From 17cbb03ba7d4fc0eb3b3b47911c58e25b567e89b Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 9 Feb 2021 09:18:24 +0100
Subject: more cmplog options in config.h

---
 include/config.h | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

(limited to 'include/config.h')

diff --git a/include/config.h b/include/config.h
index 60872785..25fa1142 100644
--- a/include/config.h
+++ b/include/config.h
@@ -36,17 +36,23 @@
 
 /* CMPLOG/REDQUEEN TUNING
  *
- * Here you can tuning and solving options for cmplog.
+ * Here you can modify tuning and solving options for CMPLOG.
  * Note that these are run-time options for afl-fuzz, no target
  * recompilation required.
  *
  */
 
+/* Enable arithmetic compare solving for both path */
+#define CMPLOG_SOLVE_ARITHMETIC
+
 /* Enable transform following (XOR/ADD/SUB manipulations, hex en/decoding) */
-// #define CMPLOG_TRANSFORM
+#define CMPLOG_SOLVE_TRANSFORM
 
 /* if TRANSFORM is enabled, this additionally enables base64 en/decoding */
-// #define CMPLOG_TRANSFORM_BASE64
+// #define CMPLOG_SOLVE_TRANSFORM_BASE64
+
+/* If a redqueen pass finds more than one solve, try to combine them? */
+#define CMPLOG_COMBINE
 
 /* Minimum % of the corpus to perform cmplog on. Default: 20% */
 #define CMPLOG_CORPUS_PERCENT 20U
-- 
cgit 1.4.1


From 756206e4d710b954759eaa97c50940825eff39f7 Mon Sep 17 00:00:00 2001
From: hexcoder <hexcoder-@users.noreply.github.com>
Date: Thu, 11 Feb 2021 20:26:02 +0100
Subject: typo

---
 include/config.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'include/config.h')

diff --git a/include/config.h b/include/config.h
index 25fa1142..181285cd 100644
--- a/include/config.h
+++ b/include/config.h
@@ -10,7 +10,7 @@
                      Dominik Maier <mail@dmnk.co>
 
    Copyright 2016, 2017 Google Inc. All rights reserved.
-   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+   Copyright 2019-2021 AFLplusplus Project. All rights reserved.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
@@ -57,7 +57,7 @@
 /* Minimum % of the corpus to perform cmplog on. Default: 20% */
 #define CMPLOG_CORPUS_PERCENT 20U
 
-/* Number of potential posititions from which we decide the cmplog becomes
+/* Number of potential positions from which we decide if cmplog becomes
    useless, default 16384 */
 #define CMPLOG_POSITIONS_MAX 16384U
 
-- 
cgit 1.4.1


From 938512a6b9451000f40491b2554b5d360840cfe5 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 17 Feb 2021 09:48:04 +0100
Subject: minor fixes

---
 include/config.h                    |  4 ++--
 include/envs.h                      |  1 +
 instrumentation/afl-compiler-rt.o.c |  2 +-
 qemu_mode/README.md                 | 22 ++++++++++------------
 qemu_mode/qemuafl                   |  2 +-
 5 files changed, 15 insertions(+), 16 deletions(-)

(limited to 'include/config.h')

diff --git a/include/config.h b/include/config.h
index 181285cd..9f7db04d 100644
--- a/include/config.h
+++ b/include/config.h
@@ -42,7 +42,7 @@
  *
  */
 
-/* Enable arithmetic compare solving for both path */
+/* Enable arithmetic compare solving for both branches */
 #define CMPLOG_SOLVE_ARITHMETIC
 
 /* Enable transform following (XOR/ADD/SUB manipulations, hex en/decoding) */
@@ -51,7 +51,7 @@
 /* if TRANSFORM is enabled, this additionally enables base64 en/decoding */
 // #define CMPLOG_SOLVE_TRANSFORM_BASE64
 
-/* If a redqueen pass finds more than one solve, try to combine them? */
+/* If a redqueen pass finds more than one solution, try to combine them? */
 #define CMPLOG_COMBINE
 
 /* Minimum % of the corpus to perform cmplog on. Default: 20% */
diff --git a/include/envs.h b/include/envs.h
index 4313e053..143979c6 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -131,6 +131,7 @@ static char *afl_environment_variables[] = {
     "AFL_QEMU_DEBUG_MAPS",
     "AFL_QEMU_DISABLE_CACHE",
     "AFL_QEMU_DRIVER_NO_HOOK",
+    "AFL_QEMU_FORCE_DFL",
     "AFL_QEMU_PERSISTENT_ADDR",
     "AFL_QEMU_PERSISTENT_CNT",
     "AFL_QEMU_PERSISTENT_GPR",
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 5fb715e2..dba4dc65 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1090,7 +1090,7 @@ __attribute__((constructor(0))) void __afl_auto_first(void) {
   if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
   u8 *ptr;
 
-  ptr = (u8 *)malloc(2097152);
+  ptr = (u8 *)malloc(MAP_INITIAL_SIZE);
 
   if (ptr && (ssize_t)ptr != -1) {
 
diff --git a/qemu_mode/README.md b/qemu_mode/README.md
index 9818846d..bc4c1d2c 100644
--- a/qemu_mode/README.md
+++ b/qemu_mode/README.md
@@ -17,7 +17,7 @@ The idea and much of the initial implementation comes from Andrew Griffiths.
 The actual implementation on current QEMU (shipped as qemuafl) is from
 Andrea Fioraldi. Special thanks to abiondo that re-enabled TCG chaining.
 
-## 2) How to use
+## 2) How to use qemu_mode
 
 The feature is implemented with a patched QEMU. The simplest way
 to build it is to run ./build_qemu_support.sh. The script will download,
@@ -176,7 +176,12 @@ Comparative measurements of execution speed or instrumentation coverage will be
 fairly meaningless if the optimization levels or instrumentation scopes don't
 match.
 
-## 12) Gotchas, feedback, bugs
+## 12) Other features
+
+With `AFL_QEMU_FORCE_DFL` you force QEMU to ignore the registered signal
+handlers of the target.
+
+## 13) Gotchas, feedback, bugs
 
 If you need to fix up checksums or do other cleanup on mutated test cases, see
 utils/custom_mutators/ for a viable solution.
@@ -197,19 +202,12 @@ with -march=core2, can help.
 Beyond that, this is an early-stage mechanism, so fields reports are welcome.
 You can send them to <afl-users@googlegroups.com>.
 
-## 13) Alternatives: static rewriting
+## 14) Alternatives: static rewriting
 
 Statically rewriting binaries just once, instead of attempting to translate
 them at run time, can be a faster alternative. That said, static rewriting is
 fraught with peril, because it depends on being able to properly and fully model
 program control flow without actually executing each and every code path.
 
-The best implementation is this one:
-
-  https://github.com/vanhauser-thc/afl-dyninst
-
-The issue however is Dyninst which is not rewriting the binaries so that
-they run stable. A lot of crashes happen, especially in C++ programs that
-use throw/catch. Try it first, and if it works for you be happy as it is
-2-3x as fast as qemu_mode, however usually not as fast as QEMU persistent mode.
-
+Checkout the "Fuzzing binary-only targets" section in our main README.md and
+the docs/binaryonly_fuzzing.md document for more information and hints.
diff --git a/qemu_mode/qemuafl b/qemu_mode/qemuafl
index 9a258d5b..213f3b27 160000
--- a/qemu_mode/qemuafl
+++ b/qemu_mode/qemuafl
@@ -1 +1 @@
-Subproject commit 9a258d5b7a38c045a6e385fcfcf80a746a60e557
+Subproject commit 213f3b27dd099ef352181c48cd75c0f20a73e3f0
-- 
cgit 1.4.1


From 974aab6cf6aa4ae34ee73bdceed1bd44a212fc5e Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sun, 21 Feb 2021 17:53:09 +0100
Subject: cmplog config.h -> -l option

---
 include/afl-fuzz.h      |  1 +
 include/config.h        |  9 ++----
 src/afl-common.c        |  8 ++---
 src/afl-fuzz-redqueen.c | 83 +++++++++++++++++++++++++------------------------
 src/afl-fuzz.c          | 46 ++++++++++++++++++++-------
 5 files changed, 85 insertions(+), 62 deletions(-)

(limited to 'include/config.h')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 1d5ec1f0..10d94fed 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -649,6 +649,7 @@ typedef struct afl_state {
   u32 cmplog_max_filesize;
   u32 cmplog_lvl;
   u32 colorize_success;
+  u8  cmplog_enable_arith, cmplog_enable_transform;
 
   struct afl_pass_stat *pass_stats;
   struct cmp_map *      orig_cmp_map;
diff --git a/include/config.h b/include/config.h
index 9f7db04d..535ce0d3 100644
--- a/include/config.h
+++ b/include/config.h
@@ -42,13 +42,8 @@
  *
  */
 
-/* Enable arithmetic compare solving for both branches */
-#define CMPLOG_SOLVE_ARITHMETIC
-
-/* Enable transform following (XOR/ADD/SUB manipulations, hex en/decoding) */
-#define CMPLOG_SOLVE_TRANSFORM
-
-/* if TRANSFORM is enabled, this additionally enables base64 en/decoding */
+/* if TRANSFORM is enabled with '-l T', this additionally enables base64
+   encoding/decoding */
 // #define CMPLOG_SOLVE_TRANSFORM_BASE64
 
 /* If a redqueen pass finds more than one solution, try to combine them? */
diff --git a/src/afl-common.c b/src/afl-common.c
index 531753c2..ce63c262 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -561,13 +561,13 @@ void print_suggested_envs(char *mispelled_env) {
   memcpy(env_name, mispelled_env + 4, env_name_len);
 
   char *seen = ck_alloc(sizeof(afl_environment_variables) / sizeof(char *));
-  int found = 0;
+  int   found = 0;
 
   int j;
   for (j = 0; afl_environment_variables[j] != NULL; ++j) {
 
     char *afl_env = afl_environment_variables[j] + 4;
-    int distance = string_distance_levenshtein(afl_env, env_name);
+    int   distance = string_distance_levenshtein(afl_env, env_name);
     if (distance < ENV_SIMILARITY_TRESHOLD && seen[j] == 0) {
 
       SAYF("Did you mean %s?\n", afl_environment_variables[j]);
@@ -575,14 +575,14 @@ void print_suggested_envs(char *mispelled_env) {
       found = 1;
 
     }
-  
+
   }
 
   if (found) goto cleanup;
 
   for (j = 0; afl_environment_variables[j] != NULL; ++j) {
 
-    char *afl_env = afl_environment_variables[j] + 4;
+    char * afl_env = afl_environment_variables[j] + 4;
     size_t afl_env_len = strlen(afl_env);
     char * reduced = ck_alloc(afl_env_len + 1);
 
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index d77baf25..1ab5f996 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -30,7 +30,6 @@
 
 //#define _DEBUG
 //#define CMPLOG_INTROSPECTION
-#define CMPLOG_COMBINE
 
 // CMP attribute enum
 enum {
@@ -523,7 +522,7 @@ static u8 its_fuzz(afl_state_t *afl, u8 *buf, u32 len, u8 *status) {
 
 }
 
-#ifdef CMPLOG_SOLVE_TRANSFORM
+//#ifdef CMPLOG_SOLVE_TRANSFORM
 static int strntoll(const char *str, size_t sz, char **end, int base,
                     long long *out) {
 
@@ -608,7 +607,7 @@ static int is_hex(const char *str) {
 
 }
 
-  #ifdef CMPLOG_SOLVE_TRANSFORM_BASE64
+#ifdef CMPLOG_SOLVE_TRANSFORM_BASE64
 // tests 4 bytes at location
 static int is_base64(const char *str) {
 
@@ -721,10 +720,10 @@ static void to_base64(u8 *src, u8 *dst, u32 dst_len) {
 
 }
 
-  #endif
-
 #endif
 
+//#endif
+
 static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
                               u64 pattern, u64 repl, u64 o_pattern,
                               u64 changed_val, u8 attr, u32 idx, u32 taint_len,
@@ -748,9 +747,9 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
   //         o_pattern, pattern, repl, changed_val, idx, taint_len,
   //         h->shape + 1, attr);
 
-#ifdef CMPLOG_SOLVE_TRANSFORM
+  //#ifdef CMPLOG_SOLVE_TRANSFORM
   // reverse atoi()/strnu?toll() is expensive, so we only to it in lvl 3
-  if (lvl & LVL3) {
+  if (afl->cmplog_enable_transform && (lvl & LVL3)) {
 
     u8 *               endptr;
     u8                 use_num = 0, use_unum = 0;
@@ -771,11 +770,11 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
     }
 
-  #ifdef _DEBUG
+#ifdef _DEBUG
     if (idx == 0)
       fprintf(stderr, "ASCII is=%u use_num=%u use_unum=%u idx=%u %llx==%llx\n",
               afl->queue_cur->is_ascii, use_num, use_unum, idx, num, pattern);
-  #endif
+#endif
 
     // num is likely not pattern as atoi("AAA") will be zero...
     if (use_num && ((u64)num == pattern || !num)) {
@@ -1060,7 +1059,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
   }
 
-#endif
+  //#endif
 
   // we only allow this for ascii2integer (above) so leave if this is the case
   if (unlikely(pattern == o_pattern)) { return 0; }
@@ -1215,8 +1214,12 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
   //       16 = modified float, 32 = modified integer (modified = wont match
   //                                                   in original buffer)
 
-#ifdef CMPLOG_SOLVE_ARITHMETIC
-  if (lvl < LVL3 || attr == IS_TRANSFORM) { return 0; }
+  //#ifdef CMPLOG_SOLVE_ARITHMETIC
+  if (!afl->cmplog_enable_arith || lvl < LVL3 || attr == IS_TRANSFORM) {
+
+    return 0;
+
+  }
 
   if (!(attr & (IS_GREATER | IS_LESSER)) || SHAPE_BYTES(h->shape) < 4) {
 
@@ -1321,11 +1324,11 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
       double *f = (double *)&repl;
       float   g = (float)*f;
       repl_new = 0;
-  #if (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
+#if (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
       memcpy((char *)&repl_new, (char *)&g, 4);
-  #else
+#else
       memcpy(((char *)&repl_new) + 4, (char *)&g, 4);
-  #endif
+#endif
       changed_val = repl_new;
       h->shape = 3;  // modify shape
 
@@ -1380,7 +1383,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
   }
 
-#endif                                           /* CMPLOG_SOLVE_ARITHMETIC */
+  //#endif                                           /* CMPLOG_SOLVE_ARITHMETIC
 
   return 0;
 
@@ -1539,7 +1542,7 @@ static void try_to_add_to_dictN(afl_state_t *afl, u128 v, u8 size) {
   for (k = 0; k < size; ++k) {
 
   #else
-  u32 off = 16 - size;
+  u32    off = 16 - size;
   for (k = 16 - size; k < 16; ++k) {
 
   #endif
@@ -1857,9 +1860,9 @@ static u8 rtn_extend_encoding(afl_state_t *afl, u8 *pattern, u8 *repl,
 #ifndef CMPLOG_COMBINE
   (void)(cbuf);
 #endif
-#ifndef CMPLOG_SOLVE_TRANSFORM
-  (void)(changed_val);
-#endif
+  //#ifndef CMPLOG_SOLVE_TRANSFORM
+  //  (void)(changed_val);
+  //#endif
 
   u8  save[40];
   u32 saved_idx = idx, pre, from = 0, to = 0, i, j;
@@ -1939,16 +1942,16 @@ static u8 rtn_extend_encoding(afl_state_t *afl, u8 *pattern, u8 *repl,
 
   }
 
-#ifdef CMPLOG_SOLVE_TRANSFORM
+  //#ifdef CMPLOG_SOLVE_TRANSFORM
 
   if (*status == 1) return 0;
 
-  if (lvl & LVL3) {
+  if (afl->cmplog_enable_transform && (lvl & LVL3)) {
 
     u32 toupper = 0, tolower = 0, xor = 0, arith = 0, tohex = 0, fromhex = 0;
-  #ifdef CMPLOG_SOLVE_TRANSFORM_BASE64
+#ifdef CMPLOG_SOLVE_TRANSFORM_BASE64
     u32 tob64 = 0, fromb64 = 0;
-  #endif
+#endif
     u32 from_0 = 0, from_x = 0, from_X = 0, from_slash = 0, from_up = 0;
     u32 to_0 = 0, to_x = 0, to_slash = 0, to_up = 0;
     u8  xor_val[32], arith_val[32], tmp[48];
@@ -2044,7 +2047,7 @@ static u8 rtn_extend_encoding(afl_state_t *afl, u8 *pattern, u8 *repl,
 
       }
 
-  #ifdef CMPLOG_SOLVE_TRANSFORM_BASE64
+#ifdef CMPLOG_SOLVE_TRANSFORM_BASE64
       if (i % 3 == 2 && i < 24) {
 
         if (is_base64(repl + ((i / 3) << 2))) tob64 += 3;
@@ -2057,7 +2060,7 @@ static u8 rtn_extend_encoding(afl_state_t *afl, u8 *pattern, u8 *repl,
 
       }
 
-  #endif
+#endif
 
       if ((o_pattern[i] ^ orig_buf[idx + i]) == xor_val[i] && xor_val[i]) {
 
@@ -2085,20 +2088,20 @@ static u8 rtn_extend_encoding(afl_state_t *afl, u8 *pattern, u8 *repl,
 
       }
 
-  #ifdef _DEBUG
+#ifdef _DEBUG
       fprintf(stderr,
               "RTN idx=%u loop=%u xor=%u arith=%u tolower=%u toupper=%u "
               "tohex=%u fromhex=%u to_0=%u to_slash=%u to_x=%u "
               "from_0=%u from_slash=%u from_x=%u\n",
               idx, i, xor, arith, tolower, toupper, tohex, fromhex, to_0,
               to_slash, to_x, from_0, from_slash, from_x);
-    #ifdef CMPLOG_SOLVE_TRANSFORM_BASE64
+  #ifdef CMPLOG_SOLVE_TRANSFORM_BASE64
       fprintf(stderr, "RTN idx=%u loop=%u tob64=%u from64=%u\n", tob64,
               fromb64);
-    #endif
   #endif
+#endif
 
-  #ifdef CMPLOG_SOLVE_TRANSFORM_BASE64
+#ifdef CMPLOG_SOLVE_TRANSFORM_BASE64
       // input is base64 and converted to binary? convert repl to base64!
       if ((i % 4) == 3 && i < 24 && fromb64 > i) {
 
@@ -2121,7 +2124,7 @@ static u8 rtn_extend_encoding(afl_state_t *afl, u8 *pattern, u8 *repl,
 
       }
 
-  #endif
+#endif
 
       // input is converted to hex? convert repl to binary!
       if (i < 16 && tohex > i) {
@@ -2250,16 +2253,16 @@ static u8 rtn_extend_encoding(afl_state_t *afl, u8 *pattern, u8 *repl,
 
       }
 
-  #ifdef CMPLOG_COMBINE
+#ifdef CMPLOG_COMBINE
       if (*status == 1) { memcpy(cbuf + idx, &buf[idx], i + 1); }
-  #endif
+#endif
 
       if ((i >= 7 &&
            (i >= xor&&i >= arith &&i >= tolower &&i >= toupper &&i > tohex &&i >
                 (fromhex + from_0 + from_x + from_slash + 1)
-  #ifdef CMPLOG_SOLVE_TRANSFORM_BASE64
+#ifdef CMPLOG_SOLVE_TRANSFORM_BASE64
             && i > tob64 + 3 && i > fromb64 + 4
-  #endif
+#endif
             )) ||
           repl[i] != changed_val[i] || *status == 1) {
 
@@ -2273,7 +2276,7 @@ static u8 rtn_extend_encoding(afl_state_t *afl, u8 *pattern, u8 *repl,
 
   }
 
-#endif
+  //#endif
 
   return 0;
 
@@ -2606,9 +2609,9 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
 
     } else if ((lvl & LVL1)
 
-#ifdef CMPLOG_SOLVE_TRANSFORM
-               || (lvl & LVL3)
-#endif
+               //#ifdef CMPLOG_SOLVE_TRANSFORM
+               || ((lvl & LVL3) && afl->cmplog_enable_transform)
+               //#endif
     ) {
 
       if (unlikely(rtn_fuzz(afl, k, orig_buf, buf, cbuf, len, lvl, taint))) {
@@ -2689,7 +2692,7 @@ exit_its:
   #else
     u32 *v = (u32 *)afl->virgin_bits;
     u32 *s = (u32 *)virgin_save;
-    u32 i;
+    u32  i;
     for (i = 0; i < (afl->shm.map_size >> 2); i++) {
 
       v[i] &= s[i];
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index e3e9007d..e2db029d 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -103,7 +103,8 @@ static void usage(u8 *argv0, int more_help) {
       "                  quad -- see docs/power_schedules.md\n"
       "  -f file       - location read by the fuzzed program (default: stdin "
       "or @@)\n"
-      "  -t msec       - timeout for each run (auto-scaled, 50-... ms, default %u ms)\n"
+      "  -t msec       - timeout for each run (auto-scaled, 50-... ms, default "
+      "%u ms)\n"
       "                  add a '+' to skip over seeds running longer.\n"
       "  -m megs       - memory limit for child process (%u MB, 0 = no limit "
       "[default])\n"
@@ -123,10 +124,10 @@ static void usage(u8 *argv0, int more_help) {
       "  -c program    - enable CmpLog by specifying a binary compiled for "
       "it.\n"
       "                  if using QEMU, just use -c 0.\n"
-      "  -l cmplog_level - set the complexity/intensivity of CmpLog.\n"
-      "                  Values: 1 (basic), 2 (larger files) and 3 "
-      "(transform)\n\n"
-
+      "  -l cmplog_opts - CmpLog configuration values (e.g. \"2AT\"):\n"
+      "                  1=small files (default), 2=larger files, 3=all "
+      "files,\n"
+      "                  A=arithmetic solving, T=tranformational solving.\n\n"
       "Fuzzing behavior settings:\n"
       "  -Z            - sequential queue selection instead of weighted "
       "random\n"
@@ -813,13 +814,36 @@ int main(int argc, char **argv_orig, char **envp) {
 
       case 'l': {
 
-        if (optarg) { afl->cmplog_lvl = atoi(optarg); }
-        if (afl->cmplog_lvl < 1 || afl->cmplog_lvl > CMPLOG_LVL_MAX) {
+        if (!optarg) { FATAL("missing parameter for 'l'"); }
+        char *c = optarg;
+        while (*c) {
 
-          FATAL(
-              "Bad complog level value, accepted values are 1 (default), 2 and "
-              "%u.",
-              CMPLOG_LVL_MAX);
+          switch (*c) {
+
+            case '0':
+            case '1':
+              afl->cmplog_lvl = 1;
+              break;
+            case '2':
+              afl->cmplog_lvl = 2;
+              break;
+            case '3':
+              afl->cmplog_lvl = 3;
+              break;
+            case 'a':
+            case 'A':
+              afl->cmplog_enable_arith = 1;
+              break;
+            case 't':
+            case 'T':
+              afl->cmplog_enable_transform = 1;
+              break;
+            default:
+              FATAL("Unknown option value '%c' in -l %s", *c, optarg);
+
+          }
+
+          ++c;
 
         }
 
-- 
cgit 1.4.1


From fb2a6b6941ffb6cf575d2a772c6e0d47b49835ee Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 22 Feb 2021 16:56:35 +0100
Subject: minimum sync time

---
 docs/Changelog.md  |  1 +
 include/afl-fuzz.h |  1 +
 include/config.h   |  5 +++++
 src/afl-fuzz-run.c |  2 ++
 src/afl-fuzz.c     | 15 ++++++++++++---
 5 files changed, 21 insertions(+), 3 deletions(-)

(limited to 'include/config.h')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index a006fccb..d8587334 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -35,6 +35,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - fixed a few crashes
     - switched to an even faster RNG
     - added hghwng's patch for faster trace map analysis
+    - added minimum SYNC_TIME to include/config.h (30 minutes default)
   - afl-cc
     - allow instrumenting LLVMFuzzerTestOneInput
     - fixed endless loop for allow/blocklist lines starting with a
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 10d94fed..e191543a 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -570,6 +570,7 @@ typedef struct afl_state {
       blocks_eff_total,                 /* Blocks subject to effector maps  */
       blocks_eff_select,                /* Blocks selected as fuzzable      */
       start_time,                       /* Unix start time (ms)             */
+      last_sync_time,			/* Time of last sync                */
       last_path_time,                   /* Time for most recent path (ms)   */
       last_crash_time,                  /* Time for most recent crash (ms)  */
       last_hang_time;                   /* Time for most recent hang (ms)   */
diff --git a/include/config.h b/include/config.h
index 535ce0d3..083cad23 100644
--- a/include/config.h
+++ b/include/config.h
@@ -280,6 +280,11 @@
 
 #define SYNC_INTERVAL 8
 
+/* Sync time (minimum time between syncing in ms, time is halfed for -M main
+   nodes): */
+
+#define SYNC_TIME 18000000LLU  /* 18000000 = 30 minutes */
+
 /* Output directory reuse grace period (minutes): */
 
 #define OUTPUT_GRACE 25
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 97cb7415..0b84a542 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -707,6 +707,8 @@ void sync_fuzzers(afl_state_t *afl) {
 
   if (afl->foreign_sync_cnt) read_foreign_testcases(afl, 0);
 
+  afl->last_sync_time = get_cur_time();
+
 }
 
 /* Trim all new test cases to save cycles when doing deterministic checks. The
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 9137dc23..f83aac9e 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1986,15 +1986,24 @@ int main(int argc, char **argv_orig, char **envp) {
 
         if (unlikely(afl->is_main_node)) {
 
-          if (!(sync_interval_cnt++ % (SYNC_INTERVAL / 3))) {
+          if (unlikely(get_cur_time() >
+                       (SYNC_TIME >> 1) + afl->last_sync_time)) {
 
-            sync_fuzzers(afl);
+            if (!(sync_interval_cnt++ % (SYNC_INTERVAL / 3))) {
+
+              sync_fuzzers(afl);
+
+            }
 
           }
 
         } else {
 
-          if (!(sync_interval_cnt++ % SYNC_INTERVAL)) { sync_fuzzers(afl); }
+          if (unlikely(get_cur_time() > SYNC_TIME + afl->last_sync_time)) {
+
+            if (!(sync_interval_cnt++ % SYNC_INTERVAL)) { sync_fuzzers(afl); }
+
+          }
 
         }
 
-- 
cgit 1.4.1


From 4ab90e739ff4410f24c63d71dfffe333063c3b3a Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 22 Feb 2021 22:24:59 +0100
Subject: code format

---
 include/afl-fuzz.h | 2 +-
 include/config.h   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'include/config.h')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index e191543a..d9dbad5a 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -570,7 +570,7 @@ typedef struct afl_state {
       blocks_eff_total,                 /* Blocks subject to effector maps  */
       blocks_eff_select,                /* Blocks selected as fuzzable      */
       start_time,                       /* Unix start time (ms)             */
-      last_sync_time,			/* Time of last sync                */
+      last_sync_time,                   /* Time of last sync                */
       last_path_time,                   /* Time for most recent path (ms)   */
       last_crash_time,                  /* Time for most recent crash (ms)  */
       last_hang_time;                   /* Time for most recent hang (ms)   */
diff --git a/include/config.h b/include/config.h
index 083cad23..241b2e69 100644
--- a/include/config.h
+++ b/include/config.h
@@ -283,7 +283,7 @@
 /* Sync time (minimum time between syncing in ms, time is halfed for -M main
    nodes): */
 
-#define SYNC_TIME 18000000LLU  /* 18000000 = 30 minutes */
+#define SYNC_TIME 18000000LLU                      /* 18000000 = 30 minutes */
 
 /* Output directory reuse grace period (minutes): */
 
-- 
cgit 1.4.1


From 564f4915665c8a68a97d71b7db812606ddec8c5b Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 24 Feb 2021 09:29:19 +0100
Subject: redqueen settings opt

---
 include/config.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'include/config.h')

diff --git a/include/config.h b/include/config.h
index 241b2e69..d2e9f889 100644
--- a/include/config.h
+++ b/include/config.h
@@ -50,14 +50,14 @@
 #define CMPLOG_COMBINE
 
 /* Minimum % of the corpus to perform cmplog on. Default: 20% */
-#define CMPLOG_CORPUS_PERCENT 20U
+#define CMPLOG_CORPUS_PERCENT 10U
 
 /* Number of potential positions from which we decide if cmplog becomes
    useless, default 16384 */
 #define CMPLOG_POSITIONS_MAX 16384U
 
 /* Maximum allowed fails per CMP value. Default: 32 * 3 */
-#define CMPLOG_FAIL_MAX 96
+#define CMPLOG_FAIL_MAX 128
 
 /* Now non-cmplog configuration options */
 
-- 
cgit 1.4.1


From e6ef2ee338d1da1d5fa8e23822247ee7837e1f54 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 24 Feb 2021 12:14:10 +0100
Subject: typo

---
 include/config.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'include/config.h')

diff --git a/include/config.h b/include/config.h
index d2e9f889..1c3370ad 100644
--- a/include/config.h
+++ b/include/config.h
@@ -281,9 +281,9 @@
 #define SYNC_INTERVAL 8
 
 /* Sync time (minimum time between syncing in ms, time is halfed for -M main
-   nodes): */
+   nodes) - default is 30 minutes: */
 
-#define SYNC_TIME 18000000LLU                      /* 18000000 = 30 minutes */
+#define SYNC_TIME (30 * 60 * 1000)
 
 /* Output directory reuse grace period (minutes): */
 
-- 
cgit 1.4.1


From 5d181950eb48afa6f86bd4455fb9f55b09f5eb19 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 24 Feb 2021 21:17:58 +0100
Subject: fixes

---
 README.md        | 6 +++---
 include/config.h | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

(limited to 'include/config.h')

diff --git a/README.md b/README.md
index 59b1c143..0539752c 100644
--- a/README.md
+++ b/README.md
@@ -1170,12 +1170,12 @@ Thank you!
 
 ## Cite
 
-If you use AFLplusplus in scientific work, consider citing [our paper](https://www.usenix.org/conference/woot20/presentation/fioraldi) presented at WOOT'20:
-
 If you use AFLpluplus to compare to your work, please use either `afl-clang-lto`
 or `afl-clang-fast` with `AFL_LLVM_CMPLOG=1` for building targets and
 `afl-fuzz` with the command line option `-l 2` for fuzzing.
-The most effective setup is the `aflplusplus` default fuzzer on Google's fuzzbench.
+The most effective setup is the `aflplusplus` default configuration on Google's [fuzzbench](https://github.com/google/fuzzbench/tree/master/fuzzers/aflplusplus).
+
+If you use AFLplusplus in scientific work, consider citing [our paper](https://www.usenix.org/conference/woot20/presentation/fioraldi) presented at WOOT'20:
 
 + Andrea Fioraldi, Dominik Maier, Heiko Eißfeldt, and Marc Heuse. “AFL++: Combining incremental steps of fuzzing research”. In 14th USENIX Workshop on Offensive Technologies (WOOT 20). USENIX Association, Aug. 2020.
 
diff --git a/include/config.h b/include/config.h
index 1c3370ad..6120dcd6 100644
--- a/include/config.h
+++ b/include/config.h
@@ -49,15 +49,15 @@
 /* If a redqueen pass finds more than one solution, try to combine them? */
 #define CMPLOG_COMBINE
 
-/* Minimum % of the corpus to perform cmplog on. Default: 20% */
+/* Minimum % of the corpus to perform cmplog on. Default: 10% */
 #define CMPLOG_CORPUS_PERCENT 10U
 
 /* Number of potential positions from which we decide if cmplog becomes
    useless, default 16384 */
 #define CMPLOG_POSITIONS_MAX 16384U
 
-/* Maximum allowed fails per CMP value. Default: 32 * 3 */
-#define CMPLOG_FAIL_MAX 128
+/* Maximum allowed fails per CMP value. Default: 96 */
+#define CMPLOG_FAIL_MAX 96
 
 /* Now non-cmplog configuration options */
 
-- 
cgit 1.4.1


From 5c239451cfd1562ce72a78eefc6886fd76f2c132 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Thu, 25 Feb 2021 09:15:45 +0100
Subject: cmplog finetuning

---
 custom_mutators/honggfuzz/honggfuzz.h | 2 +-
 include/config.h                      | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'include/config.h')

diff --git a/custom_mutators/honggfuzz/honggfuzz.h b/custom_mutators/honggfuzz/honggfuzz.h
index eb6a3f11..c80cdd87 100644
--- a/custom_mutators/honggfuzz/honggfuzz.h
+++ b/custom_mutators/honggfuzz/honggfuzz.h
@@ -39,7 +39,7 @@
 #include "libhfcommon/util.h"
 
 #define PROG_NAME    "honggfuzz"
-#define PROG_VERSION "2.3"
+#define PROG_VERSION "2.4"
 
 /* Name of the template which will be replaced with the proper name of the file */
 #define _HF_FILE_PLACEHOLDER "___FILE___"
diff --git a/include/config.h b/include/config.h
index 6120dcd6..439f4d2f 100644
--- a/include/config.h
+++ b/include/config.h
@@ -53,11 +53,11 @@
 #define CMPLOG_CORPUS_PERCENT 10U
 
 /* Number of potential positions from which we decide if cmplog becomes
-   useless, default 16384 */
-#define CMPLOG_POSITIONS_MAX 16384U
+   useless, default 8096 */
+#define CMPLOG_POSITIONS_MAX 8096U
 
-/* Maximum allowed fails per CMP value. Default: 96 */
-#define CMPLOG_FAIL_MAX 96
+/* Maximum allowed fails per CMP value. Default: 128 */
+#define CMPLOG_FAIL_MAX 128
 
 /* Now non-cmplog configuration options */
 
-- 
cgit 1.4.1


From 3a461944ecac47627d3e9d2afcf1c28925e2355a Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Fri, 26 Feb 2021 22:36:19 +0100
Subject: fine tune cmplog

---
 include/config.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'include/config.h')

diff --git a/include/config.h b/include/config.h
index 439f4d2f..b0b1f7b9 100644
--- a/include/config.h
+++ b/include/config.h
@@ -50,7 +50,7 @@
 #define CMPLOG_COMBINE
 
 /* Minimum % of the corpus to perform cmplog on. Default: 10% */
-#define CMPLOG_CORPUS_PERCENT 10U
+#define CMPLOG_CORPUS_PERCENT 5U
 
 /* Number of potential positions from which we decide if cmplog becomes
    useless, default 8096 */
-- 
cgit 1.4.1


From 0c38850f955a608529bdd02cc39dc68713ef8528 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 1 Mar 2021 09:43:35 +0100
Subject: 3.10c release

---
 README.md         | 10 +++++-----
 docs/Changelog.md | 14 +++++++-------
 include/config.h  |  4 ++--
 3 files changed, 14 insertions(+), 14 deletions(-)

(limited to 'include/config.h')

diff --git a/README.md b/README.md
index 119426f6..800c2121 100644
--- a/README.md
+++ b/README.md
@@ -2,9 +2,9 @@
 
   <img align="right" src="https://raw.githubusercontent.com/andreafioraldi/AFLplusplus-website/master/static/logo_256x256.png" alt="AFL++ Logo">
 
-  Release Version: [3.00c](https://github.com/AFLplusplus/AFLplusplus/releases)
+  Release Version: [3.10c](https://github.com/AFLplusplus/AFLplusplus/releases)
 
-  Github Version: 3.01a
+  Github Version: 3.11a
 
   Repository: [https://github.com/AFLplusplus/AFLplusplus](https://github.com/AFLplusplus/AFLplusplus)
 
@@ -25,14 +25,14 @@
   For comparisons use the fuzzbench `aflplusplus` setup, or use `afl-clang-fast`
   with `AFL_LLVM_CMPLOG=1`.
 
-## Major changes in afl++ 3.0 + 3.1
+## Major changes in afl++ 3.00 + 3.10
 
-With afl++ 3.1 we introduced the following changes from previous behaviours:
+With afl++ 3.10 we introduced the following changes from previous behaviours:
   * The '+' feature of the '-t' option now means to  auto-calculate the timeout
     with the value given being the maximum timeout. The original meaning of
     "skipping timeouts instead of abort" is now inherent to the -t option.
 
-With afl++ 3.0 we introduced changes that break some previous afl and afl++
+With afl++ 3.00 we introduced changes that break some previous afl and afl++
 behaviours and defaults:
 
   * There are no llvm_mode and gcc_plugin subdirectories anymore and there is
diff --git a/docs/Changelog.md b/docs/Changelog.md
index 192d6ee2..f3e15b6a 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -9,7 +9,7 @@ Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 
-### Version ++3.01a (dev)
+### Version ++3.10c (release)
   - Mac OS ARM64 support
   - Android support fixed and updated by Joey Jiaojg - thanks!
   - New selective instrumentation option with __AFL_COVERAGE_* commands
@@ -49,10 +49,10 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
       comment (thanks to Zherya for reporting)
     - cmplog/redqueen now also tracks floating point, _ExtInt() + 128bit
     - cmplog/redqueen can now process basic libc++ and libstdc++
-      std::string comparisons (though no position or length type variants)
-    - added support for __afl_coverage_interesting() for LTO and
-      and our own PCGUARD (llvm 10.0.1+), read more about this function
-      and selective coverage in instrumentation/README.instrument_list.md
+      std::string comparisons (no position or length type variants)
+    - added support for __afl_coverage_interesting() for LTO and our
+      own PCGUARD (llvm 10.0.1+), read more about this function and
+      selective coverage in instrumentation/README.instrument_list.md
     - added AFL_LLVM_INSTRUMENT option NATIVE for native clang pc-guard
       support (less performant than our own), GCC for old afl-gcc and
       CLANG for old afl-clang
@@ -68,12 +68,12 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
   - unicornafl
     - Substantial speed gains in python bindings for certain use cases
     - Improved rust bindings
-    - Added a new example harness to compare python, c, and rust bindings
+    - Added a new example harness to compare python, c and rust bindings
   - afl-cmin and afl-showmap now support the -f option
   - afl_plot now also generates a graph on the discovered edges
   - changed default: no memory limit for afl-cmin and afl-cmin.bash
   - warn on any _AFL and __AFL env vars.
-  - set AFL_IGNORE_UNKNOWN_ENVS to not warn on unknown AFL_... env vars.
+  - set AFL_IGNORE_UNKNOWN_ENVS to not warn on unknown AFL_... env vars
   - added dummy Makefile to instrumentation/
   - Updated utils/afl_frida to be 5% faster, 7% on x86_x64
   - Added `AFL_KILL_SIGNAL` env variable (thanks @v-p-b)
diff --git a/include/config.h b/include/config.h
index b0b1f7b9..c583f23b 100644
--- a/include/config.h
+++ b/include/config.h
@@ -25,8 +25,8 @@
 
 /* Version string: */
 
-// c = release, d = volatile github dev, e = experimental branch
-#define VERSION "++3.01a"
+// c = release, a = volatile github dev, e = experimental branch
+#define VERSION "++3.10c"
 
 /******************************************************
  *                                                    *
-- 
cgit 1.4.1


From 82c05630ba201bfc631e4e2335c6d8c2e76d91c0 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 1 Mar 2021 10:12:42 +0100
Subject: 3.11a init

---
 docs/Changelog.md | 3 +++
 include/config.h  | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

(limited to 'include/config.h')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index f3e15b6a..4e3eef16 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -8,6 +8,9 @@
 Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
+### Version ++3.11a (dev)
+  - ...
+
 
 ### Version ++3.10c (release)
   - Mac OS ARM64 support
diff --git a/include/config.h b/include/config.h
index c583f23b..a3aa9a4a 100644
--- a/include/config.h
+++ b/include/config.h
@@ -26,7 +26,7 @@
 /* Version string: */
 
 // c = release, a = volatile github dev, e = experimental branch
-#define VERSION "++3.10c"
+#define VERSION "++3.11a"
 
 /******************************************************
  *                                                    *
-- 
cgit 1.4.1


From 4bd0d4cbaf3a3de63f737ff86df5de0b809f6631 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 10 Mar 2021 15:52:27 +0100
Subject: cmplog finetuning

---
 include/config.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'include/config.h')

diff --git a/include/config.h b/include/config.h
index a3aa9a4a..6ada0fbe 100644
--- a/include/config.h
+++ b/include/config.h
@@ -54,10 +54,10 @@
 
 /* Number of potential positions from which we decide if cmplog becomes
    useless, default 8096 */
-#define CMPLOG_POSITIONS_MAX 8096U
+#define CMPLOG_POSITIONS_MAX (12 * 1024)
 
 /* Maximum allowed fails per CMP value. Default: 128 */
-#define CMPLOG_FAIL_MAX 128
+#define CMPLOG_FAIL_MAX 96
 
 /* Now non-cmplog configuration options */
 
-- 
cgit 1.4.1


From ac795ae1e154df87d422eb9a307ee1f40fcb701f Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 15 Mar 2021 23:08:28 +0100
Subject: v3.11c release

---
 README.md         | 4 ++--
 docs/Changelog.md | 4 +++-
 include/config.h  | 2 +-
 3 files changed, 6 insertions(+), 4 deletions(-)

(limited to 'include/config.h')

diff --git a/README.md b/README.md
index 0deaca22..69e5bb74 100644
--- a/README.md
+++ b/README.md
@@ -2,9 +2,9 @@
 
   <img align="right" src="https://raw.githubusercontent.com/andreafioraldi/AFLplusplus-website/master/static/logo_256x256.png" alt="AFL++ Logo">
 
-  Release Version: [3.10c](https://github.com/AFLplusplus/AFLplusplus/releases)
+  Release Version: [3.11c](https://github.com/AFLplusplus/AFLplusplus/releases)
 
-  Github Version: 3.11a
+  Github Version: 3.12a
 
   Repository: [https://github.com/AFLplusplus/AFLplusplus](https://github.com/AFLplusplus/AFLplusplus)
 
diff --git a/docs/Changelog.md b/docs/Changelog.md
index 8f3e588c..1c735a70 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -8,9 +8,11 @@
 Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
-### Version ++3.11a (dev)
+### Version ++3.11c (release)
   - afl-fuzz:
+    - better auto detection of map size
     - fix sanitizer settings (bug since 3.10c)
+    - fix an off-by-one overwrite in cmplog
     - add non-unicode variants from unicode-looking dictionary entries
     - Rust custom mutator API improvements
     - Imported crash stats painted yellow on resume (only new ones are red)
diff --git a/include/config.h b/include/config.h
index 6ada0fbe..cc8024ea 100644
--- a/include/config.h
+++ b/include/config.h
@@ -26,7 +26,7 @@
 /* Version string: */
 
 // c = release, a = volatile github dev, e = experimental branch
-#define VERSION "++3.11a"
+#define VERSION "++3.11c"
 
 /******************************************************
  *                                                    *
-- 
cgit 1.4.1


From 1dcc3549b6ecc3925825c00ac63274b83e76ec8a Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 15 Mar 2021 23:21:03 +0100
Subject: v3.12a init

---
 docs/Changelog.md | 5 ++++-
 include/config.h  | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

(limited to 'include/config.h')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 1c735a70..8222f942 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -8,6 +8,10 @@
 Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
+### Version ++3.12a (dev)
+  - ...
+
+
 ### Version ++3.11c (release)
   - afl-fuzz:
     - better auto detection of map size
@@ -38,7 +42,6 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - we no longer perform a "git drop"
   - afl-cmin: support filenames with spaces
 
-
 ### Version ++3.10c (release)
   - Mac OS ARM64 support
   - Android support fixed and updated by Joey Jiaojg - thanks!
diff --git a/include/config.h b/include/config.h
index cc8024ea..b049fee0 100644
--- a/include/config.h
+++ b/include/config.h
@@ -26,7 +26,7 @@
 /* Version string: */
 
 // c = release, a = volatile github dev, e = experimental branch
-#define VERSION "++3.11c"
+#define VERSION "++3.12a"
 
 /******************************************************
  *                                                    *
-- 
cgit 1.4.1


From 5e2a5f1110e29c36f1c41fb4677ab698c5d571c0 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 17 Mar 2021 10:26:02 +0100
Subject: shmem map size in config.h

---
 include/config.h                    |  9 ++++++
 instrumentation/afl-compiler-rt.o.c |  6 ++--
 src/afl-cc.c                        | 62 ++++++++++++++++++-------------------
 src/afl-common.c                    |  2 +-
 src/afl-fuzz.c                      | 24 +++++++++-----
 5 files changed, 60 insertions(+), 43 deletions(-)

(limited to 'include/config.h')

diff --git a/include/config.h b/include/config.h
index b049fee0..29225f6b 100644
--- a/include/config.h
+++ b/include/config.h
@@ -34,6 +34,15 @@
  *                                                    *
  ******************************************************/
 
+/* Default shared memory map size. Most targets just need a coverage map
+   between 20-250kb. Plus there is an auto-detection feature in afl-fuzz.
+   However if a target has problematic constructors and init arrays then
+   this can fail. Hence afl-fuzz deploys a larger default map. The largest
+   map seen so far is the xlsx fuzzer for libreoffice which is 5MB.
+   At runtime this value can be overriden via AFL_MAP_SIZE.
+   Default: 8MB (defined in bytes) */
+#define DEFAULT_SHMEM_SIZE (8 * 1024 * 1024)
+
 /* CMPLOG/REDQUEEN TUNING
  *
  * Here you can modify tuning and solving options for CMPLOG.
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 70148b78..c635ae63 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1774,14 +1774,14 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
   */
 
   if (unlikely(!__afl_cmp_map)) return;
-  //fprintf(stderr, "RTN1 %p %p\n", ptr1, ptr2);
+  // fprintf(stderr, "RTN1 %p %p\n", ptr1, ptr2);
   int l1, l2;
   if ((l1 = area_is_valid(ptr1, 32)) <= 0 ||
       (l2 = area_is_valid(ptr2, 32)) <= 0)
     return;
   int len = MIN(l1, l2);
 
-  //fprintf(stderr, "RTN2 %u\n", len);
+  // fprintf(stderr, "RTN2 %u\n", len);
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
@@ -1812,7 +1812,7 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
                    ptr1, len);
   __builtin_memcpy(((struct cmpfn_operands *)__afl_cmp_map->log[k])[hits].v1,
                    ptr2, len);
-  //fprintf(stderr, "RTN3\n");
+  // fprintf(stderr, "RTN3\n");
 
 }
 
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 206066fd..ebbd390c 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -959,63 +959,63 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   if (compiler_mode != GCC && compiler_mode != CLANG) {
 
-      switch (bit_mode) {
+    switch (bit_mode) {
 
-        case 0:
-          if (!shared_linking)
+      case 0:
+        if (!shared_linking)
           cc_params[cc_par_cnt++] =
               alloc_printf("%s/afl-compiler-rt.o", obj_path);
-          if (lto_mode)
-            cc_params[cc_par_cnt++] =
-                alloc_printf("%s/afl-llvm-rt-lto.o", obj_path);
-          break;
+        if (lto_mode)
+          cc_params[cc_par_cnt++] =
+              alloc_printf("%s/afl-llvm-rt-lto.o", obj_path);
+        break;
 
-        case 32:
-          if (!shared_linking)
+      case 32:
+        if (!shared_linking)
           cc_params[cc_par_cnt++] =
               alloc_printf("%s/afl-compiler-rt-32.o", obj_path);
+        if (access(cc_params[cc_par_cnt - 1], R_OK))
+          FATAL("-m32 is not supported by your compiler");
+        if (lto_mode) {
+
+          cc_params[cc_par_cnt++] =
+              alloc_printf("%s/afl-llvm-rt-lto-32.o", obj_path);
           if (access(cc_params[cc_par_cnt - 1], R_OK))
             FATAL("-m32 is not supported by your compiler");
-          if (lto_mode) {
-
-            cc_params[cc_par_cnt++] =
-                alloc_printf("%s/afl-llvm-rt-lto-32.o", obj_path);
-            if (access(cc_params[cc_par_cnt - 1], R_OK))
-              FATAL("-m32 is not supported by your compiler");
 
-          }
+        }
 
-          break;
+        break;
 
-        case 64:
-          if (!shared_linking)
+      case 64:
+        if (!shared_linking)
           cc_params[cc_par_cnt++] =
               alloc_printf("%s/afl-compiler-rt-64.o", obj_path);
+        if (access(cc_params[cc_par_cnt - 1], R_OK))
+          FATAL("-m64 is not supported by your compiler");
+        if (lto_mode) {
+
+          cc_params[cc_par_cnt++] =
+              alloc_printf("%s/afl-llvm-rt-lto-64.o", obj_path);
           if (access(cc_params[cc_par_cnt - 1], R_OK))
             FATAL("-m64 is not supported by your compiler");
-          if (lto_mode) {
 
-            cc_params[cc_par_cnt++] =
-                alloc_printf("%s/afl-llvm-rt-lto-64.o", obj_path);
-            if (access(cc_params[cc_par_cnt - 1], R_OK))
-              FATAL("-m64 is not supported by your compiler");
-
-          }
+        }
 
-          break;
+        break;
 
-      }
+    }
 
   #if !defined(__APPLE__) && !defined(__sun)
-          if (!shared_linking)
+    if (!shared_linking)
       cc_params[cc_par_cnt++] =
           alloc_printf("-Wl,--dynamic-list=%s/dynamic_list.txt", obj_path);
   #endif
 
-    }
+  }
 
   #if defined(USEMMAP) && !defined(__HAIKU__)
-    cc_params[cc_par_cnt++] = "-lrt";
+  cc_params[cc_par_cnt++] = "-lrt";
   #endif
 
 #endif
diff --git a/src/afl-common.c b/src/afl-common.c
index 27b63434..7e56ce3f 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -1072,7 +1072,7 @@ u8 *u_stringify_time_diff(u8 *buf, u64 cur_ms, u64 event_ms) {
 /* Reads the map size from ENV */
 u32 get_map_size(void) {
 
-  uint32_t map_size = 8000000;  // a very large default map
+  uint32_t map_size = DEFAULT_SHMEM_SIZE;
   char *   ptr;
 
   if ((ptr = getenv("AFL_MAP_SIZE")) || (ptr = getenv("AFL_MAPSIZE"))) {
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 2fde561c..8318a92e 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1527,11 +1527,13 @@ int main(int argc, char **argv_orig, char **envp) {
   if (!afl->non_instrumented_mode && !afl->fsrv.qemu_mode &&
       !afl->unicorn_mode) {
 
-    if (map_size <= 8000000 && !afl->non_instrumented_mode &&
+    if (map_size <= DEFAULT_SHMEM_SIZE && !afl->non_instrumented_mode &&
         !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
 
-      afl->fsrv.map_size = 8000000;  // dummy temporary value
-      setenv("AFL_MAP_SIZE", "8000000", 1);
+      afl->fsrv.map_size = DEFAULT_SHMEM_SIZE;  // dummy temporary value
+      char vbuf[16];
+      snprintf(vbuf, sizeof(vbuf), "%u", DEFAULT_SHMEM_SIZE);
+      setenv("AFL_MAP_SIZE", vbuf, 1);
 
     }
 
@@ -1582,11 +1584,13 @@ int main(int argc, char **argv_orig, char **envp) {
     afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
     afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
 
-    if (map_size <= 8000000 && !afl->non_instrumented_mode &&
+    if (map_size <= DEFAULT_SHMEM_SIZE && !afl->non_instrumented_mode &&
         !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
 
-      afl->cmplog_fsrv.map_size = 8000000;  // dummy temporary value
-      setenv("AFL_MAP_SIZE", "8000000", 1);
+      afl->fsrv.map_size = DEFAULT_SHMEM_SIZE;  // dummy temporary value
+      char vbuf[16];
+      snprintf(vbuf, sizeof(vbuf), "%u", DEFAULT_SHMEM_SIZE);
+      setenv("AFL_MAP_SIZE", vbuf, 1);
 
     }
 
@@ -1634,8 +1638,12 @@ int main(int argc, char **argv_orig, char **envp) {
   }
 
   if (afl->debug) {
-  printf("NORMAL %u, CMPLOG %u\n", afl->fsrv.map_size, afl->cmplog_fsrv.map_size);
-  fprintf(stderr, "NORMAL %u, CMPLOG %u\n", afl->fsrv.map_size, afl->cmplog_fsrv.map_size);
+
+    printf("NORMAL %u, CMPLOG %u\n", afl->fsrv.map_size,
+           afl->cmplog_fsrv.map_size);
+    fprintf(stderr, "NORMAL %u, CMPLOG %u\n", afl->fsrv.map_size,
+            afl->cmplog_fsrv.map_size);
+
   }
 
   load_auto(afl);
-- 
cgit 1.4.1


From dfe6f7f8c949744eeab7a401affde93729a5b39d Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 23 Mar 2021 20:20:59 +0100
Subject: make setting different file permissions easy via config.h

---
 docs/Changelog.md                   |  2 ++
 include/config.h                    |  3 +++
 instrumentation/afl-compiler-rt.o.c | 10 +++++-----
 src/afl-analyze.c                   |  2 +-
 src/afl-as.c                        |  2 +-
 src/afl-common.c                    |  4 ++--
 src/afl-forkserver.c                |  4 ++--
 src/afl-fuzz-bitmap.c               |  8 ++++----
 src/afl-fuzz-extras.c               |  2 +-
 src/afl-fuzz-init.c                 | 12 ++++++------
 src/afl-fuzz-mutators.c             |  2 +-
 src/afl-fuzz-queue.c                |  6 +++---
 src/afl-fuzz-run.c                  | 14 +++++++-------
 src/afl-sharedmem.c                 |  8 ++++----
 src/afl-showmap.c                   |  4 ++--
 src/afl-tmin.c                      |  4 ++--
 16 files changed, 46 insertions(+), 41 deletions(-)

(limited to 'include/config.h')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 51c8c1bc..aea95d5d 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -27,6 +27,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - add AFL_QEMU_CUSTOM_BIN
   - unicorn_mode
     - accidently removed the subfolder from github, re-added
+  - added DEFAULT_PERMISSION to config.h for all files created, default
+    to 0600
 
 ### Version ++3.11c (release)
   - afl-fuzz:
diff --git a/include/config.h b/include/config.h
index 29225f6b..3c09fce4 100644
--- a/include/config.h
+++ b/include/config.h
@@ -43,6 +43,9 @@
    Default: 8MB (defined in bytes) */
 #define DEFAULT_SHMEM_SIZE (8 * 1024 * 1024)
 
+/* Default file permission umode when creating files (default: 0600) */
+#define DEFAULT_PERMISSION 0600
+
 /* CMPLOG/REDQUEEN TUNING
  *
  * Here you can modify tuning and solving options for CMPLOG.
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index ab1bfb31..f241447a 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -204,7 +204,7 @@ static void __afl_map_shm_fuzz() {
     int         shm_fd = -1;
 
     /* create the shared memory segment as if it was a file */
-    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    shm_fd = shm_open(shm_file_path, O_RDWR, DEFAULT_PERMISSION);
     if (shm_fd == -1) {
 
       fprintf(stderr, "shm_open() failed for fuzz\n");
@@ -353,7 +353,7 @@ static void __afl_map_shm(void) {
     unsigned char *shm_base = NULL;
 
     /* create the shared memory segment as if it was a file */
-    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    shm_fd = shm_open(shm_file_path, O_RDWR, DEFAULT_PERMISSION);
     if (shm_fd == -1) {
 
       fprintf(stderr, "shm_open() failed\n");
@@ -528,7 +528,7 @@ static void __afl_map_shm(void) {
     struct cmp_map *shm_base = NULL;
 
     /* create the shared memory segment as if it was a file */
-    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    shm_fd = shm_open(shm_file_path, O_RDWR, DEFAULT_PERMISSION);
     if (shm_fd == -1) {
 
       perror("shm_open() failed\n");
@@ -729,7 +729,7 @@ static void __afl_start_snapshots(void) {
       static uint32_t counter = 0;
       char            fn[32];
       sprintf(fn, "%09u:forkserver", counter);
-      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
       if (fd_doc >= 0) {
 
         if (write(fd_doc, __afl_fuzz_ptr, *__afl_fuzz_len) != *__afl_fuzz_len) {
@@ -960,7 +960,7 @@ static void __afl_start_forkserver(void) {
       static uint32_t counter = 0;
       char            fn[32];
       sprintf(fn, "%09u:forkserver", counter);
-      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
       if (fd_doc >= 0) {
 
         if (write(fd_doc, __afl_fuzz_ptr, *__afl_fuzz_len) != *__afl_fuzz_len) {
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index 86b0f7e9..e106cd31 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -212,7 +212,7 @@ static s32 write_to_file(u8 *path, u8 *mem, u32 len) {
 
   unlink(path);                                            /* Ignore errors */
 
-  ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600);
+  ret = open(path, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   if (ret < 0) { PFATAL("Unable to create '%s'", path); }
 
diff --git a/src/afl-as.c b/src/afl-as.c
index 7de267a3..aebd0ac8 100644
--- a/src/afl-as.c
+++ b/src/afl-as.c
@@ -280,7 +280,7 @@ static void add_instrumentation(void) {
 
   }
 
-  outfd = open(modified_file, O_WRONLY | O_EXCL | O_CREAT, 0600);
+  outfd = open(modified_file, O_WRONLY | O_EXCL | O_CREAT, DEFAULT_PERMISSION);
 
   if (outfd < 0) { PFATAL("Unable to write to '%s'", modified_file); }
 
diff --git a/src/afl-common.c b/src/afl-common.c
index cd24c376..37b4788c 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -1104,7 +1104,7 @@ FILE *create_ffile(u8 *fn) {
   s32   fd;
   FILE *f;
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
   if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
 
@@ -1122,7 +1122,7 @@ s32 create_file(u8 *fn) {
 
   s32 fd;
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
   if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
 
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 68995388..b9cb48cb 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -1038,12 +1038,12 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
 
       if (unlikely(fsrv->no_unlink)) {
 
-        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
       } else {
 
         unlink(fsrv->out_file);                           /* Ignore errors. */
-        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
+        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
       }
 
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 4ed59364..3d0228db 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -42,7 +42,7 @@ void write_bitmap(afl_state_t *afl) {
   afl->bitmap_changed = 0;
 
   snprintf(fname, PATH_MAX, "%s/fuzz_bitmap", afl->out_dir);
-  fd = open(fname, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+  fd = open(fname, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
   if (fd < 0) { PFATAL("Unable to open '%s'", fname); }
 
@@ -407,7 +407,7 @@ static void write_crash_readme(afl_state_t *afl) {
 
   sprintf(fn, "%s/crashes/README.txt", afl->out_dir);
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   /* Do not die on errors here - that would be impolite. */
 
@@ -509,7 +509,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
         alloc_printf("%s/queue/id_%06u", afl->out_dir, afl->queued_paths);
 
 #endif                                                    /* ^!SIMPLE_FILES */
-    fd = open(queue_fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    fd = open(queue_fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (unlikely(fd < 0)) { PFATAL("Unable to create '%s'", queue_fn); }
     ck_write(fd, mem, len, queue_fn);
     close(fd);
@@ -783,7 +783,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
   /* If we're here, we apparently want to save the crash or hang
      test case, too. */
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
   if (unlikely(fd < 0)) { PFATAL("Unable to create '%s'", fn); }
   ck_write(fd, mem, len, fn);
   close(fd);
diff --git a/src/afl-fuzz-extras.c b/src/afl-fuzz-extras.c
index 52100fa1..6091db15 100644
--- a/src/afl-fuzz-extras.c
+++ b/src/afl-fuzz-extras.c
@@ -731,7 +731,7 @@ void save_auto(afl_state_t *afl) {
         alloc_printf("%s/queue/.state/auto_extras/auto_%06u", afl->out_dir, i);
     s32 fd;
 
-    fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+    fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
     if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
 
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index b2569dc0..47521a9e 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -152,7 +152,7 @@ void bind_to_free_cpu(afl_state_t *afl) {
 
     do {
 
-      if ((lockfd = open(lockfile, O_RDWR | O_CREAT | O_EXCL, 0600)) < 0) {
+      if ((lockfd = open(lockfile, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION)) < 0) {
 
         if (first) {
 
@@ -1219,7 +1219,7 @@ static void link_or_copy(u8 *old_path, u8 *new_path) {
   sfd = open(old_path, O_RDONLY);
   if (sfd < 0) { PFATAL("Unable to open '%s'", old_path); }
 
-  dfd = open(new_path, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  dfd = open(new_path, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
   if (dfd < 0) { PFATAL("Unable to create '%s'", new_path); }
 
   tmp = ck_alloc(64 * 1024);
@@ -2015,7 +2015,7 @@ void setup_dirs_fds(afl_state_t *afl) {
 
   if (!afl->in_place_resume) {
 
-    int fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    int fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", tmp); }
     ck_free(tmp);
 
@@ -2030,7 +2030,7 @@ void setup_dirs_fds(afl_state_t *afl) {
 
   } else {
 
-    int fd = open(tmp, O_WRONLY | O_CREAT, 0600);
+    int fd = open(tmp, O_WRONLY | O_CREAT, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", tmp); }
     ck_free(tmp);
 
@@ -2057,7 +2057,7 @@ void setup_cmdline_file(afl_state_t *afl, char **argv) {
 
   /* Store the command line to reproduce our findings */
   tmp = alloc_printf("%s/cmdline", afl->out_dir);
-  fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
   if (fd < 0) { PFATAL("Unable to create '%s'", tmp); }
   ck_free(tmp);
 
@@ -2092,7 +2092,7 @@ void setup_stdio_file(afl_state_t *afl) {
 
   unlink(afl->fsrv.out_file);                              /* Ignore errors */
 
-  afl->fsrv.out_fd = open(afl->fsrv.out_file, O_RDWR | O_CREAT | O_EXCL, 0600);
+  afl->fsrv.out_fd = open(afl->fsrv.out_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   if (afl->fsrv.out_fd < 0) {
 
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 80df6d08..a47b4f5f 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -465,7 +465,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
 
     unlink(q->fname);                                      /* ignore errors */
 
-    fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
     if (fd < 0) { PFATAL("Unable to create '%s'", q->fname); }
 
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index b2f88205..63592cef 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -249,7 +249,7 @@ void mark_as_det_done(afl_state_t *afl, struct queue_entry *q) {
   snprintf(fn, PATH_MAX, "%s/queue/.state/deterministic_done/%s", afl->out_dir,
            strrchr(q->fname, '/') + 1);
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
   if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
   close(fd);
 
@@ -272,7 +272,7 @@ void mark_as_variable(afl_state_t *afl, struct queue_entry *q) {
 
   if (symlink(ldest, fn)) {
 
-    s32 fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    s32 fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
     close(fd);
 
@@ -300,7 +300,7 @@ void mark_as_redundant(afl_state_t *afl, struct queue_entry *q, u8 state) {
 
     s32 fd;
 
-    fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
     close(fd);
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 0b84a542..30860eff 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -83,7 +83,7 @@ write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
            afl->document_counter++,
            describe_op(afl, 0, NAME_MAX - strlen("000000000:")));
 
-  if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600)) >= 0) {
+  if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION)) >= 0) {
 
     if (write(doc_fd, mem, len) != len)
       PFATAL("write to mutation file failed: %s", fn);
@@ -247,12 +247,12 @@ static void write_with_gap(afl_state_t *afl, u8 *mem, u32 len, u32 skip_at,
 
     if (unlikely(afl->no_unlink)) {
 
-      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
     } else {
 
       unlink(afl->fsrv.out_file);                         /* Ignore errors. */
-      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
+      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
     }
 
@@ -564,7 +564,7 @@ void sync_fuzzers(afl_state_t *afl) {
     /* document the attempt to sync to this instance */
 
     sprintf(qd_synced_path, "%s/.synced/%s.last", afl->out_dir, sd_ent->d_name);
-    id_fd = open(qd_synced_path, O_RDWR | O_CREAT | O_TRUNC, 0600);
+    id_fd = open(qd_synced_path, O_RDWR | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
     if (id_fd >= 0) close(id_fd);
 
     /* Skip anything that doesn't have a queue/ subdirectory. */
@@ -587,7 +587,7 @@ void sync_fuzzers(afl_state_t *afl) {
 
     sprintf(qd_synced_path, "%s/.synced/%s", afl->out_dir, sd_ent->d_name);
 
-    id_fd = open(qd_synced_path, O_RDWR | O_CREAT, 0600);
+    id_fd = open(qd_synced_path, O_RDWR | O_CREAT, DEFAULT_PERMISSION);
 
     if (id_fd < 0) { PFATAL("Unable to create '%s'", qd_synced_path); }
 
@@ -851,7 +851,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
 
     if (unlikely(afl->no_unlink)) {
 
-      fd = open(q->fname, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      fd = open(q->fname, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
       if (fd < 0) { PFATAL("Unable to create '%s'", q->fname); }
 
@@ -866,7 +866,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
     } else {
 
       unlink(q->fname);                                    /* ignore errors */
-      fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, 0600);
+      fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
       if (fd < 0) { PFATAL("Unable to create '%s'", q->fname); }
 
diff --git a/src/afl-sharedmem.c b/src/afl-sharedmem.c
index 3241a130..ac662977 100644
--- a/src/afl-sharedmem.c
+++ b/src/afl-sharedmem.c
@@ -163,7 +163,7 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
 
   /* create the shared memory segment as if it was a file */
   shm->g_shm_fd =
-      shm_open(shm->g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, 0600);
+      shm_open(shm->g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, DEFAULT_PERMISSION);
   if (shm->g_shm_fd == -1) { PFATAL("shm_open() failed"); }
 
   /* configure the size of the shared memory segment */
@@ -202,7 +202,7 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
 
     /* create the shared memory segment as if it was a file */
     shm->cmplog_g_shm_fd =
-        shm_open(shm->cmplog_g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, 0600);
+        shm_open(shm->cmplog_g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, DEFAULT_PERMISSION);
     if (shm->cmplog_g_shm_fd == -1) { PFATAL("shm_open() failed"); }
 
     /* configure the size of the shared memory segment */
@@ -241,13 +241,13 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
 #else
   u8 *shm_str;
 
-  shm->shm_id = shmget(IPC_PRIVATE, map_size, IPC_CREAT | IPC_EXCL | 0600);
+  shm->shm_id = shmget(IPC_PRIVATE, map_size, IPC_CREAT | IPC_EXCL | DEFAULT_PERMISSION);
   if (shm->shm_id < 0) { PFATAL("shmget() failed"); }
 
   if (shm->cmplog_mode) {
 
     shm->cmplog_shm_id = shmget(IPC_PRIVATE, sizeof(struct cmp_map),
-                                IPC_CREAT | IPC_EXCL | 0600);
+                                IPC_CREAT | IPC_EXCL | DEFAULT_PERMISSION);
 
     if (shm->cmplog_shm_id < 0) {
 
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 7bf5a9c7..cc0f1a7e 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -252,7 +252,7 @@ static u32 write_results_to_file(afl_forkserver_t *fsrv, u8 *outfile) {
   } else {
 
     unlink(outfile);                                       /* Ignore errors */
-    fd = open(outfile, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    fd = open(outfile, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", outfile); }
 
   }
@@ -1119,7 +1119,7 @@ int main(int argc, char **argv_orig, char **envp) {
     unlink(stdin_file);
     atexit(at_exit_handler);
     fsrv->out_file = stdin_file;
-    fsrv->out_fd = open(stdin_file, O_RDWR | O_CREAT | O_EXCL, 0600);
+    fsrv->out_fd = open(stdin_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fsrv->out_fd < 0) { PFATAL("Unable to create '%s'", out_file); }
 
     if (arg_offset && use_argv[arg_offset] != stdin_file) {
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 7ef8b9bf..fc974262 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -244,7 +244,7 @@ static s32 write_to_file(u8 *path, u8 *mem, u32 len) {
 
   unlink(path);                                            /* Ignore errors */
 
-  ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600);
+  ret = open(path, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   if (ret < 0) { PFATAL("Unable to create '%s'", path); }
 
@@ -666,7 +666,7 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
   unlink(out_file);
 
   fsrv->out_file = out_file;
-  fsrv->out_fd = open(out_file, O_RDWR | O_CREAT | O_EXCL, 0600);
+  fsrv->out_fd = open(out_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   if (fsrv->out_fd < 0) { PFATAL("Unable to create '%s'", out_file); }
 
-- 
cgit 1.4.1


From 2fef89950f826be065cc9677df690ebfd21160c1 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 23 Mar 2021 22:49:02 +0100
Subject: v3.12c release

---
 docs/Changelog.md | 2 +-
 include/config.h  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'include/config.h')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index aea95d5d..476c6f4e 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -8,7 +8,7 @@
 Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
-### Version ++3.12a (dev)
+### Version ++3.12c (release)
   - afl-fuzz:
     - added AFL_TARGET_ENV variable to pass extra env vars to the target
       (for things like LD_LIBRARY_PATH)
diff --git a/include/config.h b/include/config.h
index 3c09fce4..c93a6d51 100644
--- a/include/config.h
+++ b/include/config.h
@@ -26,7 +26,7 @@
 /* Version string: */
 
 // c = release, a = volatile github dev, e = experimental branch
-#define VERSION "++3.12a"
+#define VERSION "++3.12c"
 
 /******************************************************
  *                                                    *
-- 
cgit 1.4.1


From ee5078f43c44a022831cf83b6963930975188168 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 24 Mar 2021 11:22:37 +0100
Subject: v3.13a init

---
 docs/Changelog.md | 3 +++
 include/config.h  | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

(limited to 'include/config.h')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 5b7d6ab6..6b7ebf15 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -8,6 +8,9 @@
 Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
+### Version ++3.13a (development)
+  - ...
+
 ### Version ++3.12c (release)
   - afl-fuzz:
     - added AFL_TARGET_ENV variable to pass extra env vars to the target
diff --git a/include/config.h b/include/config.h
index c93a6d51..8ac74c45 100644
--- a/include/config.h
+++ b/include/config.h
@@ -26,7 +26,7 @@
 /* Version string: */
 
 // c = release, a = volatile github dev, e = experimental branch
-#define VERSION "++3.12c"
+#define VERSION "++3.13a"
 
 /******************************************************
  *                                                    *
-- 
cgit 1.4.1