No public description PiperOrigin-RevId: 959258384
diff --git a/.github/workflows/bazel_test_centipede.yml b/.github/workflows/bazel_test_centipede.yml index 1bbcba0..bedfddf 100644 --- a/.github/workflows/bazel_test_centipede.yml +++ b/.github/workflows/bazel_test_centipede.yml
@@ -30,6 +30,8 @@ # TODO(xinhaoyuan): Bump to 24.04 after https://github.com/llvm/llvm-project/issues/102443 # is fixed. runs-on: ubuntu-22.04 + permissions: + contents: read timeout-minutes: 60 strategy: matrix: @@ -39,13 +41,13 @@ run: | sudo sysctl -w kernel.core_pattern="" - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install dependencies run: | sudo apt-get update && sudo apt-get install -yq \ clang llvm libssl-dev - name: Restore latest cache - uses: actions/cache/restore@v4 + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: "~/.cache/bazel" key: bazel-centipede-cache-${{ matrix.config }} @@ -84,19 +86,21 @@ bazel test --no//fuzztest:use_riegeli --test_output=errors --linkopt=-fsanitize=address --copt=-fsanitize=address --test_env=ASAN_OPTIONS=detect_leaks=0 --platform_suffix=asan --test_timeout=600 centipede/puzzles:all - name: Save new cache based on main if: github.ref == 'refs/heads/main' - uses: actions/cache/save@v4 + uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: "~/.cache/bazel" key: bazel-centipede-cache-${{ matrix.config }}-${{ github.run_id }} run_tests_mac: name: Run Centipede tests (MacOS) runs-on: macos-15 + permissions: + contents: read timeout-minutes: 60 steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Restore latest cache - uses: actions/cache/restore@v4 + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: "~/.cache/bazel" key: bazel-centipede-cache-mac @@ -127,7 +131,37 @@ bazel --output_user_root="${HOME}/.cache/bazel" test --test_output=errors --no//fuzztest:use_riegeli --linkopt=-fsanitize=address --copt=-fsanitize=address --test_env=ASAN_OPTIONS=detect_leaks=0 --platform_suffix=asan --test_timeout=600 centipede/puzzles:all - name: Save new cache based on main if: github.ref == 'refs/heads/main' - uses: actions/cache/save@v4 + uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 with: path: "~/.cache/bazel" key: bazel-centipede-cache-mac-${{ github.run_id }} + run_tests_win: + name: Run Centipede tests (Windows) + runs-on: windows-latest + permissions: + contents: read + timeout-minutes: 60 + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Restore latest cache + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + with: + path: "~/.cache/bazel" + key: bazel-centipede-cache-win-${{ matrix.config }} + restore-keys: bazel-centipede-cache-win-${{ matrix.config }}- + - name: Set environment variable + run: echo "USE_BAZEL_VERSION=8.7.0" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append + - name: Run unit tests + if: ${{ !cancelled() }} + run: | + <# Only supported libraries are tested here. #> ` + bazelisk test --disk_cache=~/.cache/bazel --local_test_jobs=1 --test_output=errors --no//fuzztest:use_riegeli ` + --extra_toolchains=@local_config_cc//:cc-toolchain-x64_windows-clang-cl ` + --extra_execution_platforms=//:x64_windows-clang-cl -- centipede:util_test + - name: Save new cache based on main + # if: github.ref == 'refs/heads/main' + uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 + with: + path: "~/.cache/bazel" + key: bazel-centipede-cache-win-${{ github.run_id }}
diff --git a/BUILD b/BUILD new file mode 100644 index 0000000..4f91cb3 --- /dev/null +++ b/BUILD
@@ -0,0 +1,8 @@ +platform( + name = "x64_windows-clang-cl", + constraint_values = [ + "@platforms//cpu:x86_64", + "@platforms//os:windows", + "@bazel_tools//tools/cpp:clang-cl", + ], +)
diff --git a/MODULE.bazel b/MODULE.bazel index 4610482..741fdab 100644 --- a/MODULE.bazel +++ b/MODULE.bazel
@@ -23,6 +23,10 @@ name = "rules_cc", version = "0.2.17", ) + +cc_configure = use_extension("@rules_cc//cc:extensions.bzl", "cc_configure_extension") +use_repo(cc_configure, "local_config_cc") + bazel_dep( name = "rules_shell", version = "0.6.1",
diff --git a/centipede/BUILD b/centipede/BUILD index 3ad6fae..fecc235 100644 --- a/centipede/BUILD +++ b/centipede/BUILD
@@ -1413,7 +1413,12 @@ cc_test( name = "util_test", srcs = ["util_test.cc"], - copts = ["-fno-signed-char"], + copts = select({ + "@platforms//os:windows": [ + "/J", + ], + "//conditions:default": ["-fno-signed-char"], + }), deps = [ ":feature", ":thread_pool",
diff --git a/centipede/puzzles/BUILD b/centipede/puzzles/BUILD index b87aad0..3d83aef 100644 --- a/centipede/puzzles/BUILD +++ b/centipede/puzzles/BUILD
@@ -26,7 +26,6 @@ package(default_visibility = ["@com_google_fuzztest//centipede/puzzles:__subpackages__"]) -# The puzzles use a simple configuration language, see run_puzzle.sh. [puzzle(name = n) for n in [ "byte_cmp_4", "callstack",
diff --git a/centipede/puzzles/autodictionary_stress.cc b/centipede/puzzles/autodictionary_stress.cc index 297d5ee..40a415d 100644 --- a/centipede/puzzles/autodictionary_stress.cc +++ b/centipede/puzzles/autodictionary_stress.cc
@@ -12,9 +12,10 @@ // See the License for the specific language governing permissions and // limitations under the License. -// Centipede puzzle: stress test for --use_auto_dictionary=1. -// RUN: Run --use_auto_dictionary=1 --use_cmp_features=0 -j 5 -// RUN: ExpectInLog "Input bytes.*: abcdxyzVeryLongStringKeyword" +// CASE main: ARG: --use_auto_dictionary=1 +// CASE main: ARG: --use_cmp_features=0 +// CASE main: ARG: --j=5 +// CASE main: MATCH: Input bytes.*: abcdxyzVeryLongStringKeyword // TODO(kcc): we currently use --use_cmp_features=0 because otherwise // the corpus gets too large and the puzzle does not get solved quickly.
diff --git a/centipede/puzzles/byte_cmp_4.cc b/centipede/puzzles/byte_cmp_4.cc index 8fb9c4c..9bdcf96 100644 --- a/centipede/puzzles/byte_cmp_4.cc +++ b/centipede/puzzles/byte_cmp_4.cc
@@ -13,7 +13,7 @@ // limitations under the License. // Centipede puzzle: sequence of 4 1-byte comparisons. -// RUN: Run && SolutionIs fuzZ +// CASE main: MATCH: Input bytes *: fuzZ #include <cstddef> #include <cstdint> #include <cstdlib>
diff --git a/centipede/puzzles/callstack.cc b/centipede/puzzles/callstack.cc index 4fc9a8b..7fd1601 100644 --- a/centipede/puzzles/callstack.cc +++ b/centipede/puzzles/callstack.cc
@@ -18,10 +18,10 @@ // All functions but F0 also modify `g_result`. // The puzzle can be solved if the call sequence is FA->FB->FC->FD->FE. -// clang-format off -// RUN: Run --callstack_level=10 --use_cmp_features=0 --use_dataflow_features=0 // NOLINT -// RUN: SolutionIs ABCDE -// clang-format on +// CASE main: ARG: --callstack_level=10 +// CASE main: ARG: --use_cmp_features=0 +// CASE main: ARG: --use_dataflow_features=0 +// CASE main: MATCH: Input bytes *: ABCDE #include <cstddef> #include <cstdint> #include <cstdlib>
diff --git a/centipede/puzzles/deep_recursion.cc b/centipede/puzzles/deep_recursion.cc index 6e7572d..9440cbd 100644 --- a/centipede/puzzles/deep_recursion.cc +++ b/centipede/puzzles/deep_recursion.cc
@@ -13,11 +13,11 @@ // limitations under the License. // Centipede puzzle: use callstack features to reach deep recursion -// clang-format off -// RUN: Run --callstack_level=10 --use_cmp_features=0 --max_len=10 --num_runs=10000000 # NOLINT -// RUN: SolutionIs ABCDEF -// clang-format on -#include <sys/resource.h> +// CASE main: ARG: --callstack_level=10 +// CASE main: ARG: --use_cmp_features=0 +// CASE main: ARG: --max_len=10 +// CASE main: ARG: --num_runs=10000000 +// CASE main: MATCH: Input bytes *: ABCDEF #include <cstddef> #include <cstdint>
diff --git a/centipede/puzzles/independent_compares.cc b/centipede/puzzles/independent_compares.cc index 07294f9..0679482 100644 --- a/centipede/puzzles/independent_compares.cc +++ b/centipede/puzzles/independent_compares.cc
@@ -13,7 +13,7 @@ // limitations under the License. // Centipede puzzle: 4 independent compares setting a mask. -// RUN: Run && SolutionIs FUZZ +// CASE main: MATCH: Input bytes *: FUZZ #include <cstddef> #include <cstdint> #include <cstdlib>
diff --git a/centipede/puzzles/memcmp_3.cc b/centipede/puzzles/memcmp_3.cc index 36244e3..c12ffe0 100644 --- a/centipede/puzzles/memcmp_3.cc +++ b/centipede/puzzles/memcmp_3.cc
@@ -14,9 +14,10 @@ // Centipede puzzle: one 3-byte memcmp. Check the output in the log. // Disable use_auto_dictionary so that we test other functionality. -// RUN: Run --use_auto_dictionary=false && SolutionIs fUz -// RUN: ExpectInLog "TEXT IN STDOUT" -// RUN: ExpectInLog "TEXT IN STDERR" +// CASE main: ARG: --use_auto_dictionary=false +// CASE main: MATCH: Input bytes *: fUz +// CASE main: MATCH: TEXT IN STDOUT +// CASE main: MATCH: TEXT IN STDERR #include <cstdint> #include <cstdio>
diff --git a/centipede/puzzles/memcmp_4.cc b/centipede/puzzles/memcmp_4.cc index 97bbbd5..deefe4a 100644 --- a/centipede/puzzles/memcmp_4.cc +++ b/centipede/puzzles/memcmp_4.cc
@@ -14,7 +14,9 @@ // Centipede puzzle: one 4-byte memcmp. // Disable use_auto_dictionary so that we test other functionality. -// RUN: Run --use_auto_dictionary=false --max_len=10 && SolutionIs fuZz +// CASE main: ARG: --use_auto_dictionary=false +// CASE main: ARG: --max_len=10 +// CASE main: MATCH: Input bytes *: fuZz #include <cstdint> #include <cstdlib>
diff --git a/centipede/puzzles/memcmp_4_may_inline.cc b/centipede/puzzles/memcmp_4_may_inline.cc index bc2f062..746796d 100644 --- a/centipede/puzzles/memcmp_4_may_inline.cc +++ b/centipede/puzzles/memcmp_4_may_inline.cc
@@ -14,7 +14,8 @@ // Centipede puzzle: one 4-byte memcmp, which may get inlined. // Disable use_auto_dictionary so that we test other functionality. -// RUN: Run --use_auto_dictionary=false && SolutionIs FUZz +// CASE main: ARG: --use_auto_dictionary=false +// CASE main: MATCH: Input bytes *: FUZz #include <cstdint> #include <cstdlib>
diff --git a/centipede/puzzles/oom.cc b/centipede/puzzles/oom.cc index bb20e5d..07270d2 100644 --- a/centipede/puzzles/oom.cc +++ b/centipede/puzzles/oom.cc
@@ -13,7 +13,9 @@ // limitations under the License. // Centipede puzzle: easy-to-reach OOM. -// RUN: Run --rss_limit_mb=1000 && SolutionIs OOM && ExpectOOM +// CASE main: ARG: --rss_limit_mb=1000 +// CASE main: MATCH: Input bytes *: OOM +// CASE main: MATCH: Failure.*: rss-limit-exceeded #include <cstddef> #include <cstdint> #include <cstdio>
diff --git a/centipede/puzzles/paths.cc b/centipede/puzzles/paths.cc index ab8de1a..654300b 100644 --- a/centipede/puzzles/paths.cc +++ b/centipede/puzzles/paths.cc
@@ -16,8 +16,10 @@ // We disable use_dataflow_features because on this puzzle // it is also effective. -// RUN: Run --use_dataflow_features=0 --use_cmp_features=0 --path_level=10 -// RUN: ExpectInLog "Input bytes.*: .x1.x2.x3" +// CASE main: ARG: --use_dataflow_features=0 +// CASE main: ARG: --use_cmp_features=0 +// CASE main: ARG: --path_level=10 +// CASE main: MATCH: Input bytes.*: .x1.x2.x3 // This puzzle aborts on input "\x1\x2\x3" // The code here has very little control flow, but an exponential number of
diff --git a/centipede/puzzles/per_batch_timeout.cc b/centipede/puzzles/per_batch_timeout.cc index f64f009..9b2e506 100644 --- a/centipede/puzzles/per_batch_timeout.cc +++ b/centipede/puzzles/per_batch_timeout.cc
@@ -13,10 +13,10 @@ // limitations under the License. // Centipede puzzle: easy-to-reach per-batch timeout. -// clang-format off -// NOLINTNEXTLINE -// RUN: Run --batch_size=10 --timeout_per_input=2 --timeout_per_batch=7 && ExpectPerBatchTimeout -// clang-format on +// CASE main: ARG: --batch_size=10 +// CASE main: ARG: --timeout_per_input=2 +// CASE main: ARG: --timeout_per_batch=7 +// CASE main: MATCH: Failure.*: per-batch-timeout-exceeded #include <unistd.h>
diff --git a/centipede/puzzles/per_input_timeout.cc b/centipede/puzzles/per_input_timeout.cc index d286543..3f2e4e3 100644 --- a/centipede/puzzles/per_input_timeout.cc +++ b/centipede/puzzles/per_input_timeout.cc
@@ -12,8 +12,9 @@ // See the License for the specific language governing permissions and // limitations under the License. -// Centipede puzzle: easy-to-reach per-input timeout. -// RUN: Run --timeout_per_input=2 && SolutionIs SLO && ExpectPerInputTimeout +// CASE main: ARG: --timeout_per_input=2 +// CASE main: MATCH: Input bytes *: SLO +// CASE main: MATCH: Failure.*: per-input-timeout-exceeded #include <unistd.h>
diff --git a/centipede/puzzles/pthread_exit_uint32_cmp_1.cc b/centipede/puzzles/pthread_exit_uint32_cmp_1.cc index 1e5bade..f132c08 100644 --- a/centipede/puzzles/pthread_exit_uint32_cmp_1.cc +++ b/centipede/puzzles/pthread_exit_uint32_cmp_1.cc
@@ -15,10 +15,11 @@ // Centipede puzzle: one 4-byte cmp, in a separate thread using pthread // interface. We should be able to solve it w/o cmp features *or* w/o auto // dictionary. -// -// RUN: Run && SolutionIs Fuzz -// RUN: Run --use_auto_dictionary=0 && SolutionIs Fuzz -// RUN: Run --use_cmp_features=0 && SolutionIs Fuzz +// CASE main: MATCH: Input bytes *: Fuzz +// CASE no_cmp: ARG: --use_cmp_features=0 +// CASE no_cmp: MATCH: Input bytes *: Fuzz +// CASE no_autodict: ARG: --use_auto_dictionary=0 +// CASE no_autodict: MATCH: Input bytes *: Fuzz #include <pthread.h>
diff --git a/centipede/puzzles/puzzle.bzl b/centipede/puzzles/puzzle.bzl index a446b96..91189ff 100644 --- a/centipede/puzzles/puzzle.bzl +++ b/centipede/puzzles/puzzle.bzl
@@ -14,7 +14,7 @@ """BUILD rule for Centipede puzzles""" -load("@rules_shell//shell:sh_test.bzl", "sh_test") +load("@rules_cc//cc:cc_test.bzl", "cc_test") load("@com_google_fuzztest//centipede/testing:build_defs.bzl", "centipede_fuzz_target") def puzzle(name): @@ -36,13 +36,23 @@ # repeatability. Each sh_test performs a single run with a single seed, so # that the log is minimal. for seed in ["1", "2"]: - sh_test( + cc_test( name = "run_" + seed + "_" + name, - srcs = ["run_puzzle.sh"], + srcs = ["run_puzzle.cc"], + args = ["--seed=" + seed, "--puzzle=" + name], data = [ ":" + name, name + ".cc", "@com_google_fuzztest//centipede:centipede_uninstrumented", - "@com_google_fuzztest//centipede:test_util_sh", + ], + deps = [ + "@googletest//:gtest", + "@abseil-cpp//absl/flags:flag", + "@abseil-cpp//absl/flags:parse", + "@abseil-cpp//absl/strings", + "@abseil-cpp//absl/time", + "@com_google_fuzztest//centipede:command", + "@com_google_fuzztest//common:logging", + "@com_google_fuzztest//common:test_util", ], )
diff --git a/centipede/puzzles/run_puzzle.cc b/centipede/puzzles/run_puzzle.cc new file mode 100644 index 0000000..939675a --- /dev/null +++ b/centipede/puzzles/run_puzzle.cc
@@ -0,0 +1,179 @@ +// Copyright 2026 The FuzzTest Authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include <filesystem> // NOLINT +#include <fstream> +#include <set> +#include <sstream> +#include <string> +#include <string_view> +#include <system_error> // NOLINT +#include <utility> +#include <vector> + +#include "gmock/gmock.h" +#include "gtest/gtest.h" +#include "absl/flags/flag.h" +#include "absl/flags/parse.h" +#include "absl/strings/str_cat.h" +#include "absl/strings/str_split.h" +#include "absl/time/time.h" +#include "./centipede/command.h" +#include "./common/logging.h" +#include "./common/test_util.h" + +ABSL_FLAG(int, seed, 0, "The random seed to use"); +ABSL_FLAG(std::string, puzzle, "", "The name of the puzzle to run"); + +namespace fuzztest::internal { +namespace { + +using testing::ContainsRegex; +using testing::Value; + +std::string ReadFile(std::filesystem::path path) { + std::ifstream file(path); + std::stringstream ss; + ss << file.rdbuf(); + return ss.str(); +} + +constexpr std::string_view kCasePrefix = "// CASE "; +constexpr std::string_view kArgPrefix = "ARG:"; +constexpr std::string_view kMatchPrefix = "MATCH:"; + +std::vector<std::string> GetCasesInPuzzle(std::string_view puzzle) { + const std::string puzzle_source_path = + GetDataDependencyFilepath( + absl::StrCat("centipede/puzzles/", puzzle, ".cc")) + .string(); + std::error_code ec; + FUZZTEST_CHECK(std::filesystem::exists(puzzle_source_path, ec)) + << "Puzzle source " << puzzle_source_path << " does not exist"; + const std::string puzzle_source = ReadFile(puzzle_source_path); + std::set<std::string> found_cases; + for (std::string_view line : absl::StrSplit(puzzle_source, '\n')) { + const auto case_start_pos = line.find(kCasePrefix); + if (case_start_pos == line.npos) continue; + const auto case_end_pos = + line.find(":", case_start_pos + kCasePrefix.size()); + if (case_end_pos == line.npos) continue; + if (line.find(kMatchPrefix, case_end_pos) == line.npos) continue; + found_cases.insert(std::string{ + line.substr(case_start_pos + kCasePrefix.size(), + case_end_pos - case_start_pos - kCasePrefix.size())}); + } + return {found_cases.begin(), found_cases.end()}; +} + +class PuzzleTest : public testing::Test { + public: + PuzzleTest(std::string_view puzzle, std::string_view case_name) + : puzzle_{puzzle}, case_name_{case_name} {} + + void TestBody() { + const std::string centipede_path = + GetDataDependencyFilepath("centipede/centipede_uninstrumented") + .string(); + const std::string puzzle_binary_path = + GetDataDependencyFilepath(absl::StrCat("centipede/puzzles/", puzzle_)) + .string(); + const std::string puzzle_source_path = + GetDataDependencyFilepath( + absl::StrCat("centipede/puzzles/", puzzle_, ".cc")) + .string(); + std::error_code ec; + FUZZTEST_CHECK(std::filesystem::exists(puzzle_binary_path, ec)) + << "Puzzle binary " << puzzle_binary_path << " does not exist"; + FUZZTEST_CHECK(std::filesystem::exists(puzzle_source_path, ec)) + << "Puzzle source " << puzzle_source_path << " does not exist"; + TempDir tmp_dir{absl::StrCat(puzzle_, "_", case_name_)}; + + const std::string case_prefix = absl::StrCat(kCasePrefix, case_name_, ":"); + std::vector<std::string> extra_args; + std::vector<std::string> output_matches; + const std::string puzzle_source = ReadFile(puzzle_source_path); + for (std::string_view line : absl::StrSplit(puzzle_source, '\n')) { + const auto case_pos = line.find(case_prefix); + if (case_pos == line.npos) continue; + if (const auto arg_pos = + line.find(kArgPrefix, case_pos + case_prefix.size()); + arg_pos != line.npos) { + auto arg = std::string{absl::StripAsciiWhitespace( + line.substr(arg_pos + kArgPrefix.size()))}; + FUZZTEST_LOG(INFO) << "Using arg: " << arg; + extra_args.push_back(std::move(arg)); + continue; + } + if (const auto output_match_pos = + line.find(kMatchPrefix, case_pos + case_prefix.size()); + output_match_pos != line.npos) { + auto output_match = std::string{absl::StripAsciiWhitespace( + line.substr(output_match_pos + kMatchPrefix.size()))}; + FUZZTEST_LOG(INFO) << "Using match: " << output_match; + output_matches.push_back(std::move(output_match)); + continue; + } + } + FUZZTEST_CHECK(!output_matches.empty()) + << "Need at least one output match for case " << case_name_; + + Command::Options cmd_options; + cmd_options.args = { + absl::StrCat("--workdir=", (tmp_dir.path() / "workdir").string()), + absl::StrCat("--binary=", puzzle_binary_path), + "--populate_binary_info=0", + absl::StrCat("--seed=", absl::GetFlag(FLAGS_seed)), + "--num_runs=2000000", + "--shmem_size_mb=100", + "--exit_on_crash", + }; + cmd_options.args.insert(cmd_options.args.end(), extra_args.begin(), + extra_args.end()); + + const std::string output_prefix = (tmp_dir.path() / "out_").string(); + cmd_options.stdout_file_prefix = output_prefix; + cmd_options.stderr_file_prefix = output_prefix; + Command cmd(centipede_path, cmd_options); + FUZZTEST_CHECK(cmd.ExecuteAsync()); + (void)cmd.Wait(absl::Now() + absl::Seconds(30)); + const std::string output = ReadFile(cmd.stdout_file()); + for (const auto& output_match : output_matches) { + EXPECT_TRUE(Value(output, ContainsRegex(output_match))) << output; + } + } + + private: + std::string puzzle_; + std::string case_name_; +}; + +} // namespace +} // namespace fuzztest::internal + +int main(int argc, char** argv) { + absl::ParseCommandLine(argc, argv); + testing::InitGoogleTest(&argc, argv); + const std::string puzzle = absl::GetFlag(FLAGS_puzzle); + FUZZTEST_CHECK(!puzzle.empty()); + const auto cases = fuzztest::internal::GetCasesInPuzzle(puzzle); + for (const auto& case_name : cases) { + testing::RegisterTest( + "Puzzle", case_name.c_str(), nullptr, nullptr, __FILE__, __LINE__, + [puzzle, case_name]() -> testing::Test* { + return new fuzztest::internal::PuzzleTest{puzzle, case_name}; + }); + } + return RUN_ALL_TESTS(); +}
diff --git a/centipede/puzzles/run_puzzle.sh b/centipede/puzzles/run_puzzle.sh deleted file mode 100755 index d6d12c8..0000000 --- a/centipede/puzzles/run_puzzle.sh +++ /dev/null
@@ -1,122 +0,0 @@ -#!/bin/bash - -# Copyright 2022 The Centipede Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Run a short fuzzing session for one puzzle and check the outcome. -# This script is executed under the name run_S_PUZZLE_NAME, where S is a single -# digit representing the seed, so we get the seed and puzzle name from $0. -# Every puzzle must have one or more lines containing "RUN:<program-text>" -# This script will execute <program-text> directly in the current context. -# <program-text> can use the functions defined in this file, see USER_FUNCTIONS. - -set -eu -o pipefail - -ls -la "$(dirname "$0")" - -source "$(dirname "$0")/../test_util.sh" - -readonly centipede_dir="$(fuzztest::internal::get_centipede_test_srcdir)" -fuzztest::internal::maybe_set_var_to_executable_path centipede "${centipede_dir}/centipede_uninstrumented" -readonly centipede -fuzztest::internal::maybe_set_var_to_executable_path llvm_symbolizer "$(fuzztest::internal::get_llvm_symbolizer_path)" -readonly llvm_symbolizer -fuzztest::internal::maybe_set_var_to_executable_path objdump "$(fuzztest::internal::get_objdump_path)" -readonly objdump - -readonly target_name="$(basename "$0")" -readonly seed_and_puzzle_name="${target_name#run_}" -readonly seed="${seed_and_puzzle_name:0:1}" -readonly puzzle_name="${seed_and_puzzle_name:2}" -readonly puzzle_source_name="${puzzle_name}.cc" -readonly puzzle_path="${centipede_dir}/puzzles/${puzzle_name}" -readonly puzzle_source_path="${centipede_dir}/puzzles/${puzzle_source_name}" - -readonly workdir="${TEST_TMPDIR}/workdir" -readonly log="${TEST_TMPDIR}/log" -readonly script="${TEST_TMPDIR}/script" - -# Read the configuration from the puzzle source. -grep 'RUN:' "${puzzle_source_path}" | sed 's/^.*RUN://' > "${script}" -echo "======== SCRIPT" -cat "${script}" -echo "======== END SCRIPT" - -##################################### USER_FUNCTIONS - -# Runs Centipede with additional parameters in $@, saves the result in log, cats -# the log. Expects Centipede to exit with failure. -function Run() { - echo "======== Run $*" - rm -rf "${workdir}" - mkdir "${workdir}" - if "${centipede}" \ - --workdir "${workdir}" \ - --binary "${puzzle_path}" \ - --symbolizer_path="${llvm_symbolizer}" \ - --objdump_path="${objdump}$" \ - --seed="${seed}" \ - --num_runs=2000000 \ - --timeout_per_input=10 \ - --exit_on_crash \ - "$@" \ - 2>&1 | tee "${log}" - then - # Centipede must exit with failure. - return 1 - fi -} - -# Checks that $1 is the solution for the puzzle. -function SolutionIs() { - echo "====== ${FUNCNAME[0]}: $1" - fuzztest::internal::assert_regex_in_file "Input bytes.*: $1" "${log}" -} - -# Expects that Centipede found a per-input timeout. -function ExpectPerInputTimeout() { - echo "======= ${FUNCNAME[0]}" - fuzztest::internal::assert_regex_in_file "Per-input timeout exceeded" "${log}" - fuzztest::internal::assert_regex_in_file "Failure.*: per-input-timeout-exceeded" "${log}" -} - -# Expects that Centipede found a per-batch timeout. -function ExpectPerBatchTimeout() { - echo "======= ${FUNCNAME[0]}" - fuzztest::internal::assert_regex_in_file "Failure.*: per-batch-timeout-exceeded" "${log}" - fuzztest::internal::assert_regex_in_file \ - "Failure applies to entire batch: not executing inputs one-by-one" "${log}" - fuzztest::internal::assert_regex_not_in_file \ - "Executing inputs one-by-one, trying to find the reproducer" "${log}" -} - -# Expects that Centipede found a OOM. -function ExpectOOM() { - echo "======= ${FUNCNAME[0]}" - fuzztest::internal::assert_regex_in_file "RSS limit exceeded" "${log}" - fuzztest::internal::assert_regex_in_file "Failure.*: rss-limit-exceeded" "${log}" -} - -# Expects that $1 is found in the log. -function ExpectInLog() { - echo "======= ${FUNCNAME[0]}: $1" - fuzztest::internal::assert_regex_in_file "$1" "${log}" -} - -##################################### end USER_FUNCTIONS - -# shellcheck disable=SC1090 -source "${script}" - -echo PASS
diff --git a/centipede/puzzles/strcasecmp.cc b/centipede/puzzles/strcasecmp.cc index c9aaadd..670a9f5 100644 --- a/centipede/puzzles/strcasecmp.cc +++ b/centipede/puzzles/strcasecmp.cc
@@ -15,9 +15,10 @@ // Centipede puzzle: one 3-byte strncasecmp and one 3-byte strcasecmp. Check // the output in the log. Disable use_auto_dictionary so that we test other // functionality. -// RUN: Run --use_auto_dictionary=false && SolutionIs 123456 -// RUN: ExpectInLog "TEXT IN STDOUT" -// RUN: ExpectInLog "TEXT IN STDERR" +// CASE main: ARG: --use_auto_dictionary=false +// CASE main: MATCH: Input bytes *: 123456 +// CASE main: MATCH: TEXT IN STDOUT +// CASE main: MATCH: TEXT IN STDERR #include <strings.h>
diff --git a/centipede/puzzles/strcmp.cc b/centipede/puzzles/strcmp.cc index c61bb17..338d338 100644 --- a/centipede/puzzles/strcmp.cc +++ b/centipede/puzzles/strcmp.cc
@@ -14,9 +14,10 @@ // Centipede puzzle: one 4-byte strcmp. Check the output in the log. // Disable use_auto_dictionary so that we test other functionality. -// RUN: Run --use_auto_dictionary=false && SolutionIs fUzZ -// RUN: ExpectInLog "TEXT IN STDOUT" -// RUN: ExpectInLog "TEXT IN STDERR" +// CASE main: ARG: --use_auto_dictionary=false +// CASE main: MATCH: Input bytes *: fUzZ +// CASE main: MATCH: TEXT IN STDOUT +// CASE main: MATCH: TEXT IN STDERR #include <cstdint> #include <cstdio>
diff --git a/centipede/puzzles/strncmp.cc b/centipede/puzzles/strncmp.cc index 4668e11..74f622d 100644 --- a/centipede/puzzles/strncmp.cc +++ b/centipede/puzzles/strncmp.cc
@@ -14,9 +14,10 @@ // Centipede puzzle: one 4-byte strncmp. Check the output in the log. // Disable use_auto_dictionary so that we test other functionality. -// RUN: Run --use_auto_dictionary=false && SolutionIs fUzZ -// RUN: ExpectInLog "TEXT IN STDOUT" -// RUN: ExpectInLog "TEXT IN STDERR" +// CASE main: ARG: --use_auto_dictionary=false +// CASE main: MATCH: Input bytes *: fUzZ +// CASE main: MATCH: TEXT IN STDOUT +// CASE main: MATCH: TEXT IN STDERR #include <cstdint> #include <cstdio>
diff --git a/centipede/puzzles/switch.cc b/centipede/puzzles/switch.cc index 40a61a2..8e7f09e 100644 --- a/centipede/puzzles/switch.cc +++ b/centipede/puzzles/switch.cc
@@ -13,7 +13,9 @@ // limitations under the License. // Centipede puzzle: one 4-byte switch. -// RUN: Run --max_len=10 --use_cmp_features=0 && ExpectInLog "deadbeef found!" +// CASE main: ARG: --max_len=10 +// CASE main: ARG: --use_cmp_features=0 +// CASE main: MATCH: deadbeef found! #include <cstdint> #include <cstdio>
diff --git a/centipede/puzzles/thread_uint32_cmp_1.cc b/centipede/puzzles/thread_uint32_cmp_1.cc index 0665815..962fe3e 100644 --- a/centipede/puzzles/thread_uint32_cmp_1.cc +++ b/centipede/puzzles/thread_uint32_cmp_1.cc
@@ -14,9 +14,11 @@ // Centipede puzzle: one 4-byte cmp, in a separate thread. // We should be able to solve it w/o cmp features *or* w/o auto dictionary. -// RUN: Run && SolutionIs Fuzz -// RUN: Run --use_auto_dictionary=0 && SolutionIs Fuzz -// RUN: Run --use_cmp_features=0 && SolutionIs Fuzz +// CASE main: MATCH: Input bytes *: Fuzz +// CASE no_cmp: ARG: --use_cmp_features=0 +// CASE no_cmp: MATCH: Input bytes *: Fuzz +// CASE no_autodict: ARG: --use_auto_dictionary=0 +// CASE no_autodict: MATCH: Input bytes *: Fuzz #include <cstdint> #include <cstdlib>
diff --git a/centipede/puzzles/uint32_cmp_1.cc b/centipede/puzzles/uint32_cmp_1.cc index f41879b..3b4df01 100644 --- a/centipede/puzzles/uint32_cmp_1.cc +++ b/centipede/puzzles/uint32_cmp_1.cc
@@ -14,9 +14,11 @@ // Centipede puzzle: one 4-byte cmp. // We should be able to solve it w/o cmp features *or* w/o auto dictionary. -// RUN: Run && SolutionIs Fuzz -// RUN: Run --use_cmp_features=0 && SolutionIs Fuzz -// RUN: Run --use_auto_dictionary=0 && SolutionIs Fuzz +// CASE main: MATCH: Input bytes *: Fuzz +// CASE no_cmp: ARG: --use_cmp_features=0 +// CASE no_cmp: MATCH: Input bytes *: Fuzz +// CASE no_autodict: ARG: --use_auto_dictionary=0 +// CASE no_autodict: MATCH: Input bytes *: Fuzz #include <cstdint> #include <cstdlib>
diff --git a/centipede/util.cc b/centipede/util.cc index ab2eb19..748b76c 100644 --- a/centipede/util.cc +++ b/centipede/util.cc
@@ -17,8 +17,16 @@ #include "./centipede/util.h" +#if defined(_WIN32) +#define WIN32_LEAN_AND_MEAN +#define NOGDI +#include <process.h> +#include <windows.h> +#include <winsock2.h> +#else #include <sys/mman.h> #include <unistd.h> +#endif #include <algorithm> #include <cctype> @@ -47,6 +55,7 @@ #include "absl/base/const_init.h" #include "absl/base/nullability.h" #include "absl/base/thread_annotations.h" +#include "absl/strings/match.h" #include "absl/strings/str_format.h" #include "absl/strings/str_replace.h" #include "absl/strings/str_split.h" @@ -63,8 +72,13 @@ size_t GetRandomSeed(size_t seed) { if (seed != 0) return seed; +#if defined(_WIN32) + return time(nullptr) + GetCurrentProcessId() + + std::hash<std::thread::id>{}(std::this_thread::get_id()); +#else return time(nullptr) + getpid() + std::hash<std::thread::id>{}(std::this_thread::get_id()); +#endif } std::string AsPrintableString(ByteSpan data, size_t max_len) { @@ -83,7 +97,7 @@ template <typename Container> void ReadFromLocalFile(std::string_view file_path, Container &data) { - std::ifstream f(std::string{file_path}); + std::ifstream f(std::string{file_path}, std::ios::in | std::ios::binary); if (!f) return; f.seekg(0, std::ios_base::end); auto size = f.tellg(); @@ -112,12 +126,13 @@ } void ClearLocalFileContents(std::string_view file_path) { - std::ofstream f(std::string{file_path}, std::ios::out | std::ios::trunc); + std::ofstream f(std::string{file_path}, + std::ios::out | std::ios::trunc | std::ios::binary); FUZZTEST_CHECK(f) << "Failed to clear the file: " << file_path; } void WriteToLocalFile(std::string_view file_path, ByteSpan data) { - std::ofstream f(std::string{file_path}); + std::ofstream f(std::string{file_path}, std::ios::out | std::ios::binary); FUZZTEST_CHECK(f) << "Failed to open local file: " << file_path; f.write(reinterpret_cast<const char *>(data.data()), static_cast<int64_t>(data.size())); @@ -136,13 +151,15 @@ void WriteToLocalHashedFileInDir(std::string_view dir_path, ByteSpan data) { if (dir_path.empty()) return; - std::string file_path = std::filesystem::path(dir_path).append(Hash(data)); + std::string file_path = + std::filesystem::path(dir_path).append(Hash(data)).string(); WriteToLocalFile(file_path, data); } void WriteToRemoteHashedFileInDir(std::string_view dir_path, ByteSpan data) { if (dir_path.empty()) return; - std::string file_path = std::filesystem::path(dir_path).append(Hash(data)); + std::string file_path = + std::filesystem::path(dir_path).append(Hash(data)).string(); FUZZTEST_CHECK_OK( RemoteFileSetContents(file_path, std::string(data.begin(), data.end()))); } @@ -155,17 +172,24 @@ } std::string ProcessAndThreadUniqueID(std::string_view prefix) { - // operator << is the only way to serialize std::this_thread::get_id(). std::ostringstream oss; +#if defined(_WIN32) + oss << prefix << GetCurrentProcessId() << "-" << GetCurrentThreadId(); +#else + // operator << is the only way to serialize std::this_thread::get_id(). oss << prefix << getpid() << "-" << std::this_thread::get_id(); +#endif return oss.str(); } std::string TemporaryLocalDirPath() { const char *TMPDIR = getenv("TMPDIR"); + if (!TMPDIR) TMPDIR = getenv("TEMP"); + if (!TMPDIR) TMPDIR = getenv("TMP"); std::string tmp = TMPDIR ? TMPDIR : "/tmp"; - return std::filesystem::path(tmp).append( - ProcessAndThreadUniqueID("centipede-")); + return std::filesystem::path(tmp) + .append(ProcessAndThreadUniqueID("centipede-")) + .string(); } // We need to maintain a global set of dirs that CreateLocalDirRemovedAtExit() @@ -189,13 +213,15 @@ void CreateLocalDirRemovedAtExit(std::string_view path) { // Safeguard against removing dirs not created by TemporaryLocalDirPath(). - FUZZTEST_CHECK_NE(path.find("/centipede-"), std::string::npos); + FUZZTEST_CHECK(absl::StrContains(path, "/centipede-") || + absl::StrContains(path, "\\centipede-")); // Create the dir. std::error_code error; - std::filesystem::remove_all(path, error); - FUZZTEST_LOG_IF(ERROR, error) - << "Unable to clean up existing dir " << path << ": " << error.message(); - std::filesystem::create_directories(path); + std::filesystem::path p(path); + if (std::filesystem::exists(p, error)) { + std::filesystem::remove_all(p, error); + } + std::filesystem::create_directories(p, error); // Add to dirs_to_delete_at_exit. absl::MutexLock lock(dirs_to_delete_at_exit_mutex); if (!dirs_to_delete_at_exit) { @@ -206,7 +232,7 @@ } ScopedFile::ScopedFile(std::string_view dir_path, std::string_view name) - : my_path_(std::filesystem::path(dir_path) / name) {} + : my_path_((std::filesystem::path(dir_path) / name).string()) {} ScopedFile::~ScopedFile() { std::error_code error; @@ -359,16 +385,52 @@ return res; } +#if defined(_WIN32) +static LONG CALLBACK +AutoCommitPageFaultHandler(PEXCEPTION_POINTERS ExceptionInfo) { + if (ExceptionInfo->ExceptionRecord->ExceptionCode == + EXCEPTION_ACCESS_VIOLATION) { + ULONG_PTR fault_addr = + ExceptionInfo->ExceptionRecord->ExceptionInformation[1]; + if (VirtualAlloc(reinterpret_cast<void*>(fault_addr), 1, MEM_COMMIT, + PAGE_READWRITE) != nullptr) { + return EXCEPTION_CONTINUE_EXECUTION; + } + } + return EXCEPTION_CONTINUE_SEARCH; +} +#endif + uint8_t *MmapNoReserve(size_t size) { +#if defined(_WIN32) + // Set up page fault handler to commit page on demand. + static bool installed_veh = []() { + AddVectoredExceptionHandler(1, AutoCommitPageFaultHandler); + return true; + }(); + (void)installed_veh; + // MEM_RESERVE has different semantics and does not contradict with + // MAP_NORESERVE for mmap. + auto result = VirtualAlloc(nullptr, size, MEM_RESERVE, PAGE_READWRITE); + FUZZTEST_CHECK(result != nullptr) + << "VirtualAlloc failed for size " << size << " err=" << GetLastError(); + return reinterpret_cast<uint8_t*>(result); +#else auto result = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON | MAP_NORESERVE, -1, 0); FUZZTEST_CHECK(result != MAP_FAILED); return reinterpret_cast<uint8_t *>(result); +#endif } void Munmap(uint8_t *ptr, size_t size) { +#if defined(_WIN32) + BOOL result = VirtualFree(ptr, 0, MEM_RELEASE); + FUZZTEST_CHECK(result != 0); +#else auto result = munmap(ptr, size); FUZZTEST_CHECK_EQ(result, 0); +#endif } int PollTimeoutMs(absl::Duration timeout) {
diff --git a/centipede/util_test.cc b/centipede/util_test.cc index 1629f92..c5a6aae 100644 --- a/centipede/util_test.cc +++ b/centipede/util_test.cc
@@ -32,6 +32,10 @@ #include "./common/hash.h" #include "./common/logging.h" +#if defined(_WIN32) +#define setenv(n, v, _r) _putenv_s(n, v) +#endif + namespace fuzztest::internal { TEST(UtilTest, AsString) { @@ -116,7 +120,8 @@ auto temp_dir = TemporaryLocalDirPath(); // Create dir, create a file there, write to file, read from it, remove dir. std::filesystem::create_directories(temp_dir); - std::string temp_file_path = std::filesystem::path(temp_dir).append("blah"); + std::string temp_file_path = + std::filesystem::path(temp_dir).append("blah").string(); ByteArray written_data{1, 2, 3}; WriteToLocalFile(temp_file_path, written_data); ByteArray read_data; @@ -162,8 +167,8 @@ EXPECT_TRUE(std::filesystem::exists(tmpdir)); setenv("CENTIPEDE_UTIL_TEST_TEMP_DIR", tmpdir.c_str(), 1); // Create two subdirs via CreateLocalDirRemovedAtExit. - std::string subdir1 = std::filesystem::path(tmpdir).append("1"); - std::string subdir2 = std::filesystem::path(tmpdir).append("2"); + std::string subdir1 = std::filesystem::path(tmpdir).append("1").string(); + std::string subdir2 = std::filesystem::path(tmpdir).append("2").string(); CreateLocalDirRemovedAtExit(subdir1); CreateLocalDirRemovedAtExit(subdir2); EXPECT_TRUE(std::filesystem::exists(subdir1)); @@ -293,6 +298,15 @@ testing::ElementsAre(std::vector<int>{1}, std::vector<int>{3})); } +TEST(UtilTest, MmapTest) { + static constexpr size_t kBufSize = 1 << 30; // 1 GiB + auto* buf = MmapNoReserve(kBufSize); + ASSERT_NE(buf, nullptr); + EXPECT_EQ(buf[1234], 0); + EXPECT_EQ(buf[567890], 0); + Munmap(buf, kBufSize); +} + TEST(UtilTest, PollTimeoutMsWorks) { EXPECT_GT(PollTimeoutMs(absl::ZeroDuration()), 0); EXPECT_GT(PollTimeoutMs(-absl::InfiniteDuration()), 0);