aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/afl-cc.c14
-rw-r--r--src/afl-fuzz-init.c64
-rw-r--r--src/afl-fuzz-python.c2
-rw-r--r--src/afl-fuzz-run.c2
-rw-r--r--src/afl-fuzz-state.c10
-rw-r--r--src/afl-fuzz.c28
-rw-r--r--src/afl-showmap.c3
7 files changed, 62 insertions, 61 deletions
diff --git a/src/afl-cc.c b/src/afl-cc.c
index ebe11525..8af8e7b0 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -1224,6 +1224,14 @@ int main(int argc, char **argv, char **envp) {
if (strncmp(argv[i], "--afl", 5) == 0) {
+ if (!strcmp(argv[i], "--afl_noopt") || !strcmp(argv[i], "--afl-noopt")) {
+
+ passthrough = 1;
+ argv[i] = "-g"; // we have to overwrite it, -g is always good
+ continue;
+
+ }
+
if (compiler_mode)
WARNF(
"--afl-... compiler mode supersedes the AFL_CC_COMPILER and "
@@ -1821,6 +1829,12 @@ int main(int argc, char **argv, char **envp) {
"If anything fails - be sure to read README.lto.md!\n");
#endif
+ SAYF(
+ "\nYou can supply --afl-noopt to not instrument, like AFL_NOOPT. "
+ "(this is helpful\n"
+ "in some build systems if you do not want to instrument "
+ "everything.\n");
+
}
SAYF(
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index b277802b..88b5bc02 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -113,7 +113,7 @@ void bind_to_free_cpu(afl_state_t *afl) {
u8 lockfile[PATH_MAX] = "";
s32 i;
- if (afl->afl_env.afl_no_affinity) {
+ if (afl->afl_env.afl_no_affinity && !afl->afl_env.afl_try_affinity) {
if (afl->cpu_to_bind != -1) {
@@ -130,10 +130,21 @@ void bind_to_free_cpu(afl_state_t *afl) {
if (!bind_cpu(afl, afl->cpu_to_bind)) {
- FATAL(
- "Could not bind to requested CPU %d! Make sure you passed a valid "
- "-b.",
- afl->cpu_to_bind);
+ if (afl->afl_env.afl_try_affinity) {
+
+ WARNF(
+ "Could not bind to requested CPU %d! Make sure you passed a valid "
+ "-b.",
+ afl->cpu_to_bind);
+
+ } else {
+
+ FATAL(
+ "Could not bind to requested CPU %d! Make sure you passed a valid "
+ "-b.",
+ afl->cpu_to_bind);
+
+ }
}
@@ -420,11 +431,14 @@ void bind_to_free_cpu(afl_state_t *afl) {
"Uh-oh, looks like all %d CPU cores on your system are allocated to\n"
" other instances of afl-fuzz (or similar CPU-locked tasks). "
"Starting\n"
- " another fuzzer on this machine is probably a bad plan, but if "
- "you are\n"
- " absolutely sure, you can set AFL_NO_AFFINITY and try again.\n",
- afl->cpu_core_count);
- FATAL("No more free CPU cores");
+ " another fuzzer on this machine is probably a bad plan.\n"
+ "%s",
+ afl->cpu_core_count,
+ afl->afl_env.afl_try_affinity ? ""
+ : " If you are sure, you can set "
+ "AFL_NO_AFFINITY and try again.\n");
+
+ if (!afl->afl_env.afl_try_affinity) { FATAL("No more free CPU cores"); }
}
@@ -823,7 +837,6 @@ void perform_dry_run(afl_state_t *afl) {
struct queue_entry *q;
u32 cal_failures = 0, idx;
- u8 * skip_crashes = afl->afl_env.afl_skip_crashes;
u8 * use_mem;
for (idx = 0; idx < afl->queued_paths; idx++) {
@@ -923,27 +936,6 @@ void perform_dry_run(afl_state_t *afl) {
if (afl->crash_mode) { break; }
- if (skip_crashes) {
-
- if (afl->fsrv.uses_crash_exitcode) {
-
- WARNF(
- "Test case results in a crash or AFL_CRASH_EXITCODE %d "
- "(skipping)",
- (int)(s8)afl->fsrv.crash_exitcode);
-
- } else {
-
- WARNF("Test case results in a crash (skipping)");
-
- }
-
- q->cal_failed = CAL_CHANCES;
- ++cal_failures;
- break;
-
- }
-
if (afl->fsrv.mem_limit) {
u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
@@ -1117,14 +1109,12 @@ void perform_dry_run(afl_state_t *afl) {
if (cal_failures == afl->queued_paths) {
- FATAL("All test cases time out%s, giving up!",
- skip_crashes ? " or crash" : "");
+ FATAL("All test cases time out or crash, giving up!");
}
- WARNF("Skipped %u test cases (%0.02f%%) due to timeouts%s.", cal_failures,
- ((double)cal_failures) * 100 / afl->queued_paths,
- skip_crashes ? " or crashes" : "");
+ WARNF("Skipped %u test cases (%0.02f%%) due to timeouts or crashes.",
+ cal_failures, ((double)cal_failures) * 100 / afl->queued_paths);
if (cal_failures * 5 > afl->queued_paths) {
diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c
index 8760194c..3aa97635 100644
--- a/src/afl-fuzz-python.c
+++ b/src/afl-fuzz-python.c
@@ -212,7 +212,7 @@ static py_mutator_t *init_py_module(afl_state_t *afl, u8 *module_name) {
PyObject_GetAttrString(py_module, "introspection");
py_functions[PY_FUNC_DEINIT] = PyObject_GetAttrString(py_module, "deinit");
if (!py_functions[PY_FUNC_DEINIT])
- FATAL("deinit function not found in python module");
+ WARNF("deinit function not found in python module");
for (py_idx = 0; py_idx < PY_FUNC_COUNT; ++py_idx) {
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 6e5210b8..5a481639 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -410,7 +410,7 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
}
var_detected = 1;
- afl->stage_max = CAL_CYCLES_LONG;
+ afl->stage_max = afl->fast_cal ? CAL_CYCLES : CAL_CYCLES_LONG;
} else {
diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c
index c886cb28..0658070e 100644
--- a/src/afl-fuzz-state.c
+++ b/src/afl-fuzz-state.c
@@ -202,12 +202,18 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
afl->afl_env.afl_no_affinity =
get_afl_env(afl_environment_variables[i]) ? 1 : 0;
+ } else if (!strncmp(env, "AFL_TRY_AFFINITY",
+
+ afl_environment_variable_len)) {
+
+ afl->afl_env.afl_try_affinity =
+ get_afl_env(afl_environment_variables[i]) ? 1 : 0;
+
} else if (!strncmp(env, "AFL_SKIP_CRASHES",
afl_environment_variable_len)) {
- afl->afl_env.afl_skip_crashes =
- (u8 *)get_afl_env(afl_environment_variables[i]);
+ // we should mark this obsolete in a few versions
} else if (!strncmp(env, "AFL_HANG_TMOUT",
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 35fb2d04..a3a623d9 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -35,6 +35,10 @@
#include <sys/shm.h>
#endif
+#ifdef __APPLE__
+ #include <sys/qos.h>
+#endif
+
#ifdef PROFILING
extern u64 time_spent_working;
#endif
@@ -220,6 +224,7 @@ static void usage(u8 *argv0, int more_help) {
" then they are randomly selected instead all of them being\n"
" used. Defaults to 200.\n"
"AFL_NO_AFFINITY: do not check for an unused cpu core to use for fuzzing\n"
+ "AFL_TRY_AFFINITY: try to bind to an unused core, but don't fail if unsuccessful\n"
"AFL_NO_ARITH: skip arithmetic mutations in deterministic stage\n"
"AFL_NO_AUTODICT: do not load an offered auto dictionary compiled into a target\n"
"AFL_NO_CPU_RED: avoid red color for showing very high cpu usage\n"
@@ -240,7 +245,7 @@ static void usage(u8 *argv0, int more_help) {
"AFL_SHUFFLE_QUEUE: reorder the input queue randomly on startup\n"
"AFL_SKIP_BIN_CHECK: skip afl compatibility checks, also disables auto map size\n"
"AFL_SKIP_CPUFREQ: do not warn about variable cpu clocking\n"
- "AFL_SKIP_CRASHES: during initial dry run do not terminate for crashing inputs\n"
+ //"AFL_SKIP_CRASHES: during initial dry run do not terminate for crashing inputs\n"
"AFL_STATSD: enables StatsD metrics collection\n"
"AFL_STATSD_HOST: change default statsd host (default 127.0.0.1)\n"
"AFL_STATSD_PORT: change default statsd port (default: 8125)\n"
@@ -2296,26 +2301,9 @@ stop_fuzzing:
afl_fsrv_deinit(&afl->fsrv);
/* remove tmpfile */
- if (afl->tmp_dir != NULL && !afl->in_place_resume) {
-
- char tmpfile[PATH_MAX];
-
- if (afl->file_extension) {
-
- snprintf(tmpfile, PATH_MAX, "%s/.cur_input.%s", afl->tmp_dir,
- afl->file_extension);
+ if (afl->tmp_dir != NULL && !afl->in_place_resume && afl->fsrv.out_file) {
- } else {
-
- snprintf(tmpfile, PATH_MAX, "%s/.cur_input", afl->tmp_dir);
-
- }
-
- if (unlink(tmpfile) != 0) {
-
- FATAL("Could not unlink current input file: %s.", tmpfile);
-
- }
+ (void)unlink(afl->fsrv.out_file);
}
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index d7af668c..96b72dd9 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -235,6 +235,9 @@ static u32 write_results_to_file(afl_forkserver_t *fsrv, u8 *outfile) {
if (cmin_mode &&
(fsrv->last_run_timed_out || (!caa && child_crashed != cco))) {
+ // create empty file to prevent error messages in afl-cmin
+ fd = open(outfile, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
+ close(fd);
return ret;
}
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-24 03:47:53 +0000