Skip to content

[compiler-rt][libFuzzer] Add support for capturing SIGTRAP exits. #149120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jul 28, 2025
Merged

[compiler-rt][libFuzzer] Add support for capturing SIGTRAP exits. #149120

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a8d0dd0
[compiler-rt][libFuzzer] Add support for capturing SIGTRAP exits.
DanBlackwell Jul 16, 2025
72293b5
Break SIGTRAP test cpp file out into separate file
DanBlackwell Jul 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions compiler-rt/lib/fuzzer/FuzzerDriver.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -834,6 +834,7 @@ int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
Options.HandleInt = Flags.handle_int;
Options.HandleSegv = Flags.handle_segv;
Options.HandleTerm = Flags.handle_term;
Options.HandleTrap = Flags.handle_trap;
Options.HandleXfsz = Flags.handle_xfsz;
Options.HandleUsr1 = Flags.handle_usr1;
Options.HandleUsr2 = Flags.handle_usr2;
Expand Down
1 change: 1 addition & 0 deletions compiler-rt/lib/fuzzer/FuzzerFlags.def
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,6 +152,7 @@ FUZZER_FLAG_INT(handle_ill, 1, "If 1, try to intercept SIGILL.")
FUZZER_FLAG_INT(handle_fpe, 1, "If 1, try to intercept SIGFPE.")
FUZZER_FLAG_INT(handle_int, 1, "If 1, try to intercept SIGINT.")
FUZZER_FLAG_INT(handle_term, 1, "If 1, try to intercept SIGTERM.")
FUZZER_FLAG_INT(handle_trap, 1, "If 1, try to intercept SIGTRAP.")
FUZZER_FLAG_INT(handle_xfsz, 1, "If 1, try to intercept SIGXFSZ.")
FUZZER_FLAG_INT(handle_usr1, 1, "If 1, try to intercept SIGUSR1.")
FUZZER_FLAG_INT(handle_usr2, 1, "If 1, try to intercept SIGUSR2.")
Expand Down
1 change: 1 addition & 0 deletions compiler-rt/lib/fuzzer/FuzzerOptions.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,7 @@ struct FuzzingOptions {
bool HandleInt = false;
bool HandleSegv = false;
bool HandleTerm = false;
bool HandleTrap = false;
bool HandleXfsz = false;
bool HandleUsr1 = false;
bool HandleUsr2 = false;
Expand Down
2 changes: 1 addition & 1 deletion compiler-rt/lib/fuzzer/FuzzerUtilFuchsia.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -410,7 +410,7 @@ void SetSignalHandler(const FuzzingOptions &Options) {

// Early exit if no crash handler needed.
if (!Options.HandleSegv && !Options.HandleBus && !Options.HandleIll &&
!Options.HandleFpe && !Options.HandleAbrt)
!Options.HandleFpe && !Options.HandleAbrt && !Options.HandleTrap)
return;

// Set up the crash handler and wait until it is ready before proceeding.
Expand Down
2 changes: 2 additions & 0 deletions compiler-rt/lib/fuzzer/FuzzerUtilPosix.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,8 @@ void SetSignalHandler(const FuzzingOptions& Options) {
SetSigaction(SIGILL, CrashHandler);
if (Options.HandleFpe)
SetSigaction(SIGFPE, CrashHandler);
if (Options.HandleTrap)
SetSigaction(SIGTRAP, CrashHandler);
if (Options.HandleXfsz)
SetSigaction(SIGXFSZ, FileSizeExceedHandler);
if (Options.HandleUsr1)
Expand Down
7 changes: 7 additions & 0 deletions compiler-rt/test/fuzzer/SimpleTest.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,9 @@
#include <cstdlib>
#include <iostream>
#include <ostream>
#ifdef SIGTRAP_TEST
# include <signal.h>
#endif
Copy link
Contributor

@thetruestblue thetruestblue Jul 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not super familiar with patterns for fuzzer testing. But is there a reason we're injecting the test here rather than a stand alone file?

Copy link
Contributor Author

@DanBlackwell DanBlackwell Jul 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nah, I've broken it out into a separate file now because this was ugly.


static volatile int Sink;

Expand All @@ -20,7 +23,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
Sink = 2;
if (Size > 2 && Data[2] == '!') {
std::cout << "BINGO; Found the target, exiting\n" << std::flush;
#ifdef SIGTRAP_TEST
raise(SIGTRAP);
#else
exit(0);
#endif
}
}
}
Expand Down
7 changes: 7 additions & 0 deletions compiler-rt/test/fuzzer/sig-trap.test
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
RUN: %cpp_compiler %S/SimpleTest.cpp -DSIGTRAP_TEST -o %t-SigTrapTest

RUN: not %run %t-SigTrapTest 2>&1 | FileCheck %s
CHECK: BINGO
CHECK: ERROR: libFuzzer: deadly signal

RUN: trap "%run %t-SigTrapTest -handle_trap=0" TRAP
Loading