From a0e884cf8bffe1a0394d106375f6a23edd2b60e6 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 15 Jan 2021 16:56:40 +0100
Subject: merge cmplog

---
 src/afl-cc.c | 49 ++++++++++++++++++++++---------------------------
 1 file changed, 22 insertions(+), 27 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/src/afl-cc.c b/src/afl-cc.c
index 8fb42718..02c9c7c5 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -528,10 +528,10 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
         cc_params[cc_par_cnt++] = alloc_printf(
             "-Wl,-mllvm=-load=%s/cmplog-routines-pass.so", obj_path);
-        cc_params[cc_par_cnt++] = alloc_printf(
-            "-Wl,-mllvm=-load=%s/split-switches-pass.so", obj_path);
         cc_params[cc_par_cnt++] = alloc_printf(
             "-Wl,-mllvm=-load=%s/cmplog-instructions-pass.so", obj_path);
+        cc_params[cc_par_cnt++] = alloc_printf(
+            "-Wl,-mllvm=-load=%s/split-switches-pass.so", obj_path);
 
       } else {
 
@@ -541,18 +541,18 @@ static void edit_params(u32 argc, char **argv, char **envp) {
         cc_params[cc_par_cnt++] =
             alloc_printf("%s/cmplog-routines-pass.so", obj_path);
 
-        // reuse split switches from laf
         cc_params[cc_par_cnt++] = "-Xclang";
         cc_params[cc_par_cnt++] = "-load";
         cc_params[cc_par_cnt++] = "-Xclang";
         cc_params[cc_par_cnt++] =
-            alloc_printf("%s/split-switches-pass.so", obj_path);
+            alloc_printf("%s/cmplog-instructions-pass.so", obj_path);
 
+        // reuse split switches from laf
         cc_params[cc_par_cnt++] = "-Xclang";
         cc_params[cc_par_cnt++] = "-load";
         cc_params[cc_par_cnt++] = "-Xclang";
         cc_params[cc_par_cnt++] =
-            alloc_printf("%s/cmplog-instructions-pass.so", obj_path);
+            alloc_printf("%s/split-switches-pass.so", obj_path);
 
       }
 
@@ -792,10 +792,8 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   }
 
-#if defined(USEMMAP)
-  #if !defined(__HAIKU__)
+#if defined(USEMMAP) && !defined(__HAIKU__)
   cc_params[cc_par_cnt++] = "-lrt";
-  #endif
 #endif
 
   cc_params[cc_par_cnt++] = "-D__AFL_HAVE_MANUAL_CONTROL=1";
@@ -858,6 +856,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
   cc_params[cc_par_cnt++] =
       "-D__AFL_COVERAGE_DISCARD()=__afl_coverage_discard()";
   cc_params[cc_par_cnt++] = "-D__AFL_COVERAGE_ABORT()=__afl_coverage_abort()";
+
   cc_params[cc_par_cnt++] =
       "-D__AFL_FUZZ_TESTCASE_BUF=(__afl_fuzz_ptr ? __afl_fuzz_ptr : "
       "__afl_fuzz_alt_ptr)";
@@ -967,10 +966,8 @@ static void edit_params(u32 argc, char **argv, char **envp) {
           alloc_printf("-Wl,--dynamic-list=%s/dynamic_list.txt", obj_path);
   #endif
 
-  #if defined(USEMMAP)
-    #if !defined(__HAIKU__)
+  #if defined(USEMMAP) && !defined(__HAIKU__)
     cc_params[cc_par_cnt++] = "-lrt";
-    #endif
   #endif
 
   }
@@ -1278,7 +1275,6 @@ int main(int argc, char **argv, char **envp) {
 
       }
 
-      // this is a hidden option
       if (strncasecmp(ptr2, "llvmnative", strlen("llvmnative")) == 0 ||
           strncasecmp(ptr2, "llvm-native", strlen("llvm-native")) == 0) {
 
@@ -1349,29 +1345,28 @@ int main(int argc, char **argv, char **envp) {
 
       if (strncasecmp(ptr2, "ngram", strlen("ngram")) == 0) {
 
-        ptr2 += strlen("ngram");
-        while (*ptr2 && (*ptr2 < '0' || *ptr2 > '9'))
-          ptr2++;
+        u8 *ptr3 = ptr2 + strlen("ngram");
+        while (*ptr3 && (*ptr3 < '0' || *ptr3 > '9'))
+          ptr3++;
 
-        if (!*ptr2) {
+        if (!*ptr3) {
 
-          if ((ptr2 = getenv("AFL_LLVM_NGRAM_SIZE")) == NULL)
+          if ((ptr3 = getenv("AFL_LLVM_NGRAM_SIZE")) == NULL)
             FATAL(
                 "you must set the NGRAM size with (e.g. for value 2) "
                 "AFL_LLVM_INSTRUMENT=ngram-2");
 
         }
 
-        ngram_size = atoi(ptr2);
+        ngram_size = atoi(ptr3);
         if (ngram_size < 2 || ngram_size > NGRAM_SIZE_MAX)
           FATAL(
               "NGRAM instrumentation option must be between 2 and "
-              "NGRAM_SIZE_MAX "
-              "(%u)",
+              "NGRAM_SIZE_MAX (%u)",
               NGRAM_SIZE_MAX);
         instrument_opt_mode |= (INSTRUMENT_OPT_NGRAM);
-        ptr2 = alloc_printf("%u", ngram_size);
-        setenv("AFL_LLVM_NGRAM_SIZE", ptr2, 1);
+        u8 *ptr4 = alloc_printf("%u", ngram_size);
+        setenv("AFL_LLVM_NGRAM_SIZE", ptr4, 1);
 
       }
 
@@ -1507,6 +1502,7 @@ int main(int argc, char **argv, char **envp) {
         "((instrumentation/README.ngram.md)\n"
         "  INSTRIM: Dominator tree (for LLVM <= 6.0) "
         "(instrumentation/README.instrim.md)\n\n");
+
 #undef NATIVE_MSG
 
     SAYF(
@@ -1641,16 +1637,15 @@ int main(int argc, char **argv, char **envp) {
     if (have_lto)
       SAYF("afl-cc LTO with ld=%s %s\n", AFL_REAL_LD, AFL_CLANG_FLTO);
     if (have_llvm)
-      SAYF("afl-cc LLVM version %d using binary path \"%s\".\n", LLVM_MAJOR,
+      SAYF("afl-cc LLVM version %d using the binary path \"%s\".\n", LLVM_MAJOR,
            LLVM_BINDIR);
 #endif
 
-#if defined(USEMMAP)
+#ifdef USEMMAP
   #if !defined(__HAIKU__)
-    cc_params[cc_par_cnt++] = "-lrt";
-    SAYF("Compiled with shm_open support (adds -lrt when linking).\n");
-  #else
     SAYF("Compiled with shm_open support.\n");
+  #else
+    SAYF("Compiled with shm_open support (adds -lrt when linking).\n");
   #endif
 #else
     SAYF("Compiled with shmat support.\n");
-- 
cgit 1.4.1


From a8b06291630d5e4b71ab1eb2fee856c1c576bf4b Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 18 Jan 2021 09:26:16 +0100
Subject: introspection, favor extint over long double

---
 src/afl-cc.c            |   3 +-
 src/afl-fuzz-redqueen.c | 202 +++++++++---------------------------------------
 2 files changed, 38 insertions(+), 167 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/src/afl-cc.c b/src/afl-cc.c
index 02c9c7c5..d44f069a 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -683,6 +683,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     if (!strncmp(cur, "--afl", 5)) continue;
     if (lto_mode && !strncmp(cur, "-fuse-ld=", 9)) continue;
     if (lto_mode && !strncmp(cur, "--ld-path=", 10)) continue;
+    if (!strncmp(cur, "-fno-unroll", 11)) continue;
     if (!strcmp(cur, "-Wl,-z,defs") || !strcmp(cur, "-Wl,--no-undefined"))
       continue;
 
@@ -703,7 +704,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     if (!strcmp(cur, "-shared")) shared_linking = 1;
 
     if (!strncmp(cur, "-O", 2)) have_o = 1;
-    if (!strncmp(cur, "-f", 2) && strstr(cur, "unroll-loop")) have_unroll = 1;
+    if (!strncmp(cur, "-funroll-loop", 13)) have_unroll = 1;
 
     cc_params[cc_par_cnt++] = cur;
 
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index 56246d6e..3cfe05bc 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -31,6 +31,7 @@
 #define _DEBUG
 #define COMBINE
 #define CMPLOG_INTROSPECTION
+#define ARITHMETIC_LESSER_GREATER
 
 ///// Colorization
 
@@ -375,6 +376,7 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len,
 
 #if defined(_DEBUG) || defined(CMPLOG_INTROSPECTION)
   FILE *f = stderr;
+  #ifndef _DEBUG
   if (afl->not_on_tty) {
 
     char fn[4096];
@@ -383,6 +385,8 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len,
 
   }
 
+  #endif
+
   if (f) {
 
     fprintf(
@@ -393,7 +397,9 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len,
         afl->queue_cur->colorized, afl->stage_cur, new_hit_cnt - orig_hit_cnt,
         positions);
 
+  #ifndef _DEBUG
     if (afl->not_on_tty) { fclose(f); }
+  #endif
 
   }
 
@@ -758,11 +764,15 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
   // here we add and subract 1 from the value, but only if it is not an
   // == or != comparison
-  // Bits: 1 = Equal, 2 = Greater, 3 = Lesser, 4 = Float
+  // Bits: 1 = Equal, 2 = Greater, 4 = Lesser, 8 = Float
+  //       16 = modified float, 32 = modified integer (modified = wont match
+  //                                                   in original buffer)
 
+#ifdef ARITHMETIC_LESSER_GREATER
   if (lvl < 4) { return 0; }
 
-  if (attr >= 8 && attr < 16) {  // lesser/greater integer comparison
+  // lesser/greater FP comparison
+  if (!(attr & 1) && (attr & 6) && (attr >= 8 && attr < 16)) {
 
     u64 repl_new;
     if (SHAPE_BYTES(h->shape) == 4 && its_len >= 4) {
@@ -836,11 +846,11 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
       double *f = (double *)&repl;
       float   g = (float)*f;
       repl_new = 0;
-#if (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
+  #if (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
       memcpy((char *)&repl_new, (char *)&g, 4);
-#else
+  #else
       memcpy(((char *)&repl_new) + 4, (char *)&g, 4);
-#endif
+  #endif
       changed_val = repl_new;
       h->shape = 3;  // modify shape
 
@@ -850,7 +860,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
               afl, h, pattern, repl_new, o_pattern, changed_val, 16, idx,
               taint_len, orig_buf, buf, cbuf, len, 1, lvl, status))) {
 
-        h->shape = 7;
+        h->shape = 7;  // recover shape
         return 1;
 
       }
@@ -859,7 +869,9 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
     }
 
-  } else if (attr > 1 && attr < 8) {  // lesser/greater integer comparison
+  } else if (!(attr & 1) && (attr & 6) && attr < 8) {
+
+    // lesser/greater integer comparison
 
     u64 repl_new;
 
@@ -885,6 +897,8 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
   }
 
+#endif                                         /* ARITHMETIC_LESSER_GREATER */
+
   return 0;
 
 }
@@ -1057,89 +1071,6 @@ static u8 cmp_extend_encodingN(afl_state_t *afl, struct cmp_header *h,
 
 }
 
-// uh a pointer read from (long double*) reads 12 bytes, not 10 ...
-// so lets make this complicated.
-static u8 cmp_extend_encoding_ld(afl_state_t *afl, struct cmp_header *h,
-                                 u8 *pattern, u8 *repl, u8 *o_pattern,
-                                 u8 *changed_val, u8 attr, u32 idx,
-                                 u32 taint_len, u8 *orig_buf, u8 *buf, u8 *cbuf,
-                                 u32 len, u8 do_reverse, u8 lvl, u8 *status) {
-
-  u8 *buf_ld = &buf[idx], *o_buf_ld = &orig_buf[idx], backup[10];
-  u32 its_len = MIN(len - idx, taint_len);
-
-  if (its_len >= 10) {
-
-#ifdef _DEBUG
-    fprintf(stderr, "TestUld: %u>=10 (len=%u idx=%u attr=%u) (%u)\n", its_len,
-            len, idx, attr, do_reverse);
-    fprintf(stderr, "TestUld: ");
-    u32 i;
-    for (i = 0; i < 10; i++)
-      fprintf(stderr, "%02x", pattern[i]);
-    fprintf(stderr, "==");
-    for (i = 0; i < 10; i++)
-      fprintf(stderr, "%02x", buf_ld[i]);
-    fprintf(stderr, " ");
-    for (i = 0; i < 10; i++)
-      fprintf(stderr, "%02x", o_pattern[i]);
-    fprintf(stderr, "==");
-    for (i = 0; i < 10; i++)
-      fprintf(stderr, "%02x", o_buf_ld[i]);
-    fprintf(stderr, " <= ");
-    for (i = 0; i < 10; i++)
-      fprintf(stderr, "%02x", repl[i]);
-    fprintf(stderr, "==");
-    for (i = 0; i < 10; i++)
-      fprintf(stderr, "%02x", changed_val[i]);
-    fprintf(stderr, "\n");
-#endif
-
-    if (!memcmp(pattern, buf_ld, 10) && !memcmp(o_pattern, o_buf_ld, 10)) {
-
-      // if this is an fcmp (attr & 8 == 8) then do not compare the patterns -
-      // due to a bug in llvm dynamic float bitcasts do not work :(
-      // the value 16 means this is a +- 1.0 test case
-
-      memcpy(backup, buf_ld, 10);
-      memcpy(buf_ld, repl, 10);
-      if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
-#ifdef COMBINE
-      if (*status == 1) { memcpy(cbuf + idx, repl, 10); }
-#endif
-      memcpy(buf_ld, backup, 10);
-
-#ifdef _DEBUG
-      fprintf(stderr, "Status=%u\n", *status);
-#endif
-
-    }
-
-  }
-
-  // reverse encoding
-  if (do_reverse && *status != 1) {
-
-    u8 sp[10], sr[10], osp[10], osr[10];
-    SWAPNN(sp, pattern, 10);
-    SWAPNN(sr, repl, 10);
-    SWAPNN(osp, o_pattern, 10);
-    SWAPNN(osr, changed_val, 10);
-
-    if (unlikely(cmp_extend_encoding_ld(afl, h, sp, sr, osp, osr, attr, idx,
-                                        taint_len, orig_buf, buf, cbuf, len, 0,
-                                        lvl, status))) {
-
-      return 1;
-
-    }
-
-  }
-
-  return 0;
-
-}
-
 static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
 
   u8 *b = (u8 *)&v;
@@ -1273,7 +1204,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
   struct cmp_header *h = &afl->shm.cmp_map->headers[key];
   struct tainted *   t;
   u32                i, j, idx, taint_len;
-  u32                have_taint = 1, is_128 = 0, is_n = 0, is_ld = 0;
+  u32                have_taint = 1, is_128 = 0, is_n = 0;
   u32                loggeds = h->hits;
   if (h->hits > CMP_MAP_H) { loggeds = CMP_MAP_H; }
 
@@ -1281,12 +1212,11 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
   u8 found_one = 0;
 
   /* loop cmps are useless, detect and ignore them */
-  u128        s128_v0 = 0, s128_v1 = 0, orig_s128_v0 = 0, orig_s128_v1 = 0;
-  long double ld0, ld1, o_ld0, o_ld1;
-  u64         s_v0, s_v1;
-  u8          s_v0_fixed = 1, s_v1_fixed = 1;
-  u8          s_v0_inc = 1, s_v1_inc = 1;
-  u8          s_v0_dec = 1, s_v1_dec = 1;
+  u128 s128_v0 = 0, s128_v1 = 0, orig_s128_v0 = 0, orig_s128_v1 = 0;
+  u64  s_v0, s_v1;
+  u8   s_v0_fixed = 1, s_v1_fixed = 1;
+  u8   s_v0_inc = 1, s_v1_inc = 1;
+  u8   s_v0_dec = 1, s_v1_dec = 1;
 
   switch (SHAPE_BYTES(h->shape)) {
 
@@ -1298,9 +1228,6 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
     case 16:
       is_128 = 1;
       break;
-    case 10:
-      if (h->attribute & 8) { is_ld = 1; }
-      // fall through
     default:
       is_n = 1;
 
@@ -1376,24 +1303,6 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
       orig_s128_v0 = ((u128)orig_o->v0) + (((u128)orig_o->v0_128) << 64);
       orig_s128_v1 = ((u128)orig_o->v1) + (((u128)orig_o->v1_128) << 64);
 
-      if (is_ld) {
-
-#if (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
-        memcpy((char *)&ld0, (char *)&s128_v0, sizeof(long double));
-        memcpy((char *)&ld1, (char *)&s128_v1, sizeof(long double));
-        memcpy((char *)&o_ld0, (char *)&orig_s128_v0, sizeof(long double));
-        memcpy((char *)&o_ld1, (char *)&orig_s128_v1, sizeof(long double));
-#else
-        memcpy((char *)&ld0, (char *)(&s128_v0) + 6, sizeof(long double));
-        memcpy((char *)&ld1, (char *)(&s128_v1) + 6, sizeof(long double));
-        memcpy((char *)&o_ld0, (char *)(&orig_s128_v0) + 6,
-               sizeof(long double));
-        memcpy((char *)&o_ld1, (char *)(&orig_s128_v1) + 6,
-               sizeof(long double));
-#endif
-
-      }
-
     }
 
     for (idx = 0; idx < len; ++idx) {
@@ -1420,51 +1329,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
 
       status = 0;
 
-      if (is_ld) {  // long double special case
-
-        if (ld0 != o_ld0 && o_ld1 != o_ld0) {
-
-          if (unlikely(cmp_extend_encoding_ld(
-                  afl, h, (u8 *)&ld0, (u8 *)&ld1, (u8 *)&o_ld0, (u8 *)&o_ld1,
-                  h->attribute, idx, taint_len, orig_buf, buf, cbuf, len, 1,
-                  lvl, &status))) {
-
-            return 1;
-
-          }
-
-        }
-
-        if (status == 1) {
-
-          found_one = 1;
-          break;
-
-        }
-
-        if (ld1 != o_ld1 && o_ld0 != o_ld1) {
-
-          if (unlikely(cmp_extend_encoding_ld(
-                  afl, h, (u8 *)&ld1, (u8 *)&ld0, (u8 *)&o_ld1, (u8 *)&o_ld0,
-                  h->attribute, idx, taint_len, orig_buf, buf, cbuf, len, 1,
-                  lvl, &status))) {
-
-            return 1;
-
-          }
-
-        }
-
-        if (status == 1) {
-
-          found_one = 1;
-          break;
-
-        }
-
-      } else
-
-          if (is_n) {  // _ExtInt special case
+      if (is_n) {  // _ExtInt special case
 
         if (s128_v0 != orig_s128_v0 && orig_s128_v0 != orig_s128_v1) {
 
@@ -1552,7 +1417,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
 
       }
 
-      // even for u128 and long double do cmp_extend_encoding() because
+      // even for u128 and _ExtInt we do cmp_extend_encoding() because
       // if we got here their own special trials failed and it might just be
       // a cast from e.g. u64 to u128 from the input data.
 
@@ -1995,7 +1860,7 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
 
       }
 
-    } else {
+    } else if (lvl & 1) {
 
       if (unlikely(rtn_fuzz(afl, k, orig_buf, buf, cbuf, len, taint))) {
 
@@ -2064,7 +1929,7 @@ exit_its:
   #else
   u32 *v = (u64 *)afl->virgin_bits;
   u32 *s = (u64 *)virgin_save;
-  u32  i;
+  u32 i;
   for (i = 0; i < (afl->shm.map_size >> 2); i++) {
 
     v[i] &= s[i];
@@ -2094,6 +1959,7 @@ exit_its:
 
 #if defined(_DEBUG) || defined(CMPLOG_INTROSPECTION)
   FILE *f = stderr;
+  #ifndef _DEBUG
   if (afl->not_on_tty) {
 
     char fn[4096];
@@ -2102,6 +1968,8 @@ exit_its:
 
   }
 
+  #endif
+
   if (f) {
 
     fprintf(f,
@@ -2109,7 +1977,9 @@ exit_its:
             afl->queue_cur->fname, len, get_cur_time() - start_time, r,
             new_hit_cnt - orig_hit_cnt, cmp_locations);
 
+  #ifndef _DEBUG
     if (afl->not_on_tty) { fclose(f); }
+  #endif
 
   }
 
-- 
cgit 1.4.1


From 0d472adef0cbe68cec128b7b15e508f0bb05455d Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 21 Jan 2021 12:02:50 +0100
Subject: temp conflict resolve

---
 src/afl-cc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/src/afl-cc.c b/src/afl-cc.c
index d44f069a..2ce986c7 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -856,8 +856,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
   cc_params[cc_par_cnt++] = "-D__AFL_COVERAGE_OFF()=__afl_coverage_off()";
   cc_params[cc_par_cnt++] =
       "-D__AFL_COVERAGE_DISCARD()=__afl_coverage_discard()";
-  cc_params[cc_par_cnt++] = "-D__AFL_COVERAGE_ABORT()=__afl_coverage_abort()";
-
+  cc_params[cc_par_cnt++] = "-D__AFL_COVERAGE_SKIP()=__afl_coverage_skip()";
   cc_params[cc_par_cnt++] =
       "-D__AFL_FUZZ_TESTCASE_BUF=(__afl_fuzz_ptr ? __afl_fuzz_ptr : "
       "__afl_fuzz_alt_ptr)";
-- 
cgit 1.4.1


From b850951c726258053c5635d6597704cf346fe3c4 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 21 Jan 2021 17:15:14 +0100
Subject: code format and not setting sanitizers if debug and settings present

---
 src/afl-cc.c          |  8 ++++----
 src/afl-forkserver.c  | 53 +++++++++++++++++++++++++++------------------------
 src/afl-fuzz-bitmap.c |  6 +-----
 src/afl-fuzz-stats.c  |  2 ++
 src/afl-fuzz.c        | 12 ++++++++----
 src/afl-ld-lto.c      |  2 +-
 6 files changed, 44 insertions(+), 39 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/src/afl-cc.c b/src/afl-cc.c
index b0b11f48..8e7af0f9 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -586,9 +586,9 @@ static void edit_params(u32 argc, char **argv, char **envp) {
       if (instrument_mode == INSTRUMENT_PCGUARD) {
 
 #if LLVM_MAJOR > 10 || (LLVM_MAJOR == 10 && LLVM_MINOR > 0)
-#ifdef __ANDROID__
+  #ifdef __ANDROID__
         cc_params[cc_par_cnt++] = "-fsanitize-coverage=trace-pc-guard";
-#else
+  #else
         if (have_instr_list) {
 
           if (!be_quiet)
@@ -608,7 +608,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
         }
 
-#endif
+  #endif
 #else
   #if LLVM_MAJOR >= 4
         if (!be_quiet)
@@ -1036,7 +1036,7 @@ int main(int argc, char **argv, char **envp) {
 #endif
 
 #ifdef __ANDROID__
-    have_llvm = 1;
+  have_llvm = 1;
 #endif
 
   if ((ptr = find_object("afl-gcc-pass.so", argv[0])) != NULL) {
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 50e4139b..d4484de7 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -484,38 +484,41 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
     /* Set sane defaults for ASAN if nothing else specified. */
 
-    setenv("ASAN_OPTIONS",
-           "abort_on_error=1:"
-           "detect_leaks=0:"
-           "malloc_context_size=0:"
-           "symbolize=0:"
-           "allocator_may_return_null=1:"
-           "handle_segv=0:"
-           "handle_sigbus=0:"
-           "handle_abort=0:"
-           "handle_sigfpe=0:"
-           "handle_sigill=0",
-           0);
+    if (!afl->debug || !getenv("ASAN_OPTIONS"))
+      setenv("ASAN_OPTIONS",
+             "abort_on_error=1:"
+             "detect_leaks=0:"
+             "malloc_context_size=0:"
+             "symbolize=0:"
+             "allocator_may_return_null=1:"
+             "handle_segv=0:"
+             "handle_sigbus=0:"
+             "handle_abort=0:"
+             "handle_sigfpe=0:"
+             "handle_sigill=0",
+             0);
 
     /* Set sane defaults for UBSAN if nothing else specified. */
 
-    setenv("UBSAN_OPTIONS",
-           "halt_on_error=1:"
-           "abort_on_error=1:"
-           "malloc_context_size=0:"
-           "allocator_may_return_null=1:"
-           "symbolize=0:"
-           "handle_segv=0:"
-           "handle_sigbus=0:"
-           "handle_abort=0:"
-           "handle_sigfpe=0:"
-           "handle_sigill=0",
-           0);
+    if (!afl->debug || !getenv("UBSAN_OPTIONS"))
+      setenv("UBSAN_OPTIONS",
+             "halt_on_error=1:"
+             "abort_on_error=1:"
+             "malloc_context_size=0:"
+             "allocator_may_return_null=1:"
+             "symbolize=0:"
+             "handle_segv=0:"
+             "handle_sigbus=0:"
+             "handle_abort=0:"
+             "handle_sigfpe=0:"
+             "handle_sigill=0",
+             0);
 
     /* MSAN is tricky, because it doesn't support abort_on_error=1 at this
        point. So, we do this in a very hacky way. */
 
-    setenv("MSAN_OPTIONS",
+    if (!afl->debug || !getenv("MSAN_OPTIONS"))
+      setenv("MSAN_OPTIONS",
            "exit_code=" STRINGIFY(MSAN_ERROR) ":"
            "symbolize=0:"
            "abort_on_error=1:"
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 586f3990..0c4a114e 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -700,11 +700,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
 
       if (likely(!afl->non_instrumented_mode)) {
 
-        if (!classified) {
-
-          classify_counts(&afl->fsrv);
-
-        }
+        if (!classified) { classify_counts(&afl->fsrv); }
 
         simplify_trace(afl, afl->fsrv.trace_bits);
 
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index e67bace9..82da8176 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -60,8 +60,10 @@ void write_setup_file(afl_state_t *afl, u32 argc, char **argv) {
     if (i) fprintf(f, " ");
 #ifdef __ANDROID__
     if (memchr(argv[i], '\'', sizeof(argv[i]))) {
+
 #else
     if (index(argv[i], '\'')) {
+
 #endif
 
       fprintf(f, "'");
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 9a8159bd..2a59bbe4 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -123,7 +123,8 @@ static void usage(u8 *argv0, int more_help) {
       "it.\n"
       "                  if using QEMU, just use -c 0.\n"
       "  -l cmplog_level - set the complexity/intensivity of CmpLog.\n"
-      "                  Values: 1 (integer+string), 2 (+FP) and 3 (+transform)\n\n"
+      "                  Values: 1 (integer+string), 2 (+FP) and 3 "
+      "(+transform)\n\n"
 
       "Fuzzing behavior settings:\n"
       "  -Z            - sequential queue selection instead of weighted "
@@ -584,7 +585,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
         if (afl->timeout_given) { FATAL("Multiple -t options not supported"); }
 
-        if (!optarg || sscanf(optarg, "%u%c", &afl->fsrv.exec_tmout, &suffix) < 1 ||
+        if (!optarg ||
+            sscanf(optarg, "%u%c", &afl->fsrv.exec_tmout, &suffix) < 1 ||
             optarg[0] == '-') {
 
           FATAL("Bad syntax used for -t");
@@ -766,7 +768,8 @@ int main(int argc, char **argv_orig, char **envp) {
       case 'V': {
 
         afl->most_time_key = 1;
-        if (!optarg || sscanf(optarg, "%llu", &afl->most_time) < 1 || optarg[0] == '-') {
+        if (!optarg || sscanf(optarg, "%llu", &afl->most_time) < 1 ||
+            optarg[0] == '-') {
 
           FATAL("Bad syntax used for -V");
 
@@ -777,7 +780,8 @@ int main(int argc, char **argv_orig, char **envp) {
       case 'E': {
 
         afl->most_execs_key = 1;
-        if (!optarg || sscanf(optarg, "%llu", &afl->most_execs) < 1 || optarg[0] == '-') {
+        if (!optarg || sscanf(optarg, "%llu", &afl->most_execs) < 1 ||
+            optarg[0] == '-') {
 
           FATAL("Bad syntax used for -E");
 
diff --git a/src/afl-ld-lto.c b/src/afl-ld-lto.c
index 0671d1c4..49c04e4a 100644
--- a/src/afl-ld-lto.c
+++ b/src/afl-ld-lto.c
@@ -252,7 +252,7 @@ static void edit_params(int argc, char **argv) {
 
 int main(int argc, char **argv) {
 
-  s32 pid, i, status;
+  s32  pid, i, status;
   char thecwd[PATH_MAX];
 
   if (getenv("AFL_LD_CALLER") != NULL) {
-- 
cgit 1.4.1


From 2a9fcd2a87bf11bc019c8d6be2b6eda77b772ee2 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 28 Jan 2021 18:01:27 +0100
Subject: warn on afl-gcc/afl-clang instrumentation

---
 src/afl-cc.c | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'src/afl-cc.c')

diff --git a/src/afl-cc.c b/src/afl-cc.c
index 8e7af0f9..ff0f3c07 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -1788,6 +1788,15 @@ int main(int argc, char **argv, char **envp) {
 
   }
 
+  if (!be_quiet && (compiler_mode == GCC || compiler_mode == CLANG)) {
+
+    WARNF(
+        "You are using outdated instrumentation, install LLVM and/or "
+        "gcc-plugin and use afl-clang-fast/afl-clang-lto/afl-gcc-fast "
+        "instead!");
+
+  }
+
   if (debug) {
 
     DEBUGF("cd '%s';", getthecwd());
-- 
cgit 1.4.1


From ce673ccab3f2ca438f879c1d2e63988eb9737a35 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 28 Jan 2021 19:19:57 +0100
Subject: remove snapshot reference

---
 src/afl-cc.c | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/src/afl-cc.c b/src/afl-cc.c
index ff0f3c07..b5dcb632 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -1438,34 +1438,34 @@ int main(int argc, char **argv, char **envp) {
         "  CC=afl-cc CXX=afl-c++ meson\n\n");
 
     SAYF(
-        "                                     |---------------- FEATURES "
-        "---------------|\n"
-        "MODES:                                NCC PERSIST SNAP DICT   LAF "
+        "                                       |------------- FEATURES "
+        "-------------|\n"
+        "MODES:                                  NCC PERSIST DICT   LAF "
         "CMPLOG SELECT\n"
         "  [LTO] llvm LTO:          %s%s\n"
-        "      PCGUARD              DEFAULT    yes yes     yes  yes    yes yes "
+        "      PCGUARD              DEFAULT      yes yes     yes    yes yes "
         "   yes\n"
-        "      CLASSIC                         yes yes     yes  yes    yes yes "
+        "      CLASSIC                           yes yes     yes    yes yes "
         "   yes\n"
         "  [LLVM] llvm:             %s%s\n"
-        "      PCGUARD              %s    yes yes     yes  module yes yes    "
+        "      PCGUARD              %s      yes yes     module yes yes    "
         "extern\n"
-        "      CLASSIC              %s    no  yes     yes  module yes yes    "
+        "      CLASSIC              %s      no  yes     module yes yes    "
         "yes\n"
         "        - NORMAL\n"
         "        - CTX\n"
         "        - NGRAM-{2-16}\n"
-        "      INSTRIM                         no  yes     yes  module yes yes "
+        "      INSTRIM                           no  yes     module yes yes "
         "   yes\n"
         "        - NORMAL\n"
         "        - CTX\n"
         "        - NGRAM-{2-16}\n"
         "  [GCC_PLUGIN] gcc plugin: %s%s\n"
-        "      CLASSIC              DEFAULT    no  yes     yes  no     no  no  "
-        "   yes\n"
+        "      CLASSIC              DEFAULT      no  yes     no     no  no     "
+        "yes\n"
         "  [GCC/CLANG] simple gcc/clang: %s%s\n"
-        "      CLASSIC              DEFAULT    no  no      no   no     no  no  "
-        "   no\n\n",
+        "      CLASSIC              DEFAULT      no  no      no     no  no     "
+        "no\n\n",
         have_lto ? "AVAILABLE" : "unavailable!",
         compiler_mode == LTO ? " [SELECTED]" : "",
         have_llvm ? "AVAILABLE" : "unavailable!",
@@ -1520,9 +1520,6 @@ int main(int argc, char **argv, char **envp) {
         "          (instrumentation/README.lto.md)\n"
         "  PERSIST: persistent mode support [code] (huge speed increase!)\n"
         "          (instrumentation/README.persistent_mode.md)\n"
-        "  SNAP:   linux lkm snapshot module support [automatic] (speed "
-        "increase)\n"
-        "          (https://github.com/AFLplusplus/AFL-Snapshot-LKM/)\n"
         "  DICT:   dictionary in the target [yes=automatic or llvm module "
         "pass]\n"
         "          (instrumentation/README.lto.md + "
-- 
cgit 1.4.1


From 7a861498c27997cd7be01a5650d54cff3b87a02e Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 31 Jan 2021 15:04:40 +0100
Subject: added support for __afl_coverage_interesting

---
 docs/Changelog.md                              |  3 ++
 instrumentation/README.instrument_list.md      |  7 +++++
 instrumentation/SanitizerCoverageLTO.so.cc     | 20 ++++++++++++++
 instrumentation/SanitizerCoveragePCGUARD.so.cc | 38 +++++++++++++++++++++++---
 src/afl-cc.c                                   | 16 ++++++-----
 src/afl-fuzz.c                                 |  5 ++--
 6 files changed, 76 insertions(+), 13 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 6e59961b..99bc8b47 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -36,6 +36,9 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - cmplog/redqueen now also tracks floating point, _ExtInt() + 128bit
     - cmplog/redqueen can now process basic libc++ and libstdc++
       std::string comparisons (though no position or length type variants)
+    - added support for __afl_coverage_interesting() for LTO and
+      and our own PCGUARD (llvm 10.0.1+), read more about this function
+      and selective coverage in instrumentation/README.instrument_list.md
     - added AFL_LLVM_INSTRUMENT option NATIVE for native clang pc-guard
       support (less performant than our own), GCC for old afl-gcc and
       CLANG for old afl-clang
diff --git a/instrumentation/README.instrument_list.md b/instrumentation/README.instrument_list.md
index b47b50f6..b7dfb40c 100644
--- a/instrumentation/README.instrument_list.md
+++ b/instrumentation/README.instrument_list.md
@@ -43,6 +43,13 @@ in any function where you want:
   * `__AFL_COVERAGE_DISCARD();` - reset all coverage gathered until this point
   * `__AFL_COVERAGE_SKIP();` - mark this test case as unimportant. Whatever happens, afl-fuzz will ignore it.
 
+A special function is `__afl_coverage_interesting`.
+To use this, you must define `void __afl_coverage_interesting(u8 val, u32 id);`.
+Then you can use this function globally, where the `val` parameter can be set
+by you, the `id` parameter is for afl-fuzz and will be overwritten.
+Note that useful parameters are for `val` are: 1, 2, 3, 4, 8, 16, 32, 64, 128.
+A value of e.g. 33 will be seen as 32 for coverage purposes.
+
 ## 3) Selective instrumenation with AFL_LLVM_ALLOWLIST/AFL_LLVM_DENYLIST
 
 This feature is equivalent to llvm 12 sancov feature and allows to specify
diff --git a/instrumentation/SanitizerCoverageLTO.so.cc b/instrumentation/SanitizerCoverageLTO.so.cc
index 016ac71f..e3490847 100644
--- a/instrumentation/SanitizerCoverageLTO.so.cc
+++ b/instrumentation/SanitizerCoverageLTO.so.cc
@@ -1237,6 +1237,25 @@ void ModuleSanitizerCoverage::instrumentFunction(
 
   for (auto &BB : F) {
 
+    for (auto &IN : BB) {
+
+      CallInst *callInst = nullptr;
+
+      if ((callInst = dyn_cast<CallInst>(&IN))) {
+
+        Function *Callee = callInst->getCalledFunction();
+        if (!Callee) continue;
+        if (callInst->getCallingConv() != llvm::CallingConv::C) continue;
+        StringRef FuncName = Callee->getName();
+        if (FuncName.compare(StringRef("__afl_coverage_interesting"))) continue;
+
+        Value *val = ConstantInt::get(Int32Ty, ++afl_global_id);
+        callInst->setOperand(1, val);
+
+      }
+
+    }
+
     if (shouldInstrumentBlock(F, &BB, DT, PDT, Options))
       BlocksToInstrument.push_back(&BB);
     for (auto &Inst : BB) {
@@ -1338,6 +1357,7 @@ bool ModuleSanitizerCoverage::InjectCoverage(Function &             F,
 
   if (AllBlocks.empty()) return false;
   CreateFunctionLocalArrays(F, AllBlocks);
+
   for (size_t i = 0, N = AllBlocks.size(); i < N; i++) {
 
     // afl++ START
diff --git a/instrumentation/SanitizerCoveragePCGUARD.so.cc b/instrumentation/SanitizerCoveragePCGUARD.so.cc
index ecd6bc9b..5b274770 100644
--- a/instrumentation/SanitizerCoveragePCGUARD.so.cc
+++ b/instrumentation/SanitizerCoveragePCGUARD.so.cc
@@ -311,7 +311,8 @@ class ModuleSanitizerCoverage {
                                                     Function &F, Type *Ty,
                                                     const char *Section);
   GlobalVariable *CreatePCArray(Function &F, ArrayRef<BasicBlock *> AllBlocks);
-  void CreateFunctionLocalArrays(Function &F, ArrayRef<BasicBlock *> AllBlocks);
+  void CreateFunctionLocalArrays(Function &F, ArrayRef<BasicBlock *> AllBlocks,
+                                 uint32_t special);
   void InjectCoverageAtBlock(Function &F, BasicBlock &BB, size_t Idx,
                              bool IsLeafFunc = true);
   Function *CreateInitCallsForSections(Module &M, const char *CtorName,
@@ -970,11 +971,11 @@ GlobalVariable *ModuleSanitizerCoverage::CreatePCArray(
 }
 
 void ModuleSanitizerCoverage::CreateFunctionLocalArrays(
-    Function &F, ArrayRef<BasicBlock *> AllBlocks) {
+    Function &F, ArrayRef<BasicBlock *> AllBlocks, uint32_t special) {
 
   if (Options.TracePCGuard)
     FunctionGuardArray = CreateFunctionLocalArrayInSection(
-        AllBlocks.size(), F, Int32Ty, SanCovGuardsSectionName);
+        AllBlocks.size() + special, F, Int32Ty, SanCovGuardsSectionName);
 
   if (Options.Inline8bitCounters)
     Function8bitCounterArray = CreateFunctionLocalArrayInSection(
@@ -993,9 +994,38 @@ bool ModuleSanitizerCoverage::InjectCoverage(Function &             F,
                                              bool IsLeafFunc) {
 
   if (AllBlocks.empty()) return false;
-  CreateFunctionLocalArrays(F, AllBlocks);
+
+  uint32_t special = 0;
+  for (auto &BB : F) {
+
+    for (auto &IN : BB) {
+
+      CallInst *callInst = nullptr;
+
+      if ((callInst = dyn_cast<CallInst>(&IN))) {
+
+        Function *Callee = callInst->getCalledFunction();
+        StringRef FuncName = Callee->getName();
+        if (!Callee) continue;
+        if (callInst->getCallingConv() != llvm::CallingConv::C) continue;
+        if (FuncName.compare(StringRef("__afl_coverage_interesting"))) continue;
+
+        uint32_t id = 1 + instr + (uint32_t)AllBlocks.size() + special++;
+        Value *  val = ConstantInt::get(Int32Ty, id);
+        callInst->setOperand(1, val);
+
+      }
+
+    }
+
+  }
+
+  CreateFunctionLocalArrays(F, AllBlocks, special);
   for (size_t i = 0, N = AllBlocks.size(); i < N; i++)
     InjectCoverageAtBlock(F, *AllBlocks[i], i, IsLeafFunc);
+
+  instr += special;
+
   return true;
 
 }
diff --git a/src/afl-cc.c b/src/afl-cc.c
index b5dcb632..f513764a 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -572,7 +572,8 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
       cc_params[cc_par_cnt++] = "-Wl,--allow-multiple-definition";
 
-      if (instrument_mode == INSTRUMENT_CFG)
+      if (instrument_mode == INSTRUMENT_CFG ||
+          instrument_mode == INSTRUMENT_PCGUARD)
         cc_params[cc_par_cnt++] = alloc_printf(
             "-Wl,-mllvm=-load=%s/SanitizerCoverageLTO.so", obj_path);
       else
@@ -1670,15 +1671,16 @@ int main(int argc, char **argv, char **envp) {
   if (compiler_mode == LTO) {
 
     if (instrument_mode == 0 || instrument_mode == INSTRUMENT_LTO ||
-        instrument_mode == INSTRUMENT_CFG) {
+        instrument_mode == INSTRUMENT_CFG ||
+        instrument_mode == INSTRUMENT_PCGUARD) {
 
       lto_mode = 1;
-      if (!instrument_mode) {
+      // force CFG
+      // if (!instrument_mode) {
 
-        instrument_mode = INSTRUMENT_CFG;
-        // ptr = instrument_mode_string[instrument_mode];
-
-      }
+      instrument_mode = INSTRUMENT_PCGUARD;
+      // ptr = instrument_mode_string[instrument_mode];
+      // }
 
     } else if (instrument_mode == INSTRUMENT_LTO ||
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 647a665e..82eff61f 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -145,7 +145,8 @@ static void usage(u8 *argv0, int more_help) {
 
       "Other stuff:\n"
       "  -M/-S id      - distributed mode (see docs/parallel_fuzzing.md)\n"
-      "                  -M auto-sets -D, -Z (use -d to disable -D) and no trimming\n"
+      "                  -M auto-sets -D, -Z (use -d to disable -D) and no "
+      "trimming\n"
       "  -F path       - sync to a foreign fuzzer queue directory (requires "
       "-M, can\n"
       "                  be specified up to %u times)\n"
@@ -502,7 +503,7 @@ int main(int argc, char **argv_orig, char **envp) {
         afl->sync_id = ck_strdup(optarg);
         afl->skip_deterministic = 0;  // force deterministic fuzzing
         afl->old_seed_selection = 1;  // force old queue walking seed selection
-        afl->disable_trim = 1;  // disable trimming
+        afl->disable_trim = 1;        // disable trimming
 
         if ((c = strchr(afl->sync_id, ':'))) {
 
-- 
cgit 1.4.1


From b9f469e12fde797e301845caa4b0fd44315318bd Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 1 Feb 2021 20:00:29 +0100
Subject: make some really weird targets compile

---
 src/afl-cc.c   | 1 +
 src/afl-fuzz.c | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/afl-cc.c')

diff --git a/src/afl-cc.c b/src/afl-cc.c
index f513764a..7db3c9a0 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -689,6 +689,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     if (lto_mode && !strncmp(cur, "-fuse-ld=", 9)) continue;
     if (lto_mode && !strncmp(cur, "--ld-path=", 10)) continue;
     if (!strncmp(cur, "-fno-unroll", 11)) continue;
+    if (strstr(cur, "afl-compiler-rt") || strstr(cur, "afl-llvm-rt")) continue;
     if (!strcmp(cur, "-Wl,-z,defs") || !strcmp(cur, "-Wl,--no-undefined"))
       continue;
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 4a23d99d..3a7343ae 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1596,7 +1596,6 @@ int main(int argc, char **argv_orig, char **envp) {
     u32 new_map_size =
         afl_fsrv_get_mapsize(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
                              afl->afl_env.afl_debug_child);
-printf("NEW MAP SIZE2 %u (is %u)\n", new_map_size, map_size);
 
     if (new_map_size && new_map_size != 4194304) {
 
-- 
cgit 1.4.1


From 654f389e73c9fd5b7e141b33ea28ab0fdda3178f Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 1 Feb 2021 23:36:27 +0100
Subject: try to remove warnings during compilation

---
 src/afl-cc.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/src/afl-cc.c b/src/afl-cc.c
index 7db3c9a0..f272f0b5 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -313,7 +313,8 @@ static u8 *find_object(u8 *obj, u8 *argv0) {
 static void edit_params(u32 argc, char **argv, char **envp) {
 
   u8 fortify_set = 0, asan_set = 0, x_set = 0, bit_mode = 0, shared_linking = 0,
-     preprocessor_only = 0, have_unroll = 0, have_o = 0, have_pic = 0;
+     preprocessor_only = 0, have_unroll = 0, have_o = 0, have_pic = 0,
+     have_c = 0;
   u8 *name;
 
   cc_params = ck_alloc((argc + 128) * sizeof(u8 *));
@@ -461,7 +462,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     // laf
     if (getenv("LAF_SPLIT_SWITCHES") || getenv("AFL_LLVM_LAF_SPLIT_SWITCHES")) {
 
-      if (lto_mode) {
+      if (lto_mode && !have_c) {
 
         cc_params[cc_par_cnt++] = alloc_printf(
             "-Wl,-mllvm=-load=%s/split-switches-pass.so", obj_path);
@@ -481,7 +482,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     if (getenv("LAF_TRANSFORM_COMPARES") ||
         getenv("AFL_LLVM_LAF_TRANSFORM_COMPARES")) {
 
-      if (lto_mode) {
+      if (lto_mode && !have_c) {
 
         cc_params[cc_par_cnt++] = alloc_printf(
             "-Wl,-mllvm=-load=%s/compare-transform-pass.so", obj_path);
@@ -501,7 +502,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     if (getenv("LAF_SPLIT_COMPARES") || getenv("AFL_LLVM_LAF_SPLIT_COMPARES") ||
         getenv("AFL_LLVM_LAF_SPLIT_FLOATS")) {
 
-      if (lto_mode) {
+      if (lto_mode && !have_c) {
 
         cc_params[cc_par_cnt++] = alloc_printf(
             "-Wl,-mllvm=-load=%s/split-compares-pass.so", obj_path);
@@ -524,7 +525,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     unsetenv("AFL_LD_CALLER");
     if (cmplog_mode) {
 
-      if (lto_mode) {
+      if (lto_mode && !have_c) {
 
         cc_params[cc_par_cnt++] = alloc_printf(
             "-Wl,-mllvm=-load=%s/cmplog-routines-pass.so", obj_path);
@@ -560,7 +561,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
     }
 
-    if (lto_mode) {
+    if (lto_mode && !have_c) {
 
       u8 *ld_path = strdup(AFL_REAL_LD);
       if (!*ld_path) ld_path = "ld.lld";
@@ -708,6 +709,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     if (!strcmp(cur, "-x")) x_set = 1;
     if (!strcmp(cur, "-E")) preprocessor_only = 1;
     if (!strcmp(cur, "-shared")) shared_linking = 1;
+    if (!strcmp(cur, "-c")) have_c = 1;
 
     if (!strncmp(cur, "-O", 2)) have_o = 1;
     if (!strncmp(cur, "-funroll-loop", 13)) have_unroll = 1;
@@ -800,7 +802,8 @@ static void edit_params(u32 argc, char **argv, char **envp) {
   }
 
 #if defined(USEMMAP) && !defined(__HAIKU__)
-  cc_params[cc_par_cnt++] = "-lrt";
+  if (!have_c)
+    cc_params[cc_par_cnt++] = "-lrt";
 #endif
 
   cc_params[cc_par_cnt++] = "-D__AFL_HAVE_MANUAL_CONTROL=1";
@@ -967,15 +970,19 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     }
 
   #if !defined(__APPLE__) && !defined(__sun)
-    if (!shared_linking)
+    if (!shared_linking && !have_c)
       cc_params[cc_par_cnt++] =
           alloc_printf("-Wl,--dynamic-list=%s/dynamic_list.txt", obj_path);
   #endif
 
   #if defined(USEMMAP) && !defined(__HAIKU__)
-    cc_params[cc_par_cnt++] = "-lrt";
+    if (!have_c)
+      cc_params[cc_par_cnt++] = "-lrt";
   #endif
 
+   // prevent unnecessary build errors
+   cc_params[cc_par_cnt++] = "-Wno-unused-command-line-argument";
+
   }
 
 #endif
-- 
cgit 1.4.1


From 1f71b85426f837ebcae8381897d44a3a67c73a4f Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 2 Feb 2021 10:05:10 +0100
Subject: automagically fix sanitize fuzzer+coverage

---
 src/afl-cc.c | 42 ++++++++++++++++++++++++++++++++++++------
 1 file changed, 36 insertions(+), 6 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/src/afl-cc.c b/src/afl-cc.c
index f272f0b5..cba435bd 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -693,6 +693,38 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     if (strstr(cur, "afl-compiler-rt") || strstr(cur, "afl-llvm-rt")) continue;
     if (!strcmp(cur, "-Wl,-z,defs") || !strcmp(cur, "-Wl,--no-undefined"))
       continue;
+    if (!strncmp(cur, "-fsanitize=fuzzer-", strlen("-fsanitize=fuzzer-")) ||
+        !strncmp(cur, "-fsanitize-coverage", strlen("-fsanitize-coverage"))) {
+
+      if (!be_quiet) { WARNF("Found '%s' - stripping!", cur); }
+      continue;
+
+    }
+
+    if (!strcmp(cur, "-fsanitize=fuzzer")) {
+
+      u8 *afllib = find_object("libAFLDriver.a", argv[0]);
+
+      if (!be_quiet)
+        WARNF(
+            "Found errornous '-fsanitize=fuzzer', trying to replace with "
+            "libAFLDriver.a");
+
+      if (!afllib) {
+
+        WARNF(
+            "Cannot find 'libAFLDriver.a' to replace a wrong "
+            "'-fsanitize=fuzzer' in the flags - this will fail!");
+
+      } else {
+
+        cc_params[cc_par_cnt++] = afllib;
+
+      }
+
+      continue;
+
+    }
 
     if (!strcmp(cur, "-m32")) bit_mode = 32;
     if (!strcmp(cur, "armv7a-linux-androideabi")) bit_mode = 32;
@@ -802,8 +834,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
   }
 
 #if defined(USEMMAP) && !defined(__HAIKU__)
-  if (!have_c)
-    cc_params[cc_par_cnt++] = "-lrt";
+  if (!have_c) cc_params[cc_par_cnt++] = "-lrt";
 #endif
 
   cc_params[cc_par_cnt++] = "-D__AFL_HAVE_MANUAL_CONTROL=1";
@@ -976,12 +1007,11 @@ static void edit_params(u32 argc, char **argv, char **envp) {
   #endif
 
   #if defined(USEMMAP) && !defined(__HAIKU__)
-    if (!have_c)
-      cc_params[cc_par_cnt++] = "-lrt";
+    if (!have_c) cc_params[cc_par_cnt++] = "-lrt";
   #endif
 
-   // prevent unnecessary build errors
-   cc_params[cc_par_cnt++] = "-Wno-unused-command-line-argument";
+    // prevent unnecessary build errors
+    cc_params[cc_par_cnt++] = "-Wno-unused-command-line-argument";
 
   }
 
-- 
cgit 1.4.1


From 58a5372bf0c55ead2a04ed4a4a5b651d68e69292 Mon Sep 17 00:00:00 2001
From: hexcoder <hexcoder-@users.noreply.github.com>
Date: Wed, 3 Feb 2021 14:18:35 +0100
Subject: typo

---
 src/afl-cc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/afl-cc.c')

diff --git a/src/afl-cc.c b/src/afl-cc.c
index cba435bd..cf10d9a7 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -707,7 +707,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
       if (!be_quiet)
         WARNF(
-            "Found errornous '-fsanitize=fuzzer', trying to replace with "
+            "Found erroneous '-fsanitize=fuzzer', trying to replace with "
             "libAFLDriver.a");
 
       if (!afllib) {
-- 
cgit 1.4.1


From d920104248a6c5387267561382636de404938675 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sat, 6 Feb 2021 12:26:35 +0100
Subject: remove compiler warnings

---
 instrumentation/afl-compiler-rt.o.c | 20 ++++++++++----------
 src/afl-cc.c                        |  4 ++++
 utils/aflpp_driver/aflpp_driver.c   |  2 +-
 3 files changed, 15 insertions(+), 11 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 905051c6..ceae15d1 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -368,8 +368,8 @@ static void __afl_map_shm(void) {
 
     if (__afl_map_size && __afl_map_size > MAP_SIZE) {
 
-      u8 *map_env = getenv("AFL_MAP_SIZE");
-      if (!map_env || atoi(map_env) < MAP_SIZE) {
+      u8 *map_env = (u8 *)getenv("AFL_MAP_SIZE");
+      if (!map_env || atoi((char *)map_env) < MAP_SIZE) {
 
         send_forkserver_error(FS_ERROR_MAP_SIZE);
         _exit(1);
@@ -378,7 +378,7 @@ static void __afl_map_shm(void) {
 
     }
 
-    __afl_area_ptr = shmat(shm_id, (void *)__afl_map_addr, 0);
+    __afl_area_ptr = (u8 *)shmat(shm_id, (void *)__afl_map_addr, 0);
 
     /* Whooooops. */
 
@@ -405,9 +405,9 @@ static void __afl_map_shm(void) {
 
              __afl_map_addr) {
 
-    __afl_area_ptr =
-        mmap((void *)__afl_map_addr, __afl_map_size, PROT_READ | PROT_WRITE,
-             MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+    __afl_area_ptr = (u8 *)mmap(
+        (void *)__afl_map_addr, __afl_map_size, PROT_READ | PROT_WRITE,
+        MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
 
     if (__afl_area_ptr == MAP_FAILED) {
 
@@ -425,7 +425,7 @@ static void __afl_map_shm(void) {
 
     if (__afl_final_loc > MAP_INITIAL_SIZE) {
 
-      __afl_area_ptr = malloc(__afl_final_loc);
+      __afl_area_ptr = (u8 *)malloc(__afl_final_loc);
 
     }
 
@@ -439,7 +439,7 @@ static void __afl_map_shm(void) {
 
     if (__afl_map_size > MAP_INITIAL_SIZE) {
 
-      __afl_area_ptr_dummy = malloc(__afl_map_size);
+      __afl_area_ptr_dummy = (u8 *)malloc(__afl_map_size);
 
       if (__afl_area_ptr_dummy) {
 
@@ -505,7 +505,7 @@ static void __afl_map_shm(void) {
 #else
     u32 shm_id = atoi(id_str);
 
-    __afl_cmp_map = shmat(shm_id, NULL, 0);
+    __afl_cmp_map = (struct cmp_map *)shmat(shm_id, NULL, 0);
 #endif
 
     __afl_cmp_map_backup = __afl_cmp_map;
@@ -1528,7 +1528,7 @@ void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
 // to avoid to call it on .text addresses
 static int area_is_mapped(void *ptr, size_t len) {
 
-  char *p = ptr;
+  char *p = (char *)ptr;
   char *page = (char *)((uintptr_t)p & ~(sysconf(_SC_PAGE_SIZE) - 1));
 
   int r = msync(page, (p - page) + len, MS_ASYNC);
diff --git a/src/afl-cc.c b/src/afl-cc.c
index cf10d9a7..76f4a437 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -1840,6 +1840,8 @@ int main(int argc, char **argv, char **envp) {
     for (i = 0; i < argc; i++)
       SAYF(" '%s'", argv[i]);
     SAYF("\n");
+    fflush(stdout);
+    fflush(stderr);
 
   }
 
@@ -1880,6 +1882,8 @@ int main(int argc, char **argv, char **envp) {
     for (i = 0; i < (s32)cc_par_cnt; i++)
       SAYF(" '%s'", cc_params[i]);
     SAYF("\n");
+    fflush(stdout);
+    fflush(stderr);
 
   }
 
diff --git a/utils/aflpp_driver/aflpp_driver.c b/utils/aflpp_driver/aflpp_driver.c
index 7bb929b2..6af79e14 100644
--- a/utils/aflpp_driver/aflpp_driver.c
+++ b/utils/aflpp_driver/aflpp_driver.c
@@ -173,7 +173,7 @@ size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
 // Execute any files provided as parameters.
 static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
-  unsigned char *buf = malloc(MAX_FILE);
+  unsigned char *buf = (unsigned char *)malloc(MAX_FILE);
   for (int i = 1; i < argc; i++) {
 
     int fd = open(argv[i], O_RDONLY);
-- 
cgit 1.4.1


From 0ad56167c53ae660d40ccc6cdedb39f0a52eefcd Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sun, 7 Feb 2021 07:51:29 +0100
Subject: fix scan-build issues

---
 instrumentation/LLVMInsTrim.so.cc                  |  2 +-
 instrumentation/SanitizerCoverageLTO.so.cc         |  2 +-
 instrumentation/afl-llvm-common.cc                 |  2 +-
 instrumentation/afl-llvm-dict2file.so.cc           |  1 -
 instrumentation/afl-llvm-lto-instrumentation.so.cc |  2 +-
 instrumentation/afl-llvm-pass.so.cc                |  1 +
 instrumentation/compare-transform-pass.so.cc       |  2 +-
 instrumentation/split-compares-pass.so.cc          | 37 +++++++++-------------
 src/afl-cc.c                                       |  7 ----
 src/afl-fuzz-init.c                                |  2 +-
 src/afl-fuzz-redqueen.c                            | 36 ++++++++++++++++++---
 11 files changed, 53 insertions(+), 41 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/instrumentation/LLVMInsTrim.so.cc b/instrumentation/LLVMInsTrim.so.cc
index 235ee30f..948f8f3a 100644
--- a/instrumentation/LLVMInsTrim.so.cc
+++ b/instrumentation/LLVMInsTrim.so.cc
@@ -459,7 +459,7 @@ struct InsTrim : public ModulePass {
             BasicBlock *PBB = *PI;
             auto        It = PredMap.insert({PBB, genLabel()});
             unsigned    Label = It.first->second;
-            cur_loc = Label;
+            // cur_loc = Label;
             PN->addIncoming(ConstantInt::get(Int32Ty, Label), PBB);
 
           }
diff --git a/instrumentation/SanitizerCoverageLTO.so.cc b/instrumentation/SanitizerCoverageLTO.so.cc
index e3490847..3026abc8 100644
--- a/instrumentation/SanitizerCoverageLTO.so.cc
+++ b/instrumentation/SanitizerCoverageLTO.so.cc
@@ -760,7 +760,7 @@ bool ModuleSanitizerCoverage::instrumentModule(
                   if (literalLength + 1 == optLength) {
 
                     Str2.append("\0", 1);  // add null byte
-                    addedNull = true;
+                    // addedNull = true;
 
                   }
 
diff --git a/instrumentation/afl-llvm-common.cc b/instrumentation/afl-llvm-common.cc
index a27c4069..aa54f4f7 100644
--- a/instrumentation/afl-llvm-common.cc
+++ b/instrumentation/afl-llvm-common.cc
@@ -351,7 +351,7 @@ static std::string getSourceName(llvm::Function *F) {
 
     if (cDILoc) { instFilename = cDILoc->getFilename(); }
 
-    if (instFilename.str().empty()) {
+    if (instFilename.str().empty() && cDILoc) {
 
       /* If the original location is empty, try using the inlined location
        */
diff --git a/instrumentation/afl-llvm-dict2file.so.cc b/instrumentation/afl-llvm-dict2file.so.cc
index a4b33732..6f34ac5a 100644
--- a/instrumentation/afl-llvm-dict2file.so.cc
+++ b/instrumentation/afl-llvm-dict2file.so.cc
@@ -430,7 +430,6 @@ bool AFLdict2filePass::runOnModule(Module &M) {
                 if (literalLength + 1 == optLength) {
 
                   Str2.append("\0", 1);  // add null byte
-                  addedNull = true;
 
                 }
 
diff --git a/instrumentation/afl-llvm-lto-instrumentation.so.cc b/instrumentation/afl-llvm-lto-instrumentation.so.cc
index 841d52e5..f5c24e41 100644
--- a/instrumentation/afl-llvm-lto-instrumentation.so.cc
+++ b/instrumentation/afl-llvm-lto-instrumentation.so.cc
@@ -546,7 +546,7 @@ bool AFLLTOPass::runOnModule(Module &M) {
                   if (literalLength + 1 == optLength) {
 
                     Str2.append("\0", 1);  // add null byte
-                    addedNull = true;
+                    // addedNull = true;
 
                   }
 
diff --git a/instrumentation/afl-llvm-pass.so.cc b/instrumentation/afl-llvm-pass.so.cc
index 57ff3b47..16fd9c94 100644
--- a/instrumentation/afl-llvm-pass.so.cc
+++ b/instrumentation/afl-llvm-pass.so.cc
@@ -538,6 +538,7 @@ bool AFLCoverage::runOnModule(Module &M) {
 
         Store = IRB.CreateStore(ConstantInt::get(Int32Ty, cur_loc >> 1),
                                 AFLPrevLoc);
+        Store->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
 
       }
 
diff --git a/instrumentation/compare-transform-pass.so.cc b/instrumentation/compare-transform-pass.so.cc
index da5cf7e9..8b00d8d1 100644
--- a/instrumentation/compare-transform-pass.so.cc
+++ b/instrumentation/compare-transform-pass.so.cc
@@ -391,7 +391,7 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
         if (val && !val->empty()) {
 
           Str2 = StringRef(*val);
-          HasStr2 = true;
+          // HasStr2 = true;
 
         }
 
diff --git a/instrumentation/split-compares-pass.so.cc b/instrumentation/split-compares-pass.so.cc
index b6d8c466..80cd90ba 100644
--- a/instrumentation/split-compares-pass.so.cc
+++ b/instrumentation/split-compares-pass.so.cc
@@ -407,6 +407,7 @@ bool SplitComparesTransform::simplifyIntSignedness(Module &M) {
     auto op1 = IcmpInst->getOperand(1);
 
     IntegerType *intTyOp0 = dyn_cast<IntegerType>(op0->getType());
+    if (!intTyOp0) { continue; }
     unsigned     bitw = intTyOp0->getBitWidth();
     IntegerType *IntType = IntegerType::get(C, bitw);
 
@@ -606,10 +607,11 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
                                    : sizeInBits == 64  ? 53
                                    : sizeInBits == 128 ? 113
                                    : sizeInBits == 16  ? 11
-                                                      /* sizeInBits == 80 */
-                                                      : 65;
+                                   : sizeInBits == 80  ? 65
+                                                       : sizeInBits - 8;
 
-    const unsigned           shiftR_exponent = precision - 1;
+    const unsigned shiftR_exponent = precision - 1;
+    // BUG FIXME TODO: u64 does not work for > 64 bit ... e.g. 80 and 128 bit
     const unsigned long long mask_fraction =
         (1ULL << (shiftR_exponent - 1)) | ((1ULL << (shiftR_exponent - 1)) - 1);
     const unsigned long long mask_exponent =
@@ -1300,12 +1302,9 @@ bool SplitComparesTransform::runOnModule(Module &M) {
 
     case 64:
       count += splitIntCompares(M, bitw);
-      /*
-            if (!be_quiet)
-              errs() << "Split-integer-compare-pass " << bitw << "bit: " <<
-         count
-                     << " split\n";
-      */
+      if (debug)
+        errs() << "Split-integer-compare-pass " << bitw << "bit: " << count
+               << " split\n";
       bitw >>= 1;
 #if LLVM_VERSION_MAJOR > 3 || \
     (LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR > 7)
@@ -1313,12 +1312,9 @@ bool SplitComparesTransform::runOnModule(Module &M) {
 #endif
     case 32:
       count += splitIntCompares(M, bitw);
-      /*
-            if (!be_quiet)
-              errs() << "Split-integer-compare-pass " << bitw << "bit: " <<
-         count
-                     << " split\n";
-      */
+      if (debug)
+        errs() << "Split-integer-compare-pass " << bitw << "bit: " << count
+               << " split\n";
       bitw >>= 1;
 #if LLVM_VERSION_MAJOR > 3 || \
     (LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR > 7)
@@ -1326,13 +1322,10 @@ bool SplitComparesTransform::runOnModule(Module &M) {
 #endif
     case 16:
       count += splitIntCompares(M, bitw);
-      /*
-            if (!be_quiet)
-              errs() << "Split-integer-compare-pass " << bitw << "bit: " <<
-         count
-                     << " split\n";
-      */
-      bitw >>= 1;
+      if (debug)
+        errs() << "Split-integer-compare-pass " << bitw << "bit: " << count
+               << " split\n";
+      // bitw >>= 1;
       break;
 
     default:
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 76f4a437..0ae401e7 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -315,16 +315,9 @@ static void edit_params(u32 argc, char **argv, char **envp) {
   u8 fortify_set = 0, asan_set = 0, x_set = 0, bit_mode = 0, shared_linking = 0,
      preprocessor_only = 0, have_unroll = 0, have_o = 0, have_pic = 0,
      have_c = 0;
-  u8 *name;
 
   cc_params = ck_alloc((argc + 128) * sizeof(u8 *));
 
-  name = strrchr(argv[0], '/');
-  if (!name)
-    name = argv[0];
-  else
-    ++name;
-
   if (lto_mode) {
 
     if (lto_flag[0] != '-')
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 40ba20c7..702e732d 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -1242,7 +1242,7 @@ static void link_or_copy(u8 *old_path, u8 *new_path) {
 
 void pivot_inputs(afl_state_t *afl) {
 
-  struct queue_entry *q = afl->queue;
+  struct queue_entry *q;
   u32                 id = 0, i;
 
   ACTF("Creating hard links for all input files...");
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index f619a6d3..002929c5 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -1415,7 +1415,7 @@ static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
 
     } else if (b[k] == 0xff) {
 
-      ++cons_0;
+      ++cons_ff;
 
     } else {
 
@@ -1473,7 +1473,7 @@ static void try_to_add_to_dictN(afl_state_t *afl, u128 v, u8 size) {
 
     } else if (b[k] == 0xff) {
 
-      ++cons_0;
+      ++cons_ff;
 
     } else {
 
@@ -2410,7 +2410,21 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
 
   // manually clear the full cmp_map
   memset(afl->shm.cmp_map, 0, sizeof(struct cmp_map));
-  if (unlikely(common_fuzz_cmplog_stuff(afl, orig_buf, len))) { return 1; }
+  if (unlikely(common_fuzz_cmplog_stuff(afl, orig_buf, len))) {
+
+    afl->queue_cur->colorized = CMPLOG_LVL_MAX;
+    while (taint) {
+
+      t = taint->next;
+      ck_free(taint);
+      taint = t;
+
+    }
+
+    return 1;
+
+  }
+
   if (unlikely(!afl->orig_cmp_map)) {
 
     afl->orig_cmp_map = ck_alloc_nozero(sizeof(struct cmp_map));
@@ -2419,7 +2433,20 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
 
   memcpy(afl->orig_cmp_map, afl->shm.cmp_map, sizeof(struct cmp_map));
   memset(afl->shm.cmp_map->headers, 0, sizeof(struct cmp_header) * CMP_MAP_W);
-  if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) { return 1; }
+  if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) {
+
+    afl->queue_cur->colorized = CMPLOG_LVL_MAX;
+    while (taint) {
+
+      t = taint->next;
+      ck_free(taint);
+      taint = t;
+
+    }
+
+    return 1;
+
+  }
 
 #ifdef _DEBUG
   dump("ORIG", orig_buf, len);
@@ -2530,7 +2557,6 @@ exit_its:
     afl->queue_cur->colorized = CMPLOG_LVL_MAX;
 
     ck_free(afl->queue_cur->cmplog_colorinput);
-    t = taint;
     while (taint) {
 
       t = taint->next;
-- 
cgit 1.4.1


From 1ba5d1008e749a12ac338f57adbac3b2b4cf9ea9 Mon Sep 17 00:00:00 2001
From: aflpp <aflpp@aflplus.plus>
Date: Sat, 13 Feb 2021 10:53:40 +0100
Subject: fuck you llvm 13

---
 src/afl-cc.c | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'src/afl-cc.c')

diff --git a/src/afl-cc.c b/src/afl-cc.c
index 0ae401e7..9d88f262 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -554,6 +554,11 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
     }
 
+#if LLVM_MAJOR >= 13
+    // fuck you llvm 13
+    cc_params[cc_par_cnt++] = "-fno-experimental-new-pass-manager";
+#endif
+
     if (lto_mode && !have_c) {
 
       u8 *ld_path = strdup(AFL_REAL_LD);
-- 
cgit 1.4.1


From 9bd1e19d7f004b4da6a610b07e59f99d66bb7ec2 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sat, 13 Feb 2021 22:43:56 +0100
Subject: added AFL_IGNORE_UNKNOWN_ENVS

---
 docs/Changelog.md                              | 3 ++-
 docs/env_variables.md                          | 5 ++++-
 include/envs.h                                 | 1 +
 instrumentation/SanitizerCoveragePCGUARD.so.cc | 2 +-
 src/afl-cc.c                                   | 1 +
 src/afl-common.c                               | 4 ++--
 src/afl-fuzz.c                                 | 1 +
 src/afl-showmap.c                              | 5 +++--
 8 files changed, 15 insertions(+), 7 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 895ab845..71ef4c2c 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -61,7 +61,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - Added a new example harness to compare python, c, and rust bindings
   - afl-cmin and afl-showmap now support the -f option
   - changed default: no memory limit for afl-cmin and afl-cmin.bash
-  - warn on any _AFL and __AFL env vars
+  - warn on any _AFL and __AFL env vars.
+  - set AFL_IGNORE_UNKNOWN_ENVS to not warn on unknown AFL_... env vars.
   - added dummy Makefile to instrumentation/
   - Updated utils/afl_frida to be 5% faster, 7% on x86_x64
   - Added AFL_KILL_SIGNAL env variable (thanks @v-p-b)
diff --git a/docs/env_variables.md b/docs/env_variables.md
index 886669ad..f7745247 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -5,6 +5,10 @@
   users or for some types of custom fuzzing setups. See [README.md](README.md) for the general
   instruction manual.
 
+  Note that most tools will warn on any unknown AFL environment variables.
+  This is for warning on typos that can happen. If you want to disable this
+  check then set the `AFL_IGNORE_UNKNOWN_ENVS` environment variable.
+
 ## 1) Settings for all compilers
 
 Starting with afl++ 3.0 there is only one compiler: afl-cc
@@ -18,7 +22,6 @@ To select the different instrumentation modes this can be done by
 `MODE` can be one of `LTO` (afl-clang-lto*), `LLVM` (afl-clang-fast*), `GCC_PLUGIN`
 (afl-g*-fast) or `GCC` (afl-gcc/afl-g++).
 
-
 Because (with the exception of the --afl-MODE command line option) the
 compile-time tools do not accept afl specific command-line options, they
 make fairly broad use of environmental variables instead:
diff --git a/include/envs.h b/include/envs.h
index 210b34a6..4313e053 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -61,6 +61,7 @@ static char *afl_environment_variables[] = {
     "AFL_FORKSRV_INIT_TMOUT",
     "AFL_HARDEN",
     "AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES",
+    "AFL_IGNORE_UNKNOWN_ENVS",
     "AFL_IMPORT_FIRST",
     "AFL_INST_LIBS",
     "AFL_INST_RATIO",
diff --git a/instrumentation/SanitizerCoveragePCGUARD.so.cc b/instrumentation/SanitizerCoveragePCGUARD.so.cc
index 80c8f917..9b1351b0 100644
--- a/instrumentation/SanitizerCoveragePCGUARD.so.cc
+++ b/instrumentation/SanitizerCoveragePCGUARD.so.cc
@@ -1138,7 +1138,7 @@ void ModuleSanitizerCoverage::InjectTraceForGep(
     IRBuilder<> IRB(GEP);
     for (Use &Idx : GEP->indices())
       if (!isa<ConstantInt>(Idx) && Idx->getType()->isIntegerTy())
-         IRB.CreateCall(SanCovTraceGepFunction,
+        IRB.CreateCall(SanCovTraceGepFunction,
                        {IRB.CreateIntCast(Idx, IntptrTy, true)});
 
   }
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 9d88f262..d41f79a2 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -1587,6 +1587,7 @@ int main(int argc, char **argv, char **envp) {
           "libtokencap.so)\n"
           "  AFL_PATH: path to instrumenting pass and runtime  "
           "(afl-compiler-rt.*o)\n"
+          "  AFL_IGNORE_UNKNOWN_ENVS: don't warn on unknown env vars\n"
           "  AFL_INST_RATIO: percentage of branches to instrument\n"
           "  AFL_QUIET: suppress verbose output\n"
           "  AFL_HARDEN: adds code hardening to catch memory bugs\n"
diff --git a/src/afl-common.c b/src/afl-common.c
index 1cc7f462..589aac71 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -523,7 +523,7 @@ void check_environment_vars(char **envp) {
   if (be_quiet) { return; }
 
   int   index = 0, issue_detected = 0;
-  char *env, *val;
+  char *env, *val, *ignore = getenv("AFL_IGNORE_UNKNOWN_ENVS");
   while ((env = envp[index++]) != NULL) {
 
     if (strncmp(env, "ALF_", 4) == 0 || strncmp(env, "_ALF", 4) == 0 ||
@@ -582,7 +582,7 @@ void check_environment_vars(char **envp) {
 
       }
 
-      if (match == 0) {
+      if (match == 0 && !ignore) {
 
         WARNF("Mistyped AFL environment variable: %s", env);
         issue_detected = 1;
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index e4139857..e0ac8840 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -198,6 +198,7 @@ static void usage(u8 *argv0, int more_help) {
       "AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in milliseconds)\n"
       "AFL_HANG_TMOUT: override timeout value (in milliseconds)\n"
       "AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: don't warn about core dump handlers\n"
+      "AFL_IGNORE_UNKNOWN_ENVS: don't warn on unknown env vars\n"
       "AFL_IMPORT_FIRST: sync and import test cases from other fuzzer instances first\n"
       "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL)\n"
       "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n"
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 0d2c5ceb..b40527d3 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -1168,8 +1168,9 @@ int main(int argc, char **argv_orig, char **envp) {
 
     }
 
-    stdin_file = at_file ? strdup(at_file) : (char *)
-        alloc_printf("%s/.afl-showmap-temp-%u", use_dir, (u32)getpid());
+    stdin_file = at_file ? strdup(at_file)
+                         : (char *)alloc_printf("%s/.afl-showmap-temp-%u",
+                                                use_dir, (u32)getpid());
     unlink(stdin_file);
     atexit(at_exit_handler);
     fsrv->out_file = stdin_file;
-- 
cgit 1.4.1


From e3a5c31307f323452dc4b5288e0d19a02b596a33 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Mon, 15 Feb 2021 13:25:15 +0100
Subject: llvm bug workaround for lto extint

---
 docs/Changelog.md                           |  1 +
 include/envs.h                              |  1 +
 instrumentation/cmplog-instructions-pass.cc | 39 ++++++++++++++++++++++++++---
 qemu_mode/libqasan/dlmalloc.c               |  5 ++++
 src/afl-cc.c                                |  2 ++
 src/afl-fuzz-redqueen.c                     |  1 +
 6 files changed, 45 insertions(+), 4 deletions(-)

(limited to 'src/afl-cc.c')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 71ef4c2c..e2482f8f 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -49,6 +49,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
       CLANG for old afl-clang
     - fixed a potential crash in the LAF feature
     - workaround for llvm 13
+    - workaround for llvm internal lto bug that lets not bitcast from _ExtInt()
   - qemuafl
     - QASan (address sanitizer for Qemu) ported to qemuafl!
       See qemu_mode/libqasan/README.md
diff --git a/include/envs.h b/include/envs.h
index 4313e053..36667ebc 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -16,6 +16,7 @@ static char *afl_environment_deprecated[] = {
 
 static char *afl_environment_variables[] = {
 
+    "_AFL_LTO_COMPILE",
     "AFL_ALIGNED_ALLOC",
     "AFL_ALLOW_TMP",
     "AFL_ANALYZE_HEX",
diff --git a/instrumentation/cmplog-instructions-pass.cc b/instrumentation/cmplog-instructions-pass.cc
index b5cc1882..6b071b48 100644
--- a/instrumentation/cmplog-instructions-pass.cc
+++ b/instrumentation/cmplog-instructions-pass.cc
@@ -113,6 +113,8 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
   IntegerType *Int64Ty = IntegerType::getInt64Ty(C);
   IntegerType *Int128Ty = IntegerType::getInt128Ty(C);
 
+  char *is_lto = getenv("_AFL_LTO_COMPILE");
+
 #if LLVM_VERSION_MAJOR < 9
   Constant *
 #else
@@ -265,10 +267,20 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
       unsigned int  max_size = Val->getType()->getIntegerBitWidth(), cast_size;
       unsigned char do_cast = 0;
 
-      if (!SI->getNumCases() || max_size < 16 || max_size % 8) {
+      if (!SI->getNumCases() || max_size < 16) { continue; }
+
+      if (max_size % 8) {
+
+        if (is_lto) {
+
+          continue;  // LTO cannot bitcast from _ExtInt() :(
+
+        } else {
 
-        // if (!be_quiet) errs() << "skip trivial switch..\n";
-        continue;
+          max_size = (((max_size / 8) + 1) * 8);
+          do_cast = 1;
+
+        }
 
       }
 
@@ -285,6 +297,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
 
         }
 
+        if (is_lto) { continue; }  // LTO cannot bitcast _ExtInt() :(
         max_size = 128;
         do_cast = 1;
 
@@ -301,6 +314,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
           cast_size = max_size;
           break;
         default:
+          if (is_lto) { continue; }  // LTO cannot bitcast _ExtInt() :(
           cast_size = 128;
           do_cast = 1;
 
@@ -540,7 +554,22 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
 
       }
 
-      if (!max_size || max_size % 8 || max_size < 16) { continue; }
+      if (!max_size || max_size < 16) { continue; }
+
+      if (max_size % 8) {
+
+        if (is_lto) {
+
+          continue;  // LTO cannot bitcast from _ExtInt() :(
+
+        } else {
+
+          max_size = (((max_size / 8) + 1) * 8);
+          do_cast = 1;
+
+        }
+
+      }
 
       if (max_size > 128) {
 
@@ -552,6 +581,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
 
         }
 
+        if (is_lto) { continue; }  // LTO cannot bitcast from _ExtInt() :(
         max_size = 128;
         do_cast = 1;
 
@@ -568,6 +598,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
           cast_size = max_size;
           break;
         default:
+          if (is_lto) { continue; }  // LTO cannot bitcast from _ExtInt() :(
           cast_size = 128;
           do_cast = 1;
 
diff --git a/qemu_mode/libqasan/dlmalloc.c b/qemu_mode/libqasan/dlmalloc.c
index bace0ff6..aff58ad5 100644
--- a/qemu_mode/libqasan/dlmalloc.c
+++ b/qemu_mode/libqasan/dlmalloc.c
@@ -3917,6 +3917,7 @@ static void internal_malloc_stats(mstate m) {
                                                                 \
         } else if (RTCHECK(B == smallbin_at(M, I) ||            \
                                                                 \
+                                                                \
                            (ok_address(M, B) && B->fd == P))) { \
                                                                 \
           F->bk = B;                                            \
@@ -4128,6 +4129,7 @@ static void internal_malloc_stats(mstate m) {
                                                                      \
         } else                                                       \
                                                                      \
+                                                                     \
           CORRUPTION_ERROR_ACTION(M);                                \
         if (R != 0) {                                                \
                                                                      \
@@ -4144,6 +4146,7 @@ static void internal_malloc_stats(mstate m) {
                                                                      \
               } else                                                 \
                                                                      \
+                                                                     \
                 CORRUPTION_ERROR_ACTION(M);                          \
                                                                      \
             }                                                        \
@@ -4156,12 +4159,14 @@ static void internal_malloc_stats(mstate m) {
                                                                      \
               } else                                                 \
                                                                      \
+                                                                     \
                 CORRUPTION_ERROR_ACTION(M);                          \
                                                                      \
             }                                                        \
                                                                      \
           } else                                                     \
                                                                      \
+                                                                     \
             CORRUPTION_ERROR_ACTION(M);                              \
                                                                      \
         }                                                            \
diff --git a/src/afl-cc.c b/src/afl-cc.c
index d41f79a2..959c9a6f 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -1875,6 +1875,8 @@ int main(int argc, char **argv, char **envp) {
 
   edit_params(argc, argv, envp);
 
+  if (lto_mode) { setenv("_AFL_LTO_COMPILE", "1", 1); }
+
   if (debug) {
 
     DEBUGF("cd '%s';", getthecwd());
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index 527feef5..2b01ecad 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -1533,6 +1533,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
       is_n = 1;
 
   }
+
 #endif
 
   for (i = 0; i < loggeds; ++i) {
-- 
cgit 1.4.1