From e9e440d7f33a61793c63f90f9555ff3c0f45b3b4 Mon Sep 17 00:00:00 2001
From: Amit Elkabetz <12958411+amitelka@users.noreply.github.com>
Date: Sun, 5 Mar 2023 20:25:39 +0200
Subject: Fixed according to PR comment, moved cli flag to an env variable

---
 docs/env_variables.md | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'docs')

diff --git a/docs/env_variables.md b/docs/env_variables.md
index 6cd4104b..c9dc1bbd 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -584,6 +584,12 @@ checks or alter some of the more exotic semantics of the tool:
   - Set `AFL_PIZZA_MODE` to 1 to enable the April 1st stats menu, set to 0
     to disable although it is 1st of April.
 
+  - If you need a specific interval to update fuzzer_stats file, you can
+    set `AFL_FUZZER_STATS_UPDATE_INTERVAL` to the interval in seconds you'd
+    the file to be updated.
+    Note that will not be exact and with slow targets it can take seconds
+    until there is a slice for the time test.
+
 ## 5) Settings for afl-qemu-trace
 
 The QEMU wrapper used to instrument binary-only code supports several settings:
-- 
cgit 1.4.1


From a30664c5639a924fd2bfd40bd9570f11ef09fd10 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 6 Mar 2023 09:15:05 +0100
Subject: fix ci

---
 .github/workflows/ci.yml            | 2 +-
 docs/fuzzing_binary-only_targets.md | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'docs')

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 04cbaca8..b7d8b3b7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
       - name: debug
         run: apt-cache search plugin-dev | grep gcc-; echo; apt-cache search clang-format- | grep clang-format-
       - name: update
-        run: sudo apt-get update && sudo apt-get upgrade -y
+        run: sudo apt-get purge -y "grub*" && sudo apt-get update && sudo apt-get upgrade -y
       - name: install packages
         run: sudo apt-get install -y -m -f --install-suggests build-essential git libtool libtool-bin automake bison libglib2.0-0 clang llvm-dev libc++-dev findutils libcmocka-dev python3-dev python3-setuptools ninja-build
       - name: compiler installed
diff --git a/docs/fuzzing_binary-only_targets.md b/docs/fuzzing_binary-only_targets.md
index 266920e6..9d9d6bb6 100644
--- a/docs/fuzzing_binary-only_targets.md
+++ b/docs/fuzzing_binary-only_targets.md
@@ -201,10 +201,10 @@ afl-clang-fast's.
 ### RetroWrite
 
 RetroWrite is a static binary rewriter that can be combined with AFL++. If you
-have an x86_64 binary that still has its symbols (i.e., not stripped binary), is
-compiled with position independent code (PIC/PIE), and does not contain C++
-exceptions, then the RetroWrite solution might be for you. It decompiles to ASM
-files which can then be instrumented with afl-gcc.
+have an x86_64 or arm64 binary that does not contain C++ exceptions and - if
+x86_64 - still has it's symbols and compiled with position independent code
+(PIC/PIE), then the RetroWrite solution might be for you.
+It decompiles to ASM files which can then be instrumented with afl-gcc.
 
 Binaries that are statically instrumented for fuzzing using RetroWrite are close
 in performance to compiler-instrumented binaries and outperform the QEMU-based
-- 
cgit 1.4.1


From e6a05382b83817b245da51bcba16be5df56eb283 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 6 Mar 2023 09:59:52 +0100
Subject: fix IGNORE_PROBLEMS and update qemuafl

---
 docs/Changelog.md                   |  2 ++
 instrumentation/afl-compiler-rt.o.c | 39 ++++++++++++++++++++++++-------------
 instrumentation/afl-llvm-common.h   |  8 ++++----
 qemu_mode/QEMUAFL_VERSION           |  2 +-
 qemu_mode/qemuafl                   |  2 +-
 src/afl-fuzz-stats.c                | 22 ++++++++++-----------
 6 files changed, 44 insertions(+), 31 deletions(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 8f71fd83..f4fa4382 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -11,6 +11,8 @@
     - add CFI sanitizer variant to gcc targets
     - llvm 16 support (thanks to @devnexen!)
     - support llvm 15 native pcguard changes
+  - qemu_mode:
+    - fix _RANGES envs to allow hyphens in the filenames
   - new custom module: autotoken, grammar free fuzzer for text inputs
   - LTO autoken and llvm_mode: added AFL_LLVM_DICT2FILE_NO_MAIN support
   - better sanitizer default options support for all tools
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 9871d7f4..94022a65 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1539,12 +1539,16 @@ void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) {
   if (start == stop || *start) return;
 
   x = getenv("AFL_INST_RATIO");
-  if (x) { inst_ratio = (u32)atoi(x); }
+  if (x) {
 
-  if (!inst_ratio || inst_ratio > 100) {
+    inst_ratio = (u32)atoi(x);
 
-    fprintf(stderr, "[-] ERROR: Invalid AFL_INST_RATIO (must be 1-100).\n");
-    abort();
+    if (!inst_ratio || inst_ratio > 100) {
+
+      fprintf(stderr, "[-] ERROR: Invalid AFL_INST_RATIO (must be 1-100).\n");
+      abort();
+
+    }
 
   }
 
@@ -1568,10 +1572,16 @@ void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) {
 
       while (start < stop) {
 
-        if (likely(inst_ratio == 100) || R(100) < inst_ratio)
-          *start = offset;
-        else
-          *start = 0;  // write to map[0]
+        if (likely(inst_ratio == 100) || R(100) < inst_ratio) {
+
+          *(start++) = offset;
+
+        } else {
+
+          *(start++) = 0;  // write to map[0]
+
+        }
+
         if (unlikely(++offset >= __afl_final_loc)) { offset = 4; }
 
       }
@@ -1592,12 +1602,15 @@ void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) {
 
   while (start < stop) {
 
-    if (likely(inst_ratio == 100) || R(100) < inst_ratio)
-      *start = ++__afl_final_loc;
-    else
-      *start = 0;  // write to map[0]
+    if (likely(inst_ratio == 100) || R(100) < inst_ratio) {
+
+      *(start++) = ++__afl_final_loc;
 
-    start++;
+    } else {
+
+      *(start++) = 0;  // write to map[0]
+
+    }
 
   }
 
diff --git a/instrumentation/afl-llvm-common.h b/instrumentation/afl-llvm-common.h
index 0112c325..16a13da5 100644
--- a/instrumentation/afl-llvm-common.h
+++ b/instrumentation/afl-llvm-common.h
@@ -37,10 +37,10 @@ typedef long double max_align_t;
   #define MNAME M.getSourceFileName()
   #define FMNAME F.getParent()->getSourceFileName()
   #if LLVM_VERSION_MAJOR >= 16
-  // None becomes deprecated
-  // the standard std::nullopt_t is recommended instead
-  // from C++17 and onwards.
-  constexpr std::nullopt_t None = std::nullopt;
+// None becomes deprecated
+// the standard std::nullopt_t is recommended instead
+// from C++17 and onwards.
+constexpr std::nullopt_t None = std::nullopt;
   #endif
 #else
   #define MNAME std::string("")
diff --git a/qemu_mode/QEMUAFL_VERSION b/qemu_mode/QEMUAFL_VERSION
index 9c68f02c..39e41f79 100644
--- a/qemu_mode/QEMUAFL_VERSION
+++ b/qemu_mode/QEMUAFL_VERSION
@@ -1 +1 @@
-a8af9cbde7
+74c583b11a
diff --git a/qemu_mode/qemuafl b/qemu_mode/qemuafl
index a8af9cbd..74c583b1 160000
--- a/qemu_mode/qemuafl
+++ b/qemu_mode/qemuafl
@@ -1 +1 @@
-Subproject commit a8af9cbde71e333ce72a46f15e655d0b82ed0939
+Subproject commit 74c583b11ac508b90660723da7ee9ff7ff77ee92
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index 26e1a50e..53ab8c77 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -672,12 +672,11 @@ void show_stats_normal(afl_state_t *afl) {
   /* If no coverage was found yet, check whether run time is greater than
    * exit_on_time. */
 
-  if (unlikely(
-          !afl->non_instrumented_mode && afl->afl_env.afl_exit_on_time &&
-          ((afl->last_find_time &&
-            (cur_ms - afl->last_find_time) > afl->exit_on_time) ||
-           (!afl->last_find_time && (cur_ms - afl->start_time) 
-	                             > afl->exit_on_time)))) {
+  if (unlikely(!afl->non_instrumented_mode && afl->afl_env.afl_exit_on_time &&
+               ((afl->last_find_time &&
+                 (cur_ms - afl->last_find_time) > afl->exit_on_time) ||
+                (!afl->last_find_time &&
+                 (cur_ms - afl->start_time) > afl->exit_on_time)))) {
 
     afl->stop_soon = 2;
 
@@ -1476,12 +1475,11 @@ void show_stats_pizza(afl_state_t *afl) {
   /* If no coverage was found yet, check whether run time is greater than
    * exit_on_time. */
 
-  if (unlikely(
-          !afl->non_instrumented_mode && afl->afl_env.afl_exit_on_time &&
-          ((afl->last_find_time &&
-            (cur_ms - afl->last_find_time) > afl->exit_on_time) ||
-           (!afl->last_find_time && (cur_ms - afl->start_time)
-	                             > afl->exit_on_time)))) {
+  if (unlikely(!afl->non_instrumented_mode && afl->afl_env.afl_exit_on_time &&
+               ((afl->last_find_time &&
+                 (cur_ms - afl->last_find_time) > afl->exit_on_time) ||
+                (!afl->last_find_time &&
+                 (cur_ms - afl->start_time) > afl->exit_on_time)))) {
 
     afl->stop_soon = 2;
 
-- 
cgit 1.4.1


From e0866f51c7984c28866e7acdb153b5304c5cf7da Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Thu, 9 Mar 2023 13:57:03 +0100
Subject: support LLVMFuzzerTestOneInput -1 return

---
 docs/Changelog.md                      |  2 ++
 test/test-cmplog.c                     |  2 +-
 utils/aflpp_driver/aflpp_driver.c      | 13 ++++++++++++-
 utils/aflpp_driver/aflpp_driver_test.c | 13 ++++++++-----
 4 files changed, 23 insertions(+), 7 deletions(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index f4fa4382..5287d038 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -7,10 +7,12 @@
   - afl-fuzz:
     - ensure temporary file descriptor is closed when not used
     - added `AFL_NO_WARN_INSTABILITY`
+    - added `AFL_FRIDA_STATS_INTERVAL`
   - afl-cc:
     - add CFI sanitizer variant to gcc targets
     - llvm 16 support (thanks to @devnexen!)
     - support llvm 15 native pcguard changes
+    - support for LLVMFuzzerTestOneInput -1 return
   - qemu_mode:
     - fix _RANGES envs to allow hyphens in the filenames
   - new custom module: autotoken, grammar free fuzzer for text inputs
diff --git a/test/test-cmplog.c b/test/test-cmplog.c
index d724ecaf..bd1b73e3 100644
--- a/test/test-cmplog.c
+++ b/test/test-cmplog.c
@@ -8,7 +8,7 @@
 
 int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t i) {
 
-  if (i < 30) return 0;
+  if (i < 30) return -1;
   if (buf[0] != 'A') return 0;
   if (buf[1] != 'B') return 0;
   if (buf[2] != 'C') return 0;
diff --git a/utils/aflpp_driver/aflpp_driver.c b/utils/aflpp_driver/aflpp_driver.c
index 03376b6a..f08c9864 100644
--- a/utils/aflpp_driver/aflpp_driver.c
+++ b/utils/aflpp_driver/aflpp_driver.c
@@ -58,10 +58,15 @@ $AFL_HOME/afl-fuzz -i IN -o OUT ./a.out
   #include "hash.h"
 #endif
 
+// AFL++ shared memory fuzz cases
 int                   __afl_sharedmem_fuzzing = 1;
 extern unsigned int  *__afl_fuzz_len;
 extern unsigned char *__afl_fuzz_ptr;
 
+// AFL++ coverage map
+extern unsigned char *__afl_area_ptr;
+extern unsigned int   __afl_map_size;
+
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 __attribute__((weak)) int LLVMFuzzerTestOneInput(const uint8_t *Data,
                                                  size_t         Size);
@@ -375,7 +380,13 @@ int LLVMFuzzerRunDriver(int *argcp, char ***argvp,
         }
 
         prev_length = length;
-        (void)callback(__afl_fuzz_ptr, length);
+
+        if (unlikely(callback(__afl_fuzz_ptr, length) == -1)) {
+
+          memset(__afl_area_ptr, 0, __afl_map_size);
+          __afl_area_ptr[0] = 1;
+
+        }
 
       }
 
diff --git a/utils/aflpp_driver/aflpp_driver_test.c b/utils/aflpp_driver/aflpp_driver_test.c
index 527ba57b..7cffa4a1 100644
--- a/utils/aflpp_driver/aflpp_driver_test.c
+++ b/utils/aflpp_driver/aflpp_driver_test.c
@@ -2,9 +2,9 @@
 #include <stdlib.h>
 #include <stdint.h>
 
-void __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
+int __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
 
-  if (Size < 5) return;
+  if (Size < 5) return -1;
 
   if (Data[0] == 'F')
     if (Data[1] == 'A')
@@ -12,13 +12,16 @@ void __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
         if (Data[3] == '$')
           if (Data[4] == '$') abort();
 
+  return 0;
+
 }
 
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 
-  if (Size) crashme(Data, Size);
-
-  return 0;
+  if (Size)
+    return crashme(Data, Size);
+  else
+    return -1;
 
 }
 
-- 
cgit 1.4.1


From 5221938945cc5ff15af04b727c6a7e0085005044 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Thu, 9 Mar 2023 17:36:13 +0100
Subject: various fixes

---
 docs/Changelog.md                   |  2 +-
 include/common.h                    |  3 +++
 instrumentation/afl-compiler-rt.o.c | 18 ++++++++++++------
 src/afl-analyze.c                   |  4 ++++
 src/afl-common.c                    | 37 ++++++++++++++++++++++++++++++-------
 src/afl-fuzz-init.c                 | 19 ++++++++++++-------
 src/afl-fuzz-stats.c                |  2 +-
 src/afl-showmap.c                   |  4 ++++
 src/afl-tmin.c                      |  4 ++++
 9 files changed, 71 insertions(+), 22 deletions(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 5287d038..25c1f6bc 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -20,7 +20,7 @@
   - better sanitizer default options support for all tools
   - unicorn_mode: updated and minor issues fixed
   - frida_mode: fix issue on MacOS
-  - more minor fixes
+  - more minor fixes and cross-platform support
 
 ### Version ++4.05c (release)
   - MacOS: libdislocator, libtokencap etc. do not work with modern
diff --git a/include/common.h b/include/common.h
index c5a32cdb..5d198468 100644
--- a/include/common.h
+++ b/include/common.h
@@ -143,5 +143,8 @@ FILE *create_ffile(u8 *fn);
 /* create a file */
 s32 create_file(u8 *fn);
 
+/* memmem implementation as not all platforms support this */
+void *afl_memmem(const void *haystack, size_t haystacklen, const void *needle, size_t needlelen);
+
 #endif
 
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 94022a65..a88396d4 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1622,17 +1622,23 @@ void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) {
 
   }
 
-  if (__afl_already_initialized_shm && __afl_final_loc > __afl_map_size) {
+  if (__afl_already_initialized_shm) {
 
-    if (__afl_debug) {
+    if (__afl_final_loc > __afl_map_size) {
+
+      if (__afl_debug) {
+
+        fprintf(stderr, "Reinit shm necessary (+%u)\n",
+                __afl_final_loc - __afl_map_size);
+
+      }
 
-      fprintf(stderr, "Reinit shm necessary (+%u)\n",
-              __afl_final_loc - __afl_map_size);
+      __afl_unmap_shm();
+      __afl_map_shm();
 
     }
 
-    __afl_unmap_shm();
-    __afl_map_shm();
+    __afl_map_size = __afl_final_loc + 1;
 
   }
 
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index d4a9aa91..9734f75c 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -725,7 +725,11 @@ static void setup_signal_handlers(void) {
   struct sigaction sa;
 
   sa.sa_handler = NULL;
+  #ifdef SA_RESTART
   sa.sa_flags = SA_RESTART;
+  #else
+    sa.sa_flags = 0;
+  #endif
   sa.sa_sigaction = NULL;
 
   sigemptyset(&sa.sa_mask);
diff --git a/src/afl-common.c b/src/afl-common.c
index b0df1994..86226c9f 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -58,6 +58,25 @@ u8  last_intr = 0;
   #define AFL_PATH "/usr/local/lib/afl/"
 #endif
 
+void *afl_memmem(const void *haystack, size_t haystacklen, const void *needle,
+                 size_t needlelen) {
+
+  if (unlikely(needlelen > haystacklen)) { return NULL; }
+
+  for (u32 i = 0; i <= haystacklen - needlelen; ++i) {
+
+    if (unlikely(memcmp(haystack + i, needle, needlelen) == 0)) {
+
+      return (void *)(haystack + i);
+
+    }
+
+  }
+
+  return (void *)NULL;
+
+}
+
 void set_sanitizer_defaults() {
 
   /* Set sane defaults for ASAN if nothing else is specified. */
@@ -67,9 +86,9 @@ void set_sanitizer_defaults() {
   u8 *have_lsan_options = getenv("LSAN_OPTIONS");
   u8  have_san_options = 0;
   u8  default_options[1024] =
-      "detect_odr_violation=0:abort_on_error=1:symbolize=0:malloc_context_"
-      "size=0:allocator_may_return_null=1:handle_segv=0:handle_sigbus=0:"
-      "handle_abort=0:handle_sigfpe=0:handle_sigill=0:";
+      "detect_odr_violation=0:abort_on_error=1:symbolize=0:allocator_may_"
+      "return_null=1:handle_segv=0:handle_sigbus=0:handle_abort=0:handle_"
+      "sigfpe=0:handle_sigill=0:";
 
   if (have_asan_options || have_ubsan_options || have_msan_options ||
       have_lsan_options) {
@@ -84,14 +103,18 @@ void set_sanitizer_defaults() {
 
     u8 buf[2048] = "";
     if (!have_san_options) { strcpy(buf, default_options); }
-    strcat(buf, "exitcode=" STRINGIFY(LSAN_ERROR) ":fast_unwind_on_malloc=0:print_suppressions=0:detect_leaks=1:");
+    strcat(buf, "exitcode=" STRINGIFY(LSAN_ERROR) ":fast_unwind_on_malloc=0:print_suppressions=0:detect_leaks=1:malloc_context_size=30:");
     setenv("LSAN_OPTIONS", buf, 1);
 
   }
 
   /* for everything not LSAN we disable detect_leaks */
 
-  if (!have_lsan_options) { strcat(default_options, "detect_leaks=0:"); }
+  if (!have_lsan_options) {
+
+    strcat(default_options, "detect_leaks=0:malloc_context_size=0:");
+
+  }
 
   /* Set sane defaults for ASAN if nothing else is specified. */
 
@@ -130,7 +153,7 @@ u32 check_binary_signatures(u8 *fn) {
   if (f_data == MAP_FAILED) { PFATAL("Unable to mmap file '%s'", fn); }
   close(fd);
 
-  if (memmem(f_data, f_len, PERSIST_SIG, strlen(PERSIST_SIG) + 1)) {
+  if (afl_memmem(f_data, f_len, PERSIST_SIG, strlen(PERSIST_SIG) + 1)) {
 
     if (!be_quiet) { OKF(cPIN "Persistent mode binary detected."); }
     setenv(PERSIST_ENV_VAR, "1", 1);
@@ -155,7 +178,7 @@ u32 check_binary_signatures(u8 *fn) {
 
   }
 
-  if (memmem(f_data, f_len, DEFER_SIG, strlen(DEFER_SIG) + 1)) {
+  if (afl_memmem(f_data, f_len, DEFER_SIG, strlen(DEFER_SIG) + 1)) {
 
     if (!be_quiet) { OKF(cPIN "Deferred forkserver binary detected."); }
     setenv(DEFER_ENV_VAR, "1", 1);
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index c20965b4..3b441eee 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -24,7 +24,9 @@
  */
 
 #include "afl-fuzz.h"
+#include "common.h"
 #include <limits.h>
+#include <string.h>
 #include "cmplog.h"
 
 #ifdef HAVE_AFFINITY
@@ -2786,7 +2788,7 @@ void check_binary(afl_state_t *afl, u8 *fname) {
       !afl->fsrv.nyx_mode &&
 #endif
       !afl->fsrv.cs_mode && !afl->non_instrumented_mode &&
-      !memmem(f_data, f_len, SHM_ENV_VAR, strlen(SHM_ENV_VAR) + 1)) {
+      !afl_memmem(f_data, f_len, SHM_ENV_VAR, strlen(SHM_ENV_VAR) + 1)) {
 
     SAYF("\n" cLRD "[-] " cRST
          "Looks like the target binary is not instrumented! The fuzzer depends "
@@ -2817,7 +2819,7 @@ void check_binary(afl_state_t *afl, u8 *fname) {
   }
 
   if ((afl->fsrv.cs_mode || afl->fsrv.qemu_mode || afl->fsrv.frida_mode) &&
-      memmem(f_data, f_len, SHM_ENV_VAR, strlen(SHM_ENV_VAR) + 1)) {
+      afl_memmem(f_data, f_len, SHM_ENV_VAR, strlen(SHM_ENV_VAR) + 1)) {
 
     SAYF("\n" cLRD "[-] " cRST
          "This program appears to be instrumented with afl-gcc, but is being "
@@ -2830,9 +2832,9 @@ void check_binary(afl_state_t *afl, u8 *fname) {
 
   }
 
-  if (memmem(f_data, f_len, "__asan_init", 11) ||
-      memmem(f_data, f_len, "__msan_init", 11) ||
-      memmem(f_data, f_len, "__lsan_init", 11)) {
+  if (afl_memmem(f_data, f_len, "__asan_init", 11) ||
+      afl_memmem(f_data, f_len, "__msan_init", 11) ||
+      afl_memmem(f_data, f_len, "__lsan_init", 11)) {
 
     afl->fsrv.uses_asan = 1;
 
@@ -2840,7 +2842,7 @@ void check_binary(afl_state_t *afl, u8 *fname) {
 
   /* Detect persistent & deferred init signatures in the binary. */
 
-  if (memmem(f_data, f_len, PERSIST_SIG, strlen(PERSIST_SIG) + 1)) {
+  if (afl_memmem(f_data, f_len, PERSIST_SIG, strlen(PERSIST_SIG) + 1)) {
 
     OKF(cPIN "Persistent mode binary detected.");
     setenv(PERSIST_ENV_VAR, "1", 1);
@@ -2867,7 +2869,7 @@ void check_binary(afl_state_t *afl, u8 *fname) {
   }
 
   if (afl->fsrv.frida_mode ||
-      memmem(f_data, f_len, DEFER_SIG, strlen(DEFER_SIG) + 1)) {
+      afl_memmem(f_data, f_len, DEFER_SIG, strlen(DEFER_SIG) + 1)) {
 
     OKF(cPIN "Deferred forkserver binary detected.");
     setenv(DEFER_ENV_VAR, "1", 1);
@@ -2923,8 +2925,11 @@ void setup_signal_handlers(void) {
 
   struct sigaction sa;
 
+  memset((void*)&sa, 0, sizeof(sa));
   sa.sa_handler = NULL;
+#ifdef SA_RESTART
   sa.sa_flags = SA_RESTART;
+#endif
   sa.sa_sigaction = NULL;
 
   sigemptyset(&sa.sa_mask);
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index 65caf5ee..f53fd610 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -62,7 +62,7 @@ void write_setup_file(afl_state_t *afl, u32 argc, char **argv) {
     if (memchr(argv[i], '\'', strlen(argv[i]))) {
 
 #else
-    if (index(argv[i], '\'')) {
+    if (strchr(argv[i], '\'')) {
 
 #endif
 
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 1e281d08..32dd1c20 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -654,7 +654,11 @@ static void setup_signal_handlers(void) {
   struct sigaction sa;
 
   sa.sa_handler = NULL;
+  #ifdef SA_RESTART
   sa.sa_flags = SA_RESTART;
+  #else
+    sa.sa_flags = 0;
+  #endif
   sa.sa_sigaction = NULL;
 
   sigemptyset(&sa.sa_mask);
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 12c5e0c9..530578d9 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -743,7 +743,11 @@ static void setup_signal_handlers(void) {
   struct sigaction sa;
 
   sa.sa_handler = NULL;
+  #ifdef SA_RESTART
   sa.sa_flags = SA_RESTART;
+  #else
+    sa.sa_flags = 0;
+  #endif
   sa.sa_sigaction = NULL;
 
   sigemptyset(&sa.sa_mask);
-- 
cgit 1.4.1