From 1fc0918ac0e79588f9c4aff0a274da0897fe1b88 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 15 Dec 2020 09:55:33 +0100
Subject: v3.01a init

---
 include/config.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'include')

diff --git a/include/config.h b/include/config.h
index 93249ed9..1eb6bc5e 100644
--- a/include/config.h
+++ b/include/config.h
@@ -28,7 +28,7 @@
 /* Version string: */
 
 // c = release, d = volatile github dev, e = experimental branch
-#define VERSION "++3.00c"
+#define VERSION "++3.01a"
 
 /******************************************************
  *                                                    *
-- 
cgit v1.2.3


From d07b0169cb6137e4620db63b144e46e140b7437d Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 17 Dec 2020 10:55:33 +0100
Subject: skim import

---
 include/afl-fuzz.h | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

(limited to 'include')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 2f2d31d3..6e695a97 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -1014,14 +1014,9 @@ void write_bitmap(afl_state_t *);
 u32  count_bits(afl_state_t *, u8 *);
 u32  count_bytes(afl_state_t *, u8 *);
 u32  count_non_255_bytes(afl_state_t *, u8 *);
-#ifdef WORD_SIZE_64
-void simplify_trace(afl_state_t *, u64 *);
-void classify_counts(afl_forkserver_t *);
-#else
-void simplify_trace(afl_state_t *, u32 *);
-void classify_counts(afl_forkserver_t *);
-#endif
+void simplify_trace(afl_state_t *, u8 *);
 void init_count_class16(void);
+void classify_counts(afl_forkserver_t *fsrv);
 void minimize_bits(afl_state_t *, u8 *, u8 *);
 #ifndef SIMPLE_FILES
 u8 *describe_op(afl_state_t *, u8, size_t);
-- 
cgit v1.2.3


From 0011f2047bdd3e1adc25de4388edd609dc27bc85 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 18 Dec 2020 09:33:52 +0100
Subject: merge romu and skim

---
 include/afl-fuzz.h    |  13 ++--
 include/coverage-32.h | 109 +++++++++++++++++++++++++++++
 include/coverage-64.h | 186 ++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 304 insertions(+), 4 deletions(-)
 create mode 100644 include/coverage-32.h
 create mode 100644 include/coverage-64.h

(limited to 'include')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 6e695a97..31c19287 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -134,6 +134,12 @@
 // Little helper to access the ptr to afl->##name_buf - for use in afl_realloc.
 #define AFL_BUF_PARAM(name) ((void **)&afl->name##_buf)
 
+#ifdef WORD_SIZE_64
+  #define AFL_RAND_RETURN u64
+#else
+  #define AFL_RAND_RETURN u32
+#endif
+
 extern s8  interesting_8[INTERESTING_8_LEN];
 extern s16 interesting_16[INTERESTING_8_LEN + INTERESTING_16_LEN];
 extern s32
@@ -580,7 +586,7 @@ typedef struct afl_state {
 
   u32 rand_cnt;                         /* Random number counter            */
 
-  u64 rand_seed[4];
+  u64 rand_seed[3];
   s64 init_seed;
 
   u64 total_cal_us,                     /* Total calibration time (us)      */
@@ -1015,8 +1021,8 @@ u32  count_bits(afl_state_t *, u8 *);
 u32  count_bytes(afl_state_t *, u8 *);
 u32  count_non_255_bytes(afl_state_t *, u8 *);
 void simplify_trace(afl_state_t *, u8 *);
+void classify_counts(afl_forkserver_t *);
 void init_count_class16(void);
-void classify_counts(afl_forkserver_t *fsrv);
 void minimize_bits(afl_state_t *, u8 *, u8 *);
 #ifndef SIMPLE_FILES
 u8 *describe_op(afl_state_t *, u8, size_t);
@@ -1106,8 +1112,7 @@ u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len);
 u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
                         u64 exec_cksum);
 
-/* xoshiro256** */
-uint64_t rand_next(afl_state_t *afl);
+AFL_RAND_RETURN rand_next(afl_state_t *afl);
 
 /* probability between 0.0 and 1.0 */
 double rand_next_percent(afl_state_t *afl);
diff --git a/include/coverage-32.h b/include/coverage-32.h
new file mode 100644
index 00000000..710ff0cf
--- /dev/null
+++ b/include/coverage-32.h
@@ -0,0 +1,109 @@
+#include "config.h"
+#include "types.h"
+
+inline u32 classify_word(u32 word) {
+
+  u16 mem16[2];
+  memcpy(mem16, &word, sizeof(mem16));
+
+  mem16[0] = count_class_lookup16[mem16[0]];
+  mem16[1] = count_class_lookup16[mem16[1]];
+
+  memcpy(&word, mem16, sizeof(mem16));
+  return word;
+
+}
+
+void simplify_trace(afl_state_t *afl, u8 *bytes) {
+
+  u32 *mem = (u32 *)fsrv->trace_bits;
+  u32  i = (fsrv->map_size >> 2);
+
+  while (i--) {
+
+    /* Optimize for sparse bitmaps. */
+
+    if (unlikely(*mem)) {
+
+      u8 *mem8 = (u8 *)mem;
+
+      mem8[0] = simplify_lookup[mem8[0]];
+      mem8[1] = simplify_lookup[mem8[1]];
+      mem8[2] = simplify_lookup[mem8[2]];
+      mem8[3] = simplify_lookup[mem8[3]];
+
+    } else
+
+      *mem = 0x01010101;
+
+    mem++;
+
+  }
+
+}
+
+inline void classify_counts(u8 *bytes) {
+
+  u64 *mem = (u64 *)bytes;
+  u32  i = MAP_SIZE >> 2;
+
+  while (i--) {
+
+    /* Optimize for sparse bitmaps. */
+
+    if (unlikely(*mem)) { *mem = classify_word(*mem); }
+
+    mem++;
+
+  }
+
+}
+
+/* Updates the virgin bits, then reflects whether a new count or a new tuple is
+ * seen in ret. */
+inline void discover_word(u8 *ret, u32 *current, u32 *virgin) {
+
+  /* Optimize for (*current & *virgin) == 0 - i.e., no bits in current bitmap
+     that have not been already cleared from the virgin map - since this will
+     almost always be the case. */
+
+  if (*current & *virgin) {
+
+    if (likely(*ret < 2)) {
+
+      u8 *cur = (u8 *)current;
+      u8 *vir = (u8 *)virgin;
+
+      /* Looks like we have not found any new bytes yet; see if any non-zero
+         bytes in current[] are pristine in virgin[]. */
+
+      if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) ||
+          (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff))
+        *ret = 2;
+      else
+        *ret = 1;
+
+    }
+
+    *virgin &= ~*current;
+
+  }
+
+}
+
+#define PACK_SIZE 16
+inline u32 skim(const u32 *virgin, const u32 *current, const u32 *current_end) {
+
+  for (; current != current_end; virgin += 4, current += 4) {
+
+    if (current[0] && classify_word(current[0]) & virgin[0]) return 1;
+    if (current[1] && classify_word(current[1]) & virgin[1]) return 1;
+    if (current[2] && classify_word(current[2]) & virgin[2]) return 1;
+    if (current[3] && classify_word(current[3]) & virgin[3]) return 1;
+
+  }
+
+  return 0;
+
+}
+
diff --git a/include/coverage-64.h b/include/coverage-64.h
new file mode 100644
index 00000000..54cf0073
--- /dev/null
+++ b/include/coverage-64.h
@@ -0,0 +1,186 @@
+#include "config.h"
+#include "types.h"
+
+#if (defined(__AVX512F__) && defined(__AVX512DQ__)) || defined(__AVX2__)
+  #include <immintrin.h>
+#endif
+
+inline u64 classify_word(u64 word) {
+
+  u16 mem16[4];
+  memcpy(mem16, &word, sizeof(mem16));
+
+  mem16[0] = count_class_lookup16[mem16[0]];
+  mem16[1] = count_class_lookup16[mem16[1]];
+  mem16[2] = count_class_lookup16[mem16[2]];
+  mem16[3] = count_class_lookup16[mem16[3]];
+
+  memcpy(&word, mem16, sizeof(mem16));
+  return word;
+
+}
+
+void simplify_trace(afl_state_t *afl, u8 *bytes) {
+
+  u64 *mem = (u64 *)bytes;
+  u32  i = (afl->fsrv.map_size >> 3);
+
+  while (i--) {
+
+    /* Optimize for sparse bitmaps. */
+
+    if (unlikely(*mem)) {
+
+      u8 *mem8 = (u8 *)mem;
+
+      mem8[0] = simplify_lookup[mem8[0]];
+      mem8[1] = simplify_lookup[mem8[1]];
+      mem8[2] = simplify_lookup[mem8[2]];
+      mem8[3] = simplify_lookup[mem8[3]];
+      mem8[4] = simplify_lookup[mem8[4]];
+      mem8[5] = simplify_lookup[mem8[5]];
+      mem8[6] = simplify_lookup[mem8[6]];
+      mem8[7] = simplify_lookup[mem8[7]];
+
+    } else
+
+      *mem = 0x0101010101010101ULL;
+
+    mem++;
+
+  }
+
+}
+
+inline void classify_counts(afl_forkserver_t *fsrv) {
+
+  u64 *mem = (u64 *)fsrv->trace_bits;
+  u32  i = (fsrv->map_size >> 3);
+
+  while (i--) {
+
+    /* Optimize for sparse bitmaps. */
+
+    if (unlikely(*mem)) { *mem = classify_word(*mem); }
+
+    mem++;
+
+  }
+
+}
+
+/* Updates the virgin bits, then reflects whether a new count or a new tuple is
+ * seen in ret. */
+inline void discover_word(u8 *ret, u64 *current, u64 *virgin) {
+
+  /* Optimize for (*current & *virgin) == 0 - i.e., no bits in current bitmap
+     that have not been already cleared from the virgin map - since this will
+     almost always be the case. */
+
+  if (*current & *virgin) {
+
+    if (likely(*ret < 2)) {
+
+      u8 *cur = (u8 *)current;
+      u8 *vir = (u8 *)virgin;
+
+      /* Looks like we have not found any new bytes yet; see if any non-zero
+         bytes in current[] are pristine in virgin[]. */
+
+      if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) ||
+          (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff) ||
+          (cur[4] && vir[4] == 0xff) || (cur[5] && vir[5] == 0xff) ||
+          (cur[6] && vir[6] == 0xff) || (cur[7] && vir[7] == 0xff))
+        *ret = 2;
+      else
+        *ret = 1;
+
+    }
+
+    *virgin &= ~*current;
+
+  }
+
+}
+
+#if defined(__AVX512F__) && defined(__AVX512DQ__)
+  #define PACK_SIZE 64
+inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
+
+  for (; current != current_end; virgin += 8, current += 8) {
+
+    __m512i  value = *(__m512i *)current;
+    __mmask8 mask = _mm512_testn_epi64_mask(value, value);
+
+    /* All bytes are zero. */
+    if (mask == 0xff) continue;
+
+      /* Look for nonzero bytes and check for new bits. */
+  #define UNROLL(x) \
+    if (!(mask & (1 << x)) && classify_word(current[x]) & virgin[x]) return 1
+    UNROLL(0);
+    UNROLL(1);
+    UNROLL(2);
+    UNROLL(3);
+    UNROLL(4);
+    UNROLL(5);
+    UNROLL(6);
+    UNROLL(7);
+  #undef UNROLL
+
+  }
+
+  return 0;
+
+}
+
+#endif
+
+#if !defined(PACK_SIZE) && defined(__AVX2__)
+  #define PACK_SIZE 32
+inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
+
+  __m256i zeroes = _mm256_setzero_si256();
+
+  for (; current != current_end; virgin += 4, current += 4) {
+
+    __m256i value = *(__m256i *)current;
+    __m256i cmp = _mm256_cmpeq_epi64(value, zeroes);
+    u32     mask = _mm256_movemask_epi8(cmp);
+
+    /* All bytes are zero. */
+    if (mask == (u32)-1) continue;
+
+    /* Look for nonzero bytes and check for new bits. */
+    if (!(mask & 0xff) && classify_word(current[0]) & virgin[0]) return 1;
+    if (!(mask & 0xff00) && classify_word(current[1]) & virgin[1]) return 1;
+    if (!(mask & 0xff0000) && classify_word(current[2]) & virgin[2]) return 1;
+    if (!(mask & 0xff000000) && classify_word(current[3]) & virgin[3]) return 1;
+
+  }
+
+  return 0;
+
+}
+
+#endif
+
+#if !defined(PACK_SIZE)
+  #define PACK_SIZE 32
+inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
+
+  for (; current != current_end; virgin += 4, current += 4) {
+
+    if (current[0] && classify_word(current[0]) & virgin[0]) return 1;
+    if (current[1] && classify_word(current[1]) & virgin[1]) return 1;
+    if (current[2] && classify_word(current[2]) & virgin[2]) return 1;
+    if (current[3] && classify_word(current[3]) & virgin[3]) return 1;
+
+  }
+
+  return 0;
+
+}
+
+#endif
+
-- 
cgit v1.2.3


From f0b6576f977d9130285159dff90f5b31b950cb07 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 18 Dec 2020 09:55:47 +0100
Subject: fix

---
 include/afl-fuzz.h | 1 +
 1 file changed, 1 insertion(+)

(limited to 'include')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 31c19287..3acb6b93 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -1022,6 +1022,7 @@ u32  count_bytes(afl_state_t *, u8 *);
 u32  count_non_255_bytes(afl_state_t *, u8 *);
 void simplify_trace(afl_state_t *, u8 *);
 void classify_counts(afl_forkserver_t *);
+u8 has_new_bits_unclassified(afl_state_t *, u8 *);
 void init_count_class16(void);
 void minimize_bits(afl_state_t *, u8 *, u8 *);
 #ifndef SIMPLE_FILES
-- 
cgit v1.2.3


From 4ff9eb0e67cc70c8f9415fa5bc4df10916fb6f4c Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 18 Dec 2020 10:02:26 +0100
Subject: fix compile

---
 include/coverage-32.h | 3 +++
 include/coverage-64.h | 3 +++
 2 files changed, 6 insertions(+)

(limited to 'include')

diff --git a/include/coverage-32.h b/include/coverage-32.h
index 710ff0cf..d7684708 100644
--- a/include/coverage-32.h
+++ b/include/coverage-32.h
@@ -1,6 +1,9 @@
 #include "config.h"
 #include "types.h"
 
+u32 skim(const u32 *virgin, const u32 *current, const u32 *current_end);
+u32 classify_word(u32 word);
+
 inline u32 classify_word(u32 word) {
 
   u16 mem16[2];
diff --git a/include/coverage-64.h b/include/coverage-64.h
index 54cf0073..0ede5fa5 100644
--- a/include/coverage-64.h
+++ b/include/coverage-64.h
@@ -5,6 +5,9 @@
   #include <immintrin.h>
 #endif
 
+u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end);
+u64 classify_word(u64 word);
+
 inline u64 classify_word(u64 word) {
 
   u16 mem16[4];
-- 
cgit v1.2.3


From ea9db86bb86341e4e2b53c46204e3f86496e6ab9 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 18 Dec 2020 10:20:43 +0100
Subject: mem error fix

---
 include/afl-fuzz.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'include')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 3acb6b93..99647c5b 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -1022,7 +1022,7 @@ u32  count_bytes(afl_state_t *, u8 *);
 u32  count_non_255_bytes(afl_state_t *, u8 *);
 void simplify_trace(afl_state_t *, u8 *);
 void classify_counts(afl_forkserver_t *);
-u8 has_new_bits_unclassified(afl_state_t *, u8 *);
+void discover_word(u8 *ret, u64 *current, u64 *virgin);
 void init_count_class16(void);
 void minimize_bits(afl_state_t *, u8 *, u8 *);
 #ifndef SIMPLE_FILES
@@ -1030,6 +1030,7 @@ u8 *describe_op(afl_state_t *, u8, size_t);
 #endif
 u8 save_if_interesting(afl_state_t *, void *, u32, u8);
 u8 has_new_bits(afl_state_t *, u8 *);
+u8 has_new_bits_unclassified(afl_state_t *, u8 *);
 
 /* Extras */
 
-- 
cgit v1.2.3


From 12ebb351dc2b5655b4174539e2b9ee59e4acf893 Mon Sep 17 00:00:00 2001
From: hexcoder- <heiko@hexco.de>
Date: Fri, 18 Dec 2020 21:10:39 +0100
Subject: apply nocolor changes

---
 include/config.h | 16 +++++++++++++
 include/debug.h  | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++-----
 include/envs.h   |  4 ++++
 3 files changed, 86 insertions(+), 6 deletions(-)

(limited to 'include')

diff --git a/include/config.h b/include/config.h
index 1eb6bc5e..d57ef223 100644
--- a/include/config.h
+++ b/include/config.h
@@ -36,11 +36,27 @@
  *                                                    *
  ******************************************************/
 
+/* console output colors: There are three ways to configure its behavior
+ * 1. default: colored outputs fixed on: defined USE_COLOR && defined ALWAYS_COLORED
+ *    The env var. AFL_NO_COLOR will have no effect
+ * 2. defined USE_COLOR && !defined ALWAYS_COLORED
+ *    -> depending on env var AFL_NO_COLOR=1 colors can be switched off
+ *    at run-time. Default is to use colors.
+ * 3. colored outputs fixed off: !defined USE_COLOR
+ *    The env var. AFL_NO_COLOR will have no effect
+*/
+
 /* Comment out to disable terminal colors (note that this makes afl-analyze
    a lot less nice): */
 
 #define USE_COLOR
 
+#ifdef USE_COLOR
+/* Comment in to always enable terminal colors */
+/* Comment out to enable runtime controlled terminal colors via AFL_NO_COLOR */
+#define ALWAYS_COLORED  1
+#endif
+
 /* StatsD config
    Config can be adjusted via AFL_STATSD_HOST and AFL_STATSD_PORT environment
    variable.
diff --git a/include/debug.h b/include/debug.h
index 5512023c..7a1725b5 100644
--- a/include/debug.h
+++ b/include/debug.h
@@ -168,12 +168,72 @@
  * Debug & error macros *
  ************************/
 
-/* Just print stuff to the appropriate stream. */
+#if defined USE_COLOR && !defined ALWAYS_COLORED
+#include <unistd.h>
+#pragma GCC diagnostic ignored "-Wformat-security"
+static inline const char * colorfilter(const char * x) {
+  static int once = 1;
+  static int disabled = 0;
+
+  if (once) {
+    /* when there is no tty -> we always want filtering
+     * when AFL_NO_UI is set filtering depends on AFL_NO_COLOR
+     * otherwise we want always colors
+     */
+    disabled = isatty(2) && (!getenv("AFL_NO_UI") || (!getenv("AFL_NO_COLOR") && !getenv("AFL_NO_COLOUR")));
+    once = 0;
+  }
+  if (likely(disabled)) return x;
+
+  static char monochromestring[4096];
+  char *d = monochromestring;
+  int in_seq = 0;
+
+  while(*x) {
+    if (in_seq && *x == 'm') {
+      in_seq = 0;
+    } else {
+      if (!in_seq && *x == '\x1b') { in_seq = 1; }
+      if (!in_seq) {
+        *d++ = *x;
+      }
+    }
+    ++x;
+  }
+
+  *d = '\0';
+  return monochromestring;
+}
+#else
+#define colorfilter(x) x /* no filtering necessary */
+#endif
 
+/* macro magic to transform the first parameter to SAYF
+ * through colorfilter which strips coloring */
+#define GET_MACRO(_1,_2,_3,_4,_5,_6,_7,_8,_9,_10,\
+_11,_12,_13,_14,_15,_16,_17,_18,_19,_20,\
+_21,_22,_23,_24,_25,_26,_27,_28,_29,_30,\
+_31,_32,_33,_34,_35,_36,_37,_38,_39,_40,\
+NAME,...) NAME
+
+#define SAYF(...) GET_MACRO(__VA_ARGS__, \
+SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_1)(__VA_ARGS__)
+
+#define SAYF_1(x)  MY_SAYF(colorfilter(x))
+#define SAYF_N(x,...)  MY_SAYF(colorfilter(x), __VA_ARGS__)
+
+/* Just print stuff to the appropriate stream. */
 #ifdef MESSAGES_TO_STDOUT
-  #define SAYF(x...) printf(x)
+  #define MY_SAYF(x...) printf(x)
 #else
-  #define SAYF(x...) fprintf(stderr, x)
+  #define MY_SAYF(x...) fprintf(stderr, x)
 #endif                                               /* ^MESSAGES_TO_STDOUT */
 
 /* Show a prefixed warning. */
@@ -222,7 +282,7 @@
   do {                                                                   \
                                                                          \
     SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD                            \
-         "\n[-] PROGRAM ABORT : " cRST   x);                               \
+         "\n[-] PROGRAM ABORT : " cRST x);                               \
     SAYF(cLRD "\n         Location : " cRST "%s(), %s:%u\n\n", __func__, \
          __FILE__, __LINE__);                                            \
     exit(1);                                                             \
@@ -235,7 +295,7 @@
   do {                                                                   \
                                                                          \
     SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD                            \
-         "\n[-] PROGRAM ABORT : " cRST   x);                               \
+         "\n[-] PROGRAM ABORT : " cRST x);                               \
     SAYF(cLRD "\n    Stop location : " cRST "%s(), %s:%u\n\n", __func__, \
          __FILE__, __LINE__);                                            \
     abort();                                                             \
@@ -249,7 +309,7 @@
                                                                        \
     fflush(stdout);                                                    \
     SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD                          \
-         "\n[-]  SYSTEM ERROR : " cRST   x);                             \
+         "\n[-]  SYSTEM ERROR : " cRST x);                             \
     SAYF(cLRD "\n    Stop location : " cRST "%s(), %s:%u\n", __func__, \
          __FILE__, __LINE__);                                          \
     SAYF(cLRD "       OS message : " cRST "%s\n", strerror(errno));    \
diff --git a/include/envs.h b/include/envs.h
index c0f41ca5..f16e61f0 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -103,6 +103,10 @@ static char *afl_environment_variables[] = {
     "AFL_NO_ARITH",
     "AFL_NO_AUTODICT",
     "AFL_NO_BUILTIN",
+#if defined USE_COLOR && ! defined ALWAYS_COLORED
+    "AFL_NO_COLOR",
+    "AFL_NO_COLOUR",
+#endif
     "AFL_NO_CPU_RED",
     "AFL_NO_FORKSRV",
     "AFL_NO_UI",
-- 
cgit v1.2.3


From e1a7ed9d6ee4ec51d2a2cd9a43d15320758088d1 Mon Sep 17 00:00:00 2001
From: pr0xy <proxyjmx@gmail.com>
Date: Sun, 20 Dec 2020 18:54:32 +0900
Subject: fixed typo in include/forkserver.h

---
 include/forkserver.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'include')

diff --git a/include/forkserver.h b/include/forkserver.h
index 5d5c728f..8e029266 100644
--- a/include/forkserver.h
+++ b/include/forkserver.h
@@ -64,7 +64,7 @@ typedef struct afl_forkserver {
 
   FILE *plot_file;                      /* Gnuplot output file              */
 
-  /* Note: lat_run_timed_out is u32 to send it to the child as 4 byte array */
+  /* Note: last_run_timed_out is u32 to send it to the child as 4 byte array */
   u32 last_run_timed_out;               /* Traced process timed out?        */
 
   u8 last_kill_signal;                  /* Signal that killed the child     */
-- 
cgit v1.2.3


From 98ee17bc47b1f1d4664be9955a72727fff8e51fa Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 20 Dec 2020 14:30:06 +0100
Subject: fix endless loop in afl-cc allow/blocklists starting a line with a
 comment

---
 include/config.h | 13 +++++-----
 include/debug.h  | 76 ++++++++++++++++++++++++++++++++------------------------
 include/envs.h   |  4 +--
 3 files changed, 53 insertions(+), 40 deletions(-)

(limited to 'include')

diff --git a/include/config.h b/include/config.h
index d57ef223..e8a49270 100644
--- a/include/config.h
+++ b/include/config.h
@@ -37,14 +37,14 @@
  ******************************************************/
 
 /* console output colors: There are three ways to configure its behavior
- * 1. default: colored outputs fixed on: defined USE_COLOR && defined ALWAYS_COLORED
- *    The env var. AFL_NO_COLOR will have no effect
+ * 1. default: colored outputs fixed on: defined USE_COLOR && defined
+ * ALWAYS_COLORED The env var. AFL_NO_COLOR will have no effect
  * 2. defined USE_COLOR && !defined ALWAYS_COLORED
  *    -> depending on env var AFL_NO_COLOR=1 colors can be switched off
  *    at run-time. Default is to use colors.
  * 3. colored outputs fixed off: !defined USE_COLOR
  *    The env var. AFL_NO_COLOR will have no effect
-*/
+ */
 
 /* Comment out to disable terminal colors (note that this makes afl-analyze
    a lot less nice): */
@@ -52,9 +52,10 @@
 #define USE_COLOR
 
 #ifdef USE_COLOR
-/* Comment in to always enable terminal colors */
-/* Comment out to enable runtime controlled terminal colors via AFL_NO_COLOR */
-#define ALWAYS_COLORED  1
+  /* Comment in to always enable terminal colors */
+  /* Comment out to enable runtime controlled terminal colors via AFL_NO_COLOR
+   */
+  #define ALWAYS_COLORED 1
 #endif
 
 /* StatsD config
diff --git a/include/debug.h b/include/debug.h
index 7a1725b5..7f4a6be1 100644
--- a/include/debug.h
+++ b/include/debug.h
@@ -169,65 +169,77 @@
  ************************/
 
 #if defined USE_COLOR && !defined ALWAYS_COLORED
-#include <unistd.h>
-#pragma GCC diagnostic ignored "-Wformat-security"
-static inline const char * colorfilter(const char * x) {
+  #include <unistd.h>
+  #pragma GCC diagnostic ignored "-Wformat-security"
+static inline const char *colorfilter(const char *x) {
+
   static int once = 1;
   static int disabled = 0;
 
   if (once) {
+
     /* when there is no tty -> we always want filtering
      * when AFL_NO_UI is set filtering depends on AFL_NO_COLOR
      * otherwise we want always colors
      */
-    disabled = isatty(2) && (!getenv("AFL_NO_UI") || (!getenv("AFL_NO_COLOR") && !getenv("AFL_NO_COLOUR")));
+    disabled =
+        isatty(2) && (!getenv("AFL_NO_UI") ||
+                      (!getenv("AFL_NO_COLOR") && !getenv("AFL_NO_COLOUR")));
     once = 0;
+
   }
+
   if (likely(disabled)) return x;
 
   static char monochromestring[4096];
-  char *d = monochromestring;
-  int in_seq = 0;
+  char *      d = monochromestring;
+  int         in_seq = 0;
+
+  while (*x) {
 
-  while(*x) {
     if (in_seq && *x == 'm') {
+
       in_seq = 0;
+
     } else {
+
       if (!in_seq && *x == '\x1b') { in_seq = 1; }
-      if (!in_seq) {
-        *d++ = *x;
-      }
+      if (!in_seq) { *d++ = *x; }
+
     }
+
     ++x;
+
   }
 
   *d = '\0';
   return monochromestring;
+
 }
+
 #else
-#define colorfilter(x) x /* no filtering necessary */
+  #define colorfilter(x) x                        /* no filtering necessary */
 #endif
 
 /* macro magic to transform the first parameter to SAYF
  * through colorfilter which strips coloring */
-#define GET_MACRO(_1,_2,_3,_4,_5,_6,_7,_8,_9,_10,\
-_11,_12,_13,_14,_15,_16,_17,_18,_19,_20,\
-_21,_22,_23,_24,_25,_26,_27,_28,_29,_30,\
-_31,_32,_33,_34,_35,_36,_37,_38,_39,_40,\
-NAME,...) NAME
-
-#define SAYF(...) GET_MACRO(__VA_ARGS__, \
-SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
-SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
-SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
-SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
-SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
-SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
-SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
-SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_1)(__VA_ARGS__)
-
-#define SAYF_1(x)  MY_SAYF(colorfilter(x))
-#define SAYF_N(x,...)  MY_SAYF(colorfilter(x), __VA_ARGS__)
+#define GET_MACRO(_1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13, _14, \
+                  _15, _16, _17, _18, _19, _20, _21, _22, _23, _24, _25, _26,  \
+                  _27, _28, _29, _30, _31, _32, _33, _34, _35, _36, _37, _38,  \
+                  _39, _40, NAME, ...)                                         \
+  NAME
+
+#define SAYF(...)                                                           \
+  GET_MACRO(__VA_ARGS__, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N,    \
+            SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+            SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+            SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+            SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_N, \
+            SAYF_N, SAYF_1)                                                 \
+  (__VA_ARGS__)
+
+#define SAYF_1(x) MY_SAYF(colorfilter(x))
+#define SAYF_N(x, ...) MY_SAYF(colorfilter(x), __VA_ARGS__)
 
 /* Just print stuff to the appropriate stream. */
 #ifdef MESSAGES_TO_STDOUT
@@ -282,7 +294,7 @@ SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_1)(__VA_ARGS__)
   do {                                                                   \
                                                                          \
     SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD                            \
-         "\n[-] PROGRAM ABORT : " cRST x);                               \
+         "\n[-] PROGRAM ABORT : " cRST   x);                               \
     SAYF(cLRD "\n         Location : " cRST "%s(), %s:%u\n\n", __func__, \
          __FILE__, __LINE__);                                            \
     exit(1);                                                             \
@@ -295,7 +307,7 @@ SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_1)(__VA_ARGS__)
   do {                                                                   \
                                                                          \
     SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD                            \
-         "\n[-] PROGRAM ABORT : " cRST x);                               \
+         "\n[-] PROGRAM ABORT : " cRST   x);                               \
     SAYF(cLRD "\n    Stop location : " cRST "%s(), %s:%u\n\n", __func__, \
          __FILE__, __LINE__);                                            \
     abort();                                                             \
@@ -309,7 +321,7 @@ SAYF_N, SAYF_N, SAYF_N, SAYF_N, SAYF_1)(__VA_ARGS__)
                                                                        \
     fflush(stdout);                                                    \
     SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD                          \
-         "\n[-]  SYSTEM ERROR : " cRST x);                             \
+         "\n[-]  SYSTEM ERROR : " cRST   x);                             \
     SAYF(cLRD "\n    Stop location : " cRST "%s(), %s:%u\n", __func__, \
          __FILE__, __LINE__);                                          \
     SAYF(cLRD "       OS message : " cRST "%s\n", strerror(errno));    \
diff --git a/include/envs.h b/include/envs.h
index f16e61f0..e4e49c4d 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -78,8 +78,8 @@ static char *afl_environment_variables[] = {
     "AFL_LLVM_CTX",
     "AFL_LLVM_DICT2FILE",
     "AFL_LLVM_DOCUMENT_IDS",
-    "AFL_LLVM_INSTRUMENT",
     "AFL_LLVM_INSTRIM_LOOPHEAD",
+    "AFL_LLVM_INSTRUMENT",
     "AFL_LLVM_LTO_AUTODICTIONARY",
     "AFL_LLVM_AUTODICTIONARY",
     "AFL_LLVM_SKIPSINGLEBLOCK",
@@ -103,7 +103,7 @@ static char *afl_environment_variables[] = {
     "AFL_NO_ARITH",
     "AFL_NO_AUTODICT",
     "AFL_NO_BUILTIN",
-#if defined USE_COLOR && ! defined ALWAYS_COLORED
+#if defined USE_COLOR && !defined ALWAYS_COLORED
     "AFL_NO_COLOR",
     "AFL_NO_COLOUR",
 #endif
-- 
cgit v1.2.3


From 45a68760ee19739a7c1532d74486deb79dc6b9fd Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 21 Dec 2020 12:02:01 +0100
Subject: fix 32 bit

---
 include/coverage-32.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'include')

diff --git a/include/coverage-32.h b/include/coverage-32.h
index d7684708..124d6ee5 100644
--- a/include/coverage-32.h
+++ b/include/coverage-32.h
@@ -19,8 +19,8 @@ inline u32 classify_word(u32 word) {
 
 void simplify_trace(afl_state_t *afl, u8 *bytes) {
 
-  u32 *mem = (u32 *)fsrv->trace_bits;
-  u32  i = (fsrv->map_size >> 2);
+  u32 *mem = (u32 *)bytes;
+  u32  i = (afl->fsrv.map_size >> 2);
 
   while (i--) {
 
@@ -45,10 +45,10 @@ void simplify_trace(afl_state_t *afl, u8 *bytes) {
 
 }
 
-inline void classify_counts(u8 *bytes) {
+inline void classify_counts(afl_forkserver_t *fsrv) {
 
-  u64 *mem = (u64 *)bytes;
-  u32  i = MAP_SIZE >> 2;
+  u64 *mem = (u32 *)fsrv->trace_bits;
+  u32  i = (fsrv->map_size >> 2);
 
   while (i--) {
 
-- 
cgit v1.2.3


From 7e27448dac2191060320831904f32fe9d572bc3d Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 21 Dec 2020 12:19:22 +0100
Subject: another 32 bit fix

---
 include/afl-fuzz.h    | 4 ++++
 include/coverage-32.h | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

(limited to 'include')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 99647c5b..e2fb0344 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -1022,7 +1022,11 @@ u32  count_bytes(afl_state_t *, u8 *);
 u32  count_non_255_bytes(afl_state_t *, u8 *);
 void simplify_trace(afl_state_t *, u8 *);
 void classify_counts(afl_forkserver_t *);
+#ifdef WORD_SIZE_64
 void discover_word(u8 *ret, u64 *current, u64 *virgin);
+#else
+void discover_word(u8 *ret, u32 *current, u32 *virgin);
+#endif
 void init_count_class16(void);
 void minimize_bits(afl_state_t *, u8 *, u8 *);
 #ifndef SIMPLE_FILES
diff --git a/include/coverage-32.h b/include/coverage-32.h
index 124d6ee5..a5cc498c 100644
--- a/include/coverage-32.h
+++ b/include/coverage-32.h
@@ -47,7 +47,7 @@ void simplify_trace(afl_state_t *afl, u8 *bytes) {
 
 inline void classify_counts(afl_forkserver_t *fsrv) {
 
-  u64 *mem = (u32 *)fsrv->trace_bits;
+  u32 *mem = (u32 *)fsrv->trace_bits;
   u32  i = (fsrv->map_size >> 2);
 
   while (i--) {
-- 
cgit v1.2.3


From 2a994e457a75c28272373ba24cd4158239c007fd Mon Sep 17 00:00:00 2001
From: hexcoder- <heiko@hexco.de>
Date: Tue, 22 Dec 2020 19:39:49 +0100
Subject: portability: avoid void * arithmetic (UB), avoid GNU extension for
 array initializations

---
 include/alloc-inl.h | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

(limited to 'include')

diff --git a/include/alloc-inl.h b/include/alloc-inl.h
index 3044b7a0..8a91d196 100644
--- a/include/alloc-inl.h
+++ b/include/alloc-inl.h
@@ -271,7 +271,7 @@ static inline void *DFL_ck_alloc_nozero(u32 size) {
   ret = malloc(size + ALLOC_OFF_TOTAL);
   ALLOC_CHECK_RESULT(ret, size);
 
-  ret += ALLOC_OFF_HEAD;
+  ret = (char *)ret + ALLOC_OFF_HEAD;
 
   ALLOC_C1(ret) = ALLOC_MAGIC_C1;
   ALLOC_S(ret) = size;
@@ -311,7 +311,7 @@ static inline void DFL_ck_free(void *mem) {
 
   ALLOC_C1(mem) = ALLOC_MAGIC_F;
 
-  free(mem - ALLOC_OFF_HEAD);
+  free((char *)mem - ALLOC_OFF_HEAD);
 
 }
 
@@ -340,7 +340,7 @@ static inline void *DFL_ck_realloc(void *orig, u32 size) {
   #endif                                                    /* !DEBUG_BUILD */
 
     old_size = ALLOC_S(orig);
-    orig -= ALLOC_OFF_HEAD;
+    orig = (char *)orig - ALLOC_OFF_HEAD;
 
     ALLOC_CHECK_SIZE(old_size);
 
@@ -363,10 +363,10 @@ static inline void *DFL_ck_realloc(void *orig, u32 size) {
 
   if (orig) {
 
-    memcpy(ret + ALLOC_OFF_HEAD, orig + ALLOC_OFF_HEAD, MIN(size, old_size));
-    memset(orig + ALLOC_OFF_HEAD, 0xFF, old_size);
+    memcpy((char *)ret + ALLOC_OFF_HEAD, (char *)orig + ALLOC_OFF_HEAD, MIN(size, old_size));
+    memset((char *)orig + ALLOC_OFF_HEAD, 0xFF, old_size);
 
-    ALLOC_C1(orig + ALLOC_OFF_HEAD) = ALLOC_MAGIC_F;
+    ALLOC_C1((char *)orig + ALLOC_OFF_HEAD) = ALLOC_MAGIC_F;
 
     free(orig);
 
@@ -374,13 +374,13 @@ static inline void *DFL_ck_realloc(void *orig, u32 size) {
 
   #endif                                                   /* ^!DEBUG_BUILD */
 
-  ret += ALLOC_OFF_HEAD;
+  ret = (char *)ret + ALLOC_OFF_HEAD;
 
   ALLOC_C1(ret) = ALLOC_MAGIC_C1;
   ALLOC_S(ret) = size;
   ALLOC_C2(ret) = ALLOC_MAGIC_C2;
 
-  if (size > old_size) memset(ret + old_size, 0, size - old_size);
+  if (size > old_size) memset((char *)ret + old_size, 0, size - old_size);
 
   return ret;
 
@@ -401,7 +401,7 @@ static inline u8 *DFL_ck_strdup(u8 *str) {
   ret = malloc(size + ALLOC_OFF_TOTAL);
   ALLOC_CHECK_RESULT(ret, size);
 
-  ret += ALLOC_OFF_HEAD;
+  ret = (char *)ret + ALLOC_OFF_HEAD;
 
   ALLOC_C1(ret) = ALLOC_MAGIC_C1;
   ALLOC_S(ret) = size;
-- 
cgit v1.2.3