From bf289ce50e60ffe07d916915cdcca99e59479386 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sat, 6 Feb 2021 09:31:41 +0100
Subject: larger dummy map

---
 instrumentation/afl-compiler-rt.o.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index c24173af..905051c6 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -70,7 +70,7 @@
    run. It will end up as .comm, so it shouldn't be too wasteful. */
 
 #if MAP_SIZE <= 65536
-  #define MAP_INITIAL_SIZE 256000
+  #define MAP_INITIAL_SIZE 1048576
 #else
   #define MAP_INITIAL_SIZE MAP_SIZE
 #endif
@@ -1090,7 +1090,7 @@ __attribute__((constructor(0))) void __afl_auto_first(void) {
   if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
   u8 *ptr;
 
-  ptr = (u8 *)malloc(1024000);
+  ptr = (u8 *)malloc(2097152);
 
   if (ptr && (ssize_t)ptr != -1) {
 
-- 
cgit 1.4.1


From d920104248a6c5387267561382636de404938675 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sat, 6 Feb 2021 12:26:35 +0100
Subject: remove compiler warnings

---
 instrumentation/afl-compiler-rt.o.c | 20 ++++++++++----------
 src/afl-cc.c                        |  4 ++++
 utils/aflpp_driver/aflpp_driver.c   |  2 +-
 3 files changed, 15 insertions(+), 11 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 905051c6..ceae15d1 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -368,8 +368,8 @@ static void __afl_map_shm(void) {
 
     if (__afl_map_size && __afl_map_size > MAP_SIZE) {
 
-      u8 *map_env = getenv("AFL_MAP_SIZE");
-      if (!map_env || atoi(map_env) < MAP_SIZE) {
+      u8 *map_env = (u8 *)getenv("AFL_MAP_SIZE");
+      if (!map_env || atoi((char *)map_env) < MAP_SIZE) {
 
         send_forkserver_error(FS_ERROR_MAP_SIZE);
         _exit(1);
@@ -378,7 +378,7 @@ static void __afl_map_shm(void) {
 
     }
 
-    __afl_area_ptr = shmat(shm_id, (void *)__afl_map_addr, 0);
+    __afl_area_ptr = (u8 *)shmat(shm_id, (void *)__afl_map_addr, 0);
 
     /* Whooooops. */
 
@@ -405,9 +405,9 @@ static void __afl_map_shm(void) {
 
              __afl_map_addr) {
 
-    __afl_area_ptr =
-        mmap((void *)__afl_map_addr, __afl_map_size, PROT_READ | PROT_WRITE,
-             MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+    __afl_area_ptr = (u8 *)mmap(
+        (void *)__afl_map_addr, __afl_map_size, PROT_READ | PROT_WRITE,
+        MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
 
     if (__afl_area_ptr == MAP_FAILED) {
 
@@ -425,7 +425,7 @@ static void __afl_map_shm(void) {
 
     if (__afl_final_loc > MAP_INITIAL_SIZE) {
 
-      __afl_area_ptr = malloc(__afl_final_loc);
+      __afl_area_ptr = (u8 *)malloc(__afl_final_loc);
 
     }
 
@@ -439,7 +439,7 @@ static void __afl_map_shm(void) {
 
     if (__afl_map_size > MAP_INITIAL_SIZE) {
 
-      __afl_area_ptr_dummy = malloc(__afl_map_size);
+      __afl_area_ptr_dummy = (u8 *)malloc(__afl_map_size);
 
       if (__afl_area_ptr_dummy) {
 
@@ -505,7 +505,7 @@ static void __afl_map_shm(void) {
 #else
     u32 shm_id = atoi(id_str);
 
-    __afl_cmp_map = shmat(shm_id, NULL, 0);
+    __afl_cmp_map = (struct cmp_map *)shmat(shm_id, NULL, 0);
 #endif
 
     __afl_cmp_map_backup = __afl_cmp_map;
@@ -1528,7 +1528,7 @@ void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
 // to avoid to call it on .text addresses
 static int area_is_mapped(void *ptr, size_t len) {
 
-  char *p = ptr;
+  char *p = (char *)ptr;
   char *page = (char *)((uintptr_t)p & ~(sysconf(_SC_PAGE_SIZE) - 1));
 
   int r = msync(page, (p - page) + len, MS_ASYNC);
diff --git a/src/afl-cc.c b/src/afl-cc.c
index cf10d9a7..76f4a437 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -1840,6 +1840,8 @@ int main(int argc, char **argv, char **envp) {
     for (i = 0; i < argc; i++)
       SAYF(" '%s'", argv[i]);
     SAYF("\n");
+    fflush(stdout);
+    fflush(stderr);
 
   }
 
@@ -1880,6 +1882,8 @@ int main(int argc, char **argv, char **envp) {
     for (i = 0; i < (s32)cc_par_cnt; i++)
       SAYF(" '%s'", cc_params[i]);
     SAYF("\n");
+    fflush(stdout);
+    fflush(stderr);
 
   }
 
diff --git a/utils/aflpp_driver/aflpp_driver.c b/utils/aflpp_driver/aflpp_driver.c
index 7bb929b2..6af79e14 100644
--- a/utils/aflpp_driver/aflpp_driver.c
+++ b/utils/aflpp_driver/aflpp_driver.c
@@ -173,7 +173,7 @@ size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
 // Execute any files provided as parameters.
 static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
-  unsigned char *buf = malloc(MAX_FILE);
+  unsigned char *buf = (unsigned char *)malloc(MAX_FILE);
   for (int i = 1; i < argc; i++) {
 
     int fd = open(argv[i], O_RDONLY);
-- 
cgit 1.4.1


From a763c61d89f90330bcde7c294c57cfccda1431b8 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sat, 6 Feb 2021 12:43:22 +0100
Subject: add missing sancov cmp functions

---
 instrumentation/afl-compiler-rt.o.c | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index ceae15d1..65a5d3d2 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1320,7 +1320,7 @@ void __cmplog_ins_hook4(uint32_t arg1, uint32_t arg2, uint8_t attr) {
 
 void __cmplog_ins_hook8(uint64_t arg1, uint64_t arg2, uint8_t attr) {
 
-  // fprintf(stderr, "hook8 arg0=%lx arg1=%lx attr=%u\n", arg1, arg2, attr);
+  fprintf(stderr, "hook8 arg0=%lx arg1=%lx attr=%u\n", arg1, arg2, attr);
 
   if (unlikely(!__afl_cmp_map || arg1 == arg2)) return;
 
@@ -1455,24 +1455,48 @@ void __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2) {
 
 }
 
+void __sanitizer_cov_trace_const_cmp1(uint8_t arg1, uint8_t arg2) {
+
+  __cmplog_ins_hook1(arg1, arg2, 0);
+
+}
+
 void __sanitizer_cov_trace_cmp2(uint16_t arg1, uint16_t arg2) {
 
   __cmplog_ins_hook2(arg1, arg2, 0);
 
 }
 
+void __sanitizer_cov_trace_const_cmp2(uint16_t arg1, uint16_t arg2) {
+
+  __cmplog_ins_hook2(arg1, arg2, 0);
+
+}
+
 void __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2) {
 
   __cmplog_ins_hook4(arg1, arg2, 0);
 
 }
 
+void __sanitizer_cov_trace_cost_cmp4(uint32_t arg1, uint32_t arg2) {
+
+  __cmplog_ins_hook4(arg1, arg2, 0);
+
+}
+
 void __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2) {
 
   __cmplog_ins_hook8(arg1, arg2, 0);
 
 }
 
+void __sanitizer_cov_trace_const_cmp8(uint64_t arg1, uint64_t arg2) {
+
+  __cmplog_ins_hook8(arg1, arg2, 0);
+
+}
+
 #ifdef WORD_SIZE_64
 void __sanitizer_cov_trace_cmp16(uint128_t arg1, uint128_t arg2) {
 
-- 
cgit 1.4.1


From 209c5ba4657b641bf261da7ac9ce7d3f809109c2 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sun, 7 Feb 2021 05:33:02 +0100
Subject: larger map, stats reload fix, code format

---
 docs/Changelog.md                                  |  2 +
 instrumentation/afl-compiler-rt.o.c                |  2 +-
 instrumentation/afl-llvm-lto-instrumentation.so.cc |  3 +-
 qemu_mode/libqasan/dlmalloc.c                      |  5 ++
 src/afl-fuzz-bitmap.c                              |  3 +-
 src/afl-fuzz-statsd.c                              | 63 ++++++++++++----------
 utils/afl_untracer/afl-untracer.c                  | 10 ++--
 7 files changed, 52 insertions(+), 36 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index e9efdf38..f2041917 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -26,6 +26,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
       `-i` or resumes (as these have most likely already been done)
     - fix crash for very, very fast targets+systems (thanks to mhlakhani
       for reporting)
+    - on restarts (-i)/autoresume (AFL_AUTORESUME) the stats are now
+      reloaded and used, thanks to Vimal Joseph for this PR! 
     - if determinstic mode is active (-D, or -M without -d) then we sync
       after every queue entry as this can take very long time otherwise
     - better detection if a target needs a large shared map
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 65a5d3d2..059691ec 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -70,7 +70,7 @@
    run. It will end up as .comm, so it shouldn't be too wasteful. */
 
 #if MAP_SIZE <= 65536
-  #define MAP_INITIAL_SIZE 1048576
+  #define MAP_INITIAL_SIZE 2097152
 #else
   #define MAP_INITIAL_SIZE MAP_SIZE
 #endif
diff --git a/instrumentation/afl-llvm-lto-instrumentation.so.cc b/instrumentation/afl-llvm-lto-instrumentation.so.cc
index fa494f44..841d52e5 100644
--- a/instrumentation/afl-llvm-lto-instrumentation.so.cc
+++ b/instrumentation/afl-llvm-lto-instrumentation.so.cc
@@ -69,7 +69,8 @@ class AFLLTOPass : public ModulePass {
 
     if (getenv("AFL_DEBUG")) debug = 1;
     if ((ptr = getenv("AFL_LLVM_LTO_STARTID")) != NULL)
-      if ((afl_global_id = (uint32_t)atoi(ptr)) < 0 || afl_global_id >= MAP_SIZE)
+      if ((afl_global_id = (uint32_t)atoi(ptr)) < 0 ||
+          afl_global_id >= MAP_SIZE)
         FATAL("AFL_LLVM_LTO_STARTID value of \"%s\" is not between 0 and %u\n",
               ptr, MAP_SIZE - 1);
 
diff --git a/qemu_mode/libqasan/dlmalloc.c b/qemu_mode/libqasan/dlmalloc.c
index 39ca4301..ce94451d 100644
--- a/qemu_mode/libqasan/dlmalloc.c
+++ b/qemu_mode/libqasan/dlmalloc.c
@@ -3907,6 +3907,7 @@ static void internal_malloc_stats(mstate m) {
         clear_smallmap(M, I);                                                  \
                                                                                \
       } else if (RTCHECK(B == smallbin_at(M, I) ||                             \
+                                                                               \
                          (ok_address(M, B) && B->fd == P))) {                  \
                                                                                \
         F->bk = B;                                                             \
@@ -4117,6 +4118,7 @@ static void internal_malloc_stats(mstate m) {
           XP->child[1] = R;                                        \
                                                                    \
       } else                                                       \
+                                                                   \
         CORRUPTION_ERROR_ACTION(M);                                \
       if (R != 0) {                                                \
                                                                    \
@@ -4132,6 +4134,7 @@ static void internal_malloc_stats(mstate m) {
               C0->parent = R;                                      \
                                                                    \
             } else                                                 \
+                                                                   \
               CORRUPTION_ERROR_ACTION(M);                          \
                                                                    \
           }                                                        \
@@ -4143,11 +4146,13 @@ static void internal_malloc_stats(mstate m) {
               C1->parent = R;                                      \
                                                                    \
             } else                                                 \
+                                                                   \
               CORRUPTION_ERROR_ACTION(M);                          \
                                                                    \
           }                                                        \
                                                                    \
         } else                                                     \
+                                                                   \
           CORRUPTION_ERROR_ACTION(M);                              \
                                                                    \
       }                                                            \
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 0c4a114e..4ed59364 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -325,7 +325,8 @@ u8 *describe_op(afl_state_t *afl, u8 new_bits, size_t max_description_len) {
 
     }
 
-    sprintf(ret + strlen(ret), ",time:%llu", get_cur_time() - afl->start_time);
+    sprintf(ret + strlen(ret), ",time:%llu",
+            get_cur_time() + afl->prev_run_time - afl->start_time);
 
     if (afl->current_custom_fuzz &&
         afl->current_custom_fuzz->afl_custom_describe) {
diff --git a/src/afl-fuzz-statsd.c b/src/afl-fuzz-statsd.c
index 69cafd90..461bbbf6 100644
--- a/src/afl-fuzz-statsd.c
+++ b/src/afl-fuzz-statsd.c
@@ -1,3 +1,8 @@
+/*
+ * This implements rpc.statsd support, see docs/rpc_statsd.md
+ *
+ */
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <sys/socket.h>
@@ -226,37 +231,39 @@ int statsd_format_metric(afl_state_t *afl, char *buff, size_t bufflen) {
   */
   if (afl->statsd_metric_format_type == STATSD_TAGS_TYPE_SUFFIX) {
 
-    snprintf(buff, bufflen, afl->statsd_metric_format,
-             afl->queue_cycle ? (afl->queue_cycle - 1) : 0, tags,
-             afl->cycles_wo_finds, tags, afl->fsrv.total_execs, tags,
-             afl->fsrv.total_execs /
-                 ((double)(get_cur_time() - afl->start_time) / 1000),
-             tags, afl->queued_paths, tags, afl->queued_favored, tags,
-             afl->queued_discovered, tags, afl->queued_imported, tags,
-             afl->max_depth, tags, afl->current_entry, tags,
-             afl->pending_favored, tags, afl->pending_not_fuzzed, tags,
-             afl->queued_variable, tags, afl->unique_crashes, tags,
-             afl->unique_hangs, tags, afl->total_crashes, tags,
-             afl->slowest_exec_ms, tags,
-             count_non_255_bytes(afl, afl->virgin_bits), tags,
-             afl->var_byte_count, tags, afl->expand_havoc, tags);
+    snprintf(
+        buff, bufflen, afl->statsd_metric_format,
+        afl->queue_cycle ? (afl->queue_cycle - 1) : 0, tags,
+        afl->cycles_wo_finds, tags, afl->fsrv.total_execs, tags,
+        afl->fsrv.total_execs /
+            ((double)(get_cur_time() + afl->prev_run_time - afl->start_time) /
+             1000),
+        tags, afl->queued_paths, tags, afl->queued_favored, tags,
+        afl->queued_discovered, tags, afl->queued_imported, tags,
+        afl->max_depth, tags, afl->current_entry, tags, afl->pending_favored,
+        tags, afl->pending_not_fuzzed, tags, afl->queued_variable, tags,
+        afl->unique_crashes, tags, afl->unique_hangs, tags, afl->total_crashes,
+        tags, afl->slowest_exec_ms, tags,
+        count_non_255_bytes(afl, afl->virgin_bits), tags, afl->var_byte_count,
+        tags, afl->expand_havoc, tags);
 
   } else if (afl->statsd_metric_format_type == STATSD_TAGS_TYPE_MID) {
 
-    snprintf(buff, bufflen, afl->statsd_metric_format, tags,
-             afl->queue_cycle ? (afl->queue_cycle - 1) : 0, tags,
-             afl->cycles_wo_finds, tags, afl->fsrv.total_execs, tags,
-             afl->fsrv.total_execs /
-                 ((double)(get_cur_time() - afl->start_time) / 1000),
-             tags, afl->queued_paths, tags, afl->queued_favored, tags,
-             afl->queued_discovered, tags, afl->queued_imported, tags,
-             afl->max_depth, tags, afl->current_entry, tags,
-             afl->pending_favored, tags, afl->pending_not_fuzzed, tags,
-             afl->queued_variable, tags, afl->unique_crashes, tags,
-             afl->unique_hangs, tags, afl->total_crashes, tags,
-             afl->slowest_exec_ms, tags,
-             count_non_255_bytes(afl, afl->virgin_bits), tags,
-             afl->var_byte_count, tags, afl->expand_havoc);
+    snprintf(
+        buff, bufflen, afl->statsd_metric_format, tags,
+        afl->queue_cycle ? (afl->queue_cycle - 1) : 0, tags,
+        afl->cycles_wo_finds, tags, afl->fsrv.total_execs, tags,
+        afl->fsrv.total_execs /
+            ((double)(get_cur_time() + afl->prev_run_time - afl->start_time) /
+             1000),
+        tags, afl->queued_paths, tags, afl->queued_favored, tags,
+        afl->queued_discovered, tags, afl->queued_imported, tags,
+        afl->max_depth, tags, afl->current_entry, tags, afl->pending_favored,
+        tags, afl->pending_not_fuzzed, tags, afl->queued_variable, tags,
+        afl->unique_crashes, tags, afl->unique_hangs, tags, afl->total_crashes,
+        tags, afl->slowest_exec_ms, tags,
+        count_non_255_bytes(afl, afl->virgin_bits), tags, afl->var_byte_count,
+        tags, afl->expand_havoc);
 
   }
 
diff --git a/utils/afl_untracer/afl-untracer.c b/utils/afl_untracer/afl-untracer.c
index 1f1a10ea..2baeb58d 100644
--- a/utils/afl_untracer/afl-untracer.c
+++ b/utils/afl_untracer/afl-untracer.c
@@ -480,9 +480,9 @@ void setup_trap_instrumentation(void) {
     // Index into the coverage bitmap for the current trap instruction.
 #ifdef __aarch64__
   uint64_t bitmap_index = 0;
-#ifdef __APPLE__
+  #ifdef __APPLE__
   pthread_jit_write_protect_np(0);
-#endif
+  #endif
 #else
   uint32_t bitmap_index = 0;
 #endif
@@ -627,13 +627,13 @@ static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
   // Must re-execute the instruction, so decrement PC by one instruction.
   ucontext_t *ctx = (ucontext_t *)context;
 #if defined(__APPLE__) && defined(__LP64__)
-#if defined(__x86_64__)
+  #if defined(__x86_64__)
   ctx->uc_mcontext->__ss.__rip -= 1;
   addr = ctx->uc_mcontext->__ss.__rip;
-#else
+  #else
   ctx->uc_mcontext->__ss.__pc -= 4;
   addr = ctx->uc_mcontext->__ss.__pc;
-#endif
+  #endif
 #elif defined(__linux__)
   #if defined(__x86_64__) || defined(__i386__)
   ctx->uc_mcontext.gregs[REG_RIP] -= 1;
-- 
cgit 1.4.1


From aeb7d7048371cd91ab9280c3958f1c35e5d5e758 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sun, 7 Feb 2021 06:16:53 +0100
Subject: remove debug output

---
 instrumentation/afl-compiler-rt.o.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 059691ec..3a9e3e0e 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1320,7 +1320,7 @@ void __cmplog_ins_hook4(uint32_t arg1, uint32_t arg2, uint8_t attr) {
 
 void __cmplog_ins_hook8(uint64_t arg1, uint64_t arg2, uint8_t attr) {
 
-  fprintf(stderr, "hook8 arg0=%lx arg1=%lx attr=%u\n", arg1, arg2, attr);
+  // fprintf(stderr, "hook8 arg0=%lx arg1=%lx attr=%u\n", arg1, arg2, attr);
 
   if (unlikely(!__afl_cmp_map || arg1 == arg2)) return;
 
-- 
cgit 1.4.1


From 98559ea8b0790bc724b47e40fadfe1cfab4b726f Mon Sep 17 00:00:00 2001
From: hexcoder- <heiko@hexco.de>
Date: Mon, 15 Feb 2021 08:54:53 +0100
Subject: fix compiler warning

---
 instrumentation/afl-compiler-rt.o.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 3a9e3e0e..5fb715e2 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1171,7 +1171,7 @@ void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) {
 
     fprintf(stderr,
             "Running __sanitizer_cov_trace_pc_guard_init: %p-%p (%lu edges)\n",
-            start, stop, stop - start);
+            start, stop, (unsigned long)(stop - start));
 
   }
 
-- 
cgit 1.4.1


From 938512a6b9451000f40491b2554b5d360840cfe5 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 17 Feb 2021 09:48:04 +0100
Subject: minor fixes

---
 include/config.h                    |  4 ++--
 include/envs.h                      |  1 +
 instrumentation/afl-compiler-rt.o.c |  2 +-
 qemu_mode/README.md                 | 22 ++++++++++------------
 qemu_mode/qemuafl                   |  2 +-
 5 files changed, 15 insertions(+), 16 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/include/config.h b/include/config.h
index 181285cd..9f7db04d 100644
--- a/include/config.h
+++ b/include/config.h
@@ -42,7 +42,7 @@
  *
  */
 
-/* Enable arithmetic compare solving for both path */
+/* Enable arithmetic compare solving for both branches */
 #define CMPLOG_SOLVE_ARITHMETIC
 
 /* Enable transform following (XOR/ADD/SUB manipulations, hex en/decoding) */
@@ -51,7 +51,7 @@
 /* if TRANSFORM is enabled, this additionally enables base64 en/decoding */
 // #define CMPLOG_SOLVE_TRANSFORM_BASE64
 
-/* If a redqueen pass finds more than one solve, try to combine them? */
+/* If a redqueen pass finds more than one solution, try to combine them? */
 #define CMPLOG_COMBINE
 
 /* Minimum % of the corpus to perform cmplog on. Default: 20% */
diff --git a/include/envs.h b/include/envs.h
index 4313e053..143979c6 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -131,6 +131,7 @@ static char *afl_environment_variables[] = {
     "AFL_QEMU_DEBUG_MAPS",
     "AFL_QEMU_DISABLE_CACHE",
     "AFL_QEMU_DRIVER_NO_HOOK",
+    "AFL_QEMU_FORCE_DFL",
     "AFL_QEMU_PERSISTENT_ADDR",
     "AFL_QEMU_PERSISTENT_CNT",
     "AFL_QEMU_PERSISTENT_GPR",
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 5fb715e2..dba4dc65 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1090,7 +1090,7 @@ __attribute__((constructor(0))) void __afl_auto_first(void) {
   if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
   u8 *ptr;
 
-  ptr = (u8 *)malloc(2097152);
+  ptr = (u8 *)malloc(MAP_INITIAL_SIZE);
 
   if (ptr && (ssize_t)ptr != -1) {
 
diff --git a/qemu_mode/README.md b/qemu_mode/README.md
index 9818846d..bc4c1d2c 100644
--- a/qemu_mode/README.md
+++ b/qemu_mode/README.md
@@ -17,7 +17,7 @@ The idea and much of the initial implementation comes from Andrew Griffiths.
 The actual implementation on current QEMU (shipped as qemuafl) is from
 Andrea Fioraldi. Special thanks to abiondo that re-enabled TCG chaining.
 
-## 2) How to use
+## 2) How to use qemu_mode
 
 The feature is implemented with a patched QEMU. The simplest way
 to build it is to run ./build_qemu_support.sh. The script will download,
@@ -176,7 +176,12 @@ Comparative measurements of execution speed or instrumentation coverage will be
 fairly meaningless if the optimization levels or instrumentation scopes don't
 match.
 
-## 12) Gotchas, feedback, bugs
+## 12) Other features
+
+With `AFL_QEMU_FORCE_DFL` you force QEMU to ignore the registered signal
+handlers of the target.
+
+## 13) Gotchas, feedback, bugs
 
 If you need to fix up checksums or do other cleanup on mutated test cases, see
 utils/custom_mutators/ for a viable solution.
@@ -197,19 +202,12 @@ with -march=core2, can help.
 Beyond that, this is an early-stage mechanism, so fields reports are welcome.
 You can send them to <afl-users@googlegroups.com>.
 
-## 13) Alternatives: static rewriting
+## 14) Alternatives: static rewriting
 
 Statically rewriting binaries just once, instead of attempting to translate
 them at run time, can be a faster alternative. That said, static rewriting is
 fraught with peril, because it depends on being able to properly and fully model
 program control flow without actually executing each and every code path.
 
-The best implementation is this one:
-
-  https://github.com/vanhauser-thc/afl-dyninst
-
-The issue however is Dyninst which is not rewriting the binaries so that
-they run stable. A lot of crashes happen, especially in C++ programs that
-use throw/catch. Try it first, and if it works for you be happy as it is
-2-3x as fast as qemu_mode, however usually not as fast as QEMU persistent mode.
-
+Checkout the "Fuzzing binary-only targets" section in our main README.md and
+the docs/binaryonly_fuzzing.md document for more information and hints.
diff --git a/qemu_mode/qemuafl b/qemu_mode/qemuafl
index 9a258d5b..213f3b27 160000
--- a/qemu_mode/qemuafl
+++ b/qemu_mode/qemuafl
@@ -1 +1 @@
-Subproject commit 9a258d5b7a38c045a6e385fcfcf80a746a60e557
+Subproject commit 213f3b27dd099ef352181c48cd75c0f20a73e3f0
-- 
cgit 1.4.1


From 8c133b607cdbde60e6c922236947f7a69c9190f2 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 22 Feb 2021 12:43:39 +0100
Subject: stdstring fix attempt

---
 instrumentation/afl-compiler-rt.o.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index dba4dc65..324d541d 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1653,12 +1653,19 @@ static u8 *get_llvm_stdstring(u8 *string) {
 
 void __cmplog_rtn_gcc_stdstring_cstring(u8 *stdstring, u8 *cstring) {
 
+  if (unlikely(!__afl_cmp_map)) return;
+  if (!area_is_mapped(stdstring, 32) || !area_is_mapped(cstring, 32)) return;
+
   __cmplog_rtn_hook(get_gcc_stdstring(stdstring), cstring);
 
 }
 
 void __cmplog_rtn_gcc_stdstring_stdstring(u8 *stdstring1, u8 *stdstring2) {
 
+  if (unlikely(!__afl_cmp_map)) return;
+  if (!area_is_mapped(stdstring1, 32) || !area_is_mapped(stdstring2, 32))
+    return;
+
   __cmplog_rtn_hook(get_gcc_stdstring(stdstring1),
                     get_gcc_stdstring(stdstring2));
 
@@ -1666,12 +1673,17 @@ void __cmplog_rtn_gcc_stdstring_stdstring(u8 *stdstring1, u8 *stdstring2) {
 
 void __cmplog_rtn_llvm_stdstring_cstring(u8 *stdstring, u8 *cstring) {
 
+  if (unlikely(!__afl_cmp_map)) return;
+  if (!area_is_mapped(stdstring, 32) || !area_is_mapped(cstring, 32)) return;
   __cmplog_rtn_hook(get_llvm_stdstring(stdstring), cstring);
 
 }
 
 void __cmplog_rtn_llvm_stdstring_stdstring(u8 *stdstring1, u8 *stdstring2) {
 
+  if (unlikely(!__afl_cmp_map)) return;
+  if (!area_is_mapped(stdstring1, 32) || !area_is_mapped(stdstring2, 32))
+    return;
   __cmplog_rtn_hook(get_llvm_stdstring(stdstring1),
                     get_llvm_stdstring(stdstring2));
 
-- 
cgit 1.4.1


From 70fe872940b9815698b4317bdde33da1dae27923 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 22 Feb 2021 16:39:38 +0100
Subject: ensure a valid seed exists

---
 instrumentation/afl-compiler-rt.o.c | 2 ++
 src/afl-cc.c                        | 3 ++-
 src/afl-fuzz.c                      | 7 ++++++-
 3 files changed, 10 insertions(+), 2 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 324d541d..e4aeadfa 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1675,6 +1675,7 @@ void __cmplog_rtn_llvm_stdstring_cstring(u8 *stdstring, u8 *cstring) {
 
   if (unlikely(!__afl_cmp_map)) return;
   if (!area_is_mapped(stdstring, 32) || !area_is_mapped(cstring, 32)) return;
+
   __cmplog_rtn_hook(get_llvm_stdstring(stdstring), cstring);
 
 }
@@ -1684,6 +1685,7 @@ void __cmplog_rtn_llvm_stdstring_stdstring(u8 *stdstring1, u8 *stdstring2) {
   if (unlikely(!__afl_cmp_map)) return;
   if (!area_is_mapped(stdstring1, 32) || !area_is_mapped(stdstring2, 32))
     return;
+
   __cmplog_rtn_hook(get_llvm_stdstring(stdstring1),
                     get_llvm_stdstring(stdstring2));
 
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 2eb8c575..5f471355 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -1700,7 +1700,8 @@ int main(int argc, char **argv, char **envp) {
         "selected.\n"
         "Read the documentation for FEATURES though, all are good but few are "
         "defaults.\n"
-        "Recommended is afl-clang-lto with AFL_LLVM_CMPLOG or afl-clang-fast with\n"
+        "Recommended is afl-clang-lto with AFL_LLVM_CMPLOG or afl-clang-fast "
+        "with\n"
         "AFL_LLVM_CMPLOG and AFL_LLVM_DICT2FILE.\n\n");
 
     exit(1);
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 24d77cc9..9137dc23 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1707,7 +1707,12 @@ int main(int argc, char **argv_orig, char **envp) {
 
   cull_queue(afl);
 
-  if (!afl->pending_not_fuzzed) {
+  // ensure we have at least one seed that is not disabled.
+  u32 entry, valid_seeds = 0;
+  for (entry = 0; entry < afl->queued_paths; ++entry)
+    if (!afl->queue_buf[entry]->disabled) { ++valid_seeds; }
+
+  if (!afl->pending_not_fuzzed || !valid_seeds) {
 
     FATAL("We need at least one valid input seed that does not crash!");
 
-- 
cgit 1.4.1


From 4619a1395b9a414e5e11148d79fde3a7fa348e87 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 1 Mar 2021 09:57:57 +0100
Subject: ensure proper aligning for skim patch

---
 instrumentation/afl-compiler-rt.o.c                | 8 ++++++--
 instrumentation/afl-llvm-lto-instrumentation.so.cc | 4 +---
 src/afl-common.c                                   | 2 +-
 src/afl-forkserver.c                               | 4 ++--
 4 files changed, 10 insertions(+), 8 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index e4aeadfa..ecb94cab 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -244,8 +244,12 @@ static void __afl_map_shm(void) {
 
   if (__afl_final_loc) {
 
-    if (__afl_final_loc % 32)
-      __afl_final_loc = (((__afl_final_loc + 31) >> 5) << 5);
+    if (__afl_final_loc % 64) {
+
+      __afl_final_loc = (((__afl_final_loc + 63) >> 6) << 6);
+
+    }
+
     __afl_map_size = __afl_final_loc;
 
     if (__afl_final_loc > MAP_SIZE) {
diff --git a/instrumentation/afl-llvm-lto-instrumentation.so.cc b/instrumentation/afl-llvm-lto-instrumentation.so.cc
index f5c24e41..137bae2c 100644
--- a/instrumentation/afl-llvm-lto-instrumentation.so.cc
+++ b/instrumentation/afl-llvm-lto-instrumentation.so.cc
@@ -924,9 +924,7 @@ bool AFLLTOPass::runOnModule(Module &M) {
 
     if (getenv("AFL_LLVM_LTO_DONTWRITEID") == NULL) {
 
-      uint32_t write_loc = afl_global_id;
-
-      if (afl_global_id % 32) write_loc = (((afl_global_id + 32) >> 4) << 4);
+      uint32_t write_loc = (((afl_global_id + 63) >> 6) << 6);
 
       GlobalVariable *AFLFinalLoc = new GlobalVariable(
           M, Int32Ty, true, GlobalValue::ExternalLinkage, 0, "__afl_final_loc");
diff --git a/src/afl-common.c b/src/afl-common.c
index fa4aec7f..a306fe5e 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -1135,7 +1135,7 @@ u32 get_map_size(void) {
 
     }
 
-    if (map_size % 32) { map_size = (((map_size >> 5) + 1) << 5); }
+    if (map_size % 64) { map_size = (((map_size >> 6) + 1) << 6); }
 
   }
 
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 9ee59822..fd5edc98 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -656,11 +656,11 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
         if (!fsrv->map_size) { fsrv->map_size = MAP_SIZE; }
 
-        if (unlikely(tmp_map_size % 32)) {
+        if (unlikely(tmp_map_size % 64)) {
 
           // should not happen
           WARNF("Target reported non-aligned map size of %u", tmp_map_size);
-          tmp_map_size = (((tmp_map_size + 31) >> 5) << 5);
+          tmp_map_size = (((tmp_map_size + 63) >> 6) << 6);
 
         }
 
-- 
cgit 1.4.1


From ad7a7fcf075c617e09cb516da000b244be161093 Mon Sep 17 00:00:00 2001
From: Andrea Fioraldi <andreafioraldi@gmail.com>
Date: Mon, 1 Mar 2021 15:30:55 +0100
Subject: ASan-compatible area_is_mapped()

---
 instrumentation/afl-compiler-rt.o.c | 10 +++++++++-
 qemu_mode/qemuafl                   |  2 +-
 2 files changed, 10 insertions(+), 2 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index ecb94cab..dab06177 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -34,6 +34,7 @@
 #include <errno.h>
 
 #include <sys/mman.h>
+#include <sys/syscall.h> 
 #ifndef __HAIKU__
   #include <sys/shm.h>
 #endif
@@ -1551,15 +1552,22 @@ void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
 
 }
 
+__attribute__((weak)) void *__asan_region_is_poisoned(void *beg, size_t size) {
+  return NULL;
+}
+
 // POSIX shenanigan to see if an area is mapped.
 // If it is mapped as X-only, we have a problem, so maybe we should add a check
 // to avoid to call it on .text addresses
 static int area_is_mapped(void *ptr, size_t len) {
 
+  if (__asan_region_is_poisoned(ptr, len) == NULL)
+    return 1;
+
   char *p = (char *)ptr;
   char *page = (char *)((uintptr_t)p & ~(sysconf(_SC_PAGE_SIZE) - 1));
 
-  int r = msync(page, (p - page) + len, MS_ASYNC);
+  int r = syscall(SYS_msync, page, (p - page) + len, MS_ASYNC);
   if (r < 0) return errno != ENOMEM;
   return 1;
 
diff --git a/qemu_mode/qemuafl b/qemu_mode/qemuafl
index e36a30eb..213f3b27 160000
--- a/qemu_mode/qemuafl
+++ b/qemu_mode/qemuafl
@@ -1 +1 @@
-Subproject commit e36a30ebca57ca433a5d6e20b1a32975aabb761b
+Subproject commit 213f3b27dd099ef352181c48cd75c0f20a73e3f0
-- 
cgit 1.4.1


From 75d6a8b7011699c22e6d7c7ad9869b9a850e053b Mon Sep 17 00:00:00 2001
From: Andrea Fioraldi <andreafioraldi@gmail.com>
Date: Mon, 1 Mar 2021 15:33:28 +0100
Subject: fix last commit

---
 instrumentation/afl-compiler-rt.o.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index dab06177..1151cd52 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1559,10 +1559,10 @@ __attribute__((weak)) void *__asan_region_is_poisoned(void *beg, size_t size) {
 // POSIX shenanigan to see if an area is mapped.
 // If it is mapped as X-only, we have a problem, so maybe we should add a check
 // to avoid to call it on .text addresses
-static int area_is_mapped(void *ptr, size_t len) {
+static int area_is_valid(void *ptr, size_t len) {
 
-  if (__asan_region_is_poisoned(ptr, len) == NULL)
-    return 1;
+  if (__asan_region_is_poisoned(ptr, len))
+    return 0;
 
   char *p = (char *)ptr;
   char *page = (char *)((uintptr_t)p & ~(sysconf(_SC_PAGE_SIZE) - 1));
@@ -1577,7 +1577,7 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
 
   /*
     u32 i;
-    if (!area_is_mapped(ptr1, 32) || !area_is_mapped(ptr2, 32)) return;
+    if (!area_is_valid(ptr1, 32) || !area_is_valid(ptr2, 32)) return;
     fprintf(stderr, "rtn arg0=");
     for (i = 0; i < 24; i++)
       fprintf(stderr, "%02x", ptr1[i]);
@@ -1589,7 +1589,7 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
 
   if (unlikely(!__afl_cmp_map)) return;
 
-  if (!area_is_mapped(ptr1, 32) || !area_is_mapped(ptr2, 32)) return;
+  if (!area_is_valid(ptr1, 32) || !area_is_valid(ptr2, 32)) return;
 
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
@@ -1666,7 +1666,7 @@ static u8 *get_llvm_stdstring(u8 *string) {
 void __cmplog_rtn_gcc_stdstring_cstring(u8 *stdstring, u8 *cstring) {
 
   if (unlikely(!__afl_cmp_map)) return;
-  if (!area_is_mapped(stdstring, 32) || !area_is_mapped(cstring, 32)) return;
+  if (!area_is_valid(stdstring, 32) || !area_is_valid(cstring, 32)) return;
 
   __cmplog_rtn_hook(get_gcc_stdstring(stdstring), cstring);
 
@@ -1675,7 +1675,7 @@ void __cmplog_rtn_gcc_stdstring_cstring(u8 *stdstring, u8 *cstring) {
 void __cmplog_rtn_gcc_stdstring_stdstring(u8 *stdstring1, u8 *stdstring2) {
 
   if (unlikely(!__afl_cmp_map)) return;
-  if (!area_is_mapped(stdstring1, 32) || !area_is_mapped(stdstring2, 32))
+  if (!area_is_valid(stdstring1, 32) || !area_is_valid(stdstring2, 32))
     return;
 
   __cmplog_rtn_hook(get_gcc_stdstring(stdstring1),
@@ -1686,7 +1686,7 @@ void __cmplog_rtn_gcc_stdstring_stdstring(u8 *stdstring1, u8 *stdstring2) {
 void __cmplog_rtn_llvm_stdstring_cstring(u8 *stdstring, u8 *cstring) {
 
   if (unlikely(!__afl_cmp_map)) return;
-  if (!area_is_mapped(stdstring, 32) || !area_is_mapped(cstring, 32)) return;
+  if (!area_is_valid(stdstring, 32) || !area_is_valid(cstring, 32)) return;
 
   __cmplog_rtn_hook(get_llvm_stdstring(stdstring), cstring);
 
@@ -1695,7 +1695,7 @@ void __cmplog_rtn_llvm_stdstring_cstring(u8 *stdstring, u8 *cstring) {
 void __cmplog_rtn_llvm_stdstring_stdstring(u8 *stdstring1, u8 *stdstring2) {
 
   if (unlikely(!__afl_cmp_map)) return;
-  if (!area_is_mapped(stdstring1, 32) || !area_is_mapped(stdstring2, 32))
+  if (!area_is_valid(stdstring1, 32) || !area_is_valid(stdstring2, 32))
     return;
 
   __cmplog_rtn_hook(get_llvm_stdstring(stdstring1),
-- 
cgit 1.4.1


From a29b360d55026b43989ab653958bfd86fc854927 Mon Sep 17 00:00:00 2001
From: Andrea Fioraldi <andreafioraldi@gmail.com>
Date: Mon, 1 Mar 2021 17:16:34 +0100
Subject: area_is_valid with write

---
 instrumentation/afl-compiler-rt.o.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 1151cd52..15bc823a 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -123,6 +123,10 @@ static u8 is_persistent;
 
 static u8 _is_sancov;
 
+/* Dummy pipe for area_is_valid() */
+
+static int dummy_pipe;
+
 /* ensure we kill the child on termination */
 
 void at_exit(int signal) {
@@ -476,6 +480,11 @@ static void __afl_map_shm(void) {
   }
 
   if (id_str) {
+  
+    if (pipe(dummy_pipe) < 0) {
+      perror("pipe() failed\n");
+      exit(1);
+    }
 
 #ifdef USEMMAP
     const char *    shm_file_path = id_str;
@@ -1567,9 +1576,8 @@ static int area_is_valid(void *ptr, size_t len) {
   char *p = (char *)ptr;
   char *page = (char *)((uintptr_t)p & ~(sysconf(_SC_PAGE_SIZE) - 1));
 
-  int r = syscall(SYS_msync, page, (p - page) + len, MS_ASYNC);
-  if (r < 0) return errno != ENOMEM;
-  return 1;
+  int r = syscall(dummy_pipe[1], SYS_write, page, (p - page) + len);
+  return errno != EFAULT;
 
 }
 
-- 
cgit 1.4.1


From 05e2f577f6f510f848661073fcd19c1ef6b9a517 Mon Sep 17 00:00:00 2001
From: Andrea Fioraldi <andreafioraldi@gmail.com>
Date: Mon, 1 Mar 2021 17:21:27 +0100
Subject: fix area_is_valid with write

---
 instrumentation/afl-compiler-rt.o.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 15bc823a..1694def6 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -125,7 +125,7 @@ static u8 _is_sancov;
 
 /* Dummy pipe for area_is_valid() */
 
-static int dummy_pipe;
+static int dummy_pipe[2];
 
 /* ensure we kill the child on termination */
 
-- 
cgit 1.4.1


From 14fd4771475ede994f5731faf0ce19bebfd4034f Mon Sep 17 00:00:00 2001
From: aflpp <aflpp@aflplus.plus>
Date: Mon, 1 Mar 2021 19:03:25 +0100
Subject: better fix for asan?

---
 instrumentation/afl-compiler-rt.o.c | 95 ++++++++++++++++++++++++++-----------
 1 file changed, 68 insertions(+), 27 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 1694def6..15832793 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -34,7 +34,7 @@
 #include <errno.h>
 
 #include <sys/mman.h>
-#include <sys/syscall.h> 
+#include <sys/syscall.h>
 #ifndef __HAIKU__
   #include <sys/shm.h>
 #endif
@@ -125,7 +125,7 @@ static u8 _is_sancov;
 
 /* Dummy pipe for area_is_valid() */
 
-static int dummy_pipe[2];
+static int __afl_dummy_fd[2] = {2, 2};
 
 /* ensure we kill the child on termination */
 
@@ -480,10 +480,11 @@ static void __afl_map_shm(void) {
   }
 
   if (id_str) {
-  
-    if (pipe(dummy_pipe) < 0) {
-      perror("pipe() failed\n");
-      exit(1);
+
+    if ((__afl_dummy_fd[0] = open("/dev/null", O_WRONLY)) < 0) {
+
+      if (pipe(__afl_dummy_fd) < 0) { __afl_dummy_fd[0] = 1; }
+
     }
 
 #ifdef USEMMAP
@@ -1562,7 +1563,9 @@ void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
 }
 
 __attribute__((weak)) void *__asan_region_is_poisoned(void *beg, size_t size) {
+
   return NULL;
+
 }
 
 // POSIX shenanigan to see if an area is mapped.
@@ -1570,14 +1573,47 @@ __attribute__((weak)) void *__asan_region_is_poisoned(void *beg, size_t size) {
 // to avoid to call it on .text addresses
 static int area_is_valid(void *ptr, size_t len) {
 
-  if (__asan_region_is_poisoned(ptr, len))
-    return 0;
+  void *ret_ptr = __asan_region_is_poisoned(ptr, len);
+
+  if (ret_ptr) {  // region is poisoned
+
+    ssize_t ret_diff = ret_ptr - ptr;
+
+    if (ret_diff <= 0) {
+
+      return 0;
+
+    } else {
+
+      return ret_diff;  // only partially poisoned
+
+    }
+
+  }
 
-  char *p = (char *)ptr;
-  char *page = (char *)((uintptr_t)p & ~(sysconf(_SC_PAGE_SIZE) - 1));
+  int r = syscall(__afl_dummy_fd[0], SYS_write, ptr, len);
 
-  int r = syscall(dummy_pipe[1], SYS_write, page, (p - page) + len);
-  return errno != EFAULT;
+  if (r <= 0) {  //  maybe this is going over an asan boundary
+
+    char *p = (char *)ptr;
+    long  page_size = sysconf(_SC_PAGE_SIZE);
+    char *page = (char *)((uintptr_t)p & ~(page_size - 1)) + page_size;
+    if (page < p + len) { return 0; }
+    len -= (p + len - page);
+    r = syscall(__afl_dummy_fd[0], SYS_write, p, len);
+
+  }
+
+  // partial writes - we return what was written.
+  if (r > 0) {
+
+    return r;
+
+  } else {
+
+    return 0;
+
+  }
 
 }
 
@@ -1585,19 +1621,22 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
 
   /*
     u32 i;
-    if (!area_is_valid(ptr1, 32) || !area_is_valid(ptr2, 32)) return;
+    if (area_is_valid(ptr1, 32) <= 0 || area_is_valid(ptr2, 32) <= 0) return;
     fprintf(stderr, "rtn arg0=");
-    for (i = 0; i < 24; i++)
+    for (i = 0; i < 32; i++)
       fprintf(stderr, "%02x", ptr1[i]);
     fprintf(stderr, " arg1=");
-    for (i = 0; i < 24; i++)
+    for (i = 0; i < 32; i++)
       fprintf(stderr, "%02x", ptr2[i]);
     fprintf(stderr, "\n");
   */
 
   if (unlikely(!__afl_cmp_map)) return;
-
-  if (!area_is_valid(ptr1, 32) || !area_is_valid(ptr2, 32)) return;
+  int l1, l2;
+  if ((l1 = area_is_valid(ptr1, 32)) <= 0 ||
+      (l2 = area_is_valid(ptr2, 32)) <= 0)
+    return;
+  int len = MIN(l1, l2);
 
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
@@ -1608,17 +1647,17 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
   if (__afl_cmp_map->headers[k].type != CMP_TYPE_RTN) {
 
     __afl_cmp_map->headers[k].type = CMP_TYPE_RTN;
-    hits = 0;
     __afl_cmp_map->headers[k].hits = 1;
-    __afl_cmp_map->headers[k].shape = 31;
+    __afl_cmp_map->headers[k].shape = len - 1;
+    hits = 0;
 
   } else {
 
     hits = __afl_cmp_map->headers[k].hits++;
 
-    if (__afl_cmp_map->headers[k].shape < 31) {
+    if (__afl_cmp_map->headers[k].shape < len) {
 
-      __afl_cmp_map->headers[k].shape = 31;
+      __afl_cmp_map->headers[k].shape = len;
 
     }
 
@@ -1626,9 +1665,9 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
 
   hits &= CMP_MAP_RTN_H - 1;
   __builtin_memcpy(((struct cmpfn_operands *)__afl_cmp_map->log[k])[hits].v0,
-                   ptr1, 32);
+                   ptr1, len);
   __builtin_memcpy(((struct cmpfn_operands *)__afl_cmp_map->log[k])[hits].v1,
-                   ptr2, 32);
+                   ptr2, len);
 
 }
 
@@ -1674,7 +1713,8 @@ static u8 *get_llvm_stdstring(u8 *string) {
 void __cmplog_rtn_gcc_stdstring_cstring(u8 *stdstring, u8 *cstring) {
 
   if (unlikely(!__afl_cmp_map)) return;
-  if (!area_is_valid(stdstring, 32) || !area_is_valid(cstring, 32)) return;
+  if (area_is_valid(stdstring, 32) <= 0 || area_is_valid(cstring, 32) <= 0)
+    return;
 
   __cmplog_rtn_hook(get_gcc_stdstring(stdstring), cstring);
 
@@ -1683,7 +1723,7 @@ void __cmplog_rtn_gcc_stdstring_cstring(u8 *stdstring, u8 *cstring) {
 void __cmplog_rtn_gcc_stdstring_stdstring(u8 *stdstring1, u8 *stdstring2) {
 
   if (unlikely(!__afl_cmp_map)) return;
-  if (!area_is_valid(stdstring1, 32) || !area_is_valid(stdstring2, 32))
+  if (area_is_valid(stdstring1, 32) <= 0 || area_is_valid(stdstring2, 32) <= 0)
     return;
 
   __cmplog_rtn_hook(get_gcc_stdstring(stdstring1),
@@ -1694,7 +1734,8 @@ void __cmplog_rtn_gcc_stdstring_stdstring(u8 *stdstring1, u8 *stdstring2) {
 void __cmplog_rtn_llvm_stdstring_cstring(u8 *stdstring, u8 *cstring) {
 
   if (unlikely(!__afl_cmp_map)) return;
-  if (!area_is_valid(stdstring, 32) || !area_is_valid(cstring, 32)) return;
+  if (area_is_valid(stdstring, 32) <= 0 || area_is_valid(cstring, 32) <= 0)
+    return;
 
   __cmplog_rtn_hook(get_llvm_stdstring(stdstring), cstring);
 
@@ -1703,7 +1744,7 @@ void __cmplog_rtn_llvm_stdstring_cstring(u8 *stdstring, u8 *cstring) {
 void __cmplog_rtn_llvm_stdstring_stdstring(u8 *stdstring1, u8 *stdstring2) {
 
   if (unlikely(!__afl_cmp_map)) return;
-  if (!area_is_valid(stdstring1, 32) || !area_is_valid(stdstring2, 32))
+  if (area_is_valid(stdstring1, 32) <= 0 || area_is_valid(stdstring2, 32) <= 0)
     return;
 
   __cmplog_rtn_hook(get_llvm_stdstring(stdstring1),
-- 
cgit 1.4.1


From d0a61279b8306ea74de6f4a4a9cebbc7f559a4e1 Mon Sep 17 00:00:00 2001
From: aflpp <aflpp@aflplus.plus>
Date: Mon, 1 Mar 2021 19:15:58 +0100
Subject: write to correct pipe end

---
 instrumentation/afl-compiler-rt.o.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 15832793..1b21eea1 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -481,9 +481,9 @@ static void __afl_map_shm(void) {
 
   if (id_str) {
 
-    if ((__afl_dummy_fd[0] = open("/dev/null", O_WRONLY)) < 0) {
+    if ((__afl_dummy_fd[1] = open("/dev/null", O_WRONLY)) < 0) {
 
-      if (pipe(__afl_dummy_fd) < 0) { __afl_dummy_fd[0] = 1; }
+      if (pipe(__afl_dummy_fd) < 0) { __afl_dummy_fd[1] = 1; }
 
     }
 
@@ -1591,7 +1591,7 @@ static int area_is_valid(void *ptr, size_t len) {
 
   }
 
-  int r = syscall(__afl_dummy_fd[0], SYS_write, ptr, len);
+  int r = syscall(__afl_dummy_fd[1], SYS_write, ptr, len);
 
   if (r <= 0) {  //  maybe this is going over an asan boundary
 
@@ -1600,7 +1600,7 @@ static int area_is_valid(void *ptr, size_t len) {
     char *page = (char *)((uintptr_t)p & ~(page_size - 1)) + page_size;
     if (page < p + len) { return 0; }
     len -= (p + len - page);
-    r = syscall(__afl_dummy_fd[0], SYS_write, p, len);
+    r = syscall(__afl_dummy_fd[1], SYS_write, p, len);
 
   }
 
-- 
cgit 1.4.1


From 02f33192560a972f02fad72e051b9f884635d7ff Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Thu, 4 Mar 2021 12:23:19 +0100
Subject: only initialize afl-compiler-rt once

---
 instrumentation/afl-compiler-rt.o.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 1b21eea1..c9577a55 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -242,6 +242,10 @@ static void __afl_map_shm_fuzz() {
 
 static void __afl_map_shm(void) {
 
+  static u32 __afl_already_initialized_shm = 0;
+  if (__afl_already_initialized_shm) return;
+  __afl_already_initialized_shm = 1;
+
   // if we are not running in afl ensure the map exists
   if (!__afl_area_ptr) { __afl_area_ptr = __afl_area_ptr_dummy; }
 
@@ -742,6 +746,10 @@ static void __afl_start_snapshots(void) {
 
 static void __afl_start_forkserver(void) {
 
+  static u32 __afl_already_initialized_forkserver = 0;
+  if (__afl_already_initialized_forkserver) return;
+  __afl_already_initialized_forkserver = 1;
+
   struct sigaction orig_action;
   sigaction(SIGTERM, NULL, &orig_action);
   old_sigterm_handler = orig_action.sa_handler;
@@ -1071,6 +1079,10 @@ __attribute__((constructor(CTOR_PRIO))) void __afl_auto_early(void) {
 
 __attribute__((constructor(1))) void __afl_auto_second(void) {
 
+  static u32 __afl_already_initialized_second = 0;
+  if (__afl_already_initialized_second) return;
+  __afl_already_initialized_second = 1;
+
   if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
   u8 *ptr;
 
@@ -1102,6 +1114,10 @@ __attribute__((constructor(1))) void __afl_auto_second(void) {
 
 __attribute__((constructor(0))) void __afl_auto_first(void) {
 
+  static u32 __afl_already_initialized_first = 0;
+  if (__afl_already_initialized_first) return;
+  __afl_already_initialized_first = 1;
+
   if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
   u8 *ptr;
 
-- 
cgit 1.4.1


From 96c526cb78512737a980726dd32c95593edb8cd1 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Thu, 4 Mar 2021 14:04:40 +0100
Subject: fix caller/ctx change, support dlopen in afl-compiler-rt

---
 docs/Changelog.md                   |  10 ++++
 instrumentation/LLVMInsTrim.so.cc   |  29 ++++-----
 instrumentation/afl-compiler-rt.o.c | 114 +++++++++++++++++++++++++++++++-----
 src/afl-cc.c                        |  31 ++++++----
 4 files changed, 144 insertions(+), 40 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 1be41267..6fe3517a 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -14,6 +14,16 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
   - afl-cc
     - fixed a crash that can occur with ASAN + CMPLOG together plus
       better support for unicode (thanks to @stbergmann for reporting!)
+    - handle erroneous setups in which multiple afl-compiler-rt are
+      compiled into the target. This now also supports dlopen instrumented
+      libs loaded before the forkserver.
+    - Renamed CTX to CALLER, added correct/real CTX implemenation to CLASSIC
+  - qemu_mode
+    - added AFL_QEMU_EXCLUDE_RANGES env by @realmadsci, thanks!
+    - if no new/updated checkout is wanted, build with:
+      NO_CHECKOUT=1 ./build_qemu_support.sh
+    - we no longer perform a "git drop"
+
 
 ### Version ++3.10c (release)
   - Mac OS ARM64 support
diff --git a/instrumentation/LLVMInsTrim.so.cc b/instrumentation/LLVMInsTrim.so.cc
index 948f8f3a..f0de6536 100644
--- a/instrumentation/LLVMInsTrim.so.cc
+++ b/instrumentation/LLVMInsTrim.so.cc
@@ -135,7 +135,7 @@ struct InsTrim : public ModulePass {
     unsigned int PrevLocSize = 0;
     char *       ngram_size_str = getenv("AFL_LLVM_NGRAM_SIZE");
     if (!ngram_size_str) ngram_size_str = getenv("AFL_NGRAM_SIZE");
-    char *ctx_str = getenv("AFL_LLVM_CTX");
+    char *caller_str = getenv("AFL_LLVM_CALLER");
 
 #ifdef AFL_HAVE_VECTOR_INTRINSICS
     unsigned int ngram_size = 0;
@@ -197,9 +197,9 @@ struct InsTrim : public ModulePass {
                            GlobalValue::ExternalLinkage, 0, "__afl_area_ptr");
     GlobalVariable *AFLPrevLoc;
     GlobalVariable *AFLContext = NULL;
-    LoadInst *      PrevCtx = NULL;  // for CTX sensitive coverage
+    LoadInst *      PrevCaller = NULL;  // for CALLER sensitive coverage
 
-    if (ctx_str)
+    if (caller_str)
 #if defined(__ANDROID__) || defined(__HAIKU__)
       AFLContext = new GlobalVariable(
           M, Int32Ty, false, GlobalValue::ExternalLinkage, 0, "__afl_prev_ctx");
@@ -398,11 +398,11 @@ struct InsTrim : public ModulePass {
         unsigned int cur_loc;
 
         // Context sensitive coverage
-        if (ctx_str && &BB == &F.getEntryBlock()) {
+        if (caller_str && &BB == &F.getEntryBlock()) {
 
-          PrevCtx = IRB.CreateLoad(AFLContext);
-          PrevCtx->setMetadata(M.getMDKindID("nosanitize"),
-                               MDNode::get(C, None));
+          PrevCaller = IRB.CreateLoad(AFLContext);
+          PrevCaller->setMetadata(M.getMDKindID("nosanitize"),
+                                  MDNode::get(C, None));
 
           // does the function have calls? and is any of the calls larger than
           // one basic block?
@@ -441,7 +441,7 @@ struct InsTrim : public ModulePass {
 
           }
 
-        }  // END of ctx_str
+        }  // END of caller_str
 
         if (MarkSetOpt && MS.find(&BB) == MS.end()) { continue; }
 
@@ -485,9 +485,9 @@ struct InsTrim : public ModulePass {
 #endif
           PrevLocTrans = IRB.CreateZExt(PrevLoc, IRB.getInt32Ty());
 
-        if (ctx_str)
+        if (caller_str)
           PrevLocTrans =
-              IRB.CreateZExt(IRB.CreateXor(PrevLocTrans, PrevCtx), Int32Ty);
+              IRB.CreateZExt(IRB.CreateXor(PrevLocTrans, PrevCaller), Int32Ty);
 
         /* Load SHM pointer */
         LoadInst *MapPtr = IRB.CreateLoad(AFLMapPtr);
@@ -535,16 +535,17 @@ struct InsTrim : public ModulePass {
         IRB.CreateStore(Incr, MapPtrIdx)
             ->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
 
-        if (ctx_str && has_calls) {
+        if (caller_str && has_calls) {
 
-          // in CTX mode we have to restore the original context for the
+          // in CALLER mode we have to restore the original context for the
           // caller - she might be calling other functions which need the
-          // correct CTX
+          // correct CALLER
           Instruction *Inst = BB.getTerminator();
           if (isa<ReturnInst>(Inst) || isa<ResumeInst>(Inst)) {
 
             IRBuilder<> Post_IRB(Inst);
-            StoreInst * RestoreCtx = Post_IRB.CreateStore(PrevCtx, AFLContext);
+            StoreInst * RestoreCtx =
+                Post_IRB.CreateStore(PrevCaller, AFLContext);
             RestoreCtx->setMetadata(M.getMDKindID("nosanitize"),
                                     MDNode::get(C, None));
 
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index c9577a55..e3aa787f 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -123,6 +123,17 @@ static u8 is_persistent;
 
 static u8 _is_sancov;
 
+/* Debug? */
+
+static u32 __afl_debug;
+
+/* Already initialized markers */
+
+static u32 __afl_already_initialized_shm;
+static u32 __afl_already_initialized_forkserver;
+static u32 __afl_already_initialized_first;
+static u32 __afl_already_initialized_second;
+
 /* Dummy pipe for area_is_valid() */
 
 static int __afl_dummy_fd[2] = {2, 2};
@@ -176,7 +187,7 @@ static void __afl_map_shm_fuzz() {
 
   char *id_str = getenv(SHM_FUZZ_ENV_VAR);
 
-  if (getenv("AFL_DEBUG")) {
+  if (__afl_debug) {
 
     fprintf(stderr, "DEBUG: fuzzcase shmem %s\n", id_str ? id_str : "none");
 
@@ -222,7 +233,7 @@ static void __afl_map_shm_fuzz() {
     __afl_fuzz_len = (u32 *)map;
     __afl_fuzz_ptr = map + sizeof(u32);
 
-    if (getenv("AFL_DEBUG")) {
+    if (__afl_debug) {
 
       fprintf(stderr, "DEBUG: successfully got fuzzing shared memory\n");
 
@@ -242,7 +253,6 @@ static void __afl_map_shm_fuzz() {
 
 static void __afl_map_shm(void) {
 
-  static u32 __afl_already_initialized_shm = 0;
   if (__afl_already_initialized_shm) return;
   __afl_already_initialized_shm = 1;
 
@@ -303,7 +313,7 @@ static void __afl_map_shm(void) {
      early-stage __afl_area_initial region that is needed to allow some really
      hacky .init code to work correctly in projects such as OpenSSL. */
 
-  if (getenv("AFL_DEBUG"))
+  if (__afl_debug)
     fprintf(stderr,
             "DEBUG: id_str %s, __afl_area_ptr %p, __afl_area_initial %p, "
             "__afl_map_addr 0x%llx, MAP_SIZE %u, __afl_final_loc %u, "
@@ -359,17 +369,18 @@ static void __afl_map_shm(void) {
 
     }
 
+    close(shm_fd);
+
     if (shm_base == MAP_FAILED) {
 
-      close(shm_fd);
       shm_fd = -1;
-
       fprintf(stderr, "mmap() failed\n");
+      perror("mmap for map");
+
       if (__afl_map_addr)
         send_forkserver_error(FS_ERROR_MAP_ADDR);
       else
         send_forkserver_error(FS_ERROR_MMAP);
-      perror("mmap for map");
 
       exit(2);
 
@@ -476,7 +487,7 @@ static void __afl_map_shm(void) {
 
   id_str = getenv(CMPLOG_SHM_ENV_VAR);
 
-  if (getenv("AFL_DEBUG")) {
+  if (__afl_debug) {
 
     fprintf(stderr, "DEBUG: cmplog id_str %s\n",
             id_str == NULL ? "<null>" : id_str);
@@ -541,6 +552,58 @@ static void __afl_map_shm(void) {
 
 }
 
+/* unmap SHM. */
+
+static void __afl_unmap_shm(void) {
+
+  if (!__afl_already_initialized_shm) return;
+
+  char *id_str = getenv(SHM_ENV_VAR);
+
+  if (id_str) {
+
+#ifdef USEMMAP
+
+    munmap((void *)__afl_area_ptr, __afl_map_size);
+
+#else
+
+    shmdt((void *)__afl_area_ptr);
+
+#endif
+
+  } else if ((!__afl_area_ptr || __afl_area_ptr == __afl_area_initial) &&
+
+             __afl_map_addr) {
+
+    munmap((void *)__afl_map_addr, __afl_map_size);
+
+  }
+
+  __afl_area_ptr = __afl_area_ptr_dummy;
+
+  id_str = getenv(CMPLOG_SHM_ENV_VAR);
+
+  if (id_str) {
+
+#ifdef USEMMAP
+
+    munmap((void *)__afl_cmp_map, __afl_map_size);
+
+#else
+
+    shmdt((void *)__afl_cmp_map);
+
+#endif
+
+    __afl_cmp_map = NULL;
+
+  }
+
+  __afl_already_initialized_shm = 0;
+
+}
+
 #ifdef __linux__
 static void __afl_start_snapshots(void) {
 
@@ -569,7 +632,7 @@ static void __afl_start_snapshots(void) {
 
     if (read(FORKSRV_FD, &was_killed, 4) != 4) { _exit(1); }
 
-    if (getenv("AFL_DEBUG")) {
+    if (__afl_debug) {
 
       fprintf(stderr, "target forkserver recv: %08x\n", was_killed);
 
@@ -746,7 +809,6 @@ static void __afl_start_snapshots(void) {
 
 static void __afl_start_forkserver(void) {
 
-  static u32 __afl_already_initialized_forkserver = 0;
   if (__afl_already_initialized_forkserver) return;
   __afl_already_initialized_forkserver = 1;
 
@@ -800,7 +862,7 @@ static void __afl_start_forkserver(void) {
 
     if (read(FORKSRV_FD, &was_killed, 4) != 4) _exit(1);
 
-    if (getenv("AFL_DEBUG")) {
+    if (__afl_debug) {
 
       fprintf(stderr, "target forkserver recv: %08x\n", was_killed);
 
@@ -1035,7 +1097,7 @@ void __afl_manual_init(void) {
     __afl_sharedmem_fuzzing = 0;
     if (__afl_area_ptr == NULL) __afl_area_ptr = __afl_area_ptr_dummy;
 
-    if (getenv("AFL_DEBUG"))
+    if (__afl_debug)
       fprintf(stderr,
               "DEBUG: disabled instrumentation because of "
               "AFL_DISABLE_LLVM_INSTRUMENTATION\n");
@@ -1079,10 +1141,11 @@ __attribute__((constructor(CTOR_PRIO))) void __afl_auto_early(void) {
 
 __attribute__((constructor(1))) void __afl_auto_second(void) {
 
-  static u32 __afl_already_initialized_second = 0;
   if (__afl_already_initialized_second) return;
   __afl_already_initialized_second = 1;
 
+  if (getenv("AFL_DEBUG")) { __afl_debug = 1; }
+
   if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
   u8 *ptr;
 
@@ -1114,7 +1177,6 @@ __attribute__((constructor(1))) void __afl_auto_second(void) {
 
 __attribute__((constructor(0))) void __afl_auto_first(void) {
 
-  static u32 __afl_already_initialized_first = 0;
   if (__afl_already_initialized_first) return;
   __afl_already_initialized_first = 1;
 
@@ -1198,7 +1260,7 @@ void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) {
 
   _is_sancov = 1;
 
-  if (getenv("AFL_DEBUG")) {
+  if (__afl_debug) {
 
     fprintf(stderr,
             "Running __sanitizer_cov_trace_pc_guard_init: %p-%p (%lu edges)\n",
@@ -1235,6 +1297,28 @@ void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) {
 
   }
 
+  if (__afl_debug) {
+
+    fprintf(stderr,
+            "Done __sanitizer_cov_trace_pc_guard_init: __afl_final_loc = %u\n",
+            __afl_final_loc);
+
+  }
+
+  if (__afl_already_initialized_shm && __afl_final_loc > __afl_map_size) {
+
+    if (__afl_debug) {
+
+      fprintf(stderr, "Reinit shm necessary (+%u)\n",
+              __afl_final_loc - __afl_map_size);
+
+    }
+
+    __afl_unmap_shm();
+    __afl_map_shm();
+
+  }
+
 }
 
 ///// CmpLog instrumentation
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 0c689286..ab794877 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -89,7 +89,7 @@ char instrument_mode_string[18][18] = {
     "GCC",
     "CLANG",
     "CTX",
-    "",
+    "CALLER",
     "",
     "",
     "",
@@ -1514,12 +1514,13 @@ int main(int argc, char **argv, char **envp) {
         "      CLASSIC              %s      no  yes     module yes yes    "
         "yes\n"
         "        - NORMAL\n"
+        "        - CALLER\n"
         "        - CTX\n"
         "        - NGRAM-{2-16}\n"
         "      INSTRIM                           no  yes     module yes yes "
         "   yes\n"
         "        - NORMAL\n"
-        "        - CTX\n"
+        "        - CALLER\n"
         "        - NGRAM-{2-16}\n"
         "  [GCC_PLUGIN] gcc plugin: %s%s\n"
         "      CLASSIC              DEFAULT      no  yes     no     no  no     "
@@ -1566,7 +1567,10 @@ int main(int argc, char **argv, char **envp) {
         NATIVE_MSG
 
         "  CLASSIC: decision target instrumentation (README.llvm.md)\n"
-        "  CTX:     CLASSIC + callee context (instrumentation/README.ctx.md)\n"
+        "  CALLER:  CLASSIC + single callee context "
+        "(instrumentation/README.ctx.md)\n"
+        "  CTX:     CLASSIC + full callee context "
+        "(instrumentation/README.ctx.md)\n"
         "  NGRAM-x: CLASSIC + previous path "
         "((instrumentation/README.ngram.md)\n"
         "  INSTRIM: Dominator tree (for LLVM <= 6.0) "
@@ -1660,15 +1664,17 @@ int main(int argc, char **argv, char **envp) {
             "  AFL_LLVM_CMPLOG: log operands of comparisons (RedQueen "
             "mutator)\n"
             "  AFL_LLVM_INSTRUMENT: set instrumentation mode:\n"
-            "    CLASSIC, INSTRIM, PCGUARD, LTO, GCC, CLANG, CTX, NGRAM-2 ... "
-            "NGRAM-16\n"
+            "    CLASSIC, INSTRIM, PCGUARD, LTO, GCC, CLANG, CALLER, CTX, "
+            "NGRAM-2 ..-16\n"
             " You can also use the old environment variables instead:\n"
             "  AFL_LLVM_USE_TRACE_PC: use LLVM trace-pc-guard instrumentation\n"
             "  AFL_LLVM_INSTRIM: use light weight instrumentation InsTrim\n"
             "  AFL_LLVM_INSTRIM_LOOPHEAD: optimize loop tracing for speed "
             "(option to INSTRIM)\n"
-            "  AFL_LLVM_CTX: use context sensitive coverage (for CLASSIC and "
-            "INSTRIM)\n"
+            "  AFL_LLVM_CALLER: use single context sensitive coverage (for "
+            "CLASSIC)\n"
+            "  AFL_LLVM_CTX: use full context sensitive coverage (for "
+            "CLASSIC)\n"
             "  AFL_LLVM_NGRAM_SIZE: use ngram prev_loc count coverage (for "
             "CLASSIC & INSTRIM)\n");
 
@@ -1814,11 +1820,14 @@ int main(int argc, char **argv, char **envp) {
         "(requires LLVM 11 or higher)");
 #endif
 
-  if (instrument_opt_mode && instrument_mode != INSTRUMENT_CLASSIC &&
-      instrument_mode != INSTRUMENT_CFG)
+  if (instrument_opt_mode && instrument_mode == INSTRUMENT_CFG &&
+      instrument_opt_mode & INSTRUMENT_OPT_CTX)
+    FATAL("CFG instrumentation mode supports NGRAM and CALLER, but not CTX.");
+  else if (instrument_opt_mode && instrument_mode != INSTRUMENT_CLASSIC)
+    // we will drop CFG/INSTRIM in the future so do not advertise
     FATAL(
-        "CTX and NGRAM instrumentation options can only be used with LLVM and "
-        "CFG or CLASSIC instrumentation modes!");
+        "CALLER, CTX and NGRAM instrumentation options can only be used with "
+        "the LLVM CLASSIC instrumentation mode.");
 
   if (getenv("AFL_LLVM_SKIP_NEVERZERO") && getenv("AFL_LLVM_NOT_ZERO"))
     FATAL(
-- 
cgit 1.4.1


From 79d75d8e42e5adf64e149ab6e1fe197cb1d4f303 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Thu, 4 Mar 2021 14:19:00 +0100
Subject: even support dlopen instrumented libs after the forkserver

---
 docs/Changelog.md                   |  5 +++--
 instrumentation/afl-compiler-rt.o.c | 36 ++++++++++++++++++++++++++++++++++--
 2 files changed, 37 insertions(+), 4 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 6fe3517a..b1c991ff 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -15,8 +15,9 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - fixed a crash that can occur with ASAN + CMPLOG together plus
       better support for unicode (thanks to @stbergmann for reporting!)
     - handle erroneous setups in which multiple afl-compiler-rt are
-      compiled into the target. This now also supports dlopen instrumented
-      libs loaded before the forkserver.
+      compiled into the target. This now also supports dlopen
+      instrumented libs loaded before the forkserver and even after the
+      forkserver is started (then with collisions though)
     - Renamed CTX to CALLER, added correct/real CTX implemenation to CLASSIC
   - qemu_mode
     - added AFL_QEMU_EXCLUDE_RANGES env by @realmadsci, thanks!
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index e3aa787f..87bf6486 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1263,8 +1263,10 @@ void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) {
   if (__afl_debug) {
 
     fprintf(stderr,
-            "Running __sanitizer_cov_trace_pc_guard_init: %p-%p (%lu edges)\n",
-            start, stop, (unsigned long)(stop - start));
+            "Running __sanitizer_cov_trace_pc_guard_init: %p-%p (%lu edges) "
+            "after_fs=%u\n",
+            start, stop, (unsigned long)(stop - start),
+            __afl_already_initialized_forkserver);
 
   }
 
@@ -1280,6 +1282,36 @@ void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) {
 
   }
 
+  /* instrumented code is loaded *after* our forkserver is up. this is a
+     problem. We cannot prevent collisions then :( */
+  if (__afl_already_initialized_forkserver &&
+      __afl_final_loc + 1 + stop - start > __afl_map_size) {
+
+    if (__afl_debug)
+      fprintf(stderr, "Warning: new instrumneted code after the forkserver!\n");
+    __afl_final_loc = 2;
+
+    if (1 + stop - start > __afl_map_size) {
+
+      *(start++) = ++__afl_final_loc;
+
+      while (start < stop) {
+
+        if (R(100) < inst_ratio)
+          *start = ++__afl_final_loc % __afl_map_size;
+        else
+          *start = 0;
+
+        start++;
+
+      }
+
+      return;
+
+    }
+
+  }
+
   /* Make sure that the first element in the range is always set - we use that
      to avoid duplicate calls (which can happen as an artifact of the underlying
      implementation in LLVM). */
-- 
cgit 1.4.1


From 0aa93afeb82c610fd39b5dd4a3dd7482b9f86b1e Mon Sep 17 00:00:00 2001
From: Andrea Fioraldi <andreafioraldi@gmail.com>
Date: Thu, 4 Mar 2021 14:50:26 +0100
Subject: vectorial top-k CTX first implementation

---
 instrumentation/LLVMInsTrim.so.cc           |   2 +-
 instrumentation/afl-compiler-rt.o.c         |   4 +-
 instrumentation/afl-llvm-pass.so.cc         | 154 ++++++++++++++++++++++++----
 instrumentation/llvm-alternative-coverage.h |  21 ++++
 instrumentation/llvm-ngram-coverage.h       |  18 ----
 src/afl-cc.c                                |   2 +-
 6 files changed, 162 insertions(+), 39 deletions(-)
 create mode 100644 instrumentation/llvm-alternative-coverage.h
 delete mode 100644 instrumentation/llvm-ngram-coverage.h

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/LLVMInsTrim.so.cc b/instrumentation/LLVMInsTrim.so.cc
index 948f8f3a..83f11411 100644
--- a/instrumentation/LLVMInsTrim.so.cc
+++ b/instrumentation/LLVMInsTrim.so.cc
@@ -38,7 +38,7 @@ typedef long double max_align_t;
 
 #include "MarkNodes.h"
 #include "afl-llvm-common.h"
-#include "llvm-ngram-coverage.h"
+#include "llvm-alternative-coverage.h"
 
 #include "config.h"
 #include "debug.h"
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index c9577a55..d583e246 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -20,7 +20,7 @@
 #include "config.h"
 #include "types.h"
 #include "cmplog.h"
-#include "llvm-ngram-coverage.h"
+#include "llvm-alternative-coverage.h"
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -97,10 +97,12 @@ int __afl_selective_coverage_temp = 1;
 
 #if defined(__ANDROID__) || defined(__HAIKU__)
 PREV_LOC_T __afl_prev_loc[NGRAM_SIZE_MAX];
+PREV_LOC_T __afl_prev_caller[CTX_MAX_K];
 u32        __afl_prev_ctx;
 u32        __afl_cmp_counter;
 #else
 __thread PREV_LOC_T __afl_prev_loc[NGRAM_SIZE_MAX];
+__thread PREV_LOC_T __afl_prev_caller[CTX_MAX_K];
 __thread u32        __afl_prev_ctx;
 __thread u32        __afl_cmp_counter;
 #endif
diff --git a/instrumentation/afl-llvm-pass.so.cc b/instrumentation/afl-llvm-pass.so.cc
index 33898aec..c58e9d95 100644
--- a/instrumentation/afl-llvm-pass.so.cc
+++ b/instrumentation/afl-llvm-pass.so.cc
@@ -62,7 +62,7 @@ typedef long double max_align_t;
 #endif
 
 #include "afl-llvm-common.h"
-#include "llvm-ngram-coverage.h"
+#include "llvm-alternative-coverage.h"
 
 using namespace llvm;
 
@@ -82,6 +82,7 @@ class AFLCoverage : public ModulePass {
 
  protected:
   uint32_t ngram_size = 0;
+  uint32_t ctx_k = 0;
   uint32_t map_size = MAP_SIZE;
   uint32_t function_minimum_size = 1;
   char *   ctx_str = NULL, *caller_str = NULL, *skip_nozero = NULL;
@@ -183,12 +184,17 @@ bool AFLCoverage::runOnModule(Module &M) {
   skip_nozero = getenv("AFL_LLVM_SKIP_NEVERZERO");
 
   unsigned PrevLocSize = 0;
+  unsigned PrevCallerSize = 0;
 
   char *ngram_size_str = getenv("AFL_LLVM_NGRAM_SIZE");
   if (!ngram_size_str) ngram_size_str = getenv("AFL_NGRAM_SIZE");
+  char *ctx_k_str = getenv("AFL_LLVM_CTX_K");
+  if (!ctx_k_str) ctx_k_str = getenv("AFL_CTX_K");
   ctx_str = getenv("AFL_LLVM_CTX");
   caller_str = getenv("AFL_LLVM_CALLER");
 
+  bool instrument_ctx = ctx_str || caller_str;
+
 #ifdef AFL_HAVE_VECTOR_INTRINSICS
   /* Decide previous location vector size (must be a power of two) */
   VectorType *PrevLocTy = NULL;
@@ -205,6 +211,25 @@ bool AFLCoverage::runOnModule(Module &M) {
   if (ngram_size)
     PrevLocSize = ngram_size - 1;
   else
+    PrevLocSize = 1;
+  
+  /* Decide K-ctx vector size (must be a power of two) */
+  VectorType *PrevCallerTy = NULL;
+
+  if (ctx_k_str)
+    if (sscanf(ctx_k_str, "%u", &ctx_k) != 1 || ctx_k < 2 ||
+        ctx_k > CTX_MAX_K)
+      FATAL("Bad value of AFL_CTX_K (must be between 2 and CTX_MAX_K (%u))", CTX_MAX_K);
+
+  if (ctx_k == 1) {
+    ctx_k = 0;
+    instrument_ctx = true;
+    caller_str = ctx_k_str; // Enable CALLER instead
+  }
+  if (ctx_k) {
+    PrevCallerSize = ctx_k;
+    instrument_ctx = true;
+  }
 #else
   if (ngram_size_str)
   #ifndef LLVM_VERSION_PATCH
@@ -218,8 +243,20 @@ bool AFLCoverage::runOnModule(Module &M) {
         "%d.%d.%d!",
         LLVM_VERSION_MAJOR, LLVM_VERSION_MINOR, LLVM_VERSION_PATCH);
   #endif
+  if (ctx_k_str)
+  #ifndef LLVM_VERSION_PATCH
+    FATAL(
+        "Sorry, K-CTX branch coverage is not supported with llvm version "
+        "%d.%d.%d!",
+        LLVM_VERSION_MAJOR, LLVM_VERSION_MINOR, 0);
+  #else
+    FATAL(
+        "Sorry, K-CTX branch coverage is not supported with llvm version "
+        "%d.%d.%d!",
+        LLVM_VERSION_MAJOR, LLVM_VERSION_MINOR, LLVM_VERSION_PATCH);
+  #endif
+  PrevLocSize = 1;
 #endif
-    PrevLocSize = 1;
 
 #ifdef AFL_HAVE_VECTOR_INTRINSICS
   int PrevLocVecSize = PowerOf2Ceil(PrevLocSize);
@@ -232,6 +269,17 @@ bool AFLCoverage::runOnModule(Module &M) {
     );
 #endif
 
+#ifdef AFL_HAVE_VECTOR_INTRINSICS
+  int PrevCallerVecSize = PowerOf2Ceil(PrevCallerSize);
+  if (ctx_k)
+    PrevCallerTy = VectorType::get(IntLocTy, PrevCallerVecSize
+  #if LLVM_VERSION_MAJOR >= 12
+                                ,
+                                false
+  #endif
+    );
+#endif
+
   /* Get globals for the SHM region and the previous location. Note that
      __afl_prev_loc is thread-local. */
 
@@ -239,6 +287,7 @@ bool AFLCoverage::runOnModule(Module &M) {
       new GlobalVariable(M, PointerType::get(Int8Ty, 0), false,
                          GlobalValue::ExternalLinkage, 0, "__afl_area_ptr");
   GlobalVariable *AFLPrevLoc;
+  GlobalVariable *AFLPrevCaller;
   GlobalVariable *AFLContext = NULL;
 
   if (ctx_str || caller_str)
@@ -275,6 +324,30 @@ bool AFLCoverage::runOnModule(Module &M) {
       GlobalVariable::GeneralDynamicTLSModel, 0, false);
 #endif
 
+#ifdef AFL_HAVE_VECTOR_INTRINSICS
+  if (ctx_k)
+  #if defined(__ANDROID__) || defined(__HAIKU__)
+    AFLPrevCaller = new GlobalVariable(
+        M, PrevCallerTy, /* isConstant */ false, GlobalValue::ExternalLinkage,
+        /* Initializer */ nullptr, "__afl_prev_caller");
+  #else
+    AFLPrevCaller = new GlobalVariable(
+        M, PrevCallerTy, /* isConstant */ false, GlobalValue::ExternalLinkage,
+        /* Initializer */ nullptr, "__afl_prev_caller",
+        /* InsertBefore */ nullptr, GlobalVariable::GeneralDynamicTLSModel,
+        /* AddressSpace */ 0, /* IsExternallyInitialized */ false);
+  #endif
+  else
+#endif
+#if defined(__ANDROID__) || defined(__HAIKU__)
+    AFLPrevCaller = new GlobalVariable(
+        M, Int32Ty, false, GlobalValue::ExternalLinkage, 0, "__afl_prev_caller");
+#else
+  AFLPrevCaller = new GlobalVariable(
+      M, Int32Ty, false, GlobalValue::ExternalLinkage, 0, "__afl_prev_caller", 0,
+      GlobalVariable::GeneralDynamicTLSModel, 0, false);
+#endif
+
 #ifdef AFL_HAVE_VECTOR_INTRINSICS
   /* Create the vector shuffle mask for updating the previous block history.
      Note that the first element of the vector will store cur_loc, so just set
@@ -289,13 +362,24 @@ bool AFLCoverage::runOnModule(Module &M) {
     PrevLocShuffle.push_back(ConstantInt::get(Int32Ty, PrevLocSize));
 
   Constant *PrevLocShuffleMask = ConstantVector::get(PrevLocShuffle);
+  
+  SmallVector<Constant *, 32> PrevCallerShuffle = {UndefValue::get(Int32Ty)};
+
+  for (unsigned I = 0; I < PrevCallerSize - 1; ++I)
+    PrevCallerShuffle.push_back(ConstantInt::get(Int32Ty, I));
+
+  for (int I = PrevCallerSize; I < PrevCallerVecSize; ++I)
+    PrevCallerShuffle.push_back(ConstantInt::get(Int32Ty, PrevCallerSize));
+
+  Constant *PrevCallerShuffleMask = ConstantVector::get(PrevCallerShuffle);
 #endif
 
   // other constants we need
   ConstantInt *Zero = ConstantInt::get(Int8Ty, 0);
   ConstantInt *One = ConstantInt::get(Int8Ty, 1);
 
-  LoadInst *PrevCtx = NULL;  // CTX sensitive coverage
+  Value *PrevCtx = NULL;  // CTX sensitive coverage
+  LoadInst *PrevCaller = NULL; // K-CTX coverage
 
   /* Instrument all the things! */
 
@@ -319,12 +403,21 @@ bool AFLCoverage::runOnModule(Module &M) {
       IRBuilder<>          IRB(&(*IP));
 
       // Context sensitive coverage
-      if ((ctx_str || caller_str) && &BB == &F.getEntryBlock()) {
+      if (instrument_ctx && &BB == &F.getEntryBlock()) {
 
-        // load the context ID of the previous function and write to to a local
-        // variable on the stack
-        PrevCtx = IRB.CreateLoad(AFLContext);
-        PrevCtx->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
+#ifdef AFL_HAVE_VECTOR_INTRINSICS
+        if (ctx_k) {
+          PrevCaller = IRB.CreateLoad(AFLPrevCaller);
+          PrevCaller->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
+          PrevCtx = IRB.CreateZExt(IRB.CreateXorReduce(PrevCaller), IRB.getInt32Ty());
+        } else 
+#endif
+        {
+          // load the context ID of the previous function and write to to a local variable on the stack
+          LoadInst* PrevCtxLoad = IRB.CreateLoad(AFLContext);
+          PrevCtxLoad->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
+          PrevCtx = PrevCtxLoad;
+        }
 
         // does the function have calls? and is any of the calls larger than one
         // basic block?
@@ -356,10 +449,22 @@ bool AFLCoverage::runOnModule(Module &M) {
         if (has_calls) {
 
           Value *NewCtx = ConstantInt::get(Int32Ty, AFL_R(map_size));
-          if (ctx_str) NewCtx = IRB.CreateXor(PrevCtx, NewCtx);
-          StoreInst *StoreCtx = IRB.CreateStore(NewCtx, AFLContext);
-          StoreCtx->setMetadata(M.getMDKindID("nosanitize"),
-                                MDNode::get(C, None));
+#ifdef AFL_HAVE_VECTOR_INTRINSICS
+          if (ctx_k) {
+            Value *ShuffledPrevCaller = IRB.CreateShuffleVector(
+                PrevCaller, UndefValue::get(PrevCallerTy), PrevCallerShuffleMask);
+            Value *UpdatedPrevCaller = IRB.CreateInsertElement(ShuffledPrevCaller, NewCtx, (uint64_t)0);
+
+            StoreInst * Store = IRB.CreateStore(UpdatedPrevCaller, AFLPrevCaller);
+            Store->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
+          } else 
+#endif
+          {
+            if (ctx_str) NewCtx = IRB.CreateXor(PrevCtx, NewCtx);
+            StoreInst *StoreCtx = IRB.CreateStore(NewCtx, AFLContext);
+            StoreCtx->setMetadata(M.getMDKindID("nosanitize"),
+                                  MDNode::get(C, None));
+          }
 
         }
 
@@ -413,16 +518,22 @@ bool AFLCoverage::runOnModule(Module &M) {
 
         // in CTX mode we have to restore the original context for the caller -
         // she might be calling other functions which need the correct CTX
-        if ((ctx_str || caller_str) && has_calls) {
+        if (instrument_ctx && has_calls) {
 
           Instruction *Inst = BB.getTerminator();
           if (isa<ReturnInst>(Inst) || isa<ResumeInst>(Inst)) {
 
             IRBuilder<> Post_IRB(Inst);
-            StoreInst * RestoreCtx = Post_IRB.CreateStore(PrevCtx, AFLContext);
+
+            StoreInst * RestoreCtx;
+#ifdef AFL_HAVE_VECTOR_INTRINSICS
+            if (ctx_k)
+              RestoreCtx = IRB.CreateStore(PrevCaller, AFLPrevCaller);
+            else 
+#endif
+            RestoreCtx = Post_IRB.CreateStore(PrevCtx, AFLContext);
             RestoreCtx->setMetadata(M.getMDKindID("nosanitize"),
                                     MDNode::get(C, None));
-
           }
 
         }
@@ -460,7 +571,7 @@ bool AFLCoverage::runOnModule(Module &M) {
 #endif
         PrevLocTrans = PrevLoc;
 
-      if (ctx_str || caller_str)
+      if (instrument_ctx)
         PrevLocTrans =
             IRB.CreateZExt(IRB.CreateXor(PrevLocTrans, PrevCtx), Int32Ty);
       else
@@ -547,13 +658,20 @@ bool AFLCoverage::runOnModule(Module &M) {
       // in CTX mode we have to restore the original context for the caller -
       // she might be calling other functions which need the correct CTX.
       // Currently this is only needed for the Ubuntu clang-6.0 bug
-      if ((ctx_str || caller_str) && has_calls) {
+      if (instrument_ctx && has_calls) {
 
         Instruction *Inst = BB.getTerminator();
         if (isa<ReturnInst>(Inst) || isa<ResumeInst>(Inst)) {
 
           IRBuilder<> Post_IRB(Inst);
-          StoreInst * RestoreCtx = Post_IRB.CreateStore(PrevCtx, AFLContext);
+          
+          StoreInst * RestoreCtx;
+#ifdef AFL_HAVE_VECTOR_INTRINSICS
+          if (ctx_k)
+            RestoreCtx = IRB.CreateStore(PrevCaller, AFLPrevCaller);
+          else 
+#endif
+          RestoreCtx = Post_IRB.CreateStore(PrevCtx, AFLContext);
           RestoreCtx->setMetadata(M.getMDKindID("nosanitize"),
                                   MDNode::get(C, None));
 
diff --git a/instrumentation/llvm-alternative-coverage.h b/instrumentation/llvm-alternative-coverage.h
new file mode 100644
index 00000000..0d7b3957
--- /dev/null
+++ b/instrumentation/llvm-alternative-coverage.h
@@ -0,0 +1,21 @@
+#ifndef AFL_NGRAM_CONFIG_H
+#define AFL_NGRAM_CONFIG_H
+
+#include "types.h"
+
+#if (MAP_SIZE_POW2 <= 16)
+typedef u16 PREV_LOC_T;
+#elif (MAP_SIZE_POW2 <= 32)
+typedef u32 PREV_LOC_T;
+#else
+typedef u64 PREV_LOC_T;
+#endif
+
+/* Maximum ngram size */
+#define NGRAM_SIZE_MAX 16U
+
+/* Maximum K for top-K context sensitivity */
+#define CTX_MAX_K 32U
+
+#endif
+
diff --git a/instrumentation/llvm-ngram-coverage.h b/instrumentation/llvm-ngram-coverage.h
deleted file mode 100644
index 666839c8..00000000
--- a/instrumentation/llvm-ngram-coverage.h
+++ /dev/null
@@ -1,18 +0,0 @@
-#ifndef AFL_NGRAM_CONFIG_H
-#define AFL_NGRAM_CONFIG_H
-
-#include "types.h"
-
-#if (MAP_SIZE_POW2 <= 16)
-typedef u16 PREV_LOC_T;
-#elif (MAP_SIZE_POW2 <= 32)
-typedef u32 PREV_LOC_T;
-#else
-typedef u64 PREV_LOC_T;
-#endif
-
-/* Maximum ngram size */
-#define NGRAM_SIZE_MAX 16U
-
-#endif
-
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 0c689286..3c96beac 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -22,7 +22,7 @@
 #include "types.h"
 #include "debug.h"
 #include "alloc-inl.h"
-#include "llvm-ngram-coverage.h"
+#include "llvm-alternative-coverage.h"
 
 #include <stdio.h>
 #include <unistd.h>
-- 
cgit 1.4.1


From 3e5ac0af5237bbd01abc30538add248ee0bf1735 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Fri, 5 Mar 2021 10:21:28 +0100
Subject: no static for rt initialized markers

---
 instrumentation/afl-compiler-rt.o.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 87bf6486..664c942d 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -129,10 +129,10 @@ static u32 __afl_debug;
 
 /* Already initialized markers */
 
-static u32 __afl_already_initialized_shm;
-static u32 __afl_already_initialized_forkserver;
-static u32 __afl_already_initialized_first;
-static u32 __afl_already_initialized_second;
+u32 __afl_already_initialized_shm;
+u32 __afl_already_initialized_forkserver;
+u32 __afl_already_initialized_first;
+u32 __afl_already_initialized_second;
 
 /* Dummy pipe for area_is_valid() */
 
-- 
cgit 1.4.1


From 41ad23041b98917e9c38873f5b296ab98e59e460 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Fri, 5 Mar 2021 14:58:37 +0100
Subject: remove warnings

---
 instrumentation/afl-compiler-rt.o.c         |  8 +++-----
 instrumentation/cmplog-instructions-pass.cc | 14 +++-----------
 instrumentation/split-compares-pass.so.cc   | 19 +++++++++++++++----
 3 files changed, 21 insertions(+), 20 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 664c942d..1d8fd757 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1170,7 +1170,7 @@ __attribute__((constructor(1))) void __afl_auto_second(void) {
 
   }
 
-}
+}  // ptr memleak report is a false positive
 
 /* preset __afl_area_ptr #1 - at constructor level 0 global variables have
    not been set */
@@ -1181,9 +1181,7 @@ __attribute__((constructor(0))) void __afl_auto_first(void) {
   __afl_already_initialized_first = 1;
 
   if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
-  u8 *ptr;
-
-  ptr = (u8 *)malloc(MAP_INITIAL_SIZE);
+  u8 *ptr = (u8 *)malloc(MAP_INITIAL_SIZE);
 
   if (ptr && (ssize_t)ptr != -1) {
 
@@ -1192,7 +1190,7 @@ __attribute__((constructor(0))) void __afl_auto_first(void) {
 
   }
 
-}
+}  // ptr memleak report is a false positive
 
 /* The following stuff deals with supporting -fsanitize-coverage=trace-pc-guard.
    It remains non-operational in the traditional, plugin-backed LLVM mode.
diff --git a/instrumentation/cmplog-instructions-pass.cc b/instrumentation/cmplog-instructions-pass.cc
index dbca9afa..ad334d3b 100644
--- a/instrumentation/cmplog-instructions-pass.cc
+++ b/instrumentation/cmplog-instructions-pass.cc
@@ -418,7 +418,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
       IntegerType *        intTyOp0 = NULL;
       IntegerType *        intTyOp1 = NULL;
       unsigned             max_size = 0, cast_size = 0;
-      unsigned char        attr = 0, do_cast = 0;
+      unsigned char        attr = 0;
       std::vector<Value *> args;
 
       CmpInst *cmpInst = dyn_cast<CmpInst>(selectcmpInst);
@@ -484,7 +484,6 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
           max_size = 128;
 
         attr += 8;
-        do_cast = 1;
 
       } else {
 
@@ -503,12 +502,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
 
       if (!max_size || max_size < 16) { continue; }
 
-      if (max_size % 8) {
-
-        max_size = (((max_size / 8) + 1) * 8);
-        do_cast = 1;
-
-      }
+      if (max_size % 8) { max_size = (((max_size / 8) + 1) * 8); }
 
       if (max_size > 128) {
 
@@ -521,7 +515,6 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
         }
 
         max_size = 128;
-        do_cast = 1;
 
       }
 
@@ -537,7 +530,6 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
           break;
         default:
           cast_size = 128;
-          do_cast = 1;
 
       }
 
@@ -574,7 +566,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
       }
 
       // fprintf(stderr, "_ExtInt(%u) castTo %u with attr %u didcast %u\n",
-      //         max_size, cast_size, attr, do_cast);
+      //         max_size, cast_size, attr);
 
       switch (cast_size) {
 
diff --git a/instrumentation/split-compares-pass.so.cc b/instrumentation/split-compares-pass.so.cc
index 80cd90ba..d03944df 100644
--- a/instrumentation/split-compares-pass.so.cc
+++ b/instrumentation/split-compares-pass.so.cc
@@ -149,8 +149,11 @@ bool SplitComparesTransform::simplifyFPCompares(Module &M) {
     auto op1 = FcmpInst->getOperand(1);
 
     /* find out what the new predicate is going to be */
-    auto               pred = dyn_cast<CmpInst>(FcmpInst)->getPredicate();
+    auto cmp_inst = dyn_cast<CmpInst>(FcmpInst);
+    if (!cmp_inst) { continue; }
+    auto               pred = cmp_inst->getPredicate();
     CmpInst::Predicate new_pred;
+
     switch (pred) {
 
       case CmpInst::FCMP_UGE:
@@ -276,8 +279,11 @@ bool SplitComparesTransform::simplifyCompares(Module &M) {
     auto op1 = IcmpInst->getOperand(1);
 
     /* find out what the new predicate is going to be */
-    auto               pred = dyn_cast<CmpInst>(IcmpInst)->getPredicate();
+    auto cmp_inst = dyn_cast<CmpInst>(IcmpInst);
+    if (!cmp_inst) { continue; }
+    auto               pred = cmp_inst->getPredicate();
     CmpInst::Predicate new_pred;
+
     switch (pred) {
 
       case CmpInst::ICMP_UGE:
@@ -412,8 +418,11 @@ bool SplitComparesTransform::simplifyIntSignedness(Module &M) {
     IntegerType *IntType = IntegerType::get(C, bitw);
 
     /* get the new predicate */
-    auto               pred = dyn_cast<CmpInst>(IcmpInst)->getPredicate();
+    auto cmp_inst = dyn_cast<CmpInst>(IcmpInst);
+    if (!cmp_inst) { continue; }
+    auto               pred = cmp_inst->getPredicate();
     CmpInst::Predicate new_pred;
+
     if (pred == CmpInst::ICMP_SGT) {
 
       new_pred = CmpInst::ICMP_UGT;
@@ -1113,7 +1122,9 @@ size_t SplitComparesTransform::splitIntCompares(Module &M, unsigned bitw) {
     auto op0 = IcmpInst->getOperand(0);
     auto op1 = IcmpInst->getOperand(1);
 
-    auto pred = dyn_cast<CmpInst>(IcmpInst)->getPredicate();
+    auto cmp_inst = dyn_cast<CmpInst>(IcmpInst);
+    if (!cmp_inst) { continue; }
+    auto pred = cmp_inst->getPredicate();
 
     BasicBlock *end_bb = bb->splitBasicBlock(BasicBlock::iterator(IcmpInst));
 
-- 
cgit 1.4.1


From 44be521ab8ef5d62847ae48ebdb060d84aae5e47 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Fri, 5 Mar 2021 19:19:43 +0100
Subject: fix

---
 instrumentation/afl-compiler-rt.o.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 1d8fd757..c741bc05 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -370,10 +370,10 @@ static void __afl_map_shm(void) {
     }
 
     close(shm_fd);
+    shm_fd = -1;
 
     if (shm_base == MAP_FAILED) {
 
-      shm_fd = -1;
       fprintf(stderr, "mmap() failed\n");
       perror("mmap for map");
 
-- 
cgit 1.4.1


From 9b3d8c327d33191b181219ffce411b40bdbe8902 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sat, 6 Mar 2021 10:20:01 +0100
Subject: fix for asan compile rt

---
 instrumentation/afl-compiler-rt.o.c | 28 ++++++----------------------
 1 file changed, 6 insertions(+), 22 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index c741bc05..a702ec39 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1703,41 +1703,25 @@ __attribute__((weak)) void *__asan_region_is_poisoned(void *beg, size_t size) {
 // to avoid to call it on .text addresses
 static int area_is_valid(void *ptr, size_t len) {
 
-  void *ret_ptr = __asan_region_is_poisoned(ptr, len);
+  if (unlikely(__asan_region_is_poisoned(ptr, len))) { return 0; }
 
-  if (ret_ptr) {  // region is poisoned
+  long r = syscall(__afl_dummy_fd[1], SYS_write, ptr, len);
 
-    ssize_t ret_diff = ret_ptr - ptr;
-
-    if (ret_diff <= 0) {
-
-      return 0;
-
-    } else {
-
-      return ret_diff;  // only partially poisoned
-
-    }
-
-  }
-
-  int r = syscall(__afl_dummy_fd[1], SYS_write, ptr, len);
-
-  if (r <= 0) {  //  maybe this is going over an asan boundary
+  if (unlikely(r <= 0 || r > len)) {  // fail - maybe hitting asan boundary?
 
     char *p = (char *)ptr;
     long  page_size = sysconf(_SC_PAGE_SIZE);
     char *page = (char *)((uintptr_t)p & ~(page_size - 1)) + page_size;
-    if (page < p + len) { return 0; }
+    if (page < p + len) { return 0; }  // no isnt, return fail
     len -= (p + len - page);
     r = syscall(__afl_dummy_fd[1], SYS_write, p, len);
 
   }
 
   // partial writes - we return what was written.
-  if (r > 0) {
+  if (likely(r >= 0 && r <= len)) {
 
-    return r;
+    return (int)r;
 
   } else {
 
-- 
cgit 1.4.1


From bff02dae0d344cb51222b75840cc7f1a31ab03eb Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 10 Mar 2021 09:32:54 +0100
Subject: cmplog rtn rt fix

---
 instrumentation/afl-compiler-rt.o.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index ff14b966..74db7089 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1773,7 +1773,7 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
 
     if (__afl_cmp_map->headers[k].shape < len) {
 
-      __afl_cmp_map->headers[k].shape = len;
+      __afl_cmp_map->headers[k].shape = len - 1;
 
     }
 
-- 
cgit 1.4.1


From b2feada293b64f6148917399e728c9b19799edf9 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 10 Mar 2021 10:04:45 +0100
Subject: rt debug

---
 instrumentation/afl-compiler-rt.o.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 74db7089..7fd982ce 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -317,16 +317,18 @@ static void __afl_map_shm(void) {
 
   if (__afl_debug)
     fprintf(stderr,
-            "DEBUG: id_str %s, __afl_area_ptr %p, __afl_area_initial %p, "
-            "__afl_map_addr 0x%llx, MAP_SIZE %u, __afl_final_loc %u, "
+            "DEBUG: (1) id_str %s, __afl_area_ptr %p, __afl_area_initial %p, "
+            "__afl_area_ptr_dummy 0x%llx, __afl_map_addr 0x%llx, MAP_SIZE %u, "
+            "__afl_final_loc %u, "
             "max_size_forkserver %u/0x%x\n",
             id_str == NULL ? "<null>" : id_str, __afl_area_ptr,
-            __afl_area_initial, __afl_map_addr, MAP_SIZE, __afl_final_loc,
-            FS_OPT_MAX_MAPSIZE, FS_OPT_MAX_MAPSIZE);
+            __afl_area_initial, __afl_area_ptr_dummy, __afl_map_addr, MAP_SIZE,
+            __afl_final_loc, FS_OPT_MAX_MAPSIZE, FS_OPT_MAX_MAPSIZE);
 
   if (id_str) {
 
-    if (__afl_area_ptr && __afl_area_ptr != __afl_area_initial) {
+    if (__afl_area_ptr && __afl_area_ptr != __afl_area_initial &&
+        __afl_area_ptr != __afl_area_ptr_dummy) {
 
       if (__afl_map_addr) {
 
@@ -457,6 +459,17 @@ static void __afl_map_shm(void) {
 
     if (!__afl_area_ptr) { __afl_area_ptr = __afl_area_ptr_dummy; }
 
+    if (__afl_debug)
+      fprintf(stderr,
+              "DEBUG: (2) id_str %s, __afl_area_ptr %p, __afl_area_initial %p, "
+              "__afl_area_ptr_dummy 0x%llx, __afl_map_addr 0x%llx, MAP_SIZE "
+              "%u, __afl_final_loc %u, "
+              "max_size_forkserver %u/0x%x\n",
+              id_str == NULL ? "<null>" : id_str, __afl_area_ptr,
+              __afl_area_initial, __afl_area_ptr_dummy, __afl_map_addr,
+              MAP_SIZE, __afl_final_loc, FS_OPT_MAX_MAPSIZE,
+              FS_OPT_MAX_MAPSIZE);
+
   }
 
   __afl_area_ptr_backup = __afl_area_ptr;
-- 
cgit 1.4.1


From d678d59372494ab971429abceaa35b0fad2860ae Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 10 Mar 2021 10:07:54 +0100
Subject: fix

---
 instrumentation/afl-compiler-rt.o.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 7fd982ce..9480b90e 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -318,7 +318,7 @@ static void __afl_map_shm(void) {
   if (__afl_debug)
     fprintf(stderr,
             "DEBUG: (1) id_str %s, __afl_area_ptr %p, __afl_area_initial %p, "
-            "__afl_area_ptr_dummy 0x%llx, __afl_map_addr 0x%llx, MAP_SIZE %u, "
+            "__afl_area_ptr_dummy 0x%p, __afl_map_addr 0x%llx, MAP_SIZE %u, "
             "__afl_final_loc %u, "
             "max_size_forkserver %u/0x%x\n",
             id_str == NULL ? "<null>" : id_str, __afl_area_ptr,
@@ -462,7 +462,7 @@ static void __afl_map_shm(void) {
     if (__afl_debug)
       fprintf(stderr,
               "DEBUG: (2) id_str %s, __afl_area_ptr %p, __afl_area_initial %p, "
-              "__afl_area_ptr_dummy 0x%llx, __afl_map_addr 0x%llx, MAP_SIZE "
+              "__afl_area_ptr_dummy 0x%p, __afl_map_addr 0x%llx, MAP_SIZE "
               "%u, __afl_final_loc %u, "
               "max_size_forkserver %u/0x%x\n",
               id_str == NULL ? "<null>" : id_str, __afl_area_ptr,
-- 
cgit 1.4.1


From 69f3095045f4e60a9ef4b0ca0c5032ed824cd4f4 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 10 Mar 2021 10:40:52 +0100
Subject: correct debug

---
 instrumentation/afl-compiler-rt.o.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 9480b90e..71ef6c48 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -459,21 +459,20 @@ static void __afl_map_shm(void) {
 
     if (!__afl_area_ptr) { __afl_area_ptr = __afl_area_ptr_dummy; }
 
-    if (__afl_debug)
-      fprintf(stderr,
-              "DEBUG: (2) id_str %s, __afl_area_ptr %p, __afl_area_initial %p, "
-              "__afl_area_ptr_dummy 0x%p, __afl_map_addr 0x%llx, MAP_SIZE "
-              "%u, __afl_final_loc %u, "
-              "max_size_forkserver %u/0x%x\n",
-              id_str == NULL ? "<null>" : id_str, __afl_area_ptr,
-              __afl_area_initial, __afl_area_ptr_dummy, __afl_map_addr,
-              MAP_SIZE, __afl_final_loc, FS_OPT_MAX_MAPSIZE,
-              FS_OPT_MAX_MAPSIZE);
-
   }
 
   __afl_area_ptr_backup = __afl_area_ptr;
 
+  if (__afl_debug)
+    fprintf(stderr,
+            "DEBUG: (2) id_str %s, __afl_area_ptr %p, __afl_area_initial %p, "
+            "__afl_area_ptr_dummy 0x%p, __afl_map_addr 0x%llx, MAP_SIZE "
+            "%u, __afl_final_loc %u, "
+            "max_size_forkserver %u/0x%x\n",
+            id_str == NULL ? "<null>" : id_str, __afl_area_ptr,
+            __afl_area_initial, __afl_area_ptr_dummy, __afl_map_addr, MAP_SIZE,
+            __afl_final_loc, FS_OPT_MAX_MAPSIZE, FS_OPT_MAX_MAPSIZE);
+
   if (__afl_selective_coverage) {
 
     if (__afl_map_size > MAP_INITIAL_SIZE) {
-- 
cgit 1.4.1


From 071edb1a2ddcf787680ca5096ddc1d6e28addd0b Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 10 Mar 2021 15:44:54 +0100
Subject: brackets make dominik happy

---
 instrumentation/afl-compiler-rt.o.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 71ef6c48..cca38cd0 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -315,7 +315,8 @@ static void __afl_map_shm(void) {
      early-stage __afl_area_initial region that is needed to allow some really
      hacky .init code to work correctly in projects such as OpenSSL. */
 
-  if (__afl_debug)
+  if (__afl_debug) {
+
     fprintf(stderr,
             "DEBUG: (1) id_str %s, __afl_area_ptr %p, __afl_area_initial %p, "
             "__afl_area_ptr_dummy 0x%p, __afl_map_addr 0x%llx, MAP_SIZE %u, "
@@ -325,6 +326,8 @@ static void __afl_map_shm(void) {
             __afl_area_initial, __afl_area_ptr_dummy, __afl_map_addr, MAP_SIZE,
             __afl_final_loc, FS_OPT_MAX_MAPSIZE, FS_OPT_MAX_MAPSIZE);
 
+  }
+
   if (id_str) {
 
     if (__afl_area_ptr && __afl_area_ptr != __afl_area_initial &&
@@ -463,7 +466,8 @@ static void __afl_map_shm(void) {
 
   __afl_area_ptr_backup = __afl_area_ptr;
 
-  if (__afl_debug)
+  if (__afl_debug) {
+
     fprintf(stderr,
             "DEBUG: (2) id_str %s, __afl_area_ptr %p, __afl_area_initial %p, "
             "__afl_area_ptr_dummy 0x%p, __afl_map_addr 0x%llx, MAP_SIZE "
@@ -473,6 +477,8 @@ static void __afl_map_shm(void) {
             __afl_area_initial, __afl_area_ptr_dummy, __afl_map_addr, MAP_SIZE,
             __afl_final_loc, FS_OPT_MAX_MAPSIZE, FS_OPT_MAX_MAPSIZE);
 
+  }
+
   if (__afl_selective_coverage) {
 
     if (__afl_map_size > MAP_INITIAL_SIZE) {
@@ -1111,11 +1117,14 @@ void __afl_manual_init(void) {
     __afl_sharedmem_fuzzing = 0;
     if (__afl_area_ptr == NULL) __afl_area_ptr = __afl_area_ptr_dummy;
 
-    if (__afl_debug)
+    if (__afl_debug) {
+
       fprintf(stderr,
               "DEBUG: disabled instrumentation because of "
               "AFL_DISABLE_LLVM_INSTRUMENTATION\n");
 
+    }
+
   }
 
   if (!init_done) {
@@ -1299,8 +1308,12 @@ void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) {
   if (__afl_already_initialized_forkserver &&
       __afl_final_loc + 1 + stop - start > __afl_map_size) {
 
-    if (__afl_debug)
-      fprintf(stderr, "Warning: new instrumneted code after the forkserver!\n");
+    if (__afl_debug) {
+
+      fprintf(stderr, "Warning: new instrumented code after the forkserver!\n");
+
+    }
+
     __afl_final_loc = 2;
 
     if (1 + stop - start > __afl_map_size) {
-- 
cgit 1.4.1


From 862cb3217f5983e5cfff6568f6b31fcf1e960802 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 16 Mar 2021 14:38:13 +0100
Subject: fix cmplog rtn

---
 include/envs.h                      |  1 +
 instrumentation/afl-compiler-rt.o.c | 10 +++++-----
 src/afl-common.c                    |  6 ++++--
 utils/aflpp_driver/aflpp_driver.c   | 10 ++++++++++
 4 files changed, 20 insertions(+), 7 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/include/envs.h b/include/envs.h
index e92bee2a..cfd73b68 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -50,6 +50,7 @@ static char *afl_environment_variables[] = {
     "AFL_FAST_CAL",
     "AFL_FORCE_UI",
     "AFL_FUZZER_ARGS",  // oss-fuzz
+    "AFL_GDB",
     "AFL_GCC_ALLOWLIST",
     "AFL_GCC_DENYLIST",
     "AFL_GCC_BLOCKLIST",
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index cca38cd0..32dbc53d 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1730,18 +1730,18 @@ __attribute__((weak)) void *__asan_region_is_poisoned(void *beg, size_t size) {
 // to avoid to call it on .text addresses
 static int area_is_valid(void *ptr, size_t len) {
 
-  if (unlikely(__asan_region_is_poisoned(ptr, len))) { return 0; }
+  if (unlikely(!ptr || __asan_region_is_poisoned(ptr, len))) { return 0; }
 
-  long r = syscall(__afl_dummy_fd[1], SYS_write, ptr, len);
+  long r = syscall(SYS_write, __afl_dummy_fd[1], ptr, len);
 
   if (unlikely(r <= 0 || r > len)) {  // fail - maybe hitting asan boundary?
 
     char *p = (char *)ptr;
     long  page_size = sysconf(_SC_PAGE_SIZE);
     char *page = (char *)((uintptr_t)p & ~(page_size - 1)) + page_size;
-    if (page < p + len) { return 0; }  // no isnt, return fail
-    len -= (p + len - page);
-    r = syscall(__afl_dummy_fd[1], SYS_write, p, len);
+    if (page >= p + len) { return 0; }  // no isnt, return fail
+    len = page - p - len;
+    r = syscall(SYS_write, __afl_dummy_fd[1], p, len);
 
   }
 
diff --git a/src/afl-common.c b/src/afl-common.c
index bfb05a67..27b63434 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -150,10 +150,12 @@ void argv_cpy_free(char **argv) {
 char **get_qemu_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
 
   if (unlikely(getenv("AFL_QEMU_CUSTOM_BIN"))) {
+
     WARNF(
-      "AFL_QEMU_CUSTOM_BIN is enabled. "
-      "You must run your target under afl-qemu-trace on your own!");
+        "AFL_QEMU_CUSTOM_BIN is enabled. "
+        "You must run your target under afl-qemu-trace on your own!");
     return argv;
+
   }
 
   if (!unlikely(own_loc)) { FATAL("BUG: param own_loc is NULL"); }
diff --git a/utils/aflpp_driver/aflpp_driver.c b/utils/aflpp_driver/aflpp_driver.c
index 9c97607c..f0f3a47d 100644
--- a/utils/aflpp_driver/aflpp_driver.c
+++ b/utils/aflpp_driver/aflpp_driver.c
@@ -208,6 +208,16 @@ int main(int argc, char **argv) {
       "======================================================\n",
       argv[0], argv[0]);
 
+  if (getenv("AFL_GDB")) {
+
+    char cmd[64];
+    snprintf(cmd, sizeof(cmd), "cat /proc/%d/maps", getpid());
+    system(cmd);
+    fprintf(stderr, "DEBUG: aflpp_driver pid is %d\n", getpid());
+    sleep(1);
+
+  }
+
   output_file = stderr;
   maybe_duplicate_stderr();
   maybe_close_fd_mask();
-- 
cgit 1.4.1


From 1227776251390956fb9bfb46b20373c3b70932e5 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 16 Mar 2021 14:39:48 +0100
Subject: fix cmplog

---
 instrumentation/afl-compiler-rt.o.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 32dbc53d..50b4e2c5 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1741,7 +1741,7 @@ static int area_is_valid(void *ptr, size_t len) {
     char *page = (char *)((uintptr_t)p & ~(page_size - 1)) + page_size;
     if (page >= p + len) { return 0; }  // no isnt, return fail
     len = page - p - len;
-    r = syscall(SYS_write, __afl_dummy_fd[1], p, len);
+    r = syscall(SYS_write, __afl_dummy_fd[1], page, len);
 
   }
 
-- 
cgit 1.4.1


From f5420e737a1ed1dbeb81783836d0449c06aa0fcc Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 16 Mar 2021 16:15:29 +0100
Subject: rtn fix

---
 docs/Changelog.md                   |  2 +-
 instrumentation/afl-compiler-rt.o.c | 23 ++++++++++++-----------
 qemu_mode/qemuafl                   |  2 +-
 3 files changed, 14 insertions(+), 13 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 8222f942..9aea3638 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -9,7 +9,7 @@ Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 ### Version ++3.12a (dev)
-  - ...
+  - fix cmplog rtn (rare crash and not being able to gather ptr data)
 
 
 ### Version ++3.11c (release)
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 50b4e2c5..892118fb 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1734,25 +1734,26 @@ static int area_is_valid(void *ptr, size_t len) {
 
   long r = syscall(SYS_write, __afl_dummy_fd[1], ptr, len);
 
-  if (unlikely(r <= 0 || r > len)) {  // fail - maybe hitting asan boundary?
+  if (r <= 0 || r > len) return 0;
 
-    char *p = (char *)ptr;
-    long  page_size = sysconf(_SC_PAGE_SIZE);
-    char *page = (char *)((uintptr_t)p & ~(page_size - 1)) + page_size;
-    if (page >= p + len) { return 0; }  // no isnt, return fail
-    len = page - p - len;
-    r = syscall(SYS_write, __afl_dummy_fd[1], page, len);
+  // even if the write succeed this can be a false positive if we cross
+  // a page boundary. who knows why.
 
-  }
+  char *p = (char *)ptr;
+  long  page_size = sysconf(_SC_PAGE_SIZE);
+  char *page = (char *)((uintptr_t)p & ~(page_size - 1)) + page_size;
 
-  // partial writes - we return what was written.
-  if (likely(r >= 0 && r <= len)) {
+  if (page > p + len) {
 
+    // no, not crossing a page boundary
     return (int)r;
 
   } else {
 
-    return 0;
+    // yes it crosses a boundary, hence we can only return the length of
+    // rest of the first page, we cannot detect if the next page is valid
+    // or not, neither by SYS_write nor msync() :-(
+    return (int)(page - p);
 
   }
 
diff --git a/qemu_mode/qemuafl b/qemu_mode/qemuafl
index 0fb212da..d1ca56b8 160000
--- a/qemu_mode/qemuafl
+++ b/qemu_mode/qemuafl
@@ -1 +1 @@
-Subproject commit 0fb212daab492411b3e323bc18a3074c1aecfd37
+Subproject commit d1ca56b84e78f821406eef28d836918edfc8d610
-- 
cgit 1.4.1


From 65b90001f6e731f22178cb592b9812639bff4cb5 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 16 Mar 2021 23:24:34 +0100
Subject: debug

---
 instrumentation/afl-compiler-rt.o.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 892118fb..3bd019ac 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1774,12 +1774,14 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
   */
 
   if (unlikely(!__afl_cmp_map)) return;
+  fprintf(stderr, "RTN1 %p %p\n", ptr1, ptr2);
   int l1, l2;
   if ((l1 = area_is_valid(ptr1, 32)) <= 0 ||
       (l2 = area_is_valid(ptr2, 32)) <= 0)
     return;
   int len = MIN(l1, l2);
 
+  fprintf(stderr, "RTN2 %u\n", len);
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
@@ -1810,6 +1812,7 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
                    ptr1, len);
   __builtin_memcpy(((struct cmpfn_operands *)__afl_cmp_map->log[k])[hits].v1,
                    ptr2, len);
+  fprintf(stderr, "RTN3\n");
 
 }
 
-- 
cgit 1.4.1


From f36341b3b48061ad8ec191efbf0fdc6801f5ba11 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 17 Mar 2021 02:00:14 +0100
Subject: when you think you work on a debug branch but it is dev. git sucks so
 much ...

---
 instrumentation/afl-compiler-rt.o.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 3bd019ac..70148b78 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1774,14 +1774,14 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
   */
 
   if (unlikely(!__afl_cmp_map)) return;
-  fprintf(stderr, "RTN1 %p %p\n", ptr1, ptr2);
+  //fprintf(stderr, "RTN1 %p %p\n", ptr1, ptr2);
   int l1, l2;
   if ((l1 = area_is_valid(ptr1, 32)) <= 0 ||
       (l2 = area_is_valid(ptr2, 32)) <= 0)
     return;
   int len = MIN(l1, l2);
 
-  fprintf(stderr, "RTN2 %u\n", len);
+  //fprintf(stderr, "RTN2 %u\n", len);
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
@@ -1812,7 +1812,7 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
                    ptr1, len);
   __builtin_memcpy(((struct cmpfn_operands *)__afl_cmp_map->log[k])[hits].v1,
                    ptr2, len);
-  fprintf(stderr, "RTN3\n");
+  //fprintf(stderr, "RTN3\n");
 
 }
 
-- 
cgit 1.4.1


From 5e2a5f1110e29c36f1c41fb4677ab698c5d571c0 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 17 Mar 2021 10:26:02 +0100
Subject: shmem map size in config.h

---
 include/config.h                    |  9 ++++++
 instrumentation/afl-compiler-rt.o.c |  6 ++--
 src/afl-cc.c                        | 62 ++++++++++++++++++-------------------
 src/afl-common.c                    |  2 +-
 src/afl-fuzz.c                      | 24 +++++++++-----
 5 files changed, 60 insertions(+), 43 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/include/config.h b/include/config.h
index b049fee0..29225f6b 100644
--- a/include/config.h
+++ b/include/config.h
@@ -34,6 +34,15 @@
  *                                                    *
  ******************************************************/
 
+/* Default shared memory map size. Most targets just need a coverage map
+   between 20-250kb. Plus there is an auto-detection feature in afl-fuzz.
+   However if a target has problematic constructors and init arrays then
+   this can fail. Hence afl-fuzz deploys a larger default map. The largest
+   map seen so far is the xlsx fuzzer for libreoffice which is 5MB.
+   At runtime this value can be overriden via AFL_MAP_SIZE.
+   Default: 8MB (defined in bytes) */
+#define DEFAULT_SHMEM_SIZE (8 * 1024 * 1024)
+
 /* CMPLOG/REDQUEEN TUNING
  *
  * Here you can modify tuning and solving options for CMPLOG.
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 70148b78..c635ae63 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1774,14 +1774,14 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
   */
 
   if (unlikely(!__afl_cmp_map)) return;
-  //fprintf(stderr, "RTN1 %p %p\n", ptr1, ptr2);
+  // fprintf(stderr, "RTN1 %p %p\n", ptr1, ptr2);
   int l1, l2;
   if ((l1 = area_is_valid(ptr1, 32)) <= 0 ||
       (l2 = area_is_valid(ptr2, 32)) <= 0)
     return;
   int len = MIN(l1, l2);
 
-  //fprintf(stderr, "RTN2 %u\n", len);
+  // fprintf(stderr, "RTN2 %u\n", len);
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
   k &= CMP_MAP_W - 1;
@@ -1812,7 +1812,7 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
                    ptr1, len);
   __builtin_memcpy(((struct cmpfn_operands *)__afl_cmp_map->log[k])[hits].v1,
                    ptr2, len);
-  //fprintf(stderr, "RTN3\n");
+  // fprintf(stderr, "RTN3\n");
 
 }
 
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 206066fd..ebbd390c 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -959,63 +959,63 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   if (compiler_mode != GCC && compiler_mode != CLANG) {
 
-      switch (bit_mode) {
+    switch (bit_mode) {
 
-        case 0:
-          if (!shared_linking)
+      case 0:
+        if (!shared_linking)
           cc_params[cc_par_cnt++] =
               alloc_printf("%s/afl-compiler-rt.o", obj_path);
-          if (lto_mode)
-            cc_params[cc_par_cnt++] =
-                alloc_printf("%s/afl-llvm-rt-lto.o", obj_path);
-          break;
+        if (lto_mode)
+          cc_params[cc_par_cnt++] =
+              alloc_printf("%s/afl-llvm-rt-lto.o", obj_path);
+        break;
 
-        case 32:
-          if (!shared_linking)
+      case 32:
+        if (!shared_linking)
           cc_params[cc_par_cnt++] =
               alloc_printf("%s/afl-compiler-rt-32.o", obj_path);
+        if (access(cc_params[cc_par_cnt - 1], R_OK))
+          FATAL("-m32 is not supported by your compiler");
+        if (lto_mode) {
+
+          cc_params[cc_par_cnt++] =
+              alloc_printf("%s/afl-llvm-rt-lto-32.o", obj_path);
           if (access(cc_params[cc_par_cnt - 1], R_OK))
             FATAL("-m32 is not supported by your compiler");
-          if (lto_mode) {
-
-            cc_params[cc_par_cnt++] =
-                alloc_printf("%s/afl-llvm-rt-lto-32.o", obj_path);
-            if (access(cc_params[cc_par_cnt - 1], R_OK))
-              FATAL("-m32 is not supported by your compiler");
 
-          }
+        }
 
-          break;
+        break;
 
-        case 64:
-          if (!shared_linking)
+      case 64:
+        if (!shared_linking)
           cc_params[cc_par_cnt++] =
               alloc_printf("%s/afl-compiler-rt-64.o", obj_path);
+        if (access(cc_params[cc_par_cnt - 1], R_OK))
+          FATAL("-m64 is not supported by your compiler");
+        if (lto_mode) {
+
+          cc_params[cc_par_cnt++] =
+              alloc_printf("%s/afl-llvm-rt-lto-64.o", obj_path);
           if (access(cc_params[cc_par_cnt - 1], R_OK))
             FATAL("-m64 is not supported by your compiler");
-          if (lto_mode) {
 
-            cc_params[cc_par_cnt++] =
-                alloc_printf("%s/afl-llvm-rt-lto-64.o", obj_path);
-            if (access(cc_params[cc_par_cnt - 1], R_OK))
-              FATAL("-m64 is not supported by your compiler");
-
-          }
+        }
 
-          break;
+        break;
 
-      }
+    }
 
   #if !defined(__APPLE__) && !defined(__sun)
-          if (!shared_linking)
+    if (!shared_linking)
       cc_params[cc_par_cnt++] =
           alloc_printf("-Wl,--dynamic-list=%s/dynamic_list.txt", obj_path);
   #endif
 
-    }
+  }
 
   #if defined(USEMMAP) && !defined(__HAIKU__)
-    cc_params[cc_par_cnt++] = "-lrt";
+  cc_params[cc_par_cnt++] = "-lrt";
   #endif
 
 #endif
diff --git a/src/afl-common.c b/src/afl-common.c
index 27b63434..7e56ce3f 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -1072,7 +1072,7 @@ u8 *u_stringify_time_diff(u8 *buf, u64 cur_ms, u64 event_ms) {
 /* Reads the map size from ENV */
 u32 get_map_size(void) {
 
-  uint32_t map_size = 8000000;  // a very large default map
+  uint32_t map_size = DEFAULT_SHMEM_SIZE;
   char *   ptr;
 
   if ((ptr = getenv("AFL_MAP_SIZE")) || (ptr = getenv("AFL_MAPSIZE"))) {
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 2fde561c..8318a92e 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1527,11 +1527,13 @@ int main(int argc, char **argv_orig, char **envp) {
   if (!afl->non_instrumented_mode && !afl->fsrv.qemu_mode &&
       !afl->unicorn_mode) {
 
-    if (map_size <= 8000000 && !afl->non_instrumented_mode &&
+    if (map_size <= DEFAULT_SHMEM_SIZE && !afl->non_instrumented_mode &&
         !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
 
-      afl->fsrv.map_size = 8000000;  // dummy temporary value
-      setenv("AFL_MAP_SIZE", "8000000", 1);
+      afl->fsrv.map_size = DEFAULT_SHMEM_SIZE;  // dummy temporary value
+      char vbuf[16];
+      snprintf(vbuf, sizeof(vbuf), "%u", DEFAULT_SHMEM_SIZE);
+      setenv("AFL_MAP_SIZE", vbuf, 1);
 
     }
 
@@ -1582,11 +1584,13 @@ int main(int argc, char **argv_orig, char **envp) {
     afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
     afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
 
-    if (map_size <= 8000000 && !afl->non_instrumented_mode &&
+    if (map_size <= DEFAULT_SHMEM_SIZE && !afl->non_instrumented_mode &&
         !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
 
-      afl->cmplog_fsrv.map_size = 8000000;  // dummy temporary value
-      setenv("AFL_MAP_SIZE", "8000000", 1);
+      afl->fsrv.map_size = DEFAULT_SHMEM_SIZE;  // dummy temporary value
+      char vbuf[16];
+      snprintf(vbuf, sizeof(vbuf), "%u", DEFAULT_SHMEM_SIZE);
+      setenv("AFL_MAP_SIZE", vbuf, 1);
 
     }
 
@@ -1634,8 +1638,12 @@ int main(int argc, char **argv_orig, char **envp) {
   }
 
   if (afl->debug) {
-  printf("NORMAL %u, CMPLOG %u\n", afl->fsrv.map_size, afl->cmplog_fsrv.map_size);
-  fprintf(stderr, "NORMAL %u, CMPLOG %u\n", afl->fsrv.map_size, afl->cmplog_fsrv.map_size);
+
+    printf("NORMAL %u, CMPLOG %u\n", afl->fsrv.map_size,
+           afl->cmplog_fsrv.map_size);
+    fprintf(stderr, "NORMAL %u, CMPLOG %u\n", afl->fsrv.map_size,
+            afl->cmplog_fsrv.map_size);
+
   }
 
   load_auto(afl);
-- 
cgit 1.4.1


From 00913bce813255ebcb7e5e174513a95d126ae9ed Mon Sep 17 00:00:00 2001
From: Andrea Fioraldi <andreafioraldi@gmail.com>
Date: Fri, 19 Mar 2021 09:56:00 +0100
Subject: update dynamic list with cmplog

---
 dynamic_list.txt                    | 21 +++++++++++++++++++++
 instrumentation/afl-compiler-rt.o.c |  5 +++++
 2 files changed, 26 insertions(+)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/dynamic_list.txt b/dynamic_list.txt
index 4b92d154..f0e54d92 100644
--- a/dynamic_list.txt
+++ b/dynamic_list.txt
@@ -23,4 +23,25 @@
   "__afl_fuzz_ptr";
   "__sanitizer_cov_trace_pc_guard";
   "__sanitizer_cov_trace_pc_guard_init";
+  "__cmplog_ins_hook1";
+  "__cmplog_ins_hook2";
+  "__cmplog_ins_hook4";
+  "__cmplog_ins_hookN";
+  "__cmplog_ins_hook16";
+  "__sanitizer_cov_trace_cmp1";
+  "__sanitizer_cov_trace_const_cmp1";
+  "__sanitizer_cov_trace_cmp2";
+  "__sanitizer_cov_trace_const_cmp2";
+  "__sanitizer_cov_trace_cmp4";
+  "__sanitizer_cov_trace_const_cmp4";
+  "__sanitizer_cov_trace_cmp8";
+  "__sanitizer_cov_trace_const_cmp8";
+  "__sanitizer_cov_trace_cmp16";
+  "__sanitizer_cov_trace_const_cmp16";
+  "__sanitizer_cov_trace_switch";
+  "__cmplog_rtn_hook";
+  "__cmplog_rtn_gcc_stdstring_cstring";
+  "__cmplog_rtn_gcc_stdstring_stdstring";
+  "__cmplog_rtn_llvm_stdstring_cstring";
+  "__cmplog_rtn_llvm_stdstring_stdstring";
 };
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index c635ae63..bee03ddc 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1676,6 +1676,11 @@ void __sanitizer_cov_trace_cmp16(uint128_t arg1, uint128_t arg2) {
 
 }
 
+void __sanitizer_cov_trace_const_cmp16(uint128_t arg1, uint128_t arg2) {
+
+  __cmplog_ins_hook16(arg1, arg2, 0);
+
+}
 #endif
 
 void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
-- 
cgit 1.4.1


From 2102264acf5c271b7560a82771b3af8136af9354 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Fri, 19 Mar 2021 16:06:06 +0100
Subject: fix for new llvm 13 change

---
 docs/Changelog.md                              |  4 +++
 instrumentation/README.lto.md                  |  2 +-
 instrumentation/SanitizerCoverageLTO.so.cc     |  7 ++++
 instrumentation/SanitizerCoveragePCGUARD.so.cc |  8 +++++
 instrumentation/afl-compiler-rt.o.c            |  1 +
 instrumentation/afl-llvm-common.cc             | 18 +++-------
 test-instr.c                                   |  2 +-
 test/test-dlopen.c                             | 16 +++++----
 test/travis/bionic/Dockerfile                  | 45 -----------------------
 test/travis/focal/Dockerfile                   | 45 -----------------------
 test/travis/trusty/Dockerfile                  | 49 --------------------------
 test/travis/xenial/Dockerfile                  | 46 ------------------------
 12 files changed, 36 insertions(+), 207 deletions(-)
 delete mode 100644 test/travis/bionic/Dockerfile
 delete mode 100644 test/travis/focal/Dockerfile
 delete mode 100644 test/travis/trusty/Dockerfile
 delete mode 100644 test/travis/xenial/Dockerfile

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 8dc218af..166393cb 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -9,6 +9,8 @@ Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 ### Version ++3.12a (dev)
+  - afl-fuzz:
+    - better map detection, AFL_MAP_SIZE not needed anymore for most cases
   - afl-cc:
     - fix cmplog rtn (rare crash and not being able to gather ptr data)
     - link runtime not to shared libs
@@ -16,6 +18,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
   - qemu_mode (thanks @realmadsci):
     - move AFL_PRELOAD and AFL_USE_QASAN logic inside afl-qemu-trace
     - add AFL_QEMU_CUSTOM_BIN
+  - unicorn_mode
+    - accidently removed the subfolder from github, re-added
 
 ### Version ++3.11c (release)
   - afl-fuzz:
diff --git a/instrumentation/README.lto.md b/instrumentation/README.lto.md
index 81c82c4b..39f6465a 100644
--- a/instrumentation/README.lto.md
+++ b/instrumentation/README.lto.md
@@ -113,7 +113,7 @@ cmake \
     -DLLVM_LINK_LLVM_DYLIB="ON" \
     -DLLVM_TARGETS_TO_BUILD="host" \
     ../llvm/
-cmake --build . --parallel
+cmake --build . -j4
 export PATH="$(pwd)/bin:$PATH"
 export LLVM_CONFIG="$(pwd)/bin/llvm-config"
 export LD_LIBRARY_PATH="$(llvm-config --libdir)${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
diff --git a/instrumentation/SanitizerCoverageLTO.so.cc b/instrumentation/SanitizerCoverageLTO.so.cc
index 13a5e5fd..28d905a3 100644
--- a/instrumentation/SanitizerCoverageLTO.so.cc
+++ b/instrumentation/SanitizerCoverageLTO.so.cc
@@ -1291,10 +1291,17 @@ GlobalVariable *ModuleSanitizerCoverage::CreateFunctionLocalArrayInSection(
       *CurModule, ArrayTy, false, GlobalVariable::PrivateLinkage,
       Constant::getNullValue(ArrayTy), "__sancov_gen_");
 
+#if LLVM_VERSION_MAJOR > 12
+  if (TargetTriple.supportsCOMDAT() &&
+      (TargetTriple.isOSBinFormatELF() || !F.isInterposable()))
+    if (auto Comdat = getOrCreateFunctionComdat(F, TargetTriple))
+      Array->setComdat(Comdat);
+#else
   if (TargetTriple.supportsCOMDAT() && !F.isInterposable())
     if (auto Comdat =
             GetOrCreateFunctionComdat(F, TargetTriple, CurModuleUniqueId))
       Array->setComdat(Comdat);
+#endif
   Array->setSection(getSectionName(Section));
   Array->setAlignment(Align(DL->getTypeStoreSize(Ty).getFixedSize()));
   GlobalsToAppendToUsed.push_back(Array);
diff --git a/instrumentation/SanitizerCoveragePCGUARD.so.cc b/instrumentation/SanitizerCoveragePCGUARD.so.cc
index 0b6e274a..99ead3d6 100644
--- a/instrumentation/SanitizerCoveragePCGUARD.so.cc
+++ b/instrumentation/SanitizerCoveragePCGUARD.so.cc
@@ -769,10 +769,18 @@ GlobalVariable *ModuleSanitizerCoverage::CreateFunctionLocalArrayInSection(
       *CurModule, ArrayTy, false, GlobalVariable::PrivateLinkage,
       Constant::getNullValue(ArrayTy), "__sancov_gen_");
 
+#if LLVM_VERSION_MAJOR > 12
+  if (TargetTriple.supportsCOMDAT() &&
+      (TargetTriple.isOSBinFormatELF() || !F.isInterposable()))
+    if (auto Comdat = getOrCreateFunctionComdat(F, TargetTriple))
+      Array->setComdat(Comdat);
+#else
   if (TargetTriple.supportsCOMDAT() && !F.isInterposable())
     if (auto Comdat =
             GetOrCreateFunctionComdat(F, TargetTriple, CurModuleUniqueId))
       Array->setComdat(Comdat);
+#endif
+
   Array->setSection(getSectionName(Section));
 #if LLVM_MAJOR > 10 || (LLVM_MAJOR == 10 && LLVM_MINOR > 0)
   Array->setAlignment(Align(DL->getTypeStoreSize(Ty).getFixedSize()));
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index bee03ddc..ab1bfb31 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1681,6 +1681,7 @@ void __sanitizer_cov_trace_const_cmp16(uint128_t arg1, uint128_t arg2) {
   __cmplog_ins_hook16(arg1, arg2, 0);
 
 }
+
 #endif
 
 void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
diff --git a/instrumentation/afl-llvm-common.cc b/instrumentation/afl-llvm-common.cc
index 17780143..74943fb2 100644
--- a/instrumentation/afl-llvm-common.cc
+++ b/instrumentation/afl-llvm-common.cc
@@ -96,19 +96,11 @@ bool isIgnoreFunction(const llvm::Function *F) {
 
   static const char *ignoreSubstringList[] = {
 
-      "__asan",
-      "__msan",
-      "__ubsan",
-      "__lsan",
-      "__san",
-      "__sanitize",
-      "__cxx",
-      "_GLOBAL__",
-      "DebugCounter",
-      "DwarfDebug",
-      "DebugLoc"
-
- };
+      "__asan",       "__msan",     "__ubsan", "__lsan",
+      "__san",        "__sanitize", "__cxx",   "_GLOBAL__",
+      "DebugCounter", "DwarfDebug", "DebugLoc"
+
+  };
 
   for (auto const &ignoreListFunc : ignoreSubstringList) {
 
diff --git a/test-instr.c b/test-instr.c
index 4129a5b4..13d4eb93 100644
--- a/test-instr.c
+++ b/test-instr.c
@@ -19,7 +19,7 @@
 #include <fcntl.h>
 
 #ifdef TEST_SHARED_OBJECT
-#define main main_exported
+  #define main main_exported
 #endif
 
 int main(int argc, char **argv) {
diff --git a/test/test-dlopen.c b/test/test-dlopen.c
index 3db6adba..d08d9092 100644
--- a/test/test-dlopen.c
+++ b/test/test-dlopen.c
@@ -5,17 +5,19 @@
 
 int main(int argc, char **argv) {
 
-  if (!getenv("TEST_DLOPEN_TARGET"))
-    return 1;
-  void* lib = dlopen(getenv("TEST_DLOPEN_TARGET"), RTLD_LAZY);
+  if (!getenv("TEST_DLOPEN_TARGET")) return 1;
+  void *lib = dlopen(getenv("TEST_DLOPEN_TARGET"), RTLD_LAZY);
   if (!lib) {
+
     perror(dlerror());
     return 2;
+
   }
-  int (*func)(int, char**) = dlsym(lib, "main_exported");
-  if (!func)
-    return 3;
-  
+
+  int (*func)(int, char **) = dlsym(lib, "main_exported");
+  if (!func) return 3;
+
   return func(argc, argv);
 
 }
+
diff --git a/test/travis/bionic/Dockerfile b/test/travis/bionic/Dockerfile
deleted file mode 100644
index 00ab96f9..00000000
--- a/test/travis/bionic/Dockerfile
+++ /dev/null
@@ -1,45 +0,0 @@
-# This is the Dockerfile for testing problems in Travis build
-# configuration #1.
-# This needs not to be rebuild everytime, most of the time it needs just to
-# be build once and then started when debugging issues and execute:
-#   cd /AFLplusplus/
-#   git pull
-#   make distrib
-#
-FROM ubuntu:bionic
-LABEL "about"="travis image 1"
-RUN apt-get update && apt-get -y install \
-    automake \
-    bison \
-    build-essential \
-    clang \
-    flex \
-    git \
-    python3.7 python3.7-dev \
-    python3-setuptools \
-    libtool libtool-bin \
-    libglib2.0-dev \
-    python-setuptools \
-    wget \
-    ca-certificates \
-    libpixman-1-dev \
-    gcc-7 gcc-7-plugin-dev libc++-7-dev \
-    findutils \
-    libcmocka-dev \
-    joe nano vim locate \
-    && rm -rf /var/lib/apt/lists/*
-
-ENV AFL_NO_UI=1
-ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
-ENV LLVM_CONFIG=llvm-config-6.0
-
-RUN cd / && \
-    git clone https://github.com/AFLplusplus/AFLplusplus && \
-    cd AFLplusplus && \
-    git checkout dev && \
-    cd qemu_mode && wget http://download.qemu-project.org/qemu-3.1.1.tar.xz && \
-    cd ../unicorn_mode && git submodule init && git submodule update || true && \
-    cd /AFLplusplus && ASAN_BUILD=1 make source-only || true
-
-WORKDIR /AFLplusplus
-CMD ["/bin/bash"]
diff --git a/test/travis/focal/Dockerfile b/test/travis/focal/Dockerfile
deleted file mode 100644
index 27d994f2..00000000
--- a/test/travis/focal/Dockerfile
+++ /dev/null
@@ -1,45 +0,0 @@
-# This is the Dockerfile for testing problems in Travis build
-# configuration #1.
-# This needs not to be rebuild everytime, most of the time it needs just to
-# be build once and then started when debugging issues and execute:
-#   cd /AFLplusplus/
-#   git pull
-#   make distrib
-#
-FROM ubuntu:focal
-LABEL "about"="travis image 4"
-ARG DEBIAN_FRONTEND=noninteractive
-RUN apt-get update && apt-get -y install \
-    automake \
-    bison \
-    build-essential \
-    clang \
-    flex \
-    git \
-    python3 python3-dev \
-    python3-setuptools \
-    libtool libtool-bin \
-    libglib2.0-dev \
-    python-setuptools \
-    wget \
-    ca-certificates \
-    libpixman-1-dev \
-    gcc-9 gcc-9-plugin-dev libc++-9-dev \
-    findutils \
-    libcmocka-dev \
-    joe nano vim locate \
-    && rm -rf /var/lib/apt/lists/*
-
-ENV AFL_NO_UI=1
-ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
-
-RUN cd / && \
-    git clone https://github.com/AFLplusplus/AFLplusplus && \
-    cd AFLplusplus && \
-    git checkout dev && \
-    cd qemu_mode && wget http://download.qemu-project.org/qemu-3.1.1.tar.xz && \
-    cd ../unicorn_mode && git submodule init && git submodule update || true && \
-    cd /AFLplusplus && ASAN_BUILD=1 make source-only || true
-
-WORKDIR /AFLplusplus
-CMD ["/bin/bash"]
diff --git a/test/travis/trusty/Dockerfile b/test/travis/trusty/Dockerfile
deleted file mode 100644
index 0a6f1804..00000000
--- a/test/travis/trusty/Dockerfile
+++ /dev/null
@@ -1,49 +0,0 @@
-# This is the Dockerfile for testing problems in Travis builds
-# configuration #3.
-# This needs not to be rebuild everytime, most of the time it needs just to
-# be build once and then started when debugging issues and execute:
-#   cd /AFLplusplus/
-#   git pull
-#   make distrib
-#
-FROM ubuntu:trusty
-LABEL "about"="travis image 3"
-RUN apt-get update && apt-get -y install \
-    automake \
-    bison \
-    build-essential \
-    clang \
-    flex \
-    git \
-    python2.7 python2.7-dev \
-    python3-setuptools \
-    libtool \
-    libglib2.0-dev \
-    python-setuptools \
-    wget \
-    ca-certificates \
-    libpixman-1-dev \
-    gcc-4.8 gcc-4.8-plugin-dev \
-    libc++-dev \
-    findutils \
-    libcmocka-dev \
-    joe nano vim locate \
-    && rm -rf /var/lib/apt/lists/*
-
-ENV TERM linux
-ENV DEBIAN_FRONTEND noninteractive
-ENV LLVM_CONFIG=llvm-config-3.4
-ENV AFL_NO_UI=1
-ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
-
-RUN cd / && \
-    git clone https://github.com/AFLplusplus/AFLplusplus && \
-    cd AFLplusplus && \
-    git checkout dev && \
-    cd qemu_mode && wget http://download.qemu-project.org/qemu-3.1.1.tar.xz && \
-    cd ../unicorn_mode && git submodule init && git submodule update || true && \
-    cd /AFLplusplus && ASAN_BUILD=1 make source-only || true
-
-WORKDIR /AFLplusplus
-CMD ["/bin/bash"]
-
diff --git a/test/travis/xenial/Dockerfile b/test/travis/xenial/Dockerfile
deleted file mode 100644
index 6aa4b1d1..00000000
--- a/test/travis/xenial/Dockerfile
+++ /dev/null
@@ -1,46 +0,0 @@
-# This is the Dockerfile for testing problems in Travis builds
-# configuration #2.
-# This needs not to be rebuild everytime, most of the time it needs just to
-# be build once and then started when debugging issues and execute:
-#   cd /AFLplusplus/
-#   git pull
-#   make distrib
-#
-FROM ubuntu:xenial
-LABEL "about"="travis image 2"
-RUN apt-get update && apt-get -y install \
-    automake \
-    bison \
-    build-essential \
-    clang-6.0 \
-    flex \
-    git \
-    python3 python3-dev \
-    python3-setuptools \
-    libtool libtool-bin \
-    libglib2.0-dev \
-    python-setuptools \
-    wget \
-    ca-certificates \
-    libpixman-1-dev \
-    gcc-5 gcc-5-plugin-dev \
-    libc++-dev \
-    findutils \
-    libcmocka-dev \
-    joe nano vim locate \
-    && rm -rf /var/lib/apt/lists/*
-
-ENV LLVM_CONFIG=llvm-config-6.0
-ENV AFL_NO_UI=1
-ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
-
-RUN cd / && \
-    git clone https://github.com/AFLplusplus/AFLplusplus && \
-    cd AFLplusplus && \
-    git checkout dev && \
-    cd qemu_mode && wget http://download.qemu-project.org/qemu-3.1.1.tar.xz && \
-    cd ../unicorn_mode && git submodule init && git submodule update || true && \
-    cd /AFLplusplus && ASAN_BUILD=1 make source-only || true
-
-WORKDIR /AFLplusplus
-CMD ["/bin/bash"]
-- 
cgit 1.4.1


From dfe6f7f8c949744eeab7a401affde93729a5b39d Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 23 Mar 2021 20:20:59 +0100
Subject: make setting different file permissions easy via config.h

---
 docs/Changelog.md                   |  2 ++
 include/config.h                    |  3 +++
 instrumentation/afl-compiler-rt.o.c | 10 +++++-----
 src/afl-analyze.c                   |  2 +-
 src/afl-as.c                        |  2 +-
 src/afl-common.c                    |  4 ++--
 src/afl-forkserver.c                |  4 ++--
 src/afl-fuzz-bitmap.c               |  8 ++++----
 src/afl-fuzz-extras.c               |  2 +-
 src/afl-fuzz-init.c                 | 12 ++++++------
 src/afl-fuzz-mutators.c             |  2 +-
 src/afl-fuzz-queue.c                |  6 +++---
 src/afl-fuzz-run.c                  | 14 +++++++-------
 src/afl-sharedmem.c                 |  8 ++++----
 src/afl-showmap.c                   |  4 ++--
 src/afl-tmin.c                      |  4 ++--
 16 files changed, 46 insertions(+), 41 deletions(-)

(limited to 'instrumentation/afl-compiler-rt.o.c')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 51c8c1bc..aea95d5d 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -27,6 +27,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - add AFL_QEMU_CUSTOM_BIN
   - unicorn_mode
     - accidently removed the subfolder from github, re-added
+  - added DEFAULT_PERMISSION to config.h for all files created, default
+    to 0600
 
 ### Version ++3.11c (release)
   - afl-fuzz:
diff --git a/include/config.h b/include/config.h
index 29225f6b..3c09fce4 100644
--- a/include/config.h
+++ b/include/config.h
@@ -43,6 +43,9 @@
    Default: 8MB (defined in bytes) */
 #define DEFAULT_SHMEM_SIZE (8 * 1024 * 1024)
 
+/* Default file permission umode when creating files (default: 0600) */
+#define DEFAULT_PERMISSION 0600
+
 /* CMPLOG/REDQUEEN TUNING
  *
  * Here you can modify tuning and solving options for CMPLOG.
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index ab1bfb31..f241447a 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -204,7 +204,7 @@ static void __afl_map_shm_fuzz() {
     int         shm_fd = -1;
 
     /* create the shared memory segment as if it was a file */
-    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    shm_fd = shm_open(shm_file_path, O_RDWR, DEFAULT_PERMISSION);
     if (shm_fd == -1) {
 
       fprintf(stderr, "shm_open() failed for fuzz\n");
@@ -353,7 +353,7 @@ static void __afl_map_shm(void) {
     unsigned char *shm_base = NULL;
 
     /* create the shared memory segment as if it was a file */
-    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    shm_fd = shm_open(shm_file_path, O_RDWR, DEFAULT_PERMISSION);
     if (shm_fd == -1) {
 
       fprintf(stderr, "shm_open() failed\n");
@@ -528,7 +528,7 @@ static void __afl_map_shm(void) {
     struct cmp_map *shm_base = NULL;
 
     /* create the shared memory segment as if it was a file */
-    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    shm_fd = shm_open(shm_file_path, O_RDWR, DEFAULT_PERMISSION);
     if (shm_fd == -1) {
 
       perror("shm_open() failed\n");
@@ -729,7 +729,7 @@ static void __afl_start_snapshots(void) {
       static uint32_t counter = 0;
       char            fn[32];
       sprintf(fn, "%09u:forkserver", counter);
-      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
       if (fd_doc >= 0) {
 
         if (write(fd_doc, __afl_fuzz_ptr, *__afl_fuzz_len) != *__afl_fuzz_len) {
@@ -960,7 +960,7 @@ static void __afl_start_forkserver(void) {
       static uint32_t counter = 0;
       char            fn[32];
       sprintf(fn, "%09u:forkserver", counter);
-      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
       if (fd_doc >= 0) {
 
         if (write(fd_doc, __afl_fuzz_ptr, *__afl_fuzz_len) != *__afl_fuzz_len) {
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index 86b0f7e9..e106cd31 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -212,7 +212,7 @@ static s32 write_to_file(u8 *path, u8 *mem, u32 len) {
 
   unlink(path);                                            /* Ignore errors */
 
-  ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600);
+  ret = open(path, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   if (ret < 0) { PFATAL("Unable to create '%s'", path); }
 
diff --git a/src/afl-as.c b/src/afl-as.c
index 7de267a3..aebd0ac8 100644
--- a/src/afl-as.c
+++ b/src/afl-as.c
@@ -280,7 +280,7 @@ static void add_instrumentation(void) {
 
   }
 
-  outfd = open(modified_file, O_WRONLY | O_EXCL | O_CREAT, 0600);
+  outfd = open(modified_file, O_WRONLY | O_EXCL | O_CREAT, DEFAULT_PERMISSION);
 
   if (outfd < 0) { PFATAL("Unable to write to '%s'", modified_file); }
 
diff --git a/src/afl-common.c b/src/afl-common.c
index cd24c376..37b4788c 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -1104,7 +1104,7 @@ FILE *create_ffile(u8 *fn) {
   s32   fd;
   FILE *f;
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
   if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
 
@@ -1122,7 +1122,7 @@ s32 create_file(u8 *fn) {
 
   s32 fd;
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
   if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
 
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 68995388..b9cb48cb 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -1038,12 +1038,12 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
 
       if (unlikely(fsrv->no_unlink)) {
 
-        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
       } else {
 
         unlink(fsrv->out_file);                           /* Ignore errors. */
-        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
+        fd = open(fsrv->out_file, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
       }
 
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 4ed59364..3d0228db 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -42,7 +42,7 @@ void write_bitmap(afl_state_t *afl) {
   afl->bitmap_changed = 0;
 
   snprintf(fname, PATH_MAX, "%s/fuzz_bitmap", afl->out_dir);
-  fd = open(fname, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+  fd = open(fname, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
   if (fd < 0) { PFATAL("Unable to open '%s'", fname); }
 
@@ -407,7 +407,7 @@ static void write_crash_readme(afl_state_t *afl) {
 
   sprintf(fn, "%s/crashes/README.txt", afl->out_dir);
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   /* Do not die on errors here - that would be impolite. */
 
@@ -509,7 +509,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
         alloc_printf("%s/queue/id_%06u", afl->out_dir, afl->queued_paths);
 
 #endif                                                    /* ^!SIMPLE_FILES */
-    fd = open(queue_fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    fd = open(queue_fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (unlikely(fd < 0)) { PFATAL("Unable to create '%s'", queue_fn); }
     ck_write(fd, mem, len, queue_fn);
     close(fd);
@@ -783,7 +783,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
   /* If we're here, we apparently want to save the crash or hang
      test case, too. */
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
   if (unlikely(fd < 0)) { PFATAL("Unable to create '%s'", fn); }
   ck_write(fd, mem, len, fn);
   close(fd);
diff --git a/src/afl-fuzz-extras.c b/src/afl-fuzz-extras.c
index 52100fa1..6091db15 100644
--- a/src/afl-fuzz-extras.c
+++ b/src/afl-fuzz-extras.c
@@ -731,7 +731,7 @@ void save_auto(afl_state_t *afl) {
         alloc_printf("%s/queue/.state/auto_extras/auto_%06u", afl->out_dir, i);
     s32 fd;
 
-    fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+    fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
     if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
 
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index b2569dc0..47521a9e 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -152,7 +152,7 @@ void bind_to_free_cpu(afl_state_t *afl) {
 
     do {
 
-      if ((lockfd = open(lockfile, O_RDWR | O_CREAT | O_EXCL, 0600)) < 0) {
+      if ((lockfd = open(lockfile, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION)) < 0) {
 
         if (first) {
 
@@ -1219,7 +1219,7 @@ static void link_or_copy(u8 *old_path, u8 *new_path) {
   sfd = open(old_path, O_RDONLY);
   if (sfd < 0) { PFATAL("Unable to open '%s'", old_path); }
 
-  dfd = open(new_path, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  dfd = open(new_path, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
   if (dfd < 0) { PFATAL("Unable to create '%s'", new_path); }
 
   tmp = ck_alloc(64 * 1024);
@@ -2015,7 +2015,7 @@ void setup_dirs_fds(afl_state_t *afl) {
 
   if (!afl->in_place_resume) {
 
-    int fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    int fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", tmp); }
     ck_free(tmp);
 
@@ -2030,7 +2030,7 @@ void setup_dirs_fds(afl_state_t *afl) {
 
   } else {
 
-    int fd = open(tmp, O_WRONLY | O_CREAT, 0600);
+    int fd = open(tmp, O_WRONLY | O_CREAT, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", tmp); }
     ck_free(tmp);
 
@@ -2057,7 +2057,7 @@ void setup_cmdline_file(afl_state_t *afl, char **argv) {
 
   /* Store the command line to reproduce our findings */
   tmp = alloc_printf("%s/cmdline", afl->out_dir);
-  fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  fd = open(tmp, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
   if (fd < 0) { PFATAL("Unable to create '%s'", tmp); }
   ck_free(tmp);
 
@@ -2092,7 +2092,7 @@ void setup_stdio_file(afl_state_t *afl) {
 
   unlink(afl->fsrv.out_file);                              /* Ignore errors */
 
-  afl->fsrv.out_fd = open(afl->fsrv.out_file, O_RDWR | O_CREAT | O_EXCL, 0600);
+  afl->fsrv.out_fd = open(afl->fsrv.out_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   if (afl->fsrv.out_fd < 0) {
 
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 80df6d08..a47b4f5f 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -465,7 +465,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
 
     unlink(q->fname);                                      /* ignore errors */
 
-    fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
     if (fd < 0) { PFATAL("Unable to create '%s'", q->fname); }
 
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index b2f88205..63592cef 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -249,7 +249,7 @@ void mark_as_det_done(afl_state_t *afl, struct queue_entry *q) {
   snprintf(fn, PATH_MAX, "%s/queue/.state/deterministic_done/%s", afl->out_dir,
            strrchr(q->fname, '/') + 1);
 
-  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
   if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
   close(fd);
 
@@ -272,7 +272,7 @@ void mark_as_variable(afl_state_t *afl, struct queue_entry *q) {
 
   if (symlink(ldest, fn)) {
 
-    s32 fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    s32 fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
     close(fd);
 
@@ -300,7 +300,7 @@ void mark_as_redundant(afl_state_t *afl, struct queue_entry *q, u8 state) {
 
     s32 fd;
 
-    fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", fn); }
     close(fd);
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 0b84a542..30860eff 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -83,7 +83,7 @@ write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
            afl->document_counter++,
            describe_op(afl, 0, NAME_MAX - strlen("000000000:")));
 
-  if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600)) >= 0) {
+  if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION)) >= 0) {
 
     if (write(doc_fd, mem, len) != len)
       PFATAL("write to mutation file failed: %s", fn);
@@ -247,12 +247,12 @@ static void write_with_gap(afl_state_t *afl, u8 *mem, u32 len, u32 skip_at,
 
     if (unlikely(afl->no_unlink)) {
 
-      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
     } else {
 
       unlink(afl->fsrv.out_file);                         /* Ignore errors. */
-      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
+      fd = open(afl->fsrv.out_file, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
     }
 
@@ -564,7 +564,7 @@ void sync_fuzzers(afl_state_t *afl) {
     /* document the attempt to sync to this instance */
 
     sprintf(qd_synced_path, "%s/.synced/%s.last", afl->out_dir, sd_ent->d_name);
-    id_fd = open(qd_synced_path, O_RDWR | O_CREAT | O_TRUNC, 0600);
+    id_fd = open(qd_synced_path, O_RDWR | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
     if (id_fd >= 0) close(id_fd);
 
     /* Skip anything that doesn't have a queue/ subdirectory. */
@@ -587,7 +587,7 @@ void sync_fuzzers(afl_state_t *afl) {
 
     sprintf(qd_synced_path, "%s/.synced/%s", afl->out_dir, sd_ent->d_name);
 
-    id_fd = open(qd_synced_path, O_RDWR | O_CREAT, 0600);
+    id_fd = open(qd_synced_path, O_RDWR | O_CREAT, DEFAULT_PERMISSION);
 
     if (id_fd < 0) { PFATAL("Unable to create '%s'", qd_synced_path); }
 
@@ -851,7 +851,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
 
     if (unlikely(afl->no_unlink)) {
 
-      fd = open(q->fname, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+      fd = open(q->fname, O_WRONLY | O_CREAT | O_TRUNC, DEFAULT_PERMISSION);
 
       if (fd < 0) { PFATAL("Unable to create '%s'", q->fname); }
 
@@ -866,7 +866,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
     } else {
 
       unlink(q->fname);                                    /* ignore errors */
-      fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, 0600);
+      fd = open(q->fname, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
       if (fd < 0) { PFATAL("Unable to create '%s'", q->fname); }
 
diff --git a/src/afl-sharedmem.c b/src/afl-sharedmem.c
index 3241a130..ac662977 100644
--- a/src/afl-sharedmem.c
+++ b/src/afl-sharedmem.c
@@ -163,7 +163,7 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
 
   /* create the shared memory segment as if it was a file */
   shm->g_shm_fd =
-      shm_open(shm->g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, 0600);
+      shm_open(shm->g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, DEFAULT_PERMISSION);
   if (shm->g_shm_fd == -1) { PFATAL("shm_open() failed"); }
 
   /* configure the size of the shared memory segment */
@@ -202,7 +202,7 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
 
     /* create the shared memory segment as if it was a file */
     shm->cmplog_g_shm_fd =
-        shm_open(shm->cmplog_g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, 0600);
+        shm_open(shm->cmplog_g_shm_file_path, O_CREAT | O_RDWR | O_EXCL, DEFAULT_PERMISSION);
     if (shm->cmplog_g_shm_fd == -1) { PFATAL("shm_open() failed"); }
 
     /* configure the size of the shared memory segment */
@@ -241,13 +241,13 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
 #else
   u8 *shm_str;
 
-  shm->shm_id = shmget(IPC_PRIVATE, map_size, IPC_CREAT | IPC_EXCL | 0600);
+  shm->shm_id = shmget(IPC_PRIVATE, map_size, IPC_CREAT | IPC_EXCL | DEFAULT_PERMISSION);
   if (shm->shm_id < 0) { PFATAL("shmget() failed"); }
 
   if (shm->cmplog_mode) {
 
     shm->cmplog_shm_id = shmget(IPC_PRIVATE, sizeof(struct cmp_map),
-                                IPC_CREAT | IPC_EXCL | 0600);
+                                IPC_CREAT | IPC_EXCL | DEFAULT_PERMISSION);
 
     if (shm->cmplog_shm_id < 0) {
 
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 7bf5a9c7..cc0f1a7e 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -252,7 +252,7 @@ static u32 write_results_to_file(afl_forkserver_t *fsrv, u8 *outfile) {
   } else {
 
     unlink(outfile);                                       /* Ignore errors */
-    fd = open(outfile, O_WRONLY | O_CREAT | O_EXCL, 0600);
+    fd = open(outfile, O_WRONLY | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fd < 0) { PFATAL("Unable to create '%s'", outfile); }
 
   }
@@ -1119,7 +1119,7 @@ int main(int argc, char **argv_orig, char **envp) {
     unlink(stdin_file);
     atexit(at_exit_handler);
     fsrv->out_file = stdin_file;
-    fsrv->out_fd = open(stdin_file, O_RDWR | O_CREAT | O_EXCL, 0600);
+    fsrv->out_fd = open(stdin_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
     if (fsrv->out_fd < 0) { PFATAL("Unable to create '%s'", out_file); }
 
     if (arg_offset && use_argv[arg_offset] != stdin_file) {
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 7ef8b9bf..fc974262 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -244,7 +244,7 @@ static s32 write_to_file(u8 *path, u8 *mem, u32 len) {
 
   unlink(path);                                            /* Ignore errors */
 
-  ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600);
+  ret = open(path, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   if (ret < 0) { PFATAL("Unable to create '%s'", path); }
 
@@ -666,7 +666,7 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
   unlink(out_file);
 
   fsrv->out_file = out_file;
-  fsrv->out_fd = open(out_file, O_RDWR | O_CREAT | O_EXCL, 0600);
+  fsrv->out_fd = open(out_file, O_RDWR | O_CREAT | O_EXCL, DEFAULT_PERMISSION);
 
   if (fsrv->out_fd < 0) { PFATAL("Unable to create '%s'", out_file); }
 
-- 
cgit 1.4.1