add std::string and bcmp to dictionary functions

4 files changed, 48 insertions, 15 deletions

diff --git a/docs/Changelog.md b/docs/Changelog.md
index b4c575a6..73613452 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -28,7 +28,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - not overriding -Ox or -fno-unroll-loops anymore
     - new llvm pass: dict2file via AFL_LLVM_DICT2FILE, create afl-fuzz
       -x dictionary of string comparisons found during compilation
-    - LTO autodict now also collects interesting cmp comparisons
+    - LTO autodict now also collects interesting cmp comparisons,
+      std::string compare + find + ==, bcmp
 
 
 ### Version ++2.68c (release)
diff --git a/instrumentation/SanitizerCoverageLTO.so.cc b/instrumentation/SanitizerCoverageLTO.so.cc
index 0a136d6f..b75776b8 100644
--- a/instrumentation/SanitizerCoverageLTO.so.cc
+++ b/instrumentation/SanitizerCoverageLTO.so.cc
@@ -197,8 +197,9 @@ class ModuleSanitizerCoverage {
   void CreateFunctionLocalArrays(Function &F, ArrayRef<BasicBlock *> AllBlocks);
   void InjectCoverageAtBlock(Function &F, BasicBlock &BB, size_t Idx,
                              bool IsLeafFunc = true);
-//  std::pair<Value *, Value *> CreateSecStartEnd(Module &M, const char *Section,
-//                                                Type *Ty);
+  //  std::pair<Value *, Value *> CreateSecStartEnd(Module &M, const char
+  //  *Section,
+  //                                                Type *Ty);
 
   void SetNoSanitizeMetadata(Instruction *I) {
 
@@ -207,9 +208,9 @@ class ModuleSanitizerCoverage {
 
   }
 
-  std::string    getSectionName(const std::string &Section) const;
-//  std::string    getSectionStart(const std::string &Section) const;
-//  std::string    getSectionEnd(const std::string &Section) const;
+  std::string getSectionName(const std::string &Section) const;
+  //  std::string    getSectionStart(const std::string &Section) const;
+  //  std::string    getSectionEnd(const std::string &Section) const;
   FunctionCallee SanCovTracePCIndir;
   FunctionCallee SanCovTracePC /*, SanCovTracePCGuard*/;
   Type *IntptrTy, *IntptrPtrTy, *Int64Ty, *Int64PtrTy, *Int32Ty, *Int32PtrTy,
@@ -374,6 +375,7 @@ std::pair<Value *, Value *> ModuleSanitizerCoverage::CreateSecStartEnd(
   return std::make_pair(IRB.CreatePointerCast(GEP, Ty), SecEndPtr);
 
 }
+
 */
 
 bool ModuleSanitizerCoverage::instrumentModule(
@@ -612,6 +614,7 @@ bool ModuleSanitizerCoverage::instrumentModule(
             bool   isStrcasecmp = true;
             bool   isStrncasecmp = true;
             bool   isIntMemcpy = true;
+            bool   isStdString = true;
             bool   addedNull = false;
             size_t optLen = 0;
 
@@ -624,7 +627,13 @@ bool ModuleSanitizerCoverage::instrumentModule(
             isStrncmp &= !FuncName.compare("strncmp");
             isStrcasecmp &= !FuncName.compare("strcasecmp");
             isStrncasecmp &= !FuncName.compare("strncasecmp");
-            isIntMemcpy &= !FuncName.compare("llvm.memcpy.p0i8.p0i8.i64");
+            isIntMemcpy &= (!FuncName.compare("llvm.memcpy.p0i8.p0i8.i64") ||
+                            !FuncName.compare("bcmp"));
+            isStdString &=
+                ((FuncName.find("basic_string") != std::string::npos &&
+                  FuncName.find("compare") != std::string::npos) ||
+                 (FuncName.find("basic_string") != std::string::npos &&
+                  FuncName.find("find") != std::string::npos));
 
             /* we do something different here, putting this BB and the
                successors in a block map */
@@ -642,7 +651,7 @@ bool ModuleSanitizerCoverage::instrumentModule(
             }
 
             if (!isStrcmp && !isMemcmp && !isStrncmp && !isStrcasecmp &&
-                !isStrncasecmp && !isIntMemcpy)
+                !isStrncasecmp && !isIntMemcpy && !isStdString)
               continue;
 
             /* Verify the strcmp/memcmp/strncmp/strcasecmp/strncasecmp function
@@ -676,9 +685,12 @@ bool ModuleSanitizerCoverage::instrumentModule(
                              FT->getParamType(0) ==
                                  IntegerType::getInt8PtrTy(M.getContext()) &&
                              FT->getParamType(2)->isIntegerTy();
+            isStdString &= FT->getNumParams() >= 2 &&
+                           FT->getParamType(0)->isPointerTy() &&
+                           FT->getParamType(1)->isPointerTy();
 
             if (!isStrcmp && !isMemcmp && !isStrncmp && !isStrcasecmp &&
-                !isStrncasecmp && !isIntMemcpy)
+                !isStrncasecmp && !isIntMemcpy && !isStdString)
               continue;
 
             /* is a str{n,}{case,}cmp/memcmp, check if we have
@@ -1556,6 +1568,7 @@ std::string ModuleSanitizerCoverage::getSectionEnd(
   return "__stop___" + Section;
 
 }
+
 */
 
 char ModuleSanitizerCoverageLegacyPass::ID = 0;
diff --git a/instrumentation/afl-llvm-dict2file.so.cc b/instrumentation/afl-llvm-dict2file.so.cc
index ef42756e..0ab97d5b 100644
--- a/instrumentation/afl-llvm-dict2file.so.cc
+++ b/instrumentation/afl-llvm-dict2file.so.cc
@@ -283,6 +283,7 @@ bool AFLdict2filePass::runOnModule(Module &M) {
           bool   isStrcasecmp = true;
           bool   isStrncasecmp = true;
           bool   isIntMemcpy = true;
+          bool   isStdString = true;
           bool   addedNull = false;
           size_t optLen = 0;
 
@@ -295,10 +296,15 @@ bool AFLdict2filePass::runOnModule(Module &M) {
           isStrncmp &= !FuncName.compare("strncmp");
           isStrcasecmp &= !FuncName.compare("strcasecmp");
           isStrncasecmp &= !FuncName.compare("strncasecmp");
-          isIntMemcpy &= !FuncName.compare("llvm.memcpy.p0i8.p0i8.i64");
+          isIntMemcpy &= (!FuncName.compare("llvm.memcpy.p0i8.p0i8.i64") ||
+                          !FuncName.compare("bcmp"));
+          isStdString &= ((FuncName.find("basic_string") != std::string::npos &&
+                           FuncName.find("compare") != std::string::npos) ||
+                          (FuncName.find("basic_string") != std::string::npos &&
+                           FuncName.find("find") != std::string::npos));
 
           if (!isStrcmp && !isMemcmp && !isStrncmp && !isStrcasecmp &&
-              !isStrncasecmp && !isIntMemcpy)
+              !isStrncasecmp && !isIntMemcpy && !isStdString)
             continue;
 
           /* Verify the strcmp/memcmp/strncmp/strcasecmp/strncasecmp function
@@ -330,9 +336,12 @@ bool AFLdict2filePass::runOnModule(Module &M) {
                            FT->getParamType(0) ==
                                IntegerType::getInt8PtrTy(M.getContext()) &&
                            FT->getParamType(2)->isIntegerTy();
+          isStdString &= FT->getNumParams() >= 2 &&
+                         FT->getParamType(0)->isPointerTy() &&
+                         FT->getParamType(1)->isPointerTy();
 
           if (!isStrcmp && !isMemcmp && !isStrncmp && !isStrcasecmp &&
-              !isStrncasecmp && !isIntMemcpy)
+              !isStrncasecmp && !isIntMemcpy && !isStdString)
             continue;
 
           /* is a str{n,}{case,}cmp/memcmp, check if we have
diff --git a/instrumentation/afl-llvm-lto-instrumentation.so.cc b/instrumentation/afl-llvm-lto-instrumentation.so.cc
index 9632c319..4f032ca0 100644
--- a/instrumentation/afl-llvm-lto-instrumentation.so.cc
+++ b/instrumentation/afl-llvm-lto-instrumentation.so.cc
@@ -381,6 +381,7 @@ bool AFLLTOPass::runOnModule(Module &M) {
             bool   isStrcasecmp = true;
             bool   isStrncasecmp = true;
             bool   isIntMemcpy = true;
+            bool   isStdString = true;
             bool   addedNull = false;
             size_t optLen = 0;
 
@@ -393,7 +394,13 @@ bool AFLLTOPass::runOnModule(Module &M) {
             isStrncmp &= !FuncName.compare("strncmp");
             isStrcasecmp &= !FuncName.compare("strcasecmp");
             isStrncasecmp &= !FuncName.compare("strncasecmp");
-            isIntMemcpy &= !FuncName.compare("llvm.memcpy.p0i8.p0i8.i64");
+            isIntMemcpy &= (!FuncName.compare("llvm.memcpy.p0i8.p0i8.i64") ||
+                            !FuncName.compare("bcmp"));
+            isStdString &=
+                ((FuncName.find("basic_string") != std::string::npos &&
+                  FuncName.find("compare") != std::string::npos) ||
+                 (FuncName.find("basic_string") != std::string::npos &&
+                  FuncName.find("find") != std::string::npos));
 
             /* we do something different here, putting this BB and the
                successors in a block map */
@@ -414,7 +421,7 @@ bool AFLLTOPass::runOnModule(Module &M) {
             }
 
             if (!isStrcmp && !isMemcmp && !isStrncmp && !isStrcasecmp &&
-                !isStrncasecmp && !isIntMemcpy)
+                !isStrncasecmp && !isIntMemcpy && !isStdString)
               continue;
 
             /* Verify the strcmp/memcmp/strncmp/strcasecmp/strncasecmp function
@@ -448,9 +455,12 @@ bool AFLLTOPass::runOnModule(Module &M) {
                              FT->getParamType(0) ==
                                  IntegerType::getInt8PtrTy(M.getContext()) &&
                              FT->getParamType(2)->isIntegerTy();
+            isStdString &= FT->getNumParams() >= 2 &&
+                           FT->getParamType(0)->isPointerTy() &&
+                           FT->getParamType(1)->isPointerTy();
 
             if (!isStrcmp && !isMemcmp && !isStrncmp && !isStrcasecmp &&
-                !isStrncasecmp && !isIntMemcpy)
+                !isStrncasecmp && !isIntMemcpy && !isStdString)
               continue;
 
             /* is a str{n,}{case,}cmp/memcmp, check if we have