Merge branch 'dev' of https://github.com/AFLplusplus/AFLplusplus into dev

9 files changed, 62 insertions, 41 deletions

diff --git a/src/afl-as.c b/src/afl-as.c
index 0ed47d8c..7d70bfcd 100644
--- a/src/afl-as.c
+++ b/src/afl-as.c
@@ -152,7 +152,7 @@ static void edit_params(int argc, char **argv) {
 
     /* The Apple case is a bit different... */
 
-    if (!strcmp(argv[i], "-arch") && i + 1 < argc) {
+    if (!strcmp(argv[i], "-arch") && i + 1 < (u32)argc) {
 
       if (!strcmp(argv[i + 1], "x86_64"))
         use_64bit = 1;
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 93203cb2..cb4e00f9 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -240,6 +240,17 @@ static void afl_fauxsrv_execv(afl_forkserver_t *fsrv, char **argv) {
 
     if (!child_pid) {  // New child
 
+      close(fsrv->out_dir_fd);
+      close(fsrv->dev_null_fd);
+      close(fsrv->dev_urandom_fd);
+
+      if (fsrv->plot_file != NULL) {
+
+        fclose(fsrv->plot_file);
+        fsrv->plot_file = NULL;
+
+      }
+
       signal(SIGCHLD, old_sigchld_handler);
       // FORKSRV_FD is for communication with AFL, we don't need it in the
       // child.
@@ -360,12 +371,10 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
   if (!fsrv->fsrv_pid) {
 
     /* CHILD PROCESS */
-
     struct rlimit r;
 
     /* Umpf. On OpenBSD, the default fd limit for root users is set to
        soft 128. Let's try to fix that... */
-
     if (!getrlimit(RLIMIT_NOFILE, &r) && r.rlim_cur < FORKSRV_FD + 2) {
 
       r.rlim_cur = FORKSRV_FD + 2;
@@ -432,7 +441,12 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
     close(fsrv->dev_null_fd);
     close(fsrv->dev_urandom_fd);
 
-    if (fsrv->plot_file != NULL) { fclose(fsrv->plot_file); }
+    if (fsrv->plot_file != NULL) {
+
+      fclose(fsrv->plot_file);
+      fsrv->plot_file = NULL;
+
+    }
 
     /* This should improve performance a bit, since it stops the linker from
        doing extra work post-fork(). */
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 7b7ba006..102f04b9 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -256,18 +256,18 @@ void bind_to_free_cpu(afl_state_t *afl) {
 
   }
 
-  for (i = 0; i < proccount; i++) {
+  for (i = 0; i < (s32)proccount; i++) {
 
     #if defined(__FreeBSD__)
 
     if (!strcmp(procs[i].ki_comm, "idle")) continue;
 
     // fix when ki_oncpu = -1
-    int oncpu;
+    s32 oncpu;
     oncpu = procs[i].ki_oncpu;
     if (oncpu == -1) oncpu = procs[i].ki_lastcpu;
 
-    if (oncpu != -1 && oncpu < sizeof(cpu_used) && procs[i].ki_pctcpu > 60)
+    if (oncpu != -1 && oncpu < (s32)sizeof(cpu_used) && procs[i].ki_pctcpu > 60)
       cpu_used[oncpu] = 1;
 
     #elif defined(__DragonFly__)
@@ -1843,7 +1843,8 @@ void setup_stdio_file(afl_state_t *afl) {
 
   if (afl->file_extension) {
 
-    afl->fsrv.out_file = alloc_printf("%s/.cur_input.%s", afl->tmp_dir, afl->file_extension);
+    afl->fsrv.out_file =
+        alloc_printf("%s/.cur_input.%s", afl->tmp_dir, afl->file_extension);
 
   } else {
 
@@ -1851,11 +1852,15 @@ void setup_stdio_file(afl_state_t *afl) {
 
   }
 
-  unlink(afl->fsrv.out_file);                                              /* Ignore errors */
+  unlink(afl->fsrv.out_file);                              /* Ignore errors */
 
   afl->fsrv.out_fd = open(afl->fsrv.out_file, O_RDWR | O_CREAT | O_EXCL, 0600);
 
-  if (afl->fsrv.out_fd < 0) { PFATAL("Unable to create '%s'", afl->fsrv.out_file); }
+  if (afl->fsrv.out_fd < 0) {
+
+    PFATAL("Unable to create '%s'", afl->fsrv.out_file);
+
+  }
 
 }
 
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index 1ae6ab54..9a9ac33f 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -264,7 +264,8 @@ static u8 its_fuzz(afl_state_t *afl, u8 *buf, u32 len, u8 *status) {
 
 }
 
-static long long strntoll(const char *str, size_t sz, char **end, int base) {
+static int strntoll(const char *str, size_t sz, char **end, int base,
+                    long long *out) {
 
   char        buf[64];
   long long   ret;
@@ -272,24 +273,22 @@ static long long strntoll(const char *str, size_t sz, char **end, int base) {
 
   for (; beg && sz && *beg == ' '; beg++, sz--) {};
 
-  if (!sz || sz >= sizeof(buf)) {
-
-    if (end) *end = (char *)str;
-    return 0;
-
-  }
+  if (!sz) return 1;
+  if (sz >= sizeof(buf)) sz = sizeof(buf) - 1;
 
   memcpy(buf, beg, sz);
   buf[sz] = '\0';
   ret = strtoll(buf, end, base);
-  if (ret == LLONG_MIN || ret == LLONG_MAX) return ret;
+  if ((ret == LLONG_MIN || ret == LLONG_MAX) && errno == ERANGE) return 1;
   if (end) *end = (char *)beg + (*end - buf);
-  return ret;
+  *out = ret;
+
+  return 0;
 
 }
 
-static unsigned long long strntoull(const char *str, size_t sz, char **end,
-                                    int base) {
+static int strntoull(const char *str, size_t sz, char **end, int base,
+                     unsigned long long *out) {
 
   char               buf[64];
   unsigned long long ret;
@@ -298,18 +297,17 @@ static unsigned long long strntoull(const char *str, size_t sz, char **end,
   for (; beg && sz && *beg == ' '; beg++, sz--)
     ;
 
-  if (!sz || sz >= sizeof(buf)) {
-
-    if (end) *end = (char *)str;
-    return 0;
-
-  }
+  if (!sz) return 1;
+  if (sz >= sizeof(buf)) sz = sizeof(buf) - 1;
 
   memcpy(buf, beg, sz);
   buf[sz] = '\0';
   ret = strtoull(buf, end, base);
+  if (ret == ULLONG_MAX && errno == ERANGE) return 1;
   if (end) *end = (char *)beg + (*end - buf);
-  return ret;
+  *out = ret;
+
+  return 0;
 
 }
 
@@ -336,14 +334,14 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
   u8                 use_num = 0, use_unum = 0;
   unsigned long long unum;
   long long          num;
+
   if (afl->queue_cur->is_ascii) {
 
     endptr = buf_8;
-    num = strntoll(buf_8, len - idx, (char **)&endptr, 0);
-    if (endptr == buf_8) {
+    if (strntoll(buf_8, len - idx, (char **)&endptr, 0, &num)) {
 
-      unum = strntoull(buf_8, len - idx, (char **)&endptr, 0);
-      if (endptr == buf_8) use_unum = 1;
+      if (!strntoull(buf_8, len - idx, (char **)&endptr, 0, &unum))
+        use_unum = 1;
 
     } else
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 5ad2ace9..0df6c15c 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -178,8 +178,9 @@ static void usage(u8 *argv0, int more_help) {
       "AFL_IMPORT_FIRST: sync and import test cases from other fuzzer instances first\n"
       "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n"
       "              the target was compiled for\n"
-      "AFL_MAX_DET_EXTRAS: if the dict/extras file contains more tokens than this threshold,\n"
-      "                    the tokens will sometimes be skipped during fuzzing.\n"
+      "AFL_MAX_DET_EXTRAS: if more entries are in the dictionary list than this value\n"
+      "                    then they are randomly selected instead all of them being\n"
+      "                    used. Defaults to 200.\n"
       "AFL_NO_AFFINITY: do not check for an unused cpu core to use for fuzzing\n"
       "AFL_NO_ARITH: skip arithmetic mutations in deterministic stage\n"
       "AFL_NO_CPU_RED: avoid red color for showing very high cpu usage\n"
diff --git a/src/afl-gcc.c b/src/afl-gcc.c
index 22e6be8e..97564aea 100644
--- a/src/afl-gcc.c
+++ b/src/afl-gcc.c
@@ -415,7 +415,7 @@ int main(int argc, char **argv) {
       "AFL_KEEP_ASSEMBLY: leave instrumented assembly files\n"
       "AFL_AS_FORCE_INSTRUMENT: force instrumentation for asm sources\n";
 
-  if (argc == 2 && strcmp(argv[1], "-h") == 0) {
+  if (argc == 2 && strncmp(argv[1], "-h", 2) == 0) {
 
     printf("afl-cc" VERSION " by Michal Zalewski\n\n");
     printf("%s \n\n", argv[0]);
diff --git a/src/afl-performance.c b/src/afl-performance.c
index 0c1697a8..a9d7cefa 100644
--- a/src/afl-performance.c
+++ b/src/afl-performance.c
@@ -72,12 +72,12 @@ void jump(afl_state_t *afl) {
 
   static const uint64_t JUMP[] = {0x180ec6d33cfd0aba, 0xd5a61266f0c9392c,
                                   0xa9582618e03fc9aa, 0x39abdc4529b1661c};
-  int                   i, b;
+  size_t                i, b;
   uint64_t              s0 = 0;
   uint64_t              s1 = 0;
   uint64_t              s2 = 0;
   uint64_t              s3 = 0;
-  for (i = 0; i < sizeof JUMP / sizeof *JUMP; i++)
+  for (i = 0; i < (sizeof(JUMP) / sizeof(*JUMP)); i++)
     for (b = 0; b < 64; b++) {
 
       if (JUMP[i] & UINT64_C(1) << b) {
@@ -110,12 +110,12 @@ void long_jump(afl_state_t *afl) {
   static const uint64_t LONG_JUMP[] = {0x76e15d3efefdcbbf, 0xc5004e441c522fb3,
                                        0x77710069854ee241, 0x39109bb02acbe635};
 
-  int      i, b;
+  size_t   i, b;
   uint64_t s0 = 0;
   uint64_t s1 = 0;
   uint64_t s2 = 0;
   uint64_t s3 = 0;
-  for (i = 0; i < sizeof LONG_JUMP / sizeof *LONG_JUMP; i++)
+  for (i = 0; i < (sizeof(LONG_JUMP) / sizeof(*LONG_JUMP)); i++)
     for (b = 0; b < 64; b++) {
 
       if (LONG_JUMP[i] & UINT64_C(1) << b) {
@@ -145,7 +145,7 @@ void long_jump(afl_state_t *afl) {
 u32 hash32(u8 *key, u32 len, u32 seed) {
 
 #else
-u32 inline hash32(u8 *key, u32 len, u32 seed) {
+inline u32 hash32(u8 *key, u32 len, u32 seed) {
 
 #endif
 
@@ -157,7 +157,7 @@ u32 inline hash32(u8 *key, u32 len, u32 seed) {
 u64 hash64(u8 *key, u32 len, u64 seed) {
 
 #else
-u64 inline hash64(u8 *key, u32 len, u64 seed) {
+inline u64 hash64(u8 *key, u32 len, u64 seed) {
 
 #endif
 
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 64b52479..f4a7c336 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -636,6 +636,8 @@ static void usage(u8 *argv0) {
       "size\n"
       "              the target was compiled for\n"
       "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
+      "AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during "
+      "startup (in milliseconds)\n"
       "AFL_QUIET: do not print extra informational output\n",
       argv0, MEM_LIMIT, doc_path);
 
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 59269f45..e1d08054 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -846,6 +846,7 @@ static void usage(u8 *argv0) {
       "              the target was compiled for\n"
       "AFL_PRELOAD:  LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
       "AFL_TMIN_EXACT: require execution paths to match for crashing inputs\n"
+      "AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in milliseconds)\n"
 
       , argv0, EXEC_TIMEOUT, MEM_LIMIT, doc_path);