Merge pull request #679 from AFLplusplus/dev

Dev

17 files changed, 273 insertions, 170 deletions

diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index 6dac415b..8fc4434a 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -903,8 +903,8 @@ static void usage(u8 *argv0) {
       "Execution control settings:\n"
 
       "  -f file       - input file read by the tested program (stdin)\n"
-      "  -t msec       - timeout for each run (%d ms)\n"
-      "  -m megs       - memory limit for child process (%d MB)\n"
+      "  -t msec       - timeout for each run (%u ms)\n"
+      "  -m megs       - memory limit for child process (%u MB)\n"
       "  -Q            - use binary-only instrumentation (QEMU mode)\n"
       "  -U            - use unicorn-based instrumentation (Unicorn mode)\n"
       "  -W            - use qemu-based instrumentation with Wine (Wine "
diff --git a/src/afl-cc.c b/src/afl-cc.c
index e6a6718e..999ee7f1 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -120,8 +120,13 @@ char compiler_mode_string[7][12] = {
 
 u8 *getthecwd() {
 
-  static u8 fail[] = "";
-  if (getcwd(cwd, sizeof(cwd)) == NULL) return fail;
+  if (getcwd(cwd, sizeof(cwd)) == NULL) {
+
+    static u8 fail[] = "";
+    return fail;
+
+  }
+
   return cwd;
 
 }
@@ -654,9 +659,9 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
     }
 
-    u32 idx;
     if (lto_mode && argc > 1) {
 
+      u32 idx;
       for (idx = 1; idx < argc; idx++) {
 
         if (!strncasecmp(argv[idx], "-fpic", 5)) have_pic = 1;
@@ -787,8 +792,10 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   }
 
-#if defined(USEMMAP) && !defined(__HAIKU__)
+#if defined(USEMMAP)
+  #if !defined(__HAIKU__)
   cc_params[cc_par_cnt++] = "-lrt";
+  #endif
 #endif
 
   cc_params[cc_par_cnt++] = "-D__AFL_HAVE_MANUAL_CONTROL=1";
@@ -822,6 +829,35 @@ static void edit_params(u32 argc, char **argv, char **envp) {
       "extern unsigned char *__afl_fuzz_ptr;"
       "unsigned char __afl_fuzz_alt[1048576];"
       "unsigned char *__afl_fuzz_alt_ptr = __afl_fuzz_alt;";
+
+  if (plusplus_mode) {
+
+    cc_params[cc_par_cnt++] =
+        "-D__AFL_COVERAGE()=int __afl_selective_coverage = 1;"
+        "extern \"C\" void __afl_coverage_discard();"
+        "extern \"C\" void __afl_coverage_abort();"
+        "extern \"C\" void __afl_coverage_on();"
+        "extern \"C\" void __afl_coverage_off();";
+
+  } else {
+
+    cc_params[cc_par_cnt++] =
+        "-D__AFL_COVERAGE()=int __afl_selective_coverage = 1;"
+        "void __afl_coverage_discard();"
+        "void __afl_coverage_abort();"
+        "void __afl_coverage_on();"
+        "void __afl_coverage_off();";
+
+  }
+
+  cc_params[cc_par_cnt++] =
+      "-D__AFL_COVERAGE_START_OFF()=int __afl_selective_coverage_start_off = "
+      "1;";
+  cc_params[cc_par_cnt++] = "-D__AFL_COVERAGE_ON()=__afl_coverage_on()";
+  cc_params[cc_par_cnt++] = "-D__AFL_COVERAGE_OFF()=__afl_coverage_off()";
+  cc_params[cc_par_cnt++] =
+      "-D__AFL_COVERAGE_DISCARD()=__afl_coverage_discard()";
+  cc_params[cc_par_cnt++] = "-D__AFL_COVERAGE_ABORT()=__afl_coverage_abort()";
   cc_params[cc_par_cnt++] =
       "-D__AFL_FUZZ_TESTCASE_BUF=(__afl_fuzz_ptr ? __afl_fuzz_ptr : "
       "__afl_fuzz_alt_ptr)";
@@ -931,8 +967,10 @@ static void edit_params(u32 argc, char **argv, char **envp) {
           alloc_printf("-Wl,--dynamic-list=%s/dynamic_list.txt", obj_path);
   #endif
 
-  #ifdef USEMMAP
+  #if defined(USEMMAP)
+    #if !defined(__HAIKU__)
     cc_params[cc_par_cnt++] = "-lrt";
+    #endif
   #endif
 
   }
@@ -1208,12 +1246,12 @@ int main(int argc, char **argv, char **envp) {
 
   if (getenv("AFL_LLVM_INSTRUMENT")) {
 
-    u8 *ptr = strtok(getenv("AFL_LLVM_INSTRUMENT"), ":,;");
+    u8 *ptr2 = strtok(getenv("AFL_LLVM_INSTRUMENT"), ":,;");
 
-    while (ptr) {
+    while (ptr2) {
 
-      if (strncasecmp(ptr, "afl", strlen("afl")) == 0 ||
-          strncasecmp(ptr, "classic", strlen("classic")) == 0) {
+      if (strncasecmp(ptr2, "afl", strlen("afl")) == 0 ||
+          strncasecmp(ptr2, "classic", strlen("classic")) == 0) {
 
         if (instrument_mode == INSTRUMENT_LTO) {
 
@@ -1229,8 +1267,8 @@ int main(int argc, char **argv, char **envp) {
 
       }
 
-      if (strncasecmp(ptr, "pc-guard", strlen("pc-guard")) == 0 ||
-          strncasecmp(ptr, "pcguard", strlen("pcguard")) == 0) {
+      if (strncasecmp(ptr2, "pc-guard", strlen("pc-guard")) == 0 ||
+          strncasecmp(ptr2, "pcguard", strlen("pcguard")) == 0) {
 
         if (!instrument_mode || instrument_mode == INSTRUMENT_PCGUARD)
           instrument_mode = INSTRUMENT_PCGUARD;
@@ -1241,8 +1279,8 @@ int main(int argc, char **argv, char **envp) {
       }
 
       // this is a hidden option
-      if (strncasecmp(ptr, "llvmnative", strlen("llvmnative")) == 0 ||
-          strncasecmp(ptr, "llvm-native", strlen("llvm-native")) == 0) {
+      if (strncasecmp(ptr2, "llvmnative", strlen("llvmnative")) == 0 ||
+          strncasecmp(ptr2, "llvm-native", strlen("llvm-native")) == 0) {
 
         if (!instrument_mode || instrument_mode == INSTRUMENT_LLVMNATIVE)
           instrument_mode = INSTRUMENT_LLVMNATIVE;
@@ -1252,8 +1290,8 @@ int main(int argc, char **argv, char **envp) {
 
       }
 
-      if (strncasecmp(ptr, "cfg", strlen("cfg")) == 0 ||
-          strncasecmp(ptr, "instrim", strlen("instrim")) == 0) {
+      if (strncasecmp(ptr2, "cfg", strlen("cfg")) == 0 ||
+          strncasecmp(ptr2, "instrim", strlen("instrim")) == 0) {
 
         if (instrument_mode == INSTRUMENT_LTO) {
 
@@ -1269,7 +1307,7 @@ int main(int argc, char **argv, char **envp) {
 
       }
 
-      if (strncasecmp(ptr, "lto", strlen("lto")) == 0) {
+      if (strncasecmp(ptr2, "lto", strlen("lto")) == 0) {
 
         lto_mode = 1;
         if (!instrument_mode || instrument_mode == INSTRUMENT_LTO)
@@ -1280,7 +1318,7 @@ int main(int argc, char **argv, char **envp) {
 
       }
 
-      if (strcasecmp(ptr, "gcc") == 0) {
+      if (strcasecmp(ptr2, "gcc") == 0) {
 
         if (!instrument_mode || instrument_mode == INSTRUMENT_GCC)
           instrument_mode = INSTRUMENT_GCC;
@@ -1291,7 +1329,7 @@ int main(int argc, char **argv, char **envp) {
 
       }
 
-      if (strcasecmp(ptr, "clang") == 0) {
+      if (strcasecmp(ptr2, "clang") == 0) {
 
         if (!instrument_mode || instrument_mode == INSTRUMENT_CLANG)
           instrument_mode = INSTRUMENT_CLANG;
@@ -1302,29 +1340,29 @@ int main(int argc, char **argv, char **envp) {
 
       }
 
-      if (strncasecmp(ptr, "ctx", strlen("ctx")) == 0) {
+      if (strncasecmp(ptr2, "ctx", strlen("ctx")) == 0) {
 
         instrument_opt_mode |= INSTRUMENT_OPT_CTX;
         setenv("AFL_LLVM_CTX", "1", 1);
 
       }
 
-      if (strncasecmp(ptr, "ngram", strlen("ngram")) == 0) {
+      if (strncasecmp(ptr2, "ngram", strlen("ngram")) == 0) {
 
-        ptr += strlen("ngram");
-        while (*ptr && (*ptr < '0' || *ptr > '9'))
-          ptr++;
+        ptr2 += strlen("ngram");
+        while (*ptr2 && (*ptr2 < '0' || *ptr2 > '9'))
+          ptr2++;
 
-        if (!*ptr) {
+        if (!*ptr2) {
 
-          if ((ptr = getenv("AFL_LLVM_NGRAM_SIZE")) == NULL)
+          if ((ptr2 = getenv("AFL_LLVM_NGRAM_SIZE")) == NULL)
             FATAL(
                 "you must set the NGRAM size with (e.g. for value 2) "
                 "AFL_LLVM_INSTRUMENT=ngram-2");
 
         }
 
-        ngram_size = atoi(ptr);
+        ngram_size = atoi(ptr2);
         if (ngram_size < 2 || ngram_size > NGRAM_SIZE_MAX)
           FATAL(
               "NGRAM instrumentation option must be between 2 and "
@@ -1332,12 +1370,12 @@ int main(int argc, char **argv, char **envp) {
               "(%u)",
               NGRAM_SIZE_MAX);
         instrument_opt_mode |= (INSTRUMENT_OPT_NGRAM);
-        ptr = alloc_printf("%u", ngram_size);
-        setenv("AFL_LLVM_NGRAM_SIZE", ptr, 1);
+        ptr2 = alloc_printf("%u", ngram_size);
+        setenv("AFL_LLVM_NGRAM_SIZE", ptr2, 1);
 
       }
 
-      ptr = strtok(NULL, ":,;");
+      ptr2 = strtok(NULL, ":,;");
 
     }
 
@@ -1448,20 +1486,28 @@ int main(int argc, char **argv, char **envp) {
         "  The best is LTO but it often needs RANLIB and AR settings outside "
         "of afl-cc.\n\n");
 
+#if LLVM_MAJOR > 10 || (LLVM_MAJOR == 10 && LLVM_MINOR > 0)
+  #define NATIVE_MSG                                              \
+    "  NATIVE:  use llvm's native PCGUARD instrumentation (less " \
+    "performant)\n"
+#else
+  #define NATIVE_MSG ""
+#endif
+
     SAYF(
         "Sub-Modes: (set via env AFL_LLVM_INSTRUMENT, afl-cc selects the best "
         "available)\n"
         "  PCGUARD: Dominator tree instrumentation (best!) (README.llvm.md)\n"
-#if LLVM_MAJOR > 10 || (LLVM_MAJOR == 10 && LLVM_MINOR > 0)
-        "  NATIVE:  use llvm's native PCGUARD instrumentation (less "
-        "performant)\n"
-#endif
+
+        NATIVE_MSG
+
         "  CLASSIC: decision target instrumentation (README.llvm.md)\n"
         "  CTX:     CLASSIC + callee context (instrumentation/README.ctx.md)\n"
         "  NGRAM-x: CLASSIC + previous path "
         "((instrumentation/README.ngram.md)\n"
         "  INSTRIM: Dominator tree (for LLVM <= 6.0) "
         "(instrumentation/README.instrim.md)\n\n");
+#undef NATIVE_MSG
 
     SAYF(
         "Features: (see documentation links)\n"
@@ -1595,12 +1641,17 @@ int main(int argc, char **argv, char **envp) {
     if (have_lto)
       SAYF("afl-cc LTO with ld=%s %s\n", AFL_REAL_LD, AFL_CLANG_FLTO);
     if (have_llvm)
-      SAYF("afl-cc LLVM version %d with the the binary path \"%s\".\n",
-           LLVM_MAJOR, LLVM_BINDIR);
+      SAYF("afl-cc LLVM version %d using binary path \"%s\".\n", LLVM_MAJOR,
+           LLVM_BINDIR);
 #endif
 
-#ifdef USEMMAP
+#if defined(USEMMAP)
+  #if !defined(__HAIKU__)
+    cc_params[cc_par_cnt++] = "-lrt";
     SAYF("Compiled with shm_open support (adds -lrt when linking).\n");
+  #else
+    SAYF("Compiled with shm_open support.\n");
+  #endif
 #else
     SAYF("Compiled with shmat support.\n");
 #endif
@@ -1625,7 +1676,7 @@ int main(int argc, char **argv, char **envp) {
       if (!instrument_mode) {
 
         instrument_mode = INSTRUMENT_CFG;
-        ptr = instrument_mode_string[instrument_mode];
+        // ptr = instrument_mode_string[instrument_mode];
 
       }
 
diff --git a/src/afl-common.c b/src/afl-common.c
index 1928663d..3a7d0ce5 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -424,6 +424,40 @@ u8 *find_binary(u8 *fname) {
 
 }
 
+/* Parses the kill signal environment variable, FATALs on error.
+  If the env is not set, sets the env to default_signal for the signal handlers
+  and returns the default_signal. */
+int parse_afl_kill_signal_env(u8 *afl_kill_signal_env, int default_signal) {
+
+  if (afl_kill_signal_env && afl_kill_signal_env[0]) {
+
+    char *endptr;
+    u8    signal_code;
+    signal_code = (u8)strtoul(afl_kill_signal_env, &endptr, 10);
+    /* Did we manage to parse the full string? */
+    if (*endptr != '\0' || endptr == (char *)afl_kill_signal_env) {
+
+      FATAL("Invalid AFL_KILL_SIGNAL: %s (expected unsigned int)",
+            afl_kill_signal_env);
+
+    }
+
+    return signal_code;
+
+  } else {
+
+    char *sigstr = alloc_printf("%d", default_signal);
+    if (!sigstr) { FATAL("Failed to alloc mem for signal buf"); }
+
+    /* Set the env for signal handler */
+    setenv("AFL_KILL_SIGNAL", sigstr, 1);
+    free(sigstr);
+    return default_signal;
+
+  }
+
+}
+
 void check_environment_vars(char **envp) {
 
   if (be_quiet) { return; }
@@ -696,16 +730,16 @@ u8 *stringify_mem_size(u8 *buf, size_t len, u64 val) {
 
 u8 *stringify_time_diff(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) {
 
-  u64 delta;
-  s32 t_d, t_h, t_m, t_s;
-  u8  val_buf[STRINGIFY_VAL_SIZE_MAX];
-
   if (!event_ms) {
 
     snprintf(buf, len, "none seen yet");
 
   } else {
 
+    u64 delta;
+    s32 t_d, t_h, t_m, t_s;
+    u8  val_buf[STRINGIFY_VAL_SIZE_MAX];
+
     delta = cur_ms - event_ms;
 
     t_d = delta / 1000 / 60 / 60 / 24;
@@ -858,16 +892,16 @@ u8 *u_stringify_mem_size(u8 *buf, u64 val) {
 
 u8 *u_stringify_time_diff(u8 *buf, u64 cur_ms, u64 event_ms) {
 
-  u64 delta;
-  s32 t_d, t_h, t_m, t_s;
-  u8  val_buf[STRINGIFY_VAL_SIZE_MAX];
-
   if (!event_ms) {
 
     sprintf(buf, "none seen yet");
 
   } else {
 
+    u64 delta;
+    s32 t_d, t_h, t_m, t_s;
+    u8  val_buf[STRINGIFY_VAL_SIZE_MAX];
+
     delta = cur_ms - event_ms;
 
     t_d = delta / 1000 / 60 / 60 / 24;
@@ -895,8 +929,8 @@ u32 get_map_size(void) {
     map_size = atoi(ptr);
     if (map_size < 8 || map_size > (1 << 29)) {
 
-      FATAL("illegal AFL_MAP_SIZE %u, must be between %u and %u", map_size, 8,
-            1 << 29);
+      FATAL("illegal AFL_MAP_SIZE %u, must be between %u and %u", map_size, 8U,
+            1U << 29);
 
     }
 
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 90fa55e9..b7aa87f8 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -84,6 +84,7 @@ void afl_fsrv_init(afl_forkserver_t *fsrv) {
   fsrv->init_tmout = EXEC_TIMEOUT * FORK_WAIT_MULT;
   fsrv->mem_limit = MEM_LIMIT;
   fsrv->out_file = NULL;
+  fsrv->kill_signal = SIGKILL;
 
   /* exec related stuff */
   fsrv->child_pid = -1;
@@ -95,7 +96,6 @@ void afl_fsrv_init(afl_forkserver_t *fsrv) {
   fsrv->uses_asan = false;
 
   fsrv->init_child_func = fsrv_exec_child;
-
   list_append(&fsrv_list, fsrv);
 
 }
@@ -116,6 +116,7 @@ void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) {
   fsrv_to->no_unlink = from->no_unlink;
   fsrv_to->uses_crash_exitcode = from->uses_crash_exitcode;
   fsrv_to->crash_exitcode = from->crash_exitcode;
+  fsrv_to->kill_signal = from->kill_signal;
 
   // These are forkserver specific.
   fsrv_to->out_dir_fd = -1;
@@ -213,7 +214,7 @@ restart_select:
 static void afl_fauxsrv_execv(afl_forkserver_t *fsrv, char **argv) {
 
   unsigned char tmp[4] = {0, 0, 0, 0};
-  pid_t         child_pid = -1;
+  pid_t         child_pid;
 
   if (!be_quiet) { ACTF("Using Fauxserver:"); }
 
@@ -559,12 +560,12 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
     if (!time_ms) {
 
-      kill(fsrv->fsrv_pid, SIGKILL);
+      kill(fsrv->fsrv_pid, fsrv->kill_signal);
 
     } else if (time_ms > fsrv->init_tmout) {
 
       fsrv->last_run_timed_out = 1;
-      kill(fsrv->fsrv_pid, SIGKILL);
+      kill(fsrv->fsrv_pid, fsrv->kill_signal);
 
     } else {
 
@@ -944,10 +945,10 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
 static void afl_fsrv_kill(afl_forkserver_t *fsrv) {
 
-  if (fsrv->child_pid > 0) { kill(fsrv->child_pid, SIGKILL); }
+  if (fsrv->child_pid > 0) { kill(fsrv->child_pid, fsrv->kill_signal); }
   if (fsrv->fsrv_pid > 0) {
 
-    kill(fsrv->fsrv_pid, SIGKILL);
+    kill(fsrv->fsrv_pid, fsrv->kill_signal);
     if (waitpid(fsrv->fsrv_pid, NULL, 0) <= 0) { WARNF("error waitpid\n"); }
 
   }
@@ -1091,7 +1092,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
     /* If there was no response from forkserver after timeout seconds,
     we kill the child. The forkserver should inform us afterwards */
 
-    kill(fsrv->child_pid, SIGKILL);
+    kill(fsrv->child_pid, fsrv->kill_signal);
     fsrv->last_run_timed_out = 1;
     if (read(fsrv->fsrv_st_fd, &fsrv->child_status, 4) < 4) { exec_ms = 0; }
 
@@ -1104,7 +1105,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
          "Unable to communicate with fork server. Some possible reasons:\n\n"
          "    - You've run out of memory. Use -m to increase the the memory "
          "limit\n"
-         "      to something higher than %lld.\n"
+         "      to something higher than %llu.\n"
          "    - The binary or one of the libraries it uses manages to "
          "create\n"
          "      threads before the forkserver initializes.\n"
@@ -1137,16 +1138,18 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
 
   /* Report outcome to caller. */
 
-  if (WIFSIGNALED(fsrv->child_status) && !*stop_soon_p) {
-
-    fsrv->last_kill_signal = WTERMSIG(fsrv->child_status);
+  /* Did we timeout? */
+  if (unlikely(fsrv->last_run_timed_out)) {
 
-    if (fsrv->last_run_timed_out && fsrv->last_kill_signal == SIGKILL) {
+    fsrv->last_kill_signal = fsrv->kill_signal;
+    return FSRV_RUN_TMOUT;
 
-      return FSRV_RUN_TMOUT;
+  }
 
-    }
+  /* Did we crash? */
+  if (unlikely(WIFSIGNALED(fsrv->child_status) && !*stop_soon_p)) {
 
+    fsrv->last_kill_signal = WTERMSIG(fsrv->child_status);
     return FSRV_RUN_CRASH;
 
   }
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 62a8211c..ed8c2510 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -703,7 +703,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
         if (!classified) {
 
           classify_counts(&afl->fsrv);
-          classified = 1;
+          //          classified = 1;
 
         }
 
diff --git a/src/afl-fuzz-extras.c b/src/afl-fuzz-extras.c
index 171cce96..a3583651 100644
--- a/src/afl-fuzz-extras.c
+++ b/src/afl-fuzz-extras.c
@@ -266,7 +266,7 @@ static void extras_check_and_sort(afl_state_t *afl, u32 min_len, u32 max_len,
 
   if (afl->extras_cnt > afl->max_det_extras) {
 
-    WARNF("More than %d tokens - will use them probabilistically.",
+    WARNF("More than %u tokens - will use them probabilistically.",
           afl->max_det_extras);
 
   }
@@ -431,7 +431,6 @@ void dedup_extras(afl_state_t *afl) {
 /* Adds a new extra / dict entry. */
 void add_extra(afl_state_t *afl, u8 *mem, u32 len) {
 
-  u8  val_bufs[2][STRINGIFY_VAL_SIZE_MAX];
   u32 i, found = 0;
 
   for (i = 0; i < afl->extras_cnt; i++) {
@@ -451,6 +450,7 @@ void add_extra(afl_state_t *afl, u8 *mem, u32 len) {
 
   if (len > MAX_DICT_FILE) {
 
+    u8 val_bufs[2][STRINGIFY_VAL_SIZE_MAX];
     WARNF("Extra '%.*s' is too big (%s, limit is %s), skipping file!", (int)len,
           mem, stringify_mem_size(val_bufs[0], sizeof(val_bufs[0]), len),
           stringify_mem_size(val_bufs[1], sizeof(val_bufs[1]), MAX_DICT_FILE));
@@ -481,7 +481,7 @@ void add_extra(afl_state_t *afl, u8 *mem, u32 len) {
 
   if (afl->extras_cnt == afl->max_det_extras + 1) {
 
-    WARNF("More than %d tokens - will use them probabilistically.",
+    WARNF("More than %u tokens - will use them probabilistically.",
           afl->max_det_extras);
 
   }
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 0c85458e..089707b9 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -316,16 +316,20 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
 
   /* Initialize trimming in the custom mutator */
   afl->stage_cur = 0;
-  afl->stage_max = mutator->afl_custom_init_trim(mutator->data, in_buf, q->len);
-  if (unlikely(afl->stage_max) < 0) {
+  s32 retval = mutator->afl_custom_init_trim(mutator->data, in_buf, q->len);
+  if (unlikely(retval) < 0) {
 
-    FATAL("custom_init_trim error ret: %d", afl->stage_max);
+    FATAL("custom_init_trim error ret: %d", retval);
+
+  } else {
+
+    afl->stage_max = retval;
 
   }
 
   if (afl->not_on_tty && afl->debug) {
 
-    SAYF("[Custom Trimming] START: Max %d iterations, %u bytes", afl->stage_max,
+    SAYF("[Custom Trimming] START: Max %u iterations, %u bytes", afl->stage_max,
          q->len);
 
   }
@@ -343,7 +347,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
 
     if (unlikely(!retbuf)) {
 
-      FATAL("custom_trim failed (ret %zd)", retlen);
+      FATAL("custom_trim failed (ret %zu)", retlen);
 
     } else if (unlikely(retlen > orig_len)) {
 
@@ -409,7 +413,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
 
       if (afl->not_on_tty && afl->debug) {
 
-        SAYF("[Custom Trimming] SUCCESS: %d/%d iterations (now at %u bytes)",
+        SAYF("[Custom Trimming] SUCCESS: %u/%u iterations (now at %u bytes)",
              afl->stage_cur, afl->stage_max, q->len);
 
       }
@@ -417,16 +421,20 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
     } else {
 
       /* Tell the custom mutator that the trimming was unsuccessful */
-      afl->stage_cur = mutator->afl_custom_post_trim(mutator->data, 0);
-      if (unlikely(afl->stage_cur < 0)) {
+      s32 retval2 = mutator->afl_custom_post_trim(mutator->data, 0);
+      if (unlikely(retval2 < 0)) {
+
+        FATAL("Error ret in custom_post_trim: %d", retval2);
+
+      } else {
 
-        FATAL("Error ret in custom_post_trim: %d", afl->stage_cur);
+        afl->stage_cur = retval2;
 
       }
 
       if (afl->not_on_tty && afl->debug) {
 
-        SAYF("[Custom Trimming] FAILURE: %d/%d iterations", afl->stage_cur,
+        SAYF("[Custom Trimming] FAILURE: %u/%u iterations", afl->stage_cur,
              afl->stage_max);
 
       }
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index e6fa6064..f9509e86 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -368,7 +368,7 @@ static void locate_diffs(u8 *ptr1, u8 *ptr2, u32 len, s32 *first, s32 *last) {
 
 u8 fuzz_one_original(afl_state_t *afl) {
 
-  s32 len, temp_len;
+  u32 len, temp_len;
   u32 j;
   u32 i;
   u8 *in_buf, *out_buf, *orig_in, *ex_tmp, *eff_map = 0;
@@ -545,7 +545,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
   else
     orig_perf = perf_score = calculate_score(afl, afl->queue_cur);
 
-  if (unlikely(perf_score <= 0)) { goto abandon_entry; }
+  if (unlikely(perf_score == 0)) { goto abandon_entry; }
 
   if (unlikely(afl->shm.cmplog_mode && !afl->queue_cur->fully_colorized)) {
 
@@ -902,7 +902,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
   orig_hit_cnt = new_hit_cnt;
 
-  for (i = 0; (s32)i < len - 1; ++i) {
+  for (i = 0; i < len - 1; ++i) {
 
     /* Let's consult the effector map... */
 
@@ -945,7 +945,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
   orig_hit_cnt = new_hit_cnt;
 
-  for (i = 0; (s32)i < len - 3; ++i) {
+  for (i = 0; i < len - 3; ++i) {
 
     /* Let's consult the effector map... */
     if (!eff_map[EFF_APOS(i)] && !eff_map[EFF_APOS(i + 1)] &&
@@ -1405,7 +1405,7 @@ skip_arith:
 
   orig_hit_cnt = new_hit_cnt;
 
-  for (i = 0; (s32)i < len - 1; ++i) {
+  for (i = 0; i < len - 1; ++i) {
 
     u16 orig = *(u16 *)(out_buf + i);
 
@@ -1493,7 +1493,7 @@ skip_arith:
 
   orig_hit_cnt = new_hit_cnt;
 
-  for (i = 0; (s32)i < len - 3; i++) {
+  for (i = 0; i < len - 3; i++) {
 
     u32 orig = *(u32 *)(out_buf + i);
 
@@ -1850,7 +1850,7 @@ custom_mutator_stage:
 
           if (unlikely(!mutated_buf)) {
 
-            FATAL("Error in custom_fuzz. Size returned: %zd", mutated_size);
+            FATAL("Error in custom_fuzz. Size returned: %zu", mutated_size);
 
           }
 
@@ -2026,7 +2026,7 @@ havoc_stage:
                 el->data, out_buf, temp_len, &custom_havoc_buf, MAX_FILE);
             if (unlikely(!custom_havoc_buf)) {
 
-              FATAL("Error in custom_havoc (return %zd)", new_len);
+              FATAL("Error in custom_havoc (return %zu)", new_len);
 
             }
 
@@ -2458,7 +2458,7 @@ havoc_stage:
                 u32 use_extra = rand_below(afl, afl->a_extras_cnt);
                 u32 extra_len = afl->a_extras[use_extra].len;
 
-                if ((s32)extra_len > temp_len) { break; }
+                if (extra_len > temp_len) { break; }
 
                 u32 insert_at = rand_below(afl, temp_len - extra_len + 1);
 #ifdef INTROSPECTION
@@ -2476,7 +2476,7 @@ havoc_stage:
                 u32 use_extra = rand_below(afl, afl->extras_cnt);
                 u32 extra_len = afl->extras[use_extra].len;
 
-                if ((s32)extra_len > temp_len) { break; }
+                if (extra_len > temp_len) { break; }
 
                 u32 insert_at = rand_below(afl, temp_len - extra_len + 1);
 #ifdef INTROSPECTION
@@ -2577,7 +2577,7 @@ havoc_stage:
               u32 copy_from, copy_to, copy_len;
 
               copy_len = choose_block_len(afl, new_len - 1);
-              if ((s32)copy_len > temp_len) copy_len = temp_len;
+              if (copy_len > temp_len) copy_len = temp_len;
 
               copy_from = rand_below(afl, new_len - copy_len + 1);
               copy_to = rand_below(afl, temp_len - copy_len + 1);
@@ -2952,7 +2952,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
   else
     orig_perf = perf_score = calculate_score(afl, afl->queue_cur);
 
-  if (unlikely(perf_score <= 0)) { goto abandon_entry; }
+  if (unlikely(perf_score == 0)) { goto abandon_entry; }
 
   if (unlikely(afl->shm.cmplog_mode && !afl->queue_cur->fully_colorized)) {
 
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index c375703d..99f564e9 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -494,11 +494,12 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
 
 void destroy_queue(afl_state_t *afl) {
 
-  struct queue_entry *q;
-  u32                 i;
+  u32 i;
 
   for (i = 0; i < afl->queued_paths; i++) {
 
+    struct queue_entry *q;
+
     q = afl->queue_buf[i];
     ck_free(q->fname);
     ck_free(q->trace_mini);
@@ -1001,7 +1002,7 @@ inline void queue_testcase_retake(afl_state_t *afl, struct queue_entry *q,
 
       if (unlikely(!q->testcase_buf)) {
 
-        PFATAL("Unable to malloc '%s' with len %d", q->fname, len);
+        PFATAL("Unable to malloc '%s' with len %u", q->fname, len);
 
       }
 
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index 37d66aef..28585afe 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -99,12 +99,12 @@ static u8 get_exec_checksum(afl_state_t *afl, u8 *buf, u32 len, u64 *cksum) {
 
 }
 
-static void rand_replace(afl_state_t *afl, u8 *buf, u32 len) {
+static void xor_replace(u8 *buf, u32 len) {
 
   u32 i;
   for (i = 0; i < len; ++i) {
 
-    buf[i] = rand_below(afl, 256);
+    buf[i] ^= 0xff;
 
   }
 
@@ -115,8 +115,6 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len, u64 exec_cksum) {
   struct range *ranges = add_range(NULL, 0, len);
   u8 *          backup = ck_alloc_nozero(len);
 
-  u8 needs_write = 0;
-
   u64 orig_hit_cnt, new_hit_cnt;
   orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
 
@@ -136,7 +134,7 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len, u64 exec_cksum) {
       /* Range not empty */
 
       memcpy(backup, buf + rng->start, s);
-      rand_replace(afl, buf + rng->start, s);
+      xor_replace(buf + rng->start, s);
 
       u64 cksum;
       u64 start_us = get_cur_time_us();
@@ -158,10 +156,6 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len, u64 exec_cksum) {
         ranges = add_range(ranges, rng->start + s / 2 + 1, rng->end);
         memcpy(buf + rng->start, backup, s);
 
-      } else {
-
-        needs_write = 1;
-
       }
 
     }
@@ -191,32 +185,6 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len, u64 exec_cksum) {
 
   }
 
-  // save the input with the high entropy
-
-  if (needs_write) {
-
-    s32 fd;
-
-    if (afl->no_unlink) {
-
-      fd = open(afl->queue_cur->fname, O_WRONLY | O_CREAT | O_TRUNC, 0600);
-
-    } else {
-
-      unlink(afl->queue_cur->fname);                       /* ignore errors */
-      fd = open(afl->queue_cur->fname, O_WRONLY | O_CREAT | O_EXCL, 0600);
-
-    }
-
-    if (fd < 0) { PFATAL("Unable to create '%s'", afl->queue_cur->fname); }
-
-    ck_write(fd, buf, len, afl->queue_cur->fname);
-    afl->queue_cur->len = len;  // no-op, just to be 100% safe
-
-    close(fd);
-
-  }
-
   return 0;
 
 checksum_fail:
@@ -232,8 +200,6 @@ checksum_fail:
 
   }
 
-  // TODO: clang notices a _potential_ leak of mem pointed to by rng
-
   return 1;
 
 }
@@ -479,6 +445,10 @@ static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
 
   u32 k;
   u8  cons_ff = 0, cons_0 = 0;
+
+  if (shape > sizeof(v))
+    FATAL("shape is greater than %zu, please report!", sizeof(v));
+
   for (k = 0; k < shape; ++k) {
 
     if (b[k] == 0) {
@@ -487,7 +457,7 @@ static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
 
     } else if (b[k] == 0xff) {
 
-      ++cons_0;
+      ++cons_ff;
 
     } else {
 
@@ -701,12 +671,12 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
 
   u8 status = 0;
   // opt not in the paper
-  u32 fails = 0;
-  u8  found_one = 0;
+  //  u32 fails = 0;
+  u8 found_one = 0;
 
   for (i = 0; i < loggeds; ++i) {
 
-    fails = 0;
+    u32 fails = 0;
 
     struct cmpfn_operands *o =
         &((struct cmpfn_operands *)afl->shm.cmp_map->log[key])[i];
@@ -802,13 +772,13 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
                         u64 exec_cksum) {
 
   u8 r = 1;
-  if (afl->orig_cmp_map == NULL) {
+  if (unlikely(!afl->orig_cmp_map)) {
 
     afl->orig_cmp_map = ck_alloc_nozero(sizeof(struct cmp_map));
 
   }
 
-  if (afl->pass_stats == NULL) {
+  if (unlikely(!afl->pass_stats)) {
 
     afl->pass_stats = ck_alloc(sizeof(struct afl_pass_stat) * CMP_MAP_W);
 
@@ -888,7 +858,7 @@ exit_its:
   afl->stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt;
   afl->stage_cycles[STAGE_ITS] += afl->fsrv.total_execs - orig_execs;
 
-  memcpy(orig_buf, buf, len);
+  memcpy(buf, orig_buf, len);
 
   return r;
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 339fb9c3..cc2ef891 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -430,6 +430,13 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
   /* OK, let's collect some stats about the performance of this test case.
      This is used for fuzzing air time calculations in calculate_score(). */
 
+  if (unlikely(!afl->stage_max)) {
+
+    // Pretty sure this cannot happen, yet scan-build complains.
+    FATAL("BUG: stage_max should not be 0 here! Please report this condition.");
+
+  }
+
   q->exec_us = (stop_us - start_us) / afl->stage_max;
   q->bitmap_size = count_bytes(afl, afl->fsrv.trace_bits);
   q->handicap = handicap;
@@ -682,7 +689,7 @@ void sync_fuzzers(afl_state_t *afl) {
     // same time. If so, the first temporary main node running again will demote
     // themselves so this is not an issue
 
-    u8 path[PATH_MAX];
+    //    u8 path2[PATH_MAX];
     afl->is_main_node = 1;
     sprintf(path, "%s/is_main_node", afl->out_dir);
     int fd = open(path, O_CREAT | O_RDWR, 0644);
diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c
index 34456c0d..60c9684c 100644
--- a/src/afl-fuzz-state.c
+++ b/src/afl-fuzz-state.c
@@ -418,6 +418,13 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
                 (u8 *)get_afl_env(afl_environment_variables[i]);
 #endif
 
+          } else if (!strncmp(env, "AFL_KILL_SIGNAL",
+
+                              afl_environment_variable_len)) {
+
+            afl->afl_env.afl_kill_signal =
+                (u8 *)get_afl_env(afl_environment_variables[i]);
+
           }
 
         } else {
@@ -524,8 +531,8 @@ void afl_states_stop(void) {
 
   LIST_FOREACH(&afl_states, afl_state_t, {
 
-    if (el->fsrv.child_pid > 0) kill(el->fsrv.child_pid, SIGKILL);
-    if (el->fsrv.fsrv_pid > 0) kill(el->fsrv.fsrv_pid, SIGKILL);
+    if (el->fsrv.child_pid > 0) kill(el->fsrv.child_pid, el->fsrv.kill_signal);
+    if (el->fsrv.fsrv_pid > 0) kill(el->fsrv.fsrv_pid, el->fsrv.kill_signal);
 
   });
 
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index 1c211da6..e86f2aeb 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -31,8 +31,7 @@
 
 void write_setup_file(afl_state_t *afl, u32 argc, char **argv) {
 
-  char *val;
-  u8    fn[PATH_MAX];
+  u8 fn[PATH_MAX];
   snprintf(fn, PATH_MAX, "%s/fuzzer_setup", afl->out_dir);
   FILE *f = create_ffile(fn);
   u32   i;
@@ -44,6 +43,7 @@ void write_setup_file(afl_state_t *afl, u32 argc, char **argv) {
 
   for (i = 0; i < s_afl_env; ++i) {
 
+    char *val;
     if ((val = getenv(afl_environment_variables[i])) != NULL) {
 
       fprintf(f, "%s=%s\n", afl_environment_variables[i], val);
@@ -228,7 +228,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
 
       if (afl->virgin_bits[i] != 0xff) {
 
-        fprintf(f, " %d[%02x]", i, afl->virgin_bits[i]);
+        fprintf(f, " %u[%02x]", i, afl->virgin_bits[i]);
 
       }
 
@@ -238,7 +238,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
     fprintf(f, "var_bytes        :");
     for (i = 0; i < afl->fsrv.map_size; i++) {
 
-      if (afl->var_bytes[i]) { fprintf(f, " %d", i); }
+      if (afl->var_bytes[i]) { fprintf(f, " %u", i); }
 
     }
 
@@ -1163,7 +1163,7 @@ void show_init_stats(afl_state_t *afl) {
 
   } else {
 
-    ACTF("-t option specified. We'll use an exec timeout of %d ms.",
+    ACTF("-t option specified. We'll use an exec timeout of %u ms.",
          afl->fsrv.exec_tmout);
 
   }
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 2af374f2..37f8db8a 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -76,8 +76,17 @@ static void at_exit() {
 
   }
 
-  if (pid1 > 0) { kill(pid1, SIGKILL); }
-  if (pid2 > 0) { kill(pid2, SIGKILL); }
+  int kill_signal = SIGKILL;
+
+  /* AFL_KILL_SIGNAL should already be a valid int at this point */
+  if (getenv("AFL_KILL_SIGNAL")) {
+
+    kill_signal = atoi(getenv("AFL_KILL_SIGNAL"));
+
+  }
+
+  if (pid1 > 0) { kill(pid1, kill_signal); }
+  if (pid2 > 0) { kill(pid2, kill_signal); }
 
 }
 
@@ -99,8 +108,8 @@ static void usage(u8 *argv0, int more_help) {
       "                  lin, quad> -- see docs/power_schedules.md\n"
       "  -f file       - location read by the fuzzed program (default: stdin "
       "or @@)\n"
-      "  -t msec       - timeout for each run (auto-scaled, 50-%d ms)\n"
-      "  -m megs       - memory limit for child process (%d MB, 0 = no limit)\n"
+      "  -t msec       - timeout for each run (auto-scaled, 50-%u ms)\n"
+      "  -m megs       - memory limit for child process (%u MB, 0 = no limit)\n"
       "  -Q            - use binary-only instrumentation (QEMU mode)\n"
       "  -U            - use unicorn-based instrumentation (Unicorn mode)\n"
       "  -W            - use qemu-based instrumentation with Wine (Wine "
@@ -185,10 +194,11 @@ static void usage(u8 *argv0, int more_help) {
       "AFL_EXPAND_HAVOC_NOW: immediately enable expand havoc mode (default: after 60 minutes and a cycle without finds)\n"
       "AFL_FAST_CAL: limit the calibration stage to three cycles for speedup\n"
       "AFL_FORCE_UI: force showing the status screen (for virtual consoles)\n"
-      "AFL_HANG_TMOUT: override timeout value (in milliseconds)\n"
       "AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in milliseconds)\n"
+      "AFL_HANG_TMOUT: override timeout value (in milliseconds)\n"
       "AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: don't warn about core dump handlers\n"
       "AFL_IMPORT_FIRST: sync and import test cases from other fuzzer instances first\n"
+      "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL)\n"
       "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n"
       "              the target was compiled for\n"
       "AFL_MAX_DET_EXTRAS: if more entries are in the dictionary list than this value\n"
@@ -299,7 +309,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
   s32 opt, i, auto_sync = 0 /*, user_set_cache = 0*/;
   u64 prev_queued = 0;
-  u32 sync_interval_cnt = 0, seek_to = 0, show_help = 0, map_size = MAP_SIZE;
+  u32 sync_interval_cnt = 0, seek_to = 0, show_help = 0,
+      map_size = get_map_size();
   u8 *extras_dir[4];
   u8  mem_limit_given = 0, exit_1 = 0, debug = 0,
      extras_dir_cnt = 0 /*, have_p = 0*/;
@@ -326,7 +337,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   if (get_afl_env("AFL_DEBUG")) { debug = afl->debug = 1; }
 
-  map_size = get_map_size();
+  //  map_size = get_map_size();
   afl_state_init(afl, map_size);
   afl->debug = debug;
   afl_fsrv_init(&afl->fsrv);
@@ -976,6 +987,9 @@ int main(int argc, char **argv_orig, char **envp) {
 
   #endif
 
+  afl->fsrv.kill_signal =
+      parse_afl_kill_signal_env(afl->afl_env.afl_kill_signal, SIGKILL);
+
   setup_signal_handlers();
   check_asan_opts(afl);
 
@@ -1534,7 +1548,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   if (!afl->pending_not_fuzzed) {
 
-    FATAL("We need at least on valid input seed that does not crash!");
+    FATAL("We need at least one valid input seed that does not crash!");
 
   }
 
diff --git a/src/afl-ld-lto.c b/src/afl-ld-lto.c
index fccdb1a5..7a4d9132 100644
--- a/src/afl-ld-lto.c
+++ b/src/afl-ld-lto.c
@@ -187,7 +187,7 @@ static void edit_params(int argc, char **argv) {
 
   if (debug)
     DEBUGF(
-        "passthrough=%s instrim=%d, gold_pos=%d, gold_present=%s "
+        "passthrough=%s instrim=%u, gold_pos=%u, gold_present=%s "
         "inst_present=%s rt_present=%s rt_lto_present=%s\n",
         passthrough ? "true" : "false", instrim, gold_pos,
         gold_present ? "true" : "false", inst_present ? "true" : "false",
@@ -252,11 +252,11 @@ static void edit_params(int argc, char **argv) {
 
 int main(int argc, char **argv) {
 
-  s32  pid, i, status;
-  u8 * ptr;
+  s32 pid, i, status;
+  //  u8 * ptr;
   char thecwd[PATH_MAX];
 
-  if ((ptr = getenv("AFL_LD_CALLER")) != NULL) {
+  if (getenv("AFL_LD_CALLER") != NULL) {
 
     FATAL("ld loop detected! Set AFL_REAL_LD!\n");
 
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 355b2dc3..5c9d38e0 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -662,7 +662,7 @@ static void usage(u8 *argv0) {
 
       "Execution control settings:\n"
       "  -t msec       - timeout for each run (none)\n"
-      "  -m megs       - memory limit for child process (%d MB)\n"
+      "  -m megs       - memory limit for child process (%u MB)\n"
       "  -Q            - use binary-only instrumentation (QEMU mode)\n"
       "  -U            - use Unicorn-based instrumentation (Unicorn mode)\n"
       "  -W            - use qemu-based instrumentation with Wine (Wine mode)\n"
@@ -693,12 +693,13 @@ static void usage(u8 *argv0) {
       "AFL_CRASH_EXITCODE: optional child exit code to be interpreted as "
       "crash\n"
       "AFL_DEBUG: enable extra developer output\n"
-      "AFL_MAP_SIZE: the shared memory size for that target. must be >= the "
-      "size\n"
-      "              the target was compiled for\n"
-      "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
       "AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during "
       "startup (in milliseconds)\n"
+      "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, "
+      "etc. (default: SIGKILL)\n"
+      "AFL_MAP_SIZE: the shared memory size for that target. must be >= the "
+      "size the target was compiled for\n"
+      "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
       "AFL_QUIET: do not print extra informational output\n",
       argv0, MEM_LIMIT, doc_path);
 
@@ -1014,9 +1015,9 @@ int main(int argc, char **argv_orig, char **envp) {
 
     DIR *          dir_in, *dir_out = NULL;
     struct dirent *dir_ent;
-    int            done = 0;
-    u8             infile[PATH_MAX], outfile[PATH_MAX];
-    u8             wait_for_gdb = 0;
+    //    int            done = 0;
+    u8 infile[PATH_MAX], outfile[PATH_MAX];
+    u8 wait_for_gdb = 0;
 #if !defined(DT_REG)
     struct stat statbuf;
 #endif
@@ -1090,11 +1091,11 @@ int main(int argc, char **argv_orig, char **envp) {
 
     if (get_afl_env("AFL_DEBUG")) {
 
-      int i = optind;
+      int j = optind;
       DEBUGF("%s:", fsrv->target_path);
-      while (argv[i] != NULL) {
+      while (argv[j] != NULL) {
 
-        SAYF(" \"%s\"", argv[i++]);
+        SAYF(" \"%s\"", argv[j++]);
 
       }
 
@@ -1115,6 +1116,9 @@ int main(int argc, char **argv_orig, char **envp) {
 
     }
 
+    fsrv->kill_signal =
+        parse_afl_kill_signal_env(getenv("AFL_KILL_SIGNAL"), SIGKILL);
+
     if (getenv("AFL_CRASH_EXITCODE")) {
 
       long exitcode = strtol(getenv("AFL_CRASH_EXITCODE"), NULL, 10);
@@ -1143,7 +1147,7 @@ int main(int argc, char **argv_orig, char **envp) {
     if (fsrv->support_shmem_fuzz && !fsrv->use_shmem_fuzz)
       shm_fuzz = deinit_shmem(fsrv, shm_fuzz);
 
-    while (done == 0 && (dir_ent = readdir(dir_in))) {
+    while ((dir_ent = readdir(dir_in))) {
 
       if (dir_ent->d_name[0] == '.') {
 
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index ed928c7c..6e2d7708 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -835,8 +835,8 @@ static void usage(u8 *argv0) {
       "Execution control settings:\n"
 
       "  -f file       - input file read by the tested program (stdin)\n"
-      "  -t msec       - timeout for each run (%d ms)\n"
-      "  -m megs       - memory limit for child process (%d MB)\n"
+      "  -t msec       - timeout for each run (%u ms)\n"
+      "  -m megs       - memory limit for child process (%u MB)\n"
       "  -Q            - use binary-only instrumentation (QEMU mode)\n"
       "  -U            - use unicorn-based instrumentation (Unicorn mode)\n"
       "  -W            - use qemu-based instrumentation with Wine (Wine "
@@ -855,6 +855,7 @@ static void usage(u8 *argv0) {
       "Environment variables used:\n"
       "AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash\n"
       "AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in milliseconds)\n"
+      "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL)\n"
       "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n"
       "              the target was compiled for\n"
       "AFL_PRELOAD:  LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
@@ -1134,6 +1135,9 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
+  fsrv->kill_signal =
+      parse_afl_kill_signal_env(getenv("AFL_KILL_SIGNAL"), SIGKILL);
+
   if (getenv("AFL_CRASH_EXITCODE")) {
 
     long exitcode = strtol(getenv("AFL_CRASH_EXITCODE"), NULL, 10);