1 // Copyright 2021 Code Intelligence GmbH
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "coverage_tracker.h"
16
17 #include <jni.h>
18 #include <stdint.h>
19
20 #include <iostream>
21 #include <vector>
22
23 #include "com_code_intelligence_jazzer_runtime_CoverageMap.h"
24
25 extern "C" void __sanitizer_cov_8bit_counters_init(uint8_t *start,
26 uint8_t *end);
27 extern "C" void __sanitizer_cov_pcs_init(const uintptr_t *pcs_beg,
28 const uintptr_t *pcs_end);
29 extern "C" size_t __sanitizer_cov_get_observed_pcs(uintptr_t **pc_entries);
30
31 namespace {
AssertNoException(JNIEnv & env)32 void AssertNoException(JNIEnv &env) {
33 if (env.ExceptionCheck()) {
34 env.ExceptionDescribe();
35 std::cerr << "ERROR: Java exception occurred in CoverageTracker JNI code"
36 << std::endl;
37 _Exit(1);
38 }
39 }
40 } // namespace
41
42 namespace jazzer {
43
44 uint8_t *CoverageTracker::counters_ = nullptr;
45 PCTableEntry *CoverageTracker::pc_entries_ = nullptr;
46
Initialize(JNIEnv & env,jlong counters)47 void CoverageTracker::Initialize(JNIEnv &env, jlong counters) {
48 if (counters_ != nullptr) {
49 std::cerr << "ERROR: CoverageTracker::Initialize must not be called more "
50 "than once"
51 << std::endl;
52 _Exit(1);
53 }
54 counters_ = reinterpret_cast<uint8_t *>(static_cast<uintptr_t>(counters));
55 }
56
RegisterNewCounters(JNIEnv & env,jint old_num_counters,jint new_num_counters)57 void CoverageTracker::RegisterNewCounters(JNIEnv &env, jint old_num_counters,
58 jint new_num_counters) {
59 if (counters_ == nullptr) {
60 std::cerr
61 << "ERROR: CoverageTracker::Initialize should have been called first"
62 << std::endl;
63 _Exit(1);
64 }
65 if (new_num_counters < old_num_counters) {
66 std::cerr
67 << "ERROR: new_num_counters must not be smaller than old_num_counters"
68 << std::endl;
69 _Exit(1);
70 }
71 if (new_num_counters == old_num_counters) {
72 return;
73 }
74 std::size_t diff_num_counters = new_num_counters - old_num_counters;
75 // libFuzzer requires an array containing the instruction addresses associated
76 // with the coverage counters registered above. This is required to report how
77 // many edges have been covered. However, libFuzzer only checks these
78 // addresses when the corresponding flag is set to 1. Therefore, it is safe to
79 // set the all PC entries to any value as long as the corresponding flag is
80 // set to zero. We set the value of each PC to the index of the corresponding
81 // edge ID. This facilitates finding the edge ID of each covered PC reported
82 // by libFuzzer.
83 pc_entries_ = new PCTableEntry[diff_num_counters];
84 for (std::size_t i = 0; i < diff_num_counters; ++i) {
85 pc_entries_[i] = {i, 0};
86 }
87 __sanitizer_cov_8bit_counters_init(counters_ + old_num_counters,
88 counters_ + new_num_counters);
89 __sanitizer_cov_pcs_init((uintptr_t *)(pc_entries_),
90 (uintptr_t *)(pc_entries_ + diff_num_counters));
91 }
92 } // namespace jazzer
93
94 [[maybe_unused]] void
Java_com_code_1intelligence_jazzer_runtime_CoverageMap_initialize(JNIEnv * env,jclass,jlong counters)95 Java_com_code_1intelligence_jazzer_runtime_CoverageMap_initialize(
96 JNIEnv *env, jclass, jlong counters) {
97 ::jazzer::CoverageTracker::Initialize(*env, counters);
98 }
99
100 [[maybe_unused]] void
Java_com_code_1intelligence_jazzer_runtime_CoverageMap_registerNewCounters(JNIEnv * env,jclass,jint old_num_counters,jint new_num_counters)101 Java_com_code_1intelligence_jazzer_runtime_CoverageMap_registerNewCounters(
102 JNIEnv *env, jclass, jint old_num_counters, jint new_num_counters) {
103 ::jazzer::CoverageTracker::RegisterNewCounters(*env, old_num_counters,
104 new_num_counters);
105 }
106
107 [[maybe_unused]] jintArray
Java_com_code_1intelligence_jazzer_runtime_CoverageMap_getEverCoveredIds(JNIEnv * env,jclass)108 Java_com_code_1intelligence_jazzer_runtime_CoverageMap_getEverCoveredIds(
109 JNIEnv *env, jclass) {
110 uintptr_t *covered_pcs;
111 jint num_covered_pcs = __sanitizer_cov_get_observed_pcs(&covered_pcs);
112 std::vector<jint> covered_edge_ids(covered_pcs,
113 covered_pcs + num_covered_pcs);
114 delete[] covered_pcs;
115
116 jintArray covered_edge_ids_jni = env->NewIntArray(num_covered_pcs);
117 AssertNoException(*env);
118 env->SetIntArrayRegion(covered_edge_ids_jni, 0, num_covered_pcs,
119 covered_edge_ids.data());
120 AssertNoException(*env);
121 return covered_edge_ids_jni;
122 }
123