From 84f0b4f1874a9c3a5f2da4056f974df8273093d9 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sun, 7 Feb 2021 08:27:35 +0100
Subject: persistent replay env setup

---
 src/afl-forkserver.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/afl-forkserver.c')

diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 9ee59822..7968f69c 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -126,7 +126,7 @@ void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) {
   fsrv_to->last_run_timed_out = 0;
 
   fsrv_to->init_child_func = from->init_child_func;
-  // Note: do not copy ->add_extra_func
+  // Note: do not copy ->add_extra_func or ->persistent_replay*
 
   list_append(&fsrv_list, fsrv_to);
 
-- 
cgit 1.4.1


From 81442ba3f953c939e2cde9c16b9cd0d5fe7f12b5 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sat, 6 Mar 2021 15:48:49 +0100
Subject: implementation without testing

---
 include/forkserver.h | 11 ++++++---
 src/afl-forkserver.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 src/afl-fuzz.c       |  3 ++-
 3 files changed, 78 insertions(+), 4 deletions(-)

(limited to 'src/afl-forkserver.c')

diff --git a/include/forkserver.h b/include/forkserver.h
index a0a60e0f..ddbc36ef 100644
--- a/include/forkserver.h
+++ b/include/forkserver.h
@@ -55,9 +55,6 @@ typedef struct afl_forkserver {
   u32 init_tmout;                       /* Configurable init timeout (ms)   */
   u32 map_size;                         /* map size used by the target      */
   u32 snapshot;                         /* is snapshot feature used         */
-  u32 persistent_replay;                /* persistent replay setting        */
-  u32 persistent_replay_idx;            /* persistent replay cache ptr      */
-  u32 persistent_replay_cnt;            /* persistent replay counter        */
   u64 mem_limit;                        /* Memory cap for child (MB)        */
 
   u64 total_execs;                      /* How often run_target was called  */
@@ -97,6 +94,14 @@ typedef struct afl_forkserver {
 
   char *cmplog_binary;                  /* the name of the cmplog binary    */
 
+  /* persistent mode replay functionality */
+  u32   persistent_replay;              /* persistent replay setting        */
+  u32   persistent_replay_idx;          /* persistent replay cache ptr      */
+  u32   persistent_replay_cnt;          /* persistent replay counter        */
+  u8 *  persistent_replay_dir;
+  u8 ** persistent_replay_data;
+  u32 **persistent_replay_len;
+
   /* Function to kick off the forkserver child */
   void (*init_child_func)(struct afl_forkserver *fsrv, char **argv);
 
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 7968f69c..05aba2e5 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -364,6 +364,21 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
   if (!be_quiet) { ACTF("Spinning up the fork server..."); }
 
+  if (unlikely(fsrv->persistent_replay)) {
+
+    fsrv->persistent_replay_data =
+        (u8 **)ck_alloc(fsrv->persistent_replay * sizeof(size_t));
+    fsrv->persistent_replay_len =
+        (u32 **)ck_alloc(fsrv->persistent_replay * sizeof(u32));
+
+    if (!fsrv->persistent_replay_data || !fsrv->persistent_replay_len) {
+
+      FATAL("Unable to allocate memory for persistent replay.");
+
+    }
+
+  }
+
   if (fsrv->use_fauxsrv) {
 
     /* TODO: Come up with some nice way to initialize this all */
@@ -998,6 +1013,29 @@ u32 afl_fsrv_get_mapsize(afl_forkserver_t *fsrv, char **argv,
 
 void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
 
+  if (unlikely(fsrv->persistent_replay)) {
+
+    *fsrv->persistent_replay_len[fsrv->persistent_replay_idx] = len;
+    fsrv->persistent_replay_data[fsrv->persistent_replay_idx] = afl_realloc(
+        (void **)&fsrv->persistent_replay_data[fsrv->persistent_replay_idx],
+        len);
+
+    if (unlikely(!fsrv->persistent_replay_data[fsrv->persistent_replay_idx])) {
+
+      FATAL("allocating replay memory failed.");
+
+    }
+
+    memcpy(fsrv->persistent_replay_data[fsrv->persistent_replay_idx], buf, len);
+
+    if (unlikely(++fsrv->persistent_replay_idx >= fsrv->persistent_replay)) {
+
+      fsrv->persistent_replay_idx = 0;
+
+    }
+
+  }
+
   if (likely(fsrv->use_shmem_fuzz && fsrv->shmem_fuzz)) {
 
     if (unlikely(len > MAX_FILE)) len = MAX_FILE;
@@ -1208,6 +1246,36 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
           (fsrv->uses_crash_exitcode &&
            WEXITSTATUS(fsrv->child_status) == fsrv->crash_exitcode))) {
 
+    if (unlikely(fsrv->persistent_replay)) {
+
+      char fn[4096];
+      u32  i, writecnt = 0;
+      for (i = 0; i < fsrv->persistent_replay; ++i) {
+
+        u32 entry = (i + fsrv->persistent_replay_idx) % fsrv->persistent_replay;
+        u8 *data = fsrv->persistent_replay_data[entry];
+        u32 *len = fsrv->persistent_replay_len[entry];
+        if (likely(len && *len && data)) {
+
+          snprintf(fn, sizeof(fn), "%s/replay_%u_%u.bin",
+                   fsrv->persistent_replay_dir, fsrv->persistent_replay_cnt,
+                   writecnt++);
+          int fd = open(fn, O_WRONLY, 0644);
+          if (fd >= 0) {
+
+            ck_write(fd, data, *len, fn);
+            close(fd);
+
+          }
+
+        }
+
+      }
+
+      ++fsrv->persistent_replay_cnt;
+
+    }
+
     /* For a proper crash, set last_kill_signal to WTERMSIG, else set it to 0 */
     fsrv->last_kill_signal =
         WIFSIGNALED(fsrv->child_status) ? WTERMSIG(fsrv->child_status) : 0;
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 77e6e2ce..f3aea2c7 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1239,9 +1239,10 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-  if (afl->afl_env.afl_persistent_replay) {
+  if (unlikely(afl->afl_env.afl_persistent_replay)) {
 
     afl->fsrv.persistent_replay = atoi(afl->afl_env.afl_persistent_replay);
+    afl->fsrv.persistent_replay_dir = alloc_printf("%s/crashes", afl->out_dir);
 
   }
 
-- 
cgit 1.4.1


From 4a0d4c50fc8bec11a090156ab970414d4897ea6c Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sat, 6 Mar 2021 19:12:25 +0100
Subject: complete implemenation, still no test

---
 include/afl-fuzz.h   |  2 +-
 include/forkserver.h | 13 ++++++-----
 src/afl-forkserver.c | 63 +++++++++++++++++++++++++++++++++-------------------
 src/afl-fuzz-state.c |  4 ++--
 src/afl-fuzz.c       | 22 +++++++++++++++---
 5 files changed, 69 insertions(+), 35 deletions(-)

(limited to 'src/afl-forkserver.c')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 3b6f2285..b1fba884 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -390,7 +390,7 @@ typedef struct afl_env_vars {
       *afl_hang_tmout, *afl_forksrv_init_tmout, *afl_skip_crashes, *afl_preload,
       *afl_max_det_extras, *afl_statsd_host, *afl_statsd_port,
       *afl_crash_exitcode, *afl_statsd_tags_flavor, *afl_testcache_size,
-      *afl_testcache_entries, *afl_kill_signal, *afl_persistent_replay;
+      *afl_testcache_entries, *afl_kill_signal, *afl_persistent_record;
 
 } afl_env_vars_t;
 
diff --git a/include/forkserver.h b/include/forkserver.h
index ddbc36ef..850c5b0d 100644
--- a/include/forkserver.h
+++ b/include/forkserver.h
@@ -95,12 +95,13 @@ typedef struct afl_forkserver {
   char *cmplog_binary;                  /* the name of the cmplog binary    */
 
   /* persistent mode replay functionality */
-  u32   persistent_replay;              /* persistent replay setting        */
-  u32   persistent_replay_idx;          /* persistent replay cache ptr      */
-  u32   persistent_replay_cnt;          /* persistent replay counter        */
-  u8 *  persistent_replay_dir;
-  u8 ** persistent_replay_data;
-  u32 **persistent_replay_len;
+  u32   persistent_record;              /* persistent replay setting        */
+  u32   persistent_record_idx;          /* persistent replay cache ptr      */
+  u32   persistent_record_cnt;          /* persistent replay counter        */
+  u8 *  persistent_record_dir;
+  u8 ** persistent_record_data;
+  u32 **persistent_record_len;
+  s32   persistent_record_pid;
 
   /* Function to kick off the forkserver child */
   void (*init_child_func)(struct afl_forkserver *fsrv, char **argv);
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 05aba2e5..78e5efe7 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -126,7 +126,7 @@ void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) {
   fsrv_to->last_run_timed_out = 0;
 
   fsrv_to->init_child_func = from->init_child_func;
-  // Note: do not copy ->add_extra_func or ->persistent_replay*
+  // Note: do not copy ->add_extra_func or ->persistent_record*
 
   list_append(&fsrv_list, fsrv_to);
 
@@ -364,14 +364,14 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
   if (!be_quiet) { ACTF("Spinning up the fork server..."); }
 
-  if (unlikely(fsrv->persistent_replay)) {
+  if (unlikely(fsrv->persistent_record)) {
 
-    fsrv->persistent_replay_data =
-        (u8 **)ck_alloc(fsrv->persistent_replay * sizeof(size_t));
-    fsrv->persistent_replay_len =
-        (u32 **)ck_alloc(fsrv->persistent_replay * sizeof(u32));
+    fsrv->persistent_record_data =
+        (u8 **)ck_alloc(fsrv->persistent_record * sizeof(size_t));
+    fsrv->persistent_record_len =
+        (u32 **)ck_alloc(fsrv->persistent_record * sizeof(u32));
 
-    if (!fsrv->persistent_replay_data || !fsrv->persistent_replay_len) {
+    if (!fsrv->persistent_record_data || !fsrv->persistent_record_len) {
 
       FATAL("Unable to allocate memory for persistent replay.");
 
@@ -1013,24 +1013,24 @@ u32 afl_fsrv_get_mapsize(afl_forkserver_t *fsrv, char **argv,
 
 void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
 
-  if (unlikely(fsrv->persistent_replay)) {
+  if (unlikely(fsrv->persistent_record)) {
 
-    *fsrv->persistent_replay_len[fsrv->persistent_replay_idx] = len;
-    fsrv->persistent_replay_data[fsrv->persistent_replay_idx] = afl_realloc(
-        (void **)&fsrv->persistent_replay_data[fsrv->persistent_replay_idx],
+    *fsrv->persistent_record_len[fsrv->persistent_record_idx] = len;
+    fsrv->persistent_record_data[fsrv->persistent_record_idx] = afl_realloc(
+        (void **)&fsrv->persistent_record_data[fsrv->persistent_record_idx],
         len);
 
-    if (unlikely(!fsrv->persistent_replay_data[fsrv->persistent_replay_idx])) {
+    if (unlikely(!fsrv->persistent_record_data[fsrv->persistent_record_idx])) {
 
       FATAL("allocating replay memory failed.");
 
     }
 
-    memcpy(fsrv->persistent_replay_data[fsrv->persistent_replay_idx], buf, len);
+    memcpy(fsrv->persistent_record_data[fsrv->persistent_record_idx], buf, len);
 
-    if (unlikely(++fsrv->persistent_replay_idx >= fsrv->persistent_replay)) {
+    if (unlikely(++fsrv->persistent_record_idx >= fsrv->persistent_record)) {
 
-      fsrv->persistent_replay_idx = 0;
+      fsrv->persistent_record_idx = 0;
 
     }
 
@@ -1148,6 +1148,23 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
 
   }
 
+  // end of persistent loop?
+  if (unlikely(fsrv->persistent_record &&
+               fsrv->persistent_record_pid != fsrv->child_pid)) {
+
+    fsrv->persistent_record_pid = fsrv->child_pid;
+    u32 idx, val;
+    if (unlikely(!fsrv->persistent_record_idx))
+      idx = fsrv->persistent_record - 1;
+    else
+      idx = fsrv->persistent_record_idx - 1;
+    val = *fsrv->persistent_record_len[idx];
+    memset((void *)fsrv->persistent_record_len, 0,
+           fsrv->persistent_record * sizeof(u32));
+    *fsrv->persistent_record_len[idx] = val;
+
+  }
+
   if (fsrv->child_pid <= 0) {
 
     if (*stop_soon_p) { return 0; }
@@ -1246,19 +1263,19 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
           (fsrv->uses_crash_exitcode &&
            WEXITSTATUS(fsrv->child_status) == fsrv->crash_exitcode))) {
 
-    if (unlikely(fsrv->persistent_replay)) {
+    if (unlikely(fsrv->persistent_record)) {
 
       char fn[4096];
       u32  i, writecnt = 0;
-      for (i = 0; i < fsrv->persistent_replay; ++i) {
+      for (i = 0; i < fsrv->persistent_record; ++i) {
 
-        u32 entry = (i + fsrv->persistent_replay_idx) % fsrv->persistent_replay;
-        u8 *data = fsrv->persistent_replay_data[entry];
-        u32 *len = fsrv->persistent_replay_len[entry];
+        u32 entry = (i + fsrv->persistent_record_idx) % fsrv->persistent_record;
+        u8 *data = fsrv->persistent_record_data[entry];
+        u32 *len = fsrv->persistent_record_len[entry];
         if (likely(len && *len && data)) {
 
-          snprintf(fn, sizeof(fn), "%s/replay_%u_%u.bin",
-                   fsrv->persistent_replay_dir, fsrv->persistent_replay_cnt,
+          snprintf(fn, sizeof(fn), "%s/RECORD:%06u,cnt:%06u",
+                   fsrv->persistent_record_dir, fsrv->persistent_record_cnt,
                    writecnt++);
           int fd = open(fn, O_WRONLY, 0644);
           if (fd >= 0) {
@@ -1272,7 +1289,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
 
       }
 
-      ++fsrv->persistent_replay_cnt;
+      ++fsrv->persistent_record_cnt;
 
     }
 
diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c
index 075aef1e..514414f3 100644
--- a/src/afl-fuzz-state.c
+++ b/src/afl-fuzz-state.c
@@ -292,11 +292,11 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
             afl->afl_env.afl_autoresume =
                 get_afl_env(afl_environment_variables[i]) ? 1 : 0;
 
-          } else if (!strncmp(env, "AFL_PERSISTENT_REPLAY",
+          } else if (!strncmp(env, "AFL_PERSISTENT_RECORD",
 
                               afl_environment_variable_len)) {
 
-            afl->afl_env.afl_persistent_replay =
+            afl->afl_env.afl_persistent_record =
                 get_afl_env(afl_environment_variables[i]);
 
           } else if (!strncmp(env, "AFL_CYCLE_SCHEDULES",
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index f3aea2c7..afaa8f5f 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1239,10 +1239,26 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-  if (unlikely(afl->afl_env.afl_persistent_replay)) {
+  if (unlikely(afl->afl_env.afl_persistent_record)) {
 
-    afl->fsrv.persistent_replay = atoi(afl->afl_env.afl_persistent_replay);
-    afl->fsrv.persistent_replay_dir = alloc_printf("%s/crashes", afl->out_dir);
+    afl->fsrv.persistent_record = atoi(afl->afl_env.afl_persistent_record);
+    afl->fsrv.persistent_record_dir = alloc_printf("%s/crashes", afl->out_dir);
+
+    if (afl->fsrv.persistent_record < 2) {
+
+      FATAL(
+          "AFL_PERSISTENT_RECORD vallue must be be at least 2, recommended is "
+          "100 or 1000.");
+
+    }
+
+    if (!getenv(PERSIST_ENV_VAR)) {
+
+      FATAL(
+          "Target binary is not compiled in persistent mode, "
+          "AFL_PERSISTENT_RECORD makes no sense.");
+
+    }
 
   }
 
-- 
cgit 1.4.1


From 99b4c3f3624db9300c175936aff22535db6eef67 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sat, 6 Mar 2021 22:19:56 +0100
Subject: fix

---
 src/afl-forkserver.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'src/afl-forkserver.c')

diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 78e5efe7..a6128220 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -42,6 +42,7 @@
 #include <errno.h>
 #include <signal.h>
 #include <fcntl.h>
+#include <limits.h>
 #include <sys/time.h>
 #include <sys/wait.h>
 #include <sys/resource.h>
@@ -367,7 +368,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
   if (unlikely(fsrv->persistent_record)) {
 
     fsrv->persistent_record_data =
-        (u8 **)ck_alloc(fsrv->persistent_record * sizeof(size_t));
+        (u8 **)ck_alloc(fsrv->persistent_record * sizeof(u8 *));
     fsrv->persistent_record_len =
         (u32 **)ck_alloc(fsrv->persistent_record * sizeof(u32));
 
@@ -1265,7 +1266,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
 
     if (unlikely(fsrv->persistent_record)) {
 
-      char fn[4096];
+      char fn[PATH_MAX];
       u32  i, writecnt = 0;
       for (i = 0; i < fsrv->persistent_record; ++i) {
 
-- 
cgit 1.4.1


From 7f062524c97ab18306d42e59ab0223e04ff78f24 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sat, 6 Mar 2021 23:01:13 +0100
Subject: fixes

---
 include/envs.h       |  2 +-
 include/forkserver.h |  2 +-
 src/afl-forkserver.c | 14 +++++++-------
 src/afl-fuzz.c       | 50 +++++++++++++++++++++++++++-----------------------
 4 files changed, 36 insertions(+), 32 deletions(-)

(limited to 'src/afl-forkserver.c')

diff --git a/include/envs.h b/include/envs.h
index f82bb803..6ba69f26 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -123,7 +123,7 @@ static char *afl_environment_variables[] = {
     "AFL_MAX_DET_EXTRAS",
     "AFL_PATH",
     "AFL_PERFORMANCE_FILE",
-    "AFL_PERSISTEN_REPLAY",
+    "AFL_PERSISTENT_RECORD",
     "AFL_PRELOAD",
     "AFL_PYTHON_MODULE",
     "AFL_QEMU_COMPCOV",
diff --git a/include/forkserver.h b/include/forkserver.h
index 850c5b0d..c894ad80 100644
--- a/include/forkserver.h
+++ b/include/forkserver.h
@@ -100,7 +100,7 @@ typedef struct afl_forkserver {
   u32   persistent_record_cnt;          /* persistent replay counter        */
   u8 *  persistent_record_dir;
   u8 ** persistent_record_data;
-  u32 **persistent_record_len;
+  u32 * persistent_record_len;
   s32   persistent_record_pid;
 
   /* Function to kick off the forkserver child */
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index a6128220..e6738a71 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -370,7 +370,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
     fsrv->persistent_record_data =
         (u8 **)ck_alloc(fsrv->persistent_record * sizeof(u8 *));
     fsrv->persistent_record_len =
-        (u32 **)ck_alloc(fsrv->persistent_record * sizeof(u32));
+        (u32 *)ck_alloc(fsrv->persistent_record * sizeof(u32));
 
     if (!fsrv->persistent_record_data || !fsrv->persistent_record_len) {
 
@@ -1016,7 +1016,7 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
 
   if (unlikely(fsrv->persistent_record)) {
 
-    *fsrv->persistent_record_len[fsrv->persistent_record_idx] = len;
+    fsrv->persistent_record_len[fsrv->persistent_record_idx] = len;
     fsrv->persistent_record_data[fsrv->persistent_record_idx] = afl_realloc(
         (void **)&fsrv->persistent_record_data[fsrv->persistent_record_idx],
         len);
@@ -1159,10 +1159,10 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
       idx = fsrv->persistent_record - 1;
     else
       idx = fsrv->persistent_record_idx - 1;
-    val = *fsrv->persistent_record_len[idx];
+    val = fsrv->persistent_record_len[idx];
     memset((void *)fsrv->persistent_record_len, 0,
            fsrv->persistent_record * sizeof(u32));
-    *fsrv->persistent_record_len[idx] = val;
+    fsrv->persistent_record_len[idx] = val;
 
   }
 
@@ -1272,8 +1272,8 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
 
         u32 entry = (i + fsrv->persistent_record_idx) % fsrv->persistent_record;
         u8 *data = fsrv->persistent_record_data[entry];
-        u32 *len = fsrv->persistent_record_len[entry];
-        if (likely(len && *len && data)) {
+        u32 len = fsrv->persistent_record_len[entry];
+        if (likely(len && data)) {
 
           snprintf(fn, sizeof(fn), "%s/RECORD:%06u,cnt:%06u",
                    fsrv->persistent_record_dir, fsrv->persistent_record_cnt,
@@ -1281,7 +1281,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
           int fd = open(fn, O_WRONLY, 0644);
           if (fd >= 0) {
 
-            ck_write(fd, data, *len, fn);
+            ck_write(fd, data, len, fn);
             close(fd);
 
           }
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index afaa8f5f..4ee71120 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -986,6 +986,21 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
+  if (unlikely(afl->afl_env.afl_persistent_record)) {
+
+    afl->fsrv.persistent_record = atoi(afl->afl_env.afl_persistent_record);
+    afl->fsrv.persistent_record_dir = alloc_printf("%s/crashes", afl->out_dir);
+
+    if (afl->fsrv.persistent_record < 2) {
+
+      FATAL(
+          "AFL_PERSISTENT_RECORD value must be be at least 2, recommended is "
+          "100 or 1000.");
+
+    }
+
+  }
+
   if (afl->fsrv.qemu_mode && getenv("AFL_USE_QASAN")) {
 
     u8 *preload = getenv("AFL_PRELOAD");
@@ -1239,29 +1254,6 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-  if (unlikely(afl->afl_env.afl_persistent_record)) {
-
-    afl->fsrv.persistent_record = atoi(afl->afl_env.afl_persistent_record);
-    afl->fsrv.persistent_record_dir = alloc_printf("%s/crashes", afl->out_dir);
-
-    if (afl->fsrv.persistent_record < 2) {
-
-      FATAL(
-          "AFL_PERSISTENT_RECORD vallue must be be at least 2, recommended is "
-          "100 or 1000.");
-
-    }
-
-    if (!getenv(PERSIST_ENV_VAR)) {
-
-      FATAL(
-          "Target binary is not compiled in persistent mode, "
-          "AFL_PERSISTENT_RECORD makes no sense.");
-
-    }
-
-  }
-
   if (afl->afl_env.afl_crash_exitcode) {
 
     long exitcode = strtol(afl->afl_env.afl_crash_exitcode, NULL, 10);
@@ -1531,6 +1523,18 @@ int main(int argc, char **argv_orig, char **envp) {
 
   check_binary(afl, argv[optind]);
 
+  if (unlikely(afl->fsrv.persistent_record)) {
+
+    if (!getenv(PERSIST_ENV_VAR)) {
+
+      FATAL(
+          "Target binary is not compiled in persistent mode, "
+          "AFL_PERSISTENT_RECORD makes no sense.");
+
+    }
+
+  }
+
   if (afl->shmem_testcase_mode) { setup_testcase_shmem(afl); }
 
   afl->start_time = get_cur_time();
-- 
cgit 1.4.1


From 517db1b8dc1b310b82a73e3878285ca03249f3e4 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sat, 6 Mar 2021 23:12:44 +0100
Subject: fixes

---
 src/afl-forkserver.c | 2 +-
 src/afl-fuzz.c       | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

(limited to 'src/afl-forkserver.c')

diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index e6738a71..2ab1304e 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -1278,7 +1278,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
           snprintf(fn, sizeof(fn), "%s/RECORD:%06u,cnt:%06u",
                    fsrv->persistent_record_dir, fsrv->persistent_record_cnt,
                    writecnt++);
-          int fd = open(fn, O_WRONLY, 0644);
+          int fd = open(fn, O_CREAT | O_TRUNC | O_WRONLY, 0644);
           if (fd >= 0) {
 
             ck_write(fd, data, len, fn);
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 4ee71120..267ab075 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -989,7 +989,6 @@ int main(int argc, char **argv_orig, char **envp) {
   if (unlikely(afl->afl_env.afl_persistent_record)) {
 
     afl->fsrv.persistent_record = atoi(afl->afl_env.afl_persistent_record);
-    afl->fsrv.persistent_record_dir = alloc_printf("%s/crashes", afl->out_dir);
 
     if (afl->fsrv.persistent_record < 2) {
 
@@ -1533,6 +1532,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
     }
 
+    afl->fsrv.persistent_record_dir = alloc_printf("%s/crashes", afl->out_dir);
+
   }
 
   if (afl->shmem_testcase_mode) { setup_testcase_shmem(afl); }
-- 
cgit 1.4.1


From 958436be4ba057e8409787e7ff4ddcfa095c46da Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 24 Mar 2021 18:18:05 +0100
Subject: ifdef for record

---
 include/config.h     |  9 +++++++++
 src/afl-forkserver.c |  8 ++++++++
 src/afl-fuzz.c       | 30 +++++++++++++++++++++++-------
 3 files changed, 40 insertions(+), 7 deletions(-)

(limited to 'src/afl-forkserver.c')

diff --git a/include/config.h b/include/config.h
index 60872785..f6dbfae0 100644
--- a/include/config.h
+++ b/include/config.h
@@ -60,6 +60,15 @@
 
 /* Now non-cmplog configuration options */
 
+
+/* If a persistent target keeps state and found crashes are not reproducable
+   then enable this option and set the AFL_PERSISTENT_RECORD env variable
+   to a number. These number of testcases prior the crash will be kept and
+   also written to the crash/ directory */
+
+#define AFL_PERSISTENT_RECORD
+
+
 /* console output colors: There are three ways to configure its behavior
  * 1. default: colored outputs fixed on: defined USE_COLOR && defined
  * ALWAYS_COLORED The env var. AFL_NO_COLOR will have no effect
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 2ab1304e..4e4f92d6 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -365,6 +365,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
   if (!be_quiet) { ACTF("Spinning up the fork server..."); }
 
+#ifdef AFL_PERSISTENT_RECORD
   if (unlikely(fsrv->persistent_record)) {
 
     fsrv->persistent_record_data =
@@ -379,6 +380,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
     }
 
   }
+#endif
 
   if (fsrv->use_fauxsrv) {
 
@@ -1014,6 +1016,7 @@ u32 afl_fsrv_get_mapsize(afl_forkserver_t *fsrv, char **argv,
 
 void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
 
+#ifdef AFL_PERSISTENT_RECORD
   if (unlikely(fsrv->persistent_record)) {
 
     fsrv->persistent_record_len[fsrv->persistent_record_idx] = len;
@@ -1036,6 +1039,7 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
     }
 
   }
+#endif
 
   if (likely(fsrv->use_shmem_fuzz && fsrv->shmem_fuzz)) {
 
@@ -1149,6 +1153,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
 
   }
 
+#ifdef AFL_PERSISTENT_RECORD
   // end of persistent loop?
   if (unlikely(fsrv->persistent_record &&
                fsrv->persistent_record_pid != fsrv->child_pid)) {
@@ -1165,6 +1170,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
     fsrv->persistent_record_len[idx] = val;
 
   }
+#endif
 
   if (fsrv->child_pid <= 0) {
 
@@ -1264,6 +1270,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
           (fsrv->uses_crash_exitcode &&
            WEXITSTATUS(fsrv->child_status) == fsrv->crash_exitcode))) {
 
+#ifdef AFL_PERSISTENT_RECORD
     if (unlikely(fsrv->persistent_record)) {
 
       char fn[PATH_MAX];
@@ -1293,6 +1300,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
       ++fsrv->persistent_record_cnt;
 
     }
+#endif
 
     /* For a proper crash, set last_kill_signal to WTERMSIG, else set it to 0 */
     fsrv->last_kill_signal =
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index b2c81580..d622db71 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -218,7 +218,9 @@ static void usage(u8 *argv0, int more_help) {
       "AFL_PATH: path to AFL support binaries\n"
       "AFL_PYTHON_MODULE: mutate and trim inputs with the specified Python module\n"
       "AFL_QUIET: suppress forkserver status messages\n"
+#ifdef AFL_PERSISTENT_RECORD
       "AFL_PERSISTENT_RECORD: record the last X inputs to every crash in out/crashes\n"
+#endif
       "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
       "AFL_SHUFFLE_QUEUE: reorder the input queue randomly on startup\n"
       "AFL_SKIP_BIN_CHECK: skip the check, if the target is an executable\n"
@@ -249,7 +251,13 @@ static void usage(u8 *argv0, int more_help) {
   SAYF("Compiled with %s module support, see docs/custom_mutator.md\n",
        (char *)PYTHON_VERSION);
 #else
-  SAYF("Compiled without python module support\n");
+  SAYF("Compiled without python module support.\n");
+#endif
+
+#ifdef AFL_PERSISTENT_RECORD
+  SAYF("Compiled with AFL_PERSISTENT_RECORD support.\n");
+#else
+  SAYF("Compiled without AFL_PERSISTENT_RECORD support.\n");
 #endif
 
 #ifdef USEMMAP
@@ -259,27 +267,27 @@ static void usage(u8 *argv0, int more_help) {
 #endif
 
 #ifdef ASAN_BUILD
-  SAYF("Compiled with ASAN_BUILD\n\n");
+  SAYF("Compiled with ASAN_BUILD.\n");
 #endif
 
 #ifdef NO_SPLICING
-  SAYF("Compiled with NO_SPLICING\n\n");
+  SAYF("Compiled with NO_SPLICING.\n");
 #endif
 
 #ifdef PROFILING
-  SAYF("Compiled with PROFILING\n\n");
+  SAYF("Compiled with PROFILING.\n");
 #endif
 
 #ifdef INTROSPECTION
-  SAYF("Compiled with INTROSPECTION\n\n");
+  SAYF("Compiled with INTROSPECTION.\n");
 #endif
 
 #ifdef _DEBUG
-  SAYF("Compiled with _DEBUG\n\n");
+  SAYF("Compiled with _DEBUG.\n");
 #endif
 
 #ifdef _AFL_DOCUMENT_MUTATIONS
-  SAYF("Compiled with _AFL_DOCUMENT_MUTATIONS\n\n");
+  SAYF("Compiled with _AFL_DOCUMENT_MUTATIONS.\n");
 #endif
 
   SAYF("For additional help please consult %s/README.md :)\n\n", doc_path);
@@ -989,6 +997,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
   if (unlikely(afl->afl_env.afl_persistent_record)) {
 
+#ifdef AFL_PERSISTENT_RECORD
+
     afl->fsrv.persistent_record = atoi(afl->afl_env.afl_persistent_record);
 
     if (afl->fsrv.persistent_record < 2) {
@@ -999,6 +1009,12 @@ int main(int argc, char **argv_orig, char **envp) {
 
     }
 
+#else
+
+    FATAL("afl-fuzz was not compiled with AFL_PERSISTENT_RECORD enabled in config.h!");
+
+#endif
+
   }
 
   if (afl->fsrv.qemu_mode && getenv("AFL_USE_QASAN")) {
-- 
cgit 1.4.1


From ab394836a9fe3faadb9d1af3a7d377bbcf5b5eee Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Thu, 25 Mar 2021 08:40:33 +0100
Subject: remove warnings

---
 include/afl-fuzz.h   |  3 ++-
 include/config.h     |  5 +++--
 include/forkserver.h | 16 +++++++++-------
 src/afl-forkserver.c |  4 ++++
 src/afl-fuzz.c       | 13 +++++++++----
 src/afl-showmap.c    |  1 -
 6 files changed, 27 insertions(+), 15 deletions(-)

(limited to 'src/afl-forkserver.c')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 691ba148..046b0177 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -390,7 +390,8 @@ typedef struct afl_env_vars {
       *afl_hang_tmout, *afl_forksrv_init_tmout, *afl_skip_crashes, *afl_preload,
       *afl_max_det_extras, *afl_statsd_host, *afl_statsd_port,
       *afl_crash_exitcode, *afl_statsd_tags_flavor, *afl_testcache_size,
-      *afl_testcache_entries, *afl_kill_signal, *afl_target_env, *afl_persistent_record;
+      *afl_testcache_entries, *afl_kill_signal, *afl_target_env,
+      *afl_persistent_record;
 
 } afl_env_vars_t;
 
diff --git a/include/config.h b/include/config.h
index 4691624a..75f363f7 100644
--- a/include/config.h
+++ b/include/config.h
@@ -77,8 +77,9 @@
 
 /* If a persistent target keeps state and found crashes are not reproducable
    then enable this option and set the AFL_PERSISTENT_RECORD env variable
-   to a number. These number of testcases prior the crash will be kept and
-   also written to the crash/ directory */
+   to a number. These number of testcases prior and including the crash case
+   will be kept and written to the crash/ directory as RECORD:... files.
+   Note that every crash will be written, not only unique ones! */
 
 //#define AFL_PERSISTENT_RECORD
 
diff --git a/include/forkserver.h b/include/forkserver.h
index c894ad80..808f6bd2 100644
--- a/include/forkserver.h
+++ b/include/forkserver.h
@@ -95,13 +95,15 @@ typedef struct afl_forkserver {
   char *cmplog_binary;                  /* the name of the cmplog binary    */
 
   /* persistent mode replay functionality */
-  u32   persistent_record;              /* persistent replay setting        */
-  u32   persistent_record_idx;          /* persistent replay cache ptr      */
-  u32   persistent_record_cnt;          /* persistent replay counter        */
-  u8 *  persistent_record_dir;
-  u8 ** persistent_record_data;
-  u32 * persistent_record_len;
-  s32   persistent_record_pid;
+  u32 persistent_record;                /* persistent replay setting        */
+#ifdef AFL_PERSISTENT_RECORD
+  u32  persistent_record_idx;           /* persistent replay cache ptr      */
+  u32  persistent_record_cnt;           /* persistent replay counter        */
+  u8 * persistent_record_dir;
+  u8 **persistent_record_data;
+  u32 *persistent_record_len;
+  s32  persistent_record_pid;
+#endif
 
   /* Function to kick off the forkserver child */
   void (*init_child_func)(struct afl_forkserver *fsrv, char **argv);
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 979d7e9e..0037d2d5 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -380,6 +380,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
     }
 
   }
+
 #endif
 
   if (fsrv->use_fauxsrv) {
@@ -1073,6 +1074,7 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
     }
 
   }
+
 #endif
 
   if (likely(fsrv->use_shmem_fuzz && fsrv->shmem_fuzz)) {
@@ -1206,6 +1208,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
     fsrv->persistent_record_len[idx] = val;
 
   }
+
 #endif
 
   if (fsrv->child_pid <= 0) {
@@ -1336,6 +1339,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
       ++fsrv->persistent_record_cnt;
 
     }
+
 #endif
 
     /* For a proper crash, set last_kill_signal to WTERMSIG, else set it to 0 */
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index f89c1938..23343ade 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1034,7 +1034,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   if (unlikely(afl->afl_env.afl_persistent_record)) {
 
-#ifdef AFL_PERSISTENT_RECORD
+  #ifdef AFL_PERSISTENT_RECORD
 
     afl->fsrv.persistent_record = atoi(afl->afl_env.afl_persistent_record);
 
@@ -1046,11 +1046,13 @@ int main(int argc, char **argv_orig, char **envp) {
 
     }
 
-#else
+  #else
 
-    FATAL("afl-fuzz was not compiled with AFL_PERSISTENT_RECORD enabled in config.h!");
+    FATAL(
+        "afl-fuzz was not compiled with AFL_PERSISTENT_RECORD enabled in "
+        "config.h!");
 
-#endif
+  #endif
 
   }
 
@@ -1520,6 +1522,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   check_binary(afl, argv[optind]);
 
+  #ifdef AFL_PERSISTENT_RECORD
   if (unlikely(afl->fsrv.persistent_record)) {
 
     if (!getenv(PERSIST_ENV_VAR)) {
@@ -1534,6 +1537,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
+  #endif
+
   if (afl->shmem_testcase_mode) { setup_testcase_shmem(afl); }
 
   afl->start_time = get_cur_time();
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 558665a2..bedf7806 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -955,7 +955,6 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-
   if (in_dir) {
 
     /* If we don't have a file name chosen yet, use a safe default. */
-- 
cgit 1.4.1


From 920e9402a4d6101bbbed2ef7584d85a3c3de0eaa Mon Sep 17 00:00:00 2001
From: Joshua Rogers <jrogers@opera.com>
Date: Fri, 2 Apr 2021 22:23:11 +0000
Subject:  Add support for standalone leak-sanitizer, introducting the
 environment variable AFL_USE_LSAN.

AFL_USE_LSAN introduces the macro __AFL_CHECK_LEAK() which will check
for a memory leak when the macro is run. This is especially helpful
when using __AFL_LOOP().

If __AFL_LEAK_CHECK() is not used when AFL_USE_LSAN=1 is set,
the leak checker will run when the program exits.
---
 GNUmakefile            |  4 ++--
 README.md              |  2 +-
 docs/env_variables.md  | 20 ++++++++++++++++----
 docs/notes_for_asan.md |  7 +++++++
 include/config.h       |  4 ++++
 include/envs.h         |  1 +
 src/afl-analyze.c      | 19 +++++++++++++++++++
 src/afl-as.c           |  7 ++++---
 src/afl-cc.c           | 16 ++++++++++++++--
 src/afl-forkserver.c   | 17 +++++++++++++----
 src/afl-fuzz-init.c    | 17 ++++++++++++++++-
 src/afl-showmap.c      |  4 ++++
 src/afl-tmin.c         | 18 ++++++++++++++++++
 test/test-pre.sh       |  1 +
 14 files changed, 120 insertions(+), 17 deletions(-)

(limited to 'src/afl-forkserver.c')

diff --git a/GNUmakefile b/GNUmakefile
index f885f998..a6314a8b 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -517,7 +517,7 @@ code-format:
 ifndef AFL_NO_X86
 test_build: afl-cc afl-gcc afl-as afl-showmap
 	@echo "[*] Testing the CC wrapper afl-cc and its instrumentation output..."
-	@unset AFL_MAP_SIZE AFL_USE_UBSAN AFL_USE_CFISAN AFL_USE_ASAN AFL_USE_MSAN; ASAN_OPTIONS=detect_leaks=0 AFL_INST_RATIO=100 AFL_PATH=. ./afl-cc test-instr.c -o test-instr 2>&1 || (echo "Oops, afl-cc failed"; exit 1 )
+	@unset AFL_MAP_SIZE AFL_USE_UBSAN AFL_USE_CFISAN AFL_USE_LSAN AFL_USE_ASAN AFL_USE_MSAN; ASAN_OPTIONS=detect_leaks=0 AFL_INST_RATIO=100 AFL_PATH=. ./afl-cc test-instr.c -o test-instr 2>&1 || (echo "Oops, afl-cc failed"; exit 1 )
 	ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr0 ./test-instr < /dev/null
 	echo 1 | ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr1 ./test-instr
 	@rm -f test-instr
@@ -525,7 +525,7 @@ test_build: afl-cc afl-gcc afl-as afl-showmap
 	@echo
 	@echo "[+] All right, the instrumentation of afl-cc seems to be working!"
 #	@echo "[*] Testing the CC wrapper afl-gcc and its instrumentation output..."
-#	@unset AFL_MAP_SIZE AFL_USE_UBSAN AFL_USE_CFISAN AFL_USE_ASAN AFL_USE_MSAN; AFL_CC=$(CC) ASAN_OPTIONS=detect_leaks=0 AFL_INST_RATIO=100 AFL_PATH=. ./afl-gcc test-instr.c -o test-instr 2>&1 || (echo "Oops, afl-gcc failed"; exit 1 )
+#	@unset AFL_MAP_SIZE AFL_USE_UBSAN AFL_USE_CFISAN AFL_USE_LSAN AFL_USE_ASAN AFL_USE_MSAN; AFL_CC=$(CC) ASAN_OPTIONS=detect_leaks=0 AFL_INST_RATIO=100 AFL_PATH=. ./afl-gcc test-instr.c -o test-instr 2>&1 || (echo "Oops, afl-gcc failed"; exit 1 )
 #	ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr0 ./test-instr < /dev/null
 #	echo 1 | ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr1 ./test-instr
 #	@rm -f test-instr
diff --git a/README.md b/README.md
index 2528e1d1..41d55e9c 100644
--- a/README.md
+++ b/README.md
@@ -601,7 +601,7 @@ Every -M/-S entry needs a unique name (that can be whatever), however the same
 For every secondary fuzzer there should be a variation, e.g.:
  * one should fuzz the target that was compiled differently: with sanitizers
    activated (`export AFL_USE_ASAN=1 ; export AFL_USE_UBSAN=1 ;
-   export AFL_USE_CFISAN=1 ; `
+   export AFL_USE_CFISAN=1 ; export AFL_USE_LSAN`)
  * one should fuzz the target with CMPLOG/redqueen (see above)
  * one to three fuzzers should fuzz a target compiled with laf-intel/COMPCOV
    (see above). Important note: If you run more than one laf-intel/COMPCOV
diff --git a/docs/env_variables.md b/docs/env_variables.md
index c6ad0aa4..682ab7f1 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -55,7 +55,7 @@ make fairly broad use of environmental variables instead:
     overridden.
 
   - Setting `AFL_USE_ASAN` automatically enables ASAN, provided that your
-    compiler supports that. Note that fuzzing with ASAN is mildly challenging
+    compiler supports itt. Note that fuzzing with ASAN is mildly challenging
     - see [notes_for_asan.md](notes_for_asan.md).
 
     (You can also enable MSAN via `AFL_USE_MSAN`; ASAN and MSAN come with the
@@ -64,6 +64,13 @@ make fairly broad use of environmental variables instead:
     there is the Control Flow Integrity sanitizer that can be activated by
     `AFL_USE_CFISAN=1`)
 
+  - Setting `AFL_USE_LSAN` automatically enables Leak-Sanitizer, provided
+    that your compiler supports it. To perform a leak check within your
+    program at a certain point (such as at the end of an __AFL_LOOP,
+    you can run the macro __AFL_CHECK_LEAK(); which will cause
+    an abort if any memory is leaked (you can combine this with the
+    LSAN_OPTIONS=suppressions option to supress some known leaks).
+
   - Setting `AFL_CC`, `AFL_CXX`, and `AFL_AS` lets you use alternate downstream
     compilation tools, rather than the default 'clang', 'gcc', or 'as' binaries
     in your `$PATH`.
@@ -628,7 +635,12 @@ optimal values if not already present in the environment:
     msan_track_origins=0
     allocator_may_return_null=1
 ```
-  Be sure to include the first one when customizing anything, since some
-    MSAN versions don't call `abort()` on error, and we need a way to detect
-    faults.
+  - Similarly, the default `LSAN_OPTIONS` are set to:
+```
+    exit_code=86
+    fast_unwind_on_malloc=0
+````
+  Be sure to include the first ones for LSAN and MSAN when customizing
+     anything, since some MSAN and LSAN versions don't call `abort()` on
+     error, and we need a way to detect faults.
 
diff --git a/docs/notes_for_asan.md b/docs/notes_for_asan.md
index 2b3bc028..26f34fad 100644
--- a/docs/notes_for_asan.md
+++ b/docs/notes_for_asan.md
@@ -28,6 +28,13 @@ Note that ASAN is incompatible with -static, so be mindful of that.
 
 (You can also use AFL_USE_MSAN=1 to enable MSAN instead.)
 
+When compiling with AFL_USE_LSAN, the leak sanitizer will normally run
+when the program exits. In order to utilize this check at different times,
+such as at the end of a loop, you may use the macro __AFL_CHECK_LEAK();.
+This macro will report a crash in afl-fuzz if any memory is left leaking
+at this stage. You can also use LSAN_OPTIONS and a supressions file
+for more fine-tuned checking, however make sure you keep exitcode=23.
+
 NOTE: if you run several secondary instances, only one should run the target
 compiled with ASAN (and UBSAN, CFISAN), the others should run the target with
 no sanitizers compiled in.
diff --git a/include/config.h b/include/config.h
index 29225f6b..6490a5fe 100644
--- a/include/config.h
+++ b/include/config.h
@@ -393,6 +393,10 @@
 
 #define MSAN_ERROR 86
 
+/* Distinctive exit code used to indicate LSAN trip condition: */
+
+#define LSAN_ERROR 23
+
 /* Designated file descriptors for forkserver commands (the application will
    use FORKSRV_FD and FORKSRV_FD + 1): */
 
diff --git a/include/envs.h b/include/envs.h
index 2ce50be7..d1856c50 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -172,6 +172,7 @@ static char *afl_environment_variables[] = {
     "AFL_USE_TRACE_PC",
     "AFL_USE_UBSAN",
     "AFL_USE_CFISAN",
+    "AFL_USE_LSAN",
     "AFL_WINE_PATH",
     "AFL_NO_SNAPSHOT",
     "AFL_EXPAND_HAVOC_NOW",
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index 86b0f7e9..90305714 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -781,6 +781,19 @@ static void set_up_environment(void) {
 
   }
 
+  x = get_afl_env("LSAN_OPTIONS");
+
+  if (x) {
+
+    if (!strstr(x, "exit_code=" STRINGIFY(LSAN_ERROR))) {
+
+      FATAL("Custom LSAN_OPTIONS set without exit_code=" STRINGIFY(
+          LSAN_ERROR) " - please fix!");
+
+    }
+
+  }
+
   setenv("ASAN_OPTIONS",
          "abort_on_error=1:"
          "detect_leaks=0:"
@@ -818,6 +831,12 @@ static void set_up_environment(void) {
                          "handle_sigfpe=0:"
                          "handle_sigill=0", 0);
 
+   setenv("LSAN_OPTIONS",
+         "exitcode=" STRINGIFY(MSAN_ERROR) ":"
+         "fast_unwind_on_malloc=0",
+         0);
+
+
   if (get_afl_env("AFL_PRELOAD")) {
 
     if (qemu_mode) {
diff --git a/src/afl-as.c b/src/afl-as.c
index 7de267a3..dfae44f2 100644
--- a/src/afl-as.c
+++ b/src/afl-as.c
@@ -517,11 +517,12 @@ static void add_instrumentation(void) {
     } else {
 
       char modeline[100];
-      snprintf(modeline, sizeof(modeline), "%s%s%s%s",
+      snprintf(modeline, sizeof(modeline), "%s%s%s%s%s",
                getenv("AFL_HARDEN") ? "hardened" : "non-hardened",
                getenv("AFL_USE_ASAN") ? ", ASAN" : "",
                getenv("AFL_USE_MSAN") ? ", MSAN" : "",
-               getenv("AFL_USE_UBSAN") ? ", UBSAN" : "");
+               getenv("AFL_USE_UBSAN") ? ", UBSAN" : "",
+               getenv("AFL_USE_LSAN") ? ", LSAN" : "");
 
       OKF("Instrumented %u locations (%s-bit, %s mode, ratio %u%%).", ins_lines,
           use_64bit ? "64" : "32", modeline, inst_ratio);
@@ -585,7 +586,7 @@ int main(int argc, char **argv) {
         "AFL_QUIET: suppress verbose output\n"
         "AFL_KEEP_ASSEMBLY: leave instrumented assembly files\n"
         "AFL_AS_FORCE_INSTRUMENT: force instrumentation for asm sources\n"
-        "AFL_HARDEN, AFL_USE_ASAN, AFL_USE_MSAN, AFL_USE_UBSAN:\n"
+        "AFL_HARDEN, AFL_USE_ASAN, AFL_USE_MSAN, AFL_USE_UBSAN, AFL_USE_LSAN:\n"
         "  used in the instrumentation summary message\n",
         argv[0]);
 
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 5251465b..e0478503 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -758,7 +758,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     if (!strncmp(cur, "-fsanitize-coverage-", 20) && strstr(cur, "list="))
       have_instr_list = 1;
 
-    if (!strcmp(cur, "-fsanitize=address") || !strcmp(cur, "-fsanitize=memory"))
+    if (!(strcmp(cur, "-fsanitize=address") && strcmp(cur, "-fsanitize=memory")))
       asan_set = 1;
 
     if (strstr(cur, "FORTIFY_SOURCE")) fortify_set = 1;
@@ -817,6 +817,10 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   }
 
+  if (getenv("AFL_USE_LSAN")) {
+    cc_params[cc_par_cnt++] = "-fsanitize=leak";
+  }
+
   if (getenv("AFL_USE_CFISAN")) {
 
     if (!lto_mode) {
@@ -914,6 +918,13 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   }
 
+  if (getenv("AFL_USE_LSAN")) {
+    cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h";
+  }
+
+  cc_params[cc_par_cnt++] =
+      "-D__AFL_CHECK_LEAK()=__lsan_do_leak_check()";
+
   cc_params[cc_par_cnt++] =
       "-D__AFL_COVERAGE_START_OFF()=int __afl_selective_coverage_start_off = "
       "1;";
@@ -1740,7 +1751,8 @@ int main(int argc, char **argv, char **envp) {
           "  AFL_USE_ASAN: activate address sanitizer\n"
           "  AFL_USE_CFISAN: activate control flow sanitizer\n"
           "  AFL_USE_MSAN: activate memory sanitizer\n"
-          "  AFL_USE_UBSAN: activate undefined behaviour sanitizer\n");
+          "  AFL_USE_UBSAN: activate undefined behaviour sanitizer\n"
+          "  AFL_USE_LSAN: activate leak-checker sanitizer\n");
 
       if (have_gcc_plugin)
         SAYF(
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 68995388..fa89713a 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -483,7 +483,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
     if (!getenv("LD_BIND_LAZY")) { setenv("LD_BIND_NOW", "1", 1); }
 
-    /* Set sane defaults for ASAN if nothing else specified. */
+    /* Set sane defaults for ASAN if nothing else is specified. */
 
     if (!getenv("ASAN_OPTIONS"))
       setenv("ASAN_OPTIONS",
@@ -500,7 +500,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
              "handle_sigill=0",
              1);
 
-    /* Set sane defaults for UBSAN if nothing else specified. */
+    /* Set sane defaults for UBSAN if nothing else is specified. */
 
     if (!getenv("UBSAN_OPTIONS"))
       setenv("UBSAN_OPTIONS",
@@ -538,6 +538,14 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
            "handle_sigill=0",
            1);
 
+    /* LSAN, too, does not support abort_on_error=1. */
+
+    if (!getenv("LSAN_OPTIONS"))
+     setenv("LSAN_OPTIONS",
+            "exitcode=" STRINGIFY(LSAN_ERROR) ":"
+            "fast_unwind_on_malloc=0",
+            1);
+
     fsrv->init_child_func(fsrv, argv);
 
     /* Use a distinctive bitmap signature to tell the parent about execv()
@@ -1210,8 +1218,9 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
   if (unlikely(
           /* A normal crash/abort */
           (WIFSIGNALED(fsrv->child_status)) ||
-          /* special handling for msan */
-          (fsrv->uses_asan && WEXITSTATUS(fsrv->child_status) == MSAN_ERROR) ||
+          /* special handling for msan and lsan */
+          (fsrv->uses_asan && (WEXITSTATUS(fsrv->child_status) == MSAN_ERROR ||
+          WEXITSTATUS(fsrv->child_status) == LSAN_ERROR)) ||
           /* the custom crash_exitcode was returned by the target */
           (fsrv->uses_crash_exitcode &&
            WEXITSTATUS(fsrv->child_status) == fsrv->crash_exitcode))) {
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 82c1799e..24f5c5b5 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -2466,6 +2466,20 @@ void check_asan_opts(afl_state_t *afl) {
 
   }
 
+  x = get_afl_env("LSAN_OPTIONS");
+
+  if (x) {
+
+    if (!strstr(x, "exit_code=" STRINGIFY(LSAN_ERROR))) {
+
+      FATAL("Custom LSAN_OPTIONS set without exit_code=" STRINGIFY(
+          LSAN_ERROR) " - please fix!");
+
+    }
+
+  }
+
+
 }
 
 /* Handle stop signal (Ctrl-C, etc). */
@@ -2711,7 +2725,8 @@ void check_binary(afl_state_t *afl, u8 *fname) {
   }
 
   if (memmem(f_data, f_len, "__asan_init", 11) ||
-      memmem(f_data, f_len, "__msan_init", 11)) {
+      memmem(f_data, f_len, "__msan_init", 11) ||
+      memmem(f_data, f_len, "__lsan_init", 11)) {
 
     afl->fsrv.uses_asan = 1;
 
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 7bf5a9c7..bf076683 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -570,6 +570,10 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
          "handle_sigfpe=0:"
          "handle_sigill=0",
          0);
+  setenv("LSAN_OPTIONS",
+         "exitcode=" STRINGIFY(LSAN_ERROR) ":"
+         "fast_unwind_on_malloc=0",
+          0);
 
   setenv("UBSAN_OPTIONS",
          "halt_on_error=1:"
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 7ef8b9bf..a2741a07 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -712,6 +712,19 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
 
   }
 
+  x = get_afl_env("LSAN_OPTIONS");
+
+  if (x) {
+
+    if (!strstr(x, "exit_code=" STRINGIFY(LSAN_ERROR))) {
+
+      FATAL("Custom LSAN_OPTIONS set without exit_code=" STRINGIFY(
+          LSAN_ERROR) " - please fix!");
+
+    }
+
+  }
+
   setenv("ASAN_OPTIONS",
          "abort_on_error=1:"
          "detect_leaks=0:"
@@ -749,6 +762,11 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
                          "handle_sigfpe=0:"
                          "handle_sigill=0", 0);
 
+   setenv("LSAN_OPTIONS",
+         "exitcode=" STRINGIFY(LSAN_ERROR) ":"
+         "fast_unwind_on_malloc=0",
+         0);
+
   if (get_afl_env("AFL_PRELOAD")) {
 
     if (fsrv->qemu_mode) {
diff --git a/test/test-pre.sh b/test/test-pre.sh
index 85ac320b..174f2f7f 100755
--- a/test/test-pre.sh
+++ b/test/test-pre.sh
@@ -71,6 +71,7 @@ unset AFL_HARDEN
 unset AFL_USE_ASAN
 unset AFL_USE_MSAN
 unset AFL_USE_UBSAN
+unset AFL_USE_LSAN
 unset AFL_TMPDIR
 unset AFL_CC
 unset AFL_PRELOAD
-- 
cgit 1.4.1


From afc4da47f78a24d5e441e3815e5b322d1b27fd56 Mon Sep 17 00:00:00 2001
From: Joshua Rogers <jrogers@opera.com>
Date: Sat, 3 Apr 2021 14:50:35 +0000
Subject: Fix typos, Use symbolize=0 for LSAN, Remove syntactic sugar.

---
 README.md             | 2 +-
 docs/env_variables.md | 3 ++-
 src/afl-analyze.c     | 8 ++++----
 src/afl-cc.c          | 2 +-
 src/afl-forkserver.c  | 3 ++-
 src/afl-fuzz-init.c   | 5 ++---
 src/afl-showmap.c     | 4 +++-
 src/afl-tmin.c        | 3 ++-
 8 files changed, 17 insertions(+), 13 deletions(-)

(limited to 'src/afl-forkserver.c')

diff --git a/README.md b/README.md
index 41d55e9c..4d3f8aa9 100644
--- a/README.md
+++ b/README.md
@@ -601,7 +601,7 @@ Every -M/-S entry needs a unique name (that can be whatever), however the same
 For every secondary fuzzer there should be a variation, e.g.:
  * one should fuzz the target that was compiled differently: with sanitizers
    activated (`export AFL_USE_ASAN=1 ; export AFL_USE_UBSAN=1 ;
-   export AFL_USE_CFISAN=1 ; export AFL_USE_LSAN`)
+   export AFL_USE_CFISAN=1 ; export AFL_USE_LSAN=1`)
  * one should fuzz the target with CMPLOG/redqueen (see above)
  * one to three fuzzers should fuzz a target compiled with laf-intel/COMPCOV
    (see above). Important note: If you run more than one laf-intel/COMPCOV
diff --git a/docs/env_variables.md b/docs/env_variables.md
index 85c2efd7..5f9233d7 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -639,7 +639,8 @@ optimal values if not already present in the environment:
 ```
     exit_code=23
     fast_unwind_on_malloc=0
-````
+    symbolize=0
+```
   Be sure to include the first ones for LSAN and MSAN when customizing
      anything, since some MSAN and LSAN versions don't call `abort()` on
      error, and we need a way to detect faults.
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index f961f13a..38a40556 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -785,10 +785,9 @@ static void set_up_environment(void) {
 
   if (x) {
 
-    if (!strstr(x, "exit_code=" STRINGIFY(LSAN_ERROR))) {
+    if (!strstr(x, "symbolize=0")) {
 
-      FATAL("Custom LSAN_OPTIONS set without exit_code=" STRINGIFY(
-          LSAN_ERROR) " - please fix!");
+      FATAL("Custom LSAN_OPTIONS set without symbolize=0 - please fix!");
 
     }
 
@@ -833,7 +832,8 @@ static void set_up_environment(void) {
 
    setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
-         "fast_unwind_on_malloc=0",
+         "fast_unwind_on_malloc=0:"
+         "symbolize=0",
          0);
 
 
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 975b28d1..650e4e43 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -758,7 +758,7 @@ static void edit_params(u32 argc, char **argv, char **envp) {
     if (!strncmp(cur, "-fsanitize-coverage-", 20) && strstr(cur, "list="))
       have_instr_list = 1;
 
-    if (!(strcmp(cur, "-fsanitize=address") && strcmp(cur, "-fsanitize=memory")))
+    if (!strcmp(cur, "-fsanitize=address") || !strcmp(cur, "-fsanitize=memory"))
       asan_set = 1;
 
     if (strstr(cur, "FORTIFY_SOURCE")) fortify_set = 1;
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index fa89713a..f102b73b 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -543,7 +543,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
     if (!getenv("LSAN_OPTIONS"))
      setenv("LSAN_OPTIONS",
             "exitcode=" STRINGIFY(LSAN_ERROR) ":"
-            "fast_unwind_on_malloc=0",
+            "fast_unwind_on_malloc=0:"
+            "symbolize=0",
             1);
 
     fsrv->init_child_func(fsrv, argv);
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 24f5c5b5..6f663021 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -2470,10 +2470,9 @@ void check_asan_opts(afl_state_t *afl) {
 
   if (x) {
 
-    if (!strstr(x, "exit_code=" STRINGIFY(LSAN_ERROR))) {
+    if (!strstr(x, "symbolize=0")) {
 
-      FATAL("Custom LSAN_OPTIONS set without exit_code=" STRINGIFY(
-          LSAN_ERROR) " - please fix!");
+      FATAL("Custom LSAN_OPTIONS set without symbolize=0 - please fix!");
 
     }
 
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index bf076683..2b7d200b 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -570,9 +570,11 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
          "handle_sigfpe=0:"
          "handle_sigill=0",
          0);
+
   setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
-         "fast_unwind_on_malloc=0",
+         "fast_unwind_on_malloc=0:"
+         "symbolize=0",
           0);
 
   setenv("UBSAN_OPTIONS",
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index a2741a07..c257b67c 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -764,7 +764,8 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
 
    setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
-         "fast_unwind_on_malloc=0",
+         "fast_unwind_on_malloc=0:"
+         "symbolize=0",
          0);
 
   if (get_afl_env("AFL_PRELOAD")) {
-- 
cgit 1.4.1


From 99819cf5d1cbc262810f26098a5796c9d1262bc5 Mon Sep 17 00:00:00 2001
From: Joshua Rogers <jrogers@opera.com>
Date: Sun, 4 Apr 2021 12:45:52 +0000
Subject: Move definition of __AFL_LEAK_CHECK inside ifguards, use
 LSAN_OPTIONS=print_suppressions=0

---
 docs/env_variables.md |  1 +
 src/afl-analyze.c     |  3 ++-
 src/afl-cc.c          | 10 +++-------
 src/afl-forkserver.c  |  3 ++-
 src/afl-showmap.c     |  3 ++-
 src/afl-tmin.c        |  3 ++-
 6 files changed, 12 insertions(+), 11 deletions(-)

(limited to 'src/afl-forkserver.c')

diff --git a/docs/env_variables.md b/docs/env_variables.md
index 5f9233d7..83bc487f 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -640,6 +640,7 @@ optimal values if not already present in the environment:
     exit_code=23
     fast_unwind_on_malloc=0
     symbolize=0
+    print_suppressions=0
 ```
   Be sure to include the first ones for LSAN and MSAN when customizing
      anything, since some MSAN and LSAN versions don't call `abort()` on
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index 38a40556..f4436980 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -833,7 +833,8 @@ static void set_up_environment(void) {
    setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
          "fast_unwind_on_malloc=0:"
-         "symbolize=0",
+         "symbolize=0:"
+         "print_suppressions=0",
          0);
 
 
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 650e4e43..e2dd06e2 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -819,6 +819,9 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   if (getenv("AFL_USE_LSAN")) {
     cc_params[cc_par_cnt++] = "-fsanitize=leak";
+    cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h";
+    cc_params[cc_par_cnt++] =
+        "-D__AFL_LEAK_CHECK()=__lsan_do_leak_check()";
   }
 
   if (getenv("AFL_USE_CFISAN")) {
@@ -918,13 +921,6 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
   }
 
-  if (getenv("AFL_USE_LSAN")) {
-    cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h";
-  }
-
-  cc_params[cc_par_cnt++] =
-      "-D__AFL_LEAK_CHECK()=__lsan_do_leak_check()";
-
   cc_params[cc_par_cnt++] =
       "-D__AFL_COVERAGE_START_OFF()=int __afl_selective_coverage_start_off = "
       "1;";
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index f102b73b..ac7a1600 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -544,7 +544,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
      setenv("LSAN_OPTIONS",
             "exitcode=" STRINGIFY(LSAN_ERROR) ":"
             "fast_unwind_on_malloc=0:"
-            "symbolize=0",
+            "symbolize=0:"
+            "print_suppressions=0",
             1);
 
     fsrv->init_child_func(fsrv, argv);
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 2b7d200b..df91a4c2 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -574,7 +574,8 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
   setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
          "fast_unwind_on_malloc=0:"
-         "symbolize=0",
+         "symbolize=0:"
+         "print_suppressions=0",
           0);
 
   setenv("UBSAN_OPTIONS",
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 3a196e2e..eb5e0dcf 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -764,7 +764,8 @@ static void set_up_environment(afl_forkserver_t *fsrv) {
    setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
          "fast_unwind_on_malloc=0:"
-         "symbolize=0",
+         "symbolize=0:"
+         "print_suppressions=0",
          0);
 
   if (get_afl_env("AFL_PRELOAD")) {
-- 
cgit 1.4.1


From 3c846859eef4d17d2587ea28db83c680b51723a7 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sun, 4 Apr 2021 20:05:02 +0200
Subject: cleanup

---
 GNUmakefile                                        | 38 ++++++++++++----------
 GNUmakefile.gcc_plugin                             | 12 ++++---
 GNUmakefile.llvm                                   |  8 +++--
 docs/Changelog.md                                  |  3 ++
 include/android-ashmem.h                           | 16 +++++----
 instrumentation/afl-llvm-lto-instrumentation.so.cc |  2 +-
 src/afl-analyze.c                                  |  3 +-
 src/afl-cc.c                                       |  5 +--
 src/afl-forkserver.c                               |  7 ++--
 src/afl-fuzz-init.c                                |  1 -
 src/afl-tmin.c                                     |  2 +-
 11 files changed, 55 insertions(+), 42 deletions(-)

(limited to 'src/afl-forkserver.c')

diff --git a/GNUmakefile b/GNUmakefile
index fdbcd542..d5fb570d 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -36,6 +36,11 @@ SH_PROGS    = afl-plot afl-cmin afl-cmin.bash afl-whatsup afl-system-config
 MANPAGES=$(foreach p, $(PROGS) $(SH_PROGS), $(p).8) afl-as.8
 ASAN_OPTIONS=detect_leaks=0
 
+SYS = $(shell uname -s)
+ARCH = $(shell uname -m)
+
+$(info [*] Compiling afl++ for OS $(SYS) on ARCH $(ARCH))
+
 ifdef NO_SPLICING
   override CFLAGS += -DNO_SPLICING
 endif
@@ -82,7 +87,7 @@ endif
 #  endif
 #endif
 
-ifneq "$(shell uname)" "Darwin"
+ifneq "$(SYS)" "Darwin"
   #ifeq "$(HAVE_MARCHNATIVE)" "1"
   #  SPECIAL_PERFORMANCE += -march=native
   #endif
@@ -92,7 +97,7 @@ ifneq "$(shell uname)" "Darwin"
   endif
 endif
 
-ifeq "$(shell uname)" "SunOS"
+ifeq "$(SYS)" "SunOS"
   CFLAGS_OPT += -Wno-format-truncation
   LDFLAGS = -lkstat -lrt
 endif
@@ -119,11 +124,10 @@ ifdef INTROSPECTION
   CFLAGS_OPT += -DINTROSPECTION=1
 endif
 
-
-ifneq "$(shell uname -m)" "x86_64"
- ifneq "$(patsubst i%86,i386,$(shell uname -m))" "i386"
-  ifneq "$(shell uname -m)" "amd64"
-   ifneq "$(shell uname -m)" "i86pc"
+ifneq "$(ARCH)" "x86_64"
+ ifneq "$(patsubst i%86,i386,$(ARCH))" "i386"
+  ifneq "$(ARCH)" "amd64"
+   ifneq "$(ARCH)" "i86pc"
 	AFL_NO_X86=1
    endif
   endif
@@ -141,27 +145,27 @@ override CFLAGS += -g -Wno-pointer-sign -Wno-variadic-macros -Wall -Wextra -Wpoi
 			  -I include/ -DAFL_PATH=\"$(HELPER_PATH)\" \
 			  -DBIN_PATH=\"$(BIN_PATH)\" -DDOC_PATH=\"$(DOC_PATH)\"
 
-ifeq "$(shell uname -s)" "FreeBSD"
+ifeq "$(SYS)" "FreeBSD"
   override CFLAGS  += -I /usr/local/include/
   LDFLAGS += -L /usr/local/lib/
 endif
 
-ifeq "$(shell uname -s)" "DragonFly"
+ifeq "$(SYS)" "DragonFly"
   override CFLAGS  += -I /usr/local/include/
   LDFLAGS += -L /usr/local/lib/
 endif
 
-ifeq "$(shell uname -s)" "OpenBSD"
+ifeq "$(SYS)" "OpenBSD"
   override CFLAGS  += -I /usr/local/include/ -mno-retpoline
   LDFLAGS += -Wl,-z,notext -L /usr/local/lib/
 endif
 
-ifeq "$(shell uname -s)" "NetBSD"
+ifeq "$(SYS)" "NetBSD"
   override CFLAGS  += -I /usr/pkg/include/
   LDFLAGS += -L /usr/pkg/lib/
 endif
 
-ifeq "$(shell uname -s)" "Haiku"
+ifeq "$(SYS)" "Haiku"
   SHMAT_OK=0
   override CFLAGS  += -DUSEMMAP=1 -Wno-error=format -fPIC
   LDFLAGS += -Wno-deprecated-declarations -lgnu
@@ -236,24 +240,24 @@ else
     BUILD_DATE ?= $(shell date "+%Y-%m-%d")
 endif
 
-ifneq "$(filter Linux GNU%,$(shell uname))" ""
+ifneq "$(filter Linux GNU%,$(SYS))" ""
  ifndef DEBUG
   override CFLAGS += -D_FORTIFY_SOURCE=2
  endif
   LDFLAGS += -ldl -lrt -lm
 endif
 
-ifneq "$(findstring FreeBSD, $(shell uname))" ""
+ifneq "$(findstring FreeBSD, $(ARCH))" ""
   override CFLAGS  += -pthread
   LDFLAGS += -lpthread
 endif
 
-ifneq "$(findstring NetBSD, $(shell uname))" ""
+ifneq "$(findstring NetBSD, $(ARCH))" ""
   override CFLAGS  += -pthread
   LDFLAGS += -lpthread
 endif
 
-ifneq "$(findstring OpenBSD, $(shell uname))" ""
+ifneq "$(findstring OpenBSD, $(ARCH))" ""
   override CFLAGS  += -pthread
   LDFLAGS += -lpthread
 endif
@@ -485,7 +489,7 @@ unit_clean:
 	@rm -f ./test/unittests/unit_preallocable ./test/unittests/unit_list ./test/unittests/unit_maybe_alloc test/unittests/*.o
 
 .PHONY: unit
-ifneq "$(shell uname)" "Darwin"
+ifneq "$(ARCH)" "Darwin"
 unit:	unit_maybe_alloc unit_preallocable unit_list unit_clean unit_rand unit_hash
 else
 unit:
diff --git a/GNUmakefile.gcc_plugin b/GNUmakefile.gcc_plugin
index aa93c688..b0f90f1b 100644
--- a/GNUmakefile.gcc_plugin
+++ b/GNUmakefile.gcc_plugin
@@ -41,6 +41,8 @@ CXXEFLAGS   := $(CXXFLAGS) -Wall -std=c++11
 CC          ?= gcc
 CXX         ?= g++
 
+SYS = $(shell uname -s)
+
 ifeq "clang" "$(CC)"
         CC  = gcc
         CXX = g++
@@ -75,25 +77,25 @@ ifeq "$(TEST_MMAP)" "1"
 	override CFLAGS_SAFE += -DUSEMMAP=1
 endif
 
-ifneq "$(shell uname -s)" "Haiku"
-ifneq "$(shell uname -s)" "OpenBSD"
+ifneq "$(SYS)" "Haiku"
+ifneq "$(SYS)" "OpenBSD"
   	LDFLAGS += -lrt
 endif
 else
 	CFLAGS_SAFE += -DUSEMMAP=1
 endif
 
-ifeq "$(shell uname -s)" "OpenBSD"
+ifeq "$(SYS)" "OpenBSD"
     CC  = egcc
     CXX = eg++
     PLUGIN_FLAGS += -I/usr/local/include
 endif
 
-ifeq "$(shell uname -s)" "DragonFly"
+ifeq "$(SYS)" "DragonFly"
   	PLUGIN_FLAGS += -I/usr/local/include
 endif
 
-ifeq "$(shell uname -s)" "SunOS"
+ifeq "$(SYS)" "SunOS"
   	PLUGIN_FLAGS += -I/usr/include/gmp
 endif
 
diff --git a/GNUmakefile.llvm b/GNUmakefile.llvm
index 4b5ac520..61c17e92 100644
--- a/GNUmakefile.llvm
+++ b/GNUmakefile.llvm
@@ -30,7 +30,9 @@ BUILD_DATE  ?= $(shell date -u -d "@$(SOURCE_DATE_EPOCH)" "+%Y-%m-%d" 2>/dev/nul
 
 VERSION     = $(shell grep '^$(HASH)define VERSION ' ./config.h | cut -d '"' -f2)
 
-ifeq "$(shell uname)" "OpenBSD"
+SYS = $(shell uname -s)
+
+ifeq "$(SYS)" "OpenBSD"
   LLVM_CONFIG ?= $(BIN_PATH)/llvm-config
   HAS_OPT = $(shell test -x $(BIN_PATH)/opt && echo 0 || echo 1)
   ifeq "$(HAS_OPT)" "1"
@@ -275,13 +277,13 @@ CLANG_LFL    = `$(LLVM_CONFIG) --ldflags` $(LDFLAGS)
 
 
 # User teor2345 reports that this is required to make things work on MacOS X.
-ifeq "$(shell uname)" "Darwin"
+ifeq "$(SYS)" "Darwin"
   CLANG_LFL += -Wl,-flat_namespace -Wl,-undefined,suppress
 else
   CLANG_CPPFL += -Wl,-znodelete
 endif
 
-ifeq "$(shell uname)" "OpenBSD"
+ifeq "$(SYS)" "OpenBSD"
   CLANG_LFL += `$(LLVM_CONFIG) --libdir`/libLLVM.so
   CLANG_CPPFL += -mno-retpoline
   CFLAGS += -mno-retpoline
diff --git a/docs/Changelog.md b/docs/Changelog.md
index 91d1a8cc..24877f9a 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -11,6 +11,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
 ### Version ++3.13a (development)
   - frida_mode - new mode that uses frida to fuzz binary-only targets,
     thanks to @WorksButNotTested!
+  - create a fuzzing dictionary with the help of CodeQL thanks to
+    @microsvuln! see utils/autodict_ql
   - afl-fuzz:
     - added patch by @realmadsci to support @@ as part of command line
       options, e.g. `afl-fuzz ... -- ./target --infile=@@`
@@ -20,6 +22,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     - default cmplog level (-l) is now 2, better efficiency.
     - ensure one fuzzer sync per cycle
   - afl-cc:
+    - Leak Sanitizer support (AFL_USE_LSAN) added by Joshua Rogers, thanks!
     - Removed InsTrim instrumentation as it is not as good as PCGUARD
 
 ### Version ++3.12c (release)
diff --git a/include/android-ashmem.h b/include/android-ashmem.h
index 44fe556a..1bfd3220 100644
--- a/include/android-ashmem.h
+++ b/include/android-ashmem.h
@@ -13,12 +13,14 @@
     #include <stdio.h>
     #define ASHMEM_DEVICE "/dev/ashmem"
 
-int shmdt(const void* address) {
-#if defined(SYS_shmdt)
+int shmdt(const void *address) {
+
+    #if defined(SYS_shmdt)
   return syscall(SYS_shmdt, address);
-#else
+    #else
   return syscall(SYS_ipc, SHMDT, 0, 0, 0, address, 0);
-#endif
+    #endif
+
 }
 
 int shmctl(int __shmid, int __cmd, struct shmid_ds *__buf) {
@@ -26,7 +28,7 @@ int shmctl(int __shmid, int __cmd, struct shmid_ds *__buf) {
   int ret = 0;
   if (__cmd == IPC_RMID) {
 
-    int length = ioctl(__shmid, ASHMEM_GET_SIZE, NULL);
+    int               length = ioctl(__shmid, ASHMEM_GET_SIZE, NULL);
     struct ashmem_pin pin = {0, length};
     ret = ioctl(__shmid, ASHMEM_UNPIN, &pin);
     close(__shmid);
@@ -77,6 +79,6 @@ void *shmat(int __shmid, const void *__shmaddr, int __shmflg) {
 
 }
 
-  #endif /* !_ANDROID_ASHMEM_H */
-#endif /* !__ANDROID__ */
+  #endif                                              /* !_ANDROID_ASHMEM_H */
+#endif                                                      /* !__ANDROID__ */
 
diff --git a/instrumentation/afl-llvm-lto-instrumentation.so.cc b/instrumentation/afl-llvm-lto-instrumentation.so.cc
index 50306224..6eb19060 100644
--- a/instrumentation/afl-llvm-lto-instrumentation.so.cc
+++ b/instrumentation/afl-llvm-lto-instrumentation.so.cc
@@ -176,7 +176,7 @@ bool AFLLTOPass::runOnModule(Module &M) {
 
   }
 
-  if (debug) { fprintf(stderr, "map address is 0x%lx\n", map_addr); }
+  if (debug) { fprintf(stderr, "map address is 0x%llx\n", map_addr); }
 
   /* Get/set the globals for the SHM region. */
 
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index 7d7519fa..aabdbf1a 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -833,14 +833,13 @@ static void set_up_environment(char **argv) {
                          "handle_sigfpe=0:"
                          "handle_sigill=0", 0);
 
-   setenv("LSAN_OPTIONS",
+  setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
          "fast_unwind_on_malloc=0:"
          "symbolize=0:"
          "print_suppressions=0",
          0);
 
-
   if (get_afl_env("AFL_PRELOAD")) {
 
     if (qemu_mode) {
diff --git a/src/afl-cc.c b/src/afl-cc.c
index d4c0a6b7..3af31b3c 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -820,10 +820,11 @@ static void edit_params(u32 argc, char **argv, char **envp) {
   }
 
   if (getenv("AFL_USE_LSAN")) {
+
     cc_params[cc_par_cnt++] = "-fsanitize=leak";
     cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h";
-    cc_params[cc_par_cnt++] =
-        "-D__AFL_LEAK_CHECK()=__lsan_do_leak_check()";
+    cc_params[cc_par_cnt++] = "-D__AFL_LEAK_CHECK()=__lsan_do_leak_check()";
+
   }
 
   if (getenv("AFL_USE_CFISAN")) {
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index cd04e23d..2c502621 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -560,7 +560,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
     /* LSAN, too, does not support abort_on_error=1. */
 
     if (!getenv("LSAN_OPTIONS"))
-     setenv("LSAN_OPTIONS",
+      setenv("LSAN_OPTIONS",
             "exitcode=" STRINGIFY(LSAN_ERROR) ":"
             "fast_unwind_on_malloc=0:"
             "symbolize=0:"
@@ -1314,8 +1314,9 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
           /* A normal crash/abort */
           (WIFSIGNALED(fsrv->child_status)) ||
           /* special handling for msan and lsan */
-          (fsrv->uses_asan && (WEXITSTATUS(fsrv->child_status) == MSAN_ERROR ||
-          WEXITSTATUS(fsrv->child_status) == LSAN_ERROR)) ||
+          (fsrv->uses_asan &&
+           (WEXITSTATUS(fsrv->child_status) == MSAN_ERROR ||
+            WEXITSTATUS(fsrv->child_status) == LSAN_ERROR)) ||
           /* the custom crash_exitcode was returned by the target */
           (fsrv->uses_crash_exitcode &&
            WEXITSTATUS(fsrv->child_status) == fsrv->crash_exitcode))) {
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 48f3289d..e505abd4 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -2502,7 +2502,6 @@ void check_asan_opts(afl_state_t *afl) {
 
   }
 
-
 }
 
 /* Handle stop signal (Ctrl-C, etc). */
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 6aad748c..6656712a 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -763,7 +763,7 @@ static void set_up_environment(afl_forkserver_t *fsrv, char **argv) {
                          "handle_sigfpe=0:"
                          "handle_sigill=0", 0);
 
-   setenv("LSAN_OPTIONS",
+  setenv("LSAN_OPTIONS",
          "exitcode=" STRINGIFY(LSAN_ERROR) ":"
          "fast_unwind_on_malloc=0:"
          "symbolize=0:"
-- 
cgit 1.4.1


From bfe7e3fd55cc4cfc8ae334b68095e7b26b8ec8a5 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Wed, 7 Apr 2021 14:20:50 +0200
Subject: fix forkserver timeout error msg

---
 src/afl-forkserver.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'src/afl-forkserver.c')

diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 2c502621..727e7f8d 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -821,7 +821,9 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
   if (fsrv->last_run_timed_out) {
 
-    FATAL("Timeout while initializing fork server (adjusting -t may help)");
+    FATAL(
+        "Timeout while initializing fork server (setting "
+        "AFL_FORKSRV_INIT_TMOUT may help)");
 
   }
 
-- 
cgit 1.4.1