added afl-fuzz -I cmdline option

6 files changed, 17 insertions, 3 deletions

diff --git a/docs/ChangeLog b/docs/ChangeLog
index 75f07ce6..7ccc8b66 100644
--- a/docs/ChangeLog
+++ b/docs/ChangeLog
@@ -21,10 +21,11 @@ Version ++2.54d (dev):
   - custom mutator library is now a standard mutator, to exclusivly use it
     add AFL_CUSTOM_MUTATOR_ONLY (that will trigger the previous behaviour)
   - new library qemu_mode/unsigaction which filters sigaction events
+  - afl-fuzz: new command line option -I to execute a command on a new crash
   - no more unlinking the input file, this way the input file can also be a
     FIFO or disk partition
   - setting LLVM_CONFIG for llvm_mode will now again switch to the selected
-    llvm version. If you setup is correct.
+    llvm version. If your setup is correct.
   - fuzzing strategy yields for custom mutator were missing from the UI, added them :)
   - added "make tests" which will perform checks to see that all functionality
     is working as expected. this is currently the starting point, its not complete :)
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 4e5276f6..204d3a51 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -250,6 +250,7 @@ extern u8 *in_dir,                      /* Input directory with test cases  */
     *file_extension,                    /* File extension                   */
     *orig_cmdline,                      /* Original command line            */
     *doc_path,                          /* Path to documentation dir        */
+    *infoexec,                          /* Command to execute on a new crash */
     *out_file;                          /* File to fuzz, if any             */
 
 extern u32 exec_tmout;                  /* Configurable exec timeout (ms)   */
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index d867a318..746fc982 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -683,6 +683,10 @@ u8 save_if_interesting(char** argv, void* mem, u32 len, u8 fault) {
 #endif                                                    /* ^!SIMPLE_FILES */
 
       ++unique_crashes;
+      
+      if (infoexec) // if the user wants to be informed on new crashes - do that
+        if (system(infoexec) == -1)
+          hnb += 0; // we dont care if system errors, but we dont want a compiler warning either
 
       last_crash_time = get_cur_time();
       last_crash_execs = total_execs;
diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c
index a8c17922..a5ccfdf9 100644
--- a/src/afl-fuzz-globals.c
+++ b/src/afl-fuzz-globals.c
@@ -74,7 +74,8 @@ u8 *in_dir,                             /* Input directory with test cases  */
     *file_extension,                    /* File extension                   */
     *orig_cmdline;                      /* Original command line            */
 u8 *doc_path,                           /* Path to documentation dir        */
-    *out_file;                          /* File to fuzz, if any             */
+   *infoexec,				/* Command to execute on a new crash */
+   *out_file;                           /* File to fuzz, if any             */
 
 u32 exec_tmout = EXEC_TIMEOUT;          /* Configurable exec timeout (ms)   */
 u32 hang_tmout = EXEC_TIMEOUT;          /* Timeout used for hang det (ms)   */
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 027db2f0..3460f91d 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -76,6 +76,7 @@ static void usage(u8* argv0) {
       "Other stuff:\n"
       "  -T text       - text banner to show on the screen\n"
       "  -M / -S id    - distributed mode (see parallel_fuzzing.txt)\n"
+      "  -I command    - execute this command/script when a new crash is found\n"
       "  -B bitmap.txt - mutate a specific test case, use the out/fuzz_bitmap "
       "file\n"
       "  -C            - crash exploration mode (the peruvian rabbit thing)\n"
@@ -133,10 +134,15 @@ int main(int argc, char** argv) {
   init_seed = tv.tv_sec ^ tv.tv_usec ^ getpid();
 
   while ((opt = getopt(argc, argv,
-                       "+i:o:f:m:t:T:dnCB:S:M:x:QUWe:p:s:V:E:L:h")) > 0)
+                       "+i:I:o:f:m:t:T:dnCB:S:M:x:QUWe:p:s:V:E:L:h")) > 0)
 
     switch (opt) {
 
+      case 'I':
+
+        infoexec = optarg;
+        break;
+
       case 's': {
 
         init_seed = strtoul(optarg, 0L, 10);
diff --git a/test/test.sh b/test/test.sh
index 0fcb7087..44236b63 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -238,6 +238,7 @@ test -e ../afl-qemu-trace && {
   } || $ECHO "$RED[-] gcc compilation of test targets failed - what is going on??"
   
   $ECHO "$YELLOW[?] we need a test case for qemu_mode persistent mode"
+  $ECHO "$YELLOW[?] we need a test case for qemu_mode unsigaction library"
   # This works but there are already problems with persistent (e.g. stability)
   #$ECHO "$GREY[*] running afl-fuzz for persistent qemu_mode, this will take approx 10 seconds"
   #{