aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorvan Hauser <vh@thc.org>2020-05-13 16:49:00 +0200
committervan Hauser <vh@thc.org>2020-05-13 16:49:00 +0200
commit60a5df52623802ccadd0691b812761b3f4a9120e (patch)
tree1c1663227c13c422851aa33e21e4d25b92ce570a
parentc384a17b4181553d9e7c56fbafd6c8e934e6beed (diff)
downloadafl++-60a5df52623802ccadd0691b812761b3f4a9120e.tar.gz
code-format and slight -S/-M modifications
-rw-r--r--examples/custom_mutators/example.c7
-rw-r--r--include/afl-fuzz.h9
-rw-r--r--src/afl-fuzz-cmplog.c1
-rw-r--r--src/afl-fuzz-init.c42
-rw-r--r--src/afl-fuzz-mutators.c3
-rw-r--r--src/afl-fuzz-python.c9
-rw-r--r--src/afl-fuzz.c14
7 files changed, 46 insertions, 39 deletions
diff --git a/examples/custom_mutators/example.c b/examples/custom_mutators/example.c
index c9be3e0c..23add128 100644
--- a/examples/custom_mutators/example.c
+++ b/examples/custom_mutators/example.c
@@ -139,10 +139,11 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
* @return Size of the output buffer after processing or the needed amount.
* A return of 0 indicates an error.
*/
-size_t afl_custom_post_process(my_mutator_t *data, uint8_t *buf, size_t buf_size,
- uint8_t **out_buf) {
+size_t afl_custom_post_process(my_mutator_t *data, uint8_t *buf,
+ size_t buf_size, uint8_t **out_buf) {
- uint8_t *post_process_buf = maybe_grow(BUF_PARAMS(data, post_process), buf_size + 5);
+ uint8_t *post_process_buf =
+ maybe_grow(BUF_PARAMS(data, post_process), buf_size + 5);
if (!post_process_buf) {
perror("custom mutator realloc failed.");
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index cf8ef735..a1aa58d6 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -407,7 +407,9 @@ typedef struct afl_state {
no_unlink, /* do not unlink cur_input */
debug, /* Debug mode */
custom_only, /* Custom mutator only mode */
- python_only; /* Python-only mode */
+ python_only, /* Python-only mode */
+ is_master, /* if this is a master */
+ is_slave; /* if this is a slave */
u32 stats_update_freq; /* Stats update frequency (execs) */
@@ -418,7 +420,6 @@ typedef struct afl_state {
size_t (*radamsa_mutate_ptr)(u8 *, size_t, u8 *, size_t, u32);
u8 skip_deterministic, /* Skip deterministic stages? */
- force_deterministic, /* Force deterministic stages? */
use_splicing, /* Recombine input files? */
dumb_mode, /* Run in non-instrumented mode? */
score_changed, /* Scoring for favorites changed? */
@@ -547,7 +548,7 @@ typedef struct afl_state {
/* afl_postprocess API - Now supported via custom mutators */
- struct custom_mutator * post_library_mutator;
+ struct custom_mutator *post_library_mutator;
/* CmpLog */
@@ -674,7 +675,7 @@ struct custom_mutator {
* @return Size of the output buffer.
*/
size_t (*afl_custom_post_process)(void *data, u8 *buf, size_t buf_size,
- u8 **out_buf);
+ u8 **out_buf);
/**
* This method is called at the start of each trimming operation and receives
diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c
index 4be6a2c8..faf4dcb7 100644
--- a/src/afl-fuzz-cmplog.c
+++ b/src/afl-fuzz-cmplog.c
@@ -51,7 +51,6 @@ u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
u8 fault;
-
write_to_testcase(afl, out_buf, len);
fault = fuzz_run_target(afl, &afl->cmplog_fsrv, afl->fsrv.exec_tmout);
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index aea22f48..d468f2c8 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -297,14 +297,24 @@ void setup_post(afl_state_t *afl) {
dh = dlopen(fn, RTLD_NOW);
if (!dh) { FATAL("%s", dlerror()); }
- struct custom_mutator * mutator;
+ struct custom_mutator *mutator;
mutator = ck_alloc(sizeof(struct custom_mutator));
memset(mutator, 0, sizeof(struct custom_mutator));
mutator->afl_custom_post_process = dlsym(dh, "afl_postprocess");
- if (!mutator->afl_custom_post_process) { FATAL("Symbol 'afl_postprocess' not found."); }
+ if (!mutator->afl_custom_post_process) {
+
+ FATAL("Symbol 'afl_postprocess' not found.");
+
+ }
+
mutator->afl_custom_init = dlsym(dh, "afl_postprocess_init");
- if (!mutator->afl_custom_init) { FATAL("Symbol 'afl_postprocess_init' not found."); }
+ if (!mutator->afl_custom_init) {
+
+ FATAL("Symbol 'afl_postprocess_init' not found.");
+
+ }
+
mutator->afl_custom_deinit = dlsym(dh, "afl_postprocess_deinit");
if (!mutator->afl_custom_post_process) {
@@ -1373,6 +1383,17 @@ void setup_dirs_fds(afl_state_t *afl) {
}
+/*
+ if (afl->is_master) {
+
+ u8 *x = alloc_printf("%s/is_master", afl->sync_dir);
+ int fd = open(x, O_CREAT | O_RDWR, 0644);
+ if (fd < 0) FATAL("cannot create %s", x);
+ close(fd);
+
+ }
+*/
+
if (mkdir(afl->out_dir, 0700)) {
if (errno != EEXIST) { PFATAL("Unable to create '%s'", afl->out_dir); }
@@ -1861,14 +1882,6 @@ void fix_up_sync(afl_state_t *afl) {
if (afl->dumb_mode) { FATAL("-S / -M and -n are mutually exclusive"); }
- if (afl->skip_deterministic) {
-
- if (afl->force_deterministic) { FATAL("use -S instead of -M -d"); }
- // else
- // FATAL("-S already implies -d");
-
- }
-
while (*x) {
if (!isalnum(*x) && *x != '_' && *x != '-') {
@@ -1888,13 +1901,6 @@ void fix_up_sync(afl_state_t *afl) {
afl->sync_dir = afl->out_dir;
afl->out_dir = x;
- if (!afl->force_deterministic) {
-
- afl->skip_deterministic = 1;
- afl->use_splicing = 1;
-
- }
-
}
/* Handle screen resize (SIGWINCH). */
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index acc1b12d..87cb86fa 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -108,7 +108,8 @@ void setup_custom_mutators(afl_state_t *afl) {
#endif
- if (afl->post_library_mutator) list_append(&afl->custom_mutator_list, afl->post_library_mutator);
+ if (afl->post_library_mutator)
+ list_append(&afl->custom_mutator_list, afl->post_library_mutator);
}
diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c
index 2569cdaf..2044c97d 100644
--- a/src/afl-fuzz-python.c
+++ b/src/afl-fuzz-python.c
@@ -384,7 +384,8 @@ struct custom_mutator *load_custom_mutator_py(afl_state_t *afl,
}
-size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
+size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size,
+ u8 **out_buf) {
size_t py_out_buf_size;
PyObject * py_args, *py_value;
@@ -402,7 +403,8 @@ size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf)
PyTuple_SetItem(py_args, 0, py_value);
py_value = PyObject_CallObject(
- ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_PROCESS], py_args);
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_PROCESS],
+ py_args);
Py_DECREF(py_args);
@@ -412,7 +414,8 @@ size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf)
ck_maybe_grow(BUF_PARAMS(post_process), py_out_buf_size);
- memcpy(py->post_process_buf, PyByteArray_AsString(py_value), py_out_buf_size);
+ memcpy(py->post_process_buf, PyByteArray_AsString(py_value),
+ py_out_buf_size);
Py_DECREF(py_value);
*out_buf = py->post_process_buf;
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 8075f03d..979ebfa3 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -390,7 +390,7 @@ int main(int argc, char **argv_orig, char **envp) {
}
- afl->force_deterministic = 1;
+ afl->is_master = 1;
}
@@ -400,6 +400,9 @@ int main(int argc, char **argv_orig, char **envp) {
if (afl->sync_id) { FATAL("Multiple -S or -M options not supported"); }
afl->sync_id = ck_strdup(optarg);
+ afl->is_slave = 1;
+ afl->skip_deterministic = 1;
+ afl->use_splicing = 1;
break;
case 'f': /* target file */
@@ -500,12 +503,6 @@ int main(int argc, char **argv_orig, char **envp) {
case 'd': /* skip deterministic */
- if (afl->skip_deterministic) {
-
- FATAL("Multiple -d options not supported");
-
- }
-
afl->skip_deterministic = 1;
afl->use_splicing = 1;
break;
@@ -794,8 +791,7 @@ int main(int argc, char **argv_orig, char **envp) {
OKF("afl-tmin fork server patch from github.com/nccgroup/TriforceAFL");
OKF("MOpt Mutator from github.com/puppet-meteor/MOpt-AFL");
- if (afl->sync_id && afl->force_deterministic &&
- afl->afl_env.afl_custom_mutator_only) {
+ if (afl->sync_id && afl->is_master && afl->afl_env.afl_custom_mutator_only) {
WARNF(
"Using -M master with the AFL_CUSTOM_MUTATOR_ONLY mutator options will "