diff options
author | van Hauser <vh@thc.org> | 2019-10-04 10:33:28 +0200 |
---|---|---|
committer | van Hauser <vh@thc.org> | 2019-10-04 10:33:28 +0200 |
commit | 9c105098ddbb5f65a24063f08ed34d09aec36b04 (patch) | |
tree | e7c1e0d6db0c04ea41719c979dc13829e1adeeaa | |
parent | 9af6395e92a0f5aafcbd5e58b12a162fa7fe5d8c (diff) | |
download | afl++-9c105098ddbb5f65a24063f08ed34d09aec36b04.tar.gz |
general maintance
-rw-r--r-- | TODO | 6 | ||||
-rw-r--r-- | docs/ChangeLog | 1 | ||||
-rw-r--r-- | include/afl-fuzz.h | 6 | ||||
-rw-r--r-- | llvm_mode/afl-llvm-pass.so.cc | 10 | ||||
-rw-r--r-- | llvm_mode/split-compares-pass.so.cc | 278 | ||||
-rw-r--r-- | qemu_mode/patches/afl-qemu-cpu-inl.h | 12 | ||||
-rw-r--r-- | src/afl-fuzz-globals.c | 5 | ||||
-rw-r--r-- | src/afl-fuzz-init.c | 39 | ||||
-rw-r--r-- | src/afl-fuzz-one.c | 13 | ||||
-rw-r--r-- | src/afl-fuzz-run.c | 38 | ||||
-rw-r--r-- | src/afl-gotcpu.c | 27 | ||||
-rwxr-xr-x | test/test.sh | 2 |
12 files changed, 280 insertions, 157 deletions
diff --git a/TODO b/TODO index 4aa3dc8b..40828168 100644 --- a/TODO +++ b/TODO @@ -2,6 +2,9 @@ Roadmap 2.55d: ============== +afl-fuzz: + - radamsa mutator + gcc_plugin: - needs to be rewritten - whitelist support @@ -18,7 +21,8 @@ qemu_mode: custom_mutators: - rip what Superion is doing into custom mutators for js, php, etc. -unit testing / or large testcase campaign +enhance test/test.sh script for checking if compcov features are working +correctly (especially float splitting) The far away future: diff --git a/docs/ChangeLog b/docs/ChangeLog index 0b945d36..205330b3 100644 --- a/docs/ChangeLog +++ b/docs/ChangeLog @@ -32,6 +32,7 @@ Version ++2.54d (dev): and saves all mutations of the first run on the first file into out/queue/mutations - libtokencap and libdislocator now compile to the afl_root directory and are installed to the .../lib/afl directory when present during make install + - more BSD support, e.g. free CPU binding code for FreeBSD (thanks to devnexen) - reducing duplicate code in afl-fuzz - added "make help" - removed compile warnings from python internal stuff diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index ff26c894..e45a9d84 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -78,7 +78,7 @@ /* For systems that have sched_setaffinity; right now just Linux, but one can hope... */ -#if defined (__linux__) || defined(__FreeBSD__) +#if defined(__linux__) || defined(__FreeBSD__) #define HAVE_AFFINITY 1 #if defined(__FreeBSD__) #include <sys/cpuset.h> @@ -690,8 +690,8 @@ static u64 get_cur_time_us(void) { } #ifdef _AFL_DOCUMENT_MUTATIONS - extern u8 do_document; - extern u32 document_counter; +extern u8 do_document; +extern u32 document_counter; #endif #endif diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc index ae7b566b..3ca5ccc4 100644 --- a/llvm_mode/afl-llvm-pass.so.cc +++ b/llvm_mode/afl-llvm-pass.so.cc @@ -105,7 +105,9 @@ bool AFLCoverage::runOnModule(Module &M) { SAYF(cCYA "afl-llvm-pass" VERSION cRST " by <lszekeres@google.com>\n"); - } else if (getenv("AFL_QUIET")) be_quiet = 1; + } else if (getenv("AFL_QUIET")) + + be_quiet = 1; /* Decide instrumentation ratio */ @@ -222,9 +224,9 @@ bool AFLCoverage::runOnModule(Module &M) { cur_loc = AFL_R(MAP_SIZE); /* There is a problem with Ubuntu 18.04 and llvm 6.0 (see issue #63). - The inline function successors() is not inlined and also not found at runtime :-( - As I am unable to detect Ubuntu18.04 heree, the next best thing is to disable - this optional optimization for LLVM 6.0.0 and Linux */ + The inline function successors() is not inlined and also not found at runtime + :-( As I am unable to detect Ubuntu18.04 heree, the next best thing is to + disable this optional optimization for LLVM 6.0.0 and Linux */ #if !(LLVM_VERSION_MAJOR == 6 && LLVM_VERSION_MINOR == 0) || !defined __linux__ // only instrument if this basic block is the destination of a previous // basic block that has multiple successors diff --git a/llvm_mode/split-compares-pass.so.cc b/llvm_mode/split-compares-pass.so.cc index e97c2e7b..0595c682 100644 --- a/llvm_mode/split-compares-pass.so.cc +++ b/llvm_mode/split-compares-pass.so.cc @@ -52,8 +52,8 @@ class SplitComparesTransform : public ModulePass { private: size_t splitIntCompares(Module &M, unsigned bitw); size_t splitFPCompares(Module &M); - bool simplifyCompares(Module &M); - bool simplifyIntSignedness(Module &M); + bool simplifyCompares(Module &M); + bool simplifyIntSignedness(Module &M); size_t nextPowerOfTwo(size_t in); }; @@ -294,7 +294,11 @@ bool SplitComparesTransform::simplifyIntSignedness(Module &M) { if (!intTyOp0 || !intTyOp1) { continue; } /* i think this is not possible but to lazy to look it up */ - if (intTyOp0->getBitWidth() != intTyOp1->getBitWidth()) { continue; } + if (intTyOp0->getBitWidth() != intTyOp1->getBitWidth()) { + + continue; + + } icomps.push_back(selectcmpInst); @@ -412,30 +416,36 @@ bool SplitComparesTransform::simplifyIntSignedness(Module &M) { } size_t SplitComparesTransform::nextPowerOfTwo(size_t in) { + --in; in |= in >> 1; in |= in >> 2; in |= in >> 4; -// in |= in >> 8; -// in |= in >> 16; + // in |= in >> 8; + // in |= in >> 16; return in + 1; + } /* splits fcmps into two nested fcmps with sign compare and the rest */ size_t SplitComparesTransform::splitFPCompares(Module &M) { + size_t count = 0; LLVMContext &C = M.getContext(); const DataLayout &dl = M.getDataLayout(); - /* define unions with floating point and (sign, exponent, mantissa) triples */ + /* define unions with floating point and (sign, exponent, mantissa) triples + */ if (dl.isLittleEndian()) { - } - else if (dl.isBigEndian()) { - } - else { + + } else if (dl.isBigEndian()) { + + } else { + return count; + } std::vector<CmpInst *> fcomps; @@ -477,6 +487,7 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) { } } + if (!fcomps.size()) { return count; } IntegerType *Int1Ty = IntegerType::getInt1Ty(C); @@ -492,37 +503,42 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) { op0_size = op0->getType()->getPrimitiveSizeInBits(); op1_size = op1->getType()->getPrimitiveSizeInBits(); - if (op0_size != op1_size) { - continue; - } + if (op0_size != op1_size) { continue; } const unsigned int sizeInBits = op0->getType()->getPrimitiveSizeInBits(); - const unsigned int precision = sizeInBits == 32 ? 24 : - sizeInBits == 64 ? 53 : - sizeInBits == 128 ? 113 : - sizeInBits == 16 ? 11 : - 65; - - const unsigned shiftR_exponent = precision - 1; - const unsigned long long mask_fraction = ((1 << (precision - 2))) | ((1 << (precision - 2)) - 1); - const unsigned long long mask_exponent = (1 << (sizeInBits - precision)) - 1; + const unsigned int precision = + sizeInBits == 32 + ? 24 + : sizeInBits == 64 + ? 53 + : sizeInBits == 128 ? 113 : sizeInBits == 16 ? 11 : 65; + + const unsigned shiftR_exponent = precision - 1; + const unsigned long long mask_fraction = + ((1 << (precision - 2))) | ((1 << (precision - 2)) - 1); + const unsigned long long mask_exponent = + (1 << (sizeInBits - precision)) - 1; // round up sizes to the next power of two // this should help with integer compare splitting size_t exTySizeBytes = ((sizeInBits - precision + 7) >> 3); - size_t frTySizeBytes = ((precision - 1 + 7) >> 3); + size_t frTySizeBytes = ((precision - 1 + 7) >> 3); - IntegerType *IntExponentTy = IntegerType::get(C, nextPowerOfTwo(exTySizeBytes) << 3); - IntegerType *IntFractionTy = IntegerType::get(C, nextPowerOfTwo(frTySizeBytes) << 3); + IntegerType *IntExponentTy = + IntegerType::get(C, nextPowerOfTwo(exTySizeBytes) << 3); + IntegerType *IntFractionTy = + IntegerType::get(C, nextPowerOfTwo(frTySizeBytes) << 3); BasicBlock *end_bb = bb->splitBasicBlock(BasicBlock::iterator(FcmpInst)); /* create the integers from floats directly */ Instruction *b_op0, *b_op1; - b_op0 = CastInst::Create(Instruction::BitCast, op0, IntegerType::get(C, op0_size)); + b_op0 = CastInst::Create(Instruction::BitCast, op0, + IntegerType::get(C, op0_size)); bb->getInstList().insert(bb->getTerminator()->getIterator(), b_op0); - b_op1 = CastInst::Create(Instruction::BitCast, op1, IntegerType::get(C, op1_size)); + b_op1 = CastInst::Create(Instruction::BitCast, op1, + IntegerType::get(C, op1_size)); bb->getInstList().insert(bb->getTerminator()->getIterator(), b_op1); /* isolate signs of value of floating point type */ @@ -531,31 +547,34 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) { * the original operands so only the first bit remains.*/ Instruction *s_s0, *t_s0, *s_s1, *t_s1, *icmp_sign_bit; - s_s0 = BinaryOperator::Create(Instruction::LShr, b_op0, - ConstantInt::get(b_op0->getType(), op0_size - 1)); + s_s0 = BinaryOperator::Create( + Instruction::LShr, b_op0, + ConstantInt::get(b_op0->getType(), op0_size - 1)); bb->getInstList().insert(bb->getTerminator()->getIterator(), s_s0); t_s0 = new TruncInst(s_s0, Int1Ty); bb->getInstList().insert(bb->getTerminator()->getIterator(), t_s0); - s_s1 = BinaryOperator::Create(Instruction::LShr, b_op1, - ConstantInt::get(b_op1->getType(), op1_size - 1)); + s_s1 = BinaryOperator::Create( + Instruction::LShr, b_op1, + ConstantInt::get(b_op1->getType(), op1_size - 1)); bb->getInstList().insert(bb->getTerminator()->getIterator(), s_s1); t_s1 = new TruncInst(s_s1, Int1Ty); bb->getInstList().insert(bb->getTerminator()->getIterator(), t_s1); /* compare of the sign bits */ - icmp_sign_bit = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_s0, t_s1); + icmp_sign_bit = + CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_s0, t_s1); bb->getInstList().insert(bb->getTerminator()->getIterator(), icmp_sign_bit); /* create a new basic block which is executed if the signedness bits are * equal */ - BasicBlock * signequal_bb = + BasicBlock *signequal_bb = BasicBlock::Create(C, "signequal", end_bb->getParent(), end_bb); BranchInst::Create(end_bb, signequal_bb); /* create a new bb which is executed if exponents are equal */ - BasicBlock * middle_bb = + BasicBlock *middle_bb = BasicBlock::Create(C, "injected", end_bb->getParent(), end_bb); BranchInst::Create(end_bb, middle_bb); @@ -570,128 +589,187 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) { /* isolate the exponents */ Instruction *s_e0, *m_e0, *t_e0, *s_e1, *m_e1, *t_e1; - s_e0 = BinaryOperator::Create(Instruction::LShr, b_op0, ConstantInt::get(b_op0->getType(), shiftR_exponent)); - s_e1 = BinaryOperator::Create(Instruction::LShr, b_op1, ConstantInt::get(b_op1->getType(), shiftR_exponent)); - signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), s_e0); - signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), s_e1); + s_e0 = BinaryOperator::Create( + Instruction::LShr, b_op0, + ConstantInt::get(b_op0->getType(), shiftR_exponent)); + s_e1 = BinaryOperator::Create( + Instruction::LShr, b_op1, + ConstantInt::get(b_op1->getType(), shiftR_exponent)); + signequal_bb->getInstList().insert( + signequal_bb->getTerminator()->getIterator(), s_e0); + signequal_bb->getInstList().insert( + signequal_bb->getTerminator()->getIterator(), s_e1); t_e0 = new TruncInst(s_e0, IntExponentTy); t_e1 = new TruncInst(s_e1, IntExponentTy); - signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), t_e0); - signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), t_e1); + signequal_bb->getInstList().insert( + signequal_bb->getTerminator()->getIterator(), t_e0); + signequal_bb->getInstList().insert( + signequal_bb->getTerminator()->getIterator(), t_e1); if (sizeInBits - precision < exTySizeBytes * 8) { - m_e0 = BinaryOperator::Create(Instruction::And, t_e0, ConstantInt::get(t_e0->getType(), mask_exponent)); - m_e1 = BinaryOperator::Create(Instruction::And, t_e1, ConstantInt::get(t_e1->getType(), mask_exponent)); - signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), m_e0); - signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), m_e1); + + m_e0 = BinaryOperator::Create( + Instruction::And, t_e0, + ConstantInt::get(t_e0->getType(), mask_exponent)); + m_e1 = BinaryOperator::Create( + Instruction::And, t_e1, + ConstantInt::get(t_e1->getType(), mask_exponent)); + signequal_bb->getInstList().insert( + signequal_bb->getTerminator()->getIterator(), m_e0); + signequal_bb->getInstList().insert( + signequal_bb->getTerminator()->getIterator(), m_e1); + } else { + m_e0 = t_e0; m_e1 = t_e1; + } + /* compare the exponents of the operands */ Instruction *icmp_exponent_result; switch (FcmpInst->getPredicate()) { + case CmpInst::FCMP_OEQ: icmp_exponent_result = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, m_e0, m_e1); - break; + break; case CmpInst::FCMP_ONE: case CmpInst::FCMP_UNE: icmp_exponent_result = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_NE, m_e0, m_e1); - break; + break; case CmpInst::FCMP_OGT: Instruction *icmp_exponent; icmp_exponent = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_UGT, m_e0, m_e1); - signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), icmp_exponent); - icmp_exponent_result = BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0); - break; + signequal_bb->getInstList().insert( + signequal_bb->getTerminator()->getIterator(), icmp_exponent); + icmp_exponent_result = + BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0); + break; case CmpInst::FCMP_OLT: icmp_exponent = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_ULT, m_e0, m_e1); - signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), icmp_exponent); - icmp_exponent_result = BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0); - break; - default: - continue; + signequal_bb->getInstList().insert( + signequal_bb->getTerminator()->getIterator(), icmp_exponent); + icmp_exponent_result = + BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0); + break; + default: continue; + } - signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), icmp_exponent_result); + + signequal_bb->getInstList().insert( + signequal_bb->getTerminator()->getIterator(), icmp_exponent_result); { - auto term = signequal_bb->getTerminator(); - /* if the exponents are different do a fraction cmp */ - BranchInst::Create(middle_bb, end_bb, icmp_exponent_result, signequal_bb); - term->eraseFromParent(); - } + auto term = signequal_bb->getTerminator(); + /* if the exponents are different do a fraction cmp */ + BranchInst::Create(middle_bb, end_bb, icmp_exponent_result, signequal_bb); + term->eraseFromParent(); + + } /* isolate the mantissa aka fraction */ Instruction *t_f0, *t_f1; - bool needTrunc = IntFractionTy->getPrimitiveSizeInBits() < op0_size; -//errs() << "Fractions: IntFractionTy size " << IntFractionTy->getPrimitiveSizeInBits() << ", op0_size " << op0_size << ", needTrunc " << needTrunc << "\n"; + bool needTrunc = IntFractionTy->getPrimitiveSizeInBits() < op0_size; + // errs() << "Fractions: IntFractionTy size " << + // IntFractionTy->getPrimitiveSizeInBits() << ", op0_size " << op0_size << ", + // needTrunc " << needTrunc << "\n"; if (precision - 1 < frTySizeBytes * 8) { + Instruction *m_f0, *m_f1; - m_f0 = BinaryOperator::Create(Instruction::And, b_op0, ConstantInt::get(b_op0->getType(), mask_fraction)); - m_f1 = BinaryOperator::Create(Instruction::And, b_op1, ConstantInt::get(b_op1->getType(), mask_fraction)); - middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), m_f0); - middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), m_f1); + m_f0 = BinaryOperator::Create( + Instruction::And, b_op0, + ConstantInt::get(b_op0->getType(), mask_fraction)); + m_f1 = BinaryOperator::Create( + Instruction::And, b_op1, + ConstantInt::get(b_op1->getType(), mask_fraction)); + middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), + m_f0); + middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), + m_f1); if (needTrunc) { + t_f0 = new TruncInst(m_f0, IntFractionTy); t_f1 = new TruncInst(m_f1, IntFractionTy); - middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f0); - middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f1); + middle_bb->getInstList().insert( + middle_bb->getTerminator()->getIterator(), t_f0); + middle_bb->getInstList().insert( + middle_bb->getTerminator()->getIterator(), t_f1); + } else { + t_f0 = m_f0; t_f1 = m_f1; + } + } else { + if (needTrunc) { + t_f0 = new TruncInst(b_op0, IntFractionTy); t_f1 = new TruncInst(b_op1, IntFractionTy); - middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f0); - middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f1); + middle_bb->getInstList().insert( + middle_bb->getTerminator()->getIterator(), t_f0); + middle_bb->getInstList().insert( + middle_bb->getTerminator()->getIterator(), t_f1); + } else { + t_f0 = b_op0; t_f1 = b_op1; + } + } /* compare the fractions of the operands */ Instruction *icmp_fraction_result; switch (FcmpInst->getPredicate()) { + case CmpInst::FCMP_OEQ: icmp_fraction_result = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_f0, t_f1); - break; + break; case CmpInst::FCMP_UNE: case CmpInst::FCMP_ONE: icmp_fraction_result = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_NE, t_f0, t_f1); - break; + break; case CmpInst::FCMP_OGT: Instruction *icmp_fraction; icmp_fraction = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_UGT, t_f0, t_f1); - middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), icmp_fraction); - icmp_fraction_result = BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0); - break; + middle_bb->getInstList().insert( + middle_bb->getTerminator()->getIterator(), icmp_fraction); + icmp_fraction_result = + BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0); + break; case CmpInst::FCMP_OLT: icmp_fraction = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_ULT, t_f0, t_f1); - middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), icmp_fraction); - icmp_fraction_result = BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0); - break; - default: - continue; + middle_bb->getInstList().insert( + middle_bb->getTerminator()->getIterator(), icmp_fraction); + icmp_fraction_result = + BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0); + break; + default: continue; + } - middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), icmp_fraction_result); + + middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), + icmp_fraction_result); PHINode *PN = PHINode::Create(Int1Ty, 3, ""); switch (FcmpInst->getPredicate()) { + case CmpInst::FCMP_OEQ: /* unequal signs cannot be equal values */ /* goto false branch */ @@ -700,7 +778,7 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) { PN->addIncoming(ConstantInt::get(Int1Ty, 0), signequal_bb); /* fractions comparison */ PN->addIncoming(icmp_fraction_result, middle_bb); - break; + break; case CmpInst::FCMP_ONE: case CmpInst::FCMP_UNE: /* unequal signs are unequal values */ @@ -710,28 +788,29 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) { PN->addIncoming(ConstantInt::get(Int1Ty, 1), signequal_bb); /* fractions comparison */ PN->addIncoming(icmp_fraction_result, middle_bb); - break; + break; case CmpInst::FCMP_OGT: - /* if op1 is negative goto true branch, + /* if op1 is negative goto true branch, else go on comparing */ PN->addIncoming(t_s1, bb); PN->addIncoming(icmp_exponent_result, signequal_bb); PN->addIncoming(icmp_fraction_result, middle_bb); - break; + break; case CmpInst::FCMP_OLT: /* if op0 is negative goto true branch, else go on comparing */ PN->addIncoming(t_s0, bb); PN->addIncoming(icmp_exponent_result, signequal_bb); PN->addIncoming(icmp_fraction_result, middle_bb); - break; - default: - continue; + break; + default: continue; + } BasicBlock::iterator ii(FcmpInst); ReplaceInstWithInst(FcmpInst->getParent()->getInstList(), ii, PN); ++count; + } return count; @@ -740,6 +819,7 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) { /* splits icmps of size bitw into two nested icmps with bitw/2 size each */ size_t SplitComparesTransform::splitIntCompares(Module &M, unsigned bitw) { + size_t count = 0; LLVMContext &C = M.getContext(); @@ -755,7 +835,7 @@ size_t SplitComparesTransform::splitIntCompares(Module &M, unsigned bitw) { /* not supported yet */ if (bitw > 64) { return 0; } - /* get all EQ, NE, UGT, and ULT icmps of width bitw. if the + /* get all EQ, NE, UGT, and ULT icmps of width bitw. if the * functions simplifyCompares() and simplifyIntSignedness() * were executed only these four predicates should exist */ for (auto &F : M) { @@ -938,7 +1018,9 @@ size_t SplitComparesTransform::splitIntCompares(Module &M, unsigned bitw) { ReplaceInstWithInst(IcmpInst->getParent()->getInstList(), ii, PN); } + ++count; + } return count; @@ -958,27 +1040,29 @@ bool SplitComparesTransform::runOnModule(Module &M) { simplifyIntSignedness(M); if (getenv("AFL_QUIET") == NULL) - errs() << "Split-compare-pass by laf.intel@gmail.com, extended by heiko@hexco.de\n"; + errs() << "Split-compare-pass by laf.intel@gmail.com, extended by " + "heiko@hexco.de\n"; - errs() << "Split-floatingpoint-compare-pass: " << splitFPCompares(M) << " FP comparisons splitted\n"; + errs() << "Split-floatingpoint-compare-pass: " << splitFPCompares(M) + << " FP comparisons splitted\n"; switch (bitw) { case 64: - errs() << "Split-integer-compare-pass " << bitw << "bit: " - << splitIntCompares(M, bitw) << " splitted\n"; + errs() << "Split-integer-compare-pass " << bitw + << "bit: " << splitIntCompares(M, bitw) << " splitted\n"; bitw >>= 1; [[clang::fallthrough]]; /*FALLTHRU*/ /* FALLTHROUGH */ case 32: - errs() << "Split-integer-compare-pass " << bitw << "bit: " - << splitIntCompares(M, bitw) << " splitted\n"; + errs() << "Split-integer-compare-pass " << bitw + << "bit: " << splitIntCompares(M, bitw) << " splitted\n"; bitw >>= 1; [[clang::fallthrough]]; /*FALLTHRU*/ /* FALLTHROUGH */ case 16: - errs() << "Split-integer-compare-pass " << bitw << "bit: " - << splitIntCompares(M, bitw) << " splitted\n"; + errs() << "Split-integer-compare-pass " << bitw + << "bit: " << splitIntCompares(M, bitw) << " splitted\n"; bitw >>= 1; break; diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h index cfea04d6..209944ee 100644 --- a/qemu_mode/patches/afl-qemu-cpu-inl.h +++ b/qemu_mode/patches/afl-qemu-cpu-inl.h @@ -185,7 +185,7 @@ static void afl_setup(void) { afl_end_code = (abi_ulong)-1; } - + if (getenv("AFL_CODE_START")) afl_start_code = strtoll(getenv("AFL_CODE_START"), NULL, 16); if (getenv("AFL_CODE_END")) @@ -216,12 +216,12 @@ static void afl_setup(void) { /* If AFL_QEMU_PERSISTENT_RET is not specified patch the return addr */ } - - if (getenv("AFL_QEMU_PERSISTENT_GPR")) - persistent_save_gpr = 1; - + + if (getenv("AFL_QEMU_PERSISTENT_GPR")) persistent_save_gpr = 1; + if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET")) - persisent_retaddr_offset = strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 16); + persisent_retaddr_offset = + strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 16); if (getenv("AFL_QEMU_PERSISTENT_CNT")) afl_persistent_cnt = strtoll(getenv("AFL_QEMU_PERSISTENT_CNT"), NULL, 16); diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c index 01b242b8..a8c17922 100644 --- a/src/afl-fuzz-globals.c +++ b/src/afl-fuzz-globals.c @@ -260,6 +260,7 @@ PyObject *py_functions[PY_FUNC_COUNT]; #endif #ifdef _AFL_DOCUMENT_MUTATIONS - u8 do_document; - u32 document_counter; +u8 do_document; +u32 document_counter; #endif + diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index cb340107..12dcafae 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -32,7 +32,7 @@ void bind_to_free_cpu(void) { - cpu_set_t c; + cpu_set_t c; u8 cpu_used[4096] = {0}; u32 i; @@ -114,28 +114,34 @@ void bind_to_free_cpu(void) { closedir(d); #elif defined(__FreeBSD__) - struct kinfo_proc *procs; - size_t nprocs; - size_t proccount; - int s_name[] = {CTL_KERN, KERN_PROC, KERN_PROC_ALL}; - size_t s_name_l = sizeof(s_name)/sizeof(s_name[0]); + struct kinfo_proc* procs; + size_t nprocs; + size_t proccount; + int s_name[] = {CTL_KERN, KERN_PROC, KERN_PROC_ALL}; + size_t s_name_l = sizeof(s_name) / sizeof(s_name[0]); if (sysctl(s_name, s_name_l, NULL, &nprocs, NULL, 0) != 0) return; proccount = nprocs / sizeof(*procs); - nprocs = nprocs * 4/3; + nprocs = nprocs * 4 / 3; procs = ck_alloc(nprocs); if (sysctl(s_name, s_name_l, procs, &nprocs, NULL, 0) != 0) { + ck_free(procs); return; + } - for (i = 0; i < proccount; i ++) { - if (procs[i].ki_oncpu < sizeof(cpu_used)) - cpu_used[procs[i].ki_oncpu] = 1; + for (i = 0; i < proccount; i++) { + + if (procs[i].ki_oncpu < sizeof(cpu_used)) cpu_used[procs[i].ki_oncpu] = 1; + } ck_free(procs); +#else +#warning \ + "For this platform we do not have free CPU binding code yet. If poxxible, please supply a PR to https://github.com/vanhauser-thc/AFLplusplus" #endif for (i = 0; i < cpu_core_count; ++i) @@ -166,7 +172,10 @@ void bind_to_free_cpu(void) { #if defined(__linux__) if (sched_setaffinity(0, sizeof(c), &c)) PFATAL("sched_setaffinity failed"); #elif defined(__FreeBSD__) - if (pthread_setaffinity_np(pthread_self(), sizeof(c), &c)) PFATAL("pthread_setaffinity failed"); + if (pthread_setaffinity_np(pthread_self(), sizeof(c), &c)) + PFATAL("pthread_setaffinity failed"); +#else + // this will need something for other platforms #endif } @@ -815,7 +824,8 @@ double get_runnable_processes(void) { static double res; -#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) +#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || \ + defined(__NetBSD__) /* I don't see any portable sysctl or so that would quickly give us the number of runnable processes; the 1-minute load average can be a @@ -856,7 +866,7 @@ double get_runnable_processes(void) { } -#endif /* ^(__APPLE__ || __FreeBSD__ || __OpenBSD__ || __NetBSD__) */ +#endif /* ^(__APPLE__ || __FreeBSD__ || __OpenBSD__ || __NetBSD__) */ return res; @@ -1510,7 +1520,7 @@ void check_cpu_governor(void) { FATAL("Suboptimal CPU scaling governor"); #elif defined __APPLE__ - u64 min = 0, max = 0; + u64 min = 0, max = 0; size_t mlen = sizeof(min); if (getenv("AFL_SKIP_CPUFREQ")) return; @@ -1542,6 +1552,7 @@ void check_cpu_governor(void) { min / 1024, max / 1024); FATAL("Suboptimal CPU scaling governor"); #endif + } /* Count the number of logical CPU cores. */ diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c index 7db25254..31d58a10 100644 --- a/src/afl-fuzz-one.c +++ b/src/afl-fuzz-one.c @@ -4231,7 +4231,6 @@ pacemaker_fuzzing: #define core_fuzzing(a) common_fuzzing((a), MOpt_globals_core) - void pso_updating(void) { g_now += 1; @@ -4314,17 +4313,25 @@ u8 fuzz_one(char** argv) { #ifdef _AFL_DOCUMENT_MUTATIONS if (do_document == 0) { - char *fn = alloc_printf("%s/mutations", out_dir); + + char* fn = alloc_printf("%s/mutations", out_dir); if (fn) { - do_document = mkdir(fn, 0700); // if it exists we do not care + + do_document = mkdir(fn, 0700); // if it exists we do not care do_document = 1; ck_free(fn); + } else + PFATAL("malloc()"); + } else { + do_document = 2; stop_soon = 2; + } + #endif if (limit_time_sig == 0) { diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c index c0fa928e..46d12423 100644 --- a/src/afl-fuzz-run.c +++ b/src/afl-fuzz-run.c @@ -178,15 +178,21 @@ u8 run_target(char** argv, u32 timeout) { if ((res = read(fsrv_st_fd, &status, 4)) != 4) { if (stop_soon) return 0; - SAYF("\n" cLRD "[-] " cRST - "Unable to communicate with fork server. Some possible reasons:\n\n" - " - You've run out of memory. Use -m to increase the the memory limit\n" - " to something higher than %lld.\n" - " - The binary or one of the libraries it uses manages to create\n" - " threads before the forkserver initializes.\n" - " - The binary, at least in some circumstances, exits in a way that\n" - " also kills the parent process - raise() could be the culprit.\n\n" - "If all else fails you can disable the fork server via AFL_NO_FORKSRV=1.\n", mem_limit); + SAYF( + "\n" cLRD "[-] " cRST + "Unable to communicate with fork server. Some possible reasons:\n\n" + " - You've run out of memory. Use -m to increase the the memory " + "limit\n" + " to something higher than %lld.\n" + " - The binary or one of the libraries it uses manages to create\n" + " threads before the forkserver initializes.\n" + " - The binary, at least in some circumstances, exits in a way " + "that\n" + " also kills the parent process - raise() could be the " + "culprit.\n\n" + "If all else fails you can disable the fork server via " + "AFL_NO_FORKSRV=1.\n", + mem_limit); RPFATAL(res, "Unable to communicate with fork server"); } @@ -261,15 +267,23 @@ void write_to_testcase(void* mem, u32 len) { s32 fd = out_fd; #ifdef _AFL_DOCUMENT_MUTATIONS - s32 doc_fd; - char *fn = alloc_printf("%s/mutations/%09u:%s", out_dir, document_counter++, describe_op(0)); + s32 doc_fd; + char* fn = alloc_printf("%s/mutations/%09u:%s", out_dir, document_counter++, + describe_op(0)); if (fn != NULL) { + if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600)) >= 0) { - if (write(doc_fd, mem, len) != len) PFATAL("write to mutation file failed: %s", fn); + + if (write(doc_fd, mem, len) != len) + PFATAL("write to mutation file failed: %s", fn); close(doc_fd); + } + ck_free(fn); + } + #endif if (out_file) { diff --git a/src/afl-gotcpu.c b/src/afl-gotcpu.c index ece5a850..bdb727de 100644 --- a/src/afl-gotcpu.c +++ b/src/afl-gotcpu.c @@ -54,16 +54,16 @@ #if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__) #define HAVE_AFFINITY 1 -# if defined(__FreeBSD__) -# include <pthread.h> -# include <pthread_np.h> -# include <sys/cpuset.h> -# define cpu_set_t cpuset_t -# elif defined(__NetBSD__) -# include <pthread.h> -# include <sched.h> -# endif -#endif /* __linux__ || __FreeBSD__ || __NetBSD__ */ +#if defined(__FreeBSD__) +#include <pthread.h> +#include <pthread_np.h> +#include <sys/cpuset.h> +#define cpu_set_t cpuset_t +#elif defined(__NetBSD__) +#include <pthread.h> +#include <sched.h> +#endif +#endif /* __linux__ || __FreeBSD__ || __NetBSD__ */ /* Get unix time in microseconds. */ @@ -163,18 +163,17 @@ int main(int argc, char** argv) { if (!fr) { - u32 util_perc; + u32 util_perc; #if defined(__linux__) || defined(__FreeBSD__) cpu_set_t c; CPU_ZERO(&c); CPU_SET(i, &c); #elif defined(__NetBSD__) - cpuset_t *c; + cpuset_t* c; c = cpuset_create(); - if (c == NULL) - PFATAL("cpuset_create failed"); + if (c == NULL) PFATAL("cpuset_create failed"); cpuset_set(i, c); #endif diff --git a/test/test.sh b/test/test.sh index 0aa37c87..0fcb7087 100755 --- a/test/test.sh +++ b/test/test.sh @@ -179,7 +179,7 @@ test -e ../afl-clang-fast && { ../afl-clang-fast -o test-persistent ../experimental/persistent_demo/persistent_demo.c > /dev/null 2>&1 test -e test-persistent && { echo foo | ../afl-showmap -o /dev/null -q -r ./test-persistent && { - $ECHO "$GREEN[+] lvm_mode persistent mode feature works correctly" + $ECHO "$GREEN[+] llvm_mode persistent mode feature works correctly" } || $ECHO "$RED[!] llvm_mode persistent mode feature failed to work" } || $ECHO "$RED[!] llvm_mode persistent mode feature compilation failed" rm -f test-persistent |