ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-21 13:51:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

llvm_mode compare-transform-pass: add handling of sized comparisons with non-const size

Browse Source 
this involved insertion of an extra length-checking bb for each character
to see if we've hit the sized limit.
This commit is contained in:
Robert Scott
2020-05-22 14:32:17 +01:00
parent 7e4c5b3636
commit f6808158c5
1 changed files with 54 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

81
llvm_mode/compare-transform-pass.so.cc
View File

@ -321,7 +321,10 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
uint64_t literalLength = HasStr1 ? Str1.size() : Str2.size(); uint64_t literalLength = HasStr1 ? Str1.size() : Str2.size();
if (literalLength + 1 < ilen->getZExtValue()) continue; if (literalLength + 1 < ilen->getZExtValue()) continue;
} }
} else continue; } else if (isMemcmp)
// this *may* supply a len greater than the constant string at
// runtime so similarly we don't want to have to handle that
continue;
} }
calls.push_back(callInst); calls.push_back(callInst);
@ -356,7 +359,8 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
StringRef("strncmp")) || StringRef("strncmp")) ||
!callInst->getCalledFunction()->getName().compare( !callInst->getCalledFunction()->getName().compare(
StringRef("strncasecmp")); StringRef("strncasecmp"));
bool isConstSized = isSizedcmp && isa<ConstantInt>(callInst->getArgOperand(2)); Value *sizedValue = isSizedcmp ? callInst->getArgOperand(2) : NULL;
bool isConstSized = sizedValue && isa<ConstantInt>(sizedValue);
bool isCaseInsensitive = !callInst->getCalledFunction()->getName().compare( bool isCaseInsensitive = !callInst->getCalledFunction()->getName().compare(
StringRef("strcasecmp")) || StringRef("strcasecmp")) ||
!callInst->getCalledFunction()->getName().compare( !callInst->getCalledFunction()->getName().compare(
@ -387,8 +391,7 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
if (isConstSized) { if (isConstSized) {
Value * op2 = callInst->getArgOperand(2); constSizedLen = dyn_cast<ConstantInt>(sizedValue)->getZExtValue();
constSizedLen = dyn_cast<ConstantInt>(op2)->getZExtValue();
} }
@ -424,71 +427,95 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
unrollLen = constStrLen; unrollLen = constStrLen;
if (!be_quiet) if (!be_quiet)
errs() << callInst->getCalledFunction()->getName() << ": len " << unrollLen errs() << callInst->getCalledFunction()->getName() << ": unroll len " << unrollLen
<< ((isSizedcmp && !isConstSized) ? ", variable n" : "")
<< ": " << ConstStr << "\n"; << ": " << ConstStr << "\n";
/* split before the call instruction */ /* split before the call instruction */
BasicBlock *bb = callInst->getParent(); BasicBlock *bb = callInst->getParent();
BasicBlock *end_bb = bb->splitBasicBlock(BasicBlock::iterator(callInst)); BasicBlock *end_bb = bb->splitBasicBlock(BasicBlock::iterator(callInst));
BasicBlock *next_bb =
BasicBlock *next_lenchk_bb = NULL;
if (isSizedcmp && !isConstSized) {
next_lenchk_bb = BasicBlock::Create(C, "len_check", end_bb->getParent(), end_bb);
BranchInst::Create(end_bb, next_lenchk_bb);
}
BasicBlock *next_cmp_bb =
BasicBlock::Create(C, "cmp_added", end_bb->getParent(), end_bb); BasicBlock::Create(C, "cmp_added", end_bb->getParent(), end_bb);
BranchInst::Create(end_bb, next_bb); BranchInst::Create(end_bb, next_cmp_bb);
PHINode *PN = PHINode::Create(Int32Ty, unrollLen + 1, "cmp_phi"); PHINode *PN = PHINode::Create(Int32Ty, (next_lenchk_bb ? 2 : 1) * unrollLen + 1, "cmp_phi");
#if LLVM_VERSION_MAJOR < 8 #if LLVM_VERSION_MAJOR < 8
TerminatorInst *term = bb->getTerminator(); TerminatorInst *term = bb->getTerminator();
#else #else
Instruction *term = bb->getTerminator(); Instruction *term = bb->getTerminator();
#endif #endif
BranchInst::Create(next_bb, bb); BranchInst::Create(next_lenchk_bb ? next_lenchk_bb : next_cmp_bb, bb);
term->eraseFromParent(); term->eraseFromParent();
for (uint64_t i = 0; i < unrollLen; i++) { for (uint64_t i = 0; i < unrollLen; i++) {
BasicBlock * cur_bb = next_bb; BasicBlock *cur_cmp_bb = next_cmp_bb, *cur_lenchk_bb = next_lenchk_bb;
unsigned char c; unsigned char c;
if (cur_lenchk_bb) {
IRBuilder<> cur_lenchk_IRB(&*(cur_lenchk_bb->getFirstInsertionPt()));
Value *icmp = cur_lenchk_IRB.CreateICmpEQ(
sizedValue, ConstantInt::get(Int64Ty, i));
cur_lenchk_IRB.CreateCondBr(icmp, end_bb, cur_cmp_bb);
cur_lenchk_bb->getTerminator()->eraseFromParent();
PN->addIncoming(ConstantInt::get(Int32Ty, 0), cur_lenchk_bb);
}
if (isCaseInsensitive) if (isCaseInsensitive)
c = (unsigned char)(tolower((int)ConstStr[i]) & 0xff); c = (unsigned char)(tolower((int)ConstStr[i]) & 0xff);
else else
c = (unsigned char)ConstStr[i]; c = (unsigned char)ConstStr[i];
BasicBlock::iterator IP = next_bb->getFirstInsertionPt(); IRBuilder<> cur_cmp_IRB(&*(cur_cmp_bb->getFirstInsertionPt()));
IRBuilder<> IRB(&*IP);
Value *v = ConstantInt::get(Int64Ty, i); Value *v = ConstantInt::get(Int64Ty, i);
Value *ele = IRB.CreateInBoundsGEP(VarStr, v, "empty"); Value *ele = cur_cmp_IRB.CreateInBoundsGEP(VarStr, v, "empty");
Value *load = IRB.CreateLoad(ele); Value *load = cur_cmp_IRB.CreateLoad(ele);
if (isCaseInsensitive) { if (isCaseInsensitive) {
// load >= 'A' && load <= 'Z' ? load | 0x020 : load // load >= 'A' && load <= 'Z' ? load | 0x020 : load
load = IRB.CreateZExt(load, Int32Ty); load = cur_cmp_IRB.CreateZExt(load, Int32Ty);
std::vector<Value *> args; std::vector<Value *> args;
args.push_back(load); args.push_back(load);
load = IRB.CreateCall(tolowerFn, args, "tmp"); load = cur_cmp_IRB.CreateCall(tolowerFn, args, "tmp");
load = IRB.CreateTrunc(load, Int8Ty); load = cur_cmp_IRB.CreateTrunc(load, Int8Ty);
} }
Value *isub; Value *isub;
if (HasStr1) if (HasStr1)
isub = IRB.CreateSub(ConstantInt::get(Int8Ty, c), load); isub = cur_cmp_IRB.CreateSub(ConstantInt::get(Int8Ty, c), load);
else else
isub = IRB.CreateSub(load, ConstantInt::get(Int8Ty, c)); isub = cur_cmp_IRB.CreateSub(load, ConstantInt::get(Int8Ty, c));
Value *sext = IRB.CreateSExt(isub, Int32Ty); Value *sext = cur_cmp_IRB.CreateSExt(isub, Int32Ty);
PN->addIncoming(sext, cur_bb); PN->addIncoming(sext, cur_cmp_bb);
if (i < unrollLen - 1) { if (i < unrollLen - 1) {
next_bb = if (cur_lenchk_bb) {
BasicBlock::Create(C, "cmp_added", end_bb->getParent(), end_bb); next_lenchk_bb = BasicBlock::Create(C, "len_check", end_bb->getParent(), end_bb);
BranchInst::Create(end_bb, next_bb); BranchInst::Create(end_bb, next_lenchk_bb);
}
Value *icmp = IRB.CreateICmpEQ(isub, ConstantInt::get(Int8Ty, 0)); next_cmp_bb =
IRB.CreateCondBr(icmp, next_bb, end_bb); BasicBlock::Create(C, "cmp_added", end_bb->getParent(), end_bb);
cur_bb->getTerminator()->eraseFromParent(); BranchInst::Create(end_bb, next_cmp_bb);
Value *icmp = cur_cmp_IRB.CreateICmpEQ(isub, ConstantInt::get(Int8Ty, 0));
cur_cmp_IRB.CreateCondBr(icmp, next_lenchk_bb ? next_lenchk_bb : next_cmp_bb, end_bb);
cur_cmp_bb->getTerminator()->eraseFromParent();
} else { } else {