aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDominik Maier <domenukk@gmail.com>2020-03-25 11:31:01 +0100
committervan Hauser <vh@thc.org>2020-03-27 11:06:06 +0100
commit6d3dc83c5dde31ccb74e04815a04b85b05761b30 (patch)
tree78d63856444d89ec91fd5634052867ec38a31f7c
parent89512d4e05e18d83b634adc00afdd8ad6fb94df5 (diff)
downloadafl++-6d3dc83c5dde31ccb74e04815a04b85b05761b30.tar.gz
code format
-rw-r--r--examples/custom_mutators/custom_mutator_helpers.h11
-rw-r--r--examples/custom_mutators/example.c29
-rw-r--r--include/afl-fuzz.h19
-rw-r--r--include/common.h25
-rw-r--r--llvm_mode/afl-clang-fast.c38
-rw-r--r--src/afl-fuzz-mutators.c22
-rw-r--r--src/afl-fuzz-one.c7
-rw-r--r--src/afl-fuzz-python.c46
-rw-r--r--src/afl-fuzz-queue.c3
-rw-r--r--src/afl-fuzz-run.c8
-rw-r--r--src/afl-fuzz-stats.c119
11 files changed, 175 insertions, 152 deletions
diff --git a/examples/custom_mutators/custom_mutator_helpers.h b/examples/custom_mutators/custom_mutator_helpers.h
index 844ccf94..cd3a15f0 100644
--- a/examples/custom_mutators/custom_mutator_helpers.h
+++ b/examples/custom_mutators/custom_mutator_helpers.h
@@ -7,11 +7,13 @@
#define RAND_BELOW(limit) (rand() % (limit))
-typedef struct{} afl_t;
+typedef struct {
+
+} afl_t;
static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
- static s8 interesting_8[] = {INTERESTING_8};
+ static s8 interesting_8[] = {INTERESTING_8};
static s16 interesting_16[] = {INTERESTING_8, INTERESTING_16};
static s32 interesting_32[] = {INTERESTING_8, INTERESTING_16, INTERESTING_32};
@@ -111,8 +113,8 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
(s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)];
break;
case 1:
- *(u64 *)(out_buf + byte_idx) =
- SWAP64((s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)]);
+ *(u64 *)(out_buf + byte_idx) = SWAP64(
+ (s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)]);
break;
}
@@ -266,3 +268,4 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
}
#endif
+
diff --git a/examples/custom_mutators/example.c b/examples/custom_mutators/example.c
index 560a5919..2df17dec 100644
--- a/examples/custom_mutators/example.c
+++ b/examples/custom_mutators/example.c
@@ -23,7 +23,6 @@ static const char *commands[] = {
};
-
typedef struct my_mutator {
afl_t *afl;
@@ -34,21 +33,26 @@ typedef struct my_mutator {
/**
* Initialize this custom mutator
*
- * @param[in] afl a pointer to the internal state object. Can be ignored for now.
- * @param[in] seed A seed for this mutator - the same seed should always mutate in the same way.
+ * @param[in] afl a pointer to the internal state object. Can be ignored for
+ * now.
+ * @param[in] seed A seed for this mutator - the same seed should always mutate
+ * in the same way.
* @return Pointer to the data object this custom mutator instance should use.
* There may be multiple instances of this mutator in one afl-fuzz run!
* Returns NULL on error.
*/
my_mutator_t *afl_custom_init(afl_t *afl, unsigned int seed) {
- srand(seed); // needed also by surgical_havoc_mutate()
+ srand(seed); // needed also by surgical_havoc_mutate()
my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
if (!data) {
+
perror("afl_custom_init alloc");
return NULL;
+
}
+
data->afl = afl;
return data;
@@ -71,8 +75,8 @@ my_mutator_t *afl_custom_init(afl_t *afl, unsigned int seed) {
*/
size_t afl_custom_fuzz(my_mutator_t *data, uint8_t **buf, size_t buf_size,
uint8_t *add_buf,
- size_t add_buf_size, // add_buf can be NULL
- size_t max_size) {
+ size_t add_buf_size, // add_buf can be NULL
+ size_t max_size) {
// Make sure that the packet size does not exceed the maximum size expected by
// the fuzzer
@@ -113,7 +117,8 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t **buf, size_t buf_size,
* will release the memory after saving the test case.
* @return Size of the output buffer after processing
*/
-size_t afl_custom_pre_save(my_mutator_t *data, uint8_t *buf, size_t buf_size, uint8_t **out_buf) {
+size_t afl_custom_pre_save(my_mutator_t *data, uint8_t *buf, size_t buf_size,
+ uint8_t **out_buf) {
size_t out_buf_size;
@@ -183,7 +188,8 @@ int afl_custom_init_trim(my_mutator_t *data, uint8_t *buf, size_t buf_size) {
* the memory after saving the test case.
* @param[out] out_buf_size Pointer to the size of the trimmed test case
*/
-void afl_custom_trim(my_mutator_t *data, uint8_t **out_buf, size_t *out_buf_size) {
+void afl_custom_trim(my_mutator_t *data, uint8_t **out_buf,
+ size_t *out_buf_size) {
*out_buf_size = trim_buf_size - 1;
@@ -233,8 +239,8 @@ int afl_custom_post_trim(my_mutator_t *data, int success) {
* not produce data larger than max_size.
* @return Size of the mutated output.
*/
-size_t afl_custom_havoc_mutation(my_mutator_t *data, uint8_t **buf, size_t buf_size,
- size_t max_size) {
+size_t afl_custom_havoc_mutation(my_mutator_t *data, uint8_t **buf,
+ size_t buf_size, size_t max_size) {
if (buf_size == 0) {
@@ -292,7 +298,8 @@ uint8_t afl_custom_queue_get(my_mutator_t *data, const uint8_t *filename) {
* @param filename_new_queue File name of the new queue entry
* @param filename_orig_queue File name of the original queue entry
*/
-void afl_custom_queue_new_entry(my_mutator_t *data, const uint8_t *filename_new_queue,
+void afl_custom_queue_new_entry(my_mutator_t * data,
+ const uint8_t *filename_new_queue,
const uint8_t *filename_orig_queue) {
/* Additional analysis on the original or new test case */
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 7dddefb0..d610ac29 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -290,8 +290,8 @@ typedef struct py_mutator {
PyObject *py_module;
PyObject *py_functions[PY_FUNC_COUNT];
- void *afl_state;
- void *py_data;
+ void * afl_state;
+ void * py_data;
} py_mutator_t;
@@ -592,7 +592,7 @@ struct custom_mutator {
const char *name;
void * dh;
- void *data; /* custom mutator data ptr */
+ void *data; /* custom mutator data ptr */
/* hooks for the custom mutator function */
@@ -620,8 +620,8 @@ struct custom_mutator {
* not produce data larger than max_size.
* @return Size of the mutated output.
*/
- size_t (*afl_custom_fuzz)(void *data, u8 **buf, size_t buf_size,
- u8 *add_buf, size_t add_buf_size, size_t max_size);
+ size_t (*afl_custom_fuzz)(void *data, u8 **buf, size_t buf_size, u8 *add_buf,
+ size_t add_buf_size, size_t max_size);
/**
* A post-processing function to use right before AFL writes the test case to
@@ -711,8 +711,8 @@ struct custom_mutator {
* not produce data larger than max_size.
* @return Size of the mutated output.
*/
- size_t (*afl_custom_havoc_mutation)(void *data, u8 **buf,
- size_t buf_size, size_t max_size);
+ size_t (*afl_custom_havoc_mutation)(void *data, u8 **buf, size_t buf_size,
+ size_t max_size);
/**
* Return the probability (in percentage) that afl_custom_havoc_mutation
@@ -748,9 +748,8 @@ struct custom_mutator {
* @param filename_orig_queue File name of the original queue entry. This
* argument can be NULL while initializing the fuzzer
*/
- void (*afl_custom_queue_new_entry)(void *data,
- const u8 * filename_new_queue,
- const u8 * filename_orig_queue);
+ void (*afl_custom_queue_new_entry)(void *data, const u8 *filename_new_queue,
+ const u8 *filename_orig_queue);
/**
* Deinitialize the custom mutator.
*
diff --git a/include/common.h b/include/common.h
index 97076004..8b21b55f 100644
--- a/include/common.h
+++ b/include/common.h
@@ -78,7 +78,7 @@ static u64 get_cur_time_us(void) {
Will return buf for convenience. */
static u8 *stringify_int(u8 *buf, size_t len, u64 val) {
-
+\
#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \
do { \
\
@@ -233,23 +233,22 @@ static u8 *stringify_time_diff(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) {
}
-
/* Unsafe Describe integer. The buf sizes are not checked.
This is unsafe but fast.
Will return buf for convenience. */
static u8 *u_stringify_int(u8 *buf, u64 val) {
-
-#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \
- do { \
- \
- if (val < (_divisor) * (_limit_mult)) { \
- \
- sprintf(buf, _fmt, ((_cast)val) / (_divisor)); \
- return buf; \
- \
- } \
- \
+\
+#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \
+ do { \
+ \
+ if (val < (_divisor) * (_limit_mult)) { \
+ \
+ sprintf(buf, _fmt, ((_cast)val) / (_divisor)); \
+ return buf; \
+ \
+ } \
+ \
} while (0)
/* 0-9999 */
diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c
index 34df5671..7050e22d 100644
--- a/llvm_mode/afl-clang-fast.c
+++ b/llvm_mode/afl-clang-fast.c
@@ -485,37 +485,37 @@ static void edit_params(u32 argc, char **argv) {
// if (maybe_linking) {
- if (x_set) {
+ if (x_set) {
- cc_params[cc_par_cnt++] = "-x";
- cc_params[cc_par_cnt++] = "none";
+ cc_params[cc_par_cnt++] = "-x";
+ cc_params[cc_par_cnt++] = "none";
- }
+ }
#ifndef __ANDROID__
- switch (bit_mode) {
+ switch (bit_mode) {
- case 0:
- cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt.o", obj_path);
- break;
+ case 0:
+ cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt.o", obj_path);
+ break;
- case 32:
- cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-32.o", obj_path);
+ case 32:
+ cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-32.o", obj_path);
- if (access(cc_params[cc_par_cnt - 1], R_OK))
- FATAL("-m32 is not supported by your compiler");
+ if (access(cc_params[cc_par_cnt - 1], R_OK))
+ FATAL("-m32 is not supported by your compiler");
- break;
+ break;
- case 64:
- cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-64.o", obj_path);
+ case 64:
+ cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-64.o", obj_path);
- if (access(cc_params[cc_par_cnt - 1], R_OK))
- FATAL("-m64 is not supported by your compiler");
+ if (access(cc_params[cc_par_cnt - 1], R_OK))
+ FATAL("-m64 is not supported by your compiler");
- break;
+ break;
- }
+ }
#endif
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 3e6ad466..0b0c3394 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -78,8 +78,7 @@ void destroy_custom_mutator(afl_state_t *afl) {
afl->mutator->afl_custom_deinit(afl->mutator->data);
- if (afl->mutator->dh)
- dlclose(afl->mutator->dh);
+ if (afl->mutator->dh) dlclose(afl->mutator->dh);
ck_free(afl->mutator);
afl->mutator = NULL;
@@ -103,11 +102,13 @@ void load_custom_mutator(afl_state_t *afl, const char *fn) {
/* Mutator */
/* "afl_custom_init", required */
afl->mutator->afl_custom_init = dlsym(dh, "afl_custom_init");
- if (!afl->mutator->afl_custom_init) FATAL("Symbol 'afl_custom_init' not found.");
+ if (!afl->mutator->afl_custom_init)
+ FATAL("Symbol 'afl_custom_init' not found.");
/* "afl_custom_deinit", required */
afl->mutator->afl_custom_deinit = dlsym(dh, "afl_custom_deinit");
- if (!afl->mutator->afl_custom_deinit) FATAL("Symbol 'afl_custom_deinit' not found.");
+ if (!afl->mutator->afl_custom_deinit)
+ FATAL("Symbol 'afl_custom_deinit' not found.");
/* "afl_custom_fuzz" or "afl_custom_mutator", required */
afl->mutator->afl_custom_fuzz = dlsym(dh, "afl_custom_fuzz");
@@ -198,7 +199,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
/* Initialize trimming in the custom mutator */
afl->stage_cur = 0;
- afl->stage_max = afl->mutator->afl_custom_init_trim(afl->mutator->data, in_buf, q->len);
+ afl->stage_max =
+ afl->mutator->afl_custom_init_trim(afl->mutator->data, in_buf, q->len);
if (afl->not_on_tty && afl->debug)
SAYF("[Custom Trimming] START: Max %d iterations, %u bytes", afl->stage_max,
@@ -206,7 +208,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
while (afl->stage_cur < afl->stage_max) {
- sprintf(afl->stage_name_buf, "ptrim %s", u_stringify_int(val_buf, trim_exec));
+ sprintf(afl->stage_name_buf, "ptrim %s",
+ u_stringify_int(val_buf, trim_exec));
u32 cksum;
@@ -250,7 +253,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
}
/* Tell the custom mutator that the trimming was successful */
- afl->stage_cur = afl->mutator->afl_custom_post_trim(afl->mutator->data, 1);
+ afl->stage_cur =
+ afl->mutator->afl_custom_post_trim(afl->mutator->data, 1);
if (afl->not_on_tty && afl->debug)
SAYF("[Custom Trimming] SUCCESS: %d/%d iterations (now at %u bytes)",
@@ -259,7 +263,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
} else {
/* Tell the custom mutator that the trimming was unsuccessful */
- afl->stage_cur = afl->mutator->afl_custom_post_trim(afl->mutator->data, 0);
+ afl->stage_cur =
+ afl->mutator->afl_custom_post_trim(afl->mutator->data, 0);
if (afl->not_on_tty && afl->debug)
SAYF("[Custom Trimming] FAILURE: %d/%d iterations", afl->stage_cur,
afl->stage_max);
@@ -304,3 +309,4 @@ abort_trimming:
return fault;
}
+
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index bcd9135a..7cc5e0d9 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -360,7 +360,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
/* The custom mutator will decide to skip this test case or not. */
- if (!afl->mutator->afl_custom_queue_get(afl->mutator->data, afl->queue_cur->fname))
+ if (!afl->mutator->afl_custom_queue_get(afl->mutator->data,
+ afl->queue_cur->fname))
return 1;
}
@@ -1723,8 +1724,8 @@ havoc_stage:
if (stacked_custom && rand_below(afl, 100) < stacked_custom_prob) {
- temp_len = afl->mutator->afl_custom_havoc_mutation(afl->mutator->data, &out_buf,
- temp_len, MAX_FILE);
+ temp_len = afl->mutator->afl_custom_havoc_mutation(
+ afl->mutator->data, &out_buf, temp_len, MAX_FILE);
}
diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c
index d3027d2b..418497d0 100644
--- a/src/afl-fuzz-python.c
+++ b/src/afl-fuzz-python.c
@@ -29,8 +29,10 @@
#ifdef USE_PYTHON
static void *unsupported(afl_state_t *afl, unsigned int seed) {
+
FATAL("Python Mutator cannot be called twice yet");
return NULL;
+
}
size_t fuzz_py(void *py_mutator, u8 **buf, size_t buf_size, u8 *add_buf,
@@ -77,7 +79,8 @@ size_t fuzz_py(void *py_mutator, u8 **buf, size_t buf_size, u8 *add_buf,
PyTuple_SetItem(py_args, 2, py_value);
- py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_FUZZ], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_FUZZ], py_args);
Py_DECREF(py_args);
@@ -99,7 +102,6 @@ size_t fuzz_py(void *py_mutator, u8 **buf, size_t buf_size, u8 *add_buf,
}
-
static py_mutator_t *init_py_module(afl_state_t *afl, u8 *module_name) {
if (!module_name) return NULL;
@@ -223,7 +225,8 @@ void finalize_py_module(void *py_mutator) {
}
-static void init_py(afl_state_t *afl, py_mutator_t *py_mutator, unsigned int seed) {
+static void init_py(afl_state_t *afl, py_mutator_t *py_mutator,
+ unsigned int seed) {
PyObject *py_args, *py_value;
@@ -244,7 +247,8 @@ static void init_py(afl_state_t *afl, py_mutator_t *py_mutator, unsigned int see
PyTuple_SetItem(py_args, 0, py_value);
- py_value = PyObject_CallObject(py_mutator->py_functions[PY_FUNC_INIT], py_args);
+ py_value =
+ PyObject_CallObject(py_mutator->py_functions[PY_FUNC_INIT], py_args);
Py_DECREF(py_args);
@@ -289,9 +293,7 @@ void load_custom_mutator_py(afl_state_t *afl, char *module_name) {
py_mutator_t *py_mutator;
py_mutator = init_py_module(afl, module_name);
- if (!py_mutator) {
- FATAL("Failed to load python mutator.");
- }
+ if (!py_mutator) { FATAL("Failed to load python mutator."); }
PyObject **py_functions = py_mutator->py_functions;
@@ -334,7 +336,6 @@ void load_custom_mutator_py(afl_state_t *afl, char *module_name) {
}
-
size_t pre_save_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
size_t out_buf_size;
@@ -350,7 +351,8 @@ size_t pre_save_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
PyTuple_SetItem(py_args, 0, py_value);
- py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_PRE_SAVE], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_PRE_SAVE], py_args);
Py_DECREF(py_args);
@@ -386,7 +388,8 @@ u32 init_trim_py(void *py_mutator, u8 *buf, size_t buf_size) {
PyTuple_SetItem(py_args, 0, py_value);
- py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_INIT_TRIM], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_INIT_TRIM], py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
@@ -424,7 +427,8 @@ u32 post_trim_py(void *py_mutator, u8 success) {
PyTuple_SetItem(py_args, 0, py_value);
- py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_TRIM], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_TRIM], py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
@@ -451,7 +455,8 @@ void trim_py(void *py_mutator, u8 **out_buf, size_t *out_buf_size) {
PyObject *py_args, *py_value;
py_args = PyTuple_New(0);
- py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_TRIM], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_TRIM], py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
@@ -503,8 +508,9 @@ size_t havoc_mutation_py(void *py_mutator, u8 **buf, size_t buf_size,
PyTuple_SetItem(py_args, 1, py_value);
- py_value =
- PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_HAVOC_MUTATION], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_HAVOC_MUTATION],
+ py_args);
Py_DECREF(py_args);
@@ -533,7 +539,9 @@ u8 havoc_mutation_probability_py(void *py_mutator) {
py_args = PyTuple_New(0);
py_value = PyObject_CallObject(
- ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_HAVOC_MUTATION_PROBABILITY], py_args);
+ ((py_mutator_t *)py_mutator)
+ ->py_functions[PY_FUNC_HAVOC_MUTATION_PROBABILITY],
+ py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
@@ -573,7 +581,8 @@ u8 queue_get_py(void *py_mutator, const u8 *filename) {
PyTuple_SetItem(py_args, 0, py_value);
// Call Python function
- py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_GET], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_GET], py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
@@ -642,8 +651,9 @@ void queue_new_entry_py(void *py_mutator, const u8 *filename_new_queue,
PyTuple_SetItem(py_args, 1, py_value);
// Call
- py_value =
- PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_NEW_ENTRY], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_NEW_ENTRY],
+ py_args);
Py_DECREF(py_args);
if (py_value == NULL) {
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index b036969f..73da449a 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -147,7 +147,8 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
/* At the initialization stage, queue_cur is NULL */
if (afl->queue_cur) fname_orig = afl->queue_cur->fname;
- afl->mutator->afl_custom_queue_new_entry(afl->mutator->data, fname, fname_orig);
+ afl->mutator->afl_custom_queue_new_entry(afl->mutator->data, fname,
+ fname_orig);
}
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 2b207a9e..e8ef3049 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -217,8 +217,8 @@ void write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
if (afl->mutator && afl->mutator->afl_custom_pre_save) {
u8 * new_data;
- size_t new_size =
- afl->mutator->afl_custom_pre_save(afl->mutator->data, mem, len, &new_data);
+ size_t new_size = afl->mutator->afl_custom_pre_save(afl->mutator->data, mem,
+ len, &new_data);
ck_write(fd, new_data, new_size, afl->fsrv.out_file);
free(new_data);
@@ -627,8 +627,8 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
u32 remove_pos = remove_len;
sprintf(afl->stage_name_buf, "trim %s/%s",
- u_stringify_int(val_bufs[0], remove_len),
- u_stringify_int(val_bufs[1], remove_len));
+ u_stringify_int(val_bufs[0], remove_len),
+ u_stringify_int(val_bufs[1], remove_len));
afl->stage_cur = 0;
afl->stage_max = q->len / remove_len;
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index dc16df8f..5536c201 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -361,9 +361,9 @@ void show_stats(afl_state_t *afl) {
/* Lord, forgive me this. */
- SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
+ SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
" process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA
- " overall results " bSTG bH2 bH2 bRT "\n");
+ " overall results " bSTG bH2 bH2 bRT "\n");
if (afl->dumb_mode) {
@@ -406,8 +406,7 @@ void show_stats(afl_state_t *afl) {
(afl->last_path_time || afl->resuming_fuzz || afl->queue_cycle == 1 ||
afl->in_bitmap || afl->crash_mode)) {
- u_stringify_time_diff(time_tmp, cur_ms,
- afl->last_path_time);
+ u_stringify_time_diff(time_tmp, cur_ms, afl->last_path_time);
SAYF(bV bSTOP " last new path : " cRST "%-33s ", time_tmp);
} else {
@@ -446,9 +445,9 @@ void show_stats(afl_state_t *afl) {
" uniq hangs : " cRST "%-6s" bSTG bV "\n",
time_tmp, tmp);
- SAYF(bVR bH bSTOP cCYA
+ SAYF(bVR bH bSTOP cCYA
" cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA
- " map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
+ " map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
/* This gets funny because we want to print several variable-length variables
together, but then cram them into a fixed-width field - so we need to
@@ -477,9 +476,9 @@ void show_stats(afl_state_t *afl) {
SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp);
- SAYF(bVR bH bSTOP cCYA
+ SAYF(bVR bH bSTOP cCYA
" stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
- " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
+ " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_favored),
((double)afl->queued_favored) * 100 / afl->queued_paths);
@@ -533,30 +532,27 @@ void show_stats(afl_state_t *afl) {
if (afl->stats_avg_exec < 100) {
- sprintf(tmp, "%s/sec (%s)",
- u_stringify_float(IB(0), afl->stats_avg_exec),
- afl->stats_avg_exec < 20 ? "zzzz..." : "slow!");
+ sprintf(tmp, "%s/sec (%s)", u_stringify_float(IB(0), afl->stats_avg_exec),
+ afl->stats_avg_exec < 20 ? "zzzz..." : "slow!");
SAYF(bV bSTOP " exec speed : " cLRD "%-20s ", tmp);
} else {
- sprintf(tmp, "%s/sec",
- u_stringify_float(IB(0), afl->stats_avg_exec));
+ sprintf(tmp, "%s/sec", u_stringify_float(IB(0), afl->stats_avg_exec));
SAYF(bV bSTOP " exec speed : " cRST "%-20s ", tmp);
}
- sprintf(tmp, "%s (%s%s unique)",
- u_stringify_int(IB(0), afl->total_tmouts),
- u_stringify_int(IB(1), afl->unique_tmouts),
- (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
+ sprintf(tmp, "%s (%s%s unique)", u_stringify_int(IB(0), afl->total_tmouts),
+ u_stringify_int(IB(1), afl->unique_tmouts),
+ (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
SAYF(bSTG bV bSTOP " total tmouts : " cRST "%-22s" bSTG bV "\n", tmp);
/* Aaaalmost there... hold on! */
- SAYF(bVR bH cCYA bSTOP
+ SAYF(bVR bH cCYA bSTOP
" fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA
" path geometry " bSTG bH5 bH2 bVL "\n");
@@ -567,12 +563,12 @@ void show_stats(afl_state_t *afl) {
} else {
sprintf(tmp, "%s/%s, %s/%s, %s/%s",
- u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP1]),
- u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP1]),
- u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP2]),
- u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP2]),
- u_stringify_int(IB(3), afl->stage_finds[STAGE_FLIP4]),
- u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP4]));
+ u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP1]),
+ u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP1]),
+ u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP2]),
+ u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP2]),
+ u_stringify_int(IB(3), afl->stage_finds[STAGE_FLIP4]),
+ u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP4]));
}
@@ -582,12 +578,12 @@ void show_stats(afl_state_t *afl) {
if (!afl->skip_deterministic)
sprintf(tmp, "%s/%s, %s/%s, %s/%s",
- u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP8]),
- u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP8]),
- u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP16]),
- u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP16]),
- u_stringify_int(IB(4), afl->stage_finds[STAGE_FLIP32]),
- u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP32]));
+ u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP8]),
+ u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP8]),
+ u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP16]),
+ u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP16]),
+ u_stringify_int(IB(4), afl->stage_finds[STAGE_FLIP32]),
+ u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP32]));
SAYF(bV bSTOP " byte flips : " cRST "%-36s " bSTG bV bSTOP
" pending : " cRST "%-10s" bSTG bV "\n",
@@ -595,12 +591,12 @@ void show_stats(afl_state_t *afl) {
if (!afl->skip_deterministic)
sprintf(tmp, "%s/%s, %s/%s, %s/%s",
- u_stringify_int(IB(0), afl->stage_finds[STAGE_ARITH8]),
- u_stringify_int(IB(1), afl->stage_cycles[STAGE_ARITH8]),
- u_stringify_int(IB(2), afl->stage_finds[STAGE_ARITH16]),
- u_stringify_int(IB(3), afl->stage_cycles[STAGE_ARITH16]),
- u_stringify_int(IB(4), afl->stage_finds[STAGE_ARITH32]),
- u_stringify_int(IB(5), afl->stage_cycles[STAGE_ARITH32]));
+ u_stringify_int(IB(0), afl->stage_finds[STAGE_ARITH8]),
+ u_stringify_int(IB(1), afl->stage_cycles[STAGE_ARITH8]),
+ u_stringify_int(IB(2), afl->stage_finds[STAGE_ARITH16]),
+ u_stringify_int(IB(3), afl->stage_cycles[STAGE_ARITH16]),
+ u_stringify_int(IB(4), afl->stage_finds[STAGE_ARITH32]),
+ u_stringify_int(IB(5), afl->stage_cycles[STAGE_ARITH32]));
SAYF(bV bSTOP " arithmetics : " cRST "%-36s " bSTG bV bSTOP
" pend fav : " cRST "%-10s" bSTG bV "\n",
@@ -621,25 +617,26 @@ void show_stats(afl_state_t *afl) {
if (!afl->skip_deterministic)
sprintf(tmp, "%s/%s, %s/%s, %s/%s",
- u_stringify_int(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]),
- u_stringify_int(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]),
- u_stringify_int(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]),
- u_stringify_int(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]),
- u_stringify_int(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]),
- u_stringify_int(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO]));
+ u_stringify_int(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]),
+ u_stringify_int(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]),
+ u_stringify_int(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]),
+ u_stringify_int(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]),
+ u_stringify_int(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]),
+ u_stringify_int(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO]));
SAYF(bV bSTOP " dictionary : " cRST "%-36s " bSTG bV bSTOP
" imported : " cRST "%-10s" bSTG bV "\n",
tmp,
- afl->sync_id ? u_stringify_int(IB(0), afl->queued_imported) : (u8 *)"n/a");
+ afl->sync_id ? u_stringify_int(IB(0), afl->queued_imported)
+ : (u8 *)"n/a");
sprintf(tmp, "%s/%s, %s/%s, %s/%s",
- u_stringify_int(IB(0), afl->stage_finds[STAGE_HAVOC]),
- u_stringify_int(IB(2), afl->stage_cycles[STAGE_HAVOC]),
- u_stringify_int(IB(3), afl->stage_finds[STAGE_SPLICE]),
- u_stringify_int(IB(4), afl->stage_cycles[STAGE_SPLICE]),
- u_stringify_int(IB(5), afl->stage_finds[STAGE_RADAMSA]),
- u_stringify_int(IB(6), afl->stage_cycles[STAGE_RADAMSA]));
+ u_stringify_int(IB(0), afl->stage_finds[STAGE_HAVOC]),
+ u_stringify_int(IB(2), afl->stage_cycles[STAGE_HAVOC]),
+ u_stringify_int(IB(3), afl->stage_finds[STAGE_SPLICE]),
+ u_stringify_int(IB(4), afl->stage_cycles[STAGE_SPLICE]),
+ u_stringify_int(IB(5), afl->stage_finds[STAGE_RADAMSA]),
+ u_stringify_int(IB(6), afl->stage_cycles[STAGE_RADAMSA]));
SAYF(bV bSTOP " havoc/rad : " cRST "%-36s " bSTG bV bSTOP, tmp);
@@ -660,14 +657,14 @@ void show_stats(afl_state_t *afl) {
if (afl->shm.cmplog_mode) {
sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s",
- u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
- u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
- u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
- u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]),
- u_stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]),
- u_stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]),
- u_stringify_int(IB(6), afl->stage_finds[STAGE_ITS]),
- u_stringify_int(IB(7), afl->stage_cycles[STAGE_ITS]));
+ u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
+ u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
+ u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
+ u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]),
+ u_stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]),
+ u_stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]),
+ u_stringify_int(IB(6), afl->stage_finds[STAGE_ITS]),
+ u_stringify_int(IB(7), afl->stage_cycles[STAGE_ITS]));
SAYF(bV bSTOP " custom/rq : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
tmp);
@@ -675,10 +672,10 @@ void show_stats(afl_state_t *afl) {
} else {
sprintf(tmp, "%s/%s, %s/%s",
- u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
- u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
- u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
- u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
+ u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
+ u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
+ u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
+ u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
SAYF(bV bSTOP " py/custom : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
tmp);