From a0e884cf8bffe1a0394d106375f6a23edd2b60e6 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 15 Jan 2021 16:56:40 +0100
Subject: merge cmplog

---
 include/afl-fuzz.h | 21 ++++++++++++++++++---
 include/cmplog.h   | 17 ++++++++++-------
 include/debug.h    | 24 ++++++++++++------------
 include/types.h    | 43 ++++++++++++++++++++++++++++++++++++-------
 4 files changed, 76 insertions(+), 29 deletions(-)

(limited to 'include')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 988a907d..8a2122dc 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -145,12 +145,22 @@ extern s16 interesting_16[INTERESTING_8_LEN + INTERESTING_16_LEN];
 extern s32
     interesting_32[INTERESTING_8_LEN + INTERESTING_16_LEN + INTERESTING_32_LEN];
 
+struct tainted {
+
+  u32             pos;
+  u32             len;
+  struct tainted *next;
+  struct tainted *prev;
+
+};
+
 struct queue_entry {
 
   u8 *fname;                            /* File name for the test case      */
   u32 len;                              /* Input length                     */
 
-  u8   cal_failed;                      /* Calibration failed?              */
+  u8 colorized,                         /* Do not run redqueen stage again  */
+      cal_failed;                       /* Calibration failed?              */
   bool trim_done,                       /* Trimmed?                         */
       was_fuzzed,                       /* historical, but needed for MOpt  */
       passed_det,                       /* Deterministic stages passed?     */
@@ -158,7 +168,6 @@ struct queue_entry {
       var_behavior,                     /* Variable behavior?               */
       favored,                          /* Currently favored?               */
       fs_redundant,                     /* Marked as redundant in the fs?   */
-      fully_colorized,                  /* Do not run redqueen stage again  */
       is_ascii,                         /* Is the input just ascii text?    */
       disabled;                         /* Is disabled from fuzz selection  */
 
@@ -183,7 +192,11 @@ struct queue_entry {
 
   u8 *testcase_buf;                     /* The testcase buffer, if loaded.  */
 
-  struct queue_entry *next;             /* Next element, if any             */
+  u8 *            cmplog_colorinput;    /* the result buf of colorization   */
+  struct tainted *taint;                /* Taint information from CmpLog    */
+
+  struct queue_entry *mother,           /* queue entry this based on        */
+      *next;                            /* Next element, if any             */
 
 };
 
@@ -636,6 +649,8 @@ typedef struct afl_state {
   /* cmplog forkserver ids */
   s32 cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd;
   u32 cmplog_prev_timed_out;
+  u32 cmplog_max_filesize;
+  u32 cmplog_lvl;
 
   struct afl_pass_stat *pass_stats;
   struct cmp_map *      orig_cmp_map;
diff --git a/include/cmplog.h b/include/cmplog.h
index bf557785..6392c503 100644
--- a/include/cmplog.h
+++ b/include/cmplog.h
@@ -30,8 +30,10 @@
 
 #include "config.h"
 
+#define CMPLOG_LVL_MAX 3
+
 #define CMP_MAP_W 65536
-#define CMP_MAP_H 256
+#define CMP_MAP_H 32
 #define CMP_MAP_RTN_H (CMP_MAP_H / 4)
 
 #define SHAPE_BYTES(x) (x + 1)
@@ -41,13 +43,12 @@
 
 struct cmp_header {
 
-  unsigned hits : 20;
-
-  unsigned cnt : 20;
-  unsigned id : 16;
-
-  unsigned shape : 5;  // from 0 to 31
+  unsigned hits : 24;
+  unsigned id : 24;
+  unsigned shape : 5;
   unsigned type : 1;
+  unsigned attribute : 4;
+  unsigned reserved : 6;
 
 } __attribute__((packed));
 
@@ -55,6 +56,8 @@ struct cmp_operands {
 
   u64 v0;
   u64 v1;
+  u64 v0_128;
+  u64 v1_128;
 
 };
 
diff --git a/include/debug.h b/include/debug.h
index ef5b195b..fc1f39cb 100644
--- a/include/debug.h
+++ b/include/debug.h
@@ -295,8 +295,8 @@ static inline const char *colorfilter(const char *x) {
                                                                          \
     SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD                            \
          "\n[-] PROGRAM ABORT : " cRST   x);                               \
-    SAYF(cLRD "\n         Location : " cRST "%s(), %s:%d\n\n", __func__, \
-         __FILE__, __LINE__);                                            \
+    SAYF(cLRD "\n         Location : " cRST "%s(), %s:%u\n\n", __func__, \
+         __FILE__, (u32)__LINE__);                                       \
     exit(1);                                                             \
                                                                          \
   } while (0)
@@ -308,8 +308,8 @@ static inline const char *colorfilter(const char *x) {
                                                                          \
     SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD                            \
          "\n[-] PROGRAM ABORT : " cRST   x);                               \
-    SAYF(cLRD "\n    Stop location : " cRST "%s(), %s:%d\n\n", __func__, \
-         __FILE__, __LINE__);                                            \
+    SAYF(cLRD "\n    Stop location : " cRST "%s(), %s:%u\n\n", __func__, \
+         __FILE__, (u32)__LINE__);                                       \
     abort();                                                             \
                                                                          \
   } while (0)
@@ -322,8 +322,8 @@ static inline const char *colorfilter(const char *x) {
     fflush(stdout);                                                    \
     SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD                          \
          "\n[-]  SYSTEM ERROR : " cRST   x);                             \
-    SAYF(cLRD "\n    Stop location : " cRST "%s(), %s:%d\n", __func__, \
-         __FILE__, __LINE__);                                          \
+    SAYF(cLRD "\n    Stop location : " cRST "%s(), %s:%u\n", __func__, \
+         __FILE__, (u32)__LINE__);                                     \
     SAYF(cLRD "       OS message : " cRST "%s\n", strerror(errno));    \
     exit(1);                                                           \
                                                                        \
@@ -344,12 +344,12 @@ static inline const char *colorfilter(const char *x) {
 
 /* Show a prefixed debug output. */
 
-#define DEBUGF(x...)                         \
-  do {                                       \
-                                             \
-    SAYF(cMGN "[D] " cBRI "DEBUG: " cRST x); \
-    SAYF(cRST "");                           \
-                                             \
+#define DEBUGF(x...)                                    \
+  do {                                                  \
+                                                        \
+    fprintf(stderr, cMGN "[D] " cBRI "DEBUG: " cRST x); \
+    fprintf(stderr, cRST "");                           \
+                                                        \
   } while (0)
 
 /* Error-checking versions of read() and write() that call RPFATAL() as
diff --git a/include/types.h b/include/types.h
index 3e3bc953..d5c31597 100644
--- a/include/types.h
+++ b/include/types.h
@@ -26,9 +26,11 @@
 #include <stdint.h>
 #include <stdlib.h>
 
-typedef uint8_t  u8;
-typedef uint16_t u16;
-typedef uint32_t u32;
+typedef uint8_t           u8;
+typedef uint16_t          u16;
+typedef uint32_t          u32;
+typedef unsigned __int128 uint128_t;
+typedef uint128_t         u128;
 
 /* Extended forkserver option values */
 
@@ -57,10 +59,12 @@ typedef uint32_t u32;
 
 typedef unsigned long long u64;
 
-typedef int8_t  s8;
-typedef int16_t s16;
-typedef int32_t s32;
-typedef int64_t s64;
+typedef int8_t   s8;
+typedef int16_t  s16;
+typedef int32_t  s32;
+typedef int64_t  s64;
+typedef __int128 int128_t;
+typedef int128_t s128;
 
 #ifndef MIN
   #define MIN(a, b)           \
@@ -114,6 +118,31 @@ typedef int64_t s64;
                                                                                \
   })
 
+// It is impossible to define 128 bit constants, so ...
+#define SWAPN(_x, _l)                            \
+  ({                                             \
+                                                 \
+    u128  _res = (_x), _ret;                     \
+    char *d = (char *)&_ret, *s = (char *)&_res; \
+    int   i;                                     \
+    for (i = 0; i < 16; i++)                     \
+      d[15 - i] = s[i];                          \
+    u32 sr = 128U - ((_l) << 3U);                \
+    (_ret >>= sr);                               \
+    (u128) _ret;                                 \
+                                                 \
+  })
+
+#define SWAPNN(_x, _y, _l)                     \
+  ({                                           \
+                                               \
+    char *d = (char *)(_x), *s = (char *)(_y); \
+    u32   i, l = (_l)-1;                       \
+    for (i = 0; i <= l; i++)                   \
+      d[l - i] = s[i];                         \
+                                               \
+  })
+
 #ifdef AFL_LLVM_PASS
   #if defined(__linux__) || !defined(__ANDROID__)
     #define AFL_SR(s) (srandom(s))
-- 
cgit 1.4.1


From c71ce79963ffd3e1203d1078b8a60f91c4ecebf1 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 17 Jan 2021 15:18:20 +0100
Subject: fix colorization

---
 GNUmakefile                         |  4 +--
 include/afl-fuzz.h                  |  4 +--
 instrumentation/afl-compiler-rt.o.c |  3 +-
 src/afl-fuzz-one.c                  |  6 ++--
 src/afl-fuzz-redqueen.c             | 56 ++++++++++++++++++++++---------------
 src/afl-fuzz.c                      |  2 ++
 src/afl-showmap.c                   | 25 ++++++++++++++---
 7 files changed, 65 insertions(+), 35 deletions(-)

(limited to 'include')

diff --git a/GNUmakefile b/GNUmakefile
index 7b05a1d5..c71a7d47 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -428,8 +428,8 @@ src/afl-sharedmem.o : $(COMM_HDR) src/afl-sharedmem.c include/sharedmem.h
 afl-fuzz: $(COMM_HDR) include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o | test_x86
 	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o $@ $(PYFLAGS) $(LDFLAGS) -lm
 
-afl-showmap: src/afl-showmap.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o -o $@ $(LDFLAGS)
+afl-showmap: src/afl-showmap.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o $@ $(LDFLAGS)
 
 afl-tmin: src/afl-tmin.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o $(COMM_HDR) | test_x86
 	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o $@ $(LDFLAGS)
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 8a2122dc..621e8745 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -1136,9 +1136,9 @@ void   read_foreign_testcases(afl_state_t *, int);
 u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len);
 
 /* RedQueen */
-u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
-                        u64 exec_cksum);
+u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len);
 
+/* our RNG wrapper */
 AFL_RAND_RETURN rand_next(afl_state_t *afl);
 
 /* probability between 0.0 and 1.0 */
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 5d75af78..bbec52f9 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1209,7 +1209,8 @@ void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) {
 
 void __cmplog_ins_hook1(uint8_t arg1, uint8_t arg2, uint8_t attr) {
 
-  // fprintf(stderr, "hook1 arg0=%02x arg1=%02x attr=%u\n", arg1, arg2, attr);
+  // fprintf(stderr, "hook1 arg0=%02x arg1=%02x attr=%u\n",
+  //         (u8) arg1, (u8) arg2, attr);
 
   if (unlikely(!__afl_cmp_map)) return;
 
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 596bae22..4ce22c08 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -562,8 +562,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
           !(afl->fsrv.total_execs % afl->queued_paths) ||
           get_cur_time() - afl->last_path_time > 15000) {
 
-        if (input_to_state_stage(afl, in_buf, out_buf, len,
-                                 afl->queue_cur->exec_cksum)) {
+        if (input_to_state_stage(afl, in_buf, out_buf, len)) {
 
           goto abandon_entry;
 
@@ -2986,8 +2985,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
           !(afl->fsrv.total_execs % afl->queued_paths) ||
           get_cur_time() - afl->last_path_time > 15000) {
 
-        if (input_to_state_stage(afl, in_buf, out_buf, len,
-                                 afl->queue_cur->exec_cksum)) {
+        if (input_to_state_stage(afl, in_buf, out_buf, len)) {
 
           goto abandon_entry;
 
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index 955a9232..052f59f1 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -88,7 +88,7 @@ static struct range *pop_biggest_range(struct range **ranges) {
 static void dump(char *txt, u8 *buf, u32 len) {
 
   u32 i;
-  fprintf(stderr, "DUMP %s %llx ", txt, hash64(buf, len, 0));
+  fprintf(stderr, "DUMP %s %llx ", txt, hash64(buf, len, HASH_CONST));
   for (i = 0; i < len; i++)
     fprintf(stderr, "%02x", buf[i]);
   fprintf(stderr, "\n");
@@ -117,6 +117,7 @@ static u8 get_exec_checksum(afl_state_t *afl, u8 *buf, u32 len, u64 *cksum) {
   if (unlikely(common_fuzz_stuff(afl, buf, len))) { return 1; }
 
   *cksum = hash64(afl->fsrv.trace_bits, afl->fsrv.map_size, HASH_CONST);
+
   return 0;
 
 }
@@ -200,7 +201,7 @@ static void type_replace(afl_state_t *afl, u8 *buf, u32 len) {
 
 }
 
-static u8 colorization(afl_state_t *afl, u8 *buf, u32 len, u64 exec_cksum,
+static u8 colorization(afl_state_t *afl, u8 *buf, u32 len,
                        struct tainted **taints) {
 
   struct range *  ranges = add_range(NULL, 0, len - 1), *rng;
@@ -208,18 +209,31 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len, u64 exec_cksum,
   u8 *            backup = ck_alloc_nozero(len);
   u8 *            changed = ck_alloc_nozero(len);
 
-  u64 orig_hit_cnt, new_hit_cnt;
+  u64 orig_hit_cnt, new_hit_cnt, exec_cksum;
   orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
 
   afl->stage_name = "colorization";
   afl->stage_short = "colorization";
   afl->stage_max = (len << 1);
-
   afl->stage_cur = 0;
+
+  // in colorization we do not classify counts, hence we have to calculate
+  // the original checksum!
+  if (unlikely(get_exec_checksum(afl, buf, len, &exec_cksum))) {
+
+    goto checksum_fail;
+
+  }
+
   memcpy(backup, buf, len);
   memcpy(changed, buf, len);
   type_replace(afl, changed, len);
 
+#ifdef _DEBUG
+  dump("ORIG", buf, len);
+  dump("CHAN", changed, len);
+#endif
+
   while ((rng = pop_biggest_range(&ranges)) != NULL &&
          afl->stage_cur < afl->stage_max) {
 
@@ -227,7 +241,7 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len, u64 exec_cksum,
 
     memcpy(buf + rng->start, changed + rng->start, s);
 
-    u64 cksum;
+    u64 cksum = 0;
     u64 start_us = get_cur_time_us();
     if (unlikely(get_exec_checksum(afl, buf, len, &cksum))) {
 
@@ -633,11 +647,11 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
     if (SHAPE_BYTES(h->shape) >= 4 && *status != 1) {
 
       // if (its_len >= 4 && (attr <= 1 || attr >= 8))
-      // fprintf(stderr,
-      //         "TestU32: %u>=4 %x==%llx"
-      //         " %x==%llx (idx=%u attr=%u) <= %llx<-%llx\n",
-      //         its_len, *buf_32, pattern, *o_buf_32, o_pattern, idx, attr,
-      //         repl, changed_val);
+      //   fprintf(stderr,
+      //           "TestU32: %u>=4 %x==%llx"
+      //           " %x==%llx (idx=%u attr=%u) <= %llx<-%llx\n",
+      //           its_len, *buf_32, pattern, *o_buf_32, o_pattern, idx, attr,
+      //           repl, changed_val);
 
       if (its_len >= 4 &&
           ((*buf_32 == (u32)pattern && *o_buf_32 == (u32)o_pattern) ||
@@ -702,10 +716,10 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
     if (*status != 1) {  // u8
 
       // if (its_len >= 1 && (attr <= 1 || attr >= 8))
-      // fprintf(stderr,
-      //         "TestU8: %u>=1 %x==%x %x==%x (idx=%u attr=%u) <= %x<-%x\n",
-      //         its_len, *buf_8, pattern, *o_buf_8, o_pattern, idx, attr,
-      //         repl, changed_val);
+      //   fprintf(stderr,
+      //           "TestU8: %u>=1 %x==%x %x==%x (idx=%u attr=%u) <= %x<-%x\n",
+      //           its_len, *buf_8, (u8)pattern, *o_buf_8, (u8)o_pattern, idx,
+      //           attr, (u8)repl, (u8)changed_val);
 
       if (its_len >= 1 &&
           ((*buf_8 == (u8)pattern && *o_buf_8 == (u8)o_pattern) ||
@@ -1659,8 +1673,7 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
 ///// Input to State stage
 
 // afl->queue_cur->exec_cksum
-u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
-                        u64 exec_cksum) {
+u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
 
   u8 r = 1;
   if (unlikely(!afl->orig_cmp_map)) {
@@ -1686,7 +1699,7 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
 
   if (!afl->queue_cur->taint || !afl->queue_cur->cmplog_colorinput) {
 
-    if (unlikely(colorization(afl, buf, len, exec_cksum, &taint))) { return 1; }
+    if (unlikely(colorization(afl, buf, len, &taint))) { return 1; }
 
     // no taint? still try, create a dummy to prevent again colorization
     if (!taint) {
@@ -1696,6 +1709,10 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
 
     }
 
+#ifdef _DEBUG
+    dump("NEW ", buf, len);
+#endif
+
   } else {
 
     buf = afl->queue_cur->cmplog_colorinput;
@@ -1705,11 +1722,6 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
 
   }
 
-#ifdef _DEBUG
-  dump("ORIG", orig_buf, len);
-  dump("NEW ", buf, len);
-#endif
-
   struct tainted *t = taint;
 
   while (t) {
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 1e914ca6..88c40ee8 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1094,6 +1094,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
+  if (afl->shm.cmplog_mode) { OKF("CmpLog level: %u", afl->cmplog_lvl); }
+
   /* Dynamically allocate memory for AFLFast schedules */
   if (afl->schedule >= FAST && afl->schedule <= RARE) {
 
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 5c9d38e0..5d98d646 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -42,6 +42,7 @@
 #include "sharedmem.h"
 #include "forkserver.h"
 #include "common.h"
+#include "hash.h"
 
 #include <stdio.h>
 #include <unistd.h>
@@ -86,7 +87,8 @@ static u8 quiet_mode,                  /* Hide non-essential messages?      */
     binary_mode,                       /* Write output as a binary map      */
     keep_cores,                        /* Allow coredumps?                  */
     remove_shm = 1,                    /* remove shmem?                     */
-    collect_coverage;                  /* collect coverage                  */
+    collect_coverage,                  /* collect coverage                  */
+    no_classify;                       /* do not classify counts            */
 
 static volatile u8 stop_soon,          /* Ctrl-C pressed?                   */
     child_crashed;                     /* Child crashed?                    */
@@ -317,7 +319,9 @@ static void showmap_run_target_forkserver(afl_forkserver_t *fsrv, u8 *mem,
 
   }
 
-  classify_counts(fsrv);
+  if (fsrv->trace_bits[0] == 1) { fsrv->trace_bits[0] = 0; }
+
+  if (!no_classify) { classify_counts(fsrv); }
 
   if (!quiet_mode) { SAYF(cRST "-- Program output ends --\n"); }
 
@@ -490,7 +494,9 @@ static void showmap_run_target(afl_forkserver_t *fsrv, char **argv) {
 
   }
 
-  classify_counts(fsrv);
+  if (fsrv->trace_bits[0] == 1) { fsrv->trace_bits[0] = 0; }
+
+  if (!no_classify) { classify_counts(fsrv); }
 
   if (!quiet_mode) { SAYF(cRST "-- Program output ends --\n"); }
 
@@ -680,6 +686,7 @@ static void usage(u8 *argv0) {
       "  -q            - sink program's output and don't show messages\n"
       "  -e            - show edge coverage only, ignore hit counts\n"
       "  -r            - show real tuple values instead of AFL filter values\n"
+      "  -s            - do not classify the map\n"
       "  -c            - allow core dumps\n\n"
 
       "This tool displays raw tuple data captured by AFL instrumentation.\n"
@@ -729,10 +736,14 @@ int main(int argc, char **argv_orig, char **envp) {
 
   if (getenv("AFL_QUIET") != NULL) { be_quiet = 1; }
 
-  while ((opt = getopt(argc, argv, "+i:o:f:m:t:A:eqCZQUWbcrh")) > 0) {
+  while ((opt = getopt(argc, argv, "+i:o:f:m:t:A:eqCZQUWbcrsh")) > 0) {
 
     switch (opt) {
 
+      case 's':
+        no_classify = 1;
+        break;
+
       case 'C':
         collect_coverage = 1;
         quiet_mode = 1;
@@ -1213,6 +1224,12 @@ int main(int argc, char **argv_orig, char **envp) {
 
     showmap_run_target(fsrv, use_argv);
     tcnt = write_results_to_file(fsrv, out_file);
+    if (!quiet_mode) {
+
+      OKF("Hash of coverage map: %llx",
+          hash64(fsrv->trace_bits, fsrv->map_size, HASH_CONST));
+
+    }
 
   }
 
-- 
cgit 1.4.1


From 0b545aaeb45141e91273f2358ec457293c341c92 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 18 Jan 2021 20:18:18 +0100
Subject: use enums, support cmplog map collisions

---
 include/cmplog.h                            |   8 +-
 include/config.h                            |   2 -
 include/types.h                             |  47 ++++---
 instrumentation/afl-compiler-rt.o.c         | 201 ++++++++++++++++++++++------
 instrumentation/cmplog-instructions-pass.cc |   4 +
 instrumentation/llvm-ngram-coverage.h       |   2 +-
 src/afl-fuzz-redqueen.c                     | 129 +++++++++++-------
 7 files changed, 276 insertions(+), 117 deletions(-)

(limited to 'include')

diff --git a/include/cmplog.h b/include/cmplog.h
index 6392c503..878ed60c 100644
--- a/include/cmplog.h
+++ b/include/cmplog.h
@@ -38,17 +38,17 @@
 
 #define SHAPE_BYTES(x) (x + 1)
 
-#define CMP_TYPE_INS 0
-#define CMP_TYPE_RTN 1
+#define CMP_TYPE_INS 1
+#define CMP_TYPE_RTN 2
 
 struct cmp_header {
 
   unsigned hits : 24;
   unsigned id : 24;
   unsigned shape : 5;
-  unsigned type : 1;
+  unsigned type : 2;
   unsigned attribute : 4;
-  unsigned reserved : 6;
+  unsigned reserved : 5;
 
 } __attribute__((packed));
 
diff --git a/include/config.h b/include/config.h
index c0cd0ef1..c9c4a677 100644
--- a/include/config.h
+++ b/include/config.h
@@ -23,8 +23,6 @@
 #ifndef _HAVE_CONFIG_H
 #define _HAVE_CONFIG_H
 
-#include "types.h"
-
 /* Version string: */
 
 // c = release, d = volatile github dev, e = experimental branch
diff --git a/include/types.h b/include/types.h
index d5c31597..7b94fb83 100644
--- a/include/types.h
+++ b/include/types.h
@@ -25,12 +25,15 @@
 
 #include <stdint.h>
 #include <stdlib.h>
+#include "config.h"
 
-typedef uint8_t           u8;
-typedef uint16_t          u16;
-typedef uint32_t          u32;
+typedef uint8_t  u8;
+typedef uint16_t u16;
+typedef uint32_t u32;
+#ifdef WORD_SIZE_64
 typedef unsigned __int128 uint128_t;
 typedef uint128_t         u128;
+#endif
 
 /* Extended forkserver option values */
 
@@ -59,12 +62,14 @@ typedef uint128_t         u128;
 
 typedef unsigned long long u64;
 
-typedef int8_t   s8;
-typedef int16_t  s16;
-typedef int32_t  s32;
-typedef int64_t  s64;
+typedef int8_t  s8;
+typedef int16_t s16;
+typedef int32_t s32;
+typedef int64_t s64;
+#ifdef WORD_SIZE_64
 typedef __int128 int128_t;
 typedef int128_t s128;
+#endif
 
 #ifndef MIN
   #define MIN(a, b)           \
@@ -119,19 +124,21 @@ typedef int128_t s128;
   })
 
 // It is impossible to define 128 bit constants, so ...
-#define SWAPN(_x, _l)                            \
-  ({                                             \
-                                                 \
-    u128  _res = (_x), _ret;                     \
-    char *d = (char *)&_ret, *s = (char *)&_res; \
-    int   i;                                     \
-    for (i = 0; i < 16; i++)                     \
-      d[15 - i] = s[i];                          \
-    u32 sr = 128U - ((_l) << 3U);                \
-    (_ret >>= sr);                               \
-    (u128) _ret;                                 \
-                                                 \
-  })
+#ifdef WORD_SIZE_64
+  #define SWAPN(_x, _l)                            \
+    ({                                             \
+                                                   \
+      u128  _res = (_x), _ret;                     \
+      char *d = (char *)&_ret, *s = (char *)&_res; \
+      int   i;                                     \
+      for (i = 0; i < 16; i++)                     \
+        d[15 - i] = s[i];                          \
+      u32 sr = 128U - ((_l) << 3U);                \
+      (_ret >>= sr);                               \
+      (u128) _ret;                                 \
+                                                   \
+    })
+#endif
 
 #define SWAPNN(_x, _y, _l)                     \
   ({                                           \
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index edb635ae..0ce96673 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1218,15 +1218,22 @@ void __cmplog_ins_hook1(uint8_t arg1, uint8_t arg2, uint8_t attr) {
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
 
-  __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
-  __afl_cmp_map->headers[k].attribute = attr;
+  u32 hits;
+
+  if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
 
-  u32 hits = __afl_cmp_map->headers[k].hits;
-  __afl_cmp_map->headers[k].hits = hits + 1;
-  // if (!__afl_cmp_map->headers[k].cnt)
-  //  __afl_cmp_map->headers[k].cnt = __afl_cmp_counter++;
+    __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+    hits = 0;
+    __afl_cmp_map->headers[k].hits = 1;
+    __afl_cmp_map->headers[k].shape = 0;
 
-  __afl_cmp_map->headers[k].shape = 0;
+  } else {
+
+    hits = __afl_cmp_map->headers[k].hits++;
+
+  }
+
+  __afl_cmp_map->headers[k].attribute = attr;
 
   hits &= CMP_MAP_H - 1;
   __afl_cmp_map->log[k][hits].v0 = arg1;
@@ -1242,13 +1249,28 @@ void __cmplog_ins_hook2(uint16_t arg1, uint16_t arg2, uint8_t attr) {
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
 
-  __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
-  __afl_cmp_map->headers[k].attribute = attr;
+  u32 hits;
 
-  u32 hits = __afl_cmp_map->headers[k].hits;
-  __afl_cmp_map->headers[k].hits = hits + 1;
+  if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
 
-  __afl_cmp_map->headers[k].shape = 1;
+    __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+    hits = 0;
+    __afl_cmp_map->headers[k].hits = 1;
+    __afl_cmp_map->headers[k].shape = 1;
+
+  } else {
+
+    hits = __afl_cmp_map->headers[k].hits++;
+
+    if (!__afl_cmp_map->headers[k].shape) {
+
+      __afl_cmp_map->headers[k].shape = 1;
+
+    }
+
+  }
+
+  __afl_cmp_map->headers[k].attribute = attr;
 
   hits &= CMP_MAP_H - 1;
   __afl_cmp_map->log[k][hits].v0 = arg1;
@@ -1266,13 +1288,28 @@ void __cmplog_ins_hook4(uint32_t arg1, uint32_t arg2, uint8_t attr) {
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
 
-  __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
-  __afl_cmp_map->headers[k].attribute = attr;
+  u32 hits;
+
+  if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
+    __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+    hits = 0;
+    __afl_cmp_map->headers[k].hits = 1;
+    __afl_cmp_map->headers[k].shape = 3;
+
+  } else {
+
+    hits = __afl_cmp_map->headers[k].hits++;
 
-  u32 hits = __afl_cmp_map->headers[k].hits;
-  __afl_cmp_map->headers[k].hits = hits + 1;
+    if (__afl_cmp_map->headers[k].shape < 3) {
 
-  __afl_cmp_map->headers[k].shape = 3;
+      __afl_cmp_map->headers[k].shape = 3;
+
+    }
+
+  }
+
+  __afl_cmp_map->headers[k].attribute = attr;
 
   hits &= CMP_MAP_H - 1;
   __afl_cmp_map->log[k][hits].v0 = arg1;
@@ -1282,7 +1319,7 @@ void __cmplog_ins_hook4(uint32_t arg1, uint32_t arg2, uint8_t attr) {
 
 void __cmplog_ins_hook8(uint64_t arg1, uint64_t arg2, uint8_t attr) {
 
-   fprintf(stderr, "hook8 arg0=%lx arg1=%lx attr=%u\n", arg1, arg2, attr);
+  // fprintf(stderr, "hook8 arg0=%lx arg1=%lx attr=%u\n", arg1, arg2, attr);
 
   if (unlikely(!__afl_cmp_map || arg1 == arg2)) return;
 
@@ -1290,13 +1327,28 @@ void __cmplog_ins_hook8(uint64_t arg1, uint64_t arg2, uint8_t attr) {
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
 
-  __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
-  __afl_cmp_map->headers[k].attribute = attr;
+  u32 hits;
 
-  u32 hits = __afl_cmp_map->headers[k].hits;
-  __afl_cmp_map->headers[k].hits = hits + 1;
+  if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
 
-  __afl_cmp_map->headers[k].shape = 7;
+    __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+    hits = 0;
+    __afl_cmp_map->headers[k].hits = 1;
+    __afl_cmp_map->headers[k].shape = 7;
+
+  } else {
+
+    hits = __afl_cmp_map->headers[k].hits++;
+
+    if (__afl_cmp_map->headers[k].shape < 7) {
+
+      __afl_cmp_map->headers[k].shape = 7;
+
+    }
+
+  }
+
+  __afl_cmp_map->headers[k].attribute = attr;
 
   hits &= CMP_MAP_H - 1;
   __afl_cmp_map->log[k][hits].v0 = arg1;
@@ -1304,6 +1356,7 @@ void __cmplog_ins_hook8(uint64_t arg1, uint64_t arg2, uint8_t attr) {
 
 }
 
+#ifdef WORD_SIZE_64
 // support for u24 to u120 via llvm _ExitInt(). size is in bytes minus 1
 void __cmplog_ins_hookN(uint128_t arg1, uint128_t arg2, uint8_t attr,
                         uint8_t size) {
@@ -1318,13 +1371,28 @@ void __cmplog_ins_hookN(uint128_t arg1, uint128_t arg2, uint8_t attr,
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
 
-  __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
-  __afl_cmp_map->headers[k].attribute = attr;
+  u32 hits;
 
-  u32 hits = __afl_cmp_map->headers[k].hits;
-  __afl_cmp_map->headers[k].hits = hits + 1;
+  if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
 
-  __afl_cmp_map->headers[k].shape = size;
+    __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+    hits = 0;
+    __afl_cmp_map->headers[k].hits = 1;
+    __afl_cmp_map->headers[k].shape = size;
+
+  } else {
+
+    hits = __afl_cmp_map->headers[k].hits++;
+
+    if (__afl_cmp_map->headers[k].shape < size) {
+
+      __afl_cmp_map->headers[k].shape = size;
+
+    }
+
+  }
+
+  __afl_cmp_map->headers[k].attribute = attr;
 
   hits &= CMP_MAP_H - 1;
   __afl_cmp_map->log[k][hits].v0 = (u64)arg1;
@@ -1347,13 +1415,28 @@ void __cmplog_ins_hook16(uint128_t arg1, uint128_t arg2, uint8_t attr) {
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
 
-  __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
-  __afl_cmp_map->headers[k].attribute = attr;
+  u32 hits;
 
-  u32 hits = __afl_cmp_map->headers[k].hits;
-  __afl_cmp_map->headers[k].hits = hits + 1;
+  if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
 
-  __afl_cmp_map->headers[k].shape = 15;
+    __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+    hits = 0;
+    __afl_cmp_map->headers[k].hits = 1;
+    __afl_cmp_map->headers[k].shape = 15;
+
+  } else {
+
+    hits = __afl_cmp_map->headers[k].hits++;
+
+    if (__afl_cmp_map->headers[k].shape < 15) {
+
+      __afl_cmp_map->headers[k].shape = 15;
+
+    }
+
+  }
+
+  __afl_cmp_map->headers[k].attribute = attr;
 
   hits &= CMP_MAP_H - 1;
   __afl_cmp_map->log[k][hits].v0 = (u64)arg1;
@@ -1363,6 +1446,8 @@ void __cmplog_ins_hook16(uint128_t arg1, uint128_t arg2, uint8_t attr) {
 
 }
 
+#endif
+
 #if defined(__APPLE__)
   #pragma weak __sanitizer_cov_trace_const_cmp1 = __cmplog_ins_hook1
   #pragma weak __sanitizer_cov_trace_const_cmp2 = __cmplog_ins_hook2
@@ -1384,8 +1469,10 @@ void __sanitizer_cov_trace_const_cmp4(uint32_t arg1, uint32_t arg2)
     __attribute__((alias("__cmplog_ins_hook4")));
 void __sanitizer_cov_trace_const_cmp8(uint64_t arg1, uint64_t arg2)
     __attribute__((alias("__cmplog_ins_hook8")));
+  #ifdef WORD_SIZE_64
 void __sanitizer_cov_trace_const_cmp16(uint128_t arg1, uint128_t arg2)
     __attribute__((alias("__cmplog_ins_hook16")));
+  #endif
 
 void __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2)
     __attribute__((alias("__cmplog_ins_hook1")));
@@ -1395,8 +1482,10 @@ void __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2)
     __attribute__((alias("__cmplog_ins_hook4")));
 void __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2)
     __attribute__((alias("__cmplog_ins_hook8")));
+  #ifdef WORD_SIZE_64
 void __sanitizer_cov_trace_cmp16(uint128_t arg1, uint128_t arg2)
     __attribute__((alias("__cmplog_ins_hook16")));
+  #endif
 #endif                                                /* defined(__APPLE__) */
 
 void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
@@ -1409,12 +1498,28 @@ void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
     k = (k >> 4) ^ (k << 8);
     k &= CMP_MAP_W - 1;
 
-    __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+    u32 hits;
 
-    u32 hits = __afl_cmp_map->headers[k].hits;
-    __afl_cmp_map->headers[k].hits = hits + 1;
+    if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
 
-    __afl_cmp_map->headers[k].shape = 7;
+      __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+      hits = 0;
+      __afl_cmp_map->headers[k].hits = 1;
+      __afl_cmp_map->headers[k].shape = 7;
+
+    } else {
+
+      hits = __afl_cmp_map->headers[k].hits++;
+
+      if (__afl_cmp_map->headers[k].shape < 7) {
+
+        __afl_cmp_map->headers[k].shape = 7;
+
+      }
+
+    }
+
+    __afl_cmp_map->headers[k].attribute = 1;
 
     hits &= CMP_MAP_H - 1;
     __afl_cmp_map->log[k][hits].v0 = val;
@@ -1448,12 +1553,26 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
 
-  __afl_cmp_map->headers[k].type = CMP_TYPE_RTN;
+  u32 hits;
+
+  if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
+    __afl_cmp_map->headers[k].type = CMP_TYPE_RTN;
+    hits = 0;
+    __afl_cmp_map->headers[k].hits = 1;
+    __afl_cmp_map->headers[k].shape = 31;
+
+  } else {
+
+    hits = __afl_cmp_map->headers[k].hits++;
+
+    if (__afl_cmp_map->headers[k].shape < 31) {
 
-  u32 hits = __afl_cmp_map->headers[k].hits;
-  __afl_cmp_map->headers[k].hits = hits + 1;
+      __afl_cmp_map->headers[k].shape = 31;
 
-  __afl_cmp_map->headers[k].shape = 31;
+    }
+
+  }
 
   hits &= CMP_MAP_RTN_H - 1;
   __builtin_memcpy(((struct cmpfn_operands *)__afl_cmp_map->log[k])[hits].v0,
diff --git a/instrumentation/cmplog-instructions-pass.cc b/instrumentation/cmplog-instructions-pass.cc
index a74fb6c8..6ce1832f 100644
--- a/instrumentation/cmplog-instructions-pass.cc
+++ b/instrumentation/cmplog-instructions-pass.cc
@@ -420,6 +420,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
                 IRB.CreateCall(cmplogHookIns8, args);
                 break;
               case 128:
+#ifdef WORD_SIZE_64
                 if (max_size == 128) {
 
                   IRB.CreateCall(cmplogHookIns16, args);
@@ -430,6 +431,9 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
 
                 }
 
+#endif
+                break;
+              default:
                 break;
 
             }
diff --git a/instrumentation/llvm-ngram-coverage.h b/instrumentation/llvm-ngram-coverage.h
index 12b666e9..666839c8 100644
--- a/instrumentation/llvm-ngram-coverage.h
+++ b/instrumentation/llvm-ngram-coverage.h
@@ -1,7 +1,7 @@
 #ifndef AFL_NGRAM_CONFIG_H
 #define AFL_NGRAM_CONFIG_H
 
-#include "../config.h"
+#include "types.h"
 
 #if (MAP_SIZE_POW2 <= 16)
 typedef u16 PREV_LOC_T;
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index fe98f031..56022fa6 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -33,7 +33,26 @@
 #define CMPLOG_INTROSPECTION
 //#define ARITHMETIC_LESSER_GREATER
 
-///// Colorization
+// CMP attribute enum
+enum {
+
+  IS_EQUAL = 1,
+  IS_GREATER = 2,
+  IS_LESSER = 4,
+  IS_FP = 8,
+  IS_FP_MOD = 16,
+  IS_INT_MOD = 32
+
+};
+
+// CMPLOG LVL
+enum {
+
+  LVL1 = 1,
+  LVL2 = 2,
+  LVL3 = 4
+
+};
 
 struct range {
 
@@ -545,8 +564,8 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
   unsigned long long unum;
   long long          num;
 
-  // reverse atoi()/strnu?toll() is expensive, so we only to it in lvl == 3
-  if (lvl & 4) {
+  // reverse atoi()/strnu?toll() is expensive, so we only to it in lvl 3
+  if (lvl & LVL3) {
 
     if (afl->queue_cur->is_ascii) {
 
@@ -618,7 +637,8 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
   // we only allow this for ascii2integer (above)
   if (unlikely(pattern == o_pattern)) { return 0; }
 
-  if ((lvl & 1) || ((lvl & 2) && (attr >= 8 && attr <= 15)) || attr >= 16) {
+  if ((lvl & LVL1) || ((lvl & LVL2) && (attr >= IS_FP && attr < IS_FP_MOD)) ||
+      attr >= IS_FP_MOD) {
 
     if (SHAPE_BYTES(h->shape) >= 8 && *status != 1) {
 
@@ -632,8 +652,8 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
       // if this is an fcmp (attr & 8 == 8) then do not compare the patterns -
       // due to a bug in llvm dynamic float bitcasts do not work :(
       // the value 16 means this is a +- 1.0 test case
-      if (its_len >= 8 &&
-          ((*buf_64 == pattern && *o_buf_64 == o_pattern) || attr >= 16)) {
+      if (its_len >= 8 && ((*buf_64 == pattern && *o_buf_64 == o_pattern) ||
+                           attr >= IS_FP_MOD)) {
 
         u64 tmp_64 = *buf_64;
         *buf_64 = repl;
@@ -674,7 +694,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
       if (its_len >= 4 &&
           ((*buf_32 == (u32)pattern && *o_buf_32 == (u32)o_pattern) ||
-           attr >= 16)) {
+           attr >= IS_FP_MOD)) {
 
         u32 tmp_32 = *buf_32;
         *buf_32 = (u32)repl;
@@ -708,7 +728,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
       if (its_len >= 2 &&
           ((*buf_16 == (u16)pattern && *o_buf_16 == (u16)o_pattern) ||
-           attr >= 16)) {
+           attr >= IS_FP_MOD)) {
 
         u16 tmp_16 = *buf_16;
         *buf_16 = (u16)repl;
@@ -738,7 +758,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
     if (*status != 1) {  // u8
 
-      // if (its_len >= 1 && (attr <= 1 || attr >= 8))
+      // if (its_len >= 1)
       //   fprintf(stderr,
       //           "TestU8: %u>=1 (idx=%u attr=%u) %x==%x %x==%x <= %x<-%x\n",
       //           its_len, idx, attr, *buf_8, (u8)pattern, *o_buf_8,
@@ -746,7 +766,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
       if (its_len >= 1 &&
           ((*buf_8 == (u8)pattern && *o_buf_8 == (u8)o_pattern) ||
-           attr >= 16)) {
+           attr >= IS_FP_MOD)) {
 
         u8 tmp_8 = *buf_8;
         *buf_8 = (u8)repl;
@@ -769,10 +789,11 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
   //                                                   in original buffer)
 
 #ifdef ARITHMETIC_LESSER_GREATER
-  if (lvl < 4) { return 0; }
+  if (lvl < LVL3) { return 0; }
 
   // lesser/greater FP comparison
-  if ((attr & 6) && (attr >= 8 && attr < 16)) {
+  if ((attr & (IS_LESSER + IS_GREATER)) &&
+      (attr >= IS_FP && attr < IS_FP_MOD)) {
 
     u64 repl_new;
     if (SHAPE_BYTES(h->shape) == 4 && its_len >= 4) {
@@ -869,7 +890,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
     }
 
-  } else if ((attr & 6) && attr < 8) {
+  } else if ((attr & (IS_LESSER + IS_GREATER)) && attr < IS_FP) {
 
     // lesser/greater integer comparison
 
@@ -903,6 +924,8 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
 }
 
+#ifdef WORD_SIZE_64
+
 static u8 cmp_extend_encodingN(afl_state_t *afl, struct cmp_header *h,
                                u128 pattern, u128 repl, u128 o_pattern,
                                u128 changed_val, u8 attr, u32 idx,
@@ -917,15 +940,15 @@ static u8 cmp_extend_encodingN(afl_state_t *afl, struct cmp_header *h,
   u8  backup[16];
   u32 its_len = MIN(len - idx, taint_len);
   u32 shape = h->shape + 1;
-#if (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
+  #if (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
   size_t off = 0;
-#else
+  #else
   size_t off = 16 - shape;
-#endif
+  #endif
 
   if (its_len >= shape) {
 
-#ifdef _DEBUG
+  #ifdef _DEBUG
     // fprintf(stderr, "TestUN: %u>=%u (len=%u idx=%u attr=%u off=%lu) (%u) ",
     //         its_len, shape, len, idx, attr, off, do_reverse);
     u32 i;
@@ -948,7 +971,7 @@ static u8 cmp_extend_encodingN(afl_state_t *afl, struct cmp_header *h,
     for (i = 0; i < shape; i++)
       fprintf(stderr, "%02x", o_r[off + i]);
     fprintf(stderr, "\n");
-#endif
+  #endif
 
     if (!memcmp(ptr, p + off, shape) && !memcmp(o_ptr, o_p + off, shape)) {
 
@@ -957,15 +980,15 @@ static u8 cmp_extend_encodingN(afl_state_t *afl, struct cmp_header *h,
 
       if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
 
-#ifdef COMBINE
+  #ifdef COMBINE
       if (*status == 1) { memcpy(cbuf + idx, r, shape); }
-#endif
+  #endif
 
       memcpy(ptr, backup, shape);
 
-#ifdef _DEBUG
+  #ifdef _DEBUG
       fprintf(stderr, "Status=%u\n", *status);
-#endif
+  #endif
 
     }
 
@@ -990,6 +1013,8 @@ static u8 cmp_extend_encodingN(afl_state_t *afl, struct cmp_header *h,
 
 }
 
+#endif
+
 static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
 
   u8 *b = (u8 *)&v;
@@ -1040,21 +1065,22 @@ static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
 
 }
 
+#ifdef WORD_SIZE_64
 static void try_to_add_to_dictN(afl_state_t *afl, u128 v, u8 size) {
 
   u8 *b = (u8 *)&v;
 
   u32 k;
   u8  cons_ff = 0, cons_0 = 0;
-#if (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
+  #if (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
   u32 off = 0;
   for (k = 0; k < size; ++k) {
 
-#else
-  u32    off = 16 - size;
+  #else
+  u32 off = 16 - size;
   for (k = 16 - size; k < 16; ++k) {
 
-#endif
+  #endif
     if (b[k] == 0) {
 
       ++cons_0;
@@ -1077,6 +1103,8 @@ static void try_to_add_to_dictN(afl_state_t *afl, u128 v, u8 size) {
 
 }
 
+#endif
+
 static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
                    u32 len, u32 lvl, struct tainted *taint) {
 
@@ -1091,11 +1119,13 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
   u8 found_one = 0;
 
   /* loop cmps are useless, detect and ignore them */
+#ifdef WORD_SIZE_64
   u128 s128_v0 = 0, s128_v1 = 0, orig_s128_v0 = 0, orig_s128_v1 = 0;
-  u64  s_v0, s_v1;
-  u8   s_v0_fixed = 1, s_v1_fixed = 1;
-  u8   s_v0_inc = 1, s_v1_inc = 1;
-  u8   s_v0_dec = 1, s_v1_dec = 1;
+#endif
+  u64 s_v0, s_v1;
+  u8  s_v0_fixed = 1, s_v1_fixed = 1;
+  u8  s_v0_inc = 1, s_v1_inc = 1;
+  u8  s_v0_dec = 1, s_v1_dec = 1;
 
   switch (SHAPE_BYTES(h->shape)) {
 
@@ -1110,7 +1140,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
   }
 
   // FP handling only from lvl 2 onwards
-  if ((h->attribute & 8) && lvl < 2) return 0;
+  if ((h->attribute & IS_FP) && lvl < LVL2) return 0;
 
   for (i = 0; i < loggeds; ++i) {
 
@@ -1162,6 +1192,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
 
     }
 
+#ifdef WORD_SIZE_64
     if (unlikely(is_n)) {
 
       s128_v0 = ((u128)o->v0) + (((u128)o->v0_128) << 64);
@@ -1171,6 +1202,8 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
 
     }
 
+#endif
+
     for (idx = 0; idx < len; ++idx) {
 
       if (have_taint) {
@@ -1195,6 +1228,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
 
       status = 0;
 
+#ifdef WORD_SIZE_64
       if (is_n) {  // _ExtInt special case including u128
 
         if (s128_v0 != orig_s128_v0 && orig_s128_v0 != orig_s128_v1) {
@@ -1239,11 +1273,13 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
 
       }
 
+#endif
+
       // even for u128 and _ExtInt we do cmp_extend_encoding() because
       // if we got here their own special trials failed and it might just be
       // a cast from e.g. u64 to u128 from the input data.
 
-      if ((o->v0 != orig_o->v0 || lvl >= 4) && orig_o->v0 != orig_o->v1) {
+      if ((o->v0 != orig_o->v0 || lvl >= LVL3) && orig_o->v0 != orig_o->v1) {
 
         if (unlikely(cmp_extend_encoding(
                 afl, h, o->v0, o->v1, orig_o->v0, orig_o->v1, h->attribute, idx,
@@ -1263,7 +1299,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
       }
 
       status = 0;
-      if ((o->v1 != orig_o->v1 || lvl >= 4) && orig_o->v0 != orig_o->v1) {
+      if ((o->v1 != orig_o->v1 || lvl >= LVL3) && orig_o->v0 != orig_o->v1) {
 
         if (unlikely(cmp_extend_encoding(
                 afl, h, o->v1, o->v0, orig_o->v1, orig_o->v0, h->attribute, idx,
@@ -1521,13 +1557,6 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
 
   }
 
-  // do it manually, forkserver clear only afl->fsrv.trace_bits
-  memset(afl->shm.cmp_map->headers, 0, sizeof(afl->shm.cmp_map->headers));
-
-  if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) { return 1; }
-
-  memcpy(afl->orig_cmp_map, afl->shm.cmp_map, sizeof(struct cmp_map));
-
   struct tainted *taint = NULL;
 
   if (!afl->queue_cur->taint || !afl->queue_cur->cmplog_colorinput) {
@@ -1562,8 +1591,6 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
 
     buf = afl->queue_cur->cmplog_colorinput;
     taint = afl->queue_cur->taint;
-    // reget the cmplog information
-    if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) { return 1; }
 
   }
 
@@ -1583,9 +1610,13 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
   u32 cmp_locations = 0;
 #endif
 
-  // do it manually, forkserver clear only afl->fsrv.trace_bits
-  memset(afl->shm.cmp_map->headers, 0, sizeof(afl->shm.cmp_map->headers));
-
+  // Generate the cmplog data
+  // manually clear the full cmp_map
+  memset(afl->shm.cmp_map, 0, sizeof(struct cmp_map));
+  if (unlikely(common_fuzz_cmplog_stuff(afl, orig_buf, len))) { return 1; }
+  memcpy(afl->orig_cmp_map, afl->shm.cmp_map, sizeof(struct cmp_map));
+  // manually clear just the headers
+  memset(afl->shm.cmp_map->headers, 0, sizeof(struct cmp_header));
   if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) { return 1; }
 
   u64 orig_hit_cnt, new_hit_cnt;
@@ -1602,7 +1633,7 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
   u32 cmplog_lvl = afl->cmplog_lvl;
   if (!cmplog_done) {
 
-    lvl = 1;
+    lvl = LVL1;
 
   } else {
 
@@ -1610,8 +1641,8 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
 
   }
 
-  if (cmplog_lvl >= 2 && cmplog_done < 2) { lvl += 2; }
-  if (cmplog_lvl >= 3 && cmplog_done < 3) { lvl += 4; }
+  if (cmplog_lvl >= 2 && cmplog_done < 2) { lvl += LVL2; }
+  if (cmplog_lvl >= 3 && cmplog_done < 3) { lvl += LVL3; }
 
 #ifdef COMBINE
   u8 *cbuf = afl_realloc((void **)&afl->in_scratch_buf, len + 128);
@@ -1668,7 +1699,7 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
 
       }
 
-    } else if (lvl & 1) {
+    } else if (lvl & LVL1) {
 
       if (unlikely(rtn_fuzz(afl, k, orig_buf, buf, cbuf, len, taint))) {
 
-- 
cgit 1.4.1