From 71f8cc9dd2b38405755c2727997730d525b73b7e Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Fri, 27 Mar 2020 21:59:08 +0100
Subject: almost

---
 include/alloc-inl.h | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

(limited to 'include/alloc-inl.h')

diff --git a/include/alloc-inl.h b/include/alloc-inl.h
index c8783d96..75b038c1 100644
--- a/include/alloc-inl.h
+++ b/include/alloc-inl.h
@@ -35,6 +35,9 @@
 #include "types.h"
 #include "debug.h"
 
+/* Initial size used for ck_maybe_grow */
+#define INITIAL_GROWTH_SIZE (64)
+
 // Be careful! _WANT_ORIGINAL_AFL_ALLOC is not compatible with custom mutators
 
 #ifndef _WANT_ORIGINAL_AFL_ALLOC
@@ -764,5 +767,42 @@ static inline void TRK_ck_free(void *ptr, const char *file, const char *func,
 
 #endif                                          /* _WANT_ORIGINAL_AFL_ALLOC */
 
+/* This function makes sure *size is > size_needed after call.
+ It will realloc *buf otherwise.
+ *size will grow exponentially as per:
+ https://blog.mozilla.org/nnethercote/2014/11/04/please-grow-your-buffers-exponentially/
+ Will FATAL if size_needed is <1 or *size is negative.
+ @return For convenience, this function returns *buf.
+ */
+static inline void *ck_maybe_grow(void **buf, size_t *size, size_t size_needed) {
+
+  /* Oops. found a bug? */
+  if (unlikely(size_needed < 1)) FATAL("cannot grow to non-positive size");
+
+  /* No need to realloc */
+  if (likely(*size >= size_needed)) return *buf;
+  if (unlikely(*size < 0)) FATAL("Negative size detected!");
+  /* No inital size was set */
+  if (*size == 0) *size = INITIAL_GROWTH_SIZE;
+  while (*size < size_needed) {
+    *size *= 2;
+  }
+  *buf = ck_realloc(*buf, *size);
+  return *buf;
+
+}
+
+/* Swaps buf1 ptr and buf2 ptr, as well as their sizes */
+static inline void swap_bufs(void **buf1, size_t *size1, void **buf2, size_t *size2) {
+  void *scratch_buf = *buf1;
+  size_t scratch_size = *size1;
+  *buf1 = *buf2;
+  *size1 = *size2;
+  *buf2 = scratch_buf;
+  *size2 = scratch_size;
+}
+
+#undef INITIAL_GROWTH_SIZE
+
 #endif                                               /* ! _HAVE_ALLOC_INL_H */
 
-- 
cgit 1.4.1


From e71c2937de8a19cf9b3627b86894cafabcd45513 Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Fri, 27 Mar 2020 23:30:15 +0100
Subject: code format

---
 examples/custom_mutators/example.c |  1 +
 include/afl-fuzz.h                 | 17 ++++++++---------
 include/alloc-inl.h                | 13 ++++++++++---
 llvm_mode/afl-clang-fast.c         | 10 +++++-----
 llvm_mode/afl-llvm-pass.so.cc      |  7 ++++++-
 src/afl-fuzz-bitmap.c              | 22 +++++++++++++---------
 src/afl-fuzz-init.c                | 11 ++++-------
 src/afl-fuzz-one.c                 | 30 +++++++++++++-----------------
 src/afl-fuzz-queue.c               |  8 +++++---
 src/afl-fuzz-stats.c               |  2 +-
 10 files changed, 66 insertions(+), 55 deletions(-)

(limited to 'include/alloc-inl.h')

diff --git a/examples/custom_mutators/example.c b/examples/custom_mutators/example.c
index 8a45d87f..4b0a461b 100644
--- a/examples/custom_mutators/example.c
+++ b/examples/custom_mutators/example.c
@@ -149,6 +149,7 @@ size_t afl_custom_pre_save(my_mutator_t *data, uint8_t *buf, size_t buf_size,
     data->pre_save_size = buf_size + 5;
 
   }
+
   *out_buf = data->pre_save_buf;
 
   memcpy(*out_buf + 5, buf, buf_size);
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 2154d860..32eaf4af 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -583,27 +583,26 @@ typedef struct afl_state {
   u8 clean_trace_custom[MAP_SIZE];
   u8 first_trace[MAP_SIZE];
 
-/*needed for afl_fuzz_one */
-// TODO: see which we can reuse
-  u8 *out_buf;
+  /*needed for afl_fuzz_one */
+  // TODO: see which we can reuse
+  u8 *   out_buf;
   size_t out_size;
 
-  u8 *out_scratch_buf;
+  u8 *   out_scratch_buf;
   size_t out_scratch_size;
 
-  u8 *eff_buf;
+  u8 *   eff_buf;
   size_t eff_size;
 
-  u8 *in_buf;
+  u8 *   in_buf;
   size_t in_size;
 
-  u8 *in_scratch_buf;
+  u8 *   in_scratch_buf;
   size_t in_scratch_size;
 
-  u8 *ex_buf;
+  u8 *   ex_buf;
   size_t ex_size;
 
-
 } afl_state_t;
 
 /* A global pointer to all instances is needed (for now) for signals to arrive
diff --git a/include/alloc-inl.h b/include/alloc-inl.h
index 75b038c1..92d29c1e 100644
--- a/include/alloc-inl.h
+++ b/include/alloc-inl.h
@@ -774,7 +774,8 @@ static inline void TRK_ck_free(void *ptr, const char *file, const char *func,
  Will FATAL if size_needed is <1 or *size is negative.
  @return For convenience, this function returns *buf.
  */
-static inline void *ck_maybe_grow(void **buf, size_t *size, size_t size_needed) {
+static inline void *ck_maybe_grow(void **buf, size_t *size,
+                                  size_t size_needed) {
 
   /* Oops. found a bug? */
   if (unlikely(size_needed < 1)) FATAL("cannot grow to non-positive size");
@@ -785,21 +786,27 @@ static inline void *ck_maybe_grow(void **buf, size_t *size, size_t size_needed)
   /* No inital size was set */
   if (*size == 0) *size = INITIAL_GROWTH_SIZE;
   while (*size < size_needed) {
+
     *size *= 2;
+
   }
+
   *buf = ck_realloc(*buf, *size);
   return *buf;
 
 }
 
 /* Swaps buf1 ptr and buf2 ptr, as well as their sizes */
-static inline void swap_bufs(void **buf1, size_t *size1, void **buf2, size_t *size2) {
-  void *scratch_buf = *buf1;
+static inline void swap_bufs(void **buf1, size_t *size1, void **buf2,
+                             size_t *size2) {
+
+  void * scratch_buf = *buf1;
   size_t scratch_size = *size1;
   *buf1 = *buf2;
   *size1 = *size2;
   *buf2 = scratch_buf;
   *size2 = scratch_size;
+
 }
 
 #undef INITIAL_GROWTH_SIZE
diff --git a/llvm_mode/afl-clang-fast.c b/llvm_mode/afl-clang-fast.c
index c45c8799..99bc8d03 100644
--- a/llvm_mode/afl-clang-fast.c
+++ b/llvm_mode/afl-clang-fast.c
@@ -397,15 +397,15 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   if (getenv("AFL_USE_CFISAN")) {
 
-    if (!lto_mode) { 
-    
+    if (!lto_mode) {
+
       uint32_t i = 0, found = 0;
       while (envp[i] != NULL && !found)
-        if (strncmp("-flto", envp[i++], 5) == 0)
-          found = 1;
+        if (strncmp("-flto", envp[i++], 5) == 0) found = 1;
       if (!found) cc_params[cc_par_cnt++] = "-flto";
-      
+
     }
+
     cc_params[cc_par_cnt++] = "-fsanitize=cfi";
     cc_params[cc_par_cnt++] = "-fvisibility=hidden";
 
diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc
index 1c0a3c93..f6ead9ec 100644
--- a/llvm_mode/afl-llvm-pass.so.cc
+++ b/llvm_mode/afl-llvm-pass.so.cc
@@ -132,8 +132,11 @@ class AFLCoverage : public ModulePass {
 char AFLCoverage::ID = 0;
 
 /* needed up to 3.9.0 */
-#if LLVM_VERSION_MAJOR == 3 && (LLVM_VERSION_MINOR < 9 || (LLVM_VERSION_MINOR == 9 && LLVM_VERSION_PATCH < 1))
+#if LLVM_VERSION_MAJOR == 3 && \
+    (LLVM_VERSION_MINOR < 9 || \
+     (LLVM_VERSION_MINOR == 9 && LLVM_VERSION_PATCH < 1))
 uint64_t PowerOf2Ceil(unsigned in) {
+
   uint64_t in64 = in - 1;
   in64 |= (in64 >> 1);
   in64 |= (in64 >> 2);
@@ -142,7 +145,9 @@ uint64_t PowerOf2Ceil(unsigned in) {
   in64 |= (in64 >> 16);
   in64 |= (in64 >> 32);
   return in64 + 1;
+
 }
+
 #endif
 
 bool AFLCoverage::runOnModule(Module &M) {
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index bb01ad21..8ca286b2 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -31,7 +31,7 @@
 
 void write_bitmap(afl_state_t *afl) {
 
-  u8 fname[PATH_MAX];
+  u8  fname[PATH_MAX];
   s32 fd;
 
   if (!afl->bitmap_changed) return;
@@ -461,7 +461,7 @@ u8 *describe_op(afl_state_t *afl, u8 hnb) {
 
 static void write_crash_readme(afl_state_t *afl) {
 
-  u8 fn[PATH_MAX];
+  u8    fn[PATH_MAX];
   s32   fd;
   FILE *f;
 
@@ -558,12 +558,13 @@ u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
 
 #ifndef SIMPLE_FILES
 
-    queue_fn = alloc_printf("%s/queue/id:%06u,%s", afl->out_dir, afl->queued_paths,
-                      describe_op(afl, hnb));
+    queue_fn = alloc_printf("%s/queue/id:%06u,%s", afl->out_dir,
+                            afl->queued_paths, describe_op(afl, hnb));
 
 #else
 
-    queue_fn = alloc_printf("%s/queue/id_%06u", afl->out_dir, afl->queued_paths);
+    queue_fn =
+        alloc_printf("%s/queue/id_%06u", afl->out_dir, afl->queued_paths);
 
 #endif                                                    /* ^!SIMPLE_FILES */
 
@@ -645,11 +646,12 @@ u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
 #ifndef SIMPLE_FILES
 
       snprintf(fn, PATH_MAX, "%s/hangs/id:%06llu,%s", afl->out_dir,
-                        afl->unique_hangs, describe_op(afl, 0));
+               afl->unique_hangs, describe_op(afl, 0));
 
 #else
 
-      snprintf(fn, PATH_MAX, "%s/hangs/id_%06llu", afl->out_dir, afl->unique_hangs);
+      snprintf(fn, PATH_MAX, "%s/hangs/id_%06llu", afl->out_dir,
+               afl->unique_hangs);
 
 #endif                                                    /* ^!SIMPLE_FILES */
 
@@ -687,11 +689,13 @@ u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
 
 #ifndef SIMPLE_FILES
 
-      snprintf(fn, PATH_MAX, "%s/crashes/id:%06llu,sig:%02u,%s", afl->out_dir, afl->unique_crashes, afl->kill_signal, describe_op(afl, 0));
+      snprintf(fn, PATH_MAX, "%s/crashes/id:%06llu,sig:%02u,%s", afl->out_dir,
+               afl->unique_crashes, afl->kill_signal, describe_op(afl, 0));
 
 #else
 
-      snprintf(fn, PATH_MAX, "%s/crashes/id_%06llu_%02u", afl->out_dir, afl->unique_crashes, afl->kill_signal);
+      snprintf(fn, PATH_MAX, "%s/crashes/id_%06llu_%02u", afl->out_dir,
+               afl->unique_crashes, afl->kill_signal);
 
 #endif                                                    /* ^!SIMPLE_FILES */
 
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 1033c587..19092204 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -76,7 +76,7 @@ void bind_to_free_cpu(afl_state_t *afl) {
 
   while ((de = readdir(d))) {
 
-    u8 fn[PATH_MAX];
+    u8    fn[PATH_MAX];
     FILE *f;
     u8    tmp[MAX_LINE];
     u8    has_vmsize = 0;
@@ -85,11 +85,7 @@ void bind_to_free_cpu(afl_state_t *afl) {
 
     snprintf(fn, PATH_MAX, "/proc/%s/status", de->d_name);
 
-    if (!(f = fopen(fn, "r"))) {
-
-      continue;
-
-    }
+    if (!(f = fopen(fn, "r"))) { continue; }
 
     while (fgets(tmp, MAX_LINE, f)) {
 
@@ -368,7 +364,8 @@ void read_testcases(afl_state_t *afl) {
     struct stat st;
 
     u8 dfn[PATH_MAX];
-    snprintf(dfn, PATH_MAX, "%s/.state/deterministic_done/%s", afl->in_dir, nl[i]->d_name);
+    snprintf(dfn, PATH_MAX, "%s/.state/deterministic_done/%s", afl->in_dir,
+             nl[i]->d_name);
     u8 *fn2 = alloc_printf("%s/%s", afl->in_dir, nl[i]->d_name);
 
     u8 passed_det = 0;
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 6c1d69ad..c731ebc6 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -1957,7 +1957,9 @@ havoc_stage:
 
             clone_to = rand_below(afl, temp_len);
 
-            new_buf = ck_maybe_grow((void **)&afl->out_scratch_buf, &afl->out_scratch_size, temp_len + clone_len);
+            new_buf =
+                ck_maybe_grow((void **)&afl->out_scratch_buf,
+                              &afl->out_scratch_size, temp_len + clone_len);
 
             /* Head */
 
@@ -1977,8 +1979,8 @@ havoc_stage:
             memcpy(new_buf + clone_to + clone_len, out_buf + clone_to,
                    temp_len - clone_to);
 
-
-            swap_bufs((void **)&afl->out_buf, &afl->out_size, (void **)&afl->out_scratch_buf, &afl->out_scratch_size);
+            swap_bufs((void **)&afl->out_buf, &afl->out_size,
+                      (void **)&afl->out_scratch_buf, &afl->out_scratch_size);
             out_buf = new_buf;
             temp_len += clone_len;
 
@@ -2072,7 +2074,8 @@ havoc_stage:
 
             if (temp_len + extra_len >= MAX_FILE) break;
 
-            new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + extra_len);
+            new_buf =
+                ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + extra_len);
 
             /* Head */
             memcpy(new_buf, out_buf, insert_at);
@@ -2088,7 +2091,8 @@ havoc_stage:
 
             if (temp_len + extra_len >= MAX_FILE) break;
 
-            new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + extra_len);
+            new_buf =
+                ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + extra_len);
 
             /* Head */
             memcpy(new_buf, out_buf, insert_at);
@@ -2236,11 +2240,7 @@ retry_splicing:
 
     locate_diffs(in_buf, new_buf, MIN(len, target->len), &f_diff, &l_diff);
 
-    if (f_diff < 0 || l_diff < 2 || f_diff == l_diff) {
-
-      goto retry_splicing;
-
-    }
+    if (f_diff < 0 || l_diff < 2 || f_diff == l_diff) { goto retry_splicing; }
 
     /* Split somewhere between the first and last differing byte. */
 
@@ -2308,11 +2308,7 @@ radamsa_stage:
 
     }
 
-    if (common_fuzz_stuff(afl, tmp_buf, temp_len)) {
-
-      goto abandon_entry;
-
-    }
+    if (common_fuzz_stuff(afl, tmp_buf, temp_len)) { goto abandon_entry; }
 
   }
 
@@ -3885,7 +3881,8 @@ pacemaker_fuzzing:
 
                 clone_to = rand_below(afl, temp_len);
 
-                new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + clone_len);
+                new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch),
+                                        temp_len + clone_len);
 
                 /* Head */
 
@@ -4399,7 +4396,6 @@ u8 fuzz_one(afl_state_t *afl) {
 
   return key_val_lv;
 
-
 #undef BUF_PARAMS
 
 }
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index b5ae1255..4f1bd041 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -30,10 +30,11 @@
 
 void mark_as_det_done(afl_state_t *afl, struct queue_entry *q) {
 
-  u8 fn[PATH_MAX];
+  u8  fn[PATH_MAX];
   s32 fd;
 
-  snprintf(fn, PATH_MAX, "%s/queue/.state/deterministic_done/%s", afl->out_dir, strrchr(q->fname, '/') + 1);
+  snprintf(fn, PATH_MAX, "%s/queue/.state/deterministic_done/%s", afl->out_dir,
+           strrchr(q->fname, '/') + 1);
 
   fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
   if (fd < 0) PFATAL("Unable to create '%s'", fn);
@@ -79,7 +80,8 @@ void mark_as_redundant(afl_state_t *afl, struct queue_entry *q, u8 state) {
 
   q->fs_redundant = state;
 
-  sprintf(fn, "%s/queue/.state/redundant_edges/%s", afl->out_dir, strrchr(q->fname, '/') + 1);
+  sprintf(fn, "%s/queue/.state/redundant_edges/%s", afl->out_dir,
+          strrchr(q->fname, '/') + 1);
 
   if (state) {
 
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index d6403830..7fde2fdc 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -33,7 +33,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
   struct rusage rus;
 
   unsigned long long int cur_time = get_cur_time();
-  u8 fn[PATH_MAX];
+  u8                     fn[PATH_MAX];
   s32                    fd;
   FILE *                 f;
 
-- 
cgit 1.4.1


From 5bd8aa489b9d9db4bb330a7515666ad11eab24b4 Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Sat, 28 Mar 2020 00:44:52 +0100
Subject: fixed leak

---
 include/alloc-inl.h |  2 ++
 src/afl-fuzz-init.c |  1 +
 src/afl-fuzz-one.c  | 10 +++++-----
 3 files changed, 8 insertions(+), 5 deletions(-)

(limited to 'include/alloc-inl.h')

diff --git a/include/alloc-inl.h b/include/alloc-inl.h
index 92d29c1e..ed1e0397 100644
--- a/include/alloc-inl.h
+++ b/include/alloc-inl.h
@@ -788,10 +788,12 @@ static inline void *ck_maybe_grow(void **buf, size_t *size,
   while (*size < size_needed) {
 
     *size *= 2;
+    if ((*size) < 0) FATAL("size_t overflow");
 
   }
 
   *buf = ck_realloc(*buf, *size);
+
   return *buf;
 
 }
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 19092204..a69c3b61 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -379,6 +379,7 @@ void read_testcases(afl_state_t *afl) {
 
     if (!S_ISREG(st.st_mode) || !st.st_size || strstr(fn2, "/README.txt")) {
 
+      free(fn2);
       continue;
 
     }
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index c731ebc6..024b4665 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -430,7 +430,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
      single byte anyway, so it wouldn't give us any performance or memory usage
      benefits. */
 
-  out_buf = ck_maybe_grow((void **)&afl->out_buf, &afl->out_size, len);
+  out_buf = ck_maybe_grow(BUF_PARAMS(out), len);
 
   afl->subseq_tmouts = 0;
 
@@ -1958,8 +1958,7 @@ havoc_stage:
             clone_to = rand_below(afl, temp_len);
 
             new_buf =
-                ck_maybe_grow((void **)&afl->out_scratch_buf,
-                              &afl->out_scratch_size, temp_len + clone_len);
+                ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + clone_len);
 
             /* Head */
 
@@ -1979,9 +1978,9 @@ havoc_stage:
             memcpy(new_buf + clone_to + clone_len, out_buf + clone_to,
                    temp_len - clone_to);
 
-            swap_bufs((void **)&afl->out_buf, &afl->out_size,
-                      (void **)&afl->out_scratch_buf, &afl->out_scratch_size);
+            swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch));
             out_buf = new_buf;
+            new_buf = NULL;
             temp_len += clone_len;
 
           }
@@ -2108,6 +2107,7 @@ havoc_stage:
 
           swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch));
           out_buf = new_buf;
+          new_buf = NULL;
           temp_len += extra_len;
 
           break;
-- 
cgit 1.4.1


From e59282fe2090445ea22bc5826845251e30e3799f Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Sat, 28 Mar 2020 05:01:01 +0100
Subject: if exponential growth is too much, don't doo it

---
 examples/post_library/post_library.so.c     | 1 +
 examples/post_library/post_library_png.so.c | 1 +
 include/alloc-inl.h                         | 3 ++-
 3 files changed, 4 insertions(+), 1 deletion(-)

(limited to 'include/alloc-inl.h')

diff --git a/examples/post_library/post_library.so.c b/examples/post_library/post_library.so.c
index 735aae9b..0aa780cb 100644
--- a/examples/post_library/post_library.so.c
+++ b/examples/post_library/post_library.so.c
@@ -156,3 +156,4 @@ void afl_postprocess_deinit(post_state_t *data) {
   free(data);
 
 }
+
diff --git a/examples/post_library/post_library_png.so.c b/examples/post_library/post_library_png.so.c
index 8597c88c..41ba4f5e 100644
--- a/examples/post_library/post_library_png.so.c
+++ b/examples/post_library/post_library_png.so.c
@@ -153,3 +153,4 @@ void afl_postprocess_deinit(post_state_t *data) {
   free(data);
 
 }
+
diff --git a/include/alloc-inl.h b/include/alloc-inl.h
index ed1e0397..99a83413 100644
--- a/include/alloc-inl.h
+++ b/include/alloc-inl.h
@@ -788,7 +788,8 @@ static inline void *ck_maybe_grow(void **buf, size_t *size,
   while (*size < size_needed) {
 
     *size *= 2;
-    if ((*size) < 0) FATAL("size_t overflow");
+    /* in case of overflow we'll realloc to size_needed */
+    if ((*size) < 0) *size = size_needed;
 
   }
 
-- 
cgit 1.4.1


From 9d7ac3d99f95981df63f207f9b109182c69d8884 Mon Sep 17 00:00:00 2001
From: hexcoder- <heiko@hexco.de>
Date: Sat, 28 Mar 2020 10:23:11 +0100
Subject: alloc_inl.h/ck_maybe_grow(): fix compiler warning

---
 include/alloc-inl.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'include/alloc-inl.h')

diff --git a/include/alloc-inl.h b/include/alloc-inl.h
index 99a83413..ae908162 100644
--- a/include/alloc-inl.h
+++ b/include/alloc-inl.h
@@ -774,7 +774,7 @@ static inline void TRK_ck_free(void *ptr, const char *file, const char *func,
  Will FATAL if size_needed is <1 or *size is negative.
  @return For convenience, this function returns *buf.
  */
-static inline void *ck_maybe_grow(void **buf, size_t *size,
+static inline void *ck_maybe_grow(void **buf, ssize_t *size,
                                   size_t size_needed) {
 
   /* Oops. found a bug? */
-- 
cgit 1.4.1


From 1119a2e185498c83cdc672c4a4753494197314f2 Mon Sep 17 00:00:00 2001
From: hexcoder- <heiko@hexco.de>
Date: Sat, 28 Mar 2020 11:01:29 +0100
Subject: alloc-inl.h/ck_maybe_grow() back to size_t, reimplement overflow
 check

---
 include/alloc-inl.h   | 12 ++++++------
 src/afl-fuzz-python.c |  5 ++---
 2 files changed, 8 insertions(+), 9 deletions(-)

(limited to 'include/alloc-inl.h')

diff --git a/include/alloc-inl.h b/include/alloc-inl.h
index ae908162..11c1143a 100644
--- a/include/alloc-inl.h
+++ b/include/alloc-inl.h
@@ -771,10 +771,10 @@ static inline void TRK_ck_free(void *ptr, const char *file, const char *func,
  It will realloc *buf otherwise.
  *size will grow exponentially as per:
  https://blog.mozilla.org/nnethercote/2014/11/04/please-grow-your-buffers-exponentially/
- Will FATAL if size_needed is <1 or *size is negative.
+ Will FATAL if size_needed is <1.
  @return For convenience, this function returns *buf.
  */
-static inline void *ck_maybe_grow(void **buf, ssize_t *size,
+static inline void *ck_maybe_grow(void **buf, size_t *size,
                                   size_t size_needed) {
 
   /* Oops. found a bug? */
@@ -782,14 +782,14 @@ static inline void *ck_maybe_grow(void **buf, ssize_t *size,
 
   /* No need to realloc */
   if (likely(*size >= size_needed)) return *buf;
-  if (unlikely(*size < 0)) FATAL("Negative size detected!");
-  /* No inital size was set */
+
+  /* No initial size was set */
   if (*size == 0) *size = INITIAL_GROWTH_SIZE;
   while (*size < size_needed) {
 
-    *size *= 2;
     /* in case of overflow we'll realloc to size_needed */
-    if ((*size) < 0) *size = size_needed;
+    if (2*(*size) < size_needed) *size = size_needed;
+    else *size *= 2;
 
   }
 
diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c
index f9f71929..6f8982c0 100644
--- a/src/afl-fuzz-python.c
+++ b/src/afl-fuzz-python.c
@@ -36,7 +36,7 @@ static void *unsupported(afl_state_t *afl, unsigned int seed) {
 }
 
 /* sorry for this makro...
-it just filles in `&py_mutator->something_buf, &py_mutator->something_size`. */
+it just fills in `&py_mutator->something_buf, &py_mutator->something_size`. */
 #define BUF_PARAMS(name)                              \
   (void **)&((py_mutator_t *)py_mutator)->name##_buf, \
       &((py_mutator_t *)py_mutator)->name##_size
@@ -371,8 +371,7 @@ size_t pre_save_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
 
     py_out_buf_size = PyByteArray_Size(py_value);
 
-    ck_maybe_grow((void **)&py->pre_save_buf, &py->pre_save_size,
-                  py_out_buf_size);
+    ck_maybe_grow(BUF_PARAMS(pre_save), py_out_buf_size);
 
     memcpy(py->pre_save_buf, PyByteArray_AsString(py_value), py_out_buf_size);
     Py_DECREF(py_value);
-- 
cgit 1.4.1


From f370ef38c47eb9243c5ca06b98948e33cf5347b3 Mon Sep 17 00:00:00 2001
From: hexcoder- <heiko@hexco.de>
Date: Sat, 28 Mar 2020 12:15:01 +0100
Subject: alloc-inl.h/ck_maybe_grow(): restore original exponential allocs

---
 include/alloc-inl.h | 29 +++++++++++++++++++++++------
 1 file changed, 23 insertions(+), 6 deletions(-)

(limited to 'include/alloc-inl.h')

diff --git a/include/alloc-inl.h b/include/alloc-inl.h
index 11c1143a..b8c83db4 100644
--- a/include/alloc-inl.h
+++ b/include/alloc-inl.h
@@ -767,6 +767,20 @@ static inline void TRK_ck_free(void *ptr, const char *file, const char *func,
 
 #endif                                          /* _WANT_ORIGINAL_AFL_ALLOC */
 
+/* This function calculates the lowest power of 2 greater or equal its argument.
+ @return The rounded up power of 2 (if no overflow) or 0 on overflow.
+*/
+static inline size_t powerOf2Ceil(size_t in) {
+  if (in == 0 || in > (size_t)-1) return 0; /* avoid undefined behaviour under-/overflow */
+  size_t out = in - 1;
+  out |= out >> 1;
+  out |= out >> 2;
+  out |= out >> 4;
+  out |= out >> 8;
+  out |= out >> 16;
+  return out + 1;
+}
+
 /* This function makes sure *size is > size_needed after call.
  It will realloc *buf otherwise.
  *size will grow exponentially as per:
@@ -784,16 +798,19 @@ static inline void *ck_maybe_grow(void **buf, size_t *size,
   if (likely(*size >= size_needed)) return *buf;
 
   /* No initial size was set */
-  if (*size == 0) *size = INITIAL_GROWTH_SIZE;
-  while (*size < size_needed) {
+  if (size_needed < INITIAL_GROWTH_SIZE) size_needed = INITIAL_GROWTH_SIZE;
 
-    /* in case of overflow we'll realloc to size_needed */
-    if (2*(*size) < size_needed) *size = size_needed;
-    else *size *= 2;
+  /* grow exponentially */
+  size_t next_size = powerOf2Ceil(size_needed);
 
+  /* handle overflow */
+  if (!next_size) {
+    next_size = size_needed;
   }
 
-  *buf = ck_realloc(*buf, *size);
+  /* alloc */
+  *buf = ck_realloc(*buf, next_size);
+  *size = next_size;
 
   return *buf;
 
-- 
cgit 1.4.1


From 81873d97f8a24a874a52f56aae5ca87745f1aaec Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Sat, 28 Mar 2020 12:58:56 +0100
Subject: error handling for custom mutators

---
 examples/custom_mutators/custom_mutator_helpers.h | 49 ++++++++++++++---------
 examples/custom_mutators/example.c                | 15 ++++---
 include/afl-fuzz.h                                | 13 +++---
 include/alloc-inl.h                               |  6 +--
 src/afl-fuzz-mutators.c                           |  3 +-
 src/afl-fuzz-python.c                             |  4 +-
 6 files changed, 54 insertions(+), 36 deletions(-)

(limited to 'include/alloc-inl.h')

diff --git a/examples/custom_mutators/custom_mutator_helpers.h b/examples/custom_mutators/custom_mutator_helpers.h
index 0dc00d96..e5ce3569 100644
--- a/examples/custom_mutators/custom_mutator_helpers.h
+++ b/examples/custom_mutators/custom_mutator_helpers.h
@@ -277,37 +277,48 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
 
 }
 
+
+/* This function calculates the next power of 2 greater or equal its argument.
+ @return The rounded up power of 2 (if no overflow) or 0 on overflow.
+*/
+static inline size_t next_pow2(size_t in) {
+  if (in == 0 || in > (size_t)-1) return 0; /* avoid undefined behaviour under-/overflow */
+  size_t out = in - 1;
+  out |= out >> 1;
+  out |= out >> 2;
+  out |= out >> 4;
+  out |= out >> 8;
+  out |= out >> 16;
+  return out + 1;
+}
+
 /* This function makes sure *size is > size_needed after call.
- It changes buf and size in-place, if needed.
  It will realloc *buf otherwise.
  *size will grow exponentially as per:
  https://blog.mozilla.org/nnethercote/2014/11/04/please-grow-your-buffers-exponentially/
- Will return NULL if size_needed is <1 or *size is negative or malloc Failed.
- @return For convenience, this function returns *buf. NULL on error.
+ Will return NULL and free *buf if size_needed is <1 or realloc failed.
+ @return For convenience, this function returns *buf.
  */
-static inline void *maybe_grow(void **buf, size_t *size, size_t size_needed) {
-
-  /* Oops. found a bug? */
-  if (unlikely(size_needed < 1)) return NULL;
+static inline void *maybe_grow(void **buf, size_t *size,
+                                  size_t size_needed) {
 
   /* No need to realloc */
-  if (likely(*size >= size_needed)) return *buf;
-  if (unlikely(*size < 0)) return NULL;
-  /* No inital size was set */
-  if (*size == 0) *size = INITIAL_GROWTH_SIZE;
-  while (*size < size_needed) {
-
-    *size *= 2;
-    if ((*size) < 0) {
+  if (likely(size_needed && *size >= size_needed)) return *buf;
 
-      /* An overflow occurred. Fall back to size_needed */
-      *size = size_needed;
+  /* No initial size was set */
+  if (size_needed < INITIAL_GROWTH_SIZE) size_needed = INITIAL_GROWTH_SIZE;
 
-    }
+  /* grow exponentially */
+  size_t next_size = next_pow2(size_needed);
 
+  /* handle overflow */
+  if (!next_size) {
+    next_size = size_needed;
   }
 
-  *buf = realloc(*buf, *size);
+  /* alloc */
+  *buf = realloc(*buf, next_size);
+  *size = *buf ? next_size : 0;
 
   return *buf;
 
diff --git a/examples/custom_mutators/example.c b/examples/custom_mutators/example.c
index 9a62d1a7..488ece81 100644
--- a/examples/custom_mutators/example.c
+++ b/examples/custom_mutators/example.c
@@ -100,6 +100,7 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
   u8 *mutated_out = maybe_grow(BUF_PARAMS(data, fuzz), mutated_size);
   if (!mutated_out) {
 
+    *out_buf = NULL;
     perror("custom mutator allocation (maybe_grow)");
     return 0;            /* afl-fuzz will very likely error out after this. */
 
@@ -189,16 +190,20 @@ size_t afl_custom_pre_save(my_mutator_t *data, uint8_t *buf, size_t buf_size,
  * @param data pointer returned in afl_custom_init for this fuzz case
  * @param buf Buffer containing the test case
  * @param buf_size Size of the test case
- * @return The amount of possible iteration steps to trim the input
+ * @return The amount of possible iteration steps to trim the input.
+ *        negative on error.
  */
-int afl_custom_init_trim(my_mutator_t *data, uint8_t *buf, size_t buf_size) {
+int32_t afl_custom_init_trim(my_mutator_t *data, uint8_t *buf, size_t buf_size) {
 
   // We simply trim once
   data->trimmming_steps = 1;
 
   data->cur_step = 0;
 
-  maybe_grow(BUF_PARAMS(data, trim), buf_size);
+  if (!maybe_grow(BUF_PARAMS(data, trim), buf_size)) {
+    perror("init_trim grow");
+    return -1;
+  }
   memcpy(data->trim_buf, buf, buf_size);
 
   data->trim_size_current = buf_size;
@@ -245,9 +250,9 @@ size_t afl_custom_trim(my_mutator_t *data, uint8_t **out_buf) {
  * @param[in] data pointer returned in afl_custom_init for this fuzz case
  * @param success Indicates if the last trim operation was successful.
  * @return The next trim iteration index (from 0 to the maximum amount of
- *     steps returned in init_trim)
+ *     steps returned in init_trim). negative ret on failure.
  */
-int afl_custom_post_trim(my_mutator_t *data, int success) {
+int32_t afl_custom_post_trim(my_mutator_t *data, int success) {
 
   if (success) {
 
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 79878cb6..a265c1a3 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -700,9 +700,10 @@ struct custom_mutator {
    * @param data pointer returned in afl_custom_init for this fuzz case
    * @param buf Buffer containing the test case
    * @param buf_size Size of the test case
-   * @return The amount of possible iteration steps to trim the input
+   * @return The amount of possible iteration steps to trim the input.
+   *        Negative on error.
    */
-  u32 (*afl_custom_init_trim)(void *data, u8 *buf, size_t buf_size);
+  s32 (*afl_custom_init_trim)(void *data, u8 *buf, size_t buf_size);
 
   /**
    * This method is called for each trimming operation. It doesn't have any
@@ -733,9 +734,9 @@ struct custom_mutator {
    * @param data pointer returned in afl_custom_init for this fuzz case
    * @param success Indicates if the last trim operation was successful.
    * @return The next trim iteration index (from 0 to the maximum amount of
-   *     steps returned in init_trim)
+   *     steps returned in init_trim). Negative on error.
    */
-  u32 (*afl_custom_post_trim)(void *data, u8 success);
+  s32 (*afl_custom_post_trim)(void *data, u8 success);
 
   /**
    * Perform a single custom mutation on a given input.
@@ -818,8 +819,8 @@ u8   trim_case_custom(afl_state_t *, struct queue_entry *q, u8 *in_buf);
 void finalize_py_module(void *);
 
 size_t pre_save_py(void *, u8 *, size_t, u8 **);
-u32    init_trim_py(void *, u8 *, size_t);
-u32    post_trim_py(void *, u8);
+s32    init_trim_py(void *, u8 *, size_t);
+s32    post_trim_py(void *, u8);
 size_t trim_py(void *, u8 **);
 size_t havoc_mutation_py(void *, u8 *, size_t, u8 **, size_t);
 u8     havoc_mutation_probability_py(void *);
diff --git a/include/alloc-inl.h b/include/alloc-inl.h
index b8c83db4..91564932 100644
--- a/include/alloc-inl.h
+++ b/include/alloc-inl.h
@@ -767,10 +767,10 @@ static inline void TRK_ck_free(void *ptr, const char *file, const char *func,
 
 #endif                                          /* _WANT_ORIGINAL_AFL_ALLOC */
 
-/* This function calculates the lowest power of 2 greater or equal its argument.
+/* This function calculates the next power of 2 greater or equal its argument.
  @return The rounded up power of 2 (if no overflow) or 0 on overflow.
 */
-static inline size_t powerOf2Ceil(size_t in) {
+static inline size_t next_pow2(size_t in) {
   if (in == 0 || in > (size_t)-1) return 0; /* avoid undefined behaviour under-/overflow */
   size_t out = in - 1;
   out |= out >> 1;
@@ -801,7 +801,7 @@ static inline void *ck_maybe_grow(void **buf, size_t *size,
   if (size_needed < INITIAL_GROWTH_SIZE) size_needed = INITIAL_GROWTH_SIZE;
 
   /* grow exponentially */
-  size_t next_size = powerOf2Ceil(size_needed);
+  size_t next_size = next_pow2(size_needed);
 
   /* handle overflow */
   if (!next_size) {
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index f14a57bb..90d7de40 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -213,7 +213,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
   afl->stage_cur = 0;
   afl->stage_max =
       afl->mutator->afl_custom_init_trim(afl->mutator->data, in_buf, q->len);
-
+  if (unlikely(afl->stage_max) < 0) FATAL("custom_init_trim error ret: %d", afl->stage_max);
   if (afl->not_on_tty && afl->debug)
     SAYF("[Custom Trimming] START: Max %d iterations, %u bytes", afl->stage_max,
          q->len);
@@ -273,6 +273,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
       /* Tell the custom mutator that the trimming was unsuccessful */
       afl->stage_cur =
           afl->mutator->afl_custom_post_trim(afl->mutator->data, 0);
+      if (unlikely(afl->stage_cur < 0)) FATAL("Error ret in custom_post_trim: %d", afl->stage_cur);
       if (afl->not_on_tty && afl->debug)
         SAYF("[Custom Trimming] FAILURE: %d/%d iterations", afl->stage_cur,
              afl->stage_max);
diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c
index 76b5ca80..91e5b084 100644
--- a/src/afl-fuzz-python.c
+++ b/src/afl-fuzz-python.c
@@ -388,7 +388,7 @@ size_t pre_save_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
 
 }
 
-u32 init_trim_py(void *py_mutator, u8 *buf, size_t buf_size) {
+s32 init_trim_py(void *py_mutator, u8 *buf, size_t buf_size) {
 
   PyObject *py_args, *py_value;
 
@@ -426,7 +426,7 @@ u32 init_trim_py(void *py_mutator, u8 *buf, size_t buf_size) {
 
 }
 
-u32 post_trim_py(void *py_mutator, u8 success) {
+s32 post_trim_py(void *py_mutator, u8 success) {
 
   PyObject *py_args, *py_value;
 
-- 
cgit 1.4.1


From 98545f30aa52c1b82b88e54088848b90e178a929 Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Sat, 28 Mar 2020 12:59:41 +0100
Subject: code format

---
 examples/custom_mutators/custom_mutator_helpers.h | 13 ++++++-------
 examples/custom_mutators/example.c                |  6 +++++-
 include/alloc-inl.h                               |  9 +++++----
 src/afl-fuzz-mutators.c                           |  6 ++++--
 4 files changed, 20 insertions(+), 14 deletions(-)

(limited to 'include/alloc-inl.h')

diff --git a/examples/custom_mutators/custom_mutator_helpers.h b/examples/custom_mutators/custom_mutator_helpers.h
index e5ce3569..0848321f 100644
--- a/examples/custom_mutators/custom_mutator_helpers.h
+++ b/examples/custom_mutators/custom_mutator_helpers.h
@@ -277,12 +277,13 @@ static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
 
 }
 
-
 /* This function calculates the next power of 2 greater or equal its argument.
  @return The rounded up power of 2 (if no overflow) or 0 on overflow.
 */
 static inline size_t next_pow2(size_t in) {
-  if (in == 0 || in > (size_t)-1) return 0; /* avoid undefined behaviour under-/overflow */
+
+  if (in == 0 || in > (size_t)-1)
+    return 0;                  /* avoid undefined behaviour under-/overflow */
   size_t out = in - 1;
   out |= out >> 1;
   out |= out >> 2;
@@ -290,6 +291,7 @@ static inline size_t next_pow2(size_t in) {
   out |= out >> 8;
   out |= out >> 16;
   return out + 1;
+
 }
 
 /* This function makes sure *size is > size_needed after call.
@@ -299,8 +301,7 @@ static inline size_t next_pow2(size_t in) {
  Will return NULL and free *buf if size_needed is <1 or realloc failed.
  @return For convenience, this function returns *buf.
  */
-static inline void *maybe_grow(void **buf, size_t *size,
-                                  size_t size_needed) {
+static inline void *maybe_grow(void **buf, size_t *size, size_t size_needed) {
 
   /* No need to realloc */
   if (likely(size_needed && *size >= size_needed)) return *buf;
@@ -312,9 +313,7 @@ static inline void *maybe_grow(void **buf, size_t *size,
   size_t next_size = next_pow2(size_needed);
 
   /* handle overflow */
-  if (!next_size) {
-    next_size = size_needed;
-  }
+  if (!next_size) { next_size = size_needed; }
 
   /* alloc */
   *buf = realloc(*buf, next_size);
diff --git a/examples/custom_mutators/example.c b/examples/custom_mutators/example.c
index 488ece81..a9764f5b 100644
--- a/examples/custom_mutators/example.c
+++ b/examples/custom_mutators/example.c
@@ -193,7 +193,8 @@ size_t afl_custom_pre_save(my_mutator_t *data, uint8_t *buf, size_t buf_size,
  * @return The amount of possible iteration steps to trim the input.
  *        negative on error.
  */
-int32_t afl_custom_init_trim(my_mutator_t *data, uint8_t *buf, size_t buf_size) {
+int32_t afl_custom_init_trim(my_mutator_t *data, uint8_t *buf,
+                             size_t buf_size) {
 
   // We simply trim once
   data->trimmming_steps = 1;
@@ -201,9 +202,12 @@ int32_t afl_custom_init_trim(my_mutator_t *data, uint8_t *buf, size_t buf_size)
   data->cur_step = 0;
 
   if (!maybe_grow(BUF_PARAMS(data, trim), buf_size)) {
+
     perror("init_trim grow");
     return -1;
+
   }
+
   memcpy(data->trim_buf, buf, buf_size);
 
   data->trim_size_current = buf_size;
diff --git a/include/alloc-inl.h b/include/alloc-inl.h
index 91564932..4211e398 100644
--- a/include/alloc-inl.h
+++ b/include/alloc-inl.h
@@ -771,7 +771,9 @@ static inline void TRK_ck_free(void *ptr, const char *file, const char *func,
  @return The rounded up power of 2 (if no overflow) or 0 on overflow.
 */
 static inline size_t next_pow2(size_t in) {
-  if (in == 0 || in > (size_t)-1) return 0; /* avoid undefined behaviour under-/overflow */
+
+  if (in == 0 || in > (size_t)-1)
+    return 0;                  /* avoid undefined behaviour under-/overflow */
   size_t out = in - 1;
   out |= out >> 1;
   out |= out >> 2;
@@ -779,6 +781,7 @@ static inline size_t next_pow2(size_t in) {
   out |= out >> 8;
   out |= out >> 16;
   return out + 1;
+
 }
 
 /* This function makes sure *size is > size_needed after call.
@@ -804,9 +807,7 @@ static inline void *ck_maybe_grow(void **buf, size_t *size,
   size_t next_size = next_pow2(size_needed);
 
   /* handle overflow */
-  if (!next_size) {
-    next_size = size_needed;
-  }
+  if (!next_size) { next_size = size_needed; }
 
   /* alloc */
   *buf = ck_realloc(*buf, next_size);
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 90d7de40..754b2190 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -213,7 +213,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
   afl->stage_cur = 0;
   afl->stage_max =
       afl->mutator->afl_custom_init_trim(afl->mutator->data, in_buf, q->len);
-  if (unlikely(afl->stage_max) < 0) FATAL("custom_init_trim error ret: %d", afl->stage_max);
+  if (unlikely(afl->stage_max) < 0)
+    FATAL("custom_init_trim error ret: %d", afl->stage_max);
   if (afl->not_on_tty && afl->debug)
     SAYF("[Custom Trimming] START: Max %d iterations, %u bytes", afl->stage_max,
          q->len);
@@ -273,7 +274,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
       /* Tell the custom mutator that the trimming was unsuccessful */
       afl->stage_cur =
           afl->mutator->afl_custom_post_trim(afl->mutator->data, 0);
-      if (unlikely(afl->stage_cur < 0)) FATAL("Error ret in custom_post_trim: %d", afl->stage_cur);
+      if (unlikely(afl->stage_cur < 0))
+        FATAL("Error ret in custom_post_trim: %d", afl->stage_cur);
       if (afl->not_on_tty && afl->debug)
         SAYF("[Custom Trimming] FAILURE: %d/%d iterations", afl->stage_cur,
              afl->stage_max);
-- 
cgit 1.4.1


From 7c383094d92af16cf610a7c58cc0e7fbd701ff40 Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Mon, 30 Mar 2020 16:01:29 +0200
Subject: added unittest for unit_maybe_alloc

---
 Makefile                          |  19 ++++--
 include/alloc-inl.h               |  31 +++++++++
 test/unittests/unit_maybe_alloc.c | 140 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 184 insertions(+), 6 deletions(-)
 create mode 100644 test/unittests/unit_maybe_alloc.c

(limited to 'include/alloc-inl.h')

diff --git a/Makefile b/Makefile
index fed33d57..2e4a6570 100644
--- a/Makefile
+++ b/Makefile
@@ -3,13 +3,13 @@
 # -----------------------------
 #
 # Originally written by Michal Zalewski
-# 
+#
 # Copyright 2013, 2014, 2015, 2016, 2017 Google Inc. All rights reserved.
-# 
+#
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at:
-# 
+#
 #   http://www.apache.org/licenses/LICENSE-2.0
 #
 
@@ -311,13 +311,20 @@ afl-gotcpu: src/afl-gotcpu.c $(COMM_HDR) | test_x86
 document: $(COMM_HDR) include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o | test_x86
 	$(CC) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) $(CFLAGS_FLTO) $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o -o afl-fuzz-document $(PYFLAGS) $(LDFLAGS)
 
+test/unittests/unit_maybe_alloc.o : $(COMM_HDR) include/alloc-inl.h test/unittests/unit_maybe_alloc.c $(AFL_FUZZ_FILES)
+	$(CC) $(CFLAGS) $(CFLAGS_FLTO) -c test/unittests/unit_maybe_alloc.c -o test/unittests/unit_maybe_alloc.o
+
+unit_maybe_alloc: test/unittests/unit_maybe_alloc.o
+	$(CC) $(CFLAGS) -lcmocka -Wl,--wrap=exit -Wl,--wrap=printf $(LDFLAGS) test/unittests/unit_maybe_alloc.o -o test/unittests/unit_maybe_alloc
+	./test/unittests/unit_maybe_alloc
 
+unit: unit_maybe_alloc
 
 code-format:
 	./.custom-format.py -i src/*.c
 	./.custom-format.py -i include/*.h
-	./.custom-format.py -i libdislocator/*.c 
-	./.custom-format.py -i libtokencap/*.c 
+	./.custom-format.py -i libdislocator/*.c
+	./.custom-format.py -i libtokencap/*.c
 	./.custom-format.py -i llvm_mode/*.c
 	./.custom-format.py -i llvm_mode/*.h
 	./.custom-format.py -i llvm_mode/*.cc
@@ -364,7 +371,7 @@ all_done: test_build
 .NOTPARALLEL: clean
 
 clean:
-	rm -f $(PROGS) libradamsa.so afl-fuzz-document afl-as as afl-g++ afl-clang afl-clang++ *.o src/*.o *~ a.out core core.[1-9][0-9]* *.stackdump .test .test1 .test2 test-instr .test-instr0 .test-instr1 qemu_mode/qemu-3.1.1.tar.xz afl-qemu-trace afl-gcc-fast afl-gcc-pass.so afl-gcc-rt.o afl-g++-fast ld *.so *.8
+	rm -f $(PROGS) libradamsa.so afl-fuzz-document afl-as as afl-g++ afl-clang afl-clang++ *.o src/*.o *~ a.out core core.[1-9][0-9]* *.stackdump .test .test1 .test2 test-instr .test-instr0 .test-instr1 qemu_mode/qemu-3.1.1.tar.xz afl-qemu-trace afl-gcc-fast afl-gcc-pass.so afl-gcc-rt.o afl-g++-fast ld *.so *.8 test/unittests/*.o test/unittests/unit_maybe_alloc
 	rm -rf out_dir qemu_mode/qemu-3.1.1 *.dSYM */*.dSYM
 	-$(MAKE) -C llvm_mode clean
 	-$(MAKE) -C gcc_plugin clean
diff --git a/include/alloc-inl.h b/include/alloc-inl.h
index 4211e398..47a16bb8 100644
--- a/include/alloc-inl.h
+++ b/include/alloc-inl.h
@@ -784,6 +784,35 @@ static inline size_t next_pow2(size_t in) {
 
 }
 
+/* This function makes sure *size is > size_needed after call.
+ It will realloc *buf otherwise.
+ *size will grow exponentially as per:
+ https://blog.mozilla.org/nnethercote/2014/11/04/please-grow-your-buffers-exponentially/
+ Will return NULL and free *buf if size_needed is <1 or realloc failed.
+ @return For convenience, this function returns *buf.
+ */
+static inline void *maybe_grow(void **buf, size_t *size, size_t size_needed) {
+
+  /* No need to realloc */
+  if (likely(size_needed && *size >= size_needed)) return *buf;
+
+  /* No initial size was set */
+  if (size_needed < INITIAL_GROWTH_SIZE) size_needed = INITIAL_GROWTH_SIZE;
+
+  /* grow exponentially */
+  size_t next_size = next_pow2(size_needed);
+
+  /* handle overflow and zero size_needed */
+  if (!next_size) { next_size = size_needed; }
+
+  /* alloc */
+  *buf = realloc(*buf, next_size);
+  *size = *buf ? next_size : 0;
+
+  return *buf;
+
+}
+
 /* This function makes sure *size is > size_needed after call.
  It will realloc *buf otherwise.
  *size will grow exponentially as per:
@@ -817,6 +846,8 @@ static inline void *ck_maybe_grow(void **buf, size_t *size,
 
 }
 
+
+
 /* Swaps buf1 ptr and buf2 ptr, as well as their sizes */
 static inline void swap_bufs(void **buf1, size_t *size1, void **buf2,
                              size_t *size2) {
diff --git a/test/unittests/unit_maybe_alloc.c b/test/unittests/unit_maybe_alloc.c
new file mode 100644
index 00000000..93f10889
--- /dev/null
+++ b/test/unittests/unit_maybe_alloc.c
@@ -0,0 +1,140 @@
+#include <stdarg.h>
+#include <stddef.h>
+#include <setjmp.h>
+#include <assert.h>
+#include <cmocka.h>
+
+extern void mock_assert(const int result, const char* const expression,
+                        const char * const file, const int line);
+#undef assert
+#define assert(expression) \
+    mock_assert((int)(expression), #expression, __FILE__, __LINE__);
+#include "alloc-inl.h"
+
+/* remap exit -> assert, then use cmocka's mock_assert
+    (compile with `--wrap=exit`) */
+extern void exit(int status);
+extern void __real_exit(int status);
+void __wrap_exit(int status) {
+    assert(0);
+}
+
+/* ignore all printfs */
+extern int printf(const char *format, ...);
+extern int __real_printf(const char *format, ...);
+int __wrap_printf(const char *format, ...) {
+    return 1;
+}
+
+#define BUF_PARAMS (void **)&buf, &size
+
+static int setup(void **state) {
+
+    return 0;
+
+}
+
+static void test_null_allocs(void **state) {
+
+    void *buf = NULL;
+    size_t size = 0;
+    void *ptr = ck_maybe_grow(BUF_PARAMS, 100);
+    assert_true(buf == ptr);
+    assert_true(size >= 100);
+    ck_free(ptr);
+
+}
+
+static void test_nonpow2_size(void **state) {
+
+    char *buf = ck_alloc(150);
+    size_t size = 150;
+    buf[140] = '5';
+    char *ptr = ck_maybe_grow(BUF_PARAMS, 160);
+    assert_ptr_equal(buf, ptr);
+    assert_true(size >= 160);
+    assert_true(buf[140] == '5');
+    ck_free(ptr);
+
+}
+
+static void test_zero_size() {
+
+    char *buf = NULL;
+    size_t size = 0;
+    //assert_non_null(maybe_grow(BUF_PARAMS, 0));
+    free(buf);
+    buf = NULL;
+    size = 0;
+
+    char *ptr = ck_maybe_grow(BUF_PARAMS, 100);
+    assert_non_null(ptr);
+    assert_ptr_equal(buf, ptr);
+    assert_true(size >= 100);
+
+    expect_assert_failure(ck_maybe_grow(BUF_PARAMS, 0));
+
+}
+
+static void test_unchanged_size(void **state) {
+
+    void *buf = ck_alloc(100);
+    size_t size = 100;
+    void *buf_before = buf;
+    void *buf_after = ck_maybe_grow(BUF_PARAMS, 100);
+    assert_ptr_equal(buf, buf_after);
+    assert_ptr_equal(buf_after, buf_before);
+    ck_free(buf);
+
+}
+
+static void test_grow_multiple(void **state) {
+
+    char *buf = NULL;
+    size_t size = 0;
+
+    char *ptr = ck_maybe_grow(BUF_PARAMS, 100);
+    assert_ptr_equal(ptr, buf);
+    assert_true(size >= 100);
+    assert_int_equal(size, next_pow2(size));
+    buf[50] = '5';
+
+    ptr = (char *)ck_maybe_grow(BUF_PARAMS, 1000);
+    assert_ptr_equal(ptr, buf);
+    assert_true(size >= 100);
+    assert_int_equal(size, next_pow2(size));
+    buf[500] = '5';
+
+    ptr = (char *)ck_maybe_grow(BUF_PARAMS, 10000);
+    assert_ptr_equal(ptr, buf);
+    assert_true(size >= 10000);
+    assert_int_equal(size, next_pow2(size));
+    buf[5000] = '5';
+
+    assert_int_equal(buf[50], '5');
+    assert_int_equal(buf[500], '5');
+    assert_int_equal(buf[5000], '5');
+
+    ck_free(buf);
+
+}
+
+static int teardown(void **state) {
+
+    return 0;
+
+}
+
+int main(int argc, char **argv) {
+
+	const struct CMUnitTest tests[] = {
+		cmocka_unit_test(test_null_allocs),
+		cmocka_unit_test(test_nonpow2_size),
+		cmocka_unit_test(test_zero_size),
+        cmocka_unit_test(test_unchanged_size),
+        cmocka_unit_test(test_grow_multiple),
+	};
+
+    return cmocka_run_group_tests (tests, setup, teardown);
+
+}
\ No newline at end of file
-- 
cgit 1.4.1


From 376b45c199ffd91941ceb8d7f56e0a98badebba2 Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Mon, 30 Mar 2020 16:07:25 +0200
Subject: code format

---
 include/alloc-inl.h | 2 --
 1 file changed, 2 deletions(-)

(limited to 'include/alloc-inl.h')

diff --git a/include/alloc-inl.h b/include/alloc-inl.h
index 47a16bb8..89889cc5 100644
--- a/include/alloc-inl.h
+++ b/include/alloc-inl.h
@@ -846,8 +846,6 @@ static inline void *ck_maybe_grow(void **buf, size_t *size,
 
 }
 
-
-
 /* Swaps buf1 ptr and buf2 ptr, as well as their sizes */
 static inline void swap_bufs(void **buf1, size_t *size1, void **buf2,
                              size_t *size2) {
-- 
cgit 1.4.1