From d4fb7f8b4015297e1c74b28d671eba058cfb6366 Mon Sep 17 00:00:00 2001
From: realmadsci <71108352+realmadsci@users.noreply.github.com>
Date: Fri, 12 Mar 2021 15:53:42 -0500
Subject: Add AFL_QEMU_CUSTOM_BIN environment flag

In QEMU mode (-Q), setting AFL_QEMU_CUSTOM_BIN cause afl-fuzz to skip
prepending afl-qemu-trace to your command line. Use this if you wish to use a
custom afl-qemu-trace or if you need to modify the afl-qemu-trace arguments.
---
 docs/env_variables.md | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'docs')

diff --git a/docs/env_variables.md b/docs/env_variables.md
index a20f1e42..c6ad0aa4 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -393,6 +393,10 @@ checks or alter some of the more exotic semantics of the tool:
 
   - In QEMU mode (-Q), `AFL_PATH` will be searched for afl-qemu-trace.
 
+  - In QEMU mode (-Q), setting `AFL_QEMU_CUSTOM_BIN` cause afl-fuzz to skip
+    prepending `afl-qemu-trace` to your command line. Use this if you wish to use a
+    custom afl-qemu-trace or if you need to modify the afl-qemu-trace arguments.
+
   - Setting `AFL_CYCLE_SCHEDULES` will switch to a different schedule everytime
     a cycle is finished.
 
-- 
cgit 1.4.1


From 1dcc3549b6ecc3925825c00ac63274b83e76ec8a Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 15 Mar 2021 23:21:03 +0100
Subject: v3.12a init

---
 docs/Changelog.md | 5 ++++-
 include/config.h  | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 1c735a70..8222f942 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -8,6 +8,10 @@
 Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
+### Version ++3.12a (dev)
+  - ...
+
+
 ### Version ++3.11c (release)
   - afl-fuzz:
     - better auto detection of map size
@@ -38,7 +42,6 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - we no longer perform a "git drop"
   - afl-cmin: support filenames with spaces
 
-
 ### Version ++3.10c (release)
   - Mac OS ARM64 support
   - Android support fixed and updated by Joey Jiaojg - thanks!
diff --git a/include/config.h b/include/config.h
index cc8024ea..b049fee0 100644
--- a/include/config.h
+++ b/include/config.h
@@ -26,7 +26,7 @@
 /* Version string: */
 
 // c = release, a = volatile github dev, e = experimental branch
-#define VERSION "++3.11c"
+#define VERSION "++3.12a"
 
 /******************************************************
  *                                                    *
-- 
cgit 1.4.1


From f5420e737a1ed1dbeb81783836d0449c06aa0fcc Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 16 Mar 2021 16:15:29 +0100
Subject: rtn fix

---
 docs/Changelog.md                   |  2 +-
 instrumentation/afl-compiler-rt.o.c | 23 ++++++++++++-----------
 qemu_mode/qemuafl                   |  2 +-
 3 files changed, 14 insertions(+), 13 deletions(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 8222f942..9aea3638 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -9,7 +9,7 @@ Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 ### Version ++3.12a (dev)
-  - ...
+  - fix cmplog rtn (rare crash and not being able to gather ptr data)
 
 
 ### Version ++3.11c (release)
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 50b4e2c5..892118fb 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1734,25 +1734,26 @@ static int area_is_valid(void *ptr, size_t len) {
 
   long r = syscall(SYS_write, __afl_dummy_fd[1], ptr, len);
 
-  if (unlikely(r <= 0 || r > len)) {  // fail - maybe hitting asan boundary?
+  if (r <= 0 || r > len) return 0;
 
-    char *p = (char *)ptr;
-    long  page_size = sysconf(_SC_PAGE_SIZE);
-    char *page = (char *)((uintptr_t)p & ~(page_size - 1)) + page_size;
-    if (page >= p + len) { return 0; }  // no isnt, return fail
-    len = page - p - len;
-    r = syscall(SYS_write, __afl_dummy_fd[1], page, len);
+  // even if the write succeed this can be a false positive if we cross
+  // a page boundary. who knows why.
 
-  }
+  char *p = (char *)ptr;
+  long  page_size = sysconf(_SC_PAGE_SIZE);
+  char *page = (char *)((uintptr_t)p & ~(page_size - 1)) + page_size;
 
-  // partial writes - we return what was written.
-  if (likely(r >= 0 && r <= len)) {
+  if (page > p + len) {
 
+    // no, not crossing a page boundary
     return (int)r;
 
   } else {
 
-    return 0;
+    // yes it crosses a boundary, hence we can only return the length of
+    // rest of the first page, we cannot detect if the next page is valid
+    // or not, neither by SYS_write nor msync() :-(
+    return (int)(page - p);
 
   }
 
diff --git a/qemu_mode/qemuafl b/qemu_mode/qemuafl
index 0fb212da..d1ca56b8 160000
--- a/qemu_mode/qemuafl
+++ b/qemu_mode/qemuafl
@@ -1 +1 @@
-Subproject commit 0fb212daab492411b3e323bc18a3074c1aecfd37
+Subproject commit d1ca56b84e78f821406eef28d836918edfc8d610
-- 
cgit 1.4.1


From 175a275a3db2c9a9f6c9307c56feb58f4cfe365f Mon Sep 17 00:00:00 2001
From: Andrea Fioraldi <andreafioraldi@gmail.com>
Date: Tue, 16 Mar 2021 17:04:52 +0100
Subject: changelog

---
 docs/Changelog.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 9aea3638..17d68b0a 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -10,7 +10,9 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 ### Version ++3.12a (dev)
   - fix cmplog rtn (rare crash and not being able to gather ptr data)
-
+  - qemu_mode (thanks @realmadsci):
+    - move AFL_PRELOAD and AFL_USE_QASAN logic inside afl-qemu-trace
+    - add AFL_QEMU_CUSTOM_BIN
 
 ### Version ++3.11c (release)
   - afl-fuzz:
-- 
cgit 1.4.1


From 7c2436c7114e21f029b06346421a73910deac578 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 16 Mar 2021 19:34:34 +0100
Subject: no runtime for shared linking

---
 docs/Changelog.md |  4 +++-
 src/afl-cc.c      | 59 +++++++++++++++++++++++++++++--------------------------
 2 files changed, 34 insertions(+), 29 deletions(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 17d68b0a..bf04c58e 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -9,7 +9,9 @@ Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 ### Version ++3.12a (dev)
-  - fix cmplog rtn (rare crash and not being able to gather ptr data)
+  - afl-cc:
+    - fix cmplog rtn (rare crash and not being able to gather ptr data)
+    - link runtime not to shared libs
   - qemu_mode (thanks @realmadsci):
     - move AFL_PRELOAD and AFL_USE_QASAN logic inside afl-qemu-trace
     - add AFL_QEMU_CUSTOM_BIN
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 44654de0..18401d0d 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -959,56 +959,59 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   if (compiler_mode != GCC && compiler_mode != CLANG) {
 
-    switch (bit_mode) {
+    if (!shared_linking) {
 
-      case 0:
-        cc_params[cc_par_cnt++] =
-            alloc_printf("%s/afl-compiler-rt.o", obj_path);
-        if (lto_mode)
-          cc_params[cc_par_cnt++] =
-              alloc_printf("%s/afl-llvm-rt-lto.o", obj_path);
-        break;
+      switch (bit_mode) {
 
-      case 32:
-        cc_params[cc_par_cnt++] =
-            alloc_printf("%s/afl-compiler-rt-32.o", obj_path);
-        if (access(cc_params[cc_par_cnt - 1], R_OK))
-          FATAL("-m32 is not supported by your compiler");
-        if (lto_mode) {
+        case 0:
+          cc_params[cc_par_cnt++] =
+              alloc_printf("%s/afl-compiler-rt.o", obj_path);
+          if (lto_mode)
+            cc_params[cc_par_cnt++] =
+                alloc_printf("%s/afl-llvm-rt-lto.o", obj_path);
+          break;
 
+        case 32:
           cc_params[cc_par_cnt++] =
-              alloc_printf("%s/afl-llvm-rt-lto-32.o", obj_path);
+              alloc_printf("%s/afl-compiler-rt-32.o", obj_path);
           if (access(cc_params[cc_par_cnt - 1], R_OK))
             FATAL("-m32 is not supported by your compiler");
+          if (lto_mode) {
 
-        }
+            cc_params[cc_par_cnt++] =
+                alloc_printf("%s/afl-llvm-rt-lto-32.o", obj_path);
+            if (access(cc_params[cc_par_cnt - 1], R_OK))
+              FATAL("-m32 is not supported by your compiler");
 
-        break;
+          }
 
-      case 64:
-        cc_params[cc_par_cnt++] =
-            alloc_printf("%s/afl-compiler-rt-64.o", obj_path);
-        if (access(cc_params[cc_par_cnt - 1], R_OK))
-          FATAL("-m64 is not supported by your compiler");
-        if (lto_mode) {
+          break;
 
+        case 64:
           cc_params[cc_par_cnt++] =
-              alloc_printf("%s/afl-llvm-rt-lto-64.o", obj_path);
+              alloc_printf("%s/afl-compiler-rt-64.o", obj_path);
           if (access(cc_params[cc_par_cnt - 1], R_OK))
             FATAL("-m64 is not supported by your compiler");
+          if (lto_mode) {
 
-        }
+            cc_params[cc_par_cnt++] =
+                alloc_printf("%s/afl-llvm-rt-lto-64.o", obj_path);
+            if (access(cc_params[cc_par_cnt - 1], R_OK))
+              FATAL("-m64 is not supported by your compiler");
 
-        break;
+          }
 
-    }
+          break;
+
+      }
 
   #if !defined(__APPLE__) && !defined(__sun)
-    if (!shared_linking)
       cc_params[cc_par_cnt++] =
           alloc_printf("-Wl,--dynamic-list=%s/dynamic_list.txt", obj_path);
   #endif
 
+    }
+
   #if defined(USEMMAP) && !defined(__HAIKU__)
     cc_params[cc_par_cnt++] = "-lrt";
   #endif
-- 
cgit 1.4.1


From 94312796f936ba1830b61432a0f958e192dd212f Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 17 Mar 2021 13:16:02 +0100
Subject: better map variability

---
 docs/Changelog.md |  1 +
 src/afl-fuzz.c    | 10 ++++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index bf04c58e..8dc218af 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -12,6 +12,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
   - afl-cc:
     - fix cmplog rtn (rare crash and not being able to gather ptr data)
     - link runtime not to shared libs
+    - ensure shared libraries are properly built and instrumented
   - qemu_mode (thanks @realmadsci):
     - move AFL_PRELOAD and AFL_USE_QASAN logic inside afl-qemu-trace
     - add AFL_QEMU_CUSTOM_BIN
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 8318a92e..ff4c5281 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1584,12 +1584,14 @@ int main(int argc, char **argv_orig, char **envp) {
     afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
     afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
 
-    if (map_size <= DEFAULT_SHMEM_SIZE && !afl->non_instrumented_mode &&
-        !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
+    if ((map_size <= DEFAULT_SHMEM_SIZE ||
+         afl->cmplog_fsrv.map_size < map_size) &&
+        !afl->non_instrumented_mode && !afl->fsrv.qemu_mode &&
+        !afl->unicorn_mode) {
 
-      afl->fsrv.map_size = DEFAULT_SHMEM_SIZE;  // dummy temporary value
+      afl->cmplog_fsrv.map_size = MAX(map_size, (u32)DEFAULT_SHMEM_SIZE);
       char vbuf[16];
-      snprintf(vbuf, sizeof(vbuf), "%u", DEFAULT_SHMEM_SIZE);
+      snprintf(vbuf, sizeof(vbuf), "%u", afl->cmplog_fsrv.map_size);
       setenv("AFL_MAP_SIZE", vbuf, 1);
 
     }
-- 
cgit 1.4.1


From 2102264acf5c271b7560a82771b3af8136af9354 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Fri, 19 Mar 2021 16:06:06 +0100
Subject: fix for new llvm 13 change

---
 docs/Changelog.md                              |  4 +++
 instrumentation/README.lto.md                  |  2 +-
 instrumentation/SanitizerCoverageLTO.so.cc     |  7 ++++
 instrumentation/SanitizerCoveragePCGUARD.so.cc |  8 +++++
 instrumentation/afl-compiler-rt.o.c            |  1 +
 instrumentation/afl-llvm-common.cc             | 18 +++-------
 test-instr.c                                   |  2 +-
 test/test-dlopen.c                             | 16 +++++----
 test/travis/bionic/Dockerfile                  | 45 -----------------------
 test/travis/focal/Dockerfile                   | 45 -----------------------
 test/travis/trusty/Dockerfile                  | 49 --------------------------
 test/travis/xenial/Dockerfile                  | 46 ------------------------
 12 files changed, 36 insertions(+), 207 deletions(-)
 delete mode 100644 test/travis/bionic/Dockerfile
 delete mode 100644 test/travis/focal/Dockerfile
 delete mode 100644 test/travis/trusty/Dockerfile
 delete mode 100644 test/travis/xenial/Dockerfile

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 8dc218af..166393cb 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -9,6 +9,8 @@ Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 ### Version ++3.12a (dev)
+  - afl-fuzz:
+    - better map detection, AFL_MAP_SIZE not needed anymore for most cases
   - afl-cc:
     - fix cmplog rtn (rare crash and not being able to gather ptr data)
     - link runtime not to shared libs
@@ -16,6 +18,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
   - qemu_mode (thanks @realmadsci):
     - move AFL_PRELOAD and AFL_USE_QASAN logic inside afl-qemu-trace
     - add AFL_QEMU_CUSTOM_BIN
+  - unicorn_mode
+    - accidently removed the subfolder from github, re-added
 
 ### Version ++3.11c (release)
   - afl-fuzz:
diff --git a/instrumentation/README.lto.md b/instrumentation/README.lto.md
index 81c82c4b..39f6465a 100644
--- a/instrumentation/README.lto.md
+++ b/instrumentation/README.lto.md
@@ -113,7 +113,7 @@ cmake \
     -DLLVM_LINK_LLVM_DYLIB="ON" \
     -DLLVM_TARGETS_TO_BUILD="host" \
     ../llvm/
-cmake --build . --parallel
+cmake --build . -j4
 export PATH="$(pwd)/bin:$PATH"
 export LLVM_CONFIG="$(pwd)/bin/llvm-config"
 export LD_LIBRARY_PATH="$(llvm-config --libdir)${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
diff --git a/instrumentation/SanitizerCoverageLTO.so.cc b/instrumentation/SanitizerCoverageLTO.so.cc
index 13a5e5fd..28d905a3 100644
--- a/instrumentation/SanitizerCoverageLTO.so.cc
+++ b/instrumentation/SanitizerCoverageLTO.so.cc
@@ -1291,10 +1291,17 @@ GlobalVariable *ModuleSanitizerCoverage::CreateFunctionLocalArrayInSection(
       *CurModule, ArrayTy, false, GlobalVariable::PrivateLinkage,
       Constant::getNullValue(ArrayTy), "__sancov_gen_");
 
+#if LLVM_VERSION_MAJOR > 12
+  if (TargetTriple.supportsCOMDAT() &&
+      (TargetTriple.isOSBinFormatELF() || !F.isInterposable()))
+    if (auto Comdat = getOrCreateFunctionComdat(F, TargetTriple))
+      Array->setComdat(Comdat);
+#else
   if (TargetTriple.supportsCOMDAT() && !F.isInterposable())
     if (auto Comdat =
             GetOrCreateFunctionComdat(F, TargetTriple, CurModuleUniqueId))
       Array->setComdat(Comdat);
+#endif
   Array->setSection(getSectionName(Section));
   Array->setAlignment(Align(DL->getTypeStoreSize(Ty).getFixedSize()));
   GlobalsToAppendToUsed.push_back(Array);
diff --git a/instrumentation/SanitizerCoveragePCGUARD.so.cc b/instrumentation/SanitizerCoveragePCGUARD.so.cc
index 0b6e274a..99ead3d6 100644
--- a/instrumentation/SanitizerCoveragePCGUARD.so.cc
+++ b/instrumentation/SanitizerCoveragePCGUARD.so.cc
@@ -769,10 +769,18 @@ GlobalVariable *ModuleSanitizerCoverage::CreateFunctionLocalArrayInSection(
       *CurModule, ArrayTy, false, GlobalVariable::PrivateLinkage,
       Constant::getNullValue(ArrayTy), "__sancov_gen_");
 
+#if LLVM_VERSION_MAJOR > 12
+  if (TargetTriple.supportsCOMDAT() &&
+      (TargetTriple.isOSBinFormatELF() || !F.isInterposable()))
+    if (auto Comdat = getOrCreateFunctionComdat(F, TargetTriple))
+      Array->setComdat(Comdat);
+#else
   if (TargetTriple.supportsCOMDAT() && !F.isInterposable())
     if (auto Comdat =
             GetOrCreateFunctionComdat(F, TargetTriple, CurModuleUniqueId))
       Array->setComdat(Comdat);
+#endif
+
   Array->setSection(getSectionName(Section));
 #if LLVM_MAJOR > 10 || (LLVM_MAJOR == 10 && LLVM_MINOR > 0)
   Array->setAlignment(Align(DL->getTypeStoreSize(Ty).getFixedSize()));
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index bee03ddc..ab1bfb31 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1681,6 +1681,7 @@ void __sanitizer_cov_trace_const_cmp16(uint128_t arg1, uint128_t arg2) {
   __cmplog_ins_hook16(arg1, arg2, 0);
 
 }
+
 #endif
 
 void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
diff --git a/instrumentation/afl-llvm-common.cc b/instrumentation/afl-llvm-common.cc
index 17780143..74943fb2 100644
--- a/instrumentation/afl-llvm-common.cc
+++ b/instrumentation/afl-llvm-common.cc
@@ -96,19 +96,11 @@ bool isIgnoreFunction(const llvm::Function *F) {
 
   static const char *ignoreSubstringList[] = {
 
-      "__asan",
-      "__msan",
-      "__ubsan",
-      "__lsan",
-      "__san",
-      "__sanitize",
-      "__cxx",
-      "_GLOBAL__",
-      "DebugCounter",
-      "DwarfDebug",
-      "DebugLoc"
-
- };
+      "__asan",       "__msan",     "__ubsan", "__lsan",
+      "__san",        "__sanitize", "__cxx",   "_GLOBAL__",
+      "DebugCounter", "DwarfDebug", "DebugLoc"
+
+  };
 
   for (auto const &ignoreListFunc : ignoreSubstringList) {
 
diff --git a/test-instr.c b/test-instr.c
index 4129a5b4..13d4eb93 100644
--- a/test-instr.c
+++ b/test-instr.c
@@ -19,7 +19,7 @@
 #include <fcntl.h>
 
 #ifdef TEST_SHARED_OBJECT
-#define main main_exported
+  #define main main_exported
 #endif
 
 int main(int argc, char **argv) {
diff --git a/test/test-dlopen.c b/test/test-dlopen.c
index 3db6adba..d08d9092 100644
--- a/test/test-dlopen.c
+++ b/test/test-dlopen.c
@@ -5,17 +5,19 @@
 
 int main(int argc, char **argv) {
 
-  if (!getenv("TEST_DLOPEN_TARGET"))
-    return 1;
-  void* lib = dlopen(getenv("TEST_DLOPEN_TARGET"), RTLD_LAZY);
+  if (!getenv("TEST_DLOPEN_TARGET")) return 1;
+  void *lib = dlopen(getenv("TEST_DLOPEN_TARGET"), RTLD_LAZY);
   if (!lib) {
+
     perror(dlerror());
     return 2;
+
   }
-  int (*func)(int, char**) = dlsym(lib, "main_exported");
-  if (!func)
-    return 3;
-  
+
+  int (*func)(int, char **) = dlsym(lib, "main_exported");
+  if (!func) return 3;
+
   return func(argc, argv);
 
 }
+
diff --git a/test/travis/bionic/Dockerfile b/test/travis/bionic/Dockerfile
deleted file mode 100644
index 00ab96f9..00000000
--- a/test/travis/bionic/Dockerfile
+++ /dev/null
@@ -1,45 +0,0 @@
-# This is the Dockerfile for testing problems in Travis build
-# configuration #1.
-# This needs not to be rebuild everytime, most of the time it needs just to
-# be build once and then started when debugging issues and execute:
-#   cd /AFLplusplus/
-#   git pull
-#   make distrib
-#
-FROM ubuntu:bionic
-LABEL "about"="travis image 1"
-RUN apt-get update && apt-get -y install \
-    automake \
-    bison \
-    build-essential \
-    clang \
-    flex \
-    git \
-    python3.7 python3.7-dev \
-    python3-setuptools \
-    libtool libtool-bin \
-    libglib2.0-dev \
-    python-setuptools \
-    wget \
-    ca-certificates \
-    libpixman-1-dev \
-    gcc-7 gcc-7-plugin-dev libc++-7-dev \
-    findutils \
-    libcmocka-dev \
-    joe nano vim locate \
-    && rm -rf /var/lib/apt/lists/*
-
-ENV AFL_NO_UI=1
-ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
-ENV LLVM_CONFIG=llvm-config-6.0
-
-RUN cd / && \
-    git clone https://github.com/AFLplusplus/AFLplusplus && \
-    cd AFLplusplus && \
-    git checkout dev && \
-    cd qemu_mode && wget http://download.qemu-project.org/qemu-3.1.1.tar.xz && \
-    cd ../unicorn_mode && git submodule init && git submodule update || true && \
-    cd /AFLplusplus && ASAN_BUILD=1 make source-only || true
-
-WORKDIR /AFLplusplus
-CMD ["/bin/bash"]
diff --git a/test/travis/focal/Dockerfile b/test/travis/focal/Dockerfile
deleted file mode 100644
index 27d994f2..00000000
--- a/test/travis/focal/Dockerfile
+++ /dev/null
@@ -1,45 +0,0 @@
-# This is the Dockerfile for testing problems in Travis build
-# configuration #1.
-# This needs not to be rebuild everytime, most of the time it needs just to
-# be build once and then started when debugging issues and execute:
-#   cd /AFLplusplus/
-#   git pull
-#   make distrib
-#
-FROM ubuntu:focal
-LABEL "about"="travis image 4"
-ARG DEBIAN_FRONTEND=noninteractive
-RUN apt-get update && apt-get -y install \
-    automake \
-    bison \
-    build-essential \
-    clang \
-    flex \
-    git \
-    python3 python3-dev \
-    python3-setuptools \
-    libtool libtool-bin \
-    libglib2.0-dev \
-    python-setuptools \
-    wget \
-    ca-certificates \
-    libpixman-1-dev \
-    gcc-9 gcc-9-plugin-dev libc++-9-dev \
-    findutils \
-    libcmocka-dev \
-    joe nano vim locate \
-    && rm -rf /var/lib/apt/lists/*
-
-ENV AFL_NO_UI=1
-ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
-
-RUN cd / && \
-    git clone https://github.com/AFLplusplus/AFLplusplus && \
-    cd AFLplusplus && \
-    git checkout dev && \
-    cd qemu_mode && wget http://download.qemu-project.org/qemu-3.1.1.tar.xz && \
-    cd ../unicorn_mode && git submodule init && git submodule update || true && \
-    cd /AFLplusplus && ASAN_BUILD=1 make source-only || true
-
-WORKDIR /AFLplusplus
-CMD ["/bin/bash"]
diff --git a/test/travis/trusty/Dockerfile b/test/travis/trusty/Dockerfile
deleted file mode 100644
index 0a6f1804..00000000
--- a/test/travis/trusty/Dockerfile
+++ /dev/null
@@ -1,49 +0,0 @@
-# This is the Dockerfile for testing problems in Travis builds
-# configuration #3.
-# This needs not to be rebuild everytime, most of the time it needs just to
-# be build once and then started when debugging issues and execute:
-#   cd /AFLplusplus/
-#   git pull
-#   make distrib
-#
-FROM ubuntu:trusty
-LABEL "about"="travis image 3"
-RUN apt-get update && apt-get -y install \
-    automake \
-    bison \
-    build-essential \
-    clang \
-    flex \
-    git \
-    python2.7 python2.7-dev \
-    python3-setuptools \
-    libtool \
-    libglib2.0-dev \
-    python-setuptools \
-    wget \
-    ca-certificates \
-    libpixman-1-dev \
-    gcc-4.8 gcc-4.8-plugin-dev \
-    libc++-dev \
-    findutils \
-    libcmocka-dev \
-    joe nano vim locate \
-    && rm -rf /var/lib/apt/lists/*
-
-ENV TERM linux
-ENV DEBIAN_FRONTEND noninteractive
-ENV LLVM_CONFIG=llvm-config-3.4
-ENV AFL_NO_UI=1
-ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
-
-RUN cd / && \
-    git clone https://github.com/AFLplusplus/AFLplusplus && \
-    cd AFLplusplus && \
-    git checkout dev && \
-    cd qemu_mode && wget http://download.qemu-project.org/qemu-3.1.1.tar.xz && \
-    cd ../unicorn_mode && git submodule init && git submodule update || true && \
-    cd /AFLplusplus && ASAN_BUILD=1 make source-only || true
-
-WORKDIR /AFLplusplus
-CMD ["/bin/bash"]
-
diff --git a/test/travis/xenial/Dockerfile b/test/travis/xenial/Dockerfile
deleted file mode 100644
index 6aa4b1d1..00000000
--- a/test/travis/xenial/Dockerfile
+++ /dev/null
@@ -1,46 +0,0 @@
-# This is the Dockerfile for testing problems in Travis builds
-# configuration #2.
-# This needs not to be rebuild everytime, most of the time it needs just to
-# be build once and then started when debugging issues and execute:
-#   cd /AFLplusplus/
-#   git pull
-#   make distrib
-#
-FROM ubuntu:xenial
-LABEL "about"="travis image 2"
-RUN apt-get update && apt-get -y install \
-    automake \
-    bison \
-    build-essential \
-    clang-6.0 \
-    flex \
-    git \
-    python3 python3-dev \
-    python3-setuptools \
-    libtool libtool-bin \
-    libglib2.0-dev \
-    python-setuptools \
-    wget \
-    ca-certificates \
-    libpixman-1-dev \
-    gcc-5 gcc-5-plugin-dev \
-    libc++-dev \
-    findutils \
-    libcmocka-dev \
-    joe nano vim locate \
-    && rm -rf /var/lib/apt/lists/*
-
-ENV LLVM_CONFIG=llvm-config-6.0
-ENV AFL_NO_UI=1
-ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
-
-RUN cd / && \
-    git clone https://github.com/AFLplusplus/AFLplusplus && \
-    cd AFLplusplus && \
-    git checkout dev && \
-    cd qemu_mode && wget http://download.qemu-project.org/qemu-3.1.1.tar.xz && \
-    cd ../unicorn_mode && git submodule init && git submodule update || true && \
-    cd /AFLplusplus && ASAN_BUILD=1 make source-only || true
-
-WORKDIR /AFLplusplus
-CMD ["/bin/bash"]
-- 
cgit 1.4.1


From d7e121e2c99c02d4b6984f21ba837d44bce9c77c Mon Sep 17 00:00:00 2001
From: fuzzah <fuzzah@tuta.io>
Date: Wed, 17 Mar 2021 01:51:40 +0300
Subject: add AFL_TARGET_ENV to afl-fuzz

---
 README.md             |  1 +
 docs/Changelog.md     |  3 ++
 docs/env_variables.md |  6 ++++
 include/common.h      |  4 +++
 include/envs.h        |  1 +
 src/afl-common.c      | 96 +++++++++++++++++++++++++++++++++++++++++++++++++++
 src/afl-fuzz.c        |  8 +++++
 7 files changed, 119 insertions(+)

(limited to 'docs')

diff --git a/README.md b/README.md
index 69e5bb74..700fe818 100644
--- a/README.md
+++ b/README.md
@@ -1178,6 +1178,7 @@ without feedback, bug reports, or patches from:
   Josephine Calliotte                   Konrad Welc
   Thomas Rooijakkers                    David Carlier
   Ruben ten Hove                        Joey Jiao
+  fuzzah
 ```
 
 Thank you!
diff --git a/docs/Changelog.md b/docs/Changelog.md
index bf04c58e..fdb1cf5c 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -9,6 +9,9 @@ Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 ### Version ++3.12a (dev)
+  - afl-fuzz:
+    - added AFL_TARGET_ENV variable to pass extra env vars to the target
+      (for things like LD_LIBRARY_PATH)
   - afl-cc:
     - fix cmplog rtn (rare crash and not being able to gather ptr data)
     - link runtime not to shared libs
diff --git a/docs/env_variables.md b/docs/env_variables.md
index c6ad0aa4..96fd520f 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -408,6 +408,12 @@ checks or alter some of the more exotic semantics of the tool:
     without disrupting the afl-fuzz process itself. This is useful, among other
     things, for bootstrapping libdislocator.so.
 
+  - Setting `AFL_TARGET_ENV` causes AFL++ to set extra environment variables
+    for the target binary. Example: `AFL_TARGET_ENV="VAR1=1 VAR2='a b c'" afl-fuzz ... `
+    This exists mostly for things like `LD_LIBRARY_PATH` but it would theoretically
+    allow fuzzing of AFL++ itself (with 'target' AFL++ using some AFL_ vars that
+    would disrupt work of 'fuzzer' AFL++).
+
   - Setting `AFL_NO_UI` inhibits the UI altogether, and just periodically prints
     some basic stats. This behavior is also automatically triggered when the
     output from afl-fuzz is redirected to a file or to a pipe.
diff --git a/include/common.h b/include/common.h
index b7adbaec..06453b8e 100644
--- a/include/common.h
+++ b/include/common.h
@@ -49,6 +49,10 @@ char **get_qemu_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv);
 char **get_wine_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv);
 char * get_afl_env(char *env);
 
+/* Extract env vars from input string and set them using setenv()
+   For use with AFL_TARGET_ENV, ... */
+u8 extract_and_set_env(u8 *env_str);
+
 extern u8  be_quiet;
 extern u8 *doc_path;                    /* path to documentation dir        */
 
diff --git a/include/envs.h b/include/envs.h
index cfd73b68..fda4ab55 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -130,6 +130,7 @@ static char *afl_environment_variables[] = {
     "AFL_PATH",
     "AFL_PERFORMANCE_FILE",
     "AFL_PRELOAD",
+    "AFL_TARGET_ENV",
     "AFL_PYTHON_MODULE",
     "AFL_QEMU_CUSTOM_BIN",
     "AFL_QEMU_COMPCOV",
diff --git a/src/afl-common.c b/src/afl-common.c
index 27b63434..72a95fbc 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -706,6 +706,102 @@ char *get_afl_env(char *env) {
 
 }
 
+u8 extract_and_set_env(u8 *env_str) {
+
+  if (!env_str) { return 0; }
+
+  u8 *p = ck_strdup(env_str);
+
+  u8 *end = p + strlen((char *)p);
+
+  u8 ret_val = 0;  // return false by default
+
+  u8 *rest = p;
+  u8 *key = p;
+  u8 *val = p;
+
+  u8 closing_sym = ' ';
+  u8 c;
+
+  size_t num_pairs = 0;
+
+  while (rest < end) {
+
+    while (*rest == ' ') {
+
+      rest++;
+
+    }
+
+    if (rest + 1 >= end) break;
+
+    key = rest;
+    // env variable names may not start with numbers or '='
+    if (*key == '=' || (*key >= '0' && *key <= '9')) { goto free_and_return; }
+
+    while (rest < end && *rest != '=' && *rest != ' ') {
+
+      c = *rest;
+      // lowercase is bad but we may still allow it
+      if ((c < 'A' || c > 'Z') && (c < 'a' || c > 'z') &&
+          (c < '0' || c > '9') && c != '_') {
+
+        goto free_and_return;
+
+      }
+
+      rest++;
+
+    }
+
+    if (*rest != '=') { goto free_and_return; }
+
+    *rest = '\0';  // done with variable name
+
+    rest += 1;
+    if (rest >= end || *rest == ' ') { goto free_and_return; }
+
+    val = rest;
+    if (*val == '\'' || *val == '"') {
+
+      closing_sym = *val;
+      val += 1;
+      rest += 1;
+      if (rest >= end) { goto free_and_return; }
+
+    } else {
+
+      closing_sym = ' ';
+
+    }
+
+    while (rest < end && *rest != closing_sym) {
+
+      rest++;
+
+    }
+
+    if (closing_sym != ' ' && *rest != closing_sym) { goto free_and_return; }
+
+    *rest = '\0';  // done with variable value
+
+    rest += 1;
+    if (rest < end && *rest != ' ') { goto free_and_return; }
+
+    num_pairs += 1;
+
+    setenv(key, val, 1);
+
+  }
+
+  if (num_pairs > 0) { ret_val = 1; }
+
+free_and_return:
+  ck_free(p);
+  return ret_val;
+
+}
+
 /* Read mask bitmap from file. This is for the -B option. */
 
 void read_bitmap(u8 *fname, u8 *map, size_t len) {
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index cfb507a7..9ea1fb34 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -223,6 +223,7 @@ static void usage(u8 *argv0, int more_help) {
       "AFL_PYTHON_MODULE: mutate and trim inputs with the specified Python module\n"
       "AFL_QUIET: suppress forkserver status messages\n"
       "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
+      "AFL_TARGET_ENV: pass extra environment variables to target\n"
       "AFL_SHUFFLE_QUEUE: reorder the input queue randomly on startup\n"
       "AFL_SKIP_BIN_CHECK: skip the check, if the target is an executable\n"
       "AFL_SKIP_CPUFREQ: do not warn about variable cpu clocking\n"
@@ -1303,6 +1304,13 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
+  u8 *extra_env = (u8 *)getenv("AFL_TARGET_ENV");
+  if (extra_env && !extract_and_set_env(extra_env)) {
+
+    FATAL("Bad value of AFL_TARGET_ENV");
+
+  }
+
   save_cmdline(afl, argc, argv);
 
   fix_up_banner(afl, argv[optind]);
-- 
cgit 1.4.1


From 72a70423c2667f7ec9cd6b1ce1645fb9a20e81f1 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 22 Mar 2021 09:24:36 +0100
Subject: show afl-cc NATIVE when auto used

---
 docs/Changelog.md |  4 +++-
 src/afl-cc.c      | 12 ++++++++++--
 2 files changed, 13 insertions(+), 3 deletions(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index ab0312f8..643a959c 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -12,11 +12,13 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
   - afl-fuzz:
     - added AFL_TARGET_ENV variable to pass extra env vars to the target
       (for things like LD_LIBRARY_PATH)
-    - better map detection, AFL_MAP_SIZE not needed anymore for most cases
+    - fix map detection, AFL_MAP_SIZE not needed anymore for most cases
   - afl-cc:
     - fix cmplog rtn (rare crash and not being able to gather ptr data)
     - link runtime not to shared libs
     - ensure shared libraries are properly built and instrumented
+    - show correct LLVM PCGUARD NATIVE mode when auto switching to it
+      and keep fsanitize-coverage-*list=...
   - qemu_mode (thanks @realmadsci):
     - move AFL_PRELOAD and AFL_USE_QASAN logic inside afl-qemu-trace
     - add AFL_QEMU_CUSTOM_BIN
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 1fe68df5..80fc0742 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -590,6 +590,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 #if LLVM_MAJOR > 10 || (LLVM_MAJOR == 10 && LLVM_MINOR > 0)
   #ifdef __ANDROID__
         cc_params[cc_par_cnt++] = "-fsanitize-coverage=trace-pc-guard";
+        instrument_mode != INSTRUMENT_LLVMNATIVE;
   #else
         if (have_instr_list) {
 
@@ -599,6 +600,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
                 "-fsanitize-coverage-allow/denylist, you can use "
                 "AFL_LLVM_ALLOWLIST/AFL_LLMV_DENYLIST instead.\n");
           cc_params[cc_par_cnt++] = "-fsanitize-coverage=trace-pc-guard";
+          instrument_mode = INSTRUMENT_LLVMNATIVE;
 
         } else {
 
@@ -618,6 +620,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
               "Using unoptimized trace-pc-guard, upgrade to llvm 10.0.1+ for "
               "enhanced version.\n");
         cc_params[cc_par_cnt++] = "-fsanitize-coverage=trace-pc-guard";
+        instrument_mode = INSTRUMENT_LLVMNATIVE;
   #else
         FATAL("pcguard instrumentation requires llvm 4.0.1+");
   #endif
@@ -718,8 +721,13 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
     }
 
-    if (!strncmp(cur, "-fsanitize=fuzzer-", strlen("-fsanitize=fuzzer-")) ||
-        !strncmp(cur, "-fsanitize-coverage", strlen("-fsanitize-coverage"))) {
+    if ((!strncmp(cur, "-fsanitize=fuzzer-", strlen("-fsanitize=fuzzer-")) ||
+         !strncmp(cur, "-fsanitize-coverage", strlen("-fsanitize-coverage"))) &&
+        (strncmp(cur, "sanitize-coverage-allow",
+                 strlen("sanitize-coverage-allow")) &&
+         strncmp(cur, "sanitize-coverage-deny",
+                 strlen("sanitize-coverage-deny")) &&
+         instrument_mode != INSTRUMENT_LLVMNATIVE)) {
 
       if (!be_quiet) { WARNF("Found '%s' - stripping!", cur); }
       continue;
-- 
cgit 1.4.1


From 8868648f7623928c77e75e3e8d56770a52966332 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 22 Mar 2021 10:45:39 +0100
Subject: fix LTO selective instrumentation

---
 docs/Changelog.md                          | 2 ++
 instrumentation/SanitizerCoverageLTO.so.cc | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 643a959c..a65702d8 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -17,8 +17,10 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - fix cmplog rtn (rare crash and not being able to gather ptr data)
     - link runtime not to shared libs
     - ensure shared libraries are properly built and instrumented
+    - AFL_LLVM_INSTRUMENT_ALLOW/DENY were not implemented for LTO, added
     - show correct LLVM PCGUARD NATIVE mode when auto switching to it
       and keep fsanitize-coverage-*list=...
+      Short mnemnonic NATIVE is now also accepted.
   - qemu_mode (thanks @realmadsci):
     - move AFL_PRELOAD and AFL_USE_QASAN logic inside afl-qemu-trace
     - add AFL_QEMU_CUSTOM_BIN
diff --git a/instrumentation/SanitizerCoverageLTO.so.cc b/instrumentation/SanitizerCoverageLTO.so.cc
index 28d905a3..6dd390e6 100644
--- a/instrumentation/SanitizerCoverageLTO.so.cc
+++ b/instrumentation/SanitizerCoverageLTO.so.cc
@@ -507,6 +507,7 @@ bool ModuleSanitizerCoverage::instrumentModule(
   Zero = ConstantInt::get(Int8Tyi, 0);
   One = ConstantInt::get(Int8Tyi, 1);
 
+  initInstrumentList();
   scanForDangerousFunctions(&M);
   Mo = &M;
 
@@ -1229,7 +1230,7 @@ void ModuleSanitizerCoverage::instrumentFunction(
 
   // afl++ START
   if (!F.size()) return;
-  if (isIgnoreFunction(&F)) return;
+  if (!isInInstrumentList(&F)) return;
   // afl++ END
 
   if (Options.CoverageType >= SanitizerCoverageOptions::SCK_Edge)
-- 
cgit 1.4.1


From 0f9dceff3df8fc537bcbfe3a24dc30f9f0fa67a2 Mon Sep 17 00:00:00 2001
From: Joshua Pereyda <joshua.t.pereyda@gmail.com>
Date: Mon, 22 Mar 2021 12:06:52 -0700
Subject: add details to AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES doc

---
 docs/env_variables.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'docs')

diff --git a/docs/env_variables.md b/docs/env_variables.md
index 96fd520f..7eb973e5 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -425,7 +425,8 @@ checks or alter some of the more exotic semantics of the tool:
     no valid terminal was detected (for virtual consoles)
 
   - If you are Jakub, you may need `AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES`.
-    Others need not apply.
+    Others need not apply, unless they also want to disable the
+    /proc/sys/kernel/core_pattern check.
 
   - Benchmarking only: `AFL_BENCH_JUST_ONE` causes the fuzzer to exit after
     processing the first queue entry; and `AFL_BENCH_UNTIL_CRASH` causes it to
-- 
cgit 1.4.1


From 28f1e94ab9fdac6886c4383d9f4722f26237a05a Mon Sep 17 00:00:00 2001
From: aflpp <aflpp@aflplus.plus>
Date: Tue, 23 Mar 2021 15:33:27 +0100
Subject: fix our PCGUARD for llvm 10.0.1

---
 docs/Changelog.md                              |  1 +
 instrumentation/SanitizerCoveragePCGUARD.so.cc | 80 ++++++++++++--------------
 2 files changed, 39 insertions(+), 42 deletions(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index a65702d8..51c8c1bc 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -15,6 +15,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - fix map detection, AFL_MAP_SIZE not needed anymore for most cases
   - afl-cc:
     - fix cmplog rtn (rare crash and not being able to gather ptr data)
+    - fix our own PCGUARD implementation to compile with llvm 10.0.1
     - link runtime not to shared libs
     - ensure shared libraries are properly built and instrumented
     - AFL_LLVM_INSTRUMENT_ALLOW/DENY were not implemented for LTO, added
diff --git a/instrumentation/SanitizerCoveragePCGUARD.so.cc b/instrumentation/SanitizerCoveragePCGUARD.so.cc
index 99ead3d6..09cda9e2 100644
--- a/instrumentation/SanitizerCoveragePCGUARD.so.cc
+++ b/instrumentation/SanitizerCoveragePCGUARD.so.cc
@@ -135,12 +135,14 @@ class ModuleSanitizerCoverage {
 
  public:
   ModuleSanitizerCoverage(
-      const SanitizerCoverageOptions &Options = SanitizerCoverageOptions(),
-      const SpecialCaseList *         Allowlist = nullptr,
-      const SpecialCaseList *         Blocklist = nullptr)
-      : Options(OverrideFromCL(Options)),
-        Allowlist(Allowlist),
-        Blocklist(Blocklist) {
+      const SanitizerCoverageOptions &Options = SanitizerCoverageOptions()
+#if LLVM_MAJOR > 10
+          ,
+      const SpecialCaseList *Allowlist = nullptr,
+      const SpecialCaseList *Blocklist = nullptr
+#endif
+      )
+      : Options(OverrideFromCL(Options)) {
 
   }
 
@@ -210,9 +212,6 @@ class ModuleSanitizerCoverage {
 
   SanitizerCoverageOptions Options;
 
-  const SpecialCaseList *Allowlist;
-  const SpecialCaseList *Blocklist;
-
   uint32_t        instr = 0;
   GlobalVariable *AFLMapPtr = NULL;
   ConstantInt *   One = NULL;
@@ -224,27 +223,17 @@ class ModuleSanitizerCoverageLegacyPass : public ModulePass {
 
  public:
   ModuleSanitizerCoverageLegacyPass(
-      const SanitizerCoverageOptions &Options = SanitizerCoverageOptions(),
+      const SanitizerCoverageOptions &Options = SanitizerCoverageOptions()
+#if LLVM_VERSION_MAJOR > 10
+          ,
       const std::vector<std::string> &AllowlistFiles =
           std::vector<std::string>(),
       const std::vector<std::string> &BlocklistFiles =
-          std::vector<std::string>())
+          std::vector<std::string>()
+#endif
+          )
       : ModulePass(ID), Options(Options) {
 
-    if (AllowlistFiles.size() > 0)
-      Allowlist = SpecialCaseList::createOrDie(AllowlistFiles
-#if LLVM_MAJOR > 10 || (LLVM_MAJOR == 10 && LLVM_MINOR > 0)
-                                               ,
-                                               *vfs::getRealFileSystem()
-#endif
-      );
-    if (BlocklistFiles.size() > 0)
-      Blocklist = SpecialCaseList::createOrDie(BlocklistFiles
-#if LLVM_MAJOR > 10 || (LLVM_MAJOR == 10 && LLVM_MINOR > 0)
-                                               ,
-                                               *vfs::getRealFileSystem()
-#endif
-      );
     initializeModuleSanitizerCoverageLegacyPassPass(
         *PassRegistry::getPassRegistry());
 
@@ -252,8 +241,12 @@ class ModuleSanitizerCoverageLegacyPass : public ModulePass {
 
   bool runOnModule(Module &M) override {
 
-    ModuleSanitizerCoverage ModuleSancov(Options, Allowlist.get(),
-                                         Blocklist.get());
+    ModuleSanitizerCoverage ModuleSancov(Options
+#if LLVM_MAJOR > 10
+                                         ,
+                                         Allowlist.get(), Blocklist.get()
+#endif
+    );
     auto DTCallback = [this](Function &F) -> const DominatorTree * {
 
       return &this->getAnalysis<DominatorTreeWrapperPass>(F).getDomTree();
@@ -298,8 +291,12 @@ class ModuleSanitizerCoverageLegacyPass : public ModulePass {
 PreservedAnalyses ModuleSanitizerCoveragePass::run(Module &               M,
                                                    ModuleAnalysisManager &MAM) {
 
-  ModuleSanitizerCoverage ModuleSancov(Options, Allowlist.get(),
-                                       Blocklist.get());
+  ModuleSanitizerCoverage ModuleSancov(Options
+#if LLVM_MAJOR > 10
+                                       ,
+                                       Allowlist.get(), Blocklist.get()
+#endif
+  );
   auto &FAM = MAM.getResult<FunctionAnalysisManagerModuleProxy>(M).getManager();
   auto  DTCallback = [&FAM](Function &F) -> const DominatorTree * {
 
@@ -418,12 +415,6 @@ bool ModuleSanitizerCoverage::instrumentModule(
   }
 
   if (Options.CoverageType == SanitizerCoverageOptions::SCK_None) return false;
-  if (Allowlist &&
-      !Allowlist->inSection("coverage", "src", M.getSourceFileName()))
-    return false;
-  if (Blocklist &&
-      Blocklist->inSection("coverage", "src", M.getSourceFileName()))
-    return false;
   C = &(M.getContext());
   DL = &M.getDataLayout();
   CurModule = &M;
@@ -696,9 +687,6 @@ void ModuleSanitizerCoverage::instrumentFunction(
   if (F.hasPersonalityFn() &&
       isAsynchronousEHPersonality(classifyEHPersonality(F.getPersonalityFn())))
     return;
-  if (Allowlist && !Allowlist->inSection("coverage", "fun", F.getName()))
-    return;
-  if (Blocklist && Blocklist->inSection("coverage", "fun", F.getName())) return;
   if (Options.CoverageType >= SanitizerCoverageOptions::SCK_Edge)
     SplitAllCriticalEdges(
         F, CriticalEdgeSplittingOptions().setIgnoreUnreachableDests());
@@ -1216,12 +1204,20 @@ INITIALIZE_PASS_END(ModuleSanitizerCoverageLegacyPass, "sancov",
                     false)
 
 ModulePass *llvm::createModuleSanitizerCoverageLegacyPassPass(
-    const SanitizerCoverageOptions &Options,
+    const SanitizerCoverageOptions &Options
+#if LLVM_MAJOR > 10
+    ,
     const std::vector<std::string> &AllowlistFiles,
-    const std::vector<std::string> &BlocklistFiles) {
+    const std::vector<std::string> &BlocklistFiles
+#endif
+) {
 
-  return new ModuleSanitizerCoverageLegacyPass(Options, AllowlistFiles,
-                                               BlocklistFiles);
+  return new ModuleSanitizerCoverageLegacyPass(Options
+#if LLVM_MAJOR > 10
+                                               ,
+                                               AllowlistFiles, BlocklistFiles
+#endif
+  );
 
 }
 
-- 
cgit 1.4.1


From 5fcd634f05049564dde59df420ac1c2f291a2fb0 Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Tue, 23 Mar 2021 18:47:07 +0100
Subject: fixed tiny nitpicks

---
 docs/env_variables.md |  2 +-
 include/afl-fuzz.h    |  2 +-
 include/common.h      |  2 +-
 src/afl-common.c      | 22 +++++++++-------------
 src/afl-fuzz-state.c  |  7 +++++++
 src/afl-fuzz.c        |  4 ++--
 6 files changed, 21 insertions(+), 18 deletions(-)

(limited to 'docs')

diff --git a/docs/env_variables.md b/docs/env_variables.md
index 7eb973e5..409425f1 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -426,7 +426,7 @@ checks or alter some of the more exotic semantics of the tool:
 
   - If you are Jakub, you may need `AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES`.
     Others need not apply, unless they also want to disable the
-    /proc/sys/kernel/core_pattern check.
+    `/proc/sys/kernel/core_pattern` check.
 
   - Benchmarking only: `AFL_BENCH_JUST_ONE` causes the fuzzer to exit after
     processing the first queue entry; and `AFL_BENCH_UNTIL_CRASH` causes it to
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 5003b563..565e9afd 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -390,7 +390,7 @@ typedef struct afl_env_vars {
       *afl_hang_tmout, *afl_forksrv_init_tmout, *afl_skip_crashes, *afl_preload,
       *afl_max_det_extras, *afl_statsd_host, *afl_statsd_port,
       *afl_crash_exitcode, *afl_statsd_tags_flavor, *afl_testcache_size,
-      *afl_testcache_entries, *afl_kill_signal;
+      *afl_testcache_entries, *afl_kill_signal, *afl_target_env;
 
 } afl_env_vars_t;
 
diff --git a/include/common.h b/include/common.h
index 05137fb6..7bba9e91 100644
--- a/include/common.h
+++ b/include/common.h
@@ -51,7 +51,7 @@ char * get_afl_env(char *env);
 
 /* Extract env vars from input string and set them using setenv()
    For use with AFL_TARGET_ENV, ... */
-u8 extract_and_set_env(u8 *env_str);
+bool extract_and_set_env(u8 *env_str);
 
 extern u8  be_quiet;
 extern u8 *doc_path;                    /* path to documentation dir        */
diff --git a/src/afl-common.c b/src/afl-common.c
index 6e485117..cd24c376 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -618,19 +618,15 @@ char *get_afl_env(char *env) {
 
 }
 
-u8 extract_and_set_env(u8 *env_str) {
+bool extract_and_set_env(u8 *env_str) {
 
-  if (!env_str) { return 0; }
+  if (!env_str) { return false; }
 
-  u8 *p = ck_strdup(env_str);
+  bool ret = false;  // return false by default
 
+  u8 *p = ck_strdup(env_str);
   u8 *end = p + strlen((char *)p);
-
-  u8 ret_val = 0;  // return false by default
-
   u8 *rest = p;
-  u8 *key = p;
-  u8 *val = p;
 
   u8 closing_sym = ' ';
   u8 c;
@@ -647,7 +643,7 @@ u8 extract_and_set_env(u8 *env_str) {
 
     if (rest + 1 >= end) break;
 
-    key = rest;
+    u8 *key = rest;
     // env variable names may not start with numbers or '='
     if (*key == '=' || (*key >= '0' && *key <= '9')) { goto free_and_return; }
 
@@ -673,7 +669,7 @@ u8 extract_and_set_env(u8 *env_str) {
     rest += 1;
     if (rest >= end || *rest == ' ') { goto free_and_return; }
 
-    val = rest;
+    u8 *val = rest;
     if (*val == '\'' || *val == '"') {
 
       closing_sym = *val;
@@ -700,17 +696,17 @@ u8 extract_and_set_env(u8 *env_str) {
     rest += 1;
     if (rest < end && *rest != ' ') { goto free_and_return; }
 
-    num_pairs += 1;
+    num_pairs++;
 
     setenv(key, val, 1);
 
   }
 
-  if (num_pairs > 0) { ret_val = 1; }
+  if (num_pairs) { ret = true; }
 
 free_and_return:
   ck_free(p);
-  return ret_val;
+  return ret;
 
 }
 
diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c
index 3d36e712..0ddf8cf3 100644
--- a/src/afl-fuzz-state.c
+++ b/src/afl-fuzz-state.c
@@ -433,6 +433,13 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
             afl->afl_env.afl_kill_signal =
                 (u8 *)get_afl_env(afl_environment_variables[i]);
 
+          } else if (!strncmp(env, "AFL_TARGET_ENV",
+
+                              afl_environment_variable_len)) {
+
+            afl->afl_env.afl_target_env =
+                (u8 *)get_afl_env(afl_environment_variables[i]);
+
           }
 
         } else {
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index b1d01959..d70ffd31 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1304,8 +1304,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-  u8 *extra_env = (u8 *)getenv("AFL_TARGET_ENV");
-  if (extra_env && !extract_and_set_env(extra_env)) {
+  if (afl->afl_env.afl_target_env &&
+      !extract_and_set_env(afl->afl_env.afl_target_env)) {
 
     FATAL("Bad value of AFL_TARGET_ENV");
 
-- 
cgit 1.4.1


From dfe6f7f8c949744eeab7a401affde93729a5b39d Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 23 Mar 2021 20:20:59 +0100
Subject: make setting different file permissions easy via config.h

---
 docs/Changelog.md                   |  2 ++
 include/config.h                    |  3 +++
 instrumentation/afl-compiler-rt.o.c | 10 +++++-----
 src/afl-analyze.c                   |  2 +-
 src/afl-as.c                        |  2 +-
 src/afl-common.c                    |  4 ++--
 src/afl-forkserver.c                |  4 ++--
 src/afl-fuzz-bitmap.c               |  8 ++++----
 src/afl-fuzz-extras.c               |  2 +-
 src/afl-fuzz-init.c                 | 12 ++++++------
 src/afl-fuzz-mutators.c             |  2 +-
 src/afl-fuzz-queue.c                |  6 +++---
 src/afl-fuzz-run.c                  | 14 +++++++-------
 src/afl-sharedmem.c                 |  8 ++++----
 src/afl-showmap.c                   |  4 ++--
 src/afl-tmin.c                      |  4 ++--
 16 files changed, 46 insertions(+), 41 deletions(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 51c8c1bc..aea95d5d 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -27,6 +27,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - add AFL_QEMU_CUSTOM_BIN
   - unicorn_mode
     - accidently removed the subfolder from github, re-added
+  - added DEFAULT_PERMISSION to config.h for all files created, default
+    to 0600
 
 ### Version ++3.11c (release)
   - afl-fuzz:
diff --git a/include/config.h b/include/config.h
index 29225f6b..3c09fce4 100644
--- a/include/config.h
+++ b/include/config.h
@@ -43,6 +43,9 @@
    Default: 8MB (defined in bytes) */
 #define DEFAULT_SHMEM_SIZE (8 * 1024 * 1024)
 
+/* Default file permission umode when creating files (default: 0600) */
+#define DEFAULT_PERMISSION 0600
+
 /* CMPLOG/REDQUEEN TUNING
  *
  * Here you can modify tuning and solving options for CMPLOG.
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index ab1bfb31..f241447a 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -204,7 +204,7 @@ static void __afl_map_shm_fuzz() {
     int         shm_fd = -1;
 
     /* create the shared memory segment as if it was a file */
-    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    shm_fd = shm_open(shm_file_path, O_RDWR, DEFAULT_PERMISSION);
     if (shm_fd == -1) {
 
       fprintf(stderr, "shm_open() failed for fuzz\n");
@@ -353,7 +353,7 @@ static void __afl_map_shm(void) {
     unsigned char *shm_base = NULL;
 
     /* create the shared memory segment as if it was a file */
-    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    shm_fd = shm_open(shm_file_path, O_RDWR, DEFAULT_PERMISSION);
     if (shm_fd == -1) {
 
       fprintf(stderr, "shm_open() failed\n");
@@ -528,7 +528,7 @@ static void __afl_map_shm(void) {
     struct cmp_map *shm_base = NULL;
 
     /* create the shared memory segment as if it was a file */
-    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    shm_fd = shm_open(shm_file_path, O_RDWR, DEFAULT_PERMISSION);
     if (shm_fd == -1) {
 
       perror("shm_open() failed\n");
@@ -729,7 +729,7 @@ static void __afl_start_snapshots(void) {
       static uint32_t counter = 0;
       char            fn[32];
       sprintf(fn, "%09u:forkserver", counter);
-      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
       if (fd_doc >= 0) {
 
         if (write(fd_doc, __afl_fuzz_ptr, *__afl_fuzz_len) != *__afl_fuzz_len) {
@@ -960,7 +960,7 @@ static void __afl_start_forkserver(void) {
       static uint32_t counter = 0;
       char            fn[32];
       sprintf(fn, "%09u:forkserver", counter);
-      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
       if (fd_doc >= 0) {
 
         if (write(fd_doc, __afl_fuzz_ptr, *__afl_fuzz_len) != *__afl_fuzz_len) {
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index 86b0f7e9..e106cd31 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -212,7 +212,7 @@ static s32 write_to_file(u8 *path, u8 *mem, u32 len) {
 
   unlink(path);                                            /* Ignore errors */
 
-  ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600);
+  ret = open(path, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   if (ret < 0) { PFATAL("Unable to create '%s'", path); }
 
diff --git a/src/afl-as.c b/src/afl-as.c
index 7de267a3..aebd0ac8 100644
--- a/src/afl-as.c
+++ b/src/afl-as.c
@@ -280,7 +280,7 @@ static void add_instrumentation(void) {
 
   }
 
-  outfd = open(modified_file, O_WRONLY | O_EXCL | O_CREAT, 0600);
+  outfd = open(modified_file, O_WRONLY | O_EXCL | O_CREAT, DEFAULT_PERMISSION);
 
   if (outfd < 0) { PFATAL("Unable to write to '%s'", modified_file); }
 
diff --git a/src/afl-common.c b/src/afl-common.c
index cd24c376..37b4788c 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -1104,7 +1104,7 @@ FILE *create_ffile(u8 *fn) {
   s32   fd;
   FILE *f;
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
   if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
 
@@ -1122,7 +1122,7 @@ s32 create_file(u8 *fn) {
 
   s32 fd;
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
   if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
 
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 68995388..b9cb48cb 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -1038,12 +1038,12 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
 
       if (unlikely(fsrv->no_unlink)) {
 
-        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
       } else {
 
         unlink(fsrv->out_file);                           /* Ignore errors. */
-        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
+        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
       }
 
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 4ed59364..3d0228db 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -42,7 +42,7 @@ void write_bitmap(afl_state_t *afl) {
   afl->bitmap_changed = 0;
 
   snprintf(fname, PATH_MAX, "%s/fuzz_bitmap", afl->out_dir);
-  fd = open(fname, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+  fd = open(fname, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
   if (fd < 0) { PFATAL("Unable to open '%s'", fname); }
 
@@ -407,7 +407,7 @@ static void write_crash_readme(afl_state_t *afl) {
 
   sprintf(fn, "%s/crashes/README.txt", afl->out_dir);
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   /* Do not die on errors here - that would be impolite. */
 
@@ -509,7 +509,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
         alloc_printf("%s/queue/id_%06u", afl->out_dir, afl->queued_paths);
 
 #endif                                                    /* ^!SIMPLE_FILES */
-    fd = open(queue_fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    fd = open(queue_fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (unlikely(fd < 0)) { PFATAL("Unable to create '%s'", queue_fn); }
     ck_write(fd, mem, len, queue_fn);
     close(fd);
@@ -783,7 +783,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
   /* If we're here, we apparently want to save the crash or hang
      test case, too. */
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
   if (unlikely(fd < 0)) { PFATAL("Unable to create '%s'", fn); }
   ck_write(fd, mem, len, fn);
   close(fd);
diff --git a/src/afl-fuzz-extras.c b/src/afl-fuzz-extras.c
index 52100fa1..6091db15 100644
--- a/src/afl-fuzz-extras.c
+++ b/src/afl-fuzz-extras.c
@@ -731,7 +731,7 @@ void save_auto(afl_state_t *afl) {
         alloc_printf("%s/queue/.state/auto_extras/auto_%06u", afl->out_dir, i);
     s32 fd;
 
-    fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+    fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
     if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
 
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index b2569dc0..47521a9e 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -152,7 +152,7 @@ void bind_to_free_cpu(afl_state_t *afl) {
 
     do {
 
-      if ((lockfd = open(lockfile, O_RDWR | O_CREAT | O_EXCL, 0600)) < 0) {
+      if ((lockfd = open(lockfile, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION)) < 0) {
 
         if (first) {
 
@@ -1219,7 +1219,7 @@ static void link_or_copy(u8 *old_path, u8 *new_path) {
   sfd = open(old_path, O_RDONLY);
   if (sfd < 0) { PFATAL("Unable to open '%s'", old_path); }
 
-  dfd = open(new_path, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  dfd = open(new_path, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
   if (dfd < 0) { PFATAL("Unable to create '%s'", new_path); }
 
   tmp = ck_alloc(64 * 1024);
@@ -2015,7 +2015,7 @@ void setup_dirs_fds(afl_state_t *afl) {
 
   if (!afl->in_place_resume) {
 
-    int fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    int fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", tmp); }
     ck_free(tmp);
 
@@ -2030,7 +2030,7 @@ void setup_dirs_fds(afl_state_t *afl) {
 
   } else {
 
-    int fd = open(tmp, O_WRONLY | O_CREAT, 0600);
+    int fd = open(tmp, O_WRONLY | O_CREAT, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", tmp); }
     ck_free(tmp);
 
@@ -2057,7 +2057,7 @@ void setup_cmdline_file(afl_state_t *afl, char **argv) {
 
   /* Store the command line to reproduce our findings */
   tmp = alloc_printf("%s/cmdline", afl->out_dir);
-  fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
   if (fd < 0) { PFATAL("Unable to create '%s'", tmp); }
   ck_free(tmp);
 
@@ -2092,7 +2092,7 @@ void setup_stdio_file(afl_state_t *afl) {
 
   unlink(afl->fsrv.out_file);                              /* Ignore errors */
 
-  afl->fsrv.out_fd = open(afl->fsrv.out_file, O_RDWR | O_CREAT | O_EXCL, 0600);
+  afl->fsrv.out_fd = open(afl->fsrv.out_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   if (afl->fsrv.out_fd < 0) {
 
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 80df6d08..a47b4f5f 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -465,7 +465,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
 
     unlink(q->fname);                                      /* ignore errors */
 
-    fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
     if (fd < 0) { PFATAL("Unable to create '%s'", q->fname); }
 
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index b2f88205..63592cef 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -249,7 +249,7 @@ void mark_as_det_done(afl_state_t *afl, struct queue_entry *q) {
   snprintf(fn, PATH_MAX, "%s/queue/.state/deterministic_done/%s", afl->out_dir,
            strrchr(q->fname, '/') + 1);
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
   if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
   close(fd);
 
@@ -272,7 +272,7 @@ void mark_as_variable(afl_state_t *afl, struct queue_entry *q) {
 
   if (symlink(ldest, fn)) {
 
-    s32 fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    s32 fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
     close(fd);
 
@@ -300,7 +300,7 @@ void mark_as_redundant(afl_state_t *afl, struct queue_entry *q, u8 state) {
 
     s32 fd;
 
-    fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
     close(fd);
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 0b84a542..30860eff 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -83,7 +83,7 @@ write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
            afl->document_counter++,
            describe_op(afl, 0, NAME_MAX - strlen("000000000:")));
 
-  if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600)) >= 0) {
+  if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION)) >= 0) {
 
     if (write(doc_fd, mem, len) != len)
       PFATAL("write to mutation file failed: %s", fn);
@@ -247,12 +247,12 @@ static void write_with_gap(afl_state_t *afl, u8 *mem, u32 len, u32 skip_at,
 
     if (unlikely(afl->no_unlink)) {
 
-      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
     } else {
 
       unlink(afl->fsrv.out_file);                         /* Ignore errors. */
-      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
+      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
     }
 
@@ -564,7 +564,7 @@ void sync_fuzzers(afl_state_t *afl) {
     /* document the attempt to sync to this instance */
 
     sprintf(qd_synced_path, "%s/.synced/%s.last", afl->out_dir, sd_ent->d_name);
-    id_fd = open(qd_synced_path, O_RDWR | O_CREAT | O_TRUNC, 0600);
+    id_fd = open(qd_synced_path, O_RDWR | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
     if (id_fd >= 0) close(id_fd);
 
     /* Skip anything that doesn't have a queue/ subdirectory. */
@@ -587,7 +587,7 @@ void sync_fuzzers(afl_state_t *afl) {
 
     sprintf(qd_synced_path, "%s/.synced/%s", afl->out_dir, sd_ent->d_name);
 
-    id_fd = open(qd_synced_path, O_RDWR | O_CREAT, 0600);
+    id_fd = open(qd_synced_path, O_RDWR | O_CREAT, DEFAULT_PERMISSION);
 
     if (id_fd < 0) { PFATAL("Unable to create '%s'", qd_synced_path); }
 
@@ -851,7 +851,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
 
     if (unlikely(afl->no_unlink)) {
 
-      fd = open(q->fname, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      fd = open(q->fname, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
       if (fd < 0) { PFATAL("Unable to create '%s'", q->fname); }
 
@@ -866,7 +866,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
     } else {
 
       unlink(q->fname);                                    /* ignore errors */
-      fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, 0600);
+      fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
       if (fd < 0) { PFATAL("Unable to create '%s'", q->fname); }
 
diff --git a/src/afl-sharedmem.c b/src/afl-sharedmem.c
index 3241a130..ac662977 100644
--- a/src/afl-sharedmem.c
+++ b/src/afl-sharedmem.c
@@ -163,7 +163,7 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
 
   /* create the shared memory segment as if it was a file */
   shm->g_shm_fd =
-      shm_open(shm->g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, 0600);
+      shm_open(shm->g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, DEFAULT_PERMISSION);
   if (shm->g_shm_fd == -1) { PFATAL("shm_open() failed"); }
 
   /* configure the size of the shared memory segment */
@@ -202,7 +202,7 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
 
     /* create the shared memory segment as if it was a file */
     shm->cmplog_g_shm_fd =
-        shm_open(shm->cmplog_g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, 0600);
+        shm_open(shm->cmplog_g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, DEFAULT_PERMISSION);
     if (shm->cmplog_g_shm_fd == -1) { PFATAL("shm_open() failed"); }
 
     /* configure the size of the shared memory segment */
@@ -241,13 +241,13 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
 #else
   u8 *shm_str;
 
-  shm->shm_id = shmget(IPC_PRIVATE, map_size, IPC_CREAT | IPC_EXCL | 0600);
+  shm->shm_id = shmget(IPC_PRIVATE, map_size, IPC_CREAT | IPC_EXCL | DEFAULT_PERMISSION);
   if (shm->shm_id < 0) { PFATAL("shmget() failed"); }
 
   if (shm->cmplog_mode) {
 
     shm->cmplog_shm_id = shmget(IPC_PRIVATE, sizeof(struct cmp_map),
-                                IPC_CREAT | IPC_EXCL | 0600);
+                                IPC_CREAT | IPC_EXCL | DEFAULT_PERMISSION);
 
     if (shm->cmplog_shm_id < 0) {
 
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 7bf5a9c7..cc0f1a7e 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -252,7 +252,7 @@ static u32 write_results_to_file(afl_forkserver_t *fsrv, u8 *outfile) {
   } else {
 
     unlink(outfile);                                       /* Ignore errors */
-    fd = open(outfile, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    fd = open(outfile, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", outfile); }
 
   }
@@ -1119,7 +1119,7 @@ int main(int argc, char **argv_orig, char **envp) {
     unlink(stdin_file);
     atexit(at_exit_handler);
     fsrv->out_file = stdin_file;
-    fsrv->out_fd = open(stdin_file, O_RDWR | O_CREAT | O_EXCL, 0600);
+    fsrv->out_fd = open(stdin_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fsrv->out_fd < 0) { PFATAL("Unable to create '%s'", out_file); }
 
     if (arg_offset && use_argv[arg_offset] != stdin_file) {
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 7ef8b9bf..fc974262 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -244,7 +244,7 @@ static s32 write_to_file(u8 *path, u8 *mem, u32 len) {
 
   unlink(path);                                            /* Ignore errors */
 
-  ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600);
+  ret = open(path, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   if (ret < 0) { PFATAL("Unable to create '%s'", path); }
 
@@ -666,7 +666,7 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
   unlink(out_file);
 
   fsrv->out_file = out_file;
-  fsrv->out_fd = open(out_file, O_RDWR | O_CREAT | O_EXCL, 0600);
+  fsrv->out_fd = open(out_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   if (fsrv->out_fd < 0) { PFATAL("Unable to create '%s'", out_file); }
 
-- 
cgit 1.4.1


From 2fef89950f826be065cc9677df690ebfd21160c1 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 23 Mar 2021 22:49:02 +0100
Subject: v3.12c release

---
 docs/Changelog.md | 2 +-
 include/config.h  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index aea95d5d..476c6f4e 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -8,7 +8,7 @@
 Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
-### Version ++3.12a (dev)
+### Version ++3.12c (release)
   - afl-fuzz:
     - added AFL_TARGET_ENV variable to pass extra env vars to the target
       (for things like LD_LIBRARY_PATH)
diff --git a/include/config.h b/include/config.h
index 3c09fce4..c93a6d51 100644
--- a/include/config.h
+++ b/include/config.h
@@ -26,7 +26,7 @@
 /* Version string: */
 
 // c = release, a = volatile github dev, e = experimental branch
-#define VERSION "++3.12a"
+#define VERSION "++3.12c"
 
 /******************************************************
  *                                                    *
-- 
cgit 1.4.1


From 2b3642aa39fc79b5fd394120f0fadf4476d4476e Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 24 Mar 2021 11:13:16 +0100
Subject: v3.12c ready to go

---
 docs/Changelog.md | 1 +
 qemu_mode/qemuafl | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

(limited to 'docs')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 476c6f4e..5b7d6ab6 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -13,6 +13,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - added AFL_TARGET_ENV variable to pass extra env vars to the target
       (for things like LD_LIBRARY_PATH)
     - fix map detection, AFL_MAP_SIZE not needed anymore for most cases
+    - fix counting favorites (just a display thing)
   - afl-cc:
     - fix cmplog rtn (rare crash and not being able to gather ptr data)
     - fix our own PCGUARD implementation to compile with llvm 10.0.1
diff --git a/qemu_mode/qemuafl b/qemu_mode/qemuafl
index ddc4a974..0fb212da 160000
--- a/qemu_mode/qemuafl
+++ b/qemu_mode/qemuafl
@@ -1 +1 @@
-Subproject commit ddc4a9748d59857753fb33c30a356f354595f36d
+Subproject commit 0fb212daab492411b3e323bc18a3074c1aecfd37
-- 
cgit 1.4.1