Demangler fuzzer

Jakub Jelinek wrote:
> On Mon, Aug 11, 2014 at 05:04:20PM +0100, Gary Benson wrote:
> > +	case 's':
> > +	  seed = atoi (optarg);
> > +	  break;
> > +
> > +	case 't':
> > +	  timeout = atoi (optarg);
> > +	  break;
> > +
> > +	case 'm':
> > +	  maxcount = atoi (optarg);
> > +	  break;
> > +	}
> > +    }
> > +  while (optchr != -1);
> > +
> > +  if (seed == -1)
> > +    seed = time (NULL);
> > +  srand (seed);
> > +  printf ("%s: seed = %d\n", program_name, seed);
> 
> That will still make it non-reproduceable if time returns -1
> (well, as you cast time_t to int, that can be e.g. on 64-bit arches
> any time which has 0xffffffff in the low 32 bits).  So perhaps do
>   if (seed == -1)
>     {
>       seed = time (NULL);
>       if (seed == -1) seed = 0;
>     }
> or something similar?

I've added a flag, seed_set, so seed will only be set to time (NULL)
if the user has not specified a seed on the command line.

> > +  if (timeout != -1)
> > +    {
> > +      signal (SIGALRM, alarm_handler);
> > +      alarm (timeout);
> > +    }
> 

> Not sure how much portable signal/alarm is.  So probably should be
> guarded by the existence of signal.h, SIGALRM being defined etc.

I've removed the timeout code.  Users can limit the run by setting a
maximum number of iterations.  That's more consistent for testing
anyway: 5000000 iterations is 5000000 iterations wherever you run it.

How about this one?

Thanks,
Gary

On Tue, Aug 12, 2014 at 10:02:40AM +0100, Gary Benson wrote:
> I've removed the timeout code.  Users can limit the run by setting a
> maximum number of iterations.  That's more consistent for testing
> anyway: 5000000 iterations is 5000000 iterations wherever you run it.
> 
> How about this one?

LGTM, but I think it would be best to hear from Ian on this too.

Perhaps MAXLEN could be a command line option (then you'd need to allocate
the buffer dynamically?), but not sure if it is worth it.

	Jakub

Jakub Jelinek wrote:
> On Tue, Aug 12, 2014 at 10:02:40AM +0100, Gary Benson wrote:
> > I've removed the timeout code.  Users can limit the run by setting a
> > maximum number of iterations.  That's more consistent for testing
> > anyway: 5000000 iterations is 5000000 iterations wherever you run it.
> > 
> > How about this one?
> 
> LGTM, but I think it would be best to hear from Ian on this too.

Cool, I'll wait for Ian's reply.

> Perhaps MAXLEN could be a command line option (then you'd need to
> allocate the buffer dynamically?), but not sure if it is worth it.

Right now it generally crashes after a few hundred thousand iterations
(usually under five seconds).  It might be worth extending the fuzzer
once the bugs are fixed such that it runs without crashing for longer.
(I'll likely fix some of them myself in gaps between projects).

Cheers,
Gary

On Tue, Aug 12, 2014 at 2:02 AM, Gary Benson <gbenson@redhat.com> wrote:

> +#include <demangle.h>

Include demangle.h with "".

> +int
> +main (int argc, char *argv[])
> +{
> +  char symbol[2 + MAXLEN + 1] = "_Z";
> +  int seed = -1, seed_set = 0;
> +  int count = 0, maxcount = -1;

I think that by default the program should stop.  That will make it
possible to eventually run as part of "make check".  Give it some
number of iterations that stops it in a second or so.  You can still
have it run forever by using -m -1.

This is OK with those changes.

Thanks.

Ian

Ian Lance Taylor wrote:
> On Tue, Aug 12, 2014 at 2:02 AM, Gary Benson <gbenson@redhat.com> wrote:
> > +#include <demangle.h>
> 
> Include demangle.h with "".

Ok.

> > +int
> > +main (int argc, char *argv[])
> > +{
> > +  char symbol[2 + MAXLEN + 1] = "_Z";
> > +  int seed = -1, seed_set = 0;
> > +  int count = 0, maxcount = -1;
> 
> I think that by default the program should stop.  That will make it
> possible to eventually run as part of "make check".  Give it some
> number of iterations that stops it in a second or so.  You can still
> have it run forever by using -m -1.

On my machine it usually fails in 3-5 seconds, so a 1 second run seems
a little too short.  How does 10 seconds sound?

Thanks,
Gary

On Tue, Aug 12, 2014 at 10:11 AM, Gary Benson <gbenson@redhat.com> wrote:
> Ian Lance Taylor wrote:
>>
>> I think that by default the program should stop.  That will make it
>> possible to eventually run as part of "make check".  Give it some
>> number of iterations that stops it in a second or so.  You can still
>> have it run forever by using -m -1.
>
> On my machine it usually fails in 3-5 seconds, so a 1 second run seems
> a little too short.  How does 10 seconds sound?

OK, we can start with that, I suppose.

Ian