push to stable (#1967)

* Output afl-clang-fast stuffs only if necessary (#1912)

* afl-cc header

* afl-cc common declarations

 - Add afl-cc-state.c
 - Strip includes, find_object, debug/be_quiet/have_*/callname setting from afl-cc.c
 - Use debugf_args in main
 - Modify execvp stuffs to fit new aflcc struct

* afl-cc show usage

* afl-cc mode selecting

1. compiler_mode by callname in argv[0]
2. compiler_mode by env "AFL_CC_COMPILER"
3. compiler_mode/instrument_mode by command line options "--afl-..."
4. instrument_mode/compiler_mode by various env vars including "AFL_LLVM_INSTRUMENT"
5. final checking steps
6. print "... - mode: %s-%s\n"
7. determine real argv[0] according to compiler_mode

* afl-cc macro defs

* afl-cc linking behaviors

* afl-cc fsanitize behaviors

* afl-cc misc

* afl-cc body update

* afl-cc all-in-one

formated with custom-format.py

* nits

---------

Co-authored-by: vanhauser-thc <vh@thc.org>

* changelog

* update grammar mutator

* lto llvm 12+

* docs(custom_mutators): fix missing ':' (#1953)

* Fix broken LTO mode and response file support (#1948)

* Strip `-Wl,-no-undefined` during compilation (#1952)

Make the compiler wrapper stripping `-Wl,-no-undefined` in addition to `-Wl,--no-undefined`.
Both versions of the flag are accepted by clang and, therefore, used by building systems in the wild (e.g., samba will not build without this fix).

* Remove dead code in write_to_testcase (#1955)

The custom_mutators_count check in if case is duplicate with if condition.
The else case is custom_mutators_count == 0, neither custom_mutator_list iteration nor sent check needed.

Signed-off-by: Xeonacid <h.dwwwwww@gmail.com>

* update qemuafl

* WIP: Add ability to generate drcov trace using QEMU backend (#1956)

* Document new drcov QEMU plugin

* Add link to lightkeeper for QEMU drcov file loading

---------

Co-authored-by: Jean-Romain Garnier <jean-romain.garnier@airbus.com>

* code format

* changelog

* sleep on uid != 0 afl-system-config

* fix segv about skip_next, warn on unsupported cases of linking options (#1958)

* todos

* ensure afl-cc only allows available compiler modes

* update grammar mutator

* disable aslr on apple

* fix for arm64

* help selective instrumentation

* typos

* macos

* add compiler test script

* apple fixes

* bump nyx submodules (#1963)

* fix docs

* update changelog

* update grammar mutator

* improve compiler test script

* gcc asan workaround (#1966)

* fix github merge fuckup

* fix

* Fix afl-cc (#1968)

- Check if too many cmdline params here, each time before insert a new param.
 - Check if it is "-fsanitize=..." before we do sth.
 - Remove improper param_st transfer.

* Avoid adding llvmnative instrumentation when linking rust sanitizer runtime (#1969)

* Dynamic instrumentation filtering for LLVM native (#1971)

* Add two dynamic instrumentation filter methods to runtime

* Always use pc-table with native pcguard

* Add make_symbol_list.py and README

* changelog

* todos

* new forkserver check

* fix

* nyx test for CI

* improve nyx docs

* Fixes to afl-cc and documentation (#1974)

* Always compile with -ldl when building for CODE_COVERAGE

When building with CODE_COVERAGE, the afl runtime contains code that
calls `dladdr` which requires -ldl. Under most circumstances, clang
already adds this (e.g. when building with pc-table), but there are some
circumstances where it isn't added automatically.

* Add visibility declaration to __afl_connected

When building with hidden visibility, the use of __AFL_LOOP inside such
code can cause linker errors due to __afl_connected being declared
"hidden".

* Update docs to clarify that CODE_COVERAGE=1 is required for dynamic_covfilter

* nits

* nyx build script updates

* test error output

* debug ci

* debug ci

* Improve afl-cc (#1975)

* update response file support

 - full support of rsp file
 - fix some segv issues

* Improve afl-cc

 - remove dead code about allow/denylist options of sancov
 - missing `if (!aflcc->have_msan)`
 - add docs for each function
 - typo

* enable nyx

* debug ci

* debug ci

* debug ci

* debug ci

* debug ci

* debug ci

* debug ci

* debug ci

* fix ci

* clean test script

* NO_NYX

* NO_NYX

* fix ci

* debug ci

* fix ci

* finalize ci fix

---------

Signed-off-by: Xeonacid <h.dwwwwww@gmail.com>
Co-authored-by: Sonic <50692172+SonicStark@users.noreply.github.com>
Co-authored-by: Xeonacid <h.dwwwwww@gmail.com>
Co-authored-by: Nils Bars <nils.bars@rub.de>
Co-authored-by: Jean-Romain Garnier <7504819+JRomainG@users.noreply.github.com>
Co-authored-by: Jean-Romain Garnier <jean-romain.garnier@airbus.com>
Co-authored-by: Sergej Schumilo <sergej@schumilo.de>
Co-authored-by: Christian Holler (:decoder) <choller@mozilla.com>

4 files changed, 554 insertions, 222 deletions

diff --git a/src/afl-cc.c b/src/afl-cc.c
index 192c5423..c300ddfc 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -51,7 +51,7 @@
   #define MAX_PARAMS_NUM 2048
 #endif
 
-/* Global declarations */
+/** Global declarations -----BEGIN----- **/
 
 typedef enum {
 
@@ -170,8 +170,11 @@ typedef struct aflcc_state {
   u8 have_instr_env, have_gcc, have_clang, have_llvm, have_gcc_plugin, have_lto,
       have_optimized_pcguard, have_instr_list;
 
-  u8 fortify_set, asan_set, x_set, bit_mode, preprocessor_only, have_unroll,
-      have_o, have_pic, have_c, shared_linking, partial_linking, non_dash;
+  u8 fortify_set, x_set, bit_mode, preprocessor_only, have_unroll, have_o,
+      have_pic, have_c, shared_linking, partial_linking, non_dash, have_fp,
+      have_flto, have_hidden, have_fortify, have_fcf, have_staticasan,
+      have_rust_asanrt, have_asan, have_msan, have_ubsan, have_lsan, have_tsan,
+      have_cfisan;
 
   // u8 *march_opt;
   u8  need_aflpplib;
@@ -184,25 +187,27 @@ typedef struct aflcc_state {
 
 void aflcc_state_init(aflcc_state_t *, u8 *argv0);
 
-/* Try to find a specific runtime we need, the path to obj would be
-   allocated and returned. Otherwise it returns NULL on fail. */
 u8 *find_object(aflcc_state_t *, u8 *obj);
 
 void find_built_deps(aflcc_state_t *);
 
-static inline void limit_params(aflcc_state_t *aflcc, u32 add) {
+/* Insert param into the new argv, raise error if MAX_PARAMS_NUM exceeded. */
+static inline void insert_param(aflcc_state_t *aflcc, u8 *param) {
 
-  if (aflcc->cc_par_cnt + add >= MAX_PARAMS_NUM)
+  if (unlikely(aflcc->cc_par_cnt + 1 >= MAX_PARAMS_NUM))
     FATAL("Too many command line parameters, please increase MAX_PARAMS_NUM.");
 
-}
-
-static inline void insert_param(aflcc_state_t *aflcc, u8 *param) {
-
   aflcc->cc_params[aflcc->cc_par_cnt++] = param;
 
 }
 
+/*
+  Insert a param which contains path to the object file. It uses find_object to
+  get the path based on the name `obj`, and then uses a sprintf like method to
+  format it with `fmt`. If `fmt` is NULL, the inserted arg is same as the path.
+  If `msg` provided, it should be an error msg raised if the path can't be
+  found. `obj` must not be NULL.
+*/
 static inline void insert_object(aflcc_state_t *aflcc, u8 *obj, u8 *fmt,
                                  u8 *msg) {
 
@@ -232,6 +237,7 @@ static inline void insert_object(aflcc_state_t *aflcc, u8 *obj, u8 *fmt,
 
 }
 
+/* Insert params into the new argv, make clang load the pass. */
 static inline void load_llvm_pass(aflcc_state_t *aflcc, u8 *pass) {
 
 #if LLVM_MAJOR >= 11                                /* use new pass manager */
@@ -292,8 +298,12 @@ void add_lto_linker(aflcc_state_t *);
 void add_lto_passes(aflcc_state_t *);
 void add_runtime(aflcc_state_t *);
 
-/* Working state */
+/** Global declarations -----END----- **/
 
+/*
+  Init global state struct. We also extract the callname,
+  check debug options and if in C++ mode here.
+*/
 void aflcc_state_init(aflcc_state_t *aflcc, u8 *argv0) {
 
   // Default NULL/0 is a good start
@@ -353,7 +363,7 @@ void aflcc_state_init(aflcc_state_t *aflcc, u8 *argv0) {
 }
 
 /*
-  in find_object() we look here:
+  Try to find a specific runtime we need, in here:
 
   1. firstly we check the $AFL_PATH environment variable location if set
   2. next we check argv[0] if it has path information and use it
@@ -367,7 +377,6 @@ void aflcc_state_init(aflcc_state_t *aflcc, u8 *argv0) {
   if all these attempts fail - we return NULL and the caller has to decide
   what to do. Otherwise the path to obj would be allocated and returned.
 */
-
 u8 *find_object(aflcc_state_t *aflcc, u8 *obj) {
 
   u8 *argv0 = aflcc->argv0;
@@ -500,6 +509,10 @@ u8 *find_object(aflcc_state_t *aflcc, u8 *obj) {
 
 }
 
+/*
+  Deduce some info about compiler toolchains in current system,
+  from the building results of AFL++
+*/
 void find_built_deps(aflcc_state_t *aflcc) {
 
   char *ptr = NULL;
@@ -572,8 +585,9 @@ void find_built_deps(aflcc_state_t *aflcc) {
 
 }
 
-/* compiler_mode & instrument_mode selecting */
+/** compiler_mode & instrument_mode selecting -----BEGIN----- **/
 
+/* Select compiler_mode by callname, such as "afl-clang-fast", etc. */
 void compiler_mode_by_callname(aflcc_state_t *aflcc) {
 
   if (strncmp(aflcc->callname, "afl-clang-fast", 14) == 0) {
@@ -611,30 +625,26 @@ void compiler_mode_by_callname(aflcc_state_t *aflcc) {
 
     aflcc->compiler_mode = GCC_PLUGIN;
 
-#if defined(__x86_64__)
-
   } else if (strncmp(aflcc->callname, "afl-gcc", 7) == 0 ||
 
              strncmp(aflcc->callname, "afl-g++", 7) == 0) {
 
     aflcc->compiler_mode = GCC;
 
-#endif
-
-#if defined(__x86_64__)
-
   } else if (strcmp(aflcc->callname, "afl-clang") == 0 ||
 
              strcmp(aflcc->callname, "afl-clang++") == 0) {
 
     aflcc->compiler_mode = CLANG;
 
-#endif
-
   }
 
 }
 
+/*
+  Select compiler_mode by env AFL_CC_COMPILER. And passthrough mode can be
+  regarded as a special compiler_mode, so we check for it here, too.
+*/
 void compiler_mode_by_environ(aflcc_state_t *aflcc) {
 
   if (getenv("AFL_PASSTHROUGH") || getenv("AFL_NOOPT")) {
@@ -675,22 +685,14 @@ void compiler_mode_by_environ(aflcc_state_t *aflcc) {
 
       aflcc->compiler_mode = GCC_PLUGIN;
 
-#if defined(__x86_64__)
-
     } else if (strcasecmp(ptr, "GCC") == 0) {
 
       aflcc->compiler_mode = GCC;
 
-#endif
-
-#if defined(__x86_64__)
-
     } else if (strcasecmp(ptr, "CLANG") == 0) {
 
       aflcc->compiler_mode = CLANG;
 
-#endif
-
     } else
 
       FATAL("Unknown AFL_CC_COMPILER mode: %s\n", ptr);
@@ -699,7 +701,13 @@ void compiler_mode_by_environ(aflcc_state_t *aflcc) {
 
 }
 
-// If it can be inferred, instrument_mode would also be set
+/*
+  Select compiler_mode by command line options --afl-...
+  If it can be inferred, instrument_mode would also be set.
+  This can supersedes previous result based on callname
+  or AFL_CC_COMPILER. And "--afl_noopt"/"--afl-noopt" will
+  be overwritten by "-g".
+*/
 void compiler_mode_by_cmdline(aflcc_state_t *aflcc, int argc, char **argv) {
 
   char *ptr = NULL;
@@ -774,22 +782,14 @@ void compiler_mode_by_cmdline(aflcc_state_t *aflcc, int argc, char **argv) {
 
         aflcc->compiler_mode = GCC_PLUGIN;
 
-#if defined(__x86_64__)
-
       } else if (strcasecmp(ptr, "GCC") == 0) {
 
         aflcc->compiler_mode = GCC;
 
-#endif
-
-#if defined(__x86_64__)
-
       } else if (strncasecmp(ptr, "CLANG", 5) == 0) {
 
         aflcc->compiler_mode = CLANG;
 
-#endif
-
       } else
 
         FATAL("Unknown --afl-... compiler mode: %s\n", argv[i]);
@@ -800,6 +800,12 @@ void compiler_mode_by_cmdline(aflcc_state_t *aflcc, int argc, char **argv) {
 
 }
 
+/*
+  Select instrument_mode by those envs in old style:
+  - USE_TRACE_PC, AFL_USE_TRACE_PC, AFL_LLVM_USE_TRACE_PC, AFL_TRACE_PC
+  - AFL_LLVM_CALLER, AFL_LLVM_CTX, AFL_LLVM_CTX_K
+  - AFL_LLVM_NGRAM_SIZE
+*/
 static void instrument_mode_old_environ(aflcc_state_t *aflcc) {
 
   if (getenv("AFL_LLVM_INSTRIM") || getenv("INSTRIM") ||
@@ -859,7 +865,11 @@ static void instrument_mode_old_environ(aflcc_state_t *aflcc) {
 
 }
 
-// compiler_mode would also be set if depended by the instrument_mode
+/*
+  Select instrument_mode by env 'AFL_LLVM_INSTRUMENT'.
+  Previous compiler_mode will be superseded, if required by some
+  values of instrument_mode.
+*/
 static void instrument_mode_new_environ(aflcc_state_t *aflcc) {
 
   if (!getenv("AFL_LLVM_INSTRUMENT")) { return; }
@@ -960,7 +970,6 @@ static void instrument_mode_new_environ(aflcc_state_t *aflcc) {
 
     }
 
-#if defined(__x86_64__)
     if (strcasecmp(ptr2, "gcc") == 0) {
 
       if (!aflcc->instrument_mode || aflcc->instrument_mode == INSTRUMENT_GCC)
@@ -975,9 +984,6 @@ static void instrument_mode_new_environ(aflcc_state_t *aflcc) {
 
     }
 
-#endif
-
-#if defined(__x86_64__)
     if (strcasecmp(ptr2, "clang") == 0) {
 
       if (!aflcc->instrument_mode || aflcc->instrument_mode == INSTRUMENT_CLANG)
@@ -992,8 +998,6 @@ static void instrument_mode_new_environ(aflcc_state_t *aflcc) {
 
     }
 
-#endif
-
     if (strncasecmp(ptr2, "ctx-", strlen("ctx-")) == 0 ||
         strncasecmp(ptr2, "kctx-", strlen("c-ctx-")) == 0 ||
         strncasecmp(ptr2, "k-ctx-", strlen("k-ctx-")) == 0) {
@@ -1089,6 +1093,11 @@ static void instrument_mode_new_environ(aflcc_state_t *aflcc) {
 
 }
 
+/*
+  Select instrument_mode by envs, the top wrapper. We check
+  have_instr_env firstly, then call instrument_mode_old_environ
+  and instrument_mode_new_environ sequentially.
+*/
 void instrument_mode_by_environ(aflcc_state_t *aflcc) {
 
   if (getenv("AFL_LLVM_INSTRUMENT_FILE") || getenv("AFL_LLVM_WHITELIST") ||
@@ -1112,6 +1121,10 @@ void instrument_mode_by_environ(aflcc_state_t *aflcc) {
 
 }
 
+/*
+  Workaround to ensure CALLER, CTX, K-CTX and NGRAM
+  instrumentation were used correctly.
+*/
 static void instrument_opt_mode_exclude(aflcc_state_t *aflcc) {
 
   if ((aflcc->instrument_opt_mode & INSTRUMENT_OPT_CTX) &&
@@ -1147,6 +1160,11 @@ static void instrument_opt_mode_exclude(aflcc_state_t *aflcc) {
 
 }
 
+/*
+  Last step of compiler_mode & instrument_mode selecting.
+  We have a few of workarounds here, to check any corner cases,
+  prepare for a series of fallbacks, and raise warnings or errors.
+*/
 void mode_final_checkout(aflcc_state_t *aflcc, int argc, char **argv) {
 
   if (aflcc->instrument_opt_mode &&
@@ -1180,11 +1198,11 @@ void mode_final_checkout(aflcc_state_t *aflcc, int argc, char **argv) {
   switch (aflcc->compiler_mode) {
 
     case GCC:
-      if (!aflcc->have_gcc) FATAL("afl-gcc not available on your platform!");
+      if (!aflcc->have_gcc) FATAL("afl-gcc is not available on your platform!");
       break;
     case CLANG:
       if (!aflcc->have_clang)
-        FATAL("afl-clang not available on your platform!");
+        FATAL("afl-clang is not available on your platform!");
       break;
     case LLVM:
       if (!aflcc->have_llvm)
@@ -1351,6 +1369,10 @@ void mode_final_checkout(aflcc_state_t *aflcc, int argc, char **argv) {
 
 }
 
+/*
+  Print welcome message on screen, giving brief notes about
+  compiler_mode and instrument_mode.
+*/
 void mode_notification(aflcc_state_t *aflcc) {
 
   char *ptr2 = alloc_printf(" + NGRAM-%u", aflcc->ngram_size);
@@ -1389,6 +1411,17 @@ void mode_notification(aflcc_state_t *aflcc) {
 
 }
 
+/*
+  Set argv[0] required by execvp. It can be
+  - specified by env AFL_CXX
+  - g++ or clang++
+  - CLANGPP_BIN or LLVM_BINDIR/clang++
+  when in C++ mode, or
+  - specified by env AFL_CC
+  - gcc or clang
+  - CLANG_BIN or LLVM_BINDIR/clang
+  otherwise.
+*/
 void add_real_argv0(aflcc_state_t *aflcc) {
 
   static u8 llvm_fullpath[PATH_MAX];
@@ -1455,7 +1488,9 @@ void add_real_argv0(aflcc_state_t *aflcc) {
 
 }
 
-/* Macro defs for the preprocessor */
+/** compiler_mode & instrument_mode selecting -----END----- **/
+
+/** Macro defs for the preprocessor -----BEGIN----- **/
 
 void add_defs_common(aflcc_state_t *aflcc) {
 
@@ -1464,8 +1499,11 @@ void add_defs_common(aflcc_state_t *aflcc) {
 
 }
 
-/* See instrumentation/README.instrument_list.md#
-    2-selective-instrumentation-with-_afl_coverage-directives */
+/*
+  __afl_coverage macro defs. See
+  instrumentation/README.instrument_list.md#
+  2-selective-instrumentation-with-_afl_coverage-directives
+*/
 void add_defs_selective_instr(aflcc_state_t *aflcc) {
 
   if (aflcc->plusplus_mode) {
@@ -1499,9 +1537,11 @@ void add_defs_selective_instr(aflcc_state_t *aflcc) {
 
 }
 
-/* As documented in instrumentation/README.persistent_mode.md, deferred
-    forkserver initialization and persistent mode are not available in afl-gcc
-    and afl-clang. */
+/*
+  Macro defs for persistent mode. As documented in
+  instrumentation/README.persistent_mode.md, deferred forkserver initialization
+  and persistent mode are not available in afl-gcc and afl-clang.
+*/
 void add_defs_persistent_mode(aflcc_state_t *aflcc) {
 
   if (aflcc->compiler_mode == GCC || aflcc->compiler_mode == CLANG) return;
@@ -1552,7 +1592,7 @@ void add_defs_persistent_mode(aflcc_state_t *aflcc) {
       "({ static volatile const char *_B __attribute__((used,unused)); "
       " _B = (const char*)\"" PERSIST_SIG
       "\"; "
-      "extern int __afl_connected;"
+      "extern __attribute__((visibility(\"default\"))) int __afl_connected;"
 #ifdef __APPLE__
       "__attribute__((visibility(\"default\"))) "
       "int _L(unsigned int) __asm__(\"___afl_persistent_loop\"); "
@@ -1580,9 +1620,15 @@ void add_defs_persistent_mode(aflcc_state_t *aflcc) {
 
 }
 
-/* Control  _FORTIFY_SOURCE */
+/*
+  Control macro def of _FORTIFY_SOURCE. It will do nothing
+  if we detect this routine has been called previously, or
+  the macro already here in these existing args.
+*/
 void add_defs_fortify(aflcc_state_t *aflcc, u8 action) {
 
+  if (aflcc->have_fortify) { return; }
+
   switch (action) {
 
     case 1:
@@ -1599,8 +1645,11 @@ void add_defs_fortify(aflcc_state_t *aflcc, u8 action) {
 
   }
 
+  aflcc->have_fortify = 1;
+
 }
 
+/* Macro defs of __AFL_LEAK_CHECK, __AFL_LSAN_ON and __AFL_LSAN_OFF */
 void add_defs_lsan_ctrl(aflcc_state_t *aflcc) {
 
   insert_param(aflcc, "-includesanitizer/lsan_interface.h");
@@ -1613,7 +1662,9 @@ void add_defs_lsan_ctrl(aflcc_state_t *aflcc) {
 
 }
 
-/* About fsanitize (including PCGUARD features) */
+/** Macro defs for the preprocessor -----END----- **/
+
+/** About -fsanitize -----BEGIN----- **/
 
 /* For input "-fsanitize=...", it:
 
@@ -1692,26 +1743,59 @@ static u8 fsanitize_fuzzer_comma(char *string) {
 
 }
 
+/*
+  Parse and process possible -fsanitize related args, return PARAM_MISS
+  if nothing matched. We have 3 main tasks here for these args:
+  - Check which one of those sanitizers present here.
+  - Check if libfuzzer present. We need to block the request of enable
+    libfuzzer, and link harness with our libAFLDriver.a later.
+  - Check if SanCov allow/denylist options present. We need to try switching
+    to LLVMNATIVE instead of using our optimized PCGUARD anyway. If we
+    can't make it finally for various reasons, just drop these options.
+*/
 param_st parse_fsanitize(aflcc_state_t *aflcc, u8 *cur_argv, u8 scan) {
 
   param_st final_ = PARAM_MISS;
 
-  if (!strncmp(cur_argv, "-fsanitize-coverage-", 20) &&
-      strstr(cur_argv, "list=")) {
-
-    if (scan) {
-
-      aflcc->have_instr_list = 1;
-      final_ = PARAM_SCAN;
+// MACRO START
+#define HAVE_SANITIZER_SCAN_KEEP(v, k)        \
+  do {                                        \
+                                              \
+    if (strstr(cur_argv, "=" STRINGIFY(k)) || \
+        strstr(cur_argv, "," STRINGIFY(k))) { \
+                                              \
+      if (scan) {                             \
+                                              \
+        aflcc->have_##v = 1;                  \
+        final_ = PARAM_SCAN;                  \
+                                              \
+      } else {                                \
+                                              \
+        final_ = PARAM_KEEP;                  \
+                                              \
+      }                                       \
+                                              \
+    }                                         \
+                                              \
+  } while (0)
 
-    } else {
+  // MACRO END
 
-      final_ = PARAM_KEEP;  // may be set to DROP next
+  if (!strncmp(cur_argv, "-fsanitize=", strlen("-fsanitize="))) {
 
-    }
+    HAVE_SANITIZER_SCAN_KEEP(asan, address);
+    HAVE_SANITIZER_SCAN_KEEP(msan, memory);
+    HAVE_SANITIZER_SCAN_KEEP(ubsan, undefined);
+    HAVE_SANITIZER_SCAN_KEEP(tsan, thread);
+    HAVE_SANITIZER_SCAN_KEEP(lsan, leak);
+    HAVE_SANITIZER_SCAN_KEEP(cfisan, cfi);
 
   }
 
+#undef HAVE_SANITIZER_SCAN_KEEP
+
+  // We can't use a "else if" there, because some of the following
+  // matching rules overlap with those in the if-statement above.
   if (!strcmp(cur_argv, "-fsanitize=fuzzer")) {
 
     if (scan) {
@@ -1751,44 +1835,27 @@ param_st parse_fsanitize(aflcc_state_t *aflcc, u8 *cur_argv, u8 scan) {
 
     }
 
-  } else if ((!strncmp(cur_argv, "-fsanitize=fuzzer-",
+  } else if (!strncmp(cur_argv, "-fsanitize-coverage-", 20) &&
 
-                       strlen("-fsanitize=fuzzer-")) ||
-              !strncmp(cur_argv, "-fsanitize-coverage",
-                       strlen("-fsanitize-coverage"))) &&
-             (strncmp(cur_argv, "sanitize-coverage-allow",
-                      strlen("sanitize-coverage-allow")) &&
-              strncmp(cur_argv, "sanitize-coverage-deny",
-                      strlen("sanitize-coverage-deny")) &&
-              aflcc->instrument_mode != INSTRUMENT_LLVMNATIVE)) {
+             strstr(cur_argv, "list=")) {
 
     if (scan) {
 
+      aflcc->have_instr_list = 1;
       final_ = PARAM_SCAN;
 
     } else {
 
-      if (!be_quiet) { WARNF("Found '%s' - stripping!", cur_argv); }
-      final_ = PARAM_DROP;
-
-    }
+      if (aflcc->instrument_mode != INSTRUMENT_LLVMNATIVE) {
 
-  }
-
-  if (!strcmp(cur_argv, "-fsanitize=address") ||
-      !strcmp(cur_argv, "-fsanitize=memory")) {
-
-    if (scan) {
+        if (!be_quiet) { WARNF("Found '%s' - stripping!", cur_argv); }
+        final_ = PARAM_DROP;
 
-      // "-fsanitize=undefined,address" may be un-treated, but it's OK.
-      aflcc->asan_set = 1;
-      final_ = PARAM_SCAN;
+      } else {
 
-    } else {
+        final_ = PARAM_KEEP;
 
-      // It's impossible that final_ is PARAM_DROP before,
-      // so no checks are needed here.
-      final_ = PARAM_KEEP;
+      }
 
     }
 
@@ -1800,76 +1867,125 @@ param_st parse_fsanitize(aflcc_state_t *aflcc, u8 *cur_argv, u8 scan) {
 
 }
 
+/*
+  Add params for sanitizers. Here we need to consider:
+  - Use static runtime for asan, as much as possible.
+  - ASAN, MSAN, AFL_HARDEN are mutually exclusive.
+  - Add options if not found there, on request of AFL_USE_ASAN, AFL_USE_MSAN,
+  etc.
+  - Update have_* so that functions called after this can have correct context.
+    However this also means any functions called before should NOT depend on
+  these have_*, otherwise they may not work as expected.
+*/
 void add_sanitizers(aflcc_state_t *aflcc, char **envp) {
 
-  if (!aflcc->asan_set) {
+  if (getenv("AFL_USE_ASAN") || aflcc->have_asan) {
+
+    if (getenv("AFL_USE_MSAN") || aflcc->have_msan)
+      FATAL("ASAN and MSAN are mutually exclusive");
 
-    if (getenv("AFL_USE_ASAN")) {
+    if (getenv("AFL_HARDEN"))
+      FATAL("ASAN and AFL_HARDEN are mutually exclusive");
 
-      if (getenv("AFL_USE_MSAN")) FATAL("ASAN and MSAN are mutually exclusive");
+    if (aflcc->compiler_mode == GCC_PLUGIN && !aflcc->have_staticasan) {
 
-      if (getenv("AFL_HARDEN"))
-        FATAL("ASAN and AFL_HARDEN are mutually exclusive");
+      insert_param(aflcc, "-static-libasan");
 
-      add_defs_fortify(aflcc, 0);
-      insert_param(aflcc, "-fsanitize=address");
+    }
 
-    } else if (getenv("AFL_USE_MSAN")) {
+    add_defs_fortify(aflcc, 0);
+    if (!aflcc->have_asan) { insert_param(aflcc, "-fsanitize=address"); }
+    aflcc->have_asan = 1;
 
-      if (getenv("AFL_USE_ASAN")) FATAL("ASAN and MSAN are mutually exclusive");
+  } else if (getenv("AFL_USE_MSAN") || aflcc->have_msan) {
 
-      if (getenv("AFL_HARDEN"))
-        FATAL("MSAN and AFL_HARDEN are mutually exclusive");
+    if (getenv("AFL_USE_ASAN") || aflcc->have_asan)
+      FATAL("ASAN and MSAN are mutually exclusive");
 
-      add_defs_fortify(aflcc, 0);
-      insert_param(aflcc, "-fsanitize=memory");
+    if (getenv("AFL_HARDEN"))
+      FATAL("MSAN and AFL_HARDEN are mutually exclusive");
 
-    }
+    add_defs_fortify(aflcc, 0);
+    if (!aflcc->have_msan) { insert_param(aflcc, "-fsanitize=memory"); }
+    aflcc->have_msan = 1;
 
   }
 
-  if (getenv("AFL_USE_UBSAN")) {
+  if (getenv("AFL_USE_UBSAN") || aflcc->have_ubsan) {
+
+    if (!aflcc->have_ubsan) {
+
+      insert_param(aflcc, "-fsanitize=undefined");
+      insert_param(aflcc, "-fsanitize-undefined-trap-on-error");
+      insert_param(aflcc, "-fno-sanitize-recover=all");
+
+    }
+
+    if (!aflcc->have_fp) {
 
-    insert_param(aflcc, "-fsanitize=undefined");
-    insert_param(aflcc, "-fsanitize-undefined-trap-on-error");
-    insert_param(aflcc, "-fno-sanitize-recover=all");
-    insert_param(aflcc, "-fno-omit-frame-pointer");
+      insert_param(aflcc, "-fno-omit-frame-pointer");
+      aflcc->have_fp = 1;
+
+    }
+
+    aflcc->have_ubsan = 1;
 
   }
 
-  if (getenv("AFL_USE_TSAN")) {
+  if (getenv("AFL_USE_TSAN") || aflcc->have_tsan) {
+
+    if (!aflcc->have_fp) {
+
+      insert_param(aflcc, "-fno-omit-frame-pointer");
+      aflcc->have_fp = 1;
+
+    }
 
-    insert_param(aflcc, "-fsanitize=thread");
-    insert_param(aflcc, "-fno-omit-frame-pointer");
+    if (!aflcc->have_tsan) { insert_param(aflcc, "-fsanitize=thread"); }
+    aflcc->have_tsan = 1;
 
   }
 
-  if (getenv("AFL_USE_LSAN")) {
+  if (getenv("AFL_USE_LSAN") && !aflcc->have_lsan) {
 
     insert_param(aflcc, "-fsanitize=leak");
     add_defs_lsan_ctrl(aflcc);
+    aflcc->have_lsan = 1;
 
   }
 
-  if (getenv("AFL_USE_CFISAN")) {
+  if (getenv("AFL_USE_CFISAN") || aflcc->have_cfisan) {
 
     if (aflcc->compiler_mode == GCC_PLUGIN || aflcc->compiler_mode == GCC) {
 
-      insert_param(aflcc, "-fcf-protection=full");
+      if (!aflcc->have_fcf) { insert_param(aflcc, "-fcf-protection=full"); }
 
     } else {
 
-      if (!aflcc->lto_mode) {
+      if (!aflcc->lto_mode && !aflcc->have_flto) {
 
         uint32_t i = 0, found = 0;
-        while (envp[i] != NULL && !found)
+        while (envp[i] != NULL && !found) {
+
           if (strncmp("-flto", envp[i++], 5) == 0) found = 1;
-        if (!found) insert_param(aflcc, "-flto");
+
+        }
+
+        if (!found) { insert_param(aflcc, "-flto"); }
+        aflcc->have_flto = 1;
 
       }
 
-      insert_param(aflcc, "-fsanitize=cfi");
-      insert_param(aflcc, "-fvisibility=hidden");
+      if (!aflcc->have_cfisan) { insert_param(aflcc, "-fsanitize=cfi"); }
+
+      if (!aflcc->have_hidden) {
+
+        insert_param(aflcc, "-fvisibility=hidden");
+        aflcc->have_hidden = 1;
+
+      }
+
+      aflcc->have_cfisan = 1;
 
     }
 
@@ -1877,42 +1993,48 @@ void add_sanitizers(aflcc_state_t *aflcc, char **envp) {
 
 }
 
+/* Add params to enable LLVM SanCov, the native PCGUARD */
 void add_native_pcguard(aflcc_state_t *aflcc) {
 
+  /* If there is a rust ASan runtime on the command line, it is likely we're
+   * linking from rust and adding native flags requiring the sanitizer runtime
+   * will trigger native clang to add yet another runtime, causing linker
+   * errors. For now we shouldn't add instrumentation here, we're linking
+   * anyway.
+   */
+  if (aflcc->have_rust_asanrt) { return; }
+
   /* If llvm-config doesn't figure out LLVM_MAJOR, just
    go on anyway and let compiler complain if doesn't work. */
 
-  if (aflcc->instrument_opt_mode & INSTRUMENT_OPT_CODECOV) {
-
 #if LLVM_MAJOR > 0 && LLVM_MAJOR < 6
-    FATAL("pcguard instrumentation with pc-table requires LLVM 6.0.1+");
+  FATAL("pcguard instrumentation with pc-table requires LLVM 6.0.1+");
 #else
   #if LLVM_MAJOR == 0
-    WARNF(
-        "pcguard instrumentation with pc-table requires LLVM 6.0.1+"
-        " otherwise the compiler will fail");
+  WARNF(
+      "pcguard instrumentation with pc-table requires LLVM 6.0.1+"
+      " otherwise the compiler will fail");
   #endif
+  if (aflcc->instrument_opt_mode & INSTRUMENT_OPT_CODECOV) {
+
     insert_param(aflcc,
                  "-fsanitize-coverage=trace-pc-guard,bb,no-prune,pc-table");
-#endif
 
   } else {
 
-#if LLVM_MAJOR > 0 && LLVM_MAJOR < 4
-    FATAL("pcguard instrumentation requires LLVM 4.0.1+");
-#else
-  #if LLVM_MAJOR == 0
-    WARNF(
-        "pcguard instrumentation requires LLVM 4.0.1+"
-        " otherwise the compiler will fail");
-  #endif
-    insert_param(aflcc, "-fsanitize-coverage=trace-pc-guard");
-#endif
+    insert_param(aflcc, "-fsanitize-coverage=trace-pc-guard,pc-table");
 
   }
 
+#endif
+
 }
 
+/*
+  Add params to launch our optimized PCGUARD on request.
+  It will fallback to use the native PCGUARD in some cases. If so, plz
+  bear in mind that instrument_mode will be set to INSTRUMENT_LLVMNATIVE.
+*/
 void add_optimized_pcguard(aflcc_state_t *aflcc) {
 
 #if LLVM_MAJOR >= 13
@@ -1929,7 +2051,7 @@ void add_optimized_pcguard(aflcc_state_t *aflcc) {
       SAYF(
           "Using unoptimized trace-pc-guard, due usage of "
           "-fsanitize-coverage-allow/denylist, you can use "
-          "AFL_LLVM_ALLOWLIST/AFL_LLMV_DENYLIST instead.\n");
+          "AFL_LLVM_ALLOWLIST/AFL_LLVM_DENYLIST instead.\n");
 
     insert_param(aflcc, "-fsanitize-coverage=trace-pc-guard");
     aflcc->instrument_mode = INSTRUMENT_LLVMNATIVE;
@@ -1964,8 +2086,14 @@ void add_optimized_pcguard(aflcc_state_t *aflcc) {
 
 }
 
-/* Linking behaviors */
+/** About -fsanitize -----END----- **/
 
+/** Linking behaviors -----BEGIN----- **/
+
+/*
+  Parse and process possible linking stage related args,
+  return PARAM_MISS if nothing matched.
+*/
 param_st parse_linking_params(aflcc_state_t *aflcc, u8 *cur_argv, u8 scan,
                               u8 *skip_next, char **argv) {
 
@@ -2128,6 +2256,7 @@ param_st parse_linking_params(aflcc_state_t *aflcc, u8 *cur_argv, u8 scan,
 
 }
 
+/* Add params to specify the linker used in LTO */
 void add_lto_linker(aflcc_state_t *aflcc) {
 
   unsetenv("AFL_LD");
@@ -2167,6 +2296,7 @@ void add_lto_linker(aflcc_state_t *aflcc) {
 
 }
 
+/* Add params to launch SanitizerCoverageLTO.so when linking  */
 void add_lto_passes(aflcc_state_t *aflcc) {
 
 #if defined(AFL_CLANG_LDPATH) && LLVM_MAJOR >= 15
@@ -2185,6 +2315,7 @@ void add_lto_passes(aflcc_state_t *aflcc) {
 
 }
 
+/* Add params to link with libAFLDriver.a on request */
 static void add_aflpplib(aflcc_state_t *aflcc) {
 
   if (!aflcc->need_aflpplib) return;
@@ -2220,6 +2351,7 @@ static void add_aflpplib(aflcc_state_t *aflcc) {
 
 }
 
+/* Add params to link with runtimes depended by our instrumentation */
 void add_runtime(aflcc_state_t *aflcc) {
 
   if (aflcc->preprocessor_only || aflcc->have_c || !aflcc->non_dash) {
@@ -2281,6 +2413,11 @@ void add_runtime(aflcc_state_t *aflcc) {
 
     }
 
+  #if __AFL_CODE_COVERAGE
+    // Required for dladdr used in afl-compiler-rt.o
+    insert_param(aflcc, "-ldl");
+  #endif
+
   #if !defined(__APPLE__) && !defined(__sun)
     if (!aflcc->shared_linking && !aflcc->partial_linking)
       insert_object(aflcc, "dynamic_list.txt", "-Wl,--dynamic-list=%s", 0);
@@ -2310,8 +2447,14 @@ void add_runtime(aflcc_state_t *aflcc) {
 
 }
 
-/* Misc */
+/** Linking behaviors -----END----- **/
 
+/** Miscellaneous routines -----BEGIN----- **/
+
+/*
+  Add params to make compiler driver use our afl-as
+  as assembler, required by the vanilla instrumentation.
+*/
 void add_assembler(aflcc_state_t *aflcc) {
 
   u8 *afl_as = find_object(aflcc, "as");
@@ -2328,6 +2471,7 @@ void add_assembler(aflcc_state_t *aflcc) {
 
 }
 
+/* Add params to launch the gcc plugins for instrumentation. */
 void add_gcc_plugin(aflcc_state_t *aflcc) {
 
   if (aflcc->cmplog_mode) {
@@ -2344,6 +2488,7 @@ void add_gcc_plugin(aflcc_state_t *aflcc) {
 
 }
 
+/* Add some miscellaneous params required by our instrumentation. */
 void add_misc_params(aflcc_state_t *aflcc) {
 
   if (getenv("AFL_NO_BUILTIN") || getenv("AFL_LLVM_LAF_TRANSFORM_COMPARES") ||
@@ -2390,6 +2535,10 @@ void add_misc_params(aflcc_state_t *aflcc) {
 
 }
 
+/*
+  Parse and process a variety of args under our matching rules,
+  return PARAM_MISS if nothing matched.
+*/
 param_st parse_misc_params(aflcc_state_t *aflcc, u8 *cur_argv, u8 scan) {
 
   param_st final_ = PARAM_MISS;
@@ -2447,6 +2596,36 @@ param_st parse_misc_params(aflcc_state_t *aflcc, u8 *cur_argv, u8 scan) {
 
     SCAN_KEEP(aflcc->have_c, 1);
 
+  } else if (!strcmp(cur_argv, "-static-libasan")) {
+
+    SCAN_KEEP(aflcc->have_staticasan, 1);
+
+  } else if (strstr(cur_argv, "librustc") && strstr(cur_argv, "_rt.asan.a")) {
+
+    SCAN_KEEP(aflcc->have_rust_asanrt, 1);
+
+  } else if (!strcmp(cur_argv, "-fno-omit-frame-pointer")) {
+
+    SCAN_KEEP(aflcc->have_fp, 1);
+
+  } else if (!strcmp(cur_argv, "-fvisibility=hidden")) {
+
+    SCAN_KEEP(aflcc->have_hidden, 1);
+
+  } else if (!strcmp(cur_argv, "-flto") || !strcmp(cur_argv, "-flto=full")) {
+
+    SCAN_KEEP(aflcc->have_flto, 1);
+
+  } else if (!strncmp(cur_argv, "-D_FORTIFY_SOURCE",
+
+                      strlen("-D_FORTIFY_SOURCE"))) {
+
+    SCAN_KEEP(aflcc->have_fortify, 1);
+
+  } else if (!strncmp(cur_argv, "-fcf-protection", strlen("-fcf-protection"))) {
+
+    SCAN_KEEP(aflcc->have_cfisan, 1);
+
   } else if (!strncmp(cur_argv, "-O", 2)) {
 
     SCAN_KEEP(aflcc->have_o, 1);
@@ -2510,6 +2689,9 @@ param_st parse_misc_params(aflcc_state_t *aflcc, u8 *cur_argv, u8 scan) {
 
 }
 
+/** Miscellaneous routines -----END----- **/
+
+/* Print help message on request */
 static void maybe_usage(aflcc_state_t *aflcc, int argc, char **argv) {
 
   if (argc < 2 || strncmp(argv[1], "-h", 2) == 0) {
@@ -2538,11 +2720,11 @@ static void maybe_usage(aflcc_state_t *aflcc, int argc, char **argv) {
         "MODES:                                  NCC PERSIST DICT   LAF "
         "CMPLOG SELECT\n"
         "  [LLVM] LLVM:             %s%s\n"
-        "      PCGUARD              %s      yes yes     module yes yes    "
+        "      PCGUARD              %s    yes yes     module yes yes    "
         "yes\n"
-        "      NATIVE               AVAILABLE      no  yes     no     no  "
+        "      NATIVE               AVAILABLE    no  yes     no     no  "
         "part.  yes\n"
-        "      CLASSIC              %s      no  yes     module yes yes    "
+        "      CLASSIC              %s    no  yes     module yes yes    "
         "yes\n"
         "        - NORMAL\n"
         "        - CALLER\n"
@@ -2805,11 +2987,27 @@ static void maybe_usage(aflcc_state_t *aflcc, int argc, char **argv) {
 
 }
 
+/*
+  Process params passed to afl-cc.
+
+  We have two working modes, *scan* and *non-scan*. In scan mode,
+  the main task is to set some variables in aflcc according to current argv[i],
+  while in non-scan mode, is to choose keep or drop current argv[i].
+
+  We have several matching routines being called sequentially in the while-loop,
+  and each of them try to parse and match current argv[i] according to their own
+  rules. If one miss match, the next will then take over. In non-scan mode, each
+  argv[i] mis-matched by all the routines will be kept.
+
+  These routines are:
+  1. parse_misc_params
+  2. parse_fsanitize
+  3. parse_linking_params
+  4. `if (*cur == '@') {...}`, i.e., parse response files
+*/
 static void process_params(aflcc_state_t *aflcc, u8 scan, u32 argc,
                            char **argv) {
 
-  limit_params(aflcc, argc);
-
   // for (u32 x = 0; x < argc; ++x) fprintf(stderr, "[%u] %s\n", x, argv[x]);
 
   /* Process the argument list. */
@@ -2833,134 +3031,249 @@ static void process_params(aflcc_state_t *aflcc, u8 scan, u32 argc,
     if (PARAM_MISS != parse_linking_params(aflcc, cur, scan, &skip_next, argv))
       continue;
 
+    /* Response file support -----BEGIN-----
+      We have two choices - move everything to the command line or
+      rewrite the response files to temporary files and delete them
+      afterwards. We choose the first for easiness.
+      For clang, llvm::cl::ExpandResponseFiles does this, however it
+      only has C++ interface. And for gcc there is expandargv in libiberty,
+      written in C, but we can't simply copy-paste since its LGPL licensed.
+      So here we use an equivalent FSM as alternative, and try to be compatible
+      with the two above. See:
+        - https://gcc.gnu.org/onlinedocs/gcc/Overall-Options.html
+        - driver::expand_at_files in gcc.git/gcc/gcc.c
+        - expandargv in gcc.git/libiberty/argv.c
+        - llvm-project.git/clang/tools/driver/driver.cpp
+        - ExpandResponseFiles in
+          llvm-project.git/llvm/lib/Support/CommandLine.cpp
+    */
     if (*cur == '@') {
 
-      // response file support.
-      // we have two choices - move everything to the command line or
-      // rewrite the response files to temporary files and delete them
-      // afterwards. We choose the first for easiness.
-      // We do *not* support quotes in the rsp files to cope with spaces in
-      // filenames etc! If you need that then send a patch!
       u8 *filename = cur + 1;
       if (aflcc->debug) { DEBUGF("response file=%s\n", filename); }
-      FILE       *f = fopen(filename, "r");
-      struct stat st;
 
       // Check not found or empty? let the compiler complain if so.
-      if (!f || fstat(fileno(f), &st) < 0 || st.st_size < 1) {
+      FILE *f = fopen(filename, "r");
+      if (!f) {
 
         if (!scan) insert_param(aflcc, cur);
         continue;
 
       }
 
-      u8    *tmpbuf = malloc(st.st_size + 2), *ptr;
-      char **args = malloc(sizeof(char *) * (st.st_size >> 1));
-      int    count = 1, cont = 0, cont_act = 0;
+      struct stat st;
+      if (fstat(fileno(f), &st) || !S_ISREG(st.st_mode) || st.st_size < 1) {
 
-      while (fgets(tmpbuf, st.st_size + 1, f)) {
+        fclose(f);
+        if (!scan) insert_param(aflcc, cur);
+        continue;
 
-        ptr = tmpbuf;
-        // fprintf(stderr, "1: %s\n", ptr);
-        //  no leading whitespace
-        while (isspace(*ptr)) {
+      }
 
-          ++ptr;
-          cont_act = 0;
+      // Limit the number of response files, the max value
+      // just keep consistent with expandargv. Only do this in
+      // scan mode, and not touch rsp_count anymore in the next.
+      static u32 rsp_count = 2000;
+      if (scan) {
 
-        }
+        if (rsp_count == 0) FATAL("Too many response files provided!");
 
-        // no comments, no empty lines
-        if (*ptr == '#' || *ptr == '\n' || !*ptr) { continue; }
-        // remove LF
-        if (ptr[strlen(ptr) - 1] == '\n') { ptr[strlen(ptr) - 1] = 0; }
-        // remove CR
-        if (*ptr && ptr[strlen(ptr) - 1] == '\r') { ptr[strlen(ptr) - 1] = 0; }
-        // handle \ at end of line
-        if (*ptr && ptr[strlen(ptr) - 1] == '\\') {
+        --rsp_count;
 
-          cont = 1;
-          ptr[strlen(ptr) - 1] = 0;
+      }
 
-        }
+      // argc, argv acquired from this rsp file. Note that
+      // process_params ignores argv[0], we need to put a const "" here.
+      u32    argc_read = 1;
+      char **argv_read = ck_alloc(sizeof(char *));
+      argv_read[0] = "";
+
+      char *arg_buf = NULL;
+      u64   arg_len = 0;
+
+      enum fsm_state {
+
+        fsm_whitespace,    // whitespace seen so far
+        fsm_double_quote,  // have unpaired double quote
+        fsm_single_quote,  // have unpaired single quote
+        fsm_backslash,     // a backslash is seen with no unpaired quote
+        fsm_normal         // a normal char is seen
+
+      };
+
+      // Workaround to append c to arg buffer, and append the buffer to argv
+#define ARG_ALLOC(c)                                             \
+  do {                                                           \
+                                                                 \
+    ++arg_len;                                                   \
+    arg_buf = ck_realloc(arg_buf, (arg_len + 1) * sizeof(char)); \
+    arg_buf[arg_len] = '\0';                                     \
+    arg_buf[arg_len - 1] = (char)c;                              \
+                                                                 \
+  } while (0)
+
+#define ARG_STORE()                                                \
+  do {                                                             \
+                                                                   \
+    ++argc_read;                                                   \
+    argv_read = ck_realloc(argv_read, argc_read * sizeof(char *)); \
+    argv_read[argc_read - 1] = arg_buf;                            \
+    arg_buf = NULL;                                                \
+    arg_len = 0;                                                   \
+                                                                   \
+  } while (0)
 
-        // fprintf(stderr, "2: %s\n", ptr);
+      int cur_chr = (int)' ';  // init as whitespace, as a good start :)
+      enum fsm_state state_ = fsm_whitespace;
 
-        // remove whitespace at end
-        while (*ptr && isspace(ptr[strlen(ptr) - 1])) {
+      while (cur_chr != EOF) {
 
-          ptr[strlen(ptr) - 1] = 0;
-          cont = 0;
+        switch (state_) {
 
-        }
+          case fsm_whitespace:
 
-        // fprintf(stderr, "3: %s\n", ptr);
-        if (*ptr) {
+            if (arg_buf) {
+
+              ARG_STORE();
+              break;
+
+            }
 
-          do {
+            if (isspace(cur_chr)) {
 
-            u8 *value = ptr;
-            while (*ptr && !isspace(*ptr)) {
+              cur_chr = fgetc(f);
 
-              ++ptr;
+            } else if (cur_chr == (int)'\'') {
+
+              state_ = fsm_single_quote;
+              cur_chr = fgetc(f);
+
+            } else if (cur_chr == (int)'"') {
+
+              state_ = fsm_double_quote;
+              cur_chr = fgetc(f);
+
+            } else if (cur_chr == (int)'\\') {
+
+              state_ = fsm_backslash;
+              cur_chr = fgetc(f);
+
+            } else {
+
+              state_ = fsm_normal;
 
             }
 
-            while (*ptr && isspace(*ptr)) {
+            break;
+
+          case fsm_normal:
+
+            if (isspace(cur_chr)) {
+
+              state_ = fsm_whitespace;
+
+            } else if (cur_chr == (int)'\'') {
+
+              state_ = fsm_single_quote;
+              cur_chr = fgetc(f);
+
+            } else if (cur_chr == (int)'\"') {
 
-              *ptr++ = 0;
+              state_ = fsm_double_quote;
+              cur_chr = fgetc(f);
+
+            } else if (cur_chr == (int)'\\') {
+
+              state_ = fsm_backslash;
+              cur_chr = fgetc(f);
+
+            } else {
+
+              ARG_ALLOC(cur_chr);
+              cur_chr = fgetc(f);
 
             }
 
-            if (cont_act) {
+            break;
+
+          case fsm_backslash:
+
+            ARG_ALLOC(cur_chr);
+            cur_chr = fgetc(f);
+            state_ = fsm_normal;
 
-              u32 len = strlen(args[count - 1]) + strlen(value) + 1;
-              u8 *tmp = malloc(len);
-              snprintf(tmp, len, "%s%s", args[count - 1], value);
-              free(args[count - 1]);
-              args[count - 1] = tmp;
-              cont_act = 0;
+            break;
+
+          case fsm_single_quote:
+
+            if (cur_chr == (int)'\\') {
+
+              cur_chr = fgetc(f);
+              if (cur_chr == EOF) break;
+              ARG_ALLOC(cur_chr);
+
+            } else if (cur_chr == (int)'\'') {
+
+              state_ = fsm_normal;
 
             } else {
 
-              args[count++] = strdup(value);
+              ARG_ALLOC(cur_chr);
 
             }
 
-          } while (*ptr);
+            cur_chr = fgetc(f);
+            break;
 
-        }
+          case fsm_double_quote:
+
+            if (cur_chr == (int)'\\') {
 
-        if (cont) {
+              cur_chr = fgetc(f);
+              if (cur_chr == EOF) break;
+              ARG_ALLOC(cur_chr);
 
-          cont_act = 1;
-          cont = 0;
+            } else if (cur_chr == (int)'"') {
+
+              state_ = fsm_normal;
+
+            } else {
+
+              ARG_ALLOC(cur_chr);
+
+            }
+
+            cur_chr = fgetc(f);
+            break;
+
+          default:
+            break;
 
         }
 
       }
 
-      if (count) { process_params(aflcc, scan, count, args); }
+      if (arg_buf) { ARG_STORE(); }  // save the pending arg after EOF
 
-      // we cannot free args[] unless we don't need
-      // to keep any reference in cc_params
-      if (scan) {
+#undef ARG_ALLOC
+#undef ARG_STORE
 
-        if (count) do {
+      if (argc_read > 1) { process_params(aflcc, scan, argc_read, argv_read); }
 
-            free(args[--count]);
+      // We cannot free argv_read[] unless we don't need to keep any
+      // reference in cc_params. Never free argv[0], the const "".
+      if (scan) {
 
-          } while (count);
+        while (argc_read > 1)
+          ck_free(argv_read[--argc_read]);
 
-        free(args);
+        ck_free(argv_read);
 
       }
 
-      free(tmpbuf);
-
       continue;
 
-    }
+    }                                /* Response file support -----END----- */
 
     if (!scan) insert_param(aflcc, cur);
 
@@ -2968,8 +3281,7 @@ static void process_params(aflcc_state_t *aflcc, u8 scan, u32 argc,
 
 }
 
-/* Copy argv to cc_params, making the necessary edits. */
-
+/* Process each of the existing argv, also add a few new args. */
 static void edit_params(aflcc_state_t *aflcc, u32 argc, char **argv,
                         char **envp) {
 
@@ -3110,7 +3422,6 @@ static void edit_params(aflcc_state_t *aflcc, u32 argc, char **argv,
 }
 
 /* Main entry point */
-
 int main(int argc, char **argv, char **envp) {
 
   aflcc_state_t *aflcc = malloc(sizeof(aflcc_state_t));
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 3f9bfa72..214b4fe9 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -1017,6 +1017,12 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
   if (rlen == 4) {
 
+    if (status >= 0x41464c00 && status <= 0x41464cff) {
+
+      FATAL("Target uses the new forkserver model, you need to switch to a newer afl-fuzz too!");
+
+    }
+
     if (!be_quiet) { OKF("All right - fork server is up."); }
 
     if (getenv("AFL_DEBUG")) {
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 35932913..8ab44a3b 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -124,6 +124,9 @@ void bind_to_free_cpu(afl_state_t *afl) {
     }
 
     WARNF("Not binding to a CPU core (AFL_NO_AFFINITY set).");
+  #ifdef __linux__
+    if (afl->fsrv.nyx_mode) { afl->fsrv.nyx_bind_cpu_id = 0; }
+  #endif
     return;
 
   }
@@ -151,6 +154,9 @@ void bind_to_free_cpu(afl_state_t *afl) {
     } else {
 
       OKF("CPU binding request using -b %d successful.", afl->cpu_to_bind);
+  #ifdef __linux__
+      if (afl->fsrv.nyx_mode) { afl->fsrv.nyx_bind_cpu_id = afl->cpu_to_bind; }
+  #endif
 
     }
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 2d5787e8..8cf6c735 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -165,7 +165,7 @@ static void usage(u8 *argv0, int more_help) {
       "\n"
 
       "Mutator settings:\n"
-      "  -a            - target input format, \"text\" or \"binary\" (default: "
+      "  -a type       - target input format, \"text\" or \"binary\" (default: "
       "generic)\n"
       "  -g minlength  - set min length of generated fuzz input (default: 1)\n"
       "  -G maxlength  - set max length of generated fuzz input (default: "
@@ -1915,6 +1915,15 @@ int main(int argc, char **argv_orig, char **envp) {
   bind_to_free_cpu(afl);
   #endif                                                   /* HAVE_AFFINITY */
 
+  #ifdef __linux__
+  if (afl->fsrv.nyx_mode && afl->fsrv.nyx_bind_cpu_id == 0xFFFFFFFF) {
+
+    afl->fsrv.nyx_bind_cpu_id = 0;
+
+  }
+
+  #endif
+
   #ifdef __HAIKU__
   /* Prioritizes performance over power saving */
   set_scheduler_mode(SCHEDULER_MODE_LOW_LATENCY);