Merge pull request #806 from AFLplusplus/dev

Dev

5 files changed, 70 insertions, 54 deletions

diff --git a/README.md b/README.md
index c3c73f3f..0deaca22 100644
--- a/README.md
+++ b/README.md
@@ -546,12 +546,10 @@ If you need to stop and re-start the fuzzing, use the same command line options
 mutation mode!) and switch the input directory with a dash (`-`):
 `afl-fuzz -i - -o output -- bin/target -d @@`
 
-Note that afl-fuzz enforces memory limits to prevent the system to run out
-of memory. By default this is 50MB for a process. If this is too little for
-the target (which you can usually see by afl-fuzz bailing with the message
-that it could not connect to the forkserver), then you can increase this
-with the `-m` option, the value is in MB. To disable any memory limits
-(beware!) set `-m none` - which is usually required for ASAN compiled targets.
+Memory limits are not enforced by afl-fuzz by default and the system may run
+out of memory. You can decrease the memory with the `-m` option, the value is
+in MB. If this is too small for the target, you can usually see this by
+afl-fuzz bailing with the message that it could not connect to the forkserver.
 
 Adding a dictionary is helpful. See the directory [dictionaries/](dictionaries/) if
 something is already included for your data format, and tell afl-fuzz to load
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index bd856088..2e7de7b3 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -823,7 +823,12 @@ void show_stats(afl_state_t *afl) {
     SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP
                   " total crashes : %s%-22s" bSTG         bV "\n",
          u_stringify_int(IB(0), afl->fsrv.total_execs),
-         afl->unique_crashes ? cLRD : cRST, tmp);
+         // New crashes this round -> Red, restored crashes -> yellow, else
+         // white.
+         afl->total_crashes    ? cLRD
+         : afl->unique_crashes ? cYEL
+                               : cRST,
+         tmp);
 
   }
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index cd049fd5..dbf4df37 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1581,44 +1581,51 @@ int main(int argc, char **argv_orig, char **envp) {
   afl->fsrv.trace_bits =
       afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
 
-  if (afl->fsrv.map_size <= 8000000) {
+  if (!afl->non_instrumented_mode && !afl->fsrv.qemu_mode &&
+      !afl->unicorn_mode) {
 
-    afl->fsrv.map_size = 8000000;  // dummy temporary value
-    setenv("AFL_MAP_SIZE", "8000000", 1);
+    if (map_size <= 8000000 && !afl->non_instrumented_mode &&
+        !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
 
-  }
+      afl->fsrv.map_size = 8000000;  // dummy temporary value
+      setenv("AFL_MAP_SIZE", "8000000", 1);
 
-  u32 new_map_size = afl_fsrv_get_mapsize(
-      &afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
-
-  // only reinitialize when it makes sense
-  if (map_size < new_map_size ||
-      (new_map_size > map_size && new_map_size - map_size > MAP_SIZE &&
-       (!afl->cmplog_binary || new_map_size == MAP_SIZE))) {
-
-    OKF("Re-initializing maps to %u bytes", new_map_size);
-
-    afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
-    afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
-    afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
-    afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
-    afl->top_rated = ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
-    afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
-    afl->clean_trace_custom = ck_realloc(afl->clean_trace_custom, new_map_size);
-    afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
-    afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
-
-    afl_fsrv_kill(&afl->fsrv);
-    afl_shm_deinit(&afl->shm);
-    afl->fsrv.map_size = new_map_size;
-    afl->fsrv.trace_bits =
-        afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
-    setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
-    afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
-                   afl->afl_env.afl_debug_child);
-    map_size = new_map_size;
+    }
 
-  } else {
+    u32 new_map_size = afl_fsrv_get_mapsize(
+        &afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
+
+    // only reinitialize when it makes sense
+    if (map_size < new_map_size ||
+        (!afl->cmplog_binary && new_map_size < map_size &&
+         map_size - new_map_size > MAP_SIZE)) {
+
+      OKF("Re-initializing maps to %u bytes", new_map_size);
+
+      afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
+      afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
+      afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
+      afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
+      afl->top_rated =
+          ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
+      afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
+      afl->clean_trace_custom =
+          ck_realloc(afl->clean_trace_custom, new_map_size);
+      afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
+      afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
+
+      afl_fsrv_kill(&afl->fsrv);
+      afl_shm_deinit(&afl->shm);
+      afl->fsrv.map_size = new_map_size;
+      afl->fsrv.trace_bits =
+          afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
+      setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
+      afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
+                     afl->afl_env.afl_debug_child);
+
+      map_size = new_map_size;
+
+    }
 
     afl->fsrv.map_size = map_size;
 
@@ -1634,13 +1641,21 @@ int main(int argc, char **argv_orig, char **envp) {
     afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
     afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
 
+    if (map_size <= 8000000 && !afl->non_instrumented_mode &&
+        !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
+
+      afl->fsrv.map_size = 8000000;  // dummy temporary value
+      setenv("AFL_MAP_SIZE", "8000000", 1);
+
+    }
+
     u32 new_map_size =
         afl_fsrv_get_mapsize(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
                              afl->afl_env.afl_debug_child);
 
-    // only reinitialize when necessary
+    // only reinitialize when it needs to be larger
     if (map_size < new_map_size ||
-        (new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
+        (new_map_size < map_size && map_size - new_map_size > MAP_SIZE)) {
 
       OKF("Re-initializing maps to %u bytes due cmplog", new_map_size);
 
@@ -1672,12 +1687,10 @@ int main(int argc, char **argv_orig, char **envp) {
 
       map_size = new_map_size;
 
-    } else {
-
-      afl->cmplog_fsrv.map_size = map_size;
-
     }
 
+    afl->cmplog_fsrv.map_size = map_size;
+
     OKF("Cmplog forkserver successfully started");
 
   }
diff --git a/test/test-custom-mutators.sh b/test/test-custom-mutators.sh
index 24c95ac7..bae4220f 100755
--- a/test/test-custom-mutators.sh
+++ b/test/test-custom-mutators.sh
@@ -37,9 +37,9 @@ test "1" = "`../afl-fuzz | grep -i 'without python' >/dev/null; echo $?`" && {
       echo "00000" > in/in
 
       # Run afl-fuzz w/ the C mutator
-      $ECHO "$GREY[*] running afl-fuzz for the C mutator, this will take approx 5 seconds"
+      $ECHO "$GREY[*] running afl-fuzz for the C mutator, this will take approx 10 seconds"
       {
-        AFL_CUSTOM_MUTATOR_LIBRARY=./libexamplemutator.so AFL_CUSTOM_MUTATOR_ONLY=1 ../afl-fuzz -V1 -m ${MEM_LIMIT} -i in -o out -- ./test-custom-mutator >>errors 2>&1
+        AFL_CUSTOM_MUTATOR_LIBRARY=./libexamplemutator.so AFL_CUSTOM_MUTATOR_ONLY=1 ../afl-fuzz -V10 -m ${MEM_LIMIT} -i in -o out -- ./test-custom-mutator >>errors 2>&1
       } >>errors 2>&1
 
       # Check results
@@ -57,9 +57,9 @@ test "1" = "`../afl-fuzz | grep -i 'without python' >/dev/null; echo $?`" && {
       rm -rf out errors core.*
 
       # Run afl-fuzz w/ multiple C mutators
-      $ECHO "$GREY[*] running afl-fuzz with multiple custom C mutators, this will take approx 5 seconds"
+      $ECHO "$GREY[*] running afl-fuzz with multiple custom C mutators, this will take approx 10 seconds"
       {
-        AFL_CUSTOM_MUTATOR_LIBRARY="./libexamplemutator.so;./libexamplemutator2.so" AFL_CUSTOM_MUTATOR_ONLY=1 ../afl-fuzz -V1 -m ${MEM_LIMIT} -i in -o out -- ./test-multiple-mutators >>errors 2>&1
+        AFL_CUSTOM_MUTATOR_LIBRARY="./libexamplemutator.so;./libexamplemutator2.so" AFL_CUSTOM_MUTATOR_ONLY=1 ../afl-fuzz -V10 -m ${MEM_LIMIT} -i in -o out -- ./test-multiple-mutators >>errors 2>&1
       } >>errors 2>&1
 
       test -n "$( ls out/default/crashes/id:000000* 2>/dev/null )" && {  # TODO: update here
@@ -76,11 +76,11 @@ test "1" = "`../afl-fuzz | grep -i 'without python' >/dev/null; echo $?`" && {
       rm -rf out errors core.*
 
       # Run afl-fuzz w/ the Python mutator
-      $ECHO "$GREY[*] running afl-fuzz for the Python mutator, this will take approx 5 seconds"
+      $ECHO "$GREY[*] running afl-fuzz for the Python mutator, this will take approx 10 seconds"
       {
         export PYTHONPATH=${CUSTOM_MUTATOR_PATH}
         export AFL_PYTHON_MODULE=example
-        AFL_CUSTOM_MUTATOR_ONLY=1 ../afl-fuzz -V5 -m ${MEM_LIMIT} -i in -o out -- ./test-custom-mutator >>errors 2>&1
+        AFL_CUSTOM_MUTATOR_ONLY=1 ../afl-fuzz -V10 -m ${MEM_LIMIT} -i in -o out -- ./test-custom-mutator >>errors 2>&1
         unset PYTHONPATH
         unset AFL_PYTHON_MODULE
       } >>errors 2>&1
diff --git a/test/test-llvm.sh b/test/test-llvm.sh
index 156b8920..1bcf013a 100755
--- a/test/test-llvm.sh
+++ b/test/test-llvm.sh
@@ -164,7 +164,7 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && {
     echo ZZZZ > in/in
     $ECHO "$GREY[*] running afl-fuzz with floating point splitting, this will take max. 30 seconds"
     {
-      AFL_BENCH_UNTIL_CRASH=1 AFL_NO_UI=1 ../afl-fuzz -s 1 -V30 -m ${MEM_LIMIT} -i in -o out -D -- ./test-floatingpoint >>errors 2>&1
+      AFL_BENCH_UNTIL_CRASH=1 AFL_NO_UI=1 ../afl-fuzz -Z -s 1 -V30 -m ${MEM_LIMIT} -i in -o out -D -- ./test-floatingpoint >>errors 2>&1
     } >>errors 2>&1
     test -n "$( ls out/default/crashes/id:* 2>/dev/null )" && {
       $ECHO "$GREEN[+] llvm_mode laf-intel floatingpoint splitting feature works correctly"