aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/afl-common.c6
-rw-r--r--src/afl-forkserver.c4
-rw-r--r--src/afl-fuzz-init.c9
-rw-r--r--src/afl-fuzz-one.c15
-rw-r--r--src/afl-fuzz-run.c7
-rw-r--r--src/afl-fuzz-stats.c11
-rw-r--r--src/afl-fuzz.c19
-rw-r--r--src/afl-sharedmem.c19
8 files changed, 56 insertions, 34 deletions
diff --git a/src/afl-common.c b/src/afl-common.c
index c9b4638a..f4cba573 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -253,7 +253,8 @@ char **get_qemu_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
"binaries that are\n"
" instrumented at compile time with afl-gcc. It is also possible to "
"use it as a\n"
- " traditional non-instrumented fuzzer by specifying '-n' in the command "
+ " traditional non-instrumented fuzzer by specifying '-n' in the "
+ "command "
"line.\n");
FATAL("Failed to locate 'afl-qemu-trace'.");
@@ -353,7 +354,8 @@ char **get_wine_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
"binaries that are\n"
" instrumented at compile time with afl-gcc. It is also possible to "
"use it as a\n"
- " traditional non-instrumented fuzzer by specifying '-n' in the command "
+ " traditional non-instrumented fuzzer by specifying '-n' in the "
+ "command "
"line.\n",
ncp);
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index d32e8293..b5b55713 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -524,7 +524,9 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
} else {
- FATAL("Target requested sharedmem fuzzing, but we failed to enable it.");
+ FATAL(
+ "Target requested sharedmem fuzzing, but we failed to enable "
+ "it.");
}
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 05aa0cc7..3c3503b1 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -1859,7 +1859,11 @@ void fix_up_sync(afl_state_t *afl) {
u8 *x = afl->sync_id;
- if (afl->non_instrumented_mode) { FATAL("-S / -M and -n are mutually exclusive"); }
+ if (afl->non_instrumented_mode) {
+
+ FATAL("-S / -M and -n are mutually exclusive");
+
+ }
while (*x) {
@@ -2126,7 +2130,8 @@ void check_binary(afl_state_t *afl, u8 *fname) {
#endif /* ^!__APPLE__ */
- if (!afl->fsrv.qemu_mode && !afl->unicorn_mode && !afl->non_instrumented_mode &&
+ if (!afl->fsrv.qemu_mode && !afl->unicorn_mode &&
+ !afl->non_instrumented_mode &&
!memmem(f_data, f_len, SHM_ENV_VAR, strlen(SHM_ENV_VAR) + 1)) {
SAYF("\n" cLRD "[-] " cRST
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 146e30bc..578ac584 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -512,7 +512,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
* TRIMMING *
************/
- if (!afl->non_instrumented_mode && !afl->queue_cur->trim_done && !afl->disable_trim) {
+ if (!afl->non_instrumented_mode && !afl->queue_cur->trim_done &&
+ !afl->disable_trim) {
u8 res = trim_case(afl, afl->queue_cur, in_buf);
@@ -579,8 +580,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
/* Skip deterministic fuzzing if exec path checksum puts this out of scope
for this main instance. */
- if (afl->main_node_max &&
- (afl->queue_cur->exec_cksum % afl->main_node_max) != afl->main_node_id - 1) {
+ if (afl->main_node_max && (afl->queue_cur->exec_cksum % afl->main_node_max) !=
+ afl->main_node_id - 1) {
goto custom_mutator_stage;
@@ -2732,8 +2733,8 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
/* Skip deterministic fuzzing if exec path checksum puts this out of scope
for this main instance. */
- if (afl->main_node_max &&
- (afl->queue_cur->exec_cksum % afl->main_node_max) != afl->main_node_id - 1) {
+ if (afl->main_node_max && (afl->queue_cur->exec_cksum % afl->main_node_max) !=
+ afl->main_node_id - 1) {
goto havoc_stage;
@@ -2975,8 +2976,8 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
u32 cksum;
- /* If in non-instrumented mode or if the file is very short, just flag everything
- without wasting time on checksums. */
+ /* If in non-instrumented mode or if the file is very short, just flag
+ everything without wasting time on checksums. */
if (!afl->non_instrumented_mode && len >= EFF_MIN_LEN) {
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index ec5ade53..5934690f 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -562,10 +562,11 @@ void sync_fuzzers(afl_state_t *afl) {
closedir(sd);
// If we are a secondary and no main was found to sync then become the main
- if (unlikely(synced == 0) && likely(entries) && likely(afl->is_secondary_node)) {
+ if (unlikely(synced == 0) && likely(entries) &&
+ likely(afl->is_secondary_node)) {
- // there is a small race condition here that another secondary runs at the same
- // time. If so, the first temporary main node running again will demote
+ // there is a small race condition here that another secondary runs at the
+ // same time. If so, the first temporary main node running again will demote
// themselves so this is not an issue
u8 path[PATH_MAX];
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index d6bb8b72..97221572 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -126,8 +126,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
t_bytes, afl->var_byte_count, afl->use_banner,
afl->unicorn_mode ? "unicorn" : "", afl->fsrv.qemu_mode ? "qemu " : "",
afl->non_instrumented_mode ? " non_instrumented " : "",
- afl->no_forkserver ? "no_fsrv " : "",
- afl->crash_mode ? "crash " : "",
+ afl->no_forkserver ? "no_fsrv " : "", afl->crash_mode ? "crash " : "",
afl->persistent_mode ? "persistent " : "",
afl->shmem_testcase_mode ? "shmem_testcase " : "",
afl->deferred_mode ? "deferred " : "",
@@ -526,8 +525,9 @@ void show_stats(afl_state_t *afl) {
t_byte_ratio);
SAYF(" map density : %s%-21s" bSTG bV "\n",
- t_byte_ratio > 70 ? cLRD
- : ((t_bytes < 200 && !afl->non_instrumented_mode) ? cPIN : cRST),
+ t_byte_ratio > 70
+ ? cLRD
+ : ((t_bytes < 200 && !afl->non_instrumented_mode) ? cPIN : cRST),
tmp);
sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->cur_skipped_paths),
@@ -1022,7 +1022,8 @@ void show_init_stats(afl_state_t *afl) {
}
- /* In non-instrumented mode, re-running every timing out test case with a generous time
+ /* In non-instrumented mode, re-running every timing out test case with a
+ generous time
limit is very expensive, so let's select a more conservative default. */
if (afl->non_instrumented_mode && !(afl->afl_env.afl_hang_tmout)) {
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index aed1e958..07e1584b 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -379,9 +379,11 @@ int main(int argc, char **argv_orig, char **envp) {
*c = 0;
- if (sscanf(c + 1, "%u/%u", &afl->main_node_id, &afl->main_node_max) != 2 ||
+ if (sscanf(c + 1, "%u/%u", &afl->main_node_id, &afl->main_node_max) !=
+ 2 ||
!afl->main_node_id || !afl->main_node_max ||
- afl->main_node_id > afl->main_node_max || afl->main_node_max > 1000000) {
+ afl->main_node_id > afl->main_node_max ||
+ afl->main_node_max > 1000000) {
FATAL("Bogus main node ID passed to -M");
@@ -533,7 +535,12 @@ int main(int argc, char **argv_orig, char **envp) {
case 'n': /* dumb mode */
- if (afl->non_instrumented_mode) { FATAL("Multiple -n options not supported"); }
+ if (afl->non_instrumented_mode) {
+
+ FATAL("Multiple -n options not supported");
+
+ }
+
if (afl->afl_env.afl_dumb_forksrv) {
afl->non_instrumented_mode = 2;
@@ -793,10 +800,12 @@ int main(int argc, char **argv_orig, char **envp) {
OKF("afl-tmin fork server patch from github.com/nccgroup/TriforceAFL");
OKF("MOpt Mutator from github.com/puppet-meteor/MOpt-AFL");
- if (afl->sync_id && afl->is_main_node && afl->afl_env.afl_custom_mutator_only) {
+ if (afl->sync_id && afl->is_main_node &&
+ afl->afl_env.afl_custom_mutator_only) {
WARNF(
- "Using -M main node with the AFL_CUSTOM_MUTATOR_ONLY mutator options will "
+ "Using -M main node with the AFL_CUSTOM_MUTATOR_ONLY mutator options "
+ "will "
"result in no deterministic mutations being done!");
}
diff --git a/src/afl-sharedmem.c b/src/afl-sharedmem.c
index f87c75eb..63013435 100644
--- a/src/afl-sharedmem.c
+++ b/src/afl-sharedmem.c
@@ -96,7 +96,8 @@ void afl_shm_deinit(sharedmem_t *shm) {
Returns a pointer to shm->map for ease of use.
*/
-u8 *afl_shm_init(sharedmem_t *shm, size_t map_size, unsigned char non_instrumented_mode) {
+u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
+ unsigned char non_instrumented_mode) {
shm->map_size = map_size;
@@ -137,10 +138,10 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size, unsigned char non_instrument
}
- /* If somebody is asking us to fuzz instrumented binaries in non-instrumented mode,
- we don't want them to detect instrumentation, since we won't be sending
- fork server commands. This should be replaced with better auto-detection
- later on, perhaps? */
+ /* If somebody is asking us to fuzz instrumented binaries in non-instrumented
+ mode, we don't want them to detect instrumentation, since we won't be
+ sending fork server commands. This should be replaced with better
+ auto-detection later on, perhaps? */
if (!non_instrumented_mode) setenv(SHM_ENV_VAR, shm->g_shm_file_path, 1);
@@ -164,10 +165,10 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size, unsigned char non_instrument
shm_str = alloc_printf("%d", shm->shm_id);
- /* If somebody is asking us to fuzz instrumented binaries in non-instrumented mode,
- we don't want them to detect instrumentation, since we won't be sending
- fork server commands. This should be replaced with better auto-detection
- later on, perhaps? */
+ /* If somebody is asking us to fuzz instrumented binaries in non-instrumented
+ mode, we don't want them to detect instrumentation, since we won't be
+ sending fork server commands. This should be replaced with better
+ auto-detection later on, perhaps? */
if (!non_instrumented_mode) { setenv(SHM_ENV_VAR, shm_str, 1); }
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-15 17:16:26 +0000