From 1334851e7c35bf7bf35db0dc2a974b2e0249d8f8 Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Mon, 4 Jul 2022 09:59:47 +0200 Subject: cmplog support for gcc_plugin by adacore --- src/afl-cc.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) (limited to 'src/afl-cc.c') diff --git a/src/afl-cc.c b/src/afl-cc.c index 4a56169f..96342659 100644 --- a/src/afl-cc.c +++ b/src/afl-cc.c @@ -422,8 +422,24 @@ static void edit_params(u32 argc, char **argv, char **envp) { if (compiler_mode == GCC_PLUGIN) { - char *fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-pass.so", obj_path); - cc_params[cc_par_cnt++] = fplugin_arg; + char *fplugin_arg; + + if (cmplog_mode) + { + fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-cmplog-pass.so", + obj_path); + cc_params[cc_par_cnt++] = fplugin_arg; + fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-cmptrs-pass.so", + obj_path); + cc_params[cc_par_cnt++] = fplugin_arg; + } + else + { + fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-pass.so", + obj_path); + cc_params[cc_par_cnt++] = fplugin_arg; + } + cc_params[cc_par_cnt++] = "-fno-if-conversion"; cc_params[cc_par_cnt++] = "-fno-if-conversion2"; @@ -1879,6 +1895,7 @@ int main(int argc, char **argv, char **envp) { if (have_gcc_plugin) SAYF( "\nGCC Plugin-specific environment variables:\n" + " AFL_GCC_CMPLOG: log operands of comparisons (RedQueen mutator)\n" " AFL_GCC_OUT_OF_LINE: disable inlined instrumentation\n" " AFL_GCC_SKIP_NEVERZERO: do not skip zero on trace counters\n" " AFL_GCC_INSTRUMENT_FILE: enable selective instrumentation by " @@ -2149,9 +2166,7 @@ int main(int argc, char **argv, char **envp) { } - cmplog_mode = getenv("AFL_CMPLOG") || getenv("AFL_LLVM_CMPLOG"); - if (!be_quiet && cmplog_mode) - printf("CmpLog mode by \n"); + cmplog_mode = getenv("AFL_CMPLOG") || getenv("AFL_LLVM_CMPLOG") || getenv("AFL_GCC_CMPLOG"); #if !defined(__ANDROID__) && !defined(ANDROID) ptr = find_object("afl-compiler-rt.o", argv[0]); -- cgit 1.4.1 From 1759859ae2795ac5538b3a8e682d807d394c663e Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Thu, 7 Jul 2022 09:03:46 +0200 Subject: fix double free on exit for -c 0 on src cmplog --- src/afl-cc.c | 33 +++++++++++++++++---------------- src/afl-fuzz.c | 2 +- 2 files changed, 18 insertions(+), 17 deletions(-) (limited to 'src/afl-cc.c') diff --git a/src/afl-cc.c b/src/afl-cc.c index 96342659..246e01cd 100644 --- a/src/afl-cc.c +++ b/src/afl-cc.c @@ -424,21 +424,21 @@ static void edit_params(u32 argc, char **argv, char **envp) { char *fplugin_arg; - if (cmplog_mode) - { - fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-cmplog-pass.so", - obj_path); - cc_params[cc_par_cnt++] = fplugin_arg; - fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-cmptrs-pass.so", - obj_path); - cc_params[cc_par_cnt++] = fplugin_arg; - } - else - { - fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-pass.so", - obj_path); - cc_params[cc_par_cnt++] = fplugin_arg; - } + if (cmplog_mode) { + + fplugin_arg = + alloc_printf("-fplugin=%s/afl-gcc-cmplog-pass.so", obj_path); + cc_params[cc_par_cnt++] = fplugin_arg; + fplugin_arg = + alloc_printf("-fplugin=%s/afl-gcc-cmptrs-pass.so", obj_path); + cc_params[cc_par_cnt++] = fplugin_arg; + + } else { + + fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-pass.so", obj_path); + cc_params[cc_par_cnt++] = fplugin_arg; + + } cc_params[cc_par_cnt++] = "-fno-if-conversion"; cc_params[cc_par_cnt++] = "-fno-if-conversion2"; @@ -2166,7 +2166,8 @@ int main(int argc, char **argv, char **envp) { } - cmplog_mode = getenv("AFL_CMPLOG") || getenv("AFL_LLVM_CMPLOG") || getenv("AFL_GCC_CMPLOG"); + cmplog_mode = getenv("AFL_CMPLOG") || getenv("AFL_LLVM_CMPLOG") || + getenv("AFL_GCC_CMPLOG"); #if !defined(__ANDROID__) && !defined(ANDROID) ptr = find_object("afl-compiler-rt.o", argv[0]); diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index b23cef37..18367cf2 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -1469,7 +1469,7 @@ int main(int argc, char **argv_orig, char **envp) { if (afl->shm.cmplog_mode && (!strcmp("-", afl->cmplog_binary) || !strcmp("0", afl->cmplog_binary))) { - afl->cmplog_binary = argv[optind]; + afl->cmplog_binary = strdup(argv[optind]); } -- cgit 1.4.1