From a0e884cf8bffe1a0394d106375f6a23edd2b60e6 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 15 Jan 2021 16:56:40 +0100
Subject: merge cmplog

---
 src/afl-fuzz-init.c | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

(limited to 'src/afl-fuzz-init.c')

diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index dbffa4f9..cbff6d7e 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -729,6 +729,30 @@ void read_testcases(afl_state_t *afl, u8 *directory) {
     add_to_queue(afl, fn2, st.st_size >= MAX_FILE ? MAX_FILE : st.st_size,
                  passed_det);
 
+    if (unlikely(afl->shm.cmplog_mode)) {
+
+      if (afl->cmplog_lvl == 1) {
+
+        if (!afl->cmplog_max_filesize ||
+            afl->cmplog_max_filesize < st.st_size) {
+
+          afl->cmplog_max_filesize = st.st_size;
+
+        }
+
+      } else if (afl->cmplog_lvl == 2) {
+
+        if (!afl->cmplog_max_filesize ||
+            afl->cmplog_max_filesize > st.st_size) {
+
+          afl->cmplog_max_filesize = st.st_size;
+
+        }
+
+      }
+
+    }
+
     if (unlikely(afl->schedule >= FAST && afl->schedule <= RARE)) {
 
       u64 cksum = hash64(afl->fsrv.trace_bits, afl->fsrv.map_size, HASH_CONST);
@@ -756,6 +780,20 @@ void read_testcases(afl_state_t *afl, u8 *directory) {
 
   }
 
+  if (unlikely(afl->shm.cmplog_mode)) {
+
+    if (afl->cmplog_max_filesize < 1024) {
+
+      afl->cmplog_max_filesize = 1024;
+
+    } else {
+
+      afl->cmplog_max_filesize = (((afl->cmplog_max_filesize >> 10) + 1) << 10);
+
+    }
+
+  }
+
   afl->last_path_time = 0;
   afl->queued_at_start = afl->queued_paths;
 
-- 
cgit 1.4.1


From 258ae1632af49d9ee68b1ce1a6c74d9e92245bcf Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 22 Jan 2021 21:10:23 +0100
Subject: stack 2 heap

---
 src/afl-fuzz-init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index cbff6d7e..b1a24f2f 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -810,7 +810,7 @@ void perform_dry_run(afl_state_t *afl) {
 
   while (q) {
 
-    u8  use_mem[MAX_FILE];
+    u8  *use_mem = afl_realloc(AFL_BUF_PARAM(in), MAX_FILE);
     u8  res;
     s32 fd;
 
-- 
cgit 1.4.1


From 0a3a708f9bf7b9f192d236c792a13cec2aa54a16 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sat, 23 Jan 2021 10:01:09 +0100
Subject: less stack mem req

---
 src/afl-fuzz-init.c  | 3 ++-
 src/afl-fuzz-queue.c | 7 ++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index b1a24f2f..fed58eb6 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -807,10 +807,10 @@ void perform_dry_run(afl_state_t *afl) {
   struct queue_entry *q = afl->queue;
   u32                 cal_failures = 0;
   u8 *                skip_crashes = afl->afl_env.afl_skip_crashes;
+  u8 *                use_mem;
 
   while (q) {
 
-    u8  *use_mem = afl_realloc(AFL_BUF_PARAM(in), MAX_FILE);
     u8  res;
     s32 fd;
 
@@ -829,6 +829,7 @@ void perform_dry_run(afl_state_t *afl) {
     if (fd < 0) { PFATAL("Unable to open '%s'", q->fname); }
 
     u32 read_len = MIN(q->len, (u32)MAX_FILE);
+    use_mem = afl_realloc(AFL_BUF_PARAM(in), read_len);
     if (read(fd, use_mem, read_len) != (ssize_t)read_len) {
 
       FATAL("Short read from '%s'", q->fname);
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index aec57a6e..90f969d9 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -313,17 +313,18 @@ void mark_as_redundant(afl_state_t *afl, struct queue_entry *q, u8 state) {
 
 /* check if ascii or UTF-8 */
 
-static u8 check_if_text(struct queue_entry *q) {
+static u8 check_if_text(afl_state_t *afl, struct queue_entry *q) {
 
   if (q->len < AFL_TXT_MIN_LEN) return 0;
 
-  u8      buf[MAX_FILE];
+  u8     *buf;
   int     fd;
   u32     len = q->len, offset = 0, ascii = 0, utf8 = 0;
   ssize_t comp;
 
   if (len >= MAX_FILE) len = MAX_FILE - 1;
   if ((fd = open(q->fname, O_RDONLY)) < 0) return 0;
+  buf = afl_realloc(AFL_BUF_PARAM(in_scratch), len);
   comp = read(fd, buf, len);
   close(fd);
   if (comp != (ssize_t)len) return 0;
@@ -487,7 +488,7 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
   }
 
   /* only redqueen currently uses is_ascii */
-  if (afl->shm.cmplog_mode) q->is_ascii = check_if_text(q);
+  if (afl->shm.cmplog_mode) q->is_ascii = check_if_text(afl, q);
 
 }
 
-- 
cgit 1.4.1


From e0663c91b9cbf1bdc46593dec4ba11224e6847d7 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 26 Jan 2021 12:15:13 +0100
Subject: wip fix

---
 src/afl-fuzz-init.c | 23 ++++++++++++++++++-----
 src/afl-fuzz-one.c  | 13 +++++++++----
 2 files changed, 27 insertions(+), 9 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index fed58eb6..2cb152a9 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -1026,6 +1026,14 @@ void perform_dry_run(afl_state_t *afl) {
         /* Remove from fuzzing queue but keep for splicing */
 
         struct queue_entry *p = afl->queue;
+
+        if (!p->disabled && !p->was_fuzzed) {
+
+          --afl->pending_not_fuzzed;
+          --afl->active_paths;
+
+        }
+
         p->disabled = 1;
         p->perf_score = 0;
         while (p && p->next != q)
@@ -1036,9 +1044,6 @@ void perform_dry_run(afl_state_t *afl) {
         else
           afl->queue = q->next;
 
-        --afl->pending_not_fuzzed;
-        --afl->active_paths;
-
         afl->max_depth = 0;
         p = afl->queue;
         while (p) {
@@ -1123,8 +1128,16 @@ restart_outer_cull_loop:
       if (!p->cal_failed && p->exec_cksum == q->exec_cksum) {
 
         duplicates = 1;
-        --afl->pending_not_fuzzed;
-        afl->active_paths--;
+        if (!p->disabled && !q->disabled && !p->was_fuzzed && !q->was_fuzzed) {
+
+          --afl->pending_not_fuzzed;
+          afl->active_paths--;
+
+        } else {
+        
+          FATAL("disabled entry? this should not happen, please report!");
+        
+        }
 
         // We do not remove any of the memory allocated because for
         // splicing the data might still be interesting.
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index a7262eec..af768183 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -2782,11 +2782,16 @@ abandon_entry:
      cycle and have not seen this entry before. */
 
   if (!afl->stop_soon && !afl->queue_cur->cal_failed &&
-      (afl->queue_cur->was_fuzzed == 0 || afl->queue_cur->fuzz_level == 0)) {
+      (afl->queue_cur->was_fuzzed == 0 || afl->queue_cur->fuzz_level == 0) &&
+      !afl->queue_cur->disabled) {
 
-    --afl->pending_not_fuzzed;
-    afl->queue_cur->was_fuzzed = 1;
-    if (afl->queue_cur->favored) { --afl->pending_favored; }
+    if (!afl->queue_cur->was_fuzzed) {
+
+      --afl->pending_not_fuzzed;
+      afl->queue_cur->was_fuzzed = 1;
+      if (afl->queue_cur->favored) { --afl->pending_favored; }
+
+    }
 
   }
 
-- 
cgit 1.4.1


From 9c393adbb953fe5bf6809e5b0feca7be2f52b7f8 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 26 Jan 2021 17:12:11 +0100
Subject: real fix plus code format

---
 include/android-ashmem.h    | 84 +++++++++++++++++++++++----------------------
 src/afl-fuzz-init.c         | 28 +++++++++------
 src/afl-fuzz-queue.c        |  2 +-
 src/afl-fuzz.c              |  2 +-
 src/afl-showmap.c           | 24 ++++++++++---
 utils/afl_frida/afl-frida.c | 78 ++++++++++++++++++++++-------------------
 6 files changed, 125 insertions(+), 93 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/include/android-ashmem.h b/include/android-ashmem.h
index 6939e06d..91699b27 100644
--- a/include/android-ashmem.h
+++ b/include/android-ashmem.h
@@ -1,81 +1,83 @@
 #ifdef __ANDROID__
-#ifndef _ANDROID_ASHMEM_H
-#define _ANDROID_ASHMEM_H
-
-#include <fcntl.h>
-#include <linux/ashmem.h>
-#include <sys/ioctl.h>
-#include <sys/mman.h>
-
-#if __ANDROID_API__ >= 26
-#define shmat bionic_shmat
-#define shmctl bionic_shmctl
-#define shmdt bionic_shmdt
-#define shmget bionic_shmget
-#endif
-#include <sys/shm.h>
-#undef shmat
-#undef shmctl
-#undef shmdt
-#undef shmget
-#include <stdio.h>
-
-#define ASHMEM_DEVICE "/dev/ashmem"
+  #ifndef _ANDROID_ASHMEM_H
+    #define _ANDROID_ASHMEM_H
+
+    #include <fcntl.h>
+    #include <linux/ashmem.h>
+    #include <sys/ioctl.h>
+    #include <sys/mman.h>
+
+    #if __ANDROID_API__ >= 26
+      #define shmat bionic_shmat
+      #define shmctl bionic_shmctl
+      #define shmdt bionic_shmdt
+      #define shmget bionic_shmget
+    #endif
+    #include <sys/shm.h>
+    #undef shmat
+    #undef shmctl
+    #undef shmdt
+    #undef shmget
+    #include <stdio.h>
+
+    #define ASHMEM_DEVICE "/dev/ashmem"
 
 int shmctl(int __shmid, int __cmd, struct shmid_ds *__buf) {
+
   int ret = 0;
   if (__cmd == IPC_RMID) {
-    int length = ioctl(__shmid, ASHMEM_GET_SIZE, NULL);
+
+    int               length = ioctl(__shmid, ASHMEM_GET_SIZE, NULL);
     struct ashmem_pin pin = {0, length};
     ret = ioctl(__shmid, ASHMEM_UNPIN, &pin);
     close(__shmid);
+
   }
 
   return ret;
+
 }
 
 int shmget(key_t __key, size_t __size, int __shmflg) {
-  (void) __shmflg;
-  int fd, ret;
+
+  (void)__shmflg;
+  int  fd, ret;
   char ourkey[11];
 
   fd = open(ASHMEM_DEVICE, O_RDWR);
-  if (fd < 0)
-    return fd;
+  if (fd < 0) return fd;
 
   sprintf(ourkey, "%d", __key);
   ret = ioctl(fd, ASHMEM_SET_NAME, ourkey);
-  if (ret < 0)
-    goto error;
+  if (ret < 0) goto error;
 
   ret = ioctl(fd, ASHMEM_SET_SIZE, __size);
-  if (ret < 0)
-    goto error;
+  if (ret < 0) goto error;
 
   return fd;
 
 error:
   close(fd);
   return ret;
+
 }
 
 void *shmat(int __shmid, const void *__shmaddr, int __shmflg) {
-  (void) __shmflg;
-  int size;
+
+  (void)__shmflg;
+  int   size;
   void *ptr;
 
   size = ioctl(__shmid, ASHMEM_GET_SIZE, NULL);
-  if (size < 0) {
-    return NULL;
-  }
+  if (size < 0) { return NULL; }
 
   ptr = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, __shmid, 0);
-  if (ptr == MAP_FAILED) {
-    return NULL;
-  }
+  if (ptr == MAP_FAILED) { return NULL; }
 
   return ptr;
+
 }
 
-#endif /* !_ANDROID_ASHMEM_H */
-#endif /* !__ANDROID__ */
+  #endif                                              /* !_ANDROID_ASHMEM_H */
+#endif                                                      /* !__ANDROID__ */
+
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 2cb152a9..ed2010cd 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -1027,7 +1027,7 @@ void perform_dry_run(afl_state_t *afl) {
 
         struct queue_entry *p = afl->queue;
 
-        if (!p->disabled && !p->was_fuzzed) {
+        if (!p->was_fuzzed) {
 
           --afl->pending_not_fuzzed;
           --afl->active_paths;
@@ -1128,16 +1128,6 @@ restart_outer_cull_loop:
       if (!p->cal_failed && p->exec_cksum == q->exec_cksum) {
 
         duplicates = 1;
-        if (!p->disabled && !q->disabled && !p->was_fuzzed && !q->was_fuzzed) {
-
-          --afl->pending_not_fuzzed;
-          afl->active_paths--;
-
-        } else {
-        
-          FATAL("disabled entry? this should not happen, please report!");
-        
-        }
 
         // We do not remove any of the memory allocated because for
         // splicing the data might still be interesting.
@@ -1147,6 +1137,14 @@ restart_outer_cull_loop:
         // we keep the shorter file
         if (p->len >= q->len) {
 
+          if (!p->was_fuzzed) {
+
+            p->was_fuzzed = 1;
+            --afl->pending_not_fuzzed;
+            afl->active_paths--;
+
+          }
+
           p->disabled = 1;
           p->perf_score = 0;
           q->next = p->next;
@@ -1154,6 +1152,14 @@ restart_outer_cull_loop:
 
         } else {
 
+          if (!q->was_fuzzed) {
+
+            q->was_fuzzed = 1;
+            --afl->pending_not_fuzzed;
+            afl->active_paths--;
+
+          }
+
           q->disabled = 1;
           q->perf_score = 0;
           if (prev)
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 90f969d9..4442b400 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -317,7 +317,7 @@ static u8 check_if_text(afl_state_t *afl, struct queue_entry *q) {
 
   if (q->len < AFL_TXT_MIN_LEN) return 0;
 
-  u8     *buf;
+  u8 *    buf;
   int     fd;
   u32     len = q->len, offset = 0, ascii = 0, utf8 = 0;
   ssize_t comp;
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 9b62e961..ecf69728 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -339,7 +339,7 @@ int main(int argc, char **argv_orig, char **envp) {
   afl_state_init(afl, map_size);
   afl->debug = debug;
   afl_fsrv_init(&afl->fsrv);
-  if (debug) { afl->fsrv.debug = true ; }
+  if (debug) { afl->fsrv.debug = true; }
 
   read_afl_environment(afl, envp);
   if (afl->shm.map_size) { afl->fsrv.map_size = afl->shm.map_size; }
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index ab47c602..5a0b6ecf 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -317,8 +317,16 @@ static void showmap_run_target_forkserver(afl_forkserver_t *fsrv, u8 *mem,
 
   }
 
-  if (fsrv->trace_bits[0] == 1) { fsrv->trace_bits[0] = 0; have_coverage = 1; }
-  else { have_coverage = 0; }
+  if (fsrv->trace_bits[0] == 1) {
+
+    fsrv->trace_bits[0] = 0;
+    have_coverage = 1;
+
+  } else {
+
+    have_coverage = 0;
+
+  }
 
   if (!no_classify) { classify_counts(fsrv); }
 
@@ -493,8 +501,16 @@ static void showmap_run_target(afl_forkserver_t *fsrv, char **argv) {
 
   }
 
-  if (fsrv->trace_bits[0] == 1) { fsrv->trace_bits[0] = 0; have_coverage = 1; }
-  else { have_coverage = 0; }
+  if (fsrv->trace_bits[0] == 1) {
+
+    fsrv->trace_bits[0] = 0;
+    have_coverage = 1;
+
+  } else {
+
+    have_coverage = 0;
+
+  }
 
   if (!no_classify) { classify_counts(fsrv); }
 
diff --git a/utils/afl_frida/afl-frida.c b/utils/afl_frida/afl-frida.c
index 087f18e8..bf39be1c 100644
--- a/utils/afl_frida/afl-frida.c
+++ b/utils/afl_frida/afl-frida.c
@@ -153,7 +153,7 @@ static int enumerate_ranges(const GumRangeDetails *details,
 
 }
 
-int main(int argc, char** argv) {
+int main(int argc, char **argv) {
 
 #ifndef __APPLE__
   (void)personality(ADDR_NO_RANDOMIZE);  // disable ASLR
@@ -166,10 +166,15 @@ int main(int argc, char** argv) {
 
   void *dl = NULL;
   if (argc > 2) {
+
     dl = dlopen(argv[1], RTLD_LAZY);
+
   } else {
+
     dl = dlopen(TARGET_LIBRARY, RTLD_LAZY);
+
   }
+
   if (!dl) {
 
     if (argc > 2)
@@ -197,17 +202,18 @@ int main(int argc, char** argv) {
   // END STEP 2
 
   if (!getenv("AFL_FRIDA_TEST_INPUT")) {
+
     gum_init_embedded();
     if (!gum_stalker_is_supported()) {
-  
+
       gum_deinit_embedded();
       return 1;
-  
+
     }
-  
+
     GumStalker *stalker = gum_stalker_new();
-  
-    GumAddress     base_address;
+
+    GumAddress base_address;
     if (argc > 2)
       base_address = gum_module_find_base_address(argv[1]);
     else
@@ -215,87 +221,89 @@ int main(int argc, char** argv) {
     GumMemoryRange code_range;
     if (argc > 2)
       gum_module_enumerate_ranges(argv[1], GUM_PAGE_RX, enumerate_ranges,
-                                &code_range);
+                                  &code_range);
     else
       gum_module_enumerate_ranges(TARGET_LIBRARY, GUM_PAGE_RX, enumerate_ranges,
-                                &code_range);
-  
+                                  &code_range);
+
     guint64 code_start = code_range.base_address;
     guint64 code_end = code_range.base_address + code_range.size;
     range_t instr_range = {0, code_start, code_end};
-  
+
     printf("Frida instrumentation: base=0x%lx instrumenting=0x%lx-%lx\n",
            base_address, code_start, code_end);
     if (!code_start || !code_end) {
-  
+
       if (argc > 2)
         fprintf(stderr, "Error: no valid memory address found for %s\n",
-              argv[1]);
+                argv[1]);
       else
         fprintf(stderr, "Error: no valid memory address found for %s\n",
-              TARGET_LIBRARY);
+                TARGET_LIBRARY);
       exit(-1);
-  
+
     }
-  
+
     GumStalkerTransformer *transformer =
         gum_stalker_transformer_make_from_callback(instr_basic_block,
                                                    &instr_range, NULL);
-  
+
     // to ensure that the signatures are not optimized out
     memcpy(__afl_area_ptr, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT) + 1);
     memcpy(__afl_area_ptr + 32, (void *)AFL_DEFER_FORKSVR,
            sizeof(AFL_DEFER_FORKSVR) + 1);
     __afl_manual_init();
-  
+
     //
     // any expensive target library initialization that has to be done just once
     // - put that here
     //
-  
+
     gum_stalker_follow_me(stalker, transformer, NULL);
-  
+
     while (__afl_persistent_loop(UINT32_MAX) != 0) {
-  
+
       previous_pc = 0;  // Required!
-  
-  #ifdef _DEBUG
+
+#ifdef _DEBUG
       fprintf(stderr, "CLIENT crc: %016llx len: %u\n",
               hash64(__afl_fuzz_ptr, *__afl_fuzz_len), *__afl_fuzz_len);
       fprintf(stderr, "RECV:");
       for (int i = 0; i < *__afl_fuzz_len; i++)
         fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
       fprintf(stderr, "\n");
-  #endif
-  
+#endif
+
       // STEP 3: ensure the minimum length is present and setup the target
       //         function to fuzz.
-  
+
       if (*__afl_fuzz_len > 0) {
-  
+
         __afl_fuzz_ptr[*__afl_fuzz_len] = 0;  // if you need to null terminate
         (*o_function)(__afl_fuzz_ptr, *__afl_fuzz_len);
-  
+
       }
-  
+
       // END STEP 3
-  
+
     }
-  
+
     gum_stalker_unfollow_me(stalker);
-  
+
     while (gum_stalker_garbage_collect(stalker))
       g_usleep(10000);
-  
+
     g_object_unref(stalker);
     g_object_unref(transformer);
     gum_deinit_embedded();
 
   } else {
-    char buf[8*1024] = {0};
-    int count = read(0, buf, sizeof(buf));
-    buf[8*1024-1] = '\0';
+
+    char buf[8 * 1024] = {0};
+    int  count = read(0, buf, sizeof(buf));
+    buf[8 * 1024 - 1] = '\0';
     (*o_function)(buf, count);
+
   }
 
   return 0;
-- 
cgit 1.4.1


From 36b5336152cd886d911f4299c3154b7817c94838 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 26 Jan 2021 22:45:59 +0100
Subject: better foreign sync name

---
 src/afl-fuzz-init.c     | 15 ++++++++++++++-
 src/afl-fuzz-redqueen.c |  4 ++--
 src/afl-fuzz.c          | 10 ++++++++++
 3 files changed, 26 insertions(+), 3 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index ed2010cd..4f59a42f 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -460,6 +460,7 @@ void read_foreign_testcases(afl_state_t *afl, int first) {
   u32             i, iter;
 
   u8 val_buf[2][STRINGIFY_VAL_SIZE_MAX];
+  u8 foreign_name[16];
 
   for (iter = 0; iter < afl->foreign_sync_cnt; iter++) {
 
@@ -468,6 +469,18 @@ void read_foreign_testcases(afl_state_t *afl, int first) {
 
       if (first) ACTF("Scanning '%s'...", afl->foreign_syncs[iter].dir);
       time_t ctime_max = 0;
+      u8 *   name = rindex(afl->foreign_syncs[iter].dir, '/');
+      if (!name) { name = afl->foreign_syncs[iter].dir; }
+      if (!strcmp(name, "queue") || !strcmp(name, "out") ||
+          !strcmp(name, "default")) {
+
+        snprintf(foreign_name, sizeof(foreign_name), "foreign_%u", iter);
+
+      } else {
+
+        snprintf(foreign_name, sizeof(foreign_name), "%s_%u", name, iter);
+
+      }
 
       /* We use scandir() + alphasort() rather than readdir() because otherwise,
          the ordering of test cases would vary somewhat randomly and would be
@@ -581,7 +594,7 @@ void read_foreign_testcases(afl_state_t *afl, int first) {
 
         write_to_testcase(afl, mem, st.st_size);
         fault = fuzz_run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);
-        afl->syncing_party = "foreign";
+        afl->syncing_party = foreign_name;
         afl->queued_imported +=
             save_if_interesting(afl, mem, st.st_size, fault);
         afl->syncing_party = 0;
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index 6721b8ef..34db7231 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -249,7 +249,7 @@ static u8 colorization(afl_state_t *afl, u8 *buf, u32 len,
   afl->stage_cur = 0;
 
   // in colorization we do not classify counts, hence we have to calculate
-  // the original checksum!
+  // the original checksum.
   if (unlikely(get_exec_checksum(afl, buf, len, &exec_cksum))) {
 
     goto checksum_fail;
@@ -2368,7 +2368,7 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
   u64 orig_hit_cnt, new_hit_cnt;
   u64 orig_execs = afl->fsrv.total_execs;
   orig_hit_cnt = afl->queued_paths + afl->unique_crashes;
-  u64 screen_update = 1000000 / afl->queue_cur->exec_us,
+  u64 screen_update = 100000 / afl->queue_cur->exec_us,
       execs = afl->fsrv.total_execs;
 
   afl->stage_name = "input-to-state";
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index ecf69728..b92aa2a7 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -559,6 +559,16 @@ int main(int argc, char **argv_orig, char **envp) {
           FATAL("Maximum %u entried of -F option can be specified",
                 FOREIGN_SYNCS_MAX);
         afl->foreign_syncs[afl->foreign_sync_cnt].dir = optarg;
+        while (afl->foreign_syncs[afl->foreign_sync_cnt]
+                   .dir[strlen(afl->foreign_syncs[afl->foreign_sync_cnt].dir) -
+                        1] == '/') {
+
+          afl->foreign_syncs[afl->foreign_sync_cnt]
+              .dir[strlen(afl->foreign_syncs[afl->foreign_sync_cnt].dir) - 1] =
+              0;
+
+        }
+
         afl->foreign_sync_cnt++;
         break;
 
-- 
cgit 1.4.1


From 2044c7e2b548e2747fde5deff65c78dd05e2ec8d Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Wed, 27 Jan 2021 08:41:45 +0100
Subject: fix include

---
 include/envs.h      | 2 +-
 src/afl-fuzz-init.c | 5 ++---
 2 files changed, 3 insertions(+), 4 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/include/envs.h b/include/envs.h
index 756cd737..931cff15 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -48,7 +48,7 @@ static char *afl_environment_variables[] = {
     "AFL_EXIT_WHEN_DONE",
     "AFL_FAST_CAL",
     "AFL_FORCE_UI",
-    "AFL_FUZZER_ARGS".  // oss-fuzz
+    "AFL_FUZZER_ARGS",  // oss-fuzz
     "AFL_GCC_ALLOWLIST",
     "AFL_GCC_DENYLIST",
     "AFL_GCC_BLOCKLIST",
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 4f59a42f..a428923d 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -482,9 +482,8 @@ void read_foreign_testcases(afl_state_t *afl, int first) {
 
       }
 
-      /* We use scandir() + alphasort() rather than readdir() because otherwise,
-         the ordering of test cases would vary somewhat randomly and would be
-         difficult to control. */
+      /* We do not use sorting yet and do a more expensive ctime check instead.
+         a ctimesort() implementation would be better though. */
 
       nl_cnt = scandir(afl->foreign_syncs[iter].dir, &nl, NULL, NULL);
 
-- 
cgit 1.4.1


From 47f62eb0ca087bf26e79f2f0ce5935eda2599064 Mon Sep 17 00:00:00 2001
From: Joey Jiaojg <77719320+joeyjiaojg@users.noreply.github.com>
Date: Thu, 28 Jan 2021 12:51:45 +0800
Subject: Fix dev branch for android (#710)

* android: replace rindex with strrchr

* android: support 64bit only due to 128bit integer not supported by 32bit system

Co-authored-by: joeyjiaojg@qq.com <joeyjiaojg@163.com>
---
 Android.bp                        | 4 +++-
 src/afl-fuzz-init.c               | 2 +-
 utils/afl_untracer/afl-untracer.c | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/Android.bp b/Android.bp
index 5d6f0433..ee076d1e 100644
--- a/Android.bp
+++ b/Android.bp
@@ -36,6 +36,7 @@ cc_defaults {
 cc_binary {
   name: "afl-fuzz",
   host_supported: true,
+  compile_multilib: "64",
 
   defaults: [
     "afl-defaults",
@@ -64,6 +65,7 @@ cc_binary {
     "src/afl-common.c",
     "src/afl-sharedmem.c",
     "src/afl-forkserver.c",
+    "src/afl-performance.c",
   ],
 }
 
@@ -152,7 +154,7 @@ cc_binary_host {
 
 cc_library_static {
   name: "afl-llvm-rt",
-  compile_multilib: "both",
+  compile_multilib: "64",
   vendor_available: true,
   host_supported: true,
   recovery_available: true,
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index a428923d..5f5e65cd 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -469,7 +469,7 @@ void read_foreign_testcases(afl_state_t *afl, int first) {
 
       if (first) ACTF("Scanning '%s'...", afl->foreign_syncs[iter].dir);
       time_t ctime_max = 0;
-      u8 *   name = rindex(afl->foreign_syncs[iter].dir, '/');
+      u8 *   name = strrchr(afl->foreign_syncs[iter].dir, '/');
       if (!name) { name = afl->foreign_syncs[iter].dir; }
       if (!strcmp(name, "queue") || !strcmp(name, "out") ||
           !strcmp(name, "default")) {
diff --git a/utils/afl_untracer/afl-untracer.c b/utils/afl_untracer/afl-untracer.c
index 695f8dd1..f3894a06 100644
--- a/utils/afl_untracer/afl-untracer.c
+++ b/utils/afl_untracer/afl-untracer.c
@@ -143,7 +143,7 @@ void read_library_information(void) {
       b = buf;
       m = index(buf, '-');
       e = index(buf, ' ');
-      if ((n = rindex(buf, '/')) == NULL) n = rindex(buf, ' ');
+      if ((n = strrchr(buf, '/')) == NULL) n = strrchr(buf, ' ');
       if (n &&
           ((*n >= '0' && *n <= '9') || *n == '[' || *n == '{' || *n == '('))
         n = NULL;
-- 
cgit 1.4.1


From a61a30dee03aced16d117150c4dbfd7079de7e68 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 28 Jan 2021 14:11:33 +0100
Subject: fix another pending_not_fuzzed location

---
 src/afl-fuzz-extras.c | 2 +-
 src/afl-fuzz-init.c   | 5 +++--
 src/afl-fuzz-one.c    | 4 ++--
 src/afl-fuzz.c        | 2 +-
 4 files changed, 7 insertions(+), 6 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/src/afl-fuzz-extras.c b/src/afl-fuzz-extras.c
index a3583651..7ecad233 100644
--- a/src/afl-fuzz-extras.c
+++ b/src/afl-fuzz-extras.c
@@ -413,7 +413,7 @@ void dedup_extras(afl_state_t *afl) {
         if (j + 1 < afl->extras_cnt)  // not at the end of the list?
           memmove((char *)&afl->extras[j], (char *)&afl->extras[j + 1],
                   (afl->extras_cnt - j - 1) * sizeof(struct extra_data));
-        afl->extras_cnt--;
+        --afl->extras_cnt;
         goto restart_dedup;  // restart if several duplicates are in a row
 
       }
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 5f5e65cd..84f81112 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -1041,6 +1041,7 @@ void perform_dry_run(afl_state_t *afl) {
 
         if (!p->was_fuzzed) {
 
+          p->was_fuzzed = 1;
           --afl->pending_not_fuzzed;
           --afl->active_paths;
 
@@ -1153,7 +1154,7 @@ restart_outer_cull_loop:
 
             p->was_fuzzed = 1;
             --afl->pending_not_fuzzed;
-            afl->active_paths--;
+            --afl->active_paths;
 
           }
 
@@ -1168,7 +1169,7 @@ restart_outer_cull_loop:
 
             q->was_fuzzed = 1;
             --afl->pending_not_fuzzed;
-            afl->active_paths--;
+            --afl->active_paths;
 
           }
 
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index af768183..ff766158 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -530,7 +530,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
     len = afl->queue_cur->len;
 
     /* maybe current entry is not ready for splicing anymore */
-    if (unlikely(len <= 4 && old_len > 4)) afl->ready_for_splicing_count--;
+    if (unlikely(len <= 4 && old_len > 4)) --afl->ready_for_splicing_count;
 
   }
 
@@ -2958,7 +2958,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
     len = afl->queue_cur->len;
 
     /* maybe current entry is not ready for splicing anymore */
-    if (unlikely(len <= 4 && old_len > 4)) afl->ready_for_splicing_count--;
+    if (unlikely(len <= 4 && old_len > 4)) --afl->ready_for_splicing_count;
 
   }
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index a1f749b5..e856730e 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1636,7 +1636,7 @@ int main(int argc, char **argv_orig, char **envp) {
                  (afl->old_seed_selection && !afl->queue_cur))) {
 
       ++afl->queue_cycle;
-      runs_in_current_cycle = 0;
+      runs_in_current_cycle = (u32)-1;
       afl->cur_skipped_paths = 0;
 
       if (unlikely(afl->old_seed_selection)) {
-- 
cgit 1.4.1


From 3b3565269d0453c9f4b5b2847f809cd5d315fff2 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sat, 30 Jan 2021 14:57:17 +0100
Subject: foreign sync from ctime to mtime (libfuzzer)

---
 include/afl-fuzz.h  |  2 +-
 src/afl-fuzz-init.c | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index f46d7707..12db9e4d 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -404,7 +404,7 @@ struct afl_pass_stat {
 struct foreign_sync {
 
   u8 *   dir;
-  time_t ctime;
+  time_t mtime;
 
 };
 
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 84f81112..1808f0a1 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -468,7 +468,7 @@ void read_foreign_testcases(afl_state_t *afl, int first) {
         afl->foreign_syncs[iter].dir[0] != 0) {
 
       if (first) ACTF("Scanning '%s'...", afl->foreign_syncs[iter].dir);
-      time_t ctime_max = 0;
+      time_t mtime_max = 0;
       u8 *   name = strrchr(afl->foreign_syncs[iter].dir, '/');
       if (!name) { name = afl->foreign_syncs[iter].dir; }
       if (!strcmp(name, "queue") || !strcmp(name, "out") ||
@@ -482,8 +482,8 @@ void read_foreign_testcases(afl_state_t *afl, int first) {
 
       }
 
-      /* We do not use sorting yet and do a more expensive ctime check instead.
-         a ctimesort() implementation would be better though. */
+      /* We do not use sorting yet and do a more expensive mtime check instead.
+         a mtimesort() implementation would be better though. */
 
       nl_cnt = scandir(afl->foreign_syncs[iter].dir, &nl, NULL, NULL);
 
@@ -537,8 +537,8 @@ void read_foreign_testcases(afl_state_t *afl, int first) {
 
         }
 
-        /* we detect new files by their ctime */
-        if (likely(st.st_ctime <= afl->foreign_syncs[iter].ctime)) {
+        /* we detect new files by their mtime */
+        if (likely(st.st_mtime <= afl->foreign_syncs[iter].mtime)) {
 
           ck_free(fn2);
           continue;
@@ -600,11 +600,11 @@ void read_foreign_testcases(afl_state_t *afl, int first) {
         munmap(mem, st.st_size);
         close(fd);
 
-        if (st.st_ctime > ctime_max) ctime_max = st.st_ctime;
+        if (st.st_mtime > mtime_max) mtime_max = st.st_mtime;
 
       }
 
-      afl->foreign_syncs[iter].ctime = ctime_max;
+      afl->foreign_syncs[iter].mtime = mtime_max;
       free(nl);                                              /* not tracked */
 
     }
-- 
cgit 1.4.1


From 9d08f0d098c91e69b5fe41674e4c5d05363af604 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sat, 30 Jan 2021 15:39:47 +0100
Subject: added AFL_CMPLOG_ONLY_NEW feature

---
 docs/Changelog.md       |   2 +
 docs/env_variables.md   |   5 ++
 include/afl-fuzz.h      |   2 +-
 include/common.h        |   2 +-
 include/envs.h          |   1 +
 src/afl-analyze.c       |  22 ++++----
 src/afl-common.c        |   6 +--
 src/afl-fuzz-init.c     |   3 ++
 src/afl-fuzz-one.c      |   5 +-
 src/afl-fuzz-redqueen.c | 135 +++++++++++++++++++++++++-----------------------
 src/afl-fuzz-state.c    |   7 +++
 src/afl-fuzz.c          |  35 +++++++------
 src/afl-showmap.c       |  24 ++++-----
 src/afl-tmin.c          |  24 ++++-----
 14 files changed, 147 insertions(+), 126 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 329b7520..6e59961b 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -20,6 +20,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
       transformations (e.g. toupper, tolower, to/from hex, xor,
       arithmetics, etc.). this is costly hence new command line option
       -l that sets the intensity (values 1 to 3). recommended is 1 or 2.
+    - added `AFL_CMPLOG_ONLY_NEW` to not use cmplog on initial testcases from
+      `-i` or resumes (as these have most likely already been done)
     - fix crash for very, very fast targets+systems (thanks to mhlakhani
       for reporting)
     - if determinstic mode is active (-D, or -M without -d) then we sync
diff --git a/docs/env_variables.md b/docs/env_variables.md
index 66d85749..4c3b1cfb 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -287,6 +287,11 @@ checks or alter some of the more exotic semantics of the tool:
     the target. This must be equal or larger than the size the target was
     compiled with.
 
+  - `AFL_CMPLOG_ONLY_NEW` will only perform the expensive cmplog feature for
+    newly found testcases and not for testcases that are loaded on startup
+    (`-i in`). This is an important feature to set when resuming a fuzzing
+    session.
+
   - `AFL_TESTCACHE_SIZE` allows you to override the size of `#define TESTCASE_CACHE`
     in config.h. Recommended values are 50-250MB - or more if your fuzzing
     finds a huge amount of paths for large inputs.
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 12db9e4d..e8a21cb5 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -384,7 +384,7 @@ typedef struct afl_env_vars {
       afl_dumb_forksrv, afl_import_first, afl_custom_mutator_only, afl_no_ui,
       afl_force_ui, afl_i_dont_care_about_missing_crashes, afl_bench_just_one,
       afl_bench_until_crash, afl_debug_child, afl_autoresume, afl_cal_fast,
-      afl_cycle_schedules, afl_expand_havoc, afl_statsd;
+      afl_cycle_schedules, afl_expand_havoc, afl_statsd, afl_cmplog_only_new;
 
   u8 *afl_tmpdir, *afl_custom_mutator_library, *afl_python_module, *afl_path,
       *afl_hang_tmout, *afl_forksrv_init_tmout, *afl_skip_crashes, *afl_preload,
diff --git a/include/common.h b/include/common.h
index bdaa1735..bb8831f2 100644
--- a/include/common.h
+++ b/include/common.h
@@ -47,7 +47,7 @@ void   argv_cpy_free(char **argv);
 char **get_qemu_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv);
 char **get_wine_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv);
 char * get_afl_env(char *env);
-u8 *get_libqasan_path(u8 *own_loc);
+u8 *   get_libqasan_path(u8 *own_loc);
 
 extern u8  be_quiet;
 extern u8 *doc_path;                    /* path to documentation dir        */
diff --git a/include/envs.h b/include/envs.h
index 926c9e27..210b34a6 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -28,6 +28,7 @@ static char *afl_environment_variables[] = {
     "AFL_CC",
     "AFL_CMIN_ALLOW_ANY",
     "AFL_CMIN_CRASHES_ONLY",
+    "AFL_CMPLOG_ONLY_NEW",
     "AFL_CODE_END",
     "AFL_CODE_START",
     "AFL_COMPCOV_BINNAME",
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index 28598ba0..20aef2da 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -1079,28 +1079,28 @@ int main(int argc, char **argv_orig, char **envp) {
   if (optind == argc || !in_file) { usage(argv[0]); }
 
   if (qemu_mode && getenv("AFL_USE_QASAN")) {
-  
-    u8* preload = getenv("AFL_PRELOAD");
-    u8* libqasan = get_libqasan_path(argv_orig[0]);
-    
+
+    u8 *preload = getenv("AFL_PRELOAD");
+    u8 *libqasan = get_libqasan_path(argv_orig[0]);
+
     if (!preload) {
-    
+
       setenv("AFL_PRELOAD", libqasan, 0);
-    
+
     } else {
-    
+
       u8 *result = ck_alloc(strlen(libqasan) + strlen(preload) + 2);
       strcpy(result, libqasan);
       strcat(result, " ");
       strcat(result, preload);
-      
+
       setenv("AFL_PRELOAD", result, 1);
       ck_free(result);
-    
+
     }
-    
+
     ck_free(libqasan);
-  
+
   }
 
   map_size = get_map_size();
diff --git a/src/afl-common.c b/src/afl-common.c
index a69f2e97..235c4c05 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -364,11 +364,7 @@ u8 *get_libqasan_path(u8 *own_loc) {
     cp = alloc_printf("%s/libqasan.so", own_copy);
     ck_free(own_copy);
 
-    if (!access(cp, X_OK)) {
-
-      return cp;
-
-    }
+    if (!access(cp, X_OK)) { return cp; }
 
   } else {
 
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 1808f0a1..2a7864f9 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -25,6 +25,7 @@
 
 #include "afl-fuzz.h"
 #include <limits.h>
+#include "cmplog.h"
 
 #ifdef HAVE_AFFINITY
 
@@ -833,6 +834,8 @@ void perform_dry_run(afl_state_t *afl) {
 
     }
 
+    if (afl->afl_env.afl_cmplog_only_new) { q->colorized = CMPLOG_LVL_MAX; }
+
     u8 *fn = strrchr(q->fname, '/') + 1;
 
     ACTF("Attempting dry run with '%s'...", fn);
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index ff766158..0cf889a8 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -26,6 +26,7 @@
 #include "afl-fuzz.h"
 #include <string.h>
 #include <limits.h>
+#include "cmplog.h"
 
 /* MOpt */
 
@@ -553,7 +554,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
     if (unlikely(len < 4)) {
 
-      afl->queue_cur->colorized = 0xff;
+      afl->queue_cur->colorized = CMPLOG_LVL_MAX;
 
     } else {
 
@@ -2981,7 +2982,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
 
     if (unlikely(len < 4)) {
 
-      afl->queue_cur->colorized = 0xff;
+      afl->queue_cur->colorized = CMPLOG_LVL_MAX;
 
     } else {
 
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index fc620781..d7657c1d 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -1118,7 +1118,11 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 #ifdef ARITHMETIC_LESSER_GREATER
   if (lvl < LVL3 || attr == IS_TRANSFORM) { return 0; }
 
-  if (!(attr & (IS_GREATER | IS_LESSER)) || SHAPE_BYTES(h->shape) < 4) { return 0; }
+  if (!(attr & (IS_GREATER | IS_LESSER)) || SHAPE_BYTES(h->shape) < 4) {
+
+    return 0;
+
+  }
 
   // transform >= to < and <= to >
   if ((attr & IS_EQUAL) && (attr & (IS_GREATER | IS_LESSER))) {
@@ -1138,110 +1142,110 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
   // lesser/greater FP comparison
   if (attr >= IS_FP && attr < IS_FP_MOD) {
 
-      u64 repl_new;
-
-      if (attr & IS_GREATER) {
+    u64 repl_new;
 
-        if (SHAPE_BYTES(h->shape) == 4 && its_len >= 4) {
+    if (attr & IS_GREATER) {
 
-          float *f = (float *)&repl;
-          float  g = *f;
-          g += 1.0;
-          u32 *r = (u32 *)&g;
-          repl_new = (u32)*r;
+      if (SHAPE_BYTES(h->shape) == 4 && its_len >= 4) {
 
-        } else if (SHAPE_BYTES(h->shape) == 8 && its_len >= 8) {
+        float *f = (float *)&repl;
+        float  g = *f;
+        g += 1.0;
+        u32 *r = (u32 *)&g;
+        repl_new = (u32)*r;
 
-          double *f = (double *)&repl;
-          double  g = *f;
-          g += 1.0;
+      } else if (SHAPE_BYTES(h->shape) == 8 && its_len >= 8) {
 
-          u64 *r = (u64 *)&g;
-          repl_new = *r;
+        double *f = (double *)&repl;
+        double  g = *f;
+        g += 1.0;
 
-        } else {
+        u64 *r = (u64 *)&g;
+        repl_new = *r;
 
-          return 0;
+      } else {
 
-        }
+        return 0;
 
-        changed_val = repl_new;
+      }
 
-        if (unlikely(cmp_extend_encoding(
-                afl, h, pattern, repl_new, o_pattern, changed_val, 16, idx,
-                taint_len, orig_buf, buf, cbuf, len, 1, lvl, status))) {
+      changed_val = repl_new;
 
-          return 1;
+      if (unlikely(cmp_extend_encoding(
+              afl, h, pattern, repl_new, o_pattern, changed_val, 16, idx,
+              taint_len, orig_buf, buf, cbuf, len, 1, lvl, status))) {
 
-        }
+        return 1;
 
-      } else {
+      }
 
-        if (SHAPE_BYTES(h->shape) == 4) {
+    } else {
 
-          float *f = (float *)&repl;
-          float  g = *f;
-          g -= 1.0;
-          u32 *r = (u32 *)&g;
-          repl_new = (u32)*r;
+      if (SHAPE_BYTES(h->shape) == 4) {
 
-        } else if (SHAPE_BYTES(h->shape) == 8) {
+        float *f = (float *)&repl;
+        float  g = *f;
+        g -= 1.0;
+        u32 *r = (u32 *)&g;
+        repl_new = (u32)*r;
 
-          double *f = (double *)&repl;
-          double  g = *f;
-          g -= 1.0;
-          u64 *r = (u64 *)&g;
-          repl_new = *r;
+      } else if (SHAPE_BYTES(h->shape) == 8) {
 
-        } else {
+        double *f = (double *)&repl;
+        double  g = *f;
+        g -= 1.0;
+        u64 *r = (u64 *)&g;
+        repl_new = *r;
 
-          return 0;
+      } else {
 
-        }
+        return 0;
 
-        changed_val = repl_new;
+      }
 
-        if (unlikely(cmp_extend_encoding(
-                afl, h, pattern, repl_new, o_pattern, changed_val, 16, idx,
-                taint_len, orig_buf, buf, cbuf, len, 1, lvl, status))) {
+      changed_val = repl_new;
 
-          return 1;
+      if (unlikely(cmp_extend_encoding(
+              afl, h, pattern, repl_new, o_pattern, changed_val, 16, idx,
+              taint_len, orig_buf, buf, cbuf, len, 1, lvl, status))) {
 
-        }
+        return 1;
 
       }
 
-      // transform double to float, llvm likes to do that internally ...
-      if (SHAPE_BYTES(h->shape) == 8 && its_len >= 4) {
+    }
 
-        double *f = (double *)&repl;
-        float   g = (float)*f;
-        repl_new = 0;
+    // transform double to float, llvm likes to do that internally ...
+    if (SHAPE_BYTES(h->shape) == 8 && its_len >= 4) {
+
+      double *f = (double *)&repl;
+      float   g = (float)*f;
+      repl_new = 0;
   #if (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
-        memcpy((char *)&repl_new, (char *)&g, 4);
+      memcpy((char *)&repl_new, (char *)&g, 4);
   #else
-        memcpy(((char *)&repl_new) + 4, (char *)&g, 4);
+      memcpy(((char *)&repl_new) + 4, (char *)&g, 4);
   #endif
-        changed_val = repl_new;
-        h->shape = 3;  // modify shape
-
-        // fprintf(stderr, "DOUBLE2FLOAT %llx\n", repl_new);
+      changed_val = repl_new;
+      h->shape = 3;  // modify shape
 
-        if (unlikely(cmp_extend_encoding(
-                afl, h, pattern, repl_new, o_pattern, changed_val, 16, idx,
-                taint_len, orig_buf, buf, cbuf, len, 1, lvl, status))) {
+      // fprintf(stderr, "DOUBLE2FLOAT %llx\n", repl_new);
 
-          h->shape = 7;  // recover shape
-          return 1;
-
-        }
+      if (unlikely(cmp_extend_encoding(
+              afl, h, pattern, repl_new, o_pattern, changed_val, 16, idx,
+              taint_len, orig_buf, buf, cbuf, len, 1, lvl, status))) {
 
         h->shape = 7;  // recover shape
+        return 1;
 
       }
 
+      h->shape = 7;  // recover shape
+
     }
 
+  }
+
   else if (attr < IS_FP) {
 
     // lesser/greater integer comparison
@@ -1707,6 +1711,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
           try_to_add_to_dictN(afl, s128_v1, SHAPE_BYTES(h->shape));
 
         } else
+
 #endif
         {
 
diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c
index 8423a3d1..5040e3ef 100644
--- a/src/afl-fuzz-state.c
+++ b/src/afl-fuzz-state.c
@@ -236,6 +236,13 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
             afl->afl_env.afl_custom_mutator_only =
                 get_afl_env(afl_environment_variables[i]) ? 1 : 0;
 
+          } else if (!strncmp(env, "AFL_CMPLOG_ONLY_NEW",
+
+                              afl_environment_variable_len)) {
+
+            afl->afl_env.afl_cmplog_only_new =
+                get_afl_env(afl_environment_variables[i]) ? 1 : 0;
+
           } else if (!strncmp(env, "AFL_NO_UI", afl_environment_variable_len)) {
 
             afl->afl_env.afl_no_ui =
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 312d9424..9d9b0434 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -181,6 +181,7 @@ static void usage(u8 *argv0, int more_help) {
       "AFL_AUTORESUME: resume fuzzing if directory specified by -o already exists\n"
       "AFL_BENCH_JUST_ONE: run the target just once\n"
       "AFL_BENCH_UNTIL_CRASH: exit soon when the first crashing input has been found\n"
+      "AFL_CMPLOG_ONLY_NEW: do not run cmplog on initial testcases (good for resumes!)\n"
       "AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash\n"
       "AFL_CUSTOM_MUTATOR_LIBRARY: lib with afl_custom_fuzz() to mutate inputs\n"
       "AFL_CUSTOM_MUTATOR_ONLY: avoid AFL++'s internal mutators\n"
@@ -326,8 +327,9 @@ int main(int argc, char **argv_orig, char **envp) {
         "compile time)");
 
   }
+
   #endif
-  
+
   char **argv = argv_cpy_dup(argc, argv_orig);
 
   afl_state_t *afl = calloc(1, sizeof(afl_state_t));
@@ -356,8 +358,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   while ((opt = getopt(
               argc, argv,
-              "+b:B:c:CdDe:E:hi:I:f:F:l:L:m:M:nNo:p:RQs:S:t:T:UV:Wx:Z")) >
-         0) {
+              "+b:B:c:CdDe:E:hi:I:f:F:l:L:m:M:nNo:p:RQs:S:t:T:UV:Wx:Z")) > 0) {
 
     switch (opt) {
 
@@ -984,31 +985,31 @@ int main(int argc, char **argv_orig, char **envp) {
     usage(argv[0], show_help);
 
   }
-  
+
   if (afl->fsrv.qemu_mode && getenv("AFL_USE_QASAN")) {
-  
-    u8* preload = getenv("AFL_PRELOAD");
-    u8* libqasan = get_libqasan_path(argv_orig[0]);
-    
+
+    u8 *preload = getenv("AFL_PRELOAD");
+    u8 *libqasan = get_libqasan_path(argv_orig[0]);
+
     if (!preload) {
-    
+
       setenv("AFL_PRELOAD", libqasan, 0);
-    
+
     } else {
-    
+
       u8 *result = ck_alloc(strlen(libqasan) + strlen(preload) + 2);
       strcpy(result, libqasan);
       strcat(result, " ");
       strcat(result, preload);
-      
+
       setenv("AFL_PRELOAD", result, 1);
       ck_free(result);
-    
+
     }
-    
+
     afl->afl_env.afl_preload = (u8 *)getenv("AFL_PRELOAD");
     ck_free(libqasan);
-  
+
   }
 
   if (afl->fsrv.mem_limit && afl->shm.cmplog_mode) afl->fsrv.mem_limit += 260;
@@ -1270,7 +1271,7 @@ int main(int argc, char **argv_orig, char **envp) {
         "instead of using AFL_PRELOAD?");
 
   }
-  
+
   if (afl->afl_env.afl_preload) {
 
     if (afl->fsrv.qemu_mode) {
@@ -1322,7 +1323,7 @@ int main(int argc, char **argv_orig, char **envp) {
     FATAL("Use AFL_PRELOAD instead of AFL_LD_PRELOAD");
 
   }
-  
+
   save_cmdline(afl, argc, argv);
 
   fix_up_banner(afl, argv[optind]);
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index f3cd5a90..62bf1021 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -942,30 +942,30 @@ int main(int argc, char **argv_orig, char **envp) {
   }
 
   if (optind == argc || !out_file) { usage(argv[0]); }
-  
+
   if (fsrv->qemu_mode && getenv("AFL_USE_QASAN")) {
-  
-    u8* preload = getenv("AFL_PRELOAD");
-    u8* libqasan = get_libqasan_path(argv_orig[0]);
-    
+
+    u8 *preload = getenv("AFL_PRELOAD");
+    u8 *libqasan = get_libqasan_path(argv_orig[0]);
+
     if (!preload) {
-    
+
       setenv("AFL_PRELOAD", libqasan, 0);
-    
+
     } else {
-    
+
       u8 *result = ck_alloc(strlen(libqasan) + strlen(preload) + 2);
       strcpy(result, libqasan);
       strcat(result, " ");
       strcat(result, preload);
-      
+
       setenv("AFL_PRELOAD", result, 1);
       ck_free(result);
-    
+
     }
-    
+
     ck_free(libqasan);
-  
+
   }
 
   if (in_dir) {
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 9e9e2d63..09b5211d 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -1074,30 +1074,30 @@ int main(int argc, char **argv_orig, char **envp) {
   if (optind == argc || !in_file || !output_file) { usage(argv[0]); }
 
   check_environment_vars(envp);
-  
+
   if (fsrv->qemu_mode && getenv("AFL_USE_QASAN")) {
-  
-    u8* preload = getenv("AFL_PRELOAD");
-    u8* libqasan = get_libqasan_path(argv_orig[0]);
-    
+
+    u8 *preload = getenv("AFL_PRELOAD");
+    u8 *libqasan = get_libqasan_path(argv_orig[0]);
+
     if (!preload) {
-    
+
       setenv("AFL_PRELOAD", libqasan, 0);
-    
+
     } else {
-    
+
       u8 *result = ck_alloc(strlen(libqasan) + strlen(preload) + 2);
       strcpy(result, libqasan);
       strcat(result, " ");
       strcat(result, preload);
-      
+
       setenv("AFL_PRELOAD", result, 1);
       ck_free(result);
-    
+
     }
-    
+
     ck_free(libqasan);
-  
+
   }
 
   /* initialize cmplog_mode */
-- 
cgit 1.4.1


From e5116c6d55185177413104cad1232ca64e04b844 Mon Sep 17 00:00:00 2001
From: aflpp <aflpp@aflplus.plus>
Date: Sun, 31 Jan 2021 17:29:37 +0100
Subject: fix -Z, remove q->next

---
 include/afl-fuzz.h                           |   4 +-
 include/xxhash.h                             |   2 +-
 instrumentation/compare-transform-pass.so.cc |   2 +-
 src/afl-fuzz-init.c                          | 102 +++++++++++----------------
 src/afl-fuzz-one.c                           |   3 +-
 src/afl-fuzz-queue.c                         |  39 +++++-----
 src/afl-fuzz-stats.c                         |  10 +--
 src/afl-fuzz.c                               |  65 +++++------------
 utils/afl_untracer/afl-untracer.c            |   2 +-
 utils/libtokencap/libtokencap.so.c           |  10 +--
 utils/persistent_mode/persistent_demo_new.c  |   2 +-
 utils/persistent_mode/test-instr.c           |   2 +-
 12 files changed, 100 insertions(+), 143 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index e8a21cb5..9b27606c 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -154,6 +154,7 @@ struct queue_entry {
 
   u8 *fname;                            /* File name for the test case      */
   u32 len;                              /* Input length                     */
+  u32 id;                               /* entry number in queue_buf        */
 
   u8 colorized,                         /* Do not run redqueen stage again  */
       cal_failed;                       /* Calibration failed?              */
@@ -191,8 +192,7 @@ struct queue_entry {
   u8 *            cmplog_colorinput;    /* the result buf of colorization   */
   struct tainted *taint;                /* Taint information from CmpLog    */
 
-  struct queue_entry *mother,           /* queue entry this based on        */
-      *next;                            /* Next element, if any             */
+  struct queue_entry *mother;           /* queue entry this based on        */
 
 };
 
diff --git a/include/xxhash.h b/include/xxhash.h
index 006d3f3d..3bd56d13 100644
--- a/include/xxhash.h
+++ b/include/xxhash.h
@@ -287,7 +287,7 @@ typedef uint32_t XXH32_hash_t;
   #else
     #include <limits.h>
     #if UINT_MAX == 0xFFFFFFFFUL
-typedef unsigned int  XXH32_hash_t;
+typedef unsigned int XXH32_hash_t;
     #else
       #if ULONG_MAX == 0xFFFFFFFFUL
 typedef unsigned long XXH32_hash_t;
diff --git a/instrumentation/compare-transform-pass.so.cc b/instrumentation/compare-transform-pass.so.cc
index da5cf7e9..932540a7 100644
--- a/instrumentation/compare-transform-pass.so.cc
+++ b/instrumentation/compare-transform-pass.so.cc
@@ -68,7 +68,7 @@ class CompareTransform : public ModulePass {
   const char *getPassName() const override {
 
 #else
-  StringRef      getPassName() const override {
+  StringRef getPassName() const override {
 
 #endif
     return "transforms compare functions";
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 2a7864f9..56dae48c 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -817,12 +817,15 @@ void read_testcases(afl_state_t *afl, u8 *directory) {
 
 void perform_dry_run(afl_state_t *afl) {
 
-  struct queue_entry *q = afl->queue;
-  u32                 cal_failures = 0;
+  struct queue_entry *q;
+  u32                 cal_failures = 0, idx;
   u8 *                skip_crashes = afl->afl_env.afl_skip_crashes;
   u8 *                use_mem;
 
-  while (q) {
+  for (idx = 0; idx < afl->queued_paths; idx++) {
+
+    q = afl->queue_buf[idx];
+    if (unlikely(q->disabled)) { continue; }
 
     u8  res;
     s32 fd;
@@ -1052,20 +1055,22 @@ void perform_dry_run(afl_state_t *afl) {
 
         p->disabled = 1;
         p->perf_score = 0;
-        while (p && p->next != q)
-          p = p->next;
 
-        if (p)
-          p->next = q->next;
-        else
-          afl->queue = q->next;
+        u32 i = 0;
+        while (unlikely(afl->queue_buf[i]->disabled)) {
+
+          ++i;
+
+        }
+
+        afl->queue = afl->queue_buf[i];
 
         afl->max_depth = 0;
-        p = afl->queue;
-        while (p) {
+        for (i = 0; i < afl->queued_paths; i++) {
 
-          if (p->depth > afl->max_depth) afl->max_depth = p->depth;
-          p = p->next;
+          if (!afl->queue_buf[i]->disabled &&
+              afl->queue_buf[i]->depth > afl->max_depth)
+            afl->max_depth = afl->queue_buf[i]->depth;
 
         }
 
@@ -1098,8 +1103,6 @@ void perform_dry_run(afl_state_t *afl) {
 
     }
 
-    q = q->next;
-
   }
 
   if (cal_failures) {
@@ -1125,31 +1128,23 @@ void perform_dry_run(afl_state_t *afl) {
 
   /* Now we remove all entries from the queue that have a duplicate trace map */
 
-  q = afl->queue;
-  struct queue_entry *p, *prev = NULL;
-  int                 duplicates = 0;
-
-restart_outer_cull_loop:
+  u32 duplicates = 0, i;
 
-  while (q) {
+  for (idx = 0; idx < afl->queued_paths; idx++) {
 
-    if (q->cal_failed || !q->exec_cksum) { goto next_entry; }
+    q = afl->queue_buf[idx];
+    if (q->disabled || q->cal_failed || !q->exec_cksum) { continue; }
 
-  restart_inner_cull_loop:
+    u32 done = 0;
+    for (i = idx + 1; i < afl->queued_paths && !done; i++) {
 
-    p = q->next;
+      struct queue_entry *p = afl->queue_buf[i];
+      if (p->disabled || p->cal_failed || !p->exec_cksum) { continue; }
 
-    while (p) {
-
-      if (!p->cal_failed && p->exec_cksum == q->exec_cksum) {
+      if (p->exec_cksum == q->exec_cksum) {
 
         duplicates = 1;
 
-        // We do not remove any of the memory allocated because for
-        // splicing the data might still be interesting.
-        // We only decouple them from the linked list.
-        // This will result in some leaks at exit, but who cares.
-
         // we keep the shorter file
         if (p->len >= q->len) {
 
@@ -1163,8 +1158,6 @@ restart_outer_cull_loop:
 
           p->disabled = 1;
           p->perf_score = 0;
-          q->next = p->next;
-          goto restart_inner_cull_loop;
 
         } else {
 
@@ -1178,35 +1171,26 @@ restart_outer_cull_loop:
 
           q->disabled = 1;
           q->perf_score = 0;
-          if (prev)
-            prev->next = q = p;
-          else
-            afl->queue = q = p;
-          goto restart_outer_cull_loop;
+
+          done = 1;
 
         }
 
       }
 
-      p = p->next;
-
     }
 
-  next_entry:
-
-    prev = q;
-    q = q->next;
-
   }
 
   if (duplicates) {
 
     afl->max_depth = 0;
-    q = afl->queue;
-    while (q) {
 
-      if (q->depth > afl->max_depth) afl->max_depth = q->depth;
-      q = q->next;
+    for (idx = 0; idx < afl->queued_paths; idx++) {
+
+      if (!afl->queue_buf[idx]->disabled &&
+          afl->queue_buf[idx]->depth > afl->max_depth)
+        afl->max_depth = afl->queue_buf[idx]->depth;
 
     }
 
@@ -1256,11 +1240,15 @@ static void link_or_copy(u8 *old_path, u8 *new_path) {
 void pivot_inputs(afl_state_t *afl) {
 
   struct queue_entry *q = afl->queue;
-  u32                 id = 0;
+  u32                 id = 0, i;
 
   ACTF("Creating hard links for all input files...");
 
-  while (q) {
+  for (i = 0; i < afl->queued_paths; i++) {
+
+    q = afl->queue_buf[i];
+
+    if (unlikely(q->disabled)) { continue; }
 
     u8 *nfn, *rsl = strrchr(q->fname, '/');
     u32 orig_id;
@@ -1288,19 +1276,14 @@ void pivot_inputs(afl_state_t *afl) {
       afl->resuming_fuzz = 1;
       nfn = alloc_printf("%s/queue/%s", afl->out_dir, rsl);
 
-      /* Since we're at it, let's also try to find parent and figure out the
+      /* Since we're at it, let's also get the parent and figure out the
          appropriate depth for this entry. */
 
       src_str = strchr(rsl + 3, ':');
 
       if (src_str && sscanf(src_str + 1, "%06u", &src_id) == 1) {
 
-        struct queue_entry *s = afl->queue;
-        while (src_id-- && s) {
-
-          s = s->next;
-
-        }
+        struct queue_entry *s = afl->queue_buf[src_id];
 
         if (s) { q->depth = s->depth + 1; }
 
@@ -1348,7 +1331,6 @@ void pivot_inputs(afl_state_t *afl) {
 
     if (q->passed_det) { mark_as_det_done(afl, q); }
 
-    q = q->next;
     ++id;
 
   }
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 0cf889a8..18291fb7 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -544,7 +544,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
   if (likely(!afl->old_seed_selection))
     orig_perf = perf_score = afl->queue_cur->perf_score;
   else
-    orig_perf = perf_score = calculate_score(afl, afl->queue_cur);
+    afl->queue_cur->perf_score = orig_perf = perf_score =
+        calculate_score(afl, afl->queue_cur);
 
   if (unlikely(perf_score <= 0)) { goto abandon_entry; }
 
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 4442b400..ad3e3b8e 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -143,7 +143,7 @@ void create_alias_table(afl_state_t *afl) {
 
       struct queue_entry *q = afl->queue_buf[i];
 
-      if (!q->disabled) { q->perf_score = calculate_score(afl, q); }
+      if (likely(!q->disabled)) { q->perf_score = calculate_score(afl, q); }
 
       sum += q->perf_score;
 
@@ -444,7 +444,6 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
 
   if (afl->queue_top) {
 
-    afl->queue_top->next = q;
     afl->queue_top = q;
 
   } else {
@@ -465,6 +464,7 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
       AFL_BUF_PARAM(queue), afl->queued_paths * sizeof(struct queue_entry *));
   if (unlikely(!queue_buf)) { PFATAL("alloc"); }
   queue_buf[afl->queued_paths - 1] = q;
+  q->id = afl->queued_paths - 1;
 
   afl->last_path_time = get_cur_time();
 
@@ -641,10 +641,9 @@ void cull_queue(afl_state_t *afl) {
 
   if (likely(!afl->score_changed || afl->non_instrumented_mode)) { return; }
 
-  struct queue_entry *q;
-  u32                 len = (afl->fsrv.map_size >> 3);
-  u32                 i;
-  u8 *                temp_v = afl->map_tmp_buf;
+  u32 len = (afl->fsrv.map_size >> 3);
+  u32 i;
+  u8 *temp_v = afl->map_tmp_buf;
 
   afl->score_changed = 0;
 
@@ -653,12 +652,9 @@ void cull_queue(afl_state_t *afl) {
   afl->queued_favored = 0;
   afl->pending_favored = 0;
 
-  q = afl->queue;
-
-  while (q) {
+  for (i = 0; i < afl->queued_paths; i++) {
 
-    q->favored = 0;
-    q = q->next;
+    afl->queue_buf[i]->favored = 0;
 
   }
 
@@ -697,12 +693,13 @@ void cull_queue(afl_state_t *afl) {
 
   }
 
-  q = afl->queue;
+  for (i = 0; i < afl->queued_paths; i++) {
+
+    if (likely(!afl->queue_buf[i]->disabled)) {
 
-  while (q) {
+      mark_as_redundant(afl, afl->queue_buf[i], !afl->queue_buf[i]->favored);
 
-    mark_as_redundant(afl, q, !q->favored);
-    q = q->next;
+    }
 
   }
 
@@ -852,13 +849,15 @@ u32 calculate_score(afl_state_t *afl, struct queue_entry *q) {
       // Don't modify perf_score for unfuzzed seeds
       if (q->fuzz_level == 0) break;
 
-      struct queue_entry *queue_it = afl->queue;
-      while (queue_it) {
+      u32 i;
+      for (i = 0; i < afl->queued_paths; i++) {
 
-        fuzz_mu += log2(afl->n_fuzz[q->n_fuzz_entry]);
-        n_paths++;
+        if (likely(!afl->queue_buf[i]->disabled)) {
 
-        queue_it = queue_it->next;
+          fuzz_mu += log2(afl->n_fuzz[afl->queue_buf[i]->n_fuzz_entry]);
+          n_paths++;
+
+        }
 
       }
 
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index 82da8176..7e99bf8f 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -1014,8 +1014,8 @@ void show_stats(afl_state_t *afl) {
 
 void show_init_stats(afl_state_t *afl) {
 
-  struct queue_entry *q = afl->queue;
-  u32                 min_bits = 0, max_bits = 0, max_len = 0, count = 0;
+  struct queue_entry *q;
+  u32                 min_bits = 0, max_bits = 0, max_len = 0, count = 0, i;
   u64                 min_us = 0, max_us = 0;
   u64                 avg_us = 0;
 
@@ -1028,7 +1028,10 @@ void show_init_stats(afl_state_t *afl) {
 
   }
 
-  while (q) {
+  for (i = 0; i < afl->queued_paths; i++) {
+
+    q = afl->queue_buf[i];
+    if (unlikely(q->disabled)) { continue; }
 
     if (!min_us || q->exec_us < min_us) { min_us = q->exec_us; }
     if (q->exec_us > max_us) { max_us = q->exec_us; }
@@ -1039,7 +1042,6 @@ void show_init_stats(afl_state_t *afl) {
     if (q->len > max_len) { max_len = q->len; }
 
     ++count;
-    q = q->next;
 
   }
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 9d9b0434..40d42c11 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1558,45 +1558,6 @@ int main(int argc, char **argv_orig, char **envp) {
 
   perform_dry_run(afl);
 
-  /*
-    if (!user_set_cache && afl->q_testcase_max_cache_size) {
-
-      / * The user defined not a fixed number of entries for the cache.
-         Hence we autodetect a good value. After the dry run inputs are
-         trimmed and we know the average and max size of the input seeds.
-         We use this information to set a fitting size to max entries
-         based on the cache size. * /
-
-      struct queue_entry *q = afl->queue;
-      u64                 size = 0, count = 0, avg = 0, max = 0;
-
-      while (q) {
-
-        ++count;
-        size += q->len;
-        if (max < q->len) { max = q->len; }
-        q = q->next;
-
-      }
-
-      if (count) {
-
-        avg = size / count;
-        avg = ((avg + max) / 2) + 1;
-
-      }
-
-      if (avg < 10240) { avg = 10240; }
-
-      afl->q_testcase_max_cache_entries = afl->q_testcase_max_cache_size / avg;
-
-      if (afl->q_testcase_max_cache_entries > 32768)
-        afl->q_testcase_max_cache_entries = 32768;
-
-    }
-
-  */
-
   if (afl->q_testcase_max_cache_entries) {
 
     afl->q_testcase_cache =
@@ -1668,7 +1629,10 @@ int main(int argc, char **argv_orig, char **envp) {
       if (unlikely(afl->old_seed_selection)) {
 
         afl->current_entry = 0;
-        afl->queue_cur = afl->queue;
+        while (unlikely(afl->queue_buf[afl->current_entry]->disabled)) {
+          ++afl->current_entry;
+        }
+        afl->queue_cur = afl->queue_buf[afl->current_entry];
 
         if (unlikely(seek_to)) {
 
@@ -1800,12 +1764,14 @@ int main(int argc, char **argv_orig, char **envp) {
 
         }
 
-        struct queue_entry *q = afl->queue;
         // we must recalculate the scores of all queue entries
-        while (q) {
+        for (i = 0; i < (s32)afl->queued_paths; i++) {
+
+          if (likely(!afl->queue_buf[i]->disabled)) {
 
-          update_bitmap_score(afl, q);
-          q = q->next;
+            update_bitmap_score(afl, afl->queue_buf[i]);
+
+          }
 
         }
 
@@ -1847,8 +1813,15 @@ int main(int argc, char **argv_orig, char **envp) {
 
       if (unlikely(afl->old_seed_selection)) {
 
-        afl->queue_cur = afl->queue_cur->next;
-        ++afl->current_entry;
+        while (++afl->current_entry < afl->queued_paths &&
+               afl->queue_buf[afl->current_entry]->disabled)
+          ;
+        if (unlikely(afl->current_entry >= afl->queued_paths ||
+                     afl->queue_buf[afl->current_entry] == NULL ||
+                     afl->queue_buf[afl->current_entry]->disabled))
+          afl->queue_cur = NULL;
+        else
+          afl->queue_cur = afl->queue_buf[afl->current_entry];
 
       }
 
diff --git a/utils/afl_untracer/afl-untracer.c b/utils/afl_untracer/afl-untracer.c
index f3894a06..d2bad0b9 100644
--- a/utils/afl_untracer/afl-untracer.c
+++ b/utils/afl_untracer/afl-untracer.c
@@ -284,7 +284,7 @@ library_list_t *find_library(char *name) {
 // this seems to work for clang too. nice :) requires gcc 4.4+
 #pragma GCC push_options
 #pragma GCC optimize("O0")
-void        breakpoint(void) {
+void breakpoint(void) {
 
   if (debug) fprintf(stderr, "Breakpoint function \"breakpoint\" reached.\n");
 
diff --git a/utils/libtokencap/libtokencap.so.c b/utils/libtokencap/libtokencap.so.c
index 3629e804..26033b46 100644
--- a/utils/libtokencap/libtokencap.so.c
+++ b/utils/libtokencap/libtokencap.so.c
@@ -161,8 +161,8 @@ static void __tokencap_load_mappings(void) {
 
 #elif defined __FreeBSD__ || defined __OpenBSD__ || defined __NetBSD__
 
-  #if defined   __FreeBSD__
-  int    mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_VMMAP, __tokencap_pid};
+  #if defined __FreeBSD__
+  int mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_VMMAP, __tokencap_pid};
   #elif defined __OpenBSD__
   int mib[] = {CTL_KERN, KERN_PROC_VMMAP, __tokencap_pid};
   #elif defined __NetBSD__
@@ -177,7 +177,7 @@ static void __tokencap_load_mappings(void) {
 
   #if defined __FreeBSD__ || defined __NetBSD__
   len = len * 4 / 3;
-  #elif defined                      __OpenBSD__
+  #elif defined __OpenBSD__
   len -= len % sizeof(struct kinfo_vmentry);
   #endif
 
@@ -202,8 +202,8 @@ static void __tokencap_load_mappings(void) {
 
   #if defined __FreeBSD__ || defined __NetBSD__
 
-    #if defined   __FreeBSD__
-    size_t                size = region->kve_structsize;
+    #if defined __FreeBSD__
+    size_t size = region->kve_structsize;
 
     if (size == 0) break;
     #elif defined __NetBSD__
diff --git a/utils/persistent_mode/persistent_demo_new.c b/utils/persistent_mode/persistent_demo_new.c
index 7e694696..ca616236 100644
--- a/utils/persistent_mode/persistent_demo_new.c
+++ b/utils/persistent_mode/persistent_demo_new.c
@@ -51,7 +51,7 @@ __AFL_FUZZ_INIT();
 /* To ensure checks are not optimized out it is recommended to disable
    code optimization for the fuzzer harness main() */
 #pragma clang optimize off
-#pragma GCC            optimize("O0")
+#pragma GCC optimize("O0")
 
 int main(int argc, char **argv) {
 
diff --git a/utils/persistent_mode/test-instr.c b/utils/persistent_mode/test-instr.c
index 6da511de..2c6b6d77 100644
--- a/utils/persistent_mode/test-instr.c
+++ b/utils/persistent_mode/test-instr.c
@@ -24,7 +24,7 @@ __AFL_FUZZ_INIT();
 /* To ensure checks are not optimized out it is recommended to disable
    code optimization for the fuzzer harness main() */
 #pragma clang optimize off
-#pragma GCC            optimize("O0")
+#pragma GCC optimize("O0")
 
 int main(int argc, char **argv) {
 
-- 
cgit 1.4.1


From 981ffb27a8a166b51a06d57fce044ed1eaf1aa62 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 1 Feb 2021 12:01:23 +0100
Subject: making AFL_MAP_SIZE obsolete

---
 afl-cmin                |  4 +--
 docs/Changelog.md       |  2 ++
 include/forkserver.h    |  3 ++
 include/sharedmem.h     |  1 +
 src/afl-forkserver.c    | 28 ++++++++++++++-----
 src/afl-fuzz-init.c     | 14 ++++++----
 src/afl-fuzz.c          | 73 +++++++++++++++++++++++++++++++++++++++++++------
 src/afl-sharedmem.c     | 14 ++++++++--
 src/afl-showmap.c       | 41 +++++++++++++++++++++++++--
 src/afl-tmin.c          | 37 +++++++++++++++++++++++--
 test-instr.c            |  5 +++-
 test/test-basic.sh      | 12 ++++----
 test/test-gcc-plugin.sh | 10 +++----
 test/test-llvm-lto.sh   |  8 +++---
 test/test-llvm.sh       | 10 +++----
 15 files changed, 211 insertions(+), 51 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/afl-cmin b/afl-cmin
index ffefaead..31d7ddad 100755
--- a/afl-cmin
+++ b/afl-cmin
@@ -343,7 +343,7 @@ BEGIN {
     stat_format = "-f '%z %N'" # *BSD, MacOS
   }
   cmdline = "cd "in_dir" && find . \\( ! -name . -a -type d -prune \\) -o -type f -exec stat "stat_format" \\{\\} \\; | sort -k1n -k2r"
-  cmdline = "ls "in_dir" | (cd "in_dir" && xargs stat "stat_format") | sort -k1n -k2r"
+  cmdline = "ls "in_dir" | (cd "in_dir" && xargs stat "stat_format" 2>/dev/null) | sort -k1n -k2r"
   while (cmdline | getline) {
     sub(/^[0-9]+ (\.\/)?/,"",$0)
     infilesSmallToBig[i++] = $0
@@ -355,7 +355,7 @@ BEGIN {
   # Make sure that we're not dealing with a directory.
 
   if (0 == system("test -d "in_dir"/"first_file)) {
-    print "[-] Error: The input directory contains subdirectories - please fix." > "/dev/stderr"
+    print "[-] Error: The input directory is empty or contains subdirectories - please fix." > "/dev/stderr"
     exit 1
   }
 
diff --git a/docs/Changelog.md b/docs/Changelog.md
index ff69c949..e9efdf38 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -16,6 +16,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     to be placed in the source code.
     Check out instrumentation/README.instrument_list.md
   - afl-fuzz
+    - Making AFL_MAP_SIZE obsolete - afl-fuzz now learns on start the
+      target map size
     - upgraded cmplog/redqueen: solving for floating point, solving
       transformations (e.g. toupper, tolower, to/from hex, xor,
       arithmetics, etc.). this is costly hence new command line option
diff --git a/include/forkserver.h b/include/forkserver.h
index d2fcaa20..ac027f81 100644
--- a/include/forkserver.h
+++ b/include/forkserver.h
@@ -120,11 +120,14 @@ void afl_fsrv_init(afl_forkserver_t *fsrv);
 void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from);
 void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
                     volatile u8 *stop_soon_p, u8 debug_child_output);
+u32  afl_fsrv_get_mapsize(afl_forkserver_t *fsrv, char **argv,
+                          volatile u8 *stop_soon_p, u8 debug_child_output);
 void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len);
 fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
                                       volatile u8 *stop_soon_p);
 void              afl_fsrv_killall(void);
 void              afl_fsrv_deinit(afl_forkserver_t *fsrv);
+void              afl_fsrv_kill(afl_forkserver_t *fsrv);
 
 #ifdef __APPLE__
   #define MSG_FORK_ON_APPLE                                                    \
diff --git a/include/sharedmem.h b/include/sharedmem.h
index b15d0535..fdc947f9 100644
--- a/include/sharedmem.h
+++ b/include/sharedmem.h
@@ -51,6 +51,7 @@ typedef struct sharedmem {
   size_t map_size;                                 /* actual allocated size */
 
   int             cmplog_mode;
+  int             shmemfuzz_mode;
   struct cmp_map *cmp_map;
 
 } sharedmem_t;
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index e59f0d11..9ee59822 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -682,11 +682,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
       if ((status & FS_OPT_AUTODICT) == FS_OPT_AUTODICT) {
 
-        if (ignore_autodict) {
-
-          if (!be_quiet) { WARNF("Ignoring offered AUTODICT feature."); }
-
-        } else {
+        if (!ignore_autodict) {
 
           if (fsrv->add_extra_func == NULL || fsrv->afl_ptr == NULL) {
 
@@ -969,7 +965,9 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
 }
 
-static void afl_fsrv_kill(afl_forkserver_t *fsrv) {
+/* Stop the forkserver and child */
+
+void afl_fsrv_kill(afl_forkserver_t *fsrv) {
 
   if (fsrv->child_pid > 0) { kill(fsrv->child_pid, fsrv->kill_signal); }
   if (fsrv->fsrv_pid > 0) {
@@ -979,13 +977,28 @@ static void afl_fsrv_kill(afl_forkserver_t *fsrv) {
 
   }
 
+  close(fsrv->fsrv_ctl_fd);
+  close(fsrv->fsrv_st_fd);
+  fsrv->fsrv_pid = -1;
+  fsrv->child_pid = -1;
+
+}
+
+/* Get the map size from the target forkserver */
+
+u32 afl_fsrv_get_mapsize(afl_forkserver_t *fsrv, char **argv,
+                         volatile u8 *stop_soon_p, u8 debug_child_output) {
+
+  afl_fsrv_start(fsrv, argv, stop_soon_p, debug_child_output);
+  return fsrv->map_size;
+
 }
 
 /* Delete the current testcase and write the buf to the testcase file */
 
 void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
 
-  if (fsrv->shmem_fuzz) {
+  if (likely(fsrv->use_shmem_fuzz && fsrv->shmem_fuzz)) {
 
     if (unlikely(len > MAX_FILE)) len = MAX_FILE;
 
@@ -1042,6 +1055,7 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
 
     }
 
+    // fprintf(stderr, "WRITE %d %u\n", fd, len);
     ck_write(fd, buf, len, fsrv->out_file);
 
     if (fsrv->use_stdin) {
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 56dae48c..40ba20c7 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -766,13 +766,16 @@ void read_testcases(afl_state_t *afl, u8 *directory) {
 
     }
 
-    if (unlikely(afl->schedule >= FAST && afl->schedule <= RARE)) {
+    /*
+        if (unlikely(afl->schedule >= FAST && afl->schedule <= RARE)) {
 
-      u64 cksum = hash64(afl->fsrv.trace_bits, afl->fsrv.map_size, HASH_CONST);
-      afl->queue_top->n_fuzz_entry = cksum % N_FUZZ_SIZE;
-      afl->n_fuzz[afl->queue_top->n_fuzz_entry] = 1;
+          u64 cksum = hash64(afl->fsrv.trace_bits, afl->fsrv.map_size,
+       HASH_CONST); afl->queue_top->n_fuzz_entry = cksum % N_FUZZ_SIZE;
+          afl->n_fuzz[afl->queue_top->n_fuzz_entry] = 1;
 
-    }
+        }
+
+    */
 
   }
 
@@ -2490,6 +2493,7 @@ void setup_testcase_shmem(afl_state_t *afl) {
 
   // we need to set the non-instrumented mode to not overwrite the SHM_ENV_VAR
   u8 *map = afl_shm_init(afl->shm_fuzz, MAX_FILE + sizeof(u32), 1);
+  afl->shm_fuzz->shmemfuzz_mode = 1;
 
   if (!map) { FATAL("BUG: Zero return from afl_shm_init."); }
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index f1f92717..49733594 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -342,7 +342,6 @@ int main(int argc, char **argv_orig, char **envp) {
   afl->debug = debug;
   afl_fsrv_init(&afl->fsrv);
   if (debug) { afl->fsrv.debug = true; }
-
   read_afl_environment(afl, envp);
   if (afl->shm.map_size) { afl->fsrv.map_size = afl->shm.map_size; }
   exit_1 = !!afl->afl_env.afl_bench_just_one;
@@ -702,7 +701,6 @@ int main(int argc, char **argv_orig, char **envp) {
         if (afl->in_bitmap) { FATAL("Multiple -B options not supported"); }
 
         afl->in_bitmap = optarg;
-        read_bitmap(afl->in_bitmap, afl->virgin_bits, afl->fsrv.map_size);
         break;
 
       case 'C':                                               /* crash mode */
@@ -1369,13 +1367,6 @@ int main(int argc, char **argv_orig, char **envp) {
   set_scheduler_mode(SCHEDULER_MODE_LOW_LATENCY);
   #endif
 
-  afl->fsrv.trace_bits =
-      afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
-
-  if (!afl->in_bitmap) { memset(afl->virgin_bits, 255, afl->fsrv.map_size); }
-  memset(afl->virgin_tmout, 255, afl->fsrv.map_size);
-  memset(afl->virgin_crash, 255, afl->fsrv.map_size);
-
   init_count_class16();
 
   if (afl->is_main_node && check_main_node_exists(afl) == 1) {
@@ -1542,6 +1533,70 @@ int main(int argc, char **argv_orig, char **envp) {
   }
 
   afl->argv = use_argv;
+  afl->fsrv.trace_bits =
+      afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
+
+  if (!afl->non_instrumented_mode) {
+
+    afl->fsrv.map_size = 4194304;  // dummy temporary value
+
+    u32 new_map_size = afl_fsrv_get_mapsize(
+        &afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
+
+    if (new_map_size && new_map_size != 4194304) {
+
+      // only reinitialize when it makes sense
+      if (map_size != new_map_size) {
+
+        //      if (map_size < new_map_size ||
+        //          (new_map_size > map_size && new_map_size - map_size >
+        //          MAP_SIZE)) {
+
+        OKF("Re-initializing maps to %u bytes", new_map_size);
+
+        afl->virgin_bits = ck_realloc(afl->virgin_bits, map_size);
+        afl->virgin_tmout = ck_realloc(afl->virgin_tmout, map_size);
+        afl->virgin_crash = ck_realloc(afl->virgin_crash, map_size);
+        afl->var_bytes = ck_realloc(afl->var_bytes, map_size);
+        afl->top_rated = ck_realloc(afl->top_rated, map_size * sizeof(void *));
+        afl->clean_trace = ck_realloc(afl->clean_trace, map_size);
+        afl->clean_trace_custom = ck_realloc(afl->clean_trace_custom, map_size);
+        afl->first_trace = ck_realloc(afl->first_trace, map_size);
+        afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, map_size);
+
+        afl_shm_deinit(&afl->shm);
+        afl_fsrv_kill(&afl->fsrv);
+        afl->fsrv.map_size = new_map_size;
+        afl->fsrv.trace_bits = afl_shm_init(&afl->shm, afl->fsrv.map_size,
+                                            afl->non_instrumented_mode);
+        setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
+        afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
+                       afl->afl_env.afl_debug_child);
+
+      }
+
+      map_size = new_map_size;
+
+    }
+
+    afl->fsrv.map_size = map_size;
+
+  }
+
+  // after we have the correct bitmap size we can read the bitmap -B option
+  // and set the virgin maps
+  if (!afl->in_bitmap) {
+
+    memset(afl->virgin_bits, 255, afl->fsrv.map_size);
+
+  } else {
+
+    read_bitmap(afl->in_bitmap, afl->virgin_bits, afl->fsrv.map_size);
+
+  }
+
+  memset(afl->virgin_tmout, 255, afl->fsrv.map_size);
+  memset(afl->virgin_crash, 255, afl->fsrv.map_size);
 
   if (afl->cmplog_binary) {
 
diff --git a/src/afl-sharedmem.c b/src/afl-sharedmem.c
index fe641d0d..3241a130 100644
--- a/src/afl-sharedmem.c
+++ b/src/afl-sharedmem.c
@@ -66,9 +66,17 @@ static list_t shm_list = {.element_prealloc_count = 0};
 
 void afl_shm_deinit(sharedmem_t *shm) {
 
-  if (shm == NULL) return;
-
+  if (shm == NULL) { return; }
   list_remove(&shm_list, shm);
+  if (shm->shmemfuzz_mode) {
+
+    unsetenv(SHM_FUZZ_ENV_VAR);
+
+  } else {
+
+    unsetenv(SHM_ENV_VAR);
+
+  }
 
 #ifdef USEMMAP
   if (shm->map != NULL) {
@@ -94,6 +102,8 @@ void afl_shm_deinit(sharedmem_t *shm) {
 
   if (shm->cmplog_mode) {
 
+    unsetenv(CMPLOG_SHM_ENV_VAR);
+
     if (shm->cmp_map != NULL) {
 
       munmap(shm->cmp_map, shm->map_size);
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 62bf1021..56abe4f1 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -86,7 +86,8 @@ static u8 quiet_mode,                  /* Hide non-essential messages?      */
     remove_shm = 1,                    /* remove shmem?                     */
     collect_coverage,                  /* collect coverage                  */
     have_coverage,                     /* have coverage?                    */
-    no_classify;                       /* do not classify counts            */
+    no_classify,                       /* do not classify counts            */
+    debug;                             /* debug mode                        */
 
 static volatile u8 stop_soon,          /* Ctrl-C pressed?                   */
     child_crashed;                     /* Child crashed?                    */
@@ -743,6 +744,7 @@ int main(int argc, char **argv_orig, char **envp) {
   char **argv = argv_cpy_dup(argc, argv_orig);
 
   afl_forkserver_t fsrv_var = {0};
+  if (getenv("AFL_DEBUG")) { debug = 1; }
   fsrv = &fsrv_var;
   afl_fsrv_init(fsrv);
   map_size = get_map_size();
@@ -991,14 +993,16 @@ int main(int argc, char **argv_orig, char **envp) {
 
   //  if (afl->shmem_testcase_mode) { setup_testcase_shmem(afl); }
 
+  setenv("AFL_NO_AUTODICT", "1", 1);
+
   /* initialize cmplog_mode */
   shm.cmplog_mode = 0;
-  fsrv->trace_bits = afl_shm_init(&shm, map_size, 0);
   setup_signal_handlers();
 
   set_up_environment(fsrv);
 
   fsrv->target_path = find_binary(argv[optind]);
+  fsrv->trace_bits = afl_shm_init(&shm, map_size, 0);
 
   if (!quiet_mode) {
 
@@ -1051,6 +1055,7 @@ int main(int argc, char **argv_orig, char **envp) {
   /* initialize cmplog_mode */
   shm_fuzz->cmplog_mode = 0;
   u8 *map = afl_shm_init(shm_fuzz, MAX_FILE + sizeof(u32), 1);
+  shm_fuzz->shmemfuzz_mode = 1;
   if (!map) { FATAL("BUG: Zero return from afl_shm_init."); }
 #ifdef USEMMAP
   setenv(SHM_FUZZ_ENV_VAR, shm_fuzz->g_shm_file_path, 1);
@@ -1063,6 +1068,38 @@ int main(int argc, char **argv_orig, char **envp) {
   fsrv->shmem_fuzz_len = (u32 *)map;
   fsrv->shmem_fuzz = map + sizeof(u32);
 
+  u32 save_be_quiet = be_quiet;
+  be_quiet = debug;
+  fsrv->map_size = 4194304;  // dummy temporary value
+  u32 new_map_size = afl_fsrv_get_mapsize(
+      fsrv, use_argv, &stop_soon,
+      (get_afl_env("AFL_DEBUG_CHILD") || get_afl_env("AFL_DEBUG_CHILD_OUTPUT"))
+          ? 1
+          : 0);
+  be_quiet = save_be_quiet;
+
+  if (new_map_size) {
+
+    // only reinitialize when it makes sense
+    if (map_size < new_map_size ||
+        (new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
+
+      if (!be_quiet)
+        ACTF("Aquired new map size for target: %u bytes\n", new_map_size);
+
+      afl_shm_deinit(&shm);
+      afl_fsrv_kill(fsrv);
+      fsrv->map_size = new_map_size;
+      fsrv->trace_bits = afl_shm_init(&shm, new_map_size, 0);
+
+    }
+
+    map_size = new_map_size;
+
+  }
+
+  fsrv->map_size = map_size;
+
   if (in_dir) {
 
     DIR *          dir_in, *dir_out = NULL;
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 09b5211d..799a4b87 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -79,7 +79,8 @@ static u8 crash_mode,                  /* Crash-centric mode?               */
     edges_only,                        /* Ignore hit counts?                */
     exact_mode,                        /* Require path match for crashes?   */
     remove_out_file,                   /* remove out_file on exit?          */
-    remove_shm = 1;                    /* remove shmem on exit?             */
+    remove_shm = 1,                    /* remove shmem on exit?             */
+    debug;                             /* debug mode                        */
 
 static volatile u8 stop_soon;          /* Ctrl-C pressed?                   */
 
@@ -878,6 +879,7 @@ int main(int argc, char **argv_orig, char **envp) {
   char **argv = argv_cpy_dup(argc, argv_orig);
 
   afl_forkserver_t fsrv_var = {0};
+  if (getenv("AFL_DEBUG")) { debug = 1; }
   fsrv = &fsrv_var;
   afl_fsrv_init(fsrv);
   map_size = get_map_size();
@@ -1074,6 +1076,7 @@ int main(int argc, char **argv_orig, char **envp) {
   if (optind == argc || !in_file || !output_file) { usage(argv[0]); }
 
   check_environment_vars(envp);
+  setenv("AFL_NO_AUTODICT", "1", 1);
 
   if (fsrv->qemu_mode && getenv("AFL_USE_QASAN")) {
 
@@ -1102,7 +1105,6 @@ int main(int argc, char **argv_orig, char **envp) {
 
   /* initialize cmplog_mode */
   shm.cmplog_mode = 0;
-  fsrv->trace_bits = afl_shm_init(&shm, map_size, 0);
 
   atexit(at_exit_handler);
   setup_signal_handlers();
@@ -1110,6 +1112,7 @@ int main(int argc, char **argv_orig, char **envp) {
   set_up_environment(fsrv);
 
   fsrv->target_path = find_binary(argv[optind]);
+  fsrv->trace_bits = afl_shm_init(&shm, map_size, 0);
   detect_file_args(argv + optind, out_file, &fsrv->use_stdin);
 
   if (fsrv->qemu_mode) {
@@ -1181,6 +1184,7 @@ int main(int argc, char **argv_orig, char **envp) {
   /* initialize cmplog_mode */
   shm_fuzz->cmplog_mode = 0;
   u8 *map = afl_shm_init(shm_fuzz, MAX_FILE + sizeof(u32), 1);
+  shm_fuzz->shmemfuzz_mode = 1;
   if (!map) { FATAL("BUG: Zero return from afl_shm_init."); }
 #ifdef USEMMAP
   setenv(SHM_FUZZ_ENV_VAR, shm_fuzz->g_shm_file_path, 1);
@@ -1195,12 +1199,39 @@ int main(int argc, char **argv_orig, char **envp) {
 
   read_initial_file();
 
-  afl_fsrv_start(
+  fsrv->map_size = 4194304;  // dummy temporary value
+  u32 new_map_size = afl_fsrv_get_mapsize(
       fsrv, use_argv, &stop_soon,
       (get_afl_env("AFL_DEBUG_CHILD") || get_afl_env("AFL_DEBUG_CHILD_OUTPUT"))
           ? 1
           : 0);
 
+  if (new_map_size) {
+
+    if (map_size < new_map_size ||
+        (new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
+
+      if (!be_quiet)
+        ACTF("Aquired new map size for target: %u bytes\n", new_map_size);
+
+      afl_shm_deinit(&shm);
+      afl_fsrv_kill(fsrv);
+      fsrv->map_size = new_map_size;
+      fsrv->trace_bits = afl_shm_init(&shm, new_map_size, 0);
+      afl_fsrv_start(fsrv, use_argv, &stop_soon,
+                     (get_afl_env("AFL_DEBUG_CHILD") ||
+                      get_afl_env("AFL_DEBUG_CHILD_OUTPUT"))
+                         ? 1
+                         : 0);
+
+    }
+
+    map_size = new_map_size;
+
+  }
+
+  fsrv->map_size = map_size;
+
   if (fsrv->support_shmem_fuzz && !fsrv->use_shmem_fuzz)
     shm_fuzz = deinit_shmem(fsrv, shm_fuzz);
 
diff --git a/test-instr.c b/test-instr.c
index 84ac0036..00799103 100644
--- a/test-instr.c
+++ b/test-instr.c
@@ -32,7 +32,8 @@ int main(int argc, char **argv) {
 
   } else {
 
-    if (argc >= 3 && strcmp(argv[1], "-f") == 0)
+    if (argc >= 3 && strcmp(argv[1], "-f") == 0) {
+
       if ((fd = open(argv[2], O_RDONLY)) < 0) {
 
         fprintf(stderr, "Error: unable to open %s\n", argv[2]);
@@ -40,6 +41,8 @@ int main(int argc, char **argv) {
 
       }
 
+    }
+
     if (read(fd, buf, sizeof(buf)) < 1) {
 
       printf("Hum?\n");
diff --git a/test/test-basic.sh b/test/test-basic.sh
index fcac8ca3..132610c0 100755
--- a/test/test-basic.sh
+++ b/test/test-basic.sh
@@ -11,8 +11,8 @@ test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc
   AFL_HARDEN=1 ../${AFL_GCC} -o test-compcov.harden test-compcov.c > /dev/null 2>&1
   test -e test-instr.plain && {
     $ECHO "$GREEN[+] ${AFL_GCC} compilation succeeded"
-    echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
-    ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
+    echo 0 | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
+    AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
     test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
       diff test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
         $ECHO "$RED[!] ${AFL_GCC} instrumentation should be different on different input but is not"
@@ -26,7 +26,7 @@ test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc
     }
     rm -f test-instr.plain.0 test-instr.plain.1
     SKIP=
-    TUPLES=`echo 1|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'`
+    TUPLES=`echo 1|AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'`
     test "$TUPLES" -gt 1 -a "$TUPLES" -lt 12 && {
       $ECHO "$GREEN[+] ${AFL_GCC} run reported $TUPLES instrumented locations which is fine"
     } || {
@@ -132,8 +132,8 @@ test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc
   AFL_HARDEN=1 ../${AFL_GCC} -o test-compcov.harden test-compcov.c > /dev/null 2>&1
   test -e test-instr.plain && {
     $ECHO "$GREEN[+] ${AFL_GCC} compilation succeeded"
-    echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
-    ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
+    echo 0 | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
+    AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
     test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
       diff test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
         $ECHO "$RED[!] ${AFL_GCC} instrumentation should be different on different input but is not"
@@ -146,7 +146,7 @@ test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc
       CODE=1
     }
     rm -f test-instr.plain.0 test-instr.plain.1
-    TUPLES=`echo 1|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'`
+    TUPLES=`echo 1|AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'`
     test "$TUPLES" -gt 1 -a "$TUPLES" -lt 12 && {
       $ECHO "$GREEN[+] ${AFL_GCC} run reported $TUPLES instrumented locations which is fine"
     } || {
diff --git a/test/test-gcc-plugin.sh b/test/test-gcc-plugin.sh
index cce6336b..4c36b6c9 100755
--- a/test/test-gcc-plugin.sh
+++ b/test/test-gcc-plugin.sh
@@ -10,15 +10,15 @@ test -e ../afl-gcc-fast -a -e ../afl-compiler-rt.o && {
   AFL_HARDEN=1 ../afl-gcc-fast -o test-compcov.harden.gccpi test-compcov.c > /dev/null 2>&1
   test -e test-instr.plain.gccpi && {
     $ECHO "$GREEN[+] gcc_plugin compilation succeeded"
-    echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain.gccpi > /dev/null 2>&1
-    ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain.gccpi < /dev/null > /dev/null 2>&1
+    echo 0 | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain.gccpi > /dev/null 2>&1
+    AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain.gccpi < /dev/null > /dev/null 2>&1
     test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
       diff test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
         $ECHO "$RED[!] gcc_plugin instrumentation should be different on different input but is not"
         CODE=1
       } || {
         $ECHO "$GREEN[+] gcc_plugin instrumentation present and working correctly"
-        TUPLES=`echo 0|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain.gccpi 2>&1 | grep Captur | awk '{print$3}'`
+        TUPLES=`echo 0|AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain.gccpi 2>&1 | grep Captur | awk '{print$3}'`
         test "$TUPLES" -gt 1 -a "$TUPLES" -lt 9 && {
           $ECHO "$GREEN[+] gcc_plugin run reported $TUPLES instrumented locations which is fine"
         } || {
@@ -87,7 +87,7 @@ test -e ../afl-gcc-fast -a -e ../afl-compiler-rt.o && {
   echo foobar.c > instrumentlist.txt
   AFL_GCC_INSTRUMENT_FILE=instrumentlist.txt ../afl-gcc-fast -o test-compcov test-compcov.c > /dev/null 2>&1
   test -x test-compcov && test_compcov_binary_functionality ./test-compcov && {
-    echo 1 | ../afl-showmap -m ${MEM_LIMIT} -o - -r -- ./test-compcov 2>&1 | grep -q "Captured 0 tuples" && {
+    echo 1 | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o - -r -- ./test-compcov 2>&1 | grep -q "Captured 0 tuples" && {
       $ECHO "$GREEN[+] gcc_plugin instrumentlist feature works correctly"
     } || {
       $ECHO "$RED[!] gcc_plugin instrumentlist feature failed"
@@ -100,7 +100,7 @@ test -e ../afl-gcc-fast -a -e ../afl-compiler-rt.o && {
   rm -f test-compcov test.out instrumentlist.txt
   ../afl-gcc-fast -o test-persistent ../utils/persistent_mode/persistent_demo.c > /dev/null 2>&1
   test -e test-persistent && {
-    echo foo | ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -q -r ./test-persistent && {
+    echo foo | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -q -r ./test-persistent && {
       $ECHO "$GREEN[+] gcc_plugin persistent mode feature works correctly"
     } || {
       $ECHO "$RED[!] gcc_plugin persistent mode feature failed to work"
diff --git a/test/test-llvm-lto.sh b/test/test-llvm-lto.sh
index a931afb7..3e762acf 100755
--- a/test/test-llvm-lto.sh
+++ b/test/test-llvm-lto.sh
@@ -16,15 +16,15 @@ test -e ../afl-clang-lto -a -e ../afl-llvm-lto-instrumentation.so && {
   ../afl-clang-lto -o test-instr.plain ../test-instr.c > /dev/null 2>&1
   test -e test-instr.plain && {
     $ECHO "$GREEN[+] llvm_mode LTO compilation succeeded"
-    echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
-    ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
+    echo 0 | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
+    AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
     test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
       diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
         $ECHO "$RED[!] llvm_mode LTO instrumentation should be different on different input but is not"
         CODE=1
       } || {
         $ECHO "$GREEN[+] llvm_mode LTO instrumentation present and working correctly"
-        TUPLES=`echo 0|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'`
+        TUPLES=`echo 0|AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'`
         test "$TUPLES" -gt 2 -a "$TUPLES" -lt 7 && {
           $ECHO "$GREEN[+] llvm_mode LTO run reported $TUPLES instrumented locations which is fine"
         } || {
@@ -59,7 +59,7 @@ test -e ../afl-clang-lto -a -e ../afl-llvm-lto-instrumentation.so && {
   rm -f test-compcov test.out instrumentlist.txt
   ../afl-clang-lto -o test-persistent ../utils/persistent_mode/persistent_demo.c > /dev/null 2>&1
   test -e test-persistent && {
-    echo foo | ../afl-showmap -m none -o /dev/null -q -r ./test-persistent && {
+    echo foo | AFL_QUIET=1 ../afl-showmap -m none -o /dev/null -q -r ./test-persistent && {
       $ECHO "$GREEN[+] llvm_mode LTO persistent mode feature works correctly"
     } || {
       $ECHO "$RED[!] llvm_mode LTO persistent mode feature failed to work"
diff --git a/test/test-llvm.sh b/test/test-llvm.sh
index c968d5a9..156b8920 100755
--- a/test/test-llvm.sh
+++ b/test/test-llvm.sh
@@ -16,15 +16,15 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && {
   AFL_HARDEN=1 ../afl-clang-fast -o test-compcov.harden test-compcov.c > /dev/null 2>&1
   test -e test-instr.plain && {
     $ECHO "$GREEN[+] llvm_mode compilation succeeded"
-    echo 0 | ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
-    ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
+    echo 0 | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1
+    AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1
     test -e test-instr.plain.0 -a -e test-instr.plain.1 && {
       diff test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && {
         $ECHO "$RED[!] llvm_mode instrumentation should be different on different input but is not"
         CODE=1
       } || {
         $ECHO "$GREEN[+] llvm_mode instrumentation present and working correctly"
-        TUPLES=`echo 0|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'`
+        TUPLES=`echo 0|AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.plain 2>&1 | grep Captur | awk '{print$3}'`
         test "$TUPLES" -gt 2 -a "$TUPLES" -lt 8 && {
           $ECHO "$GREEN[+] llvm_mode run reported $TUPLES instrumented locations which is fine"
         } || {
@@ -128,7 +128,7 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && {
   test -e ../libLLVMInsTrim.so && {
     AFL_LLVM_INSTRUMENT=CFG AFL_LLVM_INSTRIM_LOOPHEAD=1 ../afl-clang-fast -o test-instr.instrim ../test-instr.c > /dev/null 2>test.out
     test -e test-instr.instrim && {
-      TUPLES=`echo 0|../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.instrim 2>&1 | grep Captur | awk '{print$3}'`
+      TUPLES=`echo 0|AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -- ./test-instr.instrim 2>&1 | grep Captur | awk '{print$3}'`
       test "$TUPLES" -gt 1 -a "$TUPLES" -lt 5 && {
         $ECHO "$GREEN[+] llvm_mode InsTrim reported $TUPLES instrumented locations which is fine"
       } || {
@@ -216,7 +216,7 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && {
   rm -rf errors test-cmplog in core.*
   ../afl-clang-fast -o test-persistent ../utils/persistent_mode/persistent_demo.c > /dev/null 2>&1
   test -e test-persistent && {
-    echo foo | ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -q -r ./test-persistent && {
+    echo foo | AFL_QUIET=1 ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -q -r ./test-persistent && {
       $ECHO "$GREEN[+] llvm_mode persistent mode feature works correctly"
     } || {
       $ECHO "$RED[!] llvm_mode persistent mode feature failed to work"
-- 
cgit 1.4.1


From 0ad56167c53ae660d40ccc6cdedb39f0a52eefcd Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sun, 7 Feb 2021 07:51:29 +0100
Subject: fix scan-build issues

---
 instrumentation/LLVMInsTrim.so.cc                  |  2 +-
 instrumentation/SanitizerCoverageLTO.so.cc         |  2 +-
 instrumentation/afl-llvm-common.cc                 |  2 +-
 instrumentation/afl-llvm-dict2file.so.cc           |  1 -
 instrumentation/afl-llvm-lto-instrumentation.so.cc |  2 +-
 instrumentation/afl-llvm-pass.so.cc                |  1 +
 instrumentation/compare-transform-pass.so.cc       |  2 +-
 instrumentation/split-compares-pass.so.cc          | 37 +++++++++-------------
 src/afl-cc.c                                       |  7 ----
 src/afl-fuzz-init.c                                |  2 +-
 src/afl-fuzz-redqueen.c                            | 36 ++++++++++++++++++---
 11 files changed, 53 insertions(+), 41 deletions(-)

(limited to 'src/afl-fuzz-init.c')

diff --git a/instrumentation/LLVMInsTrim.so.cc b/instrumentation/LLVMInsTrim.so.cc
index 235ee30f..948f8f3a 100644
--- a/instrumentation/LLVMInsTrim.so.cc
+++ b/instrumentation/LLVMInsTrim.so.cc
@@ -459,7 +459,7 @@ struct InsTrim : public ModulePass {
             BasicBlock *PBB = *PI;
             auto        It = PredMap.insert({PBB, genLabel()});
             unsigned    Label = It.first->second;
-            cur_loc = Label;
+            // cur_loc = Label;
             PN->addIncoming(ConstantInt::get(Int32Ty, Label), PBB);
 
           }
diff --git a/instrumentation/SanitizerCoverageLTO.so.cc b/instrumentation/SanitizerCoverageLTO.so.cc
index e3490847..3026abc8 100644
--- a/instrumentation/SanitizerCoverageLTO.so.cc
+++ b/instrumentation/SanitizerCoverageLTO.so.cc
@@ -760,7 +760,7 @@ bool ModuleSanitizerCoverage::instrumentModule(
                   if (literalLength + 1 == optLength) {
 
                     Str2.append("\0", 1);  // add null byte
-                    addedNull = true;
+                    // addedNull = true;
 
                   }
 
diff --git a/instrumentation/afl-llvm-common.cc b/instrumentation/afl-llvm-common.cc
index a27c4069..aa54f4f7 100644
--- a/instrumentation/afl-llvm-common.cc
+++ b/instrumentation/afl-llvm-common.cc
@@ -351,7 +351,7 @@ static std::string getSourceName(llvm::Function *F) {
 
     if (cDILoc) { instFilename = cDILoc->getFilename(); }
 
-    if (instFilename.str().empty()) {
+    if (instFilename.str().empty() && cDILoc) {
 
       /* If the original location is empty, try using the inlined location
        */
diff --git a/instrumentation/afl-llvm-dict2file.so.cc b/instrumentation/afl-llvm-dict2file.so.cc
index a4b33732..6f34ac5a 100644
--- a/instrumentation/afl-llvm-dict2file.so.cc
+++ b/instrumentation/afl-llvm-dict2file.so.cc
@@ -430,7 +430,6 @@ bool AFLdict2filePass::runOnModule(Module &M) {
                 if (literalLength + 1 == optLength) {
 
                   Str2.append("\0", 1);  // add null byte
-                  addedNull = true;
 
                 }
 
diff --git a/instrumentation/afl-llvm-lto-instrumentation.so.cc b/instrumentation/afl-llvm-lto-instrumentation.so.cc
index 841d52e5..f5c24e41 100644
--- a/instrumentation/afl-llvm-lto-instrumentation.so.cc
+++ b/instrumentation/afl-llvm-lto-instrumentation.so.cc
@@ -546,7 +546,7 @@ bool AFLLTOPass::runOnModule(Module &M) {
                   if (literalLength + 1 == optLength) {
 
                     Str2.append("\0", 1);  // add null byte
-                    addedNull = true;
+                    // addedNull = true;
 
                   }
 
diff --git a/instrumentation/afl-llvm-pass.so.cc b/instrumentation/afl-llvm-pass.so.cc
index 57ff3b47..16fd9c94 100644
--- a/instrumentation/afl-llvm-pass.so.cc
+++ b/instrumentation/afl-llvm-pass.so.cc
@@ -538,6 +538,7 @@ bool AFLCoverage::runOnModule(Module &M) {
 
         Store = IRB.CreateStore(ConstantInt::get(Int32Ty, cur_loc >> 1),
                                 AFLPrevLoc);
+        Store->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
 
       }
 
diff --git a/instrumentation/compare-transform-pass.so.cc b/instrumentation/compare-transform-pass.so.cc
index da5cf7e9..8b00d8d1 100644
--- a/instrumentation/compare-transform-pass.so.cc
+++ b/instrumentation/compare-transform-pass.so.cc
@@ -391,7 +391,7 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
         if (val && !val->empty()) {
 
           Str2 = StringRef(*val);
-          HasStr2 = true;
+          // HasStr2 = true;
 
         }
 
diff --git a/instrumentation/split-compares-pass.so.cc b/instrumentation/split-compares-pass.so.cc
index b6d8c466..80cd90ba 100644
--- a/instrumentation/split-compares-pass.so.cc
+++ b/instrumentation/split-compares-pass.so.cc
@@ -407,6 +407,7 @@ bool SplitComparesTransform::simplifyIntSignedness(Module &M) {
     auto op1 = IcmpInst->getOperand(1);
 
     IntegerType *intTyOp0 = dyn_cast<IntegerType>(op0->getType());
+    if (!intTyOp0) { continue; }
     unsigned     bitw = intTyOp0->getBitWidth();
     IntegerType *IntType = IntegerType::get(C, bitw);
 
@@ -606,10 +607,11 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
                                    : sizeInBits == 64  ? 53
                                    : sizeInBits == 128 ? 113
                                    : sizeInBits == 16  ? 11
-                                                      /* sizeInBits == 80 */
-                                                      : 65;
+                                   : sizeInBits == 80  ? 65
+                                                       : sizeInBits - 8;
 
-    const unsigned           shiftR_exponent = precision - 1;
+    const unsigned shiftR_exponent = precision - 1;
+    // BUG FIXME TODO: u64 does not work for > 64 bit ... e.g. 80 and 128 bit
     const unsigned long long mask_fraction =
         (1ULL << (shiftR_exponent - 1)) | ((1ULL << (shiftR_exponent - 1)) - 1);
     const unsigned long long mask_exponent =
@@ -1300,12 +1302,9 @@ bool SplitComparesTransform::runOnModule(Module &M) {
 
     case 64:
       count += splitIntCompares(M, bitw);
-      /*
-            if (!be_quiet)
-              errs() << "Split-integer-compare-pass " << bitw << "bit: " <<
-         count
-                     << " split\n";
-      */
+      if (debug)
+        errs() << "Split-integer-compare-pass " << bitw << "bit: " << count
+               << " split\n";
       bitw >>= 1;
 #if LLVM_VERSION_MAJOR > 3 || \
     (LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR > 7)
@@ -1313,12 +1312,9 @@ bool SplitComparesTransform::runOnModule(Module &M) {
 #endif
     case 32:
       count += splitIntCompares(M, bitw);
-      /*
-            if (!be_quiet)
-              errs() << "Split-integer-compare-pass " << bitw << "bit: " <<
-         count
-                     << " split\n";
-      */
+      if (debug)
+        errs() << "Split-integer-compare-pass " << bitw << "bit: " << count
+               << " split\n";
       bitw >>= 1;
 #if LLVM_VERSION_MAJOR > 3 || \
     (LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR > 7)
@@ -1326,13 +1322,10 @@ bool SplitComparesTransform::runOnModule(Module &M) {
 #endif
     case 16:
       count += splitIntCompares(M, bitw);
-      /*
-            if (!be_quiet)
-              errs() << "Split-integer-compare-pass " << bitw << "bit: " <<
-         count
-                     << " split\n";
-      */
-      bitw >>= 1;
+      if (debug)
+        errs() << "Split-integer-compare-pass " << bitw << "bit: " << count
+               << " split\n";
+      // bitw >>= 1;
       break;
 
     default:
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 76f4a437..0ae401e7 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -315,16 +315,9 @@ static void edit_params(u32 argc, char **argv, char **envp) {
   u8 fortify_set = 0, asan_set = 0, x_set = 0, bit_mode = 0, shared_linking = 0,
      preprocessor_only = 0, have_unroll = 0, have_o = 0, have_pic = 0,
      have_c = 0;
-  u8 *name;
 
   cc_params = ck_alloc((argc + 128) * sizeof(u8 *));
 
-  name = strrchr(argv[0], '/');
-  if (!name)
-    name = argv[0];
-  else
-    ++name;
-
   if (lto_mode) {
 
     if (lto_flag[0] != '-')
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 40ba20c7..702e732d 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -1242,7 +1242,7 @@ static void link_or_copy(u8 *old_path, u8 *new_path) {
 
 void pivot_inputs(afl_state_t *afl) {
 
-  struct queue_entry *q = afl->queue;
+  struct queue_entry *q;
   u32                 id = 0, i;
 
   ACTF("Creating hard links for all input files...");
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index f619a6d3..002929c5 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -1415,7 +1415,7 @@ static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
 
     } else if (b[k] == 0xff) {
 
-      ++cons_0;
+      ++cons_ff;
 
     } else {
 
@@ -1473,7 +1473,7 @@ static void try_to_add_to_dictN(afl_state_t *afl, u128 v, u8 size) {
 
     } else if (b[k] == 0xff) {
 
-      ++cons_0;
+      ++cons_ff;
 
     } else {
 
@@ -2410,7 +2410,21 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
 
   // manually clear the full cmp_map
   memset(afl->shm.cmp_map, 0, sizeof(struct cmp_map));
-  if (unlikely(common_fuzz_cmplog_stuff(afl, orig_buf, len))) { return 1; }
+  if (unlikely(common_fuzz_cmplog_stuff(afl, orig_buf, len))) {
+
+    afl->queue_cur->colorized = CMPLOG_LVL_MAX;
+    while (taint) {
+
+      t = taint->next;
+      ck_free(taint);
+      taint = t;
+
+    }
+
+    return 1;
+
+  }
+
   if (unlikely(!afl->orig_cmp_map)) {
 
     afl->orig_cmp_map = ck_alloc_nozero(sizeof(struct cmp_map));
@@ -2419,7 +2433,20 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
 
   memcpy(afl->orig_cmp_map, afl->shm.cmp_map, sizeof(struct cmp_map));
   memset(afl->shm.cmp_map->headers, 0, sizeof(struct cmp_header) * CMP_MAP_W);
-  if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) { return 1; }
+  if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) {
+
+    afl->queue_cur->colorized = CMPLOG_LVL_MAX;
+    while (taint) {
+
+      t = taint->next;
+      ck_free(taint);
+      taint = t;
+
+    }
+
+    return 1;
+
+  }
 
 #ifdef _DEBUG
   dump("ORIG", orig_buf, len);
@@ -2530,7 +2557,6 @@ exit_its:
     afl->queue_cur->colorized = CMPLOG_LVL_MAX;
 
     ck_free(afl->queue_cur->cmplog_colorinput);
-    t = taint;
     while (taint) {
 
       t = taint->next;
-- 
cgit 1.4.1