aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDominik Maier <domenukk@gmail.com>2020-10-06 15:38:36 +0200
committerDominik Maier <domenukk@gmail.com>2020-10-06 15:38:36 +0200
commit74dc227c4412d0121c9b972e5d89db89f54c6b3a (patch)
tree14da0722ebc330a9a7bf46086db0f45f811cbc1f
parenta4b60ca5b61c9bca5fa7b67528baeb3a8ea9320e (diff)
downloadafl++-74dc227c4412d0121c9b972e5d89db89f54c6b3a.tar.gz
code format
-rw-r--r--include/afl-fuzz.h5
-rw-r--r--include/config.h3
-rw-r--r--src/afl-fuzz-one.c22
-rw-r--r--src/afl-fuzz-queue.c34
-rw-r--r--src/afl-fuzz.c2
5 files changed, 48 insertions, 18 deletions
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 46da8c7d..5ab787e0 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -163,7 +163,7 @@ struct queue_entry {
u32 tc_ref; /* Trace bytes ref count */
u8 *testcase_buf; /* The testcase buffer, if loaded. */
- u32 testcase_refs; /* count of users of testcase buf */
+ u32 testcase_refs; /* count of users of testcase buf */
struct queue_entry *next; /* Next element, if any */
@@ -669,7 +669,8 @@ typedef struct afl_state {
/* How many queue entries currently have cached testcases */
u32 q_testcase_cache_count;
- /* Refs to each queue entry with cached testcase (for eviction, if cache_count is too large) */
+ /* Refs to each queue entry with cached testcase (for eviction, if cache_count
+ * is too large) */
struct queue_entry *q_testcase_cache[TESTCASE_CACHE_SIZE];
} afl_state_t;
diff --git a/include/config.h b/include/config.h
index 38a734ce..ec378036 100644
--- a/include/config.h
+++ b/include/config.h
@@ -300,7 +300,8 @@ Decrease if RAM usage is high. */
#define TESTCASE_CACHE_SIZE 2048
#if TESTCASE_CACHE_SIZE < 4
- #error "Dangerously low cache size: Set TESTCASE_CACHE_SIZE to 4 or more in config.h!
+ #error \
+ "Dangerously low cache size: Set TESTCASE_CACHE_SIZE to 4 or more in config.h!
#endif
/* Maximum line length passed from GCC to 'as' and used for parsing
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 20558618..a5f77f11 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -1710,8 +1710,10 @@ custom_mutator_stage:
target_len, max_seed_size);
if (new_buf) {
+
queue_testcase_release(afl, target);
new_buf = NULL;
+
}
if (unlikely(!mutated_buf)) {
@@ -2302,7 +2304,9 @@ havoc_stage:
u32 tid;
do {
+
tid = rand_below(afl, afl->queued_paths);
+
} while (tid == afl->current_entry);
struct queue_entry *target = afl->queue_buf[tid];
@@ -2310,12 +2314,13 @@ havoc_stage:
/* Make sure that the target has a reasonable length. */
while (target && (target->len < 2 || target == afl->queue_cur)) {
+
target = target->next;
+
}
if (!target) { break; }
-
u32 new_len = target->len;
/* Get the testcase contents for splicing. */
@@ -2323,16 +2328,21 @@ havoc_stage:
u8 overwrite = 0;
if (temp_len >= 2 && rand_below(afl, 2)) {
+
overwrite = 1;
- }
- else if (temp_len + HAVOC_BLK_XL >= MAX_FILE) {
+
+ } else if (temp_len + HAVOC_BLK_XL >= MAX_FILE) {
if (temp_len >= 2) {
+
overwrite = 1;
+
} else {
+
queue_testcase_release(afl, target);
new_buf = NULL;
break;
+
}
}
@@ -2497,7 +2507,8 @@ retry_splicing:
the last differing byte. Bail out if the difference is just a single
byte or so. */
- locate_diffs(in_buf, splice_buf, MIN(len, (s64)target->len), &f_diff, &l_diff);
+ locate_diffs(in_buf, splice_buf, MIN(len, (s64)target->len), &f_diff,
+ &l_diff);
if (f_diff < 0 || l_diff < 2 || f_diff == l_diff) { goto retry_splicing; }
@@ -4503,7 +4514,8 @@ pacemaker_fuzzing:
len = target->len;
memcpy(new_buf, in_buf, split_at);
- memcpy(new_buf + split_at, splicing_buf + split_at, target->len - split_at);
+ memcpy(new_buf + split_at, splicing_buf + split_at,
+ target->len - split_at);
afl_swap_bufs(AFL_BUF_PARAM(in), AFL_BUF_PARAM(in_scratch));
in_buf = new_buf;
out_buf = afl_realloc(AFL_BUF_PARAM(out), len);
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index e2387aaa..721f9ac7 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -770,24 +770,33 @@ u32 calculate_score(afl_state_t *afl, struct queue_entry *q) {
/* Tell afl that this testcase may be evicted from the cache */
inline void queue_testcase_release(afl_state_t *afl, struct queue_entry *q) {
- (void) afl;
+
+ (void)afl;
q->testcase_refs--;
- if (unlikely(q->testcase_refs < 0)) { FATAL("Testcase refcount smaller than 0"); }
+ if (unlikely(q->testcase_refs < 0)) {
+
+ FATAL("Testcase refcount smaller than 0");
+
+ }
+
}
/* Returns the testcase buf from the file behind this queue entry.
Increases the refcount. */
u8 *queue_testcase_take(afl_state_t *afl, struct queue_entry *q) {
+
if (!q->testcase_buf) {
+
u32 tid = 0;
/* Buf not cached, let's do that now */
if (likely(afl->q_testcase_cache_count == TESTCASE_CACHE_SIZE)) {
+
/* Cache full. We neet to evict one to map one.
Get a random one which is not in use */
do {
- tid = rand_below(afl, afl->q_testcase_cache_count);
+ tid = rand_below(afl, afl->q_testcase_cache_count);
} while (afl->q_testcase_cache[tid]->testcase_refs > 0);
@@ -795,21 +804,19 @@ u8 *queue_testcase_take(afl_state_t *afl, struct queue_entry *q) {
/* free the current buf from cache */
munmap(old_cached->testcase_buf, old_cached->len);
old_cached->testcase_buf = NULL;
-
+
} else {
+
tid = afl->q_testcase_cache_count;
afl->q_testcase_cache_count++;
+
}
/* Map the test case into memory. */
int fd = open(q->fname, O_RDONLY);
- if (unlikely(fd < 0)) {
-
- PFATAL("Unable to open '%s'", q->fname);
-
- }
+ if (unlikely(fd < 0)) { PFATAL("Unable to open '%s'", q->fname); }
u32 len = q->len;
@@ -827,8 +834,15 @@ u8 *queue_testcase_take(afl_state_t *afl, struct queue_entry *q) {
afl->q_testcase_cache[tid] = q;
}
+
q->testcase_refs++;
- if (!q->testcase_buf) { FATAL("Testcase buf is NULL, this should never happen"); }
+ if (!q->testcase_buf) {
+
+ FATAL("Testcase buf is NULL, this should never happen");
+
+ }
+
return q->testcase_buf;
}
+
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index dd9aaa8f..9b7c1445 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1153,7 +1153,9 @@ int main(int argc, char **argv_orig, char **envp) {
if (extras_dir_cnt) {
for (i = 0; i < extras_dir_cnt; i++) {
+
load_extras(afl, extras_dir[i]);
+
}
dedup_extras(afl);