aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/afl-analyze.c84
-rw-r--r--src/afl-cc.c24
-rw-r--r--src/afl-common.c57
-rw-r--r--src/afl-forkserver.c66
-rw-r--r--src/afl-fuzz-init.c22
-rw-r--r--src/afl-fuzz.c6
-rw-r--r--src/afl-gotcpu.c7
-rw-r--r--src/afl-showmap.c45
-rw-r--r--src/afl-tmin.c83
9 files changed, 110 insertions, 284 deletions
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index da1def3b..d4a9aa91 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -656,28 +656,6 @@ static void set_up_environment(char **argv) {
if (fsrv.out_fd < 0) { PFATAL("Unable to create '%s'", fsrv.out_file); }
/* Set sane defaults... */
-
- x = get_afl_env("ASAN_OPTIONS");
-
- if (x) {
-
- if (!strstr(x, "abort_on_error=1")) {
-
- FATAL("Custom ASAN_OPTIONS set without abort_on_error=1 - please fix!");
-
- }
-
-#ifndef ASAN_BUILD
- if (!getenv("AFL_DEBUG") && !strstr(x, "symbolize=0")) {
-
- FATAL("Custom ASAN_OPTIONS set without symbolize=0 - please fix!");
-
- }
-
-#endif
-
- }
-
x = get_afl_env("MSAN_OPTIONS");
if (x) {
@@ -689,69 +667,9 @@ static void set_up_environment(char **argv) {
}
- if (!strstr(x, "symbolize=0")) {
-
- FATAL("Custom MSAN_OPTIONS set without symbolize=0 - please fix!");
-
- }
-
- }
-
- x = get_afl_env("LSAN_OPTIONS");
-
- if (x) {
-
- if (!strstr(x, "symbolize=0")) {
-
- FATAL("Custom LSAN_OPTIONS set without symbolize=0 - please fix!");
-
- }
-
}
- setenv("ASAN_OPTIONS",
- "abort_on_error=1:"
- "detect_leaks=0:"
- "allocator_may_return_null=1:"
- "detect_odr_violation=0:"
- "symbolize=0:"
- "handle_segv=0:"
- "handle_sigbus=0:"
- "handle_abort=0:"
- "handle_sigfpe=0:"
- "handle_sigill=0",
- 0);
-
- setenv("UBSAN_OPTIONS",
- "halt_on_error=1:"
- "abort_on_error=1:"
- "malloc_context_size=0:"
- "allocator_may_return_null=1:"
- "symbolize=0:"
- "handle_segv=0:"
- "handle_sigbus=0:"
- "handle_abort=0:"
- "handle_sigfpe=0:"
- "handle_sigill=0",
- 0);
-
- setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":"
- "abort_on_error=1:"
- "msan_track_origins=0"
- "allocator_may_return_null=1:"
- "symbolize=0:"
- "handle_segv=0:"
- "handle_sigbus=0:"
- "handle_abort=0:"
- "handle_sigfpe=0:"
- "handle_sigill=0", 0);
-
- setenv("LSAN_OPTIONS",
- "exitcode=" STRINGIFY(LSAN_ERROR) ":"
- "fast_unwind_on_malloc=0:"
- "symbolize=0:"
- "print_suppressions=0",
- 0);
+ set_sanitizer_defaults();
if (get_afl_env("AFL_PRELOAD")) {
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 803e784e..7c3682fb 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -1050,17 +1050,25 @@ static void edit_params(u32 argc, char **argv, char **envp) {
if (getenv("AFL_USE_CFISAN")) {
- if (!lto_mode) {
+ if (compiler_mode == GCC_PLUGIN || compiler_mode == GCC) {
- uint32_t i = 0, found = 0;
- while (envp[i] != NULL && !found)
- if (strncmp("-flto", envp[i++], 5) == 0) found = 1;
- if (!found) cc_params[cc_par_cnt++] = "-flto";
+ cc_params[cc_par_cnt++] = "-fcf-protection=full";
- }
+ } else {
+
+ if (!lto_mode) {
+
+ uint32_t i = 0, found = 0;
+ while (envp[i] != NULL && !found)
+ if (strncmp("-flto", envp[i++], 5) == 0) found = 1;
+ if (!found) cc_params[cc_par_cnt++] = "-flto";
- cc_params[cc_par_cnt++] = "-fsanitize=cfi";
- cc_params[cc_par_cnt++] = "-fvisibility=hidden";
+ }
+
+ cc_params[cc_par_cnt++] = "-fsanitize=cfi";
+ cc_params[cc_par_cnt++] = "-fvisibility=hidden";
+
+ }
}
diff --git a/src/afl-common.c b/src/afl-common.c
index 211d5bf2..d83130b4 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -58,6 +58,63 @@ u8 last_intr = 0;
#define AFL_PATH "/usr/local/lib/afl/"
#endif
+void set_sanitizer_defaults() {
+
+ /* Set sane defaults for ASAN if nothing else is specified. */
+ u8 *have_asan_options = getenv("ASAN_OPTIONS");
+ u8 *have_ubsan_options = getenv("UBSAN_OPTIONS");
+ u8 *have_msan_options = getenv("MSAN_OPTIONS");
+ u8 *have_lsan_options = getenv("LSAN_OPTIONS");
+ u8 have_san_options = 0;
+ if (have_asan_options || have_ubsan_options || have_msan_options ||
+ have_lsan_options)
+ have_san_options = 1;
+ u8 default_options[1024] =
+ "detect_odr_violation=0:abort_on_error=1:symbolize=0:malloc_context_"
+ "size=0:allocator_may_return_null=1:handle_segv=0:handle_sigbus=0:"
+ "handle_abort=0:handle_sigfpe=0:handle_sigill=0:";
+
+ if (!have_lsan_options) strcat(default_options, "detect_leaks=0:");
+
+ /* Set sane defaults for ASAN if nothing else is specified. */
+
+ if (!have_san_options) setenv("ASAN_OPTIONS", default_options, 1);
+
+ /* Set sane defaults for UBSAN if nothing else is specified. */
+
+ if (!have_san_options) setenv("UBSAN_OPTIONS", default_options, 1);
+
+ /* MSAN is tricky, because it doesn't support abort_on_error=1 at this
+ point. So, we do this in a very hacky way. */
+
+ if (!have_msan_options) {
+
+ u8 buf[2048] = "";
+ if (!have_san_options) strcpy(buf, default_options);
+ strcat(buf, "exit_code=" STRINGIFY(MSAN_ERROR) ":msan_track_origins=0:");
+ setenv("MSAN_OPTIONS", buf, 1);
+
+ }
+
+ /* LSAN, too, does not support abort_on_error=1. (is this still true??) */
+
+ if (!have_lsan_options) {
+
+ u8 buf[2048] = "";
+ if (!have_san_options) strcpy(buf, default_options);
+ strcat(buf,
+ "exitcode=" STRINGIFY(
+ LSAN_ERROR) ":fast_unwind_on_malloc=0:print_suppressions=0:");
+ setenv("LSAN_OPTIONS", buf, 1);
+
+ }
+
+ /* Envs for QASan */
+ setenv("QASAN_MAX_CALL_STACK", "0", 0);
+ setenv("QASAN_SYMBOLIZE", "0", 0);
+
+}
+
u32 check_binary_signatures(u8 *fn) {
int ret = 0, fd = open(fn, O_RDONLY);
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 9b8660ce..89d01460 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -688,70 +688,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
if (!getenv("LD_BIND_LAZY")) { setenv("LD_BIND_NOW", "1", 1); }
- /* Set sane defaults for ASAN if nothing else is specified. */
-
- if (!getenv("ASAN_OPTIONS"))
- setenv("ASAN_OPTIONS",
- "abort_on_error=1:"
- "detect_leaks=0:"
- "malloc_context_size=0:"
- "symbolize=0:"
- "allocator_may_return_null=1:"
- "detect_odr_violation=0:"
- "handle_segv=0:"
- "handle_sigbus=0:"
- "handle_abort=0:"
- "handle_sigfpe=0:"
- "handle_sigill=0",
- 1);
-
- /* Set sane defaults for UBSAN if nothing else is specified. */
-
- if (!getenv("UBSAN_OPTIONS"))
- setenv("UBSAN_OPTIONS",
- "halt_on_error=1:"
- "abort_on_error=1:"
- "malloc_context_size=0:"
- "allocator_may_return_null=1:"
- "symbolize=0:"
- "handle_segv=0:"
- "handle_sigbus=0:"
- "handle_abort=0:"
- "handle_sigfpe=0:"
- "handle_sigill=0",
- 1);
-
- /* Envs for QASan */
- setenv("QASAN_MAX_CALL_STACK", "0", 0);
- setenv("QASAN_SYMBOLIZE", "0", 0);
-
- /* MSAN is tricky, because it doesn't support abort_on_error=1 at this
- point. So, we do this in a very hacky way. */
-
- if (!getenv("MSAN_OPTIONS"))
- setenv("MSAN_OPTIONS",
- "exit_code=" STRINGIFY(MSAN_ERROR) ":"
- "symbolize=0:"
- "abort_on_error=1:"
- "malloc_context_size=0:"
- "allocator_may_return_null=1:"
- "msan_track_origins=0:"
- "handle_segv=0:"
- "handle_sigbus=0:"
- "handle_abort=0:"
- "handle_sigfpe=0:"
- "handle_sigill=0",
- 1);
-
- /* LSAN, too, does not support abort_on_error=1. */
-
- if (!getenv("LSAN_OPTIONS"))
- setenv("LSAN_OPTIONS",
- "exitcode=" STRINGIFY(LSAN_ERROR) ":"
- "fast_unwind_on_malloc=0:"
- "symbolize=0:"
- "print_suppressions=0",
- 1);
+ /* Set sane defaults for sanitizers */
+ set_sanitizer_defaults();
fsrv->init_child_func(fsrv, argv);
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index adfc55ad..1182bd41 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -1817,17 +1817,35 @@ static void handle_existing_out_dir(afl_state_t *afl) {
if (afl->file_extension) {
- fn = alloc_printf("%s/.cur_input.%s", afl->tmp_dir, afl->file_extension);
+ fn = alloc_printf("%s/.cur_input.%s", afl->out_dir, afl->file_extension);
} else {
- fn = alloc_printf("%s/.cur_input", afl->tmp_dir);
+ fn = alloc_printf("%s/.cur_input", afl->out_dir);
}
if (unlink(fn) && errno != ENOENT) { goto dir_cleanup_failed; }
ck_free(fn);
+ if (afl->afl_env.afl_tmpdir) {
+
+ if (afl->file_extension) {
+
+ fn = alloc_printf("%s/.cur_input.%s", afl->afl_env.afl_tmpdir,
+ afl->file_extension);
+
+ } else {
+
+ fn = alloc_printf("%s/.cur_input", afl->afl_env.afl_tmpdir);
+
+ }
+
+ if (unlink(fn) && errno != ENOENT) { goto dir_cleanup_failed; }
+ ck_free(fn);
+
+ }
+
fn = alloc_printf("%s/fuzz_bitmap", afl->out_dir);
if (unlink(fn) && errno != ENOENT) { goto dir_cleanup_failed; }
ck_free(fn);
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 138df26c..20c655cf 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -310,7 +310,7 @@ static void usage(u8 *argv0, int more_help) {
"AFL_EARLY_FORKSERVER: force an early forkserver in an afl-clang-fast/\n"
" afl-clang-lto/afl-gcc-fast target\n"
"AFL_PERSISTENT: enforce persistent mode (if __AFL_LOOP is in a shared lib\n"
- "AFL_DEFER_FORKSRV: enforced deferred forkserver (__AFL_INIT is in a .so\n"
+ "AFL_DEFER_FORKSRV: enforced deferred forkserver (__AFL_INIT is in a .so)\n"
"\n"
);
@@ -2154,8 +2154,12 @@ int main(int argc, char **argv_orig, char **envp) {
if (afl->fsrv.out_file && afl->fsrv.use_shmem_fuzz) {
+ unlink(afl->fsrv.out_file);
afl->fsrv.out_file = NULL;
afl->fsrv.use_stdin = 0;
+ close(afl->fsrv.out_fd);
+ afl->fsrv.out_fd = -1;
+
if (!afl->unicorn_mode && !afl->fsrv.use_stdin && !default_output) {
WARNF(
diff --git a/src/afl-gotcpu.c b/src/afl-gotcpu.c
index 144ec9c9..c5b8a27a 100644
--- a/src/afl-gotcpu.c
+++ b/src/afl-gotcpu.c
@@ -174,7 +174,12 @@ int main(int argc, char **argv) {
if (c == NULL) PFATAL("cpuset_create failed");
cpuset_set(i, c);
- #elif defined(__APPLE__)
+ #elif defined(__APPLE__) && defined(__x86_64__)
+ // the api is not workable on arm64, core's principle
+ // differs significantly hive of core per type vs individual ones.
+ // Possible TODO: For arm64 is to slightly change the meaning
+ // of gotcpu since it makes no sense on this platform
+ // but rather just displaying current policy ?
thread_affinity_policy_data_t c = {i};
thread_port_t native_thread = pthread_mach_thread_np(pthread_self());
if (thread_policy_set(native_thread, THREAD_AFFINITY_POLICY,
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 4e019794..1e281d08 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -597,49 +597,8 @@ static void set_up_environment(afl_forkserver_t *fsrv, char **argv) {
char *afl_preload;
char *frida_afl_preload = NULL;
- setenv("ASAN_OPTIONS",
- "abort_on_error=1:"
- "detect_leaks=0:"
- "allocator_may_return_null=1:"
- "symbolize=0:"
- "detect_odr_violation=0:"
- "handle_segv=0:"
- "handle_sigbus=0:"
- "handle_abort=0:"
- "handle_sigfpe=0:"
- "handle_sigill=0",
- 0);
-
- setenv("LSAN_OPTIONS",
- "exitcode=" STRINGIFY(LSAN_ERROR) ":"
- "fast_unwind_on_malloc=0:"
- "symbolize=0:"
- "print_suppressions=0",
- 0);
-
- setenv("UBSAN_OPTIONS",
- "halt_on_error=1:"
- "abort_on_error=1:"
- "malloc_context_size=0:"
- "allocator_may_return_null=1:"
- "symbolize=0:"
- "handle_segv=0:"
- "handle_sigbus=0:"
- "handle_abort=0:"
- "handle_sigfpe=0:"
- "handle_sigill=0",
- 0);
-
- setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":"
- "abort_on_error=1:"
- "msan_track_origins=0"
- "allocator_may_return_null=1:"
- "symbolize=0:"
- "handle_segv=0:"
- "handle_sigbus=0:"
- "handle_abort=0:"
- "handle_sigfpe=0:"
- "handle_sigill=0", 0);
+
+ set_sanitizer_defaults();
if (get_afl_env("AFL_PRELOAD")) {
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 687bb0e7..12c5e0c9 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -674,27 +674,6 @@ static void set_up_environment(afl_forkserver_t *fsrv, char **argv) {
/* Set sane defaults... */
- x = get_afl_env("ASAN_OPTIONS");
-
- if (x) {
-
- if (!strstr(x, "abort_on_error=1")) {
-
- FATAL("Custom ASAN_OPTIONS set without abort_on_error=1 - please fix!");
-
- }
-
-#ifndef ASAN_BUILD
- if (!getenv("AFL_DEBUG") && !strstr(x, "symbolize=0")) {
-
- FATAL("Custom ASAN_OPTIONS set without symbolize=0 - please fix!");
-
- }
-
-#endif
-
- }
-
x = get_afl_env("MSAN_OPTIONS");
if (x) {
@@ -706,69 +685,9 @@ static void set_up_environment(afl_forkserver_t *fsrv, char **argv) {
}
- if (!strstr(x, "symbolize=0")) {
-
- FATAL("Custom MSAN_OPTIONS set without symbolize=0 - please fix!");
-
- }
-
- }
-
- x = get_afl_env("LSAN_OPTIONS");
-
- if (x) {
-
- if (!strstr(x, "symbolize=0")) {
-
- FATAL("Custom LSAN_OPTIONS set without symbolize=0 - please fix!");
-
- }
-
}
- setenv("ASAN_OPTIONS",
- "abort_on_error=1:"
- "detect_leaks=0:"
- "allocator_may_return_null=1:"
- "symbolize=0:"
- "detect_odr_violation=0:"
- "handle_segv=0:"
- "handle_sigbus=0:"
- "handle_abort=0:"
- "handle_sigfpe=0:"
- "handle_sigill=0",
- 0);
-
- setenv("UBSAN_OPTIONS",
- "halt_on_error=1:"
- "abort_on_error=1:"
- "malloc_context_size=0:"
- "allocator_may_return_null=1:"
- "symbolize=0:"
- "handle_segv=0:"
- "handle_sigbus=0:"
- "handle_abort=0:"
- "handle_sigfpe=0:"
- "handle_sigill=0",
- 0);
-
- setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":"
- "abort_on_error=1:"
- "msan_track_origins=0"
- "allocator_may_return_null=1:"
- "symbolize=0:"
- "handle_segv=0:"
- "handle_sigbus=0:"
- "handle_abort=0:"
- "handle_sigfpe=0:"
- "handle_sigill=0", 0);
-
- setenv("LSAN_OPTIONS",
- "exitcode=" STRINGIFY(LSAN_ERROR) ":"
- "fast_unwind_on_malloc=0:"
- "symbolize=0:"
- "print_suppressions=0",
- 0);
+ set_sanitizer_defaults();
if (get_afl_env("AFL_PRELOAD")) {
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-25 00:40:47 +0000