about summary refs log tree commit diff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/afl-fuzz-bitmap.c4
-rw-r--r--src/afl-fuzz-one.c22
-rw-r--r--src/afl-fuzz-queue.c3
-rw-r--r--src/afl-fuzz-run.c2
-rw-r--r--src/afl-fuzz.c2
5 files changed, 19 insertions, 14 deletions
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index d4ee36e1..9f58d604 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -183,6 +183,8 @@ u32 count_bits_len(afl_state_t *afl, u8 *mem, u32 len) {
   u32  i = (len >> 2);
   u32  ret = 0;
 
+  (void)(afl);
+
   if (len % 4) i++;
 
   while (i--) {
@@ -241,6 +243,8 @@ u32 count_bytes_len(afl_state_t *afl, u8 *mem, u32 len) {
   u32  i = (len >> 2);
   u32  ret = 0;
 
+  (void)(afl);
+
   while (i--) {
 
     u32 v = *(ptr++);
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 2f724569..4b2fd90a 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -472,12 +472,12 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
     ret_val = 1;
 
-    u32 dst = 0, i;
+    s32 dst = 0, i;
     temp_len = len = afl->queue_cur->len;
 
     fd = open(afl->queue_cur->fname, O_RDONLY);
     afl->taint_src = mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-    if (fd < 0 || (size_t)afl->taint_src == -1)
+    if (fd < 0 || (ssize_t)afl->taint_src == -1)
       FATAL("unable to open '%s'", afl->queue_cur->fname);
     close(fd);
     afl->taint_needs_splode = 1;
@@ -490,18 +490,18 @@ u8 fuzz_one_original(afl_state_t *afl) {
         temp_len = len = afl->taint_len = afl->queue_cur->taint_bytes_all;
         orig_in = in_buf =
             mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-        if (fd < 0 || (size_t)in_buf == -1)
+        if (fd < 0 || (ssize_t)in_buf == -1)
           FATAL("unable to open '%s'", afl->taint_input_file);
         close(fd);
 
         fd = open(afl->queue_cur->fname_taint, O_RDWR);
         afl->taint_map = mmap(0, afl->queue_cur->len, PROT_READ | PROT_WRITE,
                               MAP_PRIVATE, fd, 0);
-        if (fd < 0 || (size_t)in_buf == -1)
+        if (fd < 0 || (ssize_t)in_buf == -1)
           FATAL("unable to open '%s'", afl->queue_cur->fname_taint);
         close(fd);
 
-        for (i = 0; i < afl->queue_cur->len && dst < len; i++)
+        for (i = 0; i < (s32)afl->queue_cur->len && dst < len; i++)
           if (afl->taint_map[i]) in_buf[dst++] = afl->taint_src[i];
 
         break;
@@ -512,7 +512,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
         temp_len = len = afl->taint_len = afl->queue_cur->taint_bytes_new;
         orig_in = in_buf =
             mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-        if (fd < 0 || (size_t)in_buf == -1)
+        if (fd < 0 || (ssize_t)in_buf == -1)
           FATAL("unable to open '%s'", afl->taint_input_file);
         close(fd);
 
@@ -520,12 +520,12 @@ u8 fuzz_one_original(afl_state_t *afl) {
         fd = open(fn, O_RDWR);
         afl->taint_map = mmap(0, afl->queue_cur->len, PROT_READ | PROT_WRITE,
                               MAP_PRIVATE, fd, 0);
-        if (fd < 0 || (size_t)in_buf == -1)
+        if (fd < 0 || (ssize_t)in_buf == -1)
           FATAL("unable to open '%s' for %u bytes", fn, len);
         close(fd);
         ck_free(fn);
 
-        for (i = 0; i < afl->queue_cur->len && dst < len; i++)
+        for (i = 0; i < (s32)afl->queue_cur->len && dst < len; i++)
           if (afl->taint_map[i]) in_buf[dst++] = afl->taint_src[i];
 
         break;
@@ -2297,7 +2297,8 @@ havoc_stage:
           }
 
           copy_to = rand_below(afl, temp_len - copy_len + 1);
-          if (unlikely(copy_to > temp_len)) copy_to = rand_below(afl, temp_len);
+          if (unlikely(copy_to > (u32)temp_len))
+            copy_to = rand_below(afl, temp_len);
 
           if (rand_below(afl, 4)) {
 
@@ -2305,7 +2306,8 @@ havoc_stage:
 
               if (unlikely(afl->taint_needs_splode)) {
 
-                if (copy_to > temp_len) copy_to = rand_below(afl, temp_len);
+                if (copy_to > (u32)temp_len)
+                  copy_to = rand_below(afl, temp_len);
 
                 // fprintf(stderr, "\nout_buf %p + copy_to %u, src %p + %u,
                 // copy_len %u -- len %u\n", out_buf , copy_to, afl->taint_src ,
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 28af17f0..f4b58a9d 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -108,7 +108,6 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
   u8 *                ptr, *fn = fname;
   u32                 bytes = 0, plen = len;
-  s32                 fd = -1;
   struct queue_entry *prev = q->prev;
 
   if (plen % 4) plen = plen + 4 - (len % 4);
@@ -170,7 +169,7 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
           u8 *bufr = mmap(0, prev->len, PROT_READ, MAP_PRIVATE, r, 0);
 
-          if ((size_t)bufr != -1) {
+          if ((ssize_t)bufr != -1) {
 
             u32 i;
             u8 *tmp = ck_maybe_grow(BUF_PARAMS(in_scratch), plen);
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 9db23134..058f8c2d 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -883,7 +883,7 @@ u8 common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
     u8 *new_buf = ck_maybe_grow(BUF_PARAMS(in_scratch), new_len);
 
     u32 i, taint = 0;
-    for (i = 0; i < new_len; i++) {
+    for (i = 0; i < (u32)new_len; i++) {
 
       if (i >= afl->taint_len || i >= afl->queue_cur->len || afl->taint_map[i])
         new_buf[i] = out_buf[taint++];
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index d2b2c2d9..e6238366 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1095,7 +1095,7 @@ int main(int argc, char **argv_orig, char **envp) {
   if (map_size != real_map_size) {
 
     afl->fsrv.map_size = real_map_size;
-    if (afl->cmplog_binary) afl->cmplog_fsrv.map_size;
+    if (afl->cmplog_binary) afl->cmplog_fsrv.map_size = real_map_size;
 
   }
generated by cgit-pink 1.4.1 (git 2.36.1) at 2025-05-16 12:09:19 +0000