/* GCC plugin for cmplog routines instrumentation of code for AFL++. Copyright 2014-2019 Free Software Foundation, Inc Copyright 2015, 2016 Google Inc. All rights reserved. Copyright 2019-2020 AFLplusplus Project. All rights reserved. Copyright 2019-2024 AdaCore Written by Alexandre Oliva , based on the AFL++ LLVM CmpLog Routines pass by Andrea Fioraldi , and on the AFL GCC CmpLog pass. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ #include "afl-gcc-common.h" /* This plugin, being under the same license as GCC, satisfies the "GPL-compatible Software" definition in the GCC RUNTIME LIBRARY EXCEPTION, so it can be part of an "Eligible" "Compilation Process". */ int plugin_is_GPL_compatible = 1; namespace { static const struct pass_data afl_cmptrs_pass_data = { .type = GIMPLE_PASS, .name = "aflcmptrs", .optinfo_flags = OPTGROUP_NONE, .tv_id = TV_NONE, .properties_required = 0, .properties_provided = 0, .properties_destroyed = 0, .todo_flags_start = 0, .todo_flags_finish = (TODO_update_ssa | TODO_cleanup_cfg | TODO_verify_il | TODO_rebuild_cgraph_edges), }; struct afl_cmptrs_pass : afl_base_pass { afl_cmptrs_pass(bool quiet) : afl_base_pass(quiet, /*debug=*/false, afl_cmptrs_pass_data), tp8u(), cmptrs_hooks() { } /* A pointer type to a unsigned 8-bit integral type. */ tree tp8u; /* Declarations for the various cmptrs hook functions, allocated on demand.. [0] is for compares between any pointers, [1] is for compares between G++ std::string, [2] is for compares between G++ std::string and GCC C strings, [3] and [4] are analogous to [1] and [2] but for LLVM C++ strings. */ tree cmptrs_hooks[5]; tree cmptrs_hook(unsigned i) { if (!tp8u) { tree t8u; if (BITS_PER_UNIT == 8) t8u = unsigned_char_type_node; else t8u = build_nonstandard_integer_type(8, 1); tp8u = build_pointer_type(t8u); } if (i <= ARRAY_SIZE(cmptrs_hooks) && cmptrs_hooks[i]) return cmptrs_hooks[i]; const char *n = NULL; switch (i) { case 0: n = "__cmplog_rtn_hook"; break; case 1: n = "__cmplog_rtn_gcc_stdstring_stdstring"; break; case 2: n = "__cmplog_rtn_gcc_stdstring_cstring"; break; case 3: n = "__cmplog_rtn_llvm_stdstring_stdstring"; break; case 4: n = "__cmplog_rtn_llvm_stdstring_cstring"; break; default: gcc_unreachable(); } tree fnt = build_function_type_list(void_type_node, tp8u, tp8u, NULL_TREE); tree t = cmptrs_hooks[i] = build_fn_decl(n, fnt); /* Mark the newly-created decl as non-throwing, so that we can insert call within basic blocks. */ TREE_NOTHROW(t) = 1; return t; } /* Return true if T is the char* type. */ bool is_c_string(tree t) { return (POINTER_TYPE_P(t) && TYPE_MAIN_VARIANT(TREE_TYPE(t)) == char_type_node); } /* Return true if T is an indirect std::string type. The LLVM pass tests portions of the mangled name of the callee. We could do that in GCC too, but computing the mangled name may cause template instantiations and get symbols defined that could otherwise be considered unused. We check for compatible layout, and class, namespace, and field names. These have been unchanged since at least GCC 7, probably longer, up to GCC 11. Odds are that, if it were to change in significant ways, mangling would also change to flag the incompatibility, and we'd have to use a different hook anyway. */ bool is_gxx_std_string(tree t) { /* We need a pointer or reference type. */ if (!POINTER_TYPE_P(t)) return false; /* Get to the pointed-to type. */ t = TREE_TYPE(t); if (!t) return false; /* Select the main variant, so that can compare types with pointers. */ t = TYPE_MAIN_VARIANT(t); /* We expect it to be a record type. */ if (TREE_CODE(t) != RECORD_TYPE) return false; /* The type has an identifier. */ if (!TYPE_IDENTIFIER(t)) return false; /* The type of the template is basic_string. */ if (strcmp(IDENTIFIER_POINTER(TYPE_IDENTIFIER(t)), "basic_string") != 0) return false; /* It's declared in an internal namespace named __cxx11. */ tree c = DECL_CONTEXT(TYPE_NAME(t)); if (!c || TREE_CODE(c) != NAMESPACE_DECL || strcmp(IDENTIFIER_POINTER(DECL_NAME(c)), "__cxx11") != 0) return false; /* The __cxx11 namespace is a member of namespace std. */ c = DECL_CONTEXT(c); if (!c || TREE_CODE(c) != NAMESPACE_DECL || strcmp(IDENTIFIER_POINTER(DECL_NAME(c)), "std") != 0) return false; /* And the std namespace is in the global namespace. */ c = DECL_CONTEXT(c); if (c && TREE_CODE(c) != TRANSLATION_UNIT_DECL) return false; /* Check that the first nonstatic data member of the record type is named _M_dataplus. */ for (c = TYPE_FIELDS(t); c; c = DECL_CHAIN(c)) if (TREE_CODE(c) == FIELD_DECL) break; if (!c || !integer_zerop(DECL_FIELD_BIT_OFFSET(c)) || strcmp(IDENTIFIER_POINTER(DECL_NAME(c)), "_M_dataplus") != 0) return false; /* Check that the second nonstatic data member of the record type is named _M_string_length. */ tree f2; for (f2 = DECL_CHAIN(c); f2; f2 = DECL_CHAIN(f2)) if (TREE_CODE(f2) == FIELD_DECL) break; if (!f2 /* No need to check this field's offset. */ || strcmp(IDENTIFIER_POINTER(DECL_NAME(f2)), "_M_string_length") != 0) return false; /* The type of the second data member is size_t. */ if (!TREE_TYPE(f2) || TYPE_MAIN_VARIANT(TREE_TYPE(f2)) != size_type_node) return false; /* Now go back to the first data member. Its type should be a record type named _Alloc_hider. */ c = TREE_TYPE(c); if (!c || TREE_CODE(c) != RECORD_TYPE || !TYPE_IDENTIFIER(t) || strcmp(IDENTIFIER_POINTER(TYPE_IDENTIFIER(c)), "_Alloc_hider") != 0) return false; /* And its first data member is named _M_p. */ for (c = TYPE_FIELDS(c); c; c = DECL_CHAIN(c)) if (TREE_CODE(c) == FIELD_DECL) break; if (!c || !integer_zerop(DECL_FIELD_BIT_OFFSET(c)) || strcmp(IDENTIFIER_POINTER(DECL_NAME(c)), "_M_p") != 0) return false; /* For the basic_string type we're interested in, the type of the data member is the C string type. */ if (!is_c_string(TREE_TYPE(c))) return false; /* This might not be the real thing, but the bits that matter for the hook are there. */ return true; } /* ??? This is not implemented. What would the point be of recognizing LLVM's string type in GCC? */ bool is_llvm_std_string(tree t) { return false; } virtual unsigned int execute(function *fn) { if (!isInInstrumentList(fn)) return 0; basic_block bb; FOR_EACH_BB_FN(bb, fn) { for (gimple_stmt_iterator gsi = gsi_after_labels(bb); !gsi_end_p(gsi); gsi_next(&gsi)) { gimple stmt = gsi_stmt(gsi); /* We're only interested in GIMPLE_CALLs. */ if (gimple_code(stmt) != GIMPLE_CALL) continue; if (gimple_call_num_args(stmt) < 2) continue; gcall *c = as_a(stmt); tree callee_type = gimple_call_fntype(c); if (!callee_type || !TYPE_ARG_TYPES(callee_type) || !TREE_CHAIN(TYPE_ARG_TYPES(callee_type))) continue; tree arg_type[2] = { TYPE_MAIN_VARIANT(TREE_VALUE(TYPE_ARG_TYPES(callee_type))), TYPE_MAIN_VARIANT( TREE_VALUE(TREE_CHAIN(TYPE_ARG_TYPES(callee_type))))}; tree fn = NULL; /* Callee arglist starts with two GCC std::string arguments. */ if (arg_type[0] == arg_type[1] && is_gxx_std_string(arg_type[0])) fn = cmptrs_hook(1); /* Callee arglist starts with GCC std::string and C string. */ else if (is_gxx_std_string(arg_type[0]) && is_c_string(arg_type[1])) fn = cmptrs_hook(2); /* Callee arglist starts with two LLVM std::string arguments. */ else if (arg_type[0] == arg_type[1] && is_llvm_std_string(arg_type[0])) fn = cmptrs_hook(3); /* Callee arglist starts with LLVM std::string and C string. */ else if (is_llvm_std_string(arg_type[0]) && is_c_string(arg_type[1])) fn = cmptrs_hook(4); /* Callee arglist starts with two pointers to the same type, and callee returns a value. */ else if (arg_type[0] == arg_type[1] && POINTER_TYPE_P(arg_type[0]) && (TYPE_MAIN_VARIANT(gimple_call_return_type(c)) != void_type_node)) fn = cmptrs_hook(0); else continue; tree arg[2] = {gimple_call_arg(c, 0), gimple_call_arg(c, 1)}; for (unsigned i = 0; i < ARRAY_SIZE(arg); i++) { tree c = fold_convert_loc(UNKNOWN_LOCATION, tp8u, arg[i]); if (!is_gimple_val(c)) { tree s = make_ssa_name(tp8u); gimple g = gimple_build_assign(s, c); c = s; gsi_insert_before(&gsi, g, GSI_SAME_STMT); } arg[i] = c; } gimple call = gimple_build_call(fn, 2, arg[0], arg[1]); gsi_insert_before(&gsi, call, GSI_SAME_STMT); } } return 0; } }; static struct plugin_info afl_cmptrs_plugin = { .version = "20220420", .help = G_("AFL gcc cmptrs plugin\n\ \n\ Set AFL_QUIET in the environment to silence it.\n\ "), }; } // namespace /* This is the function GCC calls when loading a plugin. Initialize and register further callbacks. */ int plugin_init(struct plugin_name_args *info, struct plugin_gcc_version *version) { if (!plugin_default_version_check(version, &gcc_version)) FATAL(G_("GCC and plugin have incompatible versions, expected GCC %s, " "is %s"), gcc_version.basever, version->basever); /* Show a banner. */ bool quiet = false; if (isatty(2) && !getenv("AFL_QUIET")) SAYF(cCYA "afl-gcc-cmptrs-pass " cBRI VERSION cRST " by \n"); else quiet = true; const char *name = info->base_name; register_callback(name, PLUGIN_INFO, NULL, &afl_cmptrs_plugin); afl_cmptrs_pass *aflp = new afl_cmptrs_pass(quiet); struct register_pass_info pass_info = { .pass = aflp, .reference_pass_name = "ssa", .ref_pass_instance_number = 1, .pos_op = PASS_POS_INSERT_AFTER, }; register_callback(name, PLUGIN_PASS_MANAGER_SETUP, NULL, &pass_info); return 0; }