From 7b40d7b9420b2e3adb7d9afa88610199718dedba Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 12 May 2020 11:12:25 +0200
Subject: new code formatting + applied

---
 src/afl-fuzz-init.c | 72 ++++++++++++++++++++++++++---------------------------
 1 file changed, 36 insertions(+), 36 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 32481887..78b92368 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -33,11 +33,11 @@
 
 void bind_to_free_cpu(afl_state_t *afl) {
 
-#if defined(__linux__) || defined(__FreeBSD__) || defined(__DragonFly__)
+  #if defined(__linux__) || defined(__FreeBSD__) || defined(__DragonFly__)
   cpu_set_t c;
-#elif defined(__NetBSD__)
+  #elif defined(__NetBSD__)
   cpuset_t *         c;
-#endif
+  #endif
 
   u8  cpu_used[4096] = {0};
   u32 i;
@@ -51,7 +51,7 @@ void bind_to_free_cpu(afl_state_t *afl) {
 
   }
 
-#if defined(__linux__)
+  #if defined(__linux__)
   DIR *          d;
   struct dirent *de;
   d = opendir("/proc");
@@ -112,7 +112,7 @@ void bind_to_free_cpu(afl_state_t *afl) {
   }
 
   closedir(d);
-#elif defined(__FreeBSD__) || defined(__DragonFly__)
+  #elif defined(__FreeBSD__) || defined(__DragonFly__)
   struct kinfo_proc *procs;
   size_t             nprocs;
   size_t             proccount;
@@ -133,7 +133,7 @@ void bind_to_free_cpu(afl_state_t *afl) {
 
   for (i = 0; i < proccount; i++) {
 
-#if defined(__FreeBSD__)
+    #if defined(__FreeBSD__)
     if (!strcmp(procs[i].ki_comm, "idle")) continue;
 
     // fix when ki_oncpu = -1
@@ -143,16 +143,16 @@ void bind_to_free_cpu(afl_state_t *afl) {
 
     if (oncpu != -1 && oncpu < sizeof(cpu_used) && procs[i].ki_pctcpu > 60)
       cpu_used[oncpu] = 1;
-#elif defined(__DragonFly__)
+    #elif defined(__DragonFly__)
     if (procs[i].kp_lwp.kl_cpuid < sizeof(cpu_used) &&
         procs[i].kp_lwp.kl_pctcpu > 10)
       cpu_used[procs[i].kp_lwp.kl_cpuid] = 1;
-#endif
+    #endif
 
   }
 
   ck_free(procs);
-#elif defined(__NetBSD__)
+  #elif defined(__NetBSD__)
   struct kinfo_proc2 *procs;
   size_t              nprocs;
   size_t              proccount;
@@ -181,15 +181,15 @@ void bind_to_free_cpu(afl_state_t *afl) {
   }
 
   ck_free(procs);
-#else
-#warning \
-    "For this platform we do not have free CPU binding code yet. If possible, please supply a PR to https://github.com/AFLplusplus/AFLplusplus"
-#endif
+  #else
+    #warning \
+        "For this platform we do not have free CPU binding code yet. If possible, please supply a PR to https://github.com/AFLplusplus/AFLplusplus"
+  #endif
 
   size_t cpu_start = 0;
 
   try:
-#ifndef __ANDROID__
+  #ifndef __ANDROID__
     for (i = cpu_start; i < afl->cpu_core_count; i++) {
 
       if (!cpu_used[i]) { break; }
@@ -198,12 +198,12 @@ void bind_to_free_cpu(afl_state_t *afl) {
 
   if (i == afl->cpu_core_count) {
 
-#else
+  #else
     for (i = afl->cpu_core_count - cpu_start - 1; i > -1; i--)
       if (!cpu_used[i]) break;
   if (i == -1) {
 
-#endif
+  #endif
 
     SAYF("\n" cLRD "[-] " cRST
          "Uh-oh, looks like all %d CPU cores on your system are allocated to\n"
@@ -221,16 +221,16 @@ void bind_to_free_cpu(afl_state_t *afl) {
 
   afl->cpu_aff = i;
 
-#if defined(__linux__) || defined(__FreeBSD__) || defined(__DragonFly__)
+  #if defined(__linux__) || defined(__FreeBSD__) || defined(__DragonFly__)
   CPU_ZERO(&c);
   CPU_SET(i, &c);
-#elif defined(__NetBSD__)
+  #elif defined(__NetBSD__)
   c = cpuset_create();
   if (c == NULL) PFATAL("cpuset_create failed");
   cpuset_set(i, c);
-#endif
+  #endif
 
-#if defined(__linux__)
+  #if defined(__linux__)
   if (sched_setaffinity(0, sizeof(c), &c)) {
 
     if (cpu_start == afl->cpu_core_count) {
@@ -246,7 +246,7 @@ void bind_to_free_cpu(afl_state_t *afl) {
 
   }
 
-#elif defined(__FreeBSD__) || defined(__DragonFly__)
+  #elif defined(__FreeBSD__) || defined(__DragonFly__)
   if (pthread_setaffinity_np(pthread_self(), sizeof(c), &c)) {
 
     if (cpu_start == afl->cpu_core_count)
@@ -258,7 +258,7 @@ void bind_to_free_cpu(afl_state_t *afl) {
 
   }
 
-#elif defined(__NetBSD__)
+  #elif defined(__NetBSD__)
 if (pthread_setaffinity_np(pthread_self(), cpuset_size(c), c)) {
 
   if (cpu_start == afl->cpu_core_count)
@@ -271,10 +271,10 @@ if (pthread_setaffinity_np(pthread_self(), cpuset_size(c), c)) {
 }
 
 cpuset_destroy(c);
-#else
-// this will need something for other platforms
-// TODO: Solaris/Illumos has processor_bind ... might worth a try
-#endif
+  #else
+  // this will need something for other platforms
+  // TODO: Solaris/Illumos has processor_bind ... might worth a try
+  #endif
 
 }
 
@@ -1565,7 +1565,7 @@ void check_crash_handling(void) {
      until I get a box to test the code. So, for now, we check for crash
      reporting the awful way. */
 
-#if !TARGET_OS_IPHONE
+  #if !TARGET_OS_IPHONE
   if (system("launchctl list 2>/dev/null | grep -q '\\.ReportCrash$'")) return;
 
   SAYF(
@@ -1583,7 +1583,7 @@ void check_crash_handling(void) {
       "    launchctl unload -w ${SL}/LaunchAgents/${PL}.plist\n"
       "    sudo launchctl unload -w ${SL}/LaunchDaemons/${PL}.Root.plist\n");
 
-#endif
+  #endif
   if (!get_afl_env("AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES"))
     FATAL("Crash reporter detected");
 
@@ -1778,26 +1778,26 @@ void get_core_count(afl_state_t *afl) {
 
   /* On *BSD systems, we can just use a sysctl to get the number of CPUs. */
 
-#ifdef __APPLE__
+  #ifdef __APPLE__
 
   if (sysctlbyname("hw.logicalcpu", &afl->cpu_core_count, &s, NULL, 0) < 0)
     return;
 
-#else
+  #else
 
   int s_name[2] = {CTL_HW, HW_NCPU};
 
   if (sysctl(s_name, 2, &afl->cpu_core_count, &s, NULL, 0) < 0) return;
 
-#endif                                                        /* ^__APPLE__ */
+  #endif                                                      /* ^__APPLE__ */
 
 #else
 
-#ifdef HAVE_AFFINITY
+  #ifdef HAVE_AFFINITY
 
   afl->cpu_core_count = sysconf(_SC_NPROCESSORS_ONLN);
 
-#else
+  #else
 
   FILE *f = fopen("/proc/stat", "r");
   u8    tmp[1024];
@@ -1809,7 +1809,7 @@ void get_core_count(afl_state_t *afl) {
 
   fclose(f);
 
-#endif                                                    /* ^HAVE_AFFINITY */
+  #endif                                                  /* ^HAVE_AFFINITY */
 
 #endif                        /* ^(__APPLE__ || __FreeBSD__ || __OpenBSD__) */
 
@@ -2102,12 +2102,12 @@ void check_binary(afl_state_t *afl, u8 *fname) {
 
 #else
 
-#if !defined(__arm__) && !defined(__arm64__)
+  #if !defined(__arm__) && !defined(__arm64__)
   if ((f_data[0] != 0xCF || f_data[1] != 0xFA || f_data[2] != 0xED) &&
       (f_data[0] != 0xCA || f_data[1] != 0xFE || f_data[2] != 0xBA))
     FATAL("Program '%s' is not a 64-bit or universal Mach-O binary",
           afl->fsrv.target_path);
-#endif
+  #endif
 
 #endif                                                       /* ^!__APPLE__ */
 
-- 
cgit 1.4.1


From 9627458ecc61783aa1f8bf76835abe00c4107739 Mon Sep 17 00:00:00 2001
From: rish9101 <rranjan@cs.iitr.ac.in>
Date: Wed, 13 May 2020 18:59:12 +0530
Subject: Add post library API as custom mutator and rename pre_save

---
 docs/custom_mutators.md                     | 12 ++++++------
 examples/custom_mutators/example.c          | 24 +++++++++++------------
 examples/custom_mutators/example.py         |  2 +-
 examples/post_library/post_library.so.c     |  2 +-
 examples/post_library/post_library_png.so.c |  2 +-
 include/afl-fuzz.h                          | 22 ++++++++++-----------
 src/afl-fuzz-cmplog.c                       | 11 -----------
 src/afl-fuzz-init.c                         | 24 ++++++++++++++---------
 src/afl-fuzz-mutators.c                     | 18 +++++++++--------
 src/afl-fuzz-python.c                       | 30 ++++++++++++++---------------
 src/afl-fuzz-run.c                          | 20 ++++---------------
 src/afl-fuzz-state.c                        |  1 -
 12 files changed, 75 insertions(+), 93 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/docs/custom_mutators.md b/docs/custom_mutators.md
index b15039d4..9424af9c 100644
--- a/docs/custom_mutators.md
+++ b/docs/custom_mutators.md
@@ -33,7 +33,7 @@ C/C++:
 ```c
 void *afl_custom_init(afl_t *afl, unsigned int seed);
 size_t afl_custom_fuzz(void *data, uint8_t *buf, size_t buf_size, u8 **out_buf, uint8_t *add_buf, size_t add_buf_size, size_t max_size);
-size_t afl_custom_pre_save(void *data, uint8_t *buf, size_t buf_size, uint8_t **out_buf);
+size_t afl_custom_post_process(void *data, uint8_t *buf, size_t buf_size, uint8_t **out_buf);
 int32_t afl_custom_init_trim(void *data, uint8_t *buf, size_t buf_size);
 size_t afl_custom_trim(void *data, uint8_t **out_buf);
 int32_t afl_custom_post_trim(void *data, int success) {
@@ -51,7 +51,7 @@ def init(seed):
 def fuzz(buf, add_buf, max_size):
     return mutated_out
 
-def pre_save(buf):
+def post_process(buf):
     return out_buf
 
 def init_trim(buf):
@@ -92,7 +92,7 @@ def queue_new_entry(filename_new_queue, filename_orig_queue):
     This method performs custom mutations on a given input. It also accepts an
     additional test case.
     Note that this function is optional - but it makes sense to use it.
-    You would only skip this if `pre_send` is used to fix checksums etc.
+    You would only skip this if `post_process` is used to fix checksums etc.
     so you are using it e.g. as a post processing library.
 
 - `havoc_mutation` and `havoc_mutation_probability` (optional):
@@ -102,7 +102,7 @@ def queue_new_entry(filename_new_queue, filename_orig_queue):
     `havoc_mutation_probability`, returns the probability that `havoc_mutation`
     is called in havoc. By default, it is 6%.
 
-- `pre_save` (optional):
+- `post_process` (optional):
 
     For some cases, the format of the mutated data returned from the custom
     mutator is not suitable to directly execute the target with this input.
@@ -110,7 +110,7 @@ def queue_new_entry(filename_new_queue, filename_orig_queue):
     protobuf format which corresponds to a given grammar. In order to execute
     the target, the protobuf data must be converted to the plain-text format
     expected by the target. In such scenarios, the user can define the
-    `pre_save` function. This function is then transforming the data into the
+    `post_process` function. This function is then transforming the data into the
     format expected by the API before executing the target.
 
 - `queue_new_entry` (optional):
@@ -222,7 +222,7 @@ For C/C++ mutator, the source code must be compiled as a shared object:
 gcc -shared -Wall -O3 example.c -o example.so
 ```
 Note that if you specify multiple custom mutators, the corresponding functions will
-be called in the order in which they are specified. e.g first `pre_save` function of
+be called in the order in which they are specified. e.g first `post_process` function of
 `example_first.so` will be called and then that of `example_second.so`
 
 ### Run
diff --git a/examples/custom_mutators/example.c b/examples/custom_mutators/example.c
index c8200b26..c9be3e0c 100644
--- a/examples/custom_mutators/example.c
+++ b/examples/custom_mutators/example.c
@@ -38,7 +38,7 @@ typedef struct my_mutator {
   BUF_VAR(u8, data);
   BUF_VAR(u8, havoc);
   BUF_VAR(u8, trim);
-  BUF_VAR(u8, pre_save);
+  BUF_VAR(u8, post_process);
 
 } my_mutator_t;
 
@@ -139,11 +139,11 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
  * @return Size of the output buffer after processing or the needed amount.
  *     A return of 0 indicates an error.
  */
-size_t afl_custom_pre_save(my_mutator_t *data, uint8_t *buf, size_t buf_size,
+size_t afl_custom_post_process(my_mutator_t *data, uint8_t *buf, size_t buf_size,
                            uint8_t **out_buf) {
 
-  uint8_t *pre_save_buf = maybe_grow(BUF_PARAMS(data, pre_save), buf_size + 5);
-  if (!pre_save_buf) {
+  uint8_t *post_process_buf = maybe_grow(BUF_PARAMS(data, post_process), buf_size + 5);
+  if (!post_process_buf) {
 
     perror("custom mutator realloc failed.");
     *out_buf = NULL;
@@ -151,14 +151,14 @@ size_t afl_custom_pre_save(my_mutator_t *data, uint8_t *buf, size_t buf_size,
 
   }
 
-  memcpy(pre_save_buf + 5, buf, buf_size);
-  pre_save_buf[0] = 'A';
-  pre_save_buf[1] = 'F';
-  pre_save_buf[2] = 'L';
-  pre_save_buf[3] = '+';
-  pre_save_buf[4] = '+';
+  memcpy(post_process_buf + 5, buf, buf_size);
+  post_process_buf[0] = 'A';
+  post_process_buf[1] = 'F';
+  post_process_buf[2] = 'L';
+  post_process_buf[3] = '+';
+  post_process_buf[4] = '+';
 
-  *out_buf = pre_save_buf;
+  *out_buf = post_process_buf;
 
   return buf_size + 5;
 
@@ -364,7 +364,7 @@ void afl_custom_queue_new_entry(my_mutator_t * data,
  */
 void afl_custom_deinit(my_mutator_t *data) {
 
-  free(data->pre_save_buf);
+  free(data->post_process_buf);
   free(data->havoc_buf);
   free(data->data_buf);
   free(data->fuzz_buf);
diff --git a/examples/custom_mutators/example.py b/examples/custom_mutators/example.py
index 3c3fa8c1..cf659e5a 100644
--- a/examples/custom_mutators/example.py
+++ b/examples/custom_mutators/example.py
@@ -120,7 +120,7 @@ def fuzz(buf, add_buf, max_size):
 #
 #     return next_index
 #
-# def pre_save(buf):
+# def post_process(buf):
 #     '''
 #     Called just before the execution to write the test case in the format
 #     expected by the target
diff --git a/examples/post_library/post_library.so.c b/examples/post_library/post_library.so.c
index 0aa780cb..69fb221e 100644
--- a/examples/post_library/post_library.so.c
+++ b/examples/post_library/post_library.so.c
@@ -83,7 +83,7 @@ typedef struct post_state {
 
 } post_state_t;
 
-void *afl_postprocess_init(void *afl) {
+void *afl_postprocess_init(void *afl, unsigned int seed{
 
   post_state_t *state = malloc(sizeof(post_state_t));
   if (!state) {
diff --git a/examples/post_library/post_library_png.so.c b/examples/post_library/post_library_png.so.c
index 41ba4f5e..b29afd62 100644
--- a/examples/post_library/post_library_png.so.c
+++ b/examples/post_library/post_library_png.so.c
@@ -43,7 +43,7 @@ typedef struct post_state {
 
 } post_state_t;
 
-void *afl_postprocess_init(void *afl) {
+void *afl_postprocess_init(void *afl, unsigned int seed) {
 
   post_state_t *state = malloc(sizeof(post_state_t));
   if (!state) {
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 421413ca..057f78c2 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -260,7 +260,7 @@ enum {
 
   /* 00 */ PY_FUNC_INIT,
   /* 01 */ PY_FUNC_FUZZ,
-  /* 02 */ PY_FUNC_PRE_SAVE,
+  /* 02 */ PY_FUNC_post_process,
   /* 03 */ PY_FUNC_INIT_TRIM,
   /* 04 */ PY_FUNC_POST_TRIM,
   /* 05 */ PY_FUNC_TRIM,
@@ -283,8 +283,8 @@ typedef struct py_mutator {
   u8 *   fuzz_buf;
   size_t fuzz_size;
 
-  u8 *   pre_save_buf;
-  size_t pre_save_size;
+  u8 *   post_process_buf;
+  size_t post_process_size;
 
   u8 *   trim_buf;
   size_t trim_size;
@@ -545,11 +545,9 @@ typedef struct afl_state {
   struct extra_data *a_extras;          /* Automatically selected extras    */
   u32                a_extras_cnt;      /* Total number of tokens available */
 
-  /* afl_postprocess API */
-  void *(*post_init)(struct afl_state *afl);
-  size_t (*post_handler)(void *data, u8 *buf, u32 len, u8 **out_buf);
-  void *(*post_deinit)(void *data);
-  void *post_data;
+  /* afl_postprocess API - Now supported via custom mutators */
+
+  struct custom_mutator * post_library_mutator;
 
   /* CmpLog */
 
@@ -623,8 +621,8 @@ struct custom_mutator {
 
   const char *name;
   void *      dh;
-  u8 *        pre_save_buf;
-  size_t      pre_save_size;
+  u8 *        post_process_buf;
+  size_t      post_process_size;
   u8          stacked_custom_prob, stacked_custom;
 
   void *data;                                    /* custom mutator data ptr */
@@ -675,7 +673,7 @@ struct custom_mutator {
    *     It can chose to alter buf in-place, if the space is large enough.
    * @return Size of the output buffer.
    */
-  size_t (*afl_custom_pre_save)(void *data, u8 *buf, size_t buf_size,
+  size_t (*afl_custom_post_process)(void *data, u8 *buf, size_t buf_size,
                                 u8 **out_buf);
 
   /**
@@ -825,7 +823,7 @@ u8   trim_case_custom(afl_state_t *, struct queue_entry *q, u8 *in_buf,
 struct custom_mutator *load_custom_mutator_py(afl_state_t *, char *);
 void                   finalize_py_module(void *);
 
-size_t pre_save_py(void *, u8 *, size_t, u8 **);
+size_t post_process_py(void *, u8 *, size_t, u8 **);
 s32    init_trim_py(void *, u8 *, size_t);
 s32    post_trim_py(void *, u8);
 size_t trim_py(void *, u8 **);
diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c
index 9452fa90..4be6a2c8 100644
--- a/src/afl-fuzz-cmplog.c
+++ b/src/afl-fuzz-cmplog.c
@@ -51,17 +51,6 @@ u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
 
   u8 fault;
 
-  if (afl->post_handler) {
-
-    u8 *post_buf = NULL;
-
-    size_t post_len =
-        afl->post_handler(afl->post_data, out_buf, len, &post_buf);
-    if (!post_buf || !post_len) { return 0; }
-    out_buf = post_buf;
-    len = post_len;
-
-  }
 
   write_to_testcase(afl, out_buf, len);
 
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 78b92368..2686d014 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -297,12 +297,16 @@ void setup_post(afl_state_t *afl) {
   dh = dlopen(fn, RTLD_NOW);
   if (!dh) { FATAL("%s", dlerror()); }
 
-  afl->post_handler = dlsym(dh, "afl_postprocess");
-  if (!afl->post_handler) { FATAL("Symbol 'afl_postprocess' not found."); }
-  afl->post_init = dlsym(dh, "afl_postprocess_init");
-  if (!afl->post_init) { FATAL("Symbol 'afl_postprocess_init' not found."); }
-  afl->post_deinit = dlsym(dh, "afl_postprocess_deinit");
-  if (!afl->post_deinit) {
+  struct custom_mutator * mutator;
+  mutator = ck_alloc(sizeof(struct custom_mutator));
+  memset(mutator, 0, sizeof(struct custom_mutator));
+
+  mutator->afl_custom_post_process = dlsym(dh, "afl_postprocess");
+  if (!mutator->afl_custom_post_process) { FATAL("Symbol 'afl_postprocess' not found."); }
+  mutator->afl_custom_init = dlsym(dh, "afl_postprocess_init");
+  if (!mutator->afl_custom_init) { FATAL("Symbol 'afl_postprocess_init' not found."); }
+  mutator->afl_custom_deinit = dlsym(dh, "afl_postprocess_deinit");
+  if (!mutator->afl_custom_post_process) {
 
     FATAL("Symbol 'afl_postprocess_deinit' not found.");
 
@@ -311,16 +315,18 @@ void setup_post(afl_state_t *afl) {
   /* Do a quick test. It's better to segfault now than later =) */
 
   u8 *post_buf = NULL;
-  afl->post_data = afl->post_init(afl);
-  if (!afl->post_data) { FATAL("Could not initialize post handler."); }
+  mutator->data = mutator->afl_custom_init(afl, rand_below(afl, 0xFFFFFFFF));
+  if (!mutator->data) { FATAL("Could not initialize post handler."); }
 
-  size_t post_len = afl->post_handler(afl->post_data, tbuf, tlen, &post_buf);
+  size_t post_len = mutator->afl_custom_post_process(mutator->data, tbuf, tlen, &post_buf);
   if (!post_len || !post_buf) {
 
     SAYF("Empty return in test post handler for buf=\"hello\\0\".");
 
   }
 
+  afl->post_library_mutator = mutator;
+
   OKF("Postprocessor installed successfully.");
 
 }
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 2c2efc94..acc1b12d 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -108,6 +108,8 @@ void setup_custom_mutators(afl_state_t *afl) {
 
 #endif
 
+  if (afl->post_library_mutator) list_append(&afl->custom_mutator_list, afl->post_library_mutator);
+
 }
 
 void destroy_custom_mutators(afl_state_t *afl) {
@@ -120,11 +122,11 @@ void destroy_custom_mutators(afl_state_t *afl) {
       if (el->afl_custom_deinit) el->afl_custom_deinit(el->data);
       if (el->dh) dlclose(el->dh);
 
-      if (el->pre_save_buf) {
+      if (el->post_process_buf) {
 
-        ck_free(el->pre_save_buf);
-        el->pre_save_buf = NULL;
-        el->pre_save_size = 0;
+        ck_free(el->post_process_buf);
+        el->post_process_buf = NULL;
+        el->post_process_size = 0;
 
       }
 
@@ -170,10 +172,10 @@ struct custom_mutator *load_custom_mutator(afl_state_t *afl, const char *fn) {
   mutator->afl_custom_deinit = dlsym(dh, "afl_custom_deinit");
   if (!mutator->afl_custom_deinit) FATAL("Symbol 'afl_custom_init' not found.");
 
-  /* "afl_custom_pre_save", optional */
-  mutator->afl_custom_pre_save = dlsym(dh, "afl_custom_pre_save");
-  if (!mutator->afl_custom_pre_save)
-    ACTF("optional symbol 'afl_custom_pre_save' not found.");
+  /* "afl_custom_post_process", optional */
+  mutator->afl_custom_post_process = dlsym(dh, "afl_custom_post_process");
+  if (!mutator->afl_custom_post_process)
+    ACTF("optional symbol 'afl_custom_post_process' not found.");
 
   u8 notrim = 0;
   /* "afl_custom_init_trim", optional */
diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c
index 460d6683..984561fd 100644
--- a/src/afl-fuzz-python.c
+++ b/src/afl-fuzz-python.c
@@ -142,8 +142,8 @@ static py_mutator_t *init_py_module(afl_state_t *afl, u8 *module_name) {
       py_functions[PY_FUNC_FUZZ] = PyObject_GetAttrString(py_module, "mutate");
     if (!py_functions[PY_FUNC_FUZZ])
       WARNF("fuzz function not found in python module");
-    py_functions[PY_FUNC_PRE_SAVE] =
-        PyObject_GetAttrString(py_module, "pre_save");
+    py_functions[PY_FUNC_post_process] =
+        PyObject_GetAttrString(py_module, "post_process");
     py_functions[PY_FUNC_INIT_TRIM] =
         PyObject_GetAttrString(py_module, "init_trim");
     py_functions[PY_FUNC_POST_TRIM] =
@@ -165,9 +165,9 @@ static py_mutator_t *init_py_module(afl_state_t *afl, u8 *module_name) {
 
       if (!py_functions[py_idx] || !PyCallable_Check(py_functions[py_idx])) {
 
-        if (py_idx == PY_FUNC_PRE_SAVE) {
+        if (py_idx == PY_FUNC_post_process) {
 
-          // Implenting the pre_save API is optional for now
+          // Implenting the post_process API is optional for now
           if (PyErr_Occurred()) { PyErr_Print(); }
 
         } else if (py_idx >= PY_FUNC_INIT_TRIM && py_idx <= PY_FUNC_TRIM) {
@@ -309,8 +309,8 @@ struct custom_mutator *load_custom_mutator_py(afl_state_t *afl,
   struct custom_mutator *mutator;
 
   mutator = ck_alloc(sizeof(struct custom_mutator));
-  mutator->pre_save_buf = NULL;
-  mutator->pre_save_size = 0;
+  mutator->post_process_buf = NULL;
+  mutator->post_process_size = 0;
 
   mutator->name = module_name;
   ACTF("Loading Python mutator library from '%s'...", module_name);
@@ -330,9 +330,9 @@ struct custom_mutator *load_custom_mutator_py(afl_state_t *afl,
      is quite different from the custom mutator. */
   mutator->afl_custom_fuzz = fuzz_py;
 
-  if (py_functions[PY_FUNC_PRE_SAVE]) {
+  if (py_functions[PY_FUNC_post_process]) {
 
-    mutator->afl_custom_pre_save = pre_save_py;
+    mutator->afl_custom_post_process = post_process_py;
 
   }
 
@@ -384,7 +384,7 @@ struct custom_mutator *load_custom_mutator_py(afl_state_t *afl,
 
 }
 
-size_t pre_save_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
+size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
 
   size_t        py_out_buf_size;
   PyObject *    py_args, *py_value;
@@ -395,14 +395,14 @@ size_t pre_save_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
   if (!py_value) {
 
     Py_DECREF(py_args);
-    FATAL("Failed to convert arguments in custom pre_save");
+    FATAL("Failed to convert arguments in custom post_process");
 
   }
 
   PyTuple_SetItem(py_args, 0, py_value);
 
   py_value = PyObject_CallObject(
-      ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_PRE_SAVE], py_args);
+      ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_post_process], py_args);
 
   Py_DECREF(py_args);
 
@@ -410,18 +410,18 @@ size_t pre_save_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
 
     py_out_buf_size = PyByteArray_Size(py_value);
 
-    ck_maybe_grow(BUF_PARAMS(pre_save), py_out_buf_size);
+    ck_maybe_grow(BUF_PARAMS(post_process), py_out_buf_size);
 
-    memcpy(py->pre_save_buf, PyByteArray_AsString(py_value), py_out_buf_size);
+    memcpy(py->post_process_buf, PyByteArray_AsString(py_value), py_out_buf_size);
     Py_DECREF(py_value);
 
-    *out_buf = py->pre_save_buf;
+    *out_buf = py->post_process_buf;
     return py_out_buf_size;
 
   } else {
 
     PyErr_Print();
-    FATAL("Python custom mutator: pre_save call failed.");
+    FATAL("Python custom mutator: post_process call failed.");
 
   }
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 468b5fc6..d9adb792 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -97,10 +97,10 @@ void write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
 
     LIST_FOREACH(&afl->custom_mutator_list, struct custom_mutator, {
 
-      if (el->afl_custom_pre_save) {
+      if (el->afl_custom_post_process) {
 
         new_size =
-            el->afl_custom_pre_save(el->data, new_mem, new_size, &new_buf);
+            el->afl_custom_post_process(el->data, new_mem, new_size, &new_buf);
 
       }
 
@@ -110,7 +110,7 @@ void write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
 
     if (unlikely(!new_buf && (new_size <= 0))) {
 
-      FATAL("Custom_pre_save failed (ret: %lu)", (long unsigned)new_size);
+      FATAL("Custom_post_process failed (ret: %lu)", (long unsigned)new_size);
 
     } else if (likely(new_buf)) {
 
@@ -119,7 +119,7 @@ void write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
 
     } else {
 
-      /* custom mutators do not has a custom_pre_save function */
+      /* custom mutators do not has a custom_post_process function */
       afl_fsrv_write_to_testcase(&afl->fsrv, mem, len);
 
     }
@@ -690,18 +690,6 @@ u8 common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
 
   u8 fault;
 
-  if (afl->post_handler) {
-
-    u8 *post_buf = NULL;
-
-    size_t post_len =
-        afl->post_handler(afl->post_data, out_buf, len, &post_buf);
-    if (!post_buf || !post_len) { return 0; }
-    out_buf = post_buf;
-    len = post_len;
-
-  }
-
   write_to_testcase(afl, out_buf, len);
 
   fault = fuzz_run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);
diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c
index 4f5389e3..316f9bd9 100644
--- a/src/afl-fuzz-state.c
+++ b/src/afl-fuzz-state.c
@@ -371,7 +371,6 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
 
 void afl_state_deinit(afl_state_t *afl) {
 
-  if (afl->post_deinit) { afl->post_deinit(afl->post_data); }
   if (afl->in_place_resume) { ck_free(afl->in_dir); }
   if (afl->sync_id) { ck_free(afl->out_dir); }
   if (afl->pass_stats) { ck_free(afl->pass_stats); }
-- 
cgit 1.4.1


From 45bddcd8082eedeeb09500d764c540bc02ec0d74 Mon Sep 17 00:00:00 2001
From: rish9101 <rranjan@cs.iitr.ac.in>
Date: Wed, 13 May 2020 19:25:23 +0530
Subject: Fix bugs, remove intial post library test

---
 examples/post_library/post_library.so.c | 2 +-
 include/afl-fuzz.h                      | 2 +-
 src/afl-fuzz-init.c                     | 7 -------
 3 files changed, 2 insertions(+), 9 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/examples/post_library/post_library.so.c b/examples/post_library/post_library.so.c
index 69fb221e..d9504b23 100644
--- a/examples/post_library/post_library.so.c
+++ b/examples/post_library/post_library.so.c
@@ -83,7 +83,7 @@ typedef struct post_state {
 
 } post_state_t;
 
-void *afl_postprocess_init(void *afl, unsigned int seed{
+void *afl_postprocess_init(void *afl, unsigned int seed) {
 
   post_state_t *state = malloc(sizeof(post_state_t));
   if (!state) {
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 057f78c2..cf8ef735 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -260,7 +260,7 @@ enum {
 
   /* 00 */ PY_FUNC_INIT,
   /* 01 */ PY_FUNC_FUZZ,
-  /* 02 */ PY_FUNC_post_process,
+  /* 02 */ PY_FUNC_POST_PROCESS,
   /* 03 */ PY_FUNC_INIT_TRIM,
   /* 04 */ PY_FUNC_POST_TRIM,
   /* 05 */ PY_FUNC_TRIM,
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 2686d014..33c00c7a 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -318,13 +318,6 @@ void setup_post(afl_state_t *afl) {
   mutator->data = mutator->afl_custom_init(afl, rand_below(afl, 0xFFFFFFFF));
   if (!mutator->data) { FATAL("Could not initialize post handler."); }
 
-  size_t post_len = mutator->afl_custom_post_process(mutator->data, tbuf, tlen, &post_buf);
-  if (!post_len || !post_buf) {
-
-    SAYF("Empty return in test post handler for buf=\"hello\\0\".");
-
-  }
-
   afl->post_library_mutator = mutator;
 
   OKF("Postprocessor installed successfully.");
-- 
cgit 1.4.1


From 645e331559d01d234be231a7f5076c2ad658b159 Mon Sep 17 00:00:00 2001
From: rish9101 <rranjan@cs.iitr.ac.in>
Date: Wed, 13 May 2020 19:46:30 +0530
Subject: Fix previous commit bugs

---
 src/afl-fuzz-init.c   | 1 -
 src/afl-fuzz-python.c | 8 ++++----
 2 files changed, 4 insertions(+), 5 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 33c00c7a..aea22f48 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -314,7 +314,6 @@ void setup_post(afl_state_t *afl) {
 
   /* Do a quick test. It's better to segfault now than later =) */
 
-  u8 *post_buf = NULL;
   mutator->data = mutator->afl_custom_init(afl, rand_below(afl, 0xFFFFFFFF));
   if (!mutator->data) { FATAL("Could not initialize post handler."); }
 
diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c
index 984561fd..2569cdaf 100644
--- a/src/afl-fuzz-python.c
+++ b/src/afl-fuzz-python.c
@@ -142,7 +142,7 @@ static py_mutator_t *init_py_module(afl_state_t *afl, u8 *module_name) {
       py_functions[PY_FUNC_FUZZ] = PyObject_GetAttrString(py_module, "mutate");
     if (!py_functions[PY_FUNC_FUZZ])
       WARNF("fuzz function not found in python module");
-    py_functions[PY_FUNC_post_process] =
+    py_functions[PY_FUNC_POST_PROCESS] =
         PyObject_GetAttrString(py_module, "post_process");
     py_functions[PY_FUNC_INIT_TRIM] =
         PyObject_GetAttrString(py_module, "init_trim");
@@ -165,7 +165,7 @@ static py_mutator_t *init_py_module(afl_state_t *afl, u8 *module_name) {
 
       if (!py_functions[py_idx] || !PyCallable_Check(py_functions[py_idx])) {
 
-        if (py_idx == PY_FUNC_post_process) {
+        if (py_idx == PY_FUNC_POST_PROCESS) {
 
           // Implenting the post_process API is optional for now
           if (PyErr_Occurred()) { PyErr_Print(); }
@@ -330,7 +330,7 @@ struct custom_mutator *load_custom_mutator_py(afl_state_t *afl,
      is quite different from the custom mutator. */
   mutator->afl_custom_fuzz = fuzz_py;
 
-  if (py_functions[PY_FUNC_post_process]) {
+  if (py_functions[PY_FUNC_POST_PROCESS]) {
 
     mutator->afl_custom_post_process = post_process_py;
 
@@ -402,7 +402,7 @@ size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf)
   PyTuple_SetItem(py_args, 0, py_value);
 
   py_value = PyObject_CallObject(
-      ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_post_process], py_args);
+      ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_PROCESS], py_args);
 
   Py_DECREF(py_args);
 
-- 
cgit 1.4.1


From 60a5df52623802ccadd0691b812761b3f4a9120e Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Wed, 13 May 2020 16:49:00 +0200
Subject: code-format and slight -S/-M modifications

---
 examples/custom_mutators/example.c |  7 ++++---
 include/afl-fuzz.h                 |  9 ++++----
 src/afl-fuzz-cmplog.c              |  1 -
 src/afl-fuzz-init.c                | 42 ++++++++++++++++++++++----------------
 src/afl-fuzz-mutators.c            |  3 ++-
 src/afl-fuzz-python.c              |  9 +++++---
 src/afl-fuzz.c                     | 14 +++++--------
 7 files changed, 46 insertions(+), 39 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/examples/custom_mutators/example.c b/examples/custom_mutators/example.c
index c9be3e0c..23add128 100644
--- a/examples/custom_mutators/example.c
+++ b/examples/custom_mutators/example.c
@@ -139,10 +139,11 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
  * @return Size of the output buffer after processing or the needed amount.
  *     A return of 0 indicates an error.
  */
-size_t afl_custom_post_process(my_mutator_t *data, uint8_t *buf, size_t buf_size,
-                           uint8_t **out_buf) {
+size_t afl_custom_post_process(my_mutator_t *data, uint8_t *buf,
+                               size_t buf_size, uint8_t **out_buf) {
 
-  uint8_t *post_process_buf = maybe_grow(BUF_PARAMS(data, post_process), buf_size + 5);
+  uint8_t *post_process_buf =
+      maybe_grow(BUF_PARAMS(data, post_process), buf_size + 5);
   if (!post_process_buf) {
 
     perror("custom mutator realloc failed.");
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index cf8ef735..a1aa58d6 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -407,7 +407,9 @@ typedef struct afl_state {
       no_unlink,                        /* do not unlink cur_input          */
       debug,                            /* Debug mode                       */
       custom_only,                      /* Custom mutator only mode         */
-      python_only;                      /* Python-only mode                 */
+      python_only,                      /* Python-only mode                 */
+      is_master,                        /* if this is a master              */
+      is_slave;                         /* if this is a slave               */
 
   u32 stats_update_freq;                /* Stats update frequency (execs)   */
 
@@ -418,7 +420,6 @@ typedef struct afl_state {
   size_t (*radamsa_mutate_ptr)(u8 *, size_t, u8 *, size_t, u32);
 
   u8 skip_deterministic,                /* Skip deterministic stages?       */
-      force_deterministic,              /* Force deterministic stages?      */
       use_splicing,                     /* Recombine input files?           */
       dumb_mode,                        /* Run in non-instrumented mode?    */
       score_changed,                    /* Scoring for favorites changed?   */
@@ -547,7 +548,7 @@ typedef struct afl_state {
 
   /* afl_postprocess API - Now supported via custom mutators */
 
-  struct custom_mutator * post_library_mutator;
+  struct custom_mutator *post_library_mutator;
 
   /* CmpLog */
 
@@ -674,7 +675,7 @@ struct custom_mutator {
    * @return Size of the output buffer.
    */
   size_t (*afl_custom_post_process)(void *data, u8 *buf, size_t buf_size,
-                                u8 **out_buf);
+                                    u8 **out_buf);
 
   /**
    * This method is called at the start of each trimming operation and receives
diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c
index 4be6a2c8..faf4dcb7 100644
--- a/src/afl-fuzz-cmplog.c
+++ b/src/afl-fuzz-cmplog.c
@@ -51,7 +51,6 @@ u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
 
   u8 fault;
 
-
   write_to_testcase(afl, out_buf, len);
 
   fault = fuzz_run_target(afl, &afl->cmplog_fsrv, afl->fsrv.exec_tmout);
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index aea22f48..d468f2c8 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -297,14 +297,24 @@ void setup_post(afl_state_t *afl) {
   dh = dlopen(fn, RTLD_NOW);
   if (!dh) { FATAL("%s", dlerror()); }
 
-  struct custom_mutator * mutator;
+  struct custom_mutator *mutator;
   mutator = ck_alloc(sizeof(struct custom_mutator));
   memset(mutator, 0, sizeof(struct custom_mutator));
 
   mutator->afl_custom_post_process = dlsym(dh, "afl_postprocess");
-  if (!mutator->afl_custom_post_process) { FATAL("Symbol 'afl_postprocess' not found."); }
+  if (!mutator->afl_custom_post_process) {
+
+    FATAL("Symbol 'afl_postprocess' not found.");
+
+  }
+
   mutator->afl_custom_init = dlsym(dh, "afl_postprocess_init");
-  if (!mutator->afl_custom_init) { FATAL("Symbol 'afl_postprocess_init' not found."); }
+  if (!mutator->afl_custom_init) {
+
+    FATAL("Symbol 'afl_postprocess_init' not found.");
+
+  }
+
   mutator->afl_custom_deinit = dlsym(dh, "afl_postprocess_deinit");
   if (!mutator->afl_custom_post_process) {
 
@@ -1373,6 +1383,17 @@ void setup_dirs_fds(afl_state_t *afl) {
 
   }
 
+/*
+  if (afl->is_master) {
+
+    u8 *x = alloc_printf("%s/is_master", afl->sync_dir);
+    int fd = open(x, O_CREAT | O_RDWR, 0644);
+    if (fd < 0) FATAL("cannot create %s", x);
+    close(fd);
+
+  }
+*/
+
   if (mkdir(afl->out_dir, 0700)) {
 
     if (errno != EEXIST) { PFATAL("Unable to create '%s'", afl->out_dir); }
@@ -1861,14 +1882,6 @@ void fix_up_sync(afl_state_t *afl) {
 
   if (afl->dumb_mode) { FATAL("-S / -M and -n are mutually exclusive"); }
 
-  if (afl->skip_deterministic) {
-
-    if (afl->force_deterministic) { FATAL("use -S instead of -M -d"); }
-    // else
-    //  FATAL("-S already implies -d");
-
-  }
-
   while (*x) {
 
     if (!isalnum(*x) && *x != '_' && *x != '-') {
@@ -1888,13 +1901,6 @@ void fix_up_sync(afl_state_t *afl) {
   afl->sync_dir = afl->out_dir;
   afl->out_dir = x;
 
-  if (!afl->force_deterministic) {
-
-    afl->skip_deterministic = 1;
-    afl->use_splicing = 1;
-
-  }
-
 }
 
 /* Handle screen resize (SIGWINCH). */
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index acc1b12d..87cb86fa 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -108,7 +108,8 @@ void setup_custom_mutators(afl_state_t *afl) {
 
 #endif
 
-  if (afl->post_library_mutator) list_append(&afl->custom_mutator_list, afl->post_library_mutator);
+  if (afl->post_library_mutator)
+    list_append(&afl->custom_mutator_list, afl->post_library_mutator);
 
 }
 
diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c
index 2569cdaf..2044c97d 100644
--- a/src/afl-fuzz-python.c
+++ b/src/afl-fuzz-python.c
@@ -384,7 +384,8 @@ struct custom_mutator *load_custom_mutator_py(afl_state_t *afl,
 
 }
 
-size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
+size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size,
+                       u8 **out_buf) {
 
   size_t        py_out_buf_size;
   PyObject *    py_args, *py_value;
@@ -402,7 +403,8 @@ size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf)
   PyTuple_SetItem(py_args, 0, py_value);
 
   py_value = PyObject_CallObject(
-      ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_PROCESS], py_args);
+      ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_PROCESS],
+      py_args);
 
   Py_DECREF(py_args);
 
@@ -412,7 +414,8 @@ size_t post_process_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf)
 
     ck_maybe_grow(BUF_PARAMS(post_process), py_out_buf_size);
 
-    memcpy(py->post_process_buf, PyByteArray_AsString(py_value), py_out_buf_size);
+    memcpy(py->post_process_buf, PyByteArray_AsString(py_value),
+           py_out_buf_size);
     Py_DECREF(py_value);
 
     *out_buf = py->post_process_buf;
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 8075f03d..979ebfa3 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -390,7 +390,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
         }
 
-        afl->force_deterministic = 1;
+        afl->is_master = 1;
 
       }
 
@@ -400,6 +400,9 @@ int main(int argc, char **argv_orig, char **envp) {
 
         if (afl->sync_id) { FATAL("Multiple -S or -M options not supported"); }
         afl->sync_id = ck_strdup(optarg);
+        afl->is_slave = 1;
+        afl->skip_deterministic = 1;
+        afl->use_splicing = 1;
         break;
 
       case 'f':                                              /* target file */
@@ -500,12 +503,6 @@ int main(int argc, char **argv_orig, char **envp) {
 
       case 'd':                                       /* skip deterministic */
 
-        if (afl->skip_deterministic) {
-
-          FATAL("Multiple -d options not supported");
-
-        }
-
         afl->skip_deterministic = 1;
         afl->use_splicing = 1;
         break;
@@ -794,8 +791,7 @@ int main(int argc, char **argv_orig, char **envp) {
   OKF("afl-tmin fork server patch from github.com/nccgroup/TriforceAFL");
   OKF("MOpt Mutator from github.com/puppet-meteor/MOpt-AFL");
 
-  if (afl->sync_id && afl->force_deterministic &&
-      afl->afl_env.afl_custom_mutator_only) {
+  if (afl->sync_id && afl->is_master && afl->afl_env.afl_custom_mutator_only) {
 
     WARNF(
         "Using -M master with the AFL_CUSTOM_MUTATOR_ONLY mutator options will "
-- 
cgit 1.4.1


From 8cc54424019d64d5dabd5c53277ddb09542b5a1c Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Wed, 13 May 2020 18:20:06 +0200
Subject: fix GNUmakefile

---
 GNUmakefile         |  6 +++---
 src/afl-fuzz-init.c | 18 ++++++++++--------
 src/afl-fuzz-run.c  | 14 ++++++++++++++
 3 files changed, 27 insertions(+), 11 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/GNUmakefile b/GNUmakefile
index eefba857..00b61cd2 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -211,9 +211,9 @@ ifeq "$(shell echo 'int main() { return 0;}' | $(CC) $(CFLAGS) -fsanitize=addres
 endif
 
 ifdef ASAN_BUILD
-        $(info Compiling ASAN version of binaries)
-        CFLAGS+=$(ASAN_CFLAGS)
-        LDFLAGS+=$(ASAN_LDFLAGS)
+  $(info Compiling ASAN version of binaries)
+  CFLAGS+=$(ASAN_CFLAGS)
+  LDFLAGS+=$(ASAN_LDFLAGS)
 endif
 
 ifeq "$(shell echo '$(HASH)include <sys/ipc.h>@$(HASH)include <sys/shm.h>@int main() { int _id = shmget(IPC_PRIVATE, 65536, IPC_CREAT | IPC_EXCL | 0600); shmctl(_id, IPC_RMID, 0); return 0;}' | tr @ '\n' | $(CC) $(CFLAGS) -x c - -o .test2 2>/dev/null && echo 1 || echo 0 ; rm -f .test2 )" "1"
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index d468f2c8..9b7ead29 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -1383,16 +1383,18 @@ void setup_dirs_fds(afl_state_t *afl) {
 
   }
 
-/*
-  if (afl->is_master) {
+  /*
+    if (afl->is_master) {
 
-    u8 *x = alloc_printf("%s/is_master", afl->sync_dir);
-    int fd = open(x, O_CREAT | O_RDWR, 0644);
-    if (fd < 0) FATAL("cannot create %s", x);
-    close(fd);
+      u8 *x = alloc_printf("%s/%s/is_master", afl->sync_dir, afl->sync_id);
+      int fd = open(x, O_CREAT | O_RDWR, 0644);
+      if (fd < 0) FATAL("cannot create %s", x);
+      free(x);
+      close(fd);
 
-  }
-*/
+    }
+
+  */
 
   if (mkdir(afl->out_dir, 0700)) {
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index d9adb792..bbcd9a99 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -401,6 +401,20 @@ void sync_fuzzers(afl_state_t *afl) {
 
     }
 
+    /*
+        // a slave only syncs from a master, a master syncs from everyone
+        if (likely(afl->is_slave)) {
+
+          u8 x = alloc_printf("%s/%s/is_master", afl->sync_dir, sd_ent->d_name);
+          int res = access(x, F_OK);
+          free(x);
+          if (res != 0)
+            continue;
+
+        }
+
+    */
+
     /* Skip anything that doesn't have a queue/ subdirectory. */
 
     qd_path = alloc_printf("%s/%s/queue", afl->sync_dir, sd_ent->d_name);
-- 
cgit 1.4.1


From 044bd3cb41eac8de33ccc8bbd3001438b637ee55 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Wed, 13 May 2020 18:58:32 +0200
Subject: init/deinit need to be optional for post lib

---
 src/afl-fuzz-init.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 9b7ead29..daaac969 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -311,22 +311,17 @@ void setup_post(afl_state_t *afl) {
   mutator->afl_custom_init = dlsym(dh, "afl_postprocess_init");
   if (!mutator->afl_custom_init) {
 
-    FATAL("Symbol 'afl_postprocess_init' not found.");
+    WARNF("optional symbol 'afl_postprocess_init' not found.");
 
   }
 
   mutator->afl_custom_deinit = dlsym(dh, "afl_postprocess_deinit");
   if (!mutator->afl_custom_post_process) {
 
-    FATAL("Symbol 'afl_postprocess_deinit' not found.");
+    WARNF("optional symbol 'afl_postprocess_deinit' not found.");
 
   }
 
-  /* Do a quick test. It's better to segfault now than later =) */
-
-  mutator->data = mutator->afl_custom_init(afl, rand_below(afl, 0xFFFFFFFF));
-  if (!mutator->data) { FATAL("Could not initialize post handler."); }
-
   afl->post_library_mutator = mutator;
 
   OKF("Postprocessor installed successfully.");
-- 
cgit 1.4.1


From d334093606ff4fb77822f11cde7a80fa880de0c7 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 14 May 2020 01:00:11 +0200
Subject: deprecated AFL_POST_LIBRARY

---
 README.md                                   |   5 +-
 docs/Changelog.md                           |   2 +
 docs/env_variables.md                       |   5 +-
 docs/sister_projects.md                     |   7 --
 examples/post_library/post_library.so.c     | 159 ----------------------------
 examples/post_library/post_library_png.so.c | 156 ---------------------------
 include/afl-fuzz.h                          |   5 +-
 src/afl-common.c                            |   2 +-
 src/afl-fuzz-init.c                         |  48 ---------
 src/afl-fuzz-state.c                        |   6 +-
 src/afl-fuzz.c                              |   3 -
 test/test.sh                                |   1 -
 12 files changed, 14 insertions(+), 385 deletions(-)
 delete mode 100644 examples/post_library/post_library.so.c
 delete mode 100644 examples/post_library/post_library_png.so.c

(limited to 'src/afl-fuzz-init.c')

diff --git a/README.md b/README.md
index 04ead78e..a2c81aa4 100644
--- a/README.md
+++ b/README.md
@@ -672,8 +672,9 @@ Here are some of the most important caveats for AFL:
 
     To work around this, you can comment out the relevant checks (see
     examples/libpng_no_checksum/ for inspiration); if this is not possible,
-    you can also write a postprocessor, as explained in
-    examples/post_library/ (with AFL_POST_LIBRARY)
+    you can also write a postprocessor, one of the hooks of custom mutators.
+    See [docs/custom_mutators.md](docs/custom_mutators.md) on how to use
+    `AFL_CUSTOM_MUTATOR_LIBRARY`
 
   - There are some unfortunate trade-offs with ASAN and 64-bit binaries. This
     isn't due to any specific fault of afl-fuzz; see [docs/notes_for_asan.md](docs/notes_for_asan.md)
diff --git a/docs/Changelog.md b/docs/Changelog.md
index 0b5c11e8..4b2d7977 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -15,6 +15,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
      - better python detection
      - an old, old bug in afl that would show negative stability in rare
        circumstances is now hopefully fixed
+     - AFL_POST_LIBRARY was deprecated, use AFL_CUSTOM_MUTATOR_LIBRARY
+       instead (see docs/custom_mutators.md)
   - llvm_mode:
      - afl-clang-fast/lto now do not skip single block functions. This
        behaviour can be reactivated with AFL_LLVM_SKIPSINGLEBLOCK
diff --git a/docs/env_variables.md b/docs/env_variables.md
index 36e5a432..2668be7d 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -310,9 +310,8 @@ checks or alter some of the more exotic semantics of the tool:
     else. This makes the "own finds" counter in the UI more accurate.
     Beyond counter aesthetics, not much else should change.
 
-  - Setting AFL_POST_LIBRARY allows you to configure a postprocessor for
-    mutated files - say, to fix up checksums. See examples/post_library/
-    for more.
+  - Note that AFL_POST_LIBRARY is deprecated, use AFL_CUSTOM_MUTATOR_LIBRARY
+    instead (see below).
 
   - Setting AFL_CUSTOM_MUTATOR_LIBRARY to a shared library with
     afl_custom_fuzz() creates additional mutations through this library.
diff --git a/docs/sister_projects.md b/docs/sister_projects.md
index 1625044c..a501ecbd 100644
--- a/docs/sister_projects.md
+++ b/docs/sister_projects.md
@@ -56,13 +56,6 @@ functionality is now available as the "persistent" feature described in
 
 http://llvm.org/docs/LibFuzzer.html
 
-## AFL fixup shim (Ben Nagy)
-
-Allows AFL_POST_LIBRARY postprocessors to be written in arbitrary languages
-that don't have C / .so bindings. Includes examples in Go.
-
-https://github.com/bnagy/aflfix
-
 ## TriforceAFL (Tim Newsham and Jesse Hertz)
 
 Leverages QEMU full system emulation mode to allow AFL to target operating
diff --git a/examples/post_library/post_library.so.c b/examples/post_library/post_library.so.c
deleted file mode 100644
index d9504b23..00000000
--- a/examples/post_library/post_library.so.c
+++ /dev/null
@@ -1,159 +0,0 @@
-/*
-   american fuzzy lop++ - postprocessor library example
-   --------------------------------------------------
-
-   Originally written by Michal Zalewski
-   Edited by Dominik Maier, 2020
-
-   Copyright 2015 Google Inc. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   Postprocessor libraries can be passed to afl-fuzz to perform final cleanup
-   of any mutated test cases - for example, to fix up checksums in PNG files.
-
-   Please heed the following warnings:
-
-   1) In almost all cases, it is more productive to comment out checksum logic
-      in the targeted binary (as shown in ../libpng_no_checksum/). One possible
-      exception is the process of fuzzing binary-only software in QEMU mode.
-
-   2) The use of postprocessors for anything other than checksums is
-   questionable and may cause more harm than good. AFL is normally pretty good
-   about dealing with length fields, magic values, etc.
-
-   3) Postprocessors that do anything non-trivial must be extremely robust to
-      gracefully handle malformed data and other error conditions - otherwise,
-      they will crash and take afl-fuzz down with them. Be wary of reading past
-      *len and of integer overflows when calculating file offsets.
-
-   In other words, THIS IS PROBABLY NOT WHAT YOU WANT - unless you really,
-   honestly know what you're doing =)
-
-   With that out of the way: the postprocessor library is passed to afl-fuzz
-   via AFL_POST_LIBRARY. The library must be compiled with:
-
-     gcc -shared -Wall -O3 post_library.so.c -o post_library.so
-
-   AFL will call the afl_postprocess() function for every mutated output buffer.
-   From there, you have three choices:
-
-   1) If you don't want to modify the test case, simply set `*out_buf = in_buf`
-      and return the original `len`.
-
-   2) If you want to skip this test case altogether and have AFL generate a
-      new one, return 0 or set `*out_buf = NULL`.
-      Use this sparingly - it's faster than running the target program
-      with patently useless inputs, but still wastes CPU time.
-
-   3) If you want to modify the test case, allocate an appropriately-sized
-      buffer, move the data into that buffer, make the necessary changes, and
-      then return the new pointer as out_buf. Return an appropriate len
-   afterwards.
-
-      Note that the buffer will *not* be freed for you. To avoid memory leaks,
-      you need to free it or reuse it on subsequent calls (as shown below).
-
-      *** Feel free to reuse the original 'in_buf' BUFFER and return it. ***
-
-    Aight. The example below shows a simple postprocessor that tries to make
-    sure that all input files start with "GIF89a".
-
-    PS. If you don't like C, you can try out the unix-based wrapper from
-    Ben Nagy instead: https://github.com/bnagy/aflfix
-
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-/* Header that must be present at the beginning of every test case: */
-
-#define HEADER "GIF89a"
-
-typedef struct post_state {
-
-  unsigned char *buf;
-  size_t         size;
-
-} post_state_t;
-
-void *afl_postprocess_init(void *afl, unsigned int seed) {
-
-  post_state_t *state = malloc(sizeof(post_state_t));
-  if (!state) {
-
-    perror("malloc");
-    return NULL;
-
-  }
-
-  state->buf = calloc(sizeof(unsigned char), 4096);
-  if (!state->buf) { return NULL; }
-
-  return state;
-
-}
-
-/* The actual postprocessor routine called by afl-fuzz: */
-
-size_t afl_postprocess(post_state_t *data, unsigned char *in_buf,
-                       unsigned int len, unsigned char **out_buf) {
-
-  /* Skip execution altogether for buffers shorter than 6 bytes (just to
-     show how it's done). We can trust len to be sane. */
-
-  if (len < strlen(HEADER)) return 0;
-
-  /* Do nothing for buffers that already start with the expected header. */
-
-  if (!memcmp(in_buf, HEADER, strlen(HEADER))) {
-
-    *out_buf = in_buf;
-    return len;
-
-  }
-
-  /* Allocate memory for new buffer, reusing previous allocation if
-     possible. */
-
-  *out_buf = realloc(data->buf, len);
-
-  /* If we're out of memory, the most graceful thing to do is to return the
-     original buffer and give up on modifying it. Let AFL handle OOM on its
-     own later on. */
-
-  if (!*out_buf) {
-
-    *out_buf = in_buf;
-    return len;
-
-  }
-
-  /* Copy the original data to the new location. */
-
-  memcpy(*out_buf, in_buf, len);
-
-  /* Insert the new header. */
-
-  memcpy(*out_buf, HEADER, strlen(HEADER));
-
-  /* Return the new len. It hasn't changed, so it's just len. */
-
-  return len;
-
-}
-
-/* Gets called afterwards */
-void afl_postprocess_deinit(post_state_t *data) {
-
-  free(data->buf);
-  free(data);
-
-}
-
diff --git a/examples/post_library/post_library_png.so.c b/examples/post_library/post_library_png.so.c
deleted file mode 100644
index b29afd62..00000000
--- a/examples/post_library/post_library_png.so.c
+++ /dev/null
@@ -1,156 +0,0 @@
-/*
-   american fuzzy lop++ - postprocessor for PNG
-   ------------------------------------------
-
-   Originally written by Michal Zalewski
-
-   Copyright 2015 Google Inc. All rights reserved.
-   Adapted to the new API, 2020 by Dominik Maier
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   See post_library.so.c for a general discussion of how to implement
-   postprocessors. This specific postprocessor attempts to fix up PNG
-   checksums, providing a slightly more complicated example than found
-   in post_library.so.c.
-
-   Compile with:
-
-     gcc -shared -Wall -O3 post_library_png.so.c -o post_library_png.so -lz
-
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include <string.h>
-#include <zlib.h>
-
-#include <arpa/inet.h>
-
-/* A macro to round an integer up to 4 kB. */
-
-#define UP4K(_i) ((((_i) >> 12) + 1) << 12)
-
-typedef struct post_state {
-
-  unsigned char *buf;
-  size_t         size;
-
-} post_state_t;
-
-void *afl_postprocess_init(void *afl, unsigned int seed) {
-
-  post_state_t *state = malloc(sizeof(post_state_t));
-  if (!state) {
-
-    perror("malloc");
-    return NULL;
-
-  }
-
-  state->buf = calloc(sizeof(unsigned char), 4096);
-  if (!state->buf) { return NULL; }
-
-  return state;
-
-}
-
-size_t afl_postprocess(post_state_t *data, const unsigned char *in_buf,
-                       unsigned int len, const unsigned char **out_buf) {
-
-  unsigned char *new_buf = (unsigned char *)in_buf;
-  unsigned int   pos = 8;
-
-  /* Don't do anything if there's not enough room for the PNG header
-     (8 bytes). */
-
-  if (len < 8) {
-
-    *out_buf = in_buf;
-    return len;
-
-  }
-
-  /* Minimum size of a zero-length PNG chunk is 12 bytes; if we
-     don't have that, we can bail out. */
-
-  while (pos + 12 <= len) {
-
-    unsigned int chunk_len, real_cksum, file_cksum;
-
-    /* Chunk length is the first big-endian dword in the chunk. */
-
-    chunk_len = ntohl(*(uint32_t *)(in_buf + pos));
-
-    /* Bail out if chunk size is too big or goes past EOF. */
-
-    if (chunk_len > 1024 * 1024 || pos + 12 + chunk_len > len) break;
-
-    /* Chunk checksum is calculated for chunk ID (dword) and the actual
-       payload. */
-
-    real_cksum = htonl(crc32(0, in_buf + pos + 4, chunk_len + 4));
-
-    /* The in-file checksum is the last dword past the chunk data. */
-
-    file_cksum = *(uint32_t *)(in_buf + pos + 8 + chunk_len);
-
-    /* If the checksums do not match, we need to fix the file. */
-
-    if (real_cksum != file_cksum) {
-
-      /* First modification? Make a copy of the input buffer. Round size
-         up to 4 kB to minimize the number of reallocs needed. */
-
-      if (new_buf == in_buf) {
-
-        if (len <= data->size) {
-
-          new_buf = data->buf;
-
-        } else {
-
-          new_buf = realloc(data->buf, UP4K(len));
-          if (!new_buf) {
-
-            *out_buf = in_buf;
-            return len;
-
-          }
-
-          data->buf = new_buf;
-          data->size = UP4K(len);
-          memcpy(new_buf, in_buf, len);
-
-        }
-
-      }
-
-      *(uint32_t *)(new_buf + pos + 8 + chunk_len) = real_cksum;
-
-    }
-
-    /* Skip the entire chunk and move to the next one. */
-
-    pos += 12 + chunk_len;
-
-  }
-
-  *out_buf = new_buf;
-  return len;
-
-}
-
-/* Gets called afterwards */
-void afl_postprocess_deinit(post_state_t *data) {
-
-  free(data->buf);
-  free(data);
-
-}
-
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index a1aa58d6..9907c245 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -323,9 +323,8 @@ typedef struct afl_env_vars {
       afl_bench_until_crash, afl_debug_child_output, afl_autoresume,
       afl_cal_fast;
 
-  u8 *afl_tmpdir, *afl_post_library, *afl_custom_mutator_library,
-      *afl_python_module, *afl_path, *afl_hang_tmout, *afl_skip_crashes,
-      *afl_preload;
+  u8 *afl_tmpdir, *afl_custom_mutator_library, *afl_python_module, *afl_path,
+      *afl_hang_tmout, *afl_skip_crashes, *afl_preload;
 
 } afl_env_vars_t;
 
diff --git a/src/afl-common.c b/src/afl-common.c
index 74fd6b27..808c9812 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -76,7 +76,7 @@ char *afl_environment_variables[] = {
     "AFL_NO_X86",  // not really an env but we dont want to warn on it
     "AFL_MAP_SIZE", "AFL_MAPSIZE", "AFL_PATH", "AFL_PERFORMANCE_FILE",
     //"AFL_PERSISTENT", // not implemented anymore, so warn additionally
-    "AFL_POST_LIBRARY", "AFL_PRELOAD", "AFL_PYTHON_MODULE", "AFL_QEMU_COMPCOV",
+    "AFL_PRELOAD", "AFL_PYTHON_MODULE", "AFL_QEMU_COMPCOV",
     "AFL_QEMU_COMPCOV_DEBUG", "AFL_QEMU_DEBUG_MAPS", "AFL_QEMU_DISABLE_CACHE",
     "AFL_QEMU_PERSISTENT_ADDR", "AFL_QEMU_PERSISTENT_CNT",
     "AFL_QEMU_PERSISTENT_GPR", "AFL_QEMU_PERSISTENT_HOOK",
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index daaac969..0a7941f2 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -280,54 +280,6 @@ cpuset_destroy(c);
 
 #endif                                                     /* HAVE_AFFINITY */
 
-/* Load postprocessor, if available. */
-
-void setup_post(afl_state_t *afl) {
-
-  void *dh;
-  u8 *  fn = afl->afl_env.afl_post_library;
-  u8    tbuf[6];
-  u32   tlen = 6;
-  strncpy(tbuf, "hello", tlen);
-
-  if (!fn) { return; }
-
-  ACTF("Loading postprocessor from '%s'...", fn);
-
-  dh = dlopen(fn, RTLD_NOW);
-  if (!dh) { FATAL("%s", dlerror()); }
-
-  struct custom_mutator *mutator;
-  mutator = ck_alloc(sizeof(struct custom_mutator));
-  memset(mutator, 0, sizeof(struct custom_mutator));
-
-  mutator->afl_custom_post_process = dlsym(dh, "afl_postprocess");
-  if (!mutator->afl_custom_post_process) {
-
-    FATAL("Symbol 'afl_postprocess' not found.");
-
-  }
-
-  mutator->afl_custom_init = dlsym(dh, "afl_postprocess_init");
-  if (!mutator->afl_custom_init) {
-
-    WARNF("optional symbol 'afl_postprocess_init' not found.");
-
-  }
-
-  mutator->afl_custom_deinit = dlsym(dh, "afl_postprocess_deinit");
-  if (!mutator->afl_custom_post_process) {
-
-    WARNF("optional symbol 'afl_postprocess_deinit' not found.");
-
-  }
-
-  afl->post_library_mutator = mutator;
-
-  OKF("Postprocessor installed successfully.");
-
-}
-
 /* Shuffle an array of pointers. Might be slightly biased. */
 
 static void shuffle_ptrs(afl_state_t *afl, void **ptrs, u32 cnt) {
diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c
index 316f9bd9..99863103 100644
--- a/src/afl-fuzz-state.c
+++ b/src/afl-fuzz-state.c
@@ -313,8 +313,10 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
 
                               afl_environment_variable_len)) {
 
-            afl->afl_env.afl_post_library =
-                (u8 *)get_afl_env(afl_environment_variables[i]);
+            FATAL(
+                "AFL_POST_LIBRARY is deprecated, use "
+                "AFL_CUSTOM_MUTATOR_LIBRARY instead, see "
+                "docs/custom_mutators.md");
 
           } else if (!strncmp(env, "AFL_CUSTOM_MUTATOR_LIBRARY",
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 979ebfa3..8625c37c 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -187,7 +187,6 @@ static void usage(afl_state_t *afl, u8 *argv0, int more_help) {
       "AFL_NO_SNAPSHOT: do not use the snapshot feature (if the snapshot lkm is loaded)\n"
       "AFL_NO_UI: switch status screen off\n"
       "AFL_PATH: path to AFL support binaries\n"
-      "AFL_POST_LIBRARY: postprocess generated test cases before use as target input\n"
       "AFL_PYTHON_MODULE: mutate and trim inputs with the specified Python module\n"
       "AFL_QUIET: suppress forkserver status messages\n"
       "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
@@ -1060,8 +1059,6 @@ int main(int argc, char **argv_orig, char **envp) {
   afl->fsrv.trace_bits =
       afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->dumb_mode);
 
-  setup_post(afl);
-
   if (!afl->in_bitmap) { memset(afl->virgin_bits, 255, afl->fsrv.map_size); }
   memset(afl->virgin_tmout, 255, afl->fsrv.map_size);
   memset(afl->virgin_crash, 255, afl->fsrv.map_size);
diff --git a/test/test.sh b/test/test.sh
index 6c05571b..cb38346d 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -60,7 +60,6 @@ unset AFL_QEMU_PERSISTENT_GPR
 unset AFL_QEMU_PERSISTENT_RET
 unset AFL_QEMU_PERSISTENT_HOOK
 unset AFL_QEMU_PERSISTENT_CNT
-unset AFL_POST_LIBRARY
 unset AFL_CUSTOM_MUTATOR_LIBRARY
 unset AFL_PYTHON_MODULE
 unset AFL_PRELOAD
-- 
cgit 1.4.1


From 65f9553365557a7ad6deb2cfc01bf1cd39ac3adf Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Thu, 14 May 2020 22:25:50 +0200
Subject: unicorn mode may run scripts

---
 src/afl-fuzz-init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 0a7941f2..7bded5ff 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -1996,7 +1996,7 @@ void check_binary(afl_state_t *afl, u8 *fname) {
 
   }
 
-  if (afl->afl_env.afl_skip_bin_check || afl->use_wine) { return; }
+  if (afl->afl_env.afl_skip_bin_check || afl->use_wine || afl->unicorn_mode) { return; }
 
   /* Check for blatant user errors. */
 
-- 
cgit 1.4.1


From 63e2222af16f9306ef4a182f013f13ec6aab427a Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Fri, 15 May 2020 01:24:27 +0200
Subject: code format

---
 src/afl-fuzz-init.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 7bded5ff..613d1437 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -1996,7 +1996,11 @@ void check_binary(afl_state_t *afl, u8 *fname) {
 
   }
 
-  if (afl->afl_env.afl_skip_bin_check || afl->use_wine || afl->unicorn_mode) { return; }
+  if (afl->afl_env.afl_skip_bin_check || afl->use_wine || afl->unicorn_mode) {
+
+    return;
+
+  }
 
   /* Check for blatant user errors. */
 
-- 
cgit 1.4.1