aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorDominik Maier <domenukk@gmail.com>2020-10-06 15:38:36 +0200
committerDominik Maier <domenukk@gmail.com>2020-10-06 15:38:36 +0200
commit74dc227c4412d0121c9b972e5d89db89f54c6b3a (patch)
tree14da0722ebc330a9a7bf46086db0f45f811cbc1f /src
parenta4b60ca5b61c9bca5fa7b67528baeb3a8ea9320e (diff)
downloadafl++-74dc227c4412d0121c9b972e5d89db89f54c6b3a.tar.gz
code format
Diffstat (limited to 'src')
-rw-r--r--src/afl-fuzz-one.c22
-rw-r--r--src/afl-fuzz-queue.c34
-rw-r--r--src/afl-fuzz.c2
3 files changed, 43 insertions, 15 deletions
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 20558618..a5f77f11 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -1710,8 +1710,10 @@ custom_mutator_stage:
target_len, max_seed_size);
if (new_buf) {
+
queue_testcase_release(afl, target);
new_buf = NULL;
+
}
if (unlikely(!mutated_buf)) {
@@ -2302,7 +2304,9 @@ havoc_stage:
u32 tid;
do {
+
tid = rand_below(afl, afl->queued_paths);
+
} while (tid == afl->current_entry);
struct queue_entry *target = afl->queue_buf[tid];
@@ -2310,12 +2314,13 @@ havoc_stage:
/* Make sure that the target has a reasonable length. */
while (target && (target->len < 2 || target == afl->queue_cur)) {
+
target = target->next;
+
}
if (!target) { break; }
-
u32 new_len = target->len;
/* Get the testcase contents for splicing. */
@@ -2323,16 +2328,21 @@ havoc_stage:
u8 overwrite = 0;
if (temp_len >= 2 && rand_below(afl, 2)) {
+
overwrite = 1;
- }
- else if (temp_len + HAVOC_BLK_XL >= MAX_FILE) {
+
+ } else if (temp_len + HAVOC_BLK_XL >= MAX_FILE) {
if (temp_len >= 2) {
+
overwrite = 1;
+
} else {
+
queue_testcase_release(afl, target);
new_buf = NULL;
break;
+
}
}
@@ -2497,7 +2507,8 @@ retry_splicing:
the last differing byte. Bail out if the difference is just a single
byte or so. */
- locate_diffs(in_buf, splice_buf, MIN(len, (s64)target->len), &f_diff, &l_diff);
+ locate_diffs(in_buf, splice_buf, MIN(len, (s64)target->len), &f_diff,
+ &l_diff);
if (f_diff < 0 || l_diff < 2 || f_diff == l_diff) { goto retry_splicing; }
@@ -4503,7 +4514,8 @@ pacemaker_fuzzing:
len = target->len;
memcpy(new_buf, in_buf, split_at);
- memcpy(new_buf + split_at, splicing_buf + split_at, target->len - split_at);
+ memcpy(new_buf + split_at, splicing_buf + split_at,
+ target->len - split_at);
afl_swap_bufs(AFL_BUF_PARAM(in), AFL_BUF_PARAM(in_scratch));
in_buf = new_buf;
out_buf = afl_realloc(AFL_BUF_PARAM(out), len);
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index e2387aaa..721f9ac7 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -770,24 +770,33 @@ u32 calculate_score(afl_state_t *afl, struct queue_entry *q) {
/* Tell afl that this testcase may be evicted from the cache */
inline void queue_testcase_release(afl_state_t *afl, struct queue_entry *q) {
- (void) afl;
+
+ (void)afl;
q->testcase_refs--;
- if (unlikely(q->testcase_refs < 0)) { FATAL("Testcase refcount smaller than 0"); }
+ if (unlikely(q->testcase_refs < 0)) {
+
+ FATAL("Testcase refcount smaller than 0");
+
+ }
+
}
/* Returns the testcase buf from the file behind this queue entry.
Increases the refcount. */
u8 *queue_testcase_take(afl_state_t *afl, struct queue_entry *q) {
+
if (!q->testcase_buf) {
+
u32 tid = 0;
/* Buf not cached, let's do that now */
if (likely(afl->q_testcase_cache_count == TESTCASE_CACHE_SIZE)) {
+
/* Cache full. We neet to evict one to map one.
Get a random one which is not in use */
do {
- tid = rand_below(afl, afl->q_testcase_cache_count);
+ tid = rand_below(afl, afl->q_testcase_cache_count);
} while (afl->q_testcase_cache[tid]->testcase_refs > 0);
@@ -795,21 +804,19 @@ u8 *queue_testcase_take(afl_state_t *afl, struct queue_entry *q) {
/* free the current buf from cache */
munmap(old_cached->testcase_buf, old_cached->len);
old_cached->testcase_buf = NULL;
-
+
} else {
+
tid = afl->q_testcase_cache_count;
afl->q_testcase_cache_count++;
+
}
/* Map the test case into memory. */
int fd = open(q->fname, O_RDONLY);
- if (unlikely(fd < 0)) {
-
- PFATAL("Unable to open '%s'", q->fname);
-
- }
+ if (unlikely(fd < 0)) { PFATAL("Unable to open '%s'", q->fname); }
u32 len = q->len;
@@ -827,8 +834,15 @@ u8 *queue_testcase_take(afl_state_t *afl, struct queue_entry *q) {
afl->q_testcase_cache[tid] = q;
}
+
q->testcase_refs++;
- if (!q->testcase_buf) { FATAL("Testcase buf is NULL, this should never happen"); }
+ if (!q->testcase_buf) {
+
+ FATAL("Testcase buf is NULL, this should never happen");
+
+ }
+
return q->testcase_buf;
}
+
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index dd9aaa8f..9b7c1445 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1153,7 +1153,9 @@ int main(int argc, char **argv_orig, char **envp) {
if (extras_dir_cnt) {
for (i = 0; i < extras_dir_cnt; i++) {
+
load_extras(afl, extras_dir[i]);
+
}
dedup_extras(afl);