From 920e9402a4d6101bbbed2ef7584d85a3c3de0eaa Mon Sep 17 00:00:00 2001
From: Joshua Rogers <jrogers@opera.com>
Date: Fri, 2 Apr 2021 22:23:11 +0000
Subject:  Add support for standalone leak-sanitizer, introducting the
 environment variable AFL_USE_LSAN.

AFL_USE_LSAN introduces the macro __AFL_CHECK_LEAK() which will check
for a memory leak when the macro is run. This is especially helpful
when using __AFL_LOOP().

If __AFL_LEAK_CHECK() is not used when AFL_USE_LSAN=1 is set,
the leak checker will run when the program exits.
---
 src/afl-cc.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/src/afl-cc.c b/src/afl-cc.c
index 5251465b..e0478503 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -758,7 +758,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     if (!strncmp(cur, "-fsanitize-coverage-", 20) && strstr(cur, "list="))
       have_instr_list = 1;
 
-    if (!strcmp(cur, "-fsanitize=address") || !strcmp(cur, "-fsanitize=memory"))
+    if (!(strcmp(cur, "-fsanitize=address") && strcmp(cur, "-fsanitize=memory")))
       asan_set = 1;
 
     if (strstr(cur, "FORTIFY_SOURCE")) fortify_set = 1;
@@ -817,6 +817,10 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   }
 
+  if (getenv("AFL_USE_LSAN")) {
+    cc_params[cc_par_cnt++] = "-fsanitize=leak";
+  }
+
   if (getenv("AFL_USE_CFISAN")) {
 
     if (!lto_mode) {
@@ -914,6 +918,13 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   }
 
+  if (getenv("AFL_USE_LSAN")) {
+    cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h";
+  }
+
+  cc_params[cc_par_cnt++] =
+      "-D__AFL_CHECK_LEAK()=__lsan_do_leak_check()";
+
   cc_params[cc_par_cnt++] =
       "-D__AFL_COVERAGE_START_OFF()=int __afl_selective_coverage_start_off = "
       "1;";
@@ -1740,7 +1751,8 @@ int main(int argc, char **argv, char **envp) {
           "  AFL_USE_ASAN: activate address sanitizer\n"
           "  AFL_USE_CFISAN: activate control flow sanitizer\n"
           "  AFL_USE_MSAN: activate memory sanitizer\n"
-          "  AFL_USE_UBSAN: activate undefined behaviour sanitizer\n");
+          "  AFL_USE_UBSAN: activate undefined behaviour sanitizer\n"
+          "  AFL_USE_LSAN: activate leak-checker sanitizer\n");
 
       if (have_gcc_plugin)
         SAYF(
-- 
cgit 1.4.1


From 6514e33ab6733dd4e7ae0d3eeec83db06b3f451f Mon Sep 17 00:00:00 2001
From: Joshua Rogers <jrogers@opera.com>
Date: Fri, 2 Apr 2021 22:32:38 +0000
Subject: Replace __AFL_CHECK_LEAK with __AFL_LEAK_CHECK to be more proper.

Fix spelling mistakes.

Correctly call LSAN_ERROR not MSAN_ERROR.
---
 docs/env_variables.md  | 8 ++++----
 docs/notes_for_asan.md | 2 +-
 src/afl-analyze.c      | 2 +-
 src/afl-cc.c           | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/docs/env_variables.md b/docs/env_variables.md
index 682ab7f1..85c2efd7 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -55,7 +55,7 @@ make fairly broad use of environmental variables instead:
     overridden.
 
   - Setting `AFL_USE_ASAN` automatically enables ASAN, provided that your
-    compiler supports itt. Note that fuzzing with ASAN is mildly challenging
+    compiler supports it. Note that fuzzing with ASAN is mildly challenging
     - see [notes_for_asan.md](notes_for_asan.md).
 
     (You can also enable MSAN via `AFL_USE_MSAN`; ASAN and MSAN come with the
@@ -66,8 +66,8 @@ make fairly broad use of environmental variables instead:
 
   - Setting `AFL_USE_LSAN` automatically enables Leak-Sanitizer, provided
     that your compiler supports it. To perform a leak check within your
-    program at a certain point (such as at the end of an __AFL_LOOP,
-    you can run the macro __AFL_CHECK_LEAK(); which will cause
+    program at a certain point (such as at the end of an __AFL_LOOP),
+    you can run the macro __AFL_LEAK_CHECK(); which will cause
     an abort if any memory is leaked (you can combine this with the
     LSAN_OPTIONS=suppressions option to supress some known leaks).
 
@@ -637,7 +637,7 @@ optimal values if not already present in the environment:
 ```
   - Similarly, the default `LSAN_OPTIONS` are set to:
 ```
-    exit_code=86
+    exit_code=23
     fast_unwind_on_malloc=0
 ````
   Be sure to include the first ones for LSAN and MSAN when customizing
diff --git a/docs/notes_for_asan.md b/docs/notes_for_asan.md
index 26f34fad..f55aeaf2 100644
--- a/docs/notes_for_asan.md
+++ b/docs/notes_for_asan.md
@@ -30,7 +30,7 @@ Note that ASAN is incompatible with -static, so be mindful of that.
 
 When compiling with AFL_USE_LSAN, the leak sanitizer will normally run
 when the program exits. In order to utilize this check at different times,
-such as at the end of a loop, you may use the macro __AFL_CHECK_LEAK();.
+such as at the end of a loop, you may use the macro __AFL_LEAK_CHECK();.
 This macro will report a crash in afl-fuzz if any memory is left leaking
 at this stage. You can also use LSAN_OPTIONS and a supressions file
 for more fine-tuned checking, however make sure you keep exitcode=23.
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index 90305714..f961f13a 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -832,7 +832,7 @@ static void set_up_environment(void) {
                          "handle_sigill=0", 0);
 
    setenv("LSAN_OPTIONS",
-         "exitcode=" STRINGIFY(MSAN_ERROR) ":"
+         "exitcode=" STRINGIFY(LSAN_ERROR) ":"
          "fast_unwind_on_malloc=0",
          0);
 
diff --git a/src/afl-cc.c b/src/afl-cc.c
index e0478503..975b28d1 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -923,7 +923,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
   }
 
   cc_params[cc_par_cnt++] =
-      "-D__AFL_CHECK_LEAK()=__lsan_do_leak_check()";
+      "-D__AFL_LEAK_CHECK()=__lsan_do_leak_check()";
 
   cc_params[cc_par_cnt++] =
       "-D__AFL_COVERAGE_START_OFF()=int __afl_selective_coverage_start_off = "
-- 
cgit 1.4.1


From afc4da47f78a24d5e441e3815e5b322d1b27fd56 Mon Sep 17 00:00:00 2001
From: Joshua Rogers <jrogers@opera.com>
Date: Sat, 3 Apr 2021 14:50:35 +0000
Subject: Fix typos, Use symbolize=0 for LSAN, Remove syntactic sugar.

---
 README.md             | 2 +-
 docs/env_variables.md | 3 ++-
 src/afl-analyze.c     | 8 ++++----
 src/afl-cc.c          | 2 +-
 src/afl-forkserver.c  | 3 ++-
 src/afl-fuzz-init.c   | 5 ++---
 src/afl-showmap.c     | 4 +++-
 src/afl-tmin.c        | 3 ++-
 8 files changed, 17 insertions(+), 13 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/README.md b/README.md
index 41d55e9c..4d3f8aa9 100644
--- a/README.md
+++ b/README.md
@@ -601,7 +601,7 @@ Every -M/-S entry needs a unique name (that can be whatever), however the same
 For every secondary fuzzer there should be a variation, e.g.:
  * one should fuzz the target that was compiled differently: with sanitizers
    activated (`export AFL_USE_ASAN=1 ; export AFL_USE_UBSAN=1 ;
-   export AFL_USE_CFISAN=1 ; export AFL_USE_LSAN`)
+   export AFL_USE_CFISAN=1 ; export AFL_USE_LSAN=1`)
  * one should fuzz the target with CMPLOG/redqueen (see above)
  * one to three fuzzers should fuzz a target compiled with laf-intel/COMPCOV
    (see above). Important note: If you run more than one laf-intel/COMPCOV
diff --git a/docs/env_variables.md b/docs/env_variables.md
index 85c2efd7..5f9233d7 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -639,7 +639,8 @@ optimal values if not already present in the environment:
 ```
     exit_code=23
     fast_unwind_on_malloc=0
-````
+    symbolize=0
+```
   Be sure to include the first ones for LSAN and MSAN when customizing
      anything, since some MSAN and LSAN versions don't call `abort()` on
      error, and we need a way to detect faults.
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index f961f13a..38a40556 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -785,10 +785,9 @@ static void set_up_environment(void) {
 
   if (x) {
 
-    if (!strstr(x, "exit_code=" STRINGIFY(LSAN_ERROR))) {
+    if (!strstr(x, "symbolize=0")) {
 
-      FATAL("Custom LSAN_OPTIONS set without exit_code=" STRINGIFY(
-          LSAN_ERROR) " - please fix!");
+      FATAL("Custom LSAN_OPTIONS set without symbolize=0 - please fix!");
 
     }
 
@@ -833,7 +832,8 @@ static void set_up_environment(void) {
 
    setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
-         "fast_unwind_on_malloc=0",
+         "fast_unwind_on_malloc=0:"
+         "symbolize=0",
          0);
 
 
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 975b28d1..650e4e43 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -758,7 +758,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     if (!strncmp(cur, "-fsanitize-coverage-", 20) && strstr(cur, "list="))
       have_instr_list = 1;
 
-    if (!(strcmp(cur, "-fsanitize=address") && strcmp(cur, "-fsanitize=memory")))
+    if (!strcmp(cur, "-fsanitize=address") || !strcmp(cur, "-fsanitize=memory"))
       asan_set = 1;
 
     if (strstr(cur, "FORTIFY_SOURCE")) fortify_set = 1;
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index fa89713a..f102b73b 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -543,7 +543,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
     if (!getenv("LSAN_OPTIONS"))
      setenv("LSAN_OPTIONS",
             "exitcode=" STRINGIFY(LSAN_ERROR) ":"
-            "fast_unwind_on_malloc=0",
+            "fast_unwind_on_malloc=0:"
+            "symbolize=0",
             1);
 
     fsrv->init_child_func(fsrv, argv);
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 24f5c5b5..6f663021 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -2470,10 +2470,9 @@ void check_asan_opts(afl_state_t *afl) {
 
   if (x) {
 
-    if (!strstr(x, "exit_code=" STRINGIFY(LSAN_ERROR))) {
+    if (!strstr(x, "symbolize=0")) {
 
-      FATAL("Custom LSAN_OPTIONS set without exit_code=" STRINGIFY(
-          LSAN_ERROR) " - please fix!");
+      FATAL("Custom LSAN_OPTIONS set without symbolize=0 - please fix!");
 
     }
 
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index bf076683..2b7d200b 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -570,9 +570,11 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
          "handle_sigfpe=0:"
          "handle_sigill=0",
          0);
+
   setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
-         "fast_unwind_on_malloc=0",
+         "fast_unwind_on_malloc=0:"
+         "symbolize=0",
           0);
 
   setenv("UBSAN_OPTIONS",
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index a2741a07..c257b67c 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -764,7 +764,8 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
 
    setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
-         "fast_unwind_on_malloc=0",
+         "fast_unwind_on_malloc=0:"
+         "symbolize=0",
          0);
 
   if (get_afl_env("AFL_PRELOAD")) {
-- 
cgit 1.4.1


From 99819cf5d1cbc262810f26098a5796c9d1262bc5 Mon Sep 17 00:00:00 2001
From: Joshua Rogers <jrogers@opera.com>
Date: Sun, 4 Apr 2021 12:45:52 +0000
Subject: Move definition of __AFL_LEAK_CHECK inside ifguards, use
 LSAN_OPTIONS=print_suppressions=0

---
 docs/env_variables.md |  1 +
 src/afl-analyze.c     |  3 ++-
 src/afl-cc.c          | 10 +++-------
 src/afl-forkserver.c  |  3 ++-
 src/afl-showmap.c     |  3 ++-
 src/afl-tmin.c        |  3 ++-
 6 files changed, 12 insertions(+), 11 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/docs/env_variables.md b/docs/env_variables.md
index 5f9233d7..83bc487f 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -640,6 +640,7 @@ optimal values if not already present in the environment:
     exit_code=23
     fast_unwind_on_malloc=0
     symbolize=0
+    print_suppressions=0
 ```
   Be sure to include the first ones for LSAN and MSAN when customizing
      anything, since some MSAN and LSAN versions don't call `abort()` on
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index 38a40556..f4436980 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -833,7 +833,8 @@ static void set_up_environment(void) {
    setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
          "fast_unwind_on_malloc=0:"
-         "symbolize=0",
+         "symbolize=0:"
+         "print_suppressions=0",
          0);
 
 
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 650e4e43..e2dd06e2 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -819,6 +819,9 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   if (getenv("AFL_USE_LSAN")) {
     cc_params[cc_par_cnt++] = "-fsanitize=leak";
+    cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h";
+    cc_params[cc_par_cnt++] =
+        "-D__AFL_LEAK_CHECK()=__lsan_do_leak_check()";
   }
 
   if (getenv("AFL_USE_CFISAN")) {
@@ -918,13 +921,6 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   }
 
-  if (getenv("AFL_USE_LSAN")) {
-    cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h";
-  }
-
-  cc_params[cc_par_cnt++] =
-      "-D__AFL_LEAK_CHECK()=__lsan_do_leak_check()";
-
   cc_params[cc_par_cnt++] =
       "-D__AFL_COVERAGE_START_OFF()=int __afl_selective_coverage_start_off = "
       "1;";
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index f102b73b..ac7a1600 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -544,7 +544,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
      setenv("LSAN_OPTIONS",
             "exitcode=" STRINGIFY(LSAN_ERROR) ":"
             "fast_unwind_on_malloc=0:"
-            "symbolize=0",
+            "symbolize=0:"
+            "print_suppressions=0",
             1);
 
     fsrv->init_child_func(fsrv, argv);
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 2b7d200b..df91a4c2 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -574,7 +574,8 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
   setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
          "fast_unwind_on_malloc=0:"
-         "symbolize=0",
+         "symbolize=0:"
+         "print_suppressions=0",
           0);
 
   setenv("UBSAN_OPTIONS",
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 3a196e2e..eb5e0dcf 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -764,7 +764,8 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
    setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
          "fast_unwind_on_malloc=0:"
-         "symbolize=0",
+         "symbolize=0:"
+         "print_suppressions=0",
          0);
 
   if (get_afl_env("AFL_PRELOAD")) {
-- 
cgit 1.4.1


From 3c846859eef4d17d2587ea28db83c680b51723a7 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sun, 4 Apr 2021 20:05:02 +0200
Subject: cleanup

---
 GNUmakefile                                        | 38 ++++++++++++----------
 GNUmakefile.gcc_plugin                             | 12 ++++---
 GNUmakefile.llvm                                   |  8 +++--
 docs/Changelog.md                                  |  3 ++
 include/android-ashmem.h                           | 16 +++++----
 instrumentation/afl-llvm-lto-instrumentation.so.cc |  2 +-
 src/afl-analyze.c                                  |  3 +-
 src/afl-cc.c                                       |  5 +--
 src/afl-forkserver.c                               |  7 ++--
 src/afl-fuzz-init.c                                |  1 -
 src/afl-tmin.c                                     |  2 +-
 11 files changed, 55 insertions(+), 42 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/GNUmakefile b/GNUmakefile
index fdbcd542..d5fb570d 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -36,6 +36,11 @@ SH_PROGS    = afl-plot afl-cmin afl-cmin.bash afl-whatsup afl-system-config
 MANPAGES=$(foreach p, $(PROGS) $(SH_PROGS), $(p).8) afl-as.8
 ASAN_OPTIONS=detect_leaks=0
 
+SYS = $(shell uname -s)
+ARCH = $(shell uname -m)
+
+$(info [*] Compiling afl++ for OS $(SYS) on ARCH $(ARCH))
+
 ifdef NO_SPLICING
   override CFLAGS += -DNO_SPLICING
 endif
@@ -82,7 +87,7 @@ endif
 #  endif
 #endif
 
-ifneq "$(shell uname)" "Darwin"
+ifneq "$(SYS)" "Darwin"
   #ifeq "$(HAVE_MARCHNATIVE)" "1"
   #  SPECIAL_PERFORMANCE += -march=native
   #endif
@@ -92,7 +97,7 @@ ifneq "$(shell uname)" "Darwin"
   endif
 endif
 
-ifeq "$(shell uname)" "SunOS"
+ifeq "$(SYS)" "SunOS"
   CFLAGS_OPT += -Wno-format-truncation
   LDFLAGS = -lkstat -lrt
 endif
@@ -119,11 +124,10 @@ ifdef INTROSPECTION
   CFLAGS_OPT += -DINTROSPECTION=1
 endif
 
-
-ifneq "$(shell uname -m)" "x86_64"
- ifneq "$(patsubst i%86,i386,$(shell uname -m))" "i386"
-  ifneq "$(shell uname -m)" "amd64"
-   ifneq "$(shell uname -m)" "i86pc"
+ifneq "$(ARCH)" "x86_64"
+ ifneq "$(patsubst i%86,i386,$(ARCH))" "i386"
+  ifneq "$(ARCH)" "amd64"
+   ifneq "$(ARCH)" "i86pc"
 	AFL_NO_X86=1
    endif
   endif
@@ -141,27 +145,27 @@ override CFLAGS += -g -Wno-pointer-sign -Wno-variadic-macros -Wall -Wextra -Wpoi
 			  -I include/ -DAFL_PATH=\"$(HELPER_PATH)\" \
 			  -DBIN_PATH=\"$(BIN_PATH)\" -DDOC_PATH=\"$(DOC_PATH)\"
 
-ifeq "$(shell uname -s)" "FreeBSD"
+ifeq "$(SYS)" "FreeBSD"
   override CFLAGS  += -I /usr/local/include/
   LDFLAGS += -L /usr/local/lib/
 endif
 
-ifeq "$(shell uname -s)" "DragonFly"
+ifeq "$(SYS)" "DragonFly"
   override CFLAGS  += -I /usr/local/include/
   LDFLAGS += -L /usr/local/lib/
 endif
 
-ifeq "$(shell uname -s)" "OpenBSD"
+ifeq "$(SYS)" "OpenBSD"
   override CFLAGS  += -I /usr/local/include/ -mno-retpoline
   LDFLAGS += -Wl,-z,notext -L /usr/local/lib/
 endif
 
-ifeq "$(shell uname -s)" "NetBSD"
+ifeq "$(SYS)" "NetBSD"
   override CFLAGS  += -I /usr/pkg/include/
   LDFLAGS += -L /usr/pkg/lib/
 endif
 
-ifeq "$(shell uname -s)" "Haiku"
+ifeq "$(SYS)" "Haiku"
   SHMAT_OK=0
   override CFLAGS  += -DUSEMMAP=1 -Wno-error=format -fPIC
   LDFLAGS += -Wno-deprecated-declarations -lgnu
@@ -236,24 +240,24 @@ else
     BUILD_DATE ?= $(shell date "+%Y-%m-%d")
 endif
 
-ifneq "$(filter Linux GNU%,$(shell uname))" ""
+ifneq "$(filter Linux GNU%,$(SYS))" ""
  ifndef DEBUG
   override CFLAGS += -D_FORTIFY_SOURCE=2
  endif
   LDFLAGS += -ldl -lrt -lm
 endif
 
-ifneq "$(findstring FreeBSD, $(shell uname))" ""
+ifneq "$(findstring FreeBSD, $(ARCH))" ""
   override CFLAGS  += -pthread
   LDFLAGS += -lpthread
 endif
 
-ifneq "$(findstring NetBSD, $(shell uname))" ""
+ifneq "$(findstring NetBSD, $(ARCH))" ""
   override CFLAGS  += -pthread
   LDFLAGS += -lpthread
 endif
 
-ifneq "$(findstring OpenBSD, $(shell uname))" ""
+ifneq "$(findstring OpenBSD, $(ARCH))" ""
   override CFLAGS  += -pthread
   LDFLAGS += -lpthread
 endif
@@ -485,7 +489,7 @@ unit_clean:
 	@rm -f ./test/unittests/unit_preallocable ./test/unittests/unit_list ./test/unittests/unit_maybe_alloc test/unittests/*.o
 
 .PHONY: unit
-ifneq "$(shell uname)" "Darwin"
+ifneq "$(ARCH)" "Darwin"
 unit:	unit_maybe_alloc unit_preallocable unit_list unit_clean unit_rand unit_hash
 else
 unit:
diff --git a/GNUmakefile.gcc_plugin b/GNUmakefile.gcc_plugin
index aa93c688..b0f90f1b 100644
--- a/GNUmakefile.gcc_plugin
+++ b/GNUmakefile.gcc_plugin
@@ -41,6 +41,8 @@ CXXEFLAGS   := $(CXXFLAGS) -Wall -std=c++11
 CC          ?= gcc
 CXX         ?= g++
 
+SYS = $(shell uname -s)
+
 ifeq "clang" "$(CC)"
         CC  = gcc
         CXX = g++
@@ -75,25 +77,25 @@ ifeq "$(TEST_MMAP)" "1"
 	override CFLAGS_SAFE += -DUSEMMAP=1
 endif
 
-ifneq "$(shell uname -s)" "Haiku"
-ifneq "$(shell uname -s)" "OpenBSD"
+ifneq "$(SYS)" "Haiku"
+ifneq "$(SYS)" "OpenBSD"
   	LDFLAGS += -lrt
 endif
 else
 	CFLAGS_SAFE += -DUSEMMAP=1
 endif
 
-ifeq "$(shell uname -s)" "OpenBSD"
+ifeq "$(SYS)" "OpenBSD"
     CC  = egcc
     CXX = eg++
     PLUGIN_FLAGS += -I/usr/local/include
 endif
 
-ifeq "$(shell uname -s)" "DragonFly"
+ifeq "$(SYS)" "DragonFly"
   	PLUGIN_FLAGS += -I/usr/local/include
 endif
 
-ifeq "$(shell uname -s)" "SunOS"
+ifeq "$(SYS)" "SunOS"
   	PLUGIN_FLAGS += -I/usr/include/gmp
 endif
 
diff --git a/GNUmakefile.llvm b/GNUmakefile.llvm
index 4b5ac520..61c17e92 100644
--- a/GNUmakefile.llvm
+++ b/GNUmakefile.llvm
@@ -30,7 +30,9 @@ BUILD_DATE  ?= $(shell date -u -d "@$(SOURCE_DATE_EPOCH)" "+%Y-%m-%d" 2>/dev/nul
 
 VERSION     = $(shell grep '^$(HASH)define VERSION ' ./config.h | cut -d '"' -f2)
 
-ifeq "$(shell uname)" "OpenBSD"
+SYS = $(shell uname -s)
+
+ifeq "$(SYS)" "OpenBSD"
   LLVM_CONFIG ?= $(BIN_PATH)/llvm-config
   HAS_OPT = $(shell test -x $(BIN_PATH)/opt && echo 0 || echo 1)
   ifeq "$(HAS_OPT)" "1"
@@ -275,13 +277,13 @@ CLANG_LFL    = `$(LLVM_CONFIG) --ldflags` $(LDFLAGS)
 
 
 # User teor2345 reports that this is required to make things work on MacOS X.
-ifeq "$(shell uname)" "Darwin"
+ifeq "$(SYS)" "Darwin"
   CLANG_LFL += -Wl,-flat_namespace -Wl,-undefined,suppress
 else
   CLANG_CPPFL += -Wl,-znodelete
 endif
 
-ifeq "$(shell uname)" "OpenBSD"
+ifeq "$(SYS)" "OpenBSD"
   CLANG_LFL += `$(LLVM_CONFIG) --libdir`/libLLVM.so
   CLANG_CPPFL += -mno-retpoline
   CFLAGS += -mno-retpoline
diff --git a/docs/Changelog.md b/docs/Changelog.md
index 91d1a8cc..24877f9a 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -11,6 +11,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
 ### Version ++3.13a (development)
   - frida_mode - new mode that uses frida to fuzz binary-only targets,
     thanks to @WorksButNotTested!
+  - create a fuzzing dictionary with the help of CodeQL thanks to
+    @microsvuln! see utils/autodict_ql
   - afl-fuzz:
     - added patch by @realmadsci to support @@ as part of command line
       options, e.g. `afl-fuzz ... -- ./target --infile=@@`
@@ -20,6 +22,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - default cmplog level (-l) is now 2, better efficiency.
     - ensure one fuzzer sync per cycle
   - afl-cc:
+    - Leak Sanitizer support (AFL_USE_LSAN) added by Joshua Rogers, thanks!
     - Removed InsTrim instrumentation as it is not as good as PCGUARD
 
 ### Version ++3.12c (release)
diff --git a/include/android-ashmem.h b/include/android-ashmem.h
index 44fe556a..1bfd3220 100644
--- a/include/android-ashmem.h
+++ b/include/android-ashmem.h
@@ -13,12 +13,14 @@
     #include <stdio.h>
     #define ASHMEM_DEVICE "/dev/ashmem"
 
-int shmdt(const void* address) {
-#if defined(SYS_shmdt)
+int shmdt(const void *address) {
+
+    #if defined(SYS_shmdt)
   return syscall(SYS_shmdt, address);
-#else
+    #else
   return syscall(SYS_ipc, SHMDT, 0, 0, 0, address, 0);
-#endif
+    #endif
+
 }
 
 int shmctl(int __shmid, int __cmd, struct shmid_ds *__buf) {
@@ -26,7 +28,7 @@ int shmctl(int __shmid, int __cmd, struct shmid_ds *__buf) {
   int ret = 0;
   if (__cmd == IPC_RMID) {
 
-    int length = ioctl(__shmid, ASHMEM_GET_SIZE, NULL);
+    int               length = ioctl(__shmid, ASHMEM_GET_SIZE, NULL);
     struct ashmem_pin pin = {0, length};
     ret = ioctl(__shmid, ASHMEM_UNPIN, &pin);
     close(__shmid);
@@ -77,6 +79,6 @@ void *shmat(int __shmid, const void *__shmaddr, int __shmflg) {
 
 }
 
-  #endif /* !_ANDROID_ASHMEM_H */
-#endif /* !__ANDROID__ */
+  #endif                                              /* !_ANDROID_ASHMEM_H */
+#endif                                                      /* !__ANDROID__ */
 
diff --git a/instrumentation/afl-llvm-lto-instrumentation.so.cc b/instrumentation/afl-llvm-lto-instrumentation.so.cc
index 50306224..6eb19060 100644
--- a/instrumentation/afl-llvm-lto-instrumentation.so.cc
+++ b/instrumentation/afl-llvm-lto-instrumentation.so.cc
@@ -176,7 +176,7 @@ bool AFLLTOPass::runOnModule(Module &M) {
 
   }
 
-  if (debug) { fprintf(stderr, "map address is 0x%lx\n", map_addr); }
+  if (debug) { fprintf(stderr, "map address is 0x%llx\n", map_addr); }
 
   /* Get/set the globals for the SHM region. */
 
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index 7d7519fa..aabdbf1a 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -833,14 +833,13 @@ static void set_up_environment(char **argv) {
                          "handle_sigfpe=0:"
                          "handle_sigill=0", 0);
 
-   setenv("LSAN_OPTIONS",
+  setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
          "fast_unwind_on_malloc=0:"
          "symbolize=0:"
          "print_suppressions=0",
          0);
 
-
   if (get_afl_env("AFL_PRELOAD")) {
 
     if (qemu_mode) {
diff --git a/src/afl-cc.c b/src/afl-cc.c
index d4c0a6b7..3af31b3c 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -820,10 +820,11 @@ static void edit_params(u32 argc, char **argv, char **envp) {
   }
 
   if (getenv("AFL_USE_LSAN")) {
+
     cc_params[cc_par_cnt++] = "-fsanitize=leak";
     cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h";
-    cc_params[cc_par_cnt++] =
-        "-D__AFL_LEAK_CHECK()=__lsan_do_leak_check()";
+    cc_params[cc_par_cnt++] = "-D__AFL_LEAK_CHECK()=__lsan_do_leak_check()";
+
   }
 
   if (getenv("AFL_USE_CFISAN")) {
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index cd04e23d..2c502621 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -560,7 +560,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
     /* LSAN, too, does not support abort_on_error=1. */
 
     if (!getenv("LSAN_OPTIONS"))
-     setenv("LSAN_OPTIONS",
+      setenv("LSAN_OPTIONS",
             "exitcode=" STRINGIFY(LSAN_ERROR) ":"
             "fast_unwind_on_malloc=0:"
             "symbolize=0:"
@@ -1314,8 +1314,9 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
           /* A normal crash/abort */
           (WIFSIGNALED(fsrv->child_status)) ||
           /* special handling for msan and lsan */
-          (fsrv->uses_asan && (WEXITSTATUS(fsrv->child_status) == MSAN_ERROR ||
-          WEXITSTATUS(fsrv->child_status) == LSAN_ERROR)) ||
+          (fsrv->uses_asan &&
+           (WEXITSTATUS(fsrv->child_status) == MSAN_ERROR ||
+            WEXITSTATUS(fsrv->child_status) == LSAN_ERROR)) ||
           /* the custom crash_exitcode was returned by the target */
           (fsrv->uses_crash_exitcode &&
            WEXITSTATUS(fsrv->child_status) == fsrv->crash_exitcode))) {
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 48f3289d..e505abd4 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -2502,7 +2502,6 @@ void check_asan_opts(afl_state_t *afl) {
 
   }
 
-
 }
 
 /* Handle stop signal (Ctrl-C, etc). */
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 6aad748c..6656712a 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -763,7 +763,7 @@ static void set_up_environment(afl_forkserver_t *fsrv, char **argv) {
                          "handle_sigfpe=0:"
                          "handle_sigill=0", 0);
 
-   setenv("LSAN_OPTIONS",
+  setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
          "fast_unwind_on_malloc=0:"
          "symbolize=0:"
-- 
cgit 1.4.1


From 9c517199b25e5fb43c38737021002249fd506ad7 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Thu, 8 Apr 2021 10:03:36 +0200
Subject: removed -lc++ linking for lto

---
 src/afl-cc.c | 3 ---
 1 file changed, 3 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/src/afl-cc.c b/src/afl-cc.c
index 3af31b3c..1f89bac5 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -430,9 +430,6 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
     cc_params[cc_par_cnt++] = "-Wno-unused-command-line-argument";
 
-    if (lto_mode && plusplus_mode)
-      cc_params[cc_par_cnt++] = "-lc++";  // needed by fuzzbench, early
-
     if (lto_mode && have_instr_env) {
 
       cc_params[cc_par_cnt++] = "-Xclang";
-- 
cgit 1.4.1