fix shared memory leaks in afl-showmap, initialize cmplog_mode

4 files changed, 20 insertions, 2 deletions

diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index f9ba8860..56284f6f 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -1049,6 +1049,9 @@ int main(int argc, char **argv, char **envp) {
   check_environment_vars(envp);
 
   sharedmem_t shm = {0};
+
+  /* initialize cmplog_mode */
+  shm.cmplog_mode = 0;
   trace_bits = afl_shm_init(&shm, map_size, 0);
   atexit(at_exit_handler);
   setup_signal_handlers();
diff --git a/src/afl-sharedmem.c b/src/afl-sharedmem.c
index 44a91a97..de0dc916 100644
--- a/src/afl-sharedmem.c
+++ b/src/afl-sharedmem.c
@@ -101,7 +101,7 @@ void afl_shm_deinit(sharedmem_t *shm) {
 u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
                  unsigned char non_instrumented_mode) {
 
-  shm->map_size = map_size;
+  shm->map_size = 0;
 
   shm->map = NULL;
 
@@ -153,7 +153,6 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
   u8 *shm_str;
 
   shm->shm_id = shmget(IPC_PRIVATE, map_size, IPC_CREAT | IPC_EXCL | 0600);
-
   if (shm->shm_id < 0) { PFATAL("shmget() failed"); }
 
   if (shm->cmplog_mode) {
@@ -204,6 +203,7 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
 
 #endif
 
+  shm->map_size = map_size;
   list_append(&shm_list, shm);
 
   return shm->map;
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 1ab7d0a8..24e83721 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -151,6 +151,7 @@ static sharedmem_t *deinit_shmem(afl_forkserver_t *fsrv,
 
   afl_shm_deinit(shm_fuzz);
   fsrv->support_shmem_fuzz = 0;
+  fsrv->shmem_fuzz_len = NULL;
   fsrv->shmem_fuzz = NULL;
   ck_free(shm_fuzz);
   return NULL;
@@ -811,6 +812,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
   //  if (afl->shmem_testcase_mode) { setup_testcase_shmem(afl); }
 
+  /* initialize cmplog_mode */
+  shm.cmplog_mode = 0;
   fsrv->trace_bits = afl_shm_init(&shm, map_size, 0);
   setup_signal_handlers();
 
@@ -865,6 +868,9 @@ int main(int argc, char **argv_orig, char **envp) {
   }
 
   shm_fuzz = ck_alloc(sizeof(sharedmem_t));
+
+  /* initialize cmplog_mode */
+  shm_fuzz->cmplog_mode = 0;
   u8 *map = afl_shm_init(shm_fuzz, MAX_FILE + sizeof(u32), 1);
   if (!map) { FATAL("BUG: Zero return from afl_shm_init."); }
 #ifdef USEMMAP
@@ -991,6 +997,9 @@ int main(int argc, char **argv_orig, char **envp) {
 
   } else {
 
+    if (fsrv->support_shmem_fuzz && !fsrv->use_shmem_fuzz)
+      shm_fuzz = deinit_shmem(fsrv, shm_fuzz);
+
     showmap_run_target(fsrv, use_argv);
     tcnt = write_results_to_file(fsrv, out_file);
 
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 5e4bdb6c..2db1eae7 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -116,6 +116,7 @@ static sharedmem_t *deinit_shmem(afl_forkserver_t *fsrv,
 
   afl_shm_deinit(shm_fuzz);
   fsrv->support_shmem_fuzz = 0;
+  fsrv->shmem_fuzz_len = NULL;
   fsrv->shmem_fuzz = NULL;
   ck_free(shm_fuzz);
   return NULL;
@@ -1036,6 +1037,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
   check_environment_vars(envp);
 
+  /* initialize cmplog_mode */
+  shm.cmplog_mode = 0;
   fsrv->trace_bits = afl_shm_init(&shm, map_size, 0);
 
   atexit(at_exit_handler);
@@ -1078,6 +1081,9 @@ int main(int argc, char **argv_orig, char **envp) {
   SAYF("\n");
 
   shm_fuzz = ck_alloc(sizeof(sharedmem_t));
+
+  /* initialize cmplog_mode */
+  shm_fuzz->cmplog_mode = 0;
   u8 *map = afl_shm_init(shm_fuzz, MAX_FILE + sizeof(u32), 1);
   if (!map) { FATAL("BUG: Zero return from afl_shm_init."); }
 #ifdef USEMMAP