) __interception::PTR_TO_REAL(x)
20+
#define FUNC_TYPE(x) x##_type
21+
#define DEFINE_REAL(ret_type, func, ...) \
22+
typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \
23+
namespace __interception { \
24+
FUNC_TYPE(func) PTR_TO_REAL(func); \
25+
}
26+
27+
#include <cassert>
28+
#include <cstdint>
29+
#include <dlfcn.h> // for dlsym()
30+
#include <sanitizer/common_interface_defs.h>
31+
32+
static void *getFuncAddr(const char *name, uintptr_t wrapper_addr) {
33+
void *addr = dlsym(RTLD_NEXT, name);
34+
if (!addr) {
35+
// If the lookup using RTLD_NEXT failed, the sanitizer runtime library is
36+
// later in the library search order than the DSO that we are trying to
37+
// intercept, which means that we cannot intercept this function. We still
38+
// want the address of the real definition, though, so look it up using
39+
// RTLD_DEFAULT.
40+
addr = dlsym(RTLD_DEFAULT, name);
41+
42+
// In case `name' is not loaded, dlsym ends up finding the actual wrapper.
43+
// We don't want to intercept the wrapper and have it point to itself.
44+
if (reinterpret_cast<uintptr_t>(addr) == wrapper_addr)
45+
addr = nullptr;
46+
}
47+
return addr;
48+
}
49+
50+
static int FuzzerInited = 0;
51+
static bool FuzzerInitIsRunning;
52+
53+
static void fuzzerInit();
54+
55+
static void ensureFuzzerInited() {
56+
assert(!FuzzerInitIsRunning);
57+
if (!FuzzerInited) {
58+
fuzzerInit();
59+
}
60+
}
61+
62+
static int internal_strcmp_strncmp(const char *s1, const char *s2, bool strncmp,
63+
size_t n) {
64+
size_t i = 0;
65+
while (true) {
66+
if (strncmp) {
67+
if (i == n)
68+
break;
69+
i++;
70+
}
71+
unsigned c1 = *s1;
72+
unsigned c2 = *s2;
73+
if (c1 != c2)
74+
return (c1 < c2) ? -1 : 1;
75+
if (c1 == 0)
76+
break;
77+
s1++;
78+
s2++;
79+
}
80+
return 0;
81+
}
82+
83+
static int internal_strncmp(const char *s1, const char *s2, size_t n) {
84+
return internal_strcmp_strncmp(s1, s2, true, n);
85+
}
86+
87+
static int internal_strcmp(const char *s1, const char *s2) {
88+
return internal_strcmp_strncmp(s1, s2, false, 0);
89+
}
90+
91+
static int internal_memcmp(const void *s1, const void *s2, size_t n) {
92+
const uint8_t *t1 = static_cast<const uint8_t *>(s1);
93+
const uint8_t *t2 = static_cast<const uint8_t *>(s2);
94+
for (size_t i = 0; i < n; ++i, ++t1, ++t2)
95+
if (*t1 != *t2)
96+
return *t1 < *t2 ? -1 : 1;
97+
return 0;
98+
}
99+
100+
static size_t internal_strlen(const char *s) {
101+
size_t i = 0;
102+
while (s[i])
103+
i++;
104+
return i;
105+
}
106+
107+
static char *internal_strstr(const char *haystack, const char *needle) {
108+
// This is O(N^2), but we are not using it in hot places.
109+
size_t len1 = internal_strlen(haystack);
110+
size_t len2 = internal_strlen(needle);
111+
if (len1 < len2)
112+
return nullptr;
113+
for (size_t pos = 0; pos <= len1 - len2; pos++) {
114+
if (internal_memcmp(haystack + pos, needle, len2) == 0)
115+
return const_cast<char *>(haystack) + pos;
116+
}
117+
return nullptr;
118+
}
119+
120+
extern "C" {
121+
122+
DEFINE_REAL(int, memcmp, const void *, const void *, size_t)
123+
DEFINE_REAL(int, strncmp, const char *, const char *, size_t)
124+
DEFINE_REAL(int, strcmp, const char *, const char *)
125+
DEFINE_REAL(int, strncasecmp, const char *, const char *, size_t)
126+
DEFINE_REAL(int, strcasecmp, const char *, const char *)
127+
DEFINE_REAL(char *, strstr, const char *, const char *)
128+
DEFINE_REAL(char *, strcasestr, const char *, const char *)
129+
DEFINE_REAL(void *, memmem, const void *, size_t, const void *, size_t)
130+
131+
ATTRIBUTE_INTERFACE int memcmp(const void *s1, const void *s2, size_t n) {
132+
if (!FuzzerInited)
133+
return internal_memcmp(s1, s2, n);
134+
int result = REAL(memcmp)(s1, s2, n);
135+
__sanitizer_weak_hook_memcmp(GET_CALLER_PC(), s1, s2, n, result);
136+
return result;
137+
}
138+
139+
ATTRIBUTE_INTERFACE int strncmp(const char *s1, const char *s2, size_t n) {
140+
if (!FuzzerInited)
141+
return internal_strncmp(s1, s2, n);
142+
int result = REAL(strncmp)(s1, s2, n);
143+
__sanitizer_weak_hook_strncmp(GET_CALLER_PC(), s1, s2, n, result);
144+
return result;
145+
}
146+
147+
ATTRIBUTE_INTERFACE int strcmp(const char *s1, const char *s2) {
148+
if (!FuzzerInited)
149+
return internal_strcmp(s1, s2);
150+
int result = REAL(strcmp)(s1, s2);
151+
__sanitizer_weak_hook_strcmp(GET_CALLER_PC(), s1, s2, result);
152+
return result;
153+
}
154+
155+
ATTRIBUTE_INTERFACE int strncasecmp(const char *s1, const char *s2, size_t n) {
156+
ensureFuzzerInited();
157+
int result = REAL(strncasecmp)(s1, s2, n);
158+
__sanitizer_weak_hook_strncasecmp(GET_CALLER_PC(), s1, s2, n, result);
159+
return result;
160+
}
161+
162+
ATTRIBUTE_INTERFACE int strcasecmp(const char *s1, const char *s2) {
163+
ensureFuzzerInited();
164+
int result = REAL(strcasecmp)(s1, s2);
165+
__sanitizer_weak_hook_strcasecmp(GET_CALLER_PC(), s1, s2, result);
166+
return result;
167+
}
168+
169+
ATTRIBUTE_INTERFACE char *strstr(const char *s1, const char *s2) {
170+
if (!FuzzerInited)
171+
return internal_strstr(s1, s2);
172+
char *result = REAL(strstr)(s1, s2);
173+
__sanitizer_weak_hook_strstr(GET_CALLER_PC(), s1, s2, result);
174+
return result;
175+
}
176+
177+
ATTRIBUTE_INTERFACE char *strcasestr(const char *s1, const char *s2) {
178+
ensureFuzzerInited();
179+
char *result = REAL(strcasestr)(s1, s2);
180+
__sanitizer_weak_hook_strcasestr(GET_CALLER_PC(), s1, s2, result);
181+
return result;
182+
}
183+
184+
ATTRIBUTE_INTERFACE
185+
void *memmem(const void *s1, size_t len1, const void *s2, size_t len2) {
186+
ensureFuzzerInited();
187+
void *result = REAL(memmem)(s1, len1, s2, len2);
188+
__sanitizer_weak_hook_memmem(GET_CALLER_PC(), s1, len1, s2, len2, result);
189+
return result;
190+
}
191+
192+
__attribute__((section(".preinit_array"),
193+
used)) static void (*__local_fuzzer_preinit)(void) = fuzzerInit;
194+
195+
} // extern "C"
196+
197+
static void fuzzerInit() {
198+
assert(!FuzzerInitIsRunning);
199+
if (FuzzerInited)
200+
return;
201+
FuzzerInitIsRunning = true;
202+
203+
REAL(memcmp) = reinterpret_cast<memcmp_type>(
204+
getFuncAddr("memcmp", reinterpret_cast<uintptr_t>(&memcmp)));
205+
REAL(strncmp) = reinterpret_cast<strncmp_type>(
206+
getFuncAddr("strncmp", reinterpret_cast<uintptr_t>(&strncmp)));
207+
REAL(strcmp) = reinterpret_cast<strcmp_type>(
208+
getFuncAddr("strcmp", reinterpret_cast<uintptr_t>(&strcmp)));
209+
REAL(strncasecmp) = reinterpret_cast<strncasecmp_type>(
210+
getFuncAddr("strncasecmp", reinterpret_cast<uintptr_t>(&strncasecmp)));
211+
REAL(strcasecmp) = reinterpret_cast<strcasecmp_type>(
212+
getFuncAddr("strcasecmp", reinterpret_cast<uintptr_t>(&strcasecmp)));
213+
REAL(strstr) = reinterpret_cast<strstr_type>(
214+
getFuncAddr("strstr", reinterpret_cast<uintptr_t>(&strstr)));
215+
REAL(strcasestr) = reinterpret_cast<strcasestr_type>(
216+
getFuncAddr("strcasestr", reinterpret_cast<uintptr_t>(&strcasestr)));
217+
REAL(memmem) = reinterpret_cast<memmem_type>(
218+
getFuncAddr("memmem", reinterpret_cast<uintptr_t>(&memmem)));
219+
220+
FuzzerInitIsRunning = false;
221+
FuzzerInited = 1;
222+
}
223+
224+
#endif
Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
2+
// See https://llvm.org/LICENSE.txt for license information.
3+
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
4+
5+
// Test whether calling certain libFuzzer's interceptors inside allocators
6+
// does not cause an assertion failure.
7+
#include <assert.h>
8+
#include <cstddef>
9+
#include <cstdint>
10+
#include <cstdlib>
11+
#include <cstring>
12+
#include <iostream>
13+
#include <malloc.h>
14+
15+
static const char *buf1 = "aaaa";
16+
static const char *buf2 = "bbbb";
17+
18+
static void callFuzzerInterceptors(const char *prefix) {
19+
int memcmp_result = memcmp(buf1, buf2, 4);
20+
if (memcmp_result != 0) {
21+
fprintf(stderr, "%s-MEMCMP\n", prefix);
22+
}
23+
int strncmp_result = strncmp(buf1, buf2, 4);
24+
if (strncmp_result != 0) {
25+
fprintf(stderr, "%s-STRNCMP\n", prefix);
26+
}
27+
int strcmp_result = strcmp(buf1, buf2);
28+
if (strcmp_result != 0) {
29+
fprintf(stderr, "%s-STRCMP\n", prefix);
30+
}
31+
const char *strstr_result = strstr(buf1, buf2);
32+
if (strstr_result == nullptr) {
33+
fprintf(stderr, "%s-STRSTR\n", prefix);
34+
}
35+
}
36+
37+
extern "C" void *__libc_calloc(size_t, size_t);
38+
39+
extern "C" void *calloc(size_t n, size_t elem_size) {
40+
static bool CalledOnce = false;
41+
if (!CalledOnce) {
42+
callFuzzerInterceptors("CALLOC");
43+
CalledOnce = true;
44+
}
45+
return __libc_calloc(n, elem_size);
46+
}
Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
UNSUPPORTED: freebsd
2+
RUN: %cpp_compiler -fno-sanitize=address -fno-builtin %S/CustomAllocator.cpp %S/EmptyTest.cpp -o %t-NoAsanCustomAllocatorTest
3+
4+
RUN: %run %t-NoAsanCustomAllocatorTest -runs=1 2>&1 | FileCheck %s
5+
6+
CHECK: CALLOC-MEMCMP
7+
CHECK-NEXT: CALLOC-STRNCMP
8+
CHECK-NEXT: CALLOC-STRCMP
9+
CHECK-NEXT: CALLOC-STRSTR

compiler-rt/test/fuzzer/memcmp.test

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
UNSUPPORTED: freebsd
22
RUN: %cpp_compiler %S/MemcmpTest.cpp -o %t-MemcmpTest
33
RUN: not %run %t-MemcmpTest -seed=1 -runs=10000000 2>&1 | FileCheck %s
4+
5+
RUN: %cpp_compiler -fno-sanitize=address -fno-builtin-memcmp %S/MemcmpTest.cpp -o %t-NoAsanMemcmpTest
6+
RUN: not %run %t-NoAsanMemcmpTest -seed=1 -runs=10000000 2>&1 | FileCheck %s
7+
8+
RUN: %cpp_compiler -fno-sanitize=address -fno-builtin-calloc -fno-builtin-memcmp %S/CustomAllocator.cpp %S/MemcmpTest.cpp -o %t-NoAsanCustomAllocatorMemcmpTest
9+
RUN: not %run %t-NoAsanCustomAllocatorMemcmpTest -seed=1 -runs=10000000 2>&1 | FileCheck %s
10+
411
CHECK: BINGO

compiler-rt/test/fuzzer/memcmp64.test

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
UNSUPPORTED: freebsd
22
RUN: %cpp_compiler %S/Memcmp64BytesTest.cpp -o %t-Memcmp64BytesTest
33
RUN: not %run %t-Memcmp64BytesTest -seed=1 -runs=1000000 2>&1 | FileCheck %s
4+
5+
RUN: %cpp_compiler -fno-sanitize=address -fno-builtin-memcmp %S/Memcmp64BytesTest.cpp -o %t-NoAsanMemcmp64BytesTest
6+
RUN: not %run %t-NoAsanMemcmp64BytesTest -seed=1 -runs=1000000 2>&1 | FileCheck %s
7+
48
CHECK: BINGO

compiler-rt/test/fuzzer/strcmp.test

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
UNSUPPORTED: freebsd
22
RUN: %cpp_compiler %S/StrcmpTest.cpp -o %t-StrcmpTest
33
RUN: not %run %t-StrcmpTest -seed=1 -runs=2000000 2>&1 | FileCheck %s
4-
CHECK: BINGO
54

5+
RUN: %cpp_compiler -fno-sanitize=address -fno-builtin-strcmp %S/StrcmpTest.cpp -o %t-NoAsanStrcmpTest
6+
RUN: not %run %t-NoAsanStrcmpTest -seed=1 -runs=2000000 2>&1 | FileCheck %s
7+
8+
RUN: %cpp_compiler -fno-sanitize=address -fno-builtin-calloc -fno-builtin-strcmp %S/CustomAllocator.cpp %S/StrcmpTest.cpp -o %t-NoAsanCustomAllocatorStrcmpTest
9+
RUN: not %run %t-NoAsanCustomAllocatorStrcmpTest -seed=1 -runs=2000000 2>&1 | FileCheck %s
10+
11+
CHECK: BINGO

compiler-rt/test/fuzzer/strncmp.test

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
UNSUPPORTED: freebsd
22
RUN: %cpp_compiler %S/StrncmpTest.cpp -o %t-StrncmpTest
33
RUN: not %run %t-StrncmpTest -seed=2 -runs=10000000 2>&1 | FileCheck %s
4-
CHECK: BINGO
54

5+
RUN: %cpp_compiler -fno-sanitize=address -fno-builtin-strncmp %S/StrncmpTest.cpp -o %t-NoAsanStrncmpTest
6+
RUN: not %run %t-NoAsanStrncmpTest -seed=2 -runs=10000000 2>&1 | FileCheck %s
7+
8+
RUN: %cpp_compiler -fno-sanitize=address -fno-builtin-calloc -fno-builtin-strncmp %S/CustomAllocator.cpp %S/StrncmpTest.cpp -o %t-NoAsanCustomAllocatorStrncmpTest
9+
RUN: not %run %t-NoAsanCustomAllocatorStrncmpTest -seed=2 -runs=10000000 2>&1 | FileCheck %s
10+
11+
CHECK: BINGO

0 commit comments

Comments
 (0)