modfuzz.py

#!/usr/bin/env python

# To use:
# 1) Update the 'decls' list below with your fuzzing configuration.
# 2) Run with the clang binary as the command-line argument.

from __future__ importabsolute_import, division, print_function
importrandom
importsubprocess
importsys
importos

clang=sys.argv[1]
none_opts=0.3


classDecl(object):
def__init__(self, text, depends=[], provides=[], conflicts=[]):
self.text=text
self.depends=depends
self.provides=provides
self.conflicts=conflicts

defvalid(self, model):
foriinself.depends:
ifinotinmodel.decls:
returnFalse
foriinself.conflicts:
ifiinmodel.decls:
returnFalse
returnTrue

defapply(self, model, name):
foriinself.provides:
model.decls[i] =True
model.source+=self.text% {"name": name}


decls= [
Decl("struct X { int n; };\n", provides=["X"], conflicts=["X"]),
Decl('static_assert(X{.n=1}.n == 1, "");\n', depends=["X"]),
Decl("X %(name)s;\n", depends=["X"]),
]


classFS(object):
def__init__(self):
self.fs= {}
self.prevfs= {}

defwrite(self, path, contents):
self.fs[path] =contents

defdone(self):
forf, sinself.fs.items():
ifself.prevfs.get(f) !=s:
f=file(f, "w")
f.write(s)
f.close()

forfinself.prevfs:
iffnotinself.fs:
os.remove(f)

self.prevfs, self.fs=self.fs, {}


fs=FS()


classCodeModel(object):
def__init__(self):
self.source=""
self.modules= {}
self.decls= {}
self.i=0

defmake_name(self):
self.i+=1
return"n"+str(self.i)

deffails(self):
fs.write(
"module.modulemap",
"".join(
'module %s { header "%s.h" export * }\n'% (m, m)
forminself.modules.keys()
 ),
 )

form, (s, _) inself.modules.items():
fs.write("%s.h"%m, s)

fs.write("main.cc", self.source)
fs.done()

return (
subprocess.call(
 [clang, "-std=c++11", "-c", "-fmodules", "main.cc", "-o", "/dev/null"]
 )
!=0
 )


defgenerate():
model=CodeModel()
m= []

try:
fordinmutations(model):
d(model)
m.append(d)
ifnotmodel.fails():
return
exceptKeyboardInterrupt:
print()
returnTrue

sys.stdout.write("\nReducing:\n")
sys.stdout.flush()

try:
whileTrue:
assertm, "got a failure with no steps; broken clang binary?"
i=random.choice(list(range(len(m))))
x=m[0:i] +m[i+1 :]
m2=CodeModel()
fordinx:
d(m2)
ifm2.fails():
m=x
model=m2
else:
sys.stdout.write(".")
sys.stdout.flush()
exceptKeyboardInterrupt:
# FIXME: Clean out output directory first.
model.fails()
returnmodel


defchoose(options):
whileTrue:
i=int(random.uniform(0, len(options) +none_opts))
ifi>=len(options):
break
yieldoptions[i]


defmutations(model):
options= [create_module, add_top_level_decl]
foroptinchoose(options):
yieldopt(model, options)


defcreate_module(model, options):
n=model.make_name()

defgo(model):
model.modules[n] = (model.source, model.decls)
 (model.source, model.decls) = ("", {})

options+= [lambdamodel, options: add_import(model, options, n)]
returngo


defadd_top_level_decl(model, options):
n=model.make_name()
d=random.choice([declfordeclindeclsifdecl.valid(model)])

defgo(model):
ifnotd.valid(model):
return
d.apply(model, n)

returngo


defadd_import(model, options, module_name):
defgo(model):
ifmodule_nameinmodel.modules:
model.source+='#include "%s.h"\n'%module_name
model.decls.update(model.modules[module_name][1])

returngo


sys.stdout.write("Finding bug: ")
whileTrue:
ifgenerate():
break
sys.stdout.write(".")
sys.stdout.flush()