code format

8 files changed, 151 insertions, 134 deletions

diff --git a/examples/qemu_persistent_hook/read_into_rdi.c b/examples/qemu_persistent_hook/read_into_rdi.c
index 4c5119e0..fd4c9000 100644
--- a/examples/qemu_persistent_hook/read_into_rdi.c
+++ b/examples/qemu_persistent_hook/read_into_rdi.c
@@ -2,35 +2,37 @@
 #include <stdio.h>
 #include <unistd.h>
 
-#define g2h(x) ((void *)((unsigned long)(x) + guest_base))
-#define h2g(x) ((uint64_t)(x) - guest_base)
+#define g2h(x) ((void*)((unsigned long)(x) + guest_base))
+#define h2g(x) ((uint64_t)(x)-guest_base)
 
 enum {
-    R_EAX = 0,
-    R_ECX = 1,
-    R_EDX = 2,
-    R_EBX = 3,
-    R_ESP = 4,
-    R_EBP = 5,
-    R_ESI = 6,
-    R_EDI = 7,
-    R_R8 = 8,
-    R_R9 = 9,
-    R_R10 = 10,
-    R_R11 = 11,
-    R_R12 = 12,
-    R_R13 = 13,
-    R_R14 = 14,
-    R_R15 = 15,
-
-    R_AL = 0,
-    R_CL = 1,
-    R_DL = 2,
-    R_BL = 3,
-    R_AH = 4,
-    R_CH = 5,
-    R_DH = 6,
-    R_BH = 7,
+
+  R_EAX = 0,
+  R_ECX = 1,
+  R_EDX = 2,
+  R_EBX = 3,
+  R_ESP = 4,
+  R_EBP = 5,
+  R_ESI = 6,
+  R_EDI = 7,
+  R_R8 = 8,
+  R_R9 = 9,
+  R_R10 = 10,
+  R_R11 = 11,
+  R_R12 = 12,
+  R_R13 = 13,
+  R_R14 = 14,
+  R_R15 = 15,
+
+  R_AL = 0,
+  R_CL = 1,
+  R_DL = 2,
+  R_BL = 3,
+  R_AH = 4,
+  R_CH = 5,
+  R_DH = 6,
+  R_BH = 7,
+
 };
 
 void afl_persistent_hook(uint64_t* regs, uint64_t guest_base) {
@@ -40,3 +42,4 @@ void afl_persistent_hook(uint64_t* regs, uint64_t guest_base) {
   printf("readed %ld bytes\n", r);
 
 }
+
diff --git a/examples/qemu_persistent_hook/test.c b/examples/qemu_persistent_hook/test.c
index 079d2be4..83001545 100644
--- a/examples/qemu_persistent_hook/test.c
+++ b/examples/qemu_persistent_hook/test.c
@@ -6,16 +6,15 @@ int target_func(char *buf, int size) {
   switch (buf[0]) {
 
     case 1:
-      if (buf[1] == '\x44') {
-        puts("a");
-      }
+      if (buf[1] == '\x44') { puts("a"); }
       break;
     case 0xff:
       if (buf[2] == '\xff') {
-        if (buf[1] == '\x44') {
-          puts("b");
-        }
+
+        if (buf[1] == '\x44') { puts("b"); }
+
       }
+
       break;
     default: break;
 
@@ -32,3 +31,4 @@ int main() {
   target_func(data, 1024);
 
 }
+
diff --git a/qemu_mode/patches/afl-qemu-common.h b/qemu_mode/patches/afl-qemu-common.h
index de6c7b73..da3d563e 100644
--- a/qemu_mode/patches/afl-qemu-common.h
+++ b/qemu_mode/patches/afl-qemu-common.h
@@ -59,7 +59,7 @@
 #define INC_AFL_AREA(loc) afl_area_ptr[loc]++
 #endif
 
-typedef void (*afl_persistent_hook_fn)(uint64_t* regs, uint64_t guest_base);
+typedef void (*afl_persistent_hook_fn)(uint64_t *regs, uint64_t guest_base);
 
 /* Declared in afl-qemu-cpu-inl.h */
 
@@ -81,7 +81,7 @@ extern afl_persistent_hook_fn afl_persistent_hook_ptr;
 
 extern __thread abi_ulong afl_prev_loc;
 
-extern struct cmp_map* __afl_cmp_map;
+extern struct cmp_map *__afl_cmp_map;
 extern __thread u32    __afl_cmp_counter;
 
 void afl_debug_dump_saved_regs();
diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h
index 7ef54d78..5e155c74 100644
--- a/qemu_mode/patches/afl-qemu-cpu-inl.h
+++ b/qemu_mode/patches/afl-qemu-cpu-inl.h
@@ -82,7 +82,7 @@ u8 afl_compcov_level;
 
 __thread abi_ulong afl_prev_loc;
 
-struct cmp_map* __afl_cmp_map;
+struct cmp_map *__afl_cmp_map;
 __thread u32    __afl_cmp_counter;
 
 /* Set in the child process in forkserver mode: */
@@ -187,9 +187,9 @@ static void afl_setup(void) {
     if (inst_r) afl_area_ptr[0] = 1;
 
   }
-  
-  if (getenv("___AFL_EINS_ZWEI_POLIZEI___")) { // CmpLog forkserver
-  
+
+  if (getenv("___AFL_EINS_ZWEI_POLIZEI___")) {  // CmpLog forkserver
+
     id_str = getenv(CMPLOG_SHM_ENV_VAR);
 
     if (id_str) {
@@ -198,10 +198,10 @@ static void afl_setup(void) {
 
       __afl_cmp_map = shmat(shm_id, NULL, 0);
 
-      if (__afl_cmp_map == (void*)-1) exit(1);
+      if (__afl_cmp_map == (void *)-1) exit(1);
 
     }
-    
+
   }
 
   if (getenv("AFL_INST_LIBS")) {
@@ -247,32 +247,42 @@ static void afl_setup(void) {
   if (getenv("AFL_QEMU_PERSISTENT_GPR")) persistent_save_gpr = 1;
 
   if (getenv("AFL_QEMU_PERSISTENT_HOOK")) {
-  
+
 #ifdef AFL_QEMU_STATIC_BUILD
 
-    fprintf(stderr, "[AFL] ERROR: you cannot use AFL_QEMU_PERSISTENT_HOOK when afl-qemu-trace is static\n");
+    fprintf(stderr,
+            "[AFL] ERROR: you cannot use AFL_QEMU_PERSISTENT_HOOK when "
+            "afl-qemu-trace is static\n");
     exit(1);
 
 #else
-  
+
     persistent_save_gpr = 1;
-  
-    void* plib = dlopen(getenv("AFL_QEMU_PERSISTENT_HOOK"), RTLD_NOW);
+
+    void *plib = dlopen(getenv("AFL_QEMU_PERSISTENT_HOOK"), RTLD_NOW);
     if (!plib) {
-      fprintf(stderr, "[AFL] ERROR: invalid AFL_QEMU_PERSISTENT_HOOK=%s\n", getenv("AFL_QEMU_PERSISTENT_HOOK"));
+
+      fprintf(stderr, "[AFL] ERROR: invalid AFL_QEMU_PERSISTENT_HOOK=%s\n",
+              getenv("AFL_QEMU_PERSISTENT_HOOK"));
       exit(1);
+
     }
-    
+
     afl_persistent_hook_ptr = dlsym(plib, "afl_persistent_hook");
     if (!afl_persistent_hook_ptr) {
-      fprintf(stderr, "[AFL] ERROR: failed to find the function \"afl_persistent_hook\" in %s\n", getenv("AFL_QEMU_PERSISTENT_HOOK"));
+
+      fprintf(stderr,
+              "[AFL] ERROR: failed to find the function "
+              "\"afl_persistent_hook\" in %s\n",
+              getenv("AFL_QEMU_PERSISTENT_HOOK"));
       exit(1);
+
     }
 
 #endif
 
   }
-  
+
   if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"))
     persisent_retaddr_offset =
         strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 0);
@@ -402,9 +412,12 @@ static void afl_forkserver(CPUState *cpu) {
     if (WIFSTOPPED(status))
       child_stopped = 1;
     else if (unlikely(first_run && is_persistent)) {
+
       fprintf(stderr, "[AFL] ERROR: no persistent iteration executed\n");
       exit(12);  // Persistent is wrong
+
     }
+
     first_run = 0;
 
     if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7);
diff --git a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h
index d081060f..3c230c30 100644
--- a/qemu_mode/patches/afl-qemu-cpu-translate-inl.h
+++ b/qemu_mode/patches/afl-qemu-cpu-translate-inl.h
@@ -153,17 +153,15 @@ static void afl_cmplog_64(target_ulong cur_loc, target_ulong arg1,
 
 }
 
-
 static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2,
                             TCGMemOp ot, int is_imm) {
 
   void *func;
 
-  if (cur_loc > afl_end_code || cur_loc < afl_start_code)
-    return;
+  if (cur_loc > afl_end_code || cur_loc < afl_start_code) return;
 
   if (__afl_cmp_map) {
-  
+
     cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
     cur_loc &= CMP_MAP_W - 1;
 
@@ -177,16 +175,16 @@ static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2,
     }
 
     tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2);
-  
+
   } else if (afl_compcov_level) {
-  
+
     if (!is_imm && afl_compcov_level < 2) return;
 
     cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
     cur_loc &= MAP_SIZE - 7;
 
     if (cur_loc >= afl_inst_rms) return;
-    
+
     switch (ot) {
 
       case MO_64: func = &afl_compcov_log_64; break;
@@ -197,7 +195,7 @@ static void afl_gen_compcov(target_ulong cur_loc, TCGv_i64 arg1, TCGv_i64 arg2,
     }
 
     tcg_gen_afl_compcov_log_call(func, cur_loc, arg1, arg2);
-  
+
   }
 
 }
@@ -254,62 +252,60 @@ static void log_x86_sp_content(void) {
 
 }*/
 
-
 static void callback_to_persistent_hook(void) {
 
   afl_persistent_hook_ptr(persistent_saved_gpr, guest_base);
-  
+
 }
 
-static void i386_restore_state_for_persistent(TCGv* cpu_regs) {
-
-  if (persistent_save_gpr) {                                         
-                                                                       
-    int      i;                                                      
-    TCGv_ptr gpr_sv;                                                 
-                                                                     
-    TCGv_ptr first_pass_ptr = tcg_const_ptr(&persistent_first_pass); 
-    TCGv     first_pass = tcg_temp_local_new();                      
-    TCGv     one = tcg_const_tl(1);                                  
-    tcg_gen_ld8u_tl(first_pass, first_pass_ptr, 0);                  
-                                                                     
-    TCGLabel *lbl_restore_gpr = gen_new_label();                        
-    tcg_gen_brcond_tl(TCG_COND_NE, first_pass, one, lbl_restore_gpr);   
-              
+static void i386_restore_state_for_persistent(TCGv *cpu_regs) {
+
+  if (persistent_save_gpr) {
+
+    int      i;
+    TCGv_ptr gpr_sv;
+
+    TCGv_ptr first_pass_ptr = tcg_const_ptr(&persistent_first_pass);
+    TCGv     first_pass = tcg_temp_local_new();
+    TCGv     one = tcg_const_tl(1);
+    tcg_gen_ld8u_tl(first_pass, first_pass_ptr, 0);
+
+    TCGLabel *lbl_restore_gpr = gen_new_label();
+    tcg_gen_brcond_tl(TCG_COND_NE, first_pass, one, lbl_restore_gpr);
+
     // save GRP registers
-    for (i = 0; i < CPU_NB_REGS; ++i) {                              
-                                                                     
-      gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]);              
-      tcg_gen_st_tl(cpu_regs[i], gpr_sv, 0);                         
-                                                                     
+    for (i = 0; i < CPU_NB_REGS; ++i) {
+
+      gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]);
+      tcg_gen_st_tl(cpu_regs[i], gpr_sv, 0);
+
     }
 
     gen_set_label(lbl_restore_gpr);
-    
+
     tcg_gen_afl_call0(&afl_persistent_loop);
-    
-    if (afl_persistent_hook_ptr)
-      tcg_gen_afl_call0(callback_to_persistent_hook);
-
-    // restore GRP registers                                                     
-    for (i = 0; i < CPU_NB_REGS; ++i) {                              
-                                                                     
-      gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]);              
-      tcg_gen_ld_tl(cpu_regs[i], gpr_sv, 0);                         
-                                                                     
+
+    if (afl_persistent_hook_ptr) tcg_gen_afl_call0(callback_to_persistent_hook);
+
+    // restore GRP registers
+    for (i = 0; i < CPU_NB_REGS; ++i) {
+
+      gpr_sv = tcg_const_ptr(&persistent_saved_gpr[i]);
+      tcg_gen_ld_tl(cpu_regs[i], gpr_sv, 0);
+
     }
-                                                                     
-    tcg_temp_free(first_pass);                                       
-                                                                     
+
+    tcg_temp_free(first_pass);
+
   } else if (afl_persistent_ret_addr == 0) {
-                                                                     
+
     TCGv_ptr stack_off_ptr = tcg_const_ptr(&persistent_stack_offset);
-    TCGv     stack_off = tcg_temp_new();                             
-    tcg_gen_ld_tl(stack_off, stack_off_ptr, 0);                      
-    tcg_gen_sub_tl(cpu_regs[R_ESP], cpu_regs[R_ESP], stack_off);     
-    tcg_temp_free(stack_off);                                        
-                                                                     
-  }                                                                  
+    TCGv     stack_off = tcg_temp_new();
+    tcg_gen_ld_tl(stack_off, stack_off_ptr, 0);
+    tcg_gen_sub_tl(cpu_regs[R_ESP], cpu_regs[R_ESP], stack_off);
+    tcg_temp_free(stack_off);
+
+  }
 
 }
 
diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c
index 709abefe..3d34bf71 100644
--- a/src/afl-fuzz-cmplog.c
+++ b/src/afl-fuzz-cmplog.c
@@ -442,7 +442,7 @@ u8 run_cmplog_target(char** argv, u32 timeout) {
       setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":"
                              "symbolize=0:"
                              "msan_track_origins=0", 0);
-      
+
       setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1);
 
       if (!qemu_mode) argv[0] = cmplog_binary;
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index bac7357e..296fcd98 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -122,9 +122,8 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) {
   while ((rng = pop_biggest_range(&ranges)) != NULL && stage_cur) {
 
     u32 s = rng->end - rng->start;
-    if (s == 0)
-      goto empty_range;
-    
+    if (s == 0) goto empty_range;
+
     memcpy(backup, buf + rng->start, s);
     rand_replace(buf + rng->start, s);
 
@@ -137,9 +136,11 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) {
       ranges = add_range(ranges, rng->start + s / 2 + 1, rng->end);
       memcpy(buf + rng->start, backup, s);
 
-    } else needs_write = 1;
+    } else
+
+      needs_write = 1;
 
-empty_range:
+  empty_range:
     ck_free(rng);
     --stage_cur;
 
@@ -156,9 +157,9 @@ empty_range:
     ck_free(rng);
 
   }
-  
+
   // save the input with the high entropy
-  
+
   if (needs_write) {
 
     s32 fd;
@@ -169,7 +170,7 @@ empty_range:
 
     } else {
 
-      unlink(queue_cur->fname);                                    /* ignore errors */
+      unlink(queue_cur->fname);                            /* ignore errors */
       fd = open(queue_cur->fname, O_WRONLY | O_CREAT | O_EXCL, 0600);
 
     }
@@ -177,10 +178,10 @@ empty_range:
     if (fd < 0) PFATAL("Unable to create '%s'", queue_cur->fname);
 
     ck_write(fd, buf, len, queue_cur->fname);
-    queue_cur->len = len; // no-op, just to be 100% safe
-    
+    queue_cur->len = len;  // no-op, just to be 100% safe
+
     close(fd);
-    
+
   }
 
   return 0;
@@ -305,24 +306,27 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
 void try_to_add_to_dict(u64 v, u8 shape) {
 
   u8* b = (u8*)&v;
-  
+
   u32 k;
-  u8 cons_ff = 0, cons_0 = 0;
+  u8  cons_ff = 0, cons_0 = 0;
   for (k = 0; k < shape; ++k) {
 
-    if (b[k] == 0) ++cons_0;
-    else if (b[k] == 0xff) ++cons_0;
-    else cons_0 = cons_ff = 0;
-    
-    if (cons_0 > 1 || cons_ff > 1)
-      return;
+    if (b[k] == 0)
+      ++cons_0;
+    else if (b[k] == 0xff)
+      ++cons_0;
+    else
+      cons_0 = cons_ff = 0;
+
+    if (cons_0 > 1 || cons_ff > 1) return;
 
   }
-  
+
   maybe_add_auto((u8*)&v, shape);
-  
+
   u64 rev;
   switch (shape) {
+
     case 1: break;
     case 2:
       rev = SWAP16((u16)v);
@@ -336,8 +340,9 @@ void try_to_add_to_dict(u64 v, u8 shape) {
       rev = SWAP64(v);
       maybe_add_auto((u8*)&rev, shape);
       break;
+
   }
-  
+
 }
 
 u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
@@ -380,13 +385,13 @@ u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
         break;
 
     }
-    
+
     // If failed, add to dictionary
     if (fails == 8) {
-    
+
       try_to_add_to_dict(o->v0, SHAPE_BYTES(h->shape));
       try_to_add_to_dict(o->v1, SHAPE_BYTES(h->shape));
-    
+
     }
 
   cmp_fuzz_next_iter:
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index 1b7e5226..d09b4fe6 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -334,9 +334,9 @@ void show_stats(void) {
 
   /* Lord, forgive me this. */
 
-  SAYF(SET_G1 bSTG bLT bH bSTOP                         cCYA
+  SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
        " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA
-       " overall results " bSTG bH2 bH2                 bRT "\n");
+       " overall results " bSTG bH2 bH2 bRT "\n");
 
   if (dumb_mode) {
 
@@ -413,9 +413,9 @@ void show_stats(void) {
                 "   uniq hangs : " cRST "%-6s" bSTG         bV "\n",
        DTD(cur_ms, last_hang_time), tmp);
 
-  SAYF(bVR bH bSTOP                                          cCYA
+  SAYF(bVR bH bSTOP            cCYA
        " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA
-       " map coverage " bSTG bH bHT bH20 bH2                 bVL "\n");
+       " map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
 
   /* This gets funny because we want to print several variable-length variables
      together, but then cram them into a fixed-width field - so we need to
@@ -443,9 +443,9 @@ void show_stats(void) {
 
   SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp);
 
-  SAYF(bVR bH bSTOP                                         cCYA
+  SAYF(bVR bH bSTOP            cCYA
        " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
-       " findings in depth " bSTG bH10 bH5 bH2 bH2          bVL "\n");
+       " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
 
   sprintf(tmp, "%s (%0.02f%%)", DI(queued_favored),
           ((double)queued_favored) * 100 / queued_paths);
@@ -514,7 +514,7 @@ void show_stats(void) {
 
   /* Aaaalmost there... hold on! */
 
-  SAYF(bVR bH cCYA                                                     bSTOP
+  SAYF(bVR bH cCYA                      bSTOP
        " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA
        " path geometry " bSTG bH5 bH2 bVL "\n");