From b60663c0318b8baf21b36b549d765ddd2eeeb54e Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 9 Aug 2020 18:48:12 +0200
Subject: taint integration done

---
 src/afl-fuzz-queue.c | 151 +++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 147 insertions(+), 4 deletions(-)

(limited to 'src/afl-fuzz-queue.c')

diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index f35df914..36ec0896 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -103,6 +103,139 @@ void mark_as_redundant(afl_state_t *afl, struct queue_entry *q, u8 state) {
 
 }
 
+void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
+                       u8 *mem, u32 len) {
+
+  u8 *                ptr, *fn = fname;
+  u32                 bytes = 0, plen = len;
+  s32                 fd = -1;
+  struct queue_entry *prev = q->prev;
+
+  if (plen % 4) plen = plen + 4 - (len % 4);
+
+  if ((ptr = strrchr(fname, '/')) != NULL) fn = ptr + 1;
+  q->fname_taint = alloc_printf("%s/taint/%s", afl->out_dir, fn);
+
+  if (q->fname_taint) {
+
+    afl->taint_fsrv.map_size = plen;  // speed :)
+    write_to_testcase(afl, mem, len);
+    if (afl_fsrv_run_target(&afl->taint_fsrv, afl->fsrv.exec_tmout,
+                            &afl->stop_soon) == 0) {
+
+      bytes = count_bytes_len(afl, afl->taint_fsrv.trace_bits, plen);
+      if (afl->debug)
+        fprintf(stderr, "Debug: tainted %u out of %u bytes\n", bytes, len);
+
+      if (bytes) {
+
+        s32 i = len;
+        while (i > 0 && !afl->taint_fsrv.trace_bits[i - 1])
+          i--;
+        q->taint_bytes_highest = i;
+
+      }
+
+    }
+
+    if (((bytes * 100) / len) < 90) {
+
+      // we only use the taint havoc mode if the entry has less than 90% of
+      // overall tainted bytes
+      q->taint_bytes_all = bytes;
+
+      // save the bytes away
+      int w = open(q->fname_taint, O_CREAT | O_WRONLY, 0644);
+      if (w >= 0) {
+
+        ck_write(w, afl->taint_fsrv.trace_bits, plen, q->fname_taint);
+        close(w);
+
+      } else {
+
+        FATAL("could not create %s", q->fname_taint);
+        bytes = 0;
+
+      }
+
+      if (bytes && prev && prev->taint_bytes_all) {
+
+        // check if there are new bytes in the taint vs the previous
+        int r = open(prev->fname_taint, O_RDONLY);
+
+        if (r >= 0) {
+
+          u8 *bufr = mmap(0, prev->len, PROT_READ, MAP_PRIVATE, r, 0);
+
+          if ((size_t)bufr != -1) {
+
+            u32 i;
+            u8 *tmp = ck_maybe_grow(BUF_PARAMS(in_scratch), plen);
+            memset(tmp, 0, plen);
+
+            for (i = 0; i < len; i++)
+              if (afl->taint_fsrv.trace_bits[i] && (i >= prev->len || !bufr[i]))
+                tmp[i] = 1;
+
+            q->taint_bytes_new = count_bytes_len(afl, tmp, plen);
+
+            if (q->taint_bytes_new) {
+
+              u8 *fnw = alloc_printf("%s.new", q->fname_taint);
+              int w = open(fnw, O_CREAT | O_WRONLY, 0644);
+              if (w >= 0) {
+
+                ck_write(w, tmp, plen, fnw);
+                close(w);
+
+              } else {
+
+                q->taint_bytes_new = 0;
+
+              }
+
+              ck_free(fnw);
+
+            }
+
+            munmap(bufr, prev->len);
+
+          }
+
+          close(r);
+
+        }
+
+      }
+
+    } else {
+
+      bytes = 0;
+
+    }
+
+  }
+
+  if (!bytes) {
+
+    q->taint_bytes_highest = q->taint_bytes_all = q->taint_bytes_new = 0;
+
+    if (q->fname_taint) {
+
+      ck_free(q->fname_taint);
+      q->fname_taint = NULL;
+
+    }
+
+  } else {
+
+    if (q->taint_bytes_all && !q->taint_bytes_new)
+      q->taint_bytes_new = q->taint_bytes_all;
+
+  }
+
+}
+
 /* check if ascii or UTF-8 */
 
 static u8 check_if_text(struct queue_entry *q) {
@@ -212,10 +345,12 @@ static u8 check_if_text(struct queue_entry *q) {
 
 /* Append new test case to the queue. */
 
-void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
+void add_to_queue(afl_state_t *afl, u8 *fname, u8 *mem, u32 len,
+                  struct queue_entry *prev_q, u8 passed_det) {
 
   struct queue_entry *q = ck_alloc(sizeof(struct queue_entry));
 
+  q->prev = prev_q;
   q->fname = fname;
   q->len = len;
   q->depth = afl->cur_depth + 1;
@@ -254,6 +389,17 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
 
   afl->last_path_time = get_cur_time();
 
+  /* trigger the tain gathering if this is not a dry run */
+  if (afl->fsrv.taint_mode && mem) {
+
+    perform_taint_run(afl, q, fname, mem, len);
+
+  }
+
+  /* only redqueen currently uses is_ascii */
+  if (afl->shm.cmplog_mode) q->is_ascii = check_if_text(q);
+
+  /* run custom mutators afl_custom_queue_new_entry() */
   if (afl->custom_mutators_count) {
 
     LIST_FOREACH(&afl->custom_mutator_list, struct custom_mutator, {
@@ -273,9 +419,6 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
 
   }
 
-  /* only redqueen currently uses is_ascii */
-  if (afl->shm.cmplog_mode) q->is_ascii = check_if_text(q);
-
 }
 
 /* Destroy the entire queue. */
-- 
cgit 1.4.1


From ff40359a608f3c14c1025908a2810ca71fd502af Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 9 Aug 2020 21:09:07 +0200
Subject: fixes

---
 src/afl-fuzz-init.c  |  8 +++++++-
 src/afl-fuzz-one.c   | 28 ++++++++++++++++------------
 src/afl-fuzz-queue.c | 10 +++++-----
 3 files changed, 28 insertions(+), 18 deletions(-)

(limited to 'src/afl-fuzz-queue.c')

diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 350a3b4c..432e0649 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -961,7 +961,8 @@ void perform_dry_run(afl_state_t *afl) {
     }
 
     /* perform taint gathering on the input seed */
-    perform_taint_run(afl, q, q->fname, use_mem, q->len);
+    if (afl->fsrv.taint_mode)
+      perform_taint_run(afl, q, q->fname, use_mem, q->len);
 
     q = q->next;
 
@@ -1505,6 +1506,11 @@ static void handle_existing_out_dir(afl_state_t *afl) {
 
     fn = alloc_printf("%s/taint", afl->out_dir);
     mkdir(fn, 0755);  // ignore errors
+
+    u8 *fn2 = alloc_printf("%s/taint/.input", afl->out_dir);
+    unlink(fn2);  // ignore errors
+    ck_free(fn2);
+
     if (delete_files(fn, CASE_PREFIX)) { goto dir_cleanup_failed; }
     ck_free(fn);
 
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index ec7c4772..e75c2cec 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -458,26 +458,31 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
   }
 
-  if (unlikely(afl->fsrv.taint_mode && (afl->queue_cycle % 3))) {
+  u32 tmp_val;
+
+  if (unlikely(afl->fsrv.taint_mode &&
+               (tmp_val = (afl->queue_cycle % 3)) != 1)) {
 
     if (unlikely(afl->queue_cur->cal_failed)) goto abandon_entry;
+    if (tmp_val == 1 && !afl->queue_cur->taint_bytes_all) goto abandon_entry;
+    if (tmp_val == 2 && !afl->queue_cur->taint_bytes_new) goto abandon_entry;
 
     u32 dst = 0, i;
+    temp_len = len = afl->queue_cur->len;
 
     fd = open(afl->queue_cur->fname, O_RDONLY);
     afl->taint_src = mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
     if (fd < 0 || (size_t)afl->taint_src == -1)
       FATAL("unable to open '%s'", afl->queue_cur->fname);
     close(fd);
+    afl->taint_needs_splode = 1;
 
-    switch (afl->queue_cycle % 3) {
+    switch (tmp_val) {
 
-      case 0:  // do nothing, but cannot happen -> else
+      case 1:  // do nothing, but cannot happen -> else
         break;
 
-      case 1:  // fuzz only tainted bytes
-        if (!afl->queue_cur->taint_bytes_all) goto abandon_entry;
-        afl->taint_needs_splode = 1;
+      case 2:  // fuzz only tainted bytes
 
         fd = open(afl->taint_input_file, O_RDONLY);
         len = afl->taint_len = afl->queue_cur->taint_bytes_all;
@@ -499,9 +504,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
         break;
 
-      case 2:  // fuzz only newly tainted bytes
-        if (!afl->queue_cur->taint_bytes_new) goto abandon_entry;
-        afl->taint_needs_splode = 1;
+      case 0:  // fuzz only newly tainted bytes
 
         fd = open(afl->taint_input_file, O_RDONLY);
         len = afl->taint_len = afl->queue_cur->taint_bytes_new;
@@ -515,7 +518,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
         fd = open(fn, O_RDWR);
         afl->taint_map = mmap(0, afl->queue_cur->len, PROT_READ | PROT_WRITE,
                               MAP_PRIVATE, fd, 0);
-        if (fd < 0 || (size_t)in_buf == -1) FATAL("unable to open '%s'", fn);
+        if (fd < 0 || (size_t)in_buf == -1)
+          FATAL("unable to open '%s' for %u bytes", fn, len);
         close(fd);
         ck_free(fn);
 
@@ -526,8 +530,6 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
     }
 
-    goto havoc_stage;  // we let the normal cycles do deterministic mode - if
-
   } else {
 
     /* Map the test case into memory. */
@@ -653,6 +655,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
      if it has gone through deterministic testing in earlier, resumed runs
      (passed_det). */
 
+  if (afl->taint_needs_splode) goto havoc_stage;
+
   if (likely(afl->queue_cur->passed_det) || likely(afl->skip_deterministic) ||
       likely(perf_score <
              (afl->queue_cur->depth * 30 <= afl->havoc_max_mult * 100
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 36ec0896..3ada9d98 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -118,6 +118,9 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
   if (q->fname_taint) {
 
+    u8 *save = ck_maybe_grow(BUF_PARAMS(out_scratch), afl->fsrv.map_size);
+    memcpy(save, afl->taint_fsrv.trace_bits, afl->fsrv.map_size);
+
     afl->taint_fsrv.map_size = plen;  // speed :)
     write_to_testcase(afl, mem, len);
     if (afl_fsrv_run_target(&afl->taint_fsrv, afl->fsrv.exec_tmout,
@@ -214,6 +217,8 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
     }
 
+    memcpy(afl->taint_fsrv.trace_bits, save, afl->fsrv.map_size);
+
   }
 
   if (!bytes) {
@@ -227,11 +232,6 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
     }
 
-  } else {
-
-    if (q->taint_bytes_all && !q->taint_bytes_new)
-      q->taint_bytes_new = q->taint_bytes_all;
-
   }
 
 }
-- 
cgit 1.4.1


From f181a8307b9544a24e2c737e748e9ff34e8620e1 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 12:48:15 +0200
Subject: put ! in .new map

---
 src/afl-fuzz-queue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/afl-fuzz-queue.c')

diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 3ada9d98..28af17f0 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -178,7 +178,7 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
             for (i = 0; i < len; i++)
               if (afl->taint_fsrv.trace_bits[i] && (i >= prev->len || !bufr[i]))
-                tmp[i] = 1;
+                tmp[i] = '!';
 
             q->taint_bytes_new = count_bytes_len(afl, tmp, plen);
 
-- 
cgit 1.4.1


From 3ec1b2374336d0b98aa4fc586cd5bc601b711821 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 11 Aug 2020 10:36:34 +0200
Subject: cleanup minor issues

---
 src/afl-fuzz-bitmap.c |  4 ++++
 src/afl-fuzz-one.c    | 22 ++++++++++++----------
 src/afl-fuzz-queue.c  |  3 +--
 src/afl-fuzz-run.c    |  2 +-
 src/afl-fuzz.c        |  2 +-
 5 files changed, 19 insertions(+), 14 deletions(-)

(limited to 'src/afl-fuzz-queue.c')

diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index d4ee36e1..9f58d604 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -183,6 +183,8 @@ u32 count_bits_len(afl_state_t *afl, u8 *mem, u32 len) {
   u32  i = (len >> 2);
   u32  ret = 0;
 
+  (void)(afl);
+
   if (len % 4) i++;
 
   while (i--) {
@@ -241,6 +243,8 @@ u32 count_bytes_len(afl_state_t *afl, u8 *mem, u32 len) {
   u32  i = (len >> 2);
   u32  ret = 0;
 
+  (void)(afl);
+
   while (i--) {
 
     u32 v = *(ptr++);
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 2f724569..4b2fd90a 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -472,12 +472,12 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
     ret_val = 1;
 
-    u32 dst = 0, i;
+    s32 dst = 0, i;
     temp_len = len = afl->queue_cur->len;
 
     fd = open(afl->queue_cur->fname, O_RDONLY);
     afl->taint_src = mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-    if (fd < 0 || (size_t)afl->taint_src == -1)
+    if (fd < 0 || (ssize_t)afl->taint_src == -1)
       FATAL("unable to open '%s'", afl->queue_cur->fname);
     close(fd);
     afl->taint_needs_splode = 1;
@@ -490,18 +490,18 @@ u8 fuzz_one_original(afl_state_t *afl) {
         temp_len = len = afl->taint_len = afl->queue_cur->taint_bytes_all;
         orig_in = in_buf =
             mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-        if (fd < 0 || (size_t)in_buf == -1)
+        if (fd < 0 || (ssize_t)in_buf == -1)
           FATAL("unable to open '%s'", afl->taint_input_file);
         close(fd);
 
         fd = open(afl->queue_cur->fname_taint, O_RDWR);
         afl->taint_map = mmap(0, afl->queue_cur->len, PROT_READ | PROT_WRITE,
                               MAP_PRIVATE, fd, 0);
-        if (fd < 0 || (size_t)in_buf == -1)
+        if (fd < 0 || (ssize_t)in_buf == -1)
           FATAL("unable to open '%s'", afl->queue_cur->fname_taint);
         close(fd);
 
-        for (i = 0; i < afl->queue_cur->len && dst < len; i++)
+        for (i = 0; i < (s32)afl->queue_cur->len && dst < len; i++)
           if (afl->taint_map[i]) in_buf[dst++] = afl->taint_src[i];
 
         break;
@@ -512,7 +512,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
         temp_len = len = afl->taint_len = afl->queue_cur->taint_bytes_new;
         orig_in = in_buf =
             mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-        if (fd < 0 || (size_t)in_buf == -1)
+        if (fd < 0 || (ssize_t)in_buf == -1)
           FATAL("unable to open '%s'", afl->taint_input_file);
         close(fd);
 
@@ -520,12 +520,12 @@ u8 fuzz_one_original(afl_state_t *afl) {
         fd = open(fn, O_RDWR);
         afl->taint_map = mmap(0, afl->queue_cur->len, PROT_READ | PROT_WRITE,
                               MAP_PRIVATE, fd, 0);
-        if (fd < 0 || (size_t)in_buf == -1)
+        if (fd < 0 || (ssize_t)in_buf == -1)
           FATAL("unable to open '%s' for %u bytes", fn, len);
         close(fd);
         ck_free(fn);
 
-        for (i = 0; i < afl->queue_cur->len && dst < len; i++)
+        for (i = 0; i < (s32)afl->queue_cur->len && dst < len; i++)
           if (afl->taint_map[i]) in_buf[dst++] = afl->taint_src[i];
 
         break;
@@ -2297,7 +2297,8 @@ havoc_stage:
           }
 
           copy_to = rand_below(afl, temp_len - copy_len + 1);
-          if (unlikely(copy_to > temp_len)) copy_to = rand_below(afl, temp_len);
+          if (unlikely(copy_to > (u32)temp_len))
+            copy_to = rand_below(afl, temp_len);
 
           if (rand_below(afl, 4)) {
 
@@ -2305,7 +2306,8 @@ havoc_stage:
 
               if (unlikely(afl->taint_needs_splode)) {
 
-                if (copy_to > temp_len) copy_to = rand_below(afl, temp_len);
+                if (copy_to > (u32)temp_len)
+                  copy_to = rand_below(afl, temp_len);
 
                 // fprintf(stderr, "\nout_buf %p + copy_to %u, src %p + %u,
                 // copy_len %u -- len %u\n", out_buf , copy_to, afl->taint_src ,
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 28af17f0..f4b58a9d 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -108,7 +108,6 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
   u8 *                ptr, *fn = fname;
   u32                 bytes = 0, plen = len;
-  s32                 fd = -1;
   struct queue_entry *prev = q->prev;
 
   if (plen % 4) plen = plen + 4 - (len % 4);
@@ -170,7 +169,7 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
           u8 *bufr = mmap(0, prev->len, PROT_READ, MAP_PRIVATE, r, 0);
 
-          if ((size_t)bufr != -1) {
+          if ((ssize_t)bufr != -1) {
 
             u32 i;
             u8 *tmp = ck_maybe_grow(BUF_PARAMS(in_scratch), plen);
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 9db23134..058f8c2d 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -883,7 +883,7 @@ u8 common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
     u8 *new_buf = ck_maybe_grow(BUF_PARAMS(in_scratch), new_len);
 
     u32 i, taint = 0;
-    for (i = 0; i < new_len; i++) {
+    for (i = 0; i < (u32)new_len; i++) {
 
       if (i >= afl->taint_len || i >= afl->queue_cur->len || afl->taint_map[i])
         new_buf[i] = out_buf[taint++];
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index d2b2c2d9..e6238366 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1095,7 +1095,7 @@ int main(int argc, char **argv_orig, char **envp) {
   if (map_size != real_map_size) {
 
     afl->fsrv.map_size = real_map_size;
-    if (afl->cmplog_binary) afl->cmplog_fsrv.map_size;
+    if (afl->cmplog_binary) afl->cmplog_fsrv.map_size = real_map_size;
 
   }
 
-- 
cgit 1.4.1


From 4f695b6f4c3ced165703363904e42492fca82112 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 11 Aug 2020 11:16:48 +0200
Subject: fixes

---
 include/afl-fuzz.h    |  2 +-
 src/afl-common.c      |  4 +--
 src/afl-fuzz-bitmap.c |  2 ++
 src/afl-fuzz-queue.c  | 78 +++++++++++++++++++++++++++++++++++----------------
 src/afl-fuzz-stats.c  |  5 ++--
 5 files changed, 62 insertions(+), 29 deletions(-)

(limited to 'src/afl-fuzz-queue.c')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 02c36861..c578c583 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -506,7 +506,7 @@ typedef struct afl_state {
       var_byte_count,                   /* Bitmap bytes with var behavior   */
       current_entry,                    /* Current queue entry ID           */
       havoc_div,                        /* Cycle count divisor for havoc    */
-      taint_len;
+      taint_len, taint_count;
 
   u64 total_crashes,                    /* Total number of crashes          */
       unique_crashes,                   /* Crashes with unique signatures   */
diff --git a/src/afl-common.c b/src/afl-common.c
index c1302080..cefed8dc 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -471,8 +471,8 @@ void read_bitmap(u8 *fname, u8 *map, size_t len) {
 
 u64 get_cur_time(void) {
 
-  static struct timeval  tv;
-  static struct timezone tz;
+  struct timeval  tv;
+  struct timezone tz;
 
   gettimeofday(&tv, &tz);
 
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 9f58d604..d273818d 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -245,6 +245,8 @@ u32 count_bytes_len(afl_state_t *afl, u8 *mem, u32 len) {
 
   (void)(afl);
 
+  if (len % 4) i++;
+
   while (i--) {
 
     u32 v = *(ptr++);
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index f4b58a9d..b56e10f8 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -125,42 +125,64 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
     if (afl_fsrv_run_target(&afl->taint_fsrv, afl->fsrv.exec_tmout,
                             &afl->stop_soon) == 0) {
 
-      bytes = count_bytes_len(afl, afl->taint_fsrv.trace_bits, plen);
+      bytes = q->taint_bytes_all =
+          count_bytes_len(afl, afl->taint_fsrv.trace_bits, plen);
       if (afl->debug)
         fprintf(stderr, "Debug: tainted %u out of %u bytes\n", bytes, len);
 
-      if (bytes) {
+      /* DEBUG FIXME TODO XXX */
+      u32 i;
+      for (i = 0; i < len; i++) {
 
-        s32 i = len;
-        while (i > 0 && !afl->taint_fsrv.trace_bits[i - 1])
-          i--;
-        q->taint_bytes_highest = i;
+        if (afl->taint_fsrv.trace_bits[i] &&
+            afl->taint_fsrv.trace_bits[i] != '!')
+          FATAL("invalid taint map value %02x at pos %d",
+                afl->taint_fsrv.trace_bits[i], i);
 
       }
 
-    }
+      if (len < plen)
+        for (i = len; i < plen; i++) {
 
-    if (((bytes * 100) / len) < 90) {
+          if (afl->taint_fsrv.trace_bits[i])
+            FATAL("invalid taint map value %02x in padding at pos %d",
+                  afl->taint_fsrv.trace_bits[i], i);
 
-      // we only use the taint havoc mode if the entry has less than 90% of
-      // overall tainted bytes
-      q->taint_bytes_all = bytes;
+        }
+
+    }
+
+    // if all is tainted we do not need to write taint data away
+    if (bytes && bytes < len) {
 
       // save the bytes away
       int w = open(q->fname_taint, O_CREAT | O_WRONLY, 0644);
       if (w >= 0) {
 
-        ck_write(w, afl->taint_fsrv.trace_bits, plen, q->fname_taint);
+        ck_write(w, afl->taint_fsrv.trace_bits, len, q->fname_taint);
         close(w);
 
+        // find the highest tainted offset in the input (for trim opt)
+        s32 i = len;
+        while (i > 0 && !afl->taint_fsrv.trace_bits[i - 1])
+          i--;
+        q->taint_bytes_highest = i;
+
+        afl->taint_count++;
+
       } else {
 
         FATAL("could not create %s", q->fname_taint);
-        bytes = 0;
+        q->taint_bytes_all = bytes = 0;
 
       }
 
-      if (bytes && prev && prev->taint_bytes_all) {
+      // it is possible that there is no main taint file - if the whole file
+      // is tainted - but a .new taint file if it had new tainted bytes
+
+      // check if there is a previous queue entry and if it had taint
+      if (bytes && prev && prev->taint_bytes_all &&
+          prev->taint_bytes_all < prev->len) {
 
         // check if there are new bytes in the taint vs the previous
         int r = open(prev->fname_taint, O_RDONLY);
@@ -181,14 +203,28 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
             q->taint_bytes_new = count_bytes_len(afl, tmp, plen);
 
+            if (afl->debug)
+              fprintf(stderr, "Debug: %u new taint out of %u bytes\n", bytes,
+                      len);
+
             if (q->taint_bytes_new) {
 
               u8 *fnw = alloc_printf("%s.new", q->fname_taint);
-              int w = open(fnw, O_CREAT | O_WRONLY, 0644);
-              if (w >= 0) {
+              if (fnw) {
+
+                int w = open(fnw, O_CREAT | O_WRONLY, 0644);
+                if (w >= 0) {
+
+                  ck_write(w, tmp, plen, fnw);
+                  close(w);
 
-                ck_write(w, tmp, plen, fnw);
-                close(w);
+                } else {
+
+                  q->taint_bytes_new = 0;
+
+                }
+
+                ck_free(fnw);
 
               } else {
 
@@ -196,8 +232,6 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
               }
 
-              ck_free(fnw);
-
             }
 
             munmap(bufr, prev->len);
@@ -210,10 +244,6 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
       }
 
-    } else {
-
-      bytes = 0;
-
     }
 
     memcpy(afl->taint_fsrv.trace_bits, save, afl->fsrv.map_size);
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index aeb290bd..0cc06e12 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -116,6 +116,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
           "edges_found       : %u\n"
           "var_byte_count    : %u\n"
           "havoc_expansion   : %u\n"
+          "tainted_inputs    : %u\n"
           "afl_banner        : %s\n"
           "afl_version       : " VERSION
           "\n"
@@ -149,8 +150,8 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
 #else
           -1,
 #endif
-          t_bytes, afl->var_byte_count, afl->expand_havoc, afl->use_banner,
-          afl->unicorn_mode ? "unicorn" : "",
+          t_bytes, afl->var_byte_count, afl->expand_havoc, afl->taint_count,
+          afl->use_banner, afl->unicorn_mode ? "unicorn" : "",
           afl->fsrv.qemu_mode ? "qemu " : "",
           afl->non_instrumented_mode ? " non_instrumented " : "",
           afl->no_forkserver ? "no_fsrv " : "", afl->crash_mode ? "crash " : "",
-- 
cgit 1.4.1


From 457f627101c08b885e9edfd8b491b5be198b6f14 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 11 Aug 2020 15:10:18 +0200
Subject: move taint_mode var

---
 src/afl-forkserver.c |  2 +-
 src/afl-fuzz-init.c  |  6 +++---
 src/afl-fuzz-one.c   |  2 +-
 src/afl-fuzz-queue.c |  3 ++-
 src/afl-fuzz-run.c   |  2 +-
 src/afl-fuzz.c       | 30 ++++++++++++++++--------------
 6 files changed, 24 insertions(+), 21 deletions(-)

(limited to 'src/afl-fuzz-queue.c')

diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index adb75a2d..56475320 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -497,7 +497,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
   char pid_buf[16];
   sprintf(pid_buf, "%d", fsrv->fsrv_pid);
 
-  if (fsrv->qemu_mode == 2) {
+  if (fsrv->taint_mode) {
 
     setenv("__AFL_TARGET_PID3", pid_buf, 1);
 
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 432e0649..669bd65a 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -961,7 +961,7 @@ void perform_dry_run(afl_state_t *afl) {
     }
 
     /* perform taint gathering on the input seed */
-    if (afl->fsrv.taint_mode)
+    if (afl->taint_mode)
       perform_taint_run(afl, q, q->fname, use_mem, q->len);
 
     q = q->next;
@@ -1502,7 +1502,7 @@ static void handle_existing_out_dir(afl_state_t *afl) {
   if (delete_files(fn, CASE_PREFIX)) { goto dir_cleanup_failed; }
   ck_free(fn);
 
-  if (afl->fsrv.taint_mode) {
+  if (afl->taint_mode) {
 
     fn = alloc_printf("%s/taint", afl->out_dir);
     mkdir(fn, 0755);  // ignore errors
@@ -1745,7 +1745,7 @@ void setup_dirs_fds(afl_state_t *afl) {
 
   /* Taint directory if taint_mode. */
 
-  if (afl->fsrv.taint_mode) {
+  if (afl->taint_mode) {
 
     tmp = alloc_printf("%s/taint", afl->out_dir);
     if (mkdir(tmp, 0700)) { PFATAL("Unable to create '%s'", tmp); }
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 4b2fd90a..69f885ca 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -460,7 +460,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
   u32 tmp_val = 0;
 
-  if (unlikely(afl->fsrv.taint_mode)) {
+  if (unlikely(afl->taint_mode)) {
 
     tmp_val = afl->queue_cycle % 2;
     ret_val = 0;
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index b56e10f8..bb44e465 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -220,6 +220,7 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
                 } else {
 
+                  FATAL("count not create '%s'", fnw);
                   q->taint_bytes_new = 0;
 
                 }
@@ -419,7 +420,7 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u8 *mem, u32 len,
   afl->last_path_time = get_cur_time();
 
   /* trigger the tain gathering if this is not a dry run */
-  if (afl->fsrv.taint_mode && mem) {
+  if (afl->taint_mode && mem) {
 
     perform_taint_run(afl, q, fname, mem, len);
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 058f8c2d..5f928333 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -349,7 +349,7 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
 
   }
 
-  if (unlikely(afl->fsrv.taint_mode))
+  if (unlikely(afl->taint_mode))
     q->exec_cksum = 0;
   else if (q->exec_cksum) {
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index e6238366..bead2ed9 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -288,7 +288,7 @@ int main(int argc, char **argv_orig, char **envp) {
     switch (opt) {
 
       case 'A':
-        afl->fsrv.taint_mode = 1;
+        afl->taint_mode = 1;
         if (!mem_limit_given) { afl->fsrv.mem_limit = MEM_LIMIT_QEMU; }
         break;
 
@@ -829,10 +829,10 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-  if (afl->fsrv.taint_mode && afl->fsrv.map_size < MAX_FILE) {
+  if (afl->taint_mode && afl->fsrv.map_size < MAX_FILE) {
 
     real_map_size = map_size;
-    map_size = afl->fsrv.map_size = afl->shm.map_size = MAX_FILE;
+    map_size = MAX_FILE;
 
   }
 
@@ -891,9 +891,12 @@ int main(int argc, char **argv_orig, char **envp) {
     if (afl->crash_mode) { FATAL("-C and -n are mutually exclusive"); }
     if (afl->fsrv.qemu_mode) { FATAL("-Q and -n are mutually exclusive"); }
     if (afl->unicorn_mode) { FATAL("-U and -n are mutually exclusive"); }
-    if (afl->fsrv.taint_mode) { FATAL("-A and -n are mutually exclusive"); }
+    if (afl->taint_mode) { FATAL("-A and -n are mutually exclusive"); }
 
   }
+  
+  if (afl->limit_time_sig != 0 && afl->taint_mode) { FATAL("-A and -L are mutually exclusive"); }
+  if (afl->unicorn_mode != 0 && afl->taint_mode) { FATAL("-A and -U are mutually exclusive"); }
 
   if (get_afl_env("AFL_DISABLE_TRIM")) { afl->disable_trim = 1; }
 
@@ -992,7 +995,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   if (afl->afl_env.afl_preload) {
 
-    if (afl->fsrv.qemu_mode || afl->fsrv.taint_mode) {
+    if (afl->fsrv.qemu_mode || afl->taint_mode) {
 
       u8 *qemu_preload = getenv("QEMU_SET_ENV");
       u8 *afl_preload = getenv("AFL_PRELOAD");
@@ -1088,17 +1091,17 @@ int main(int argc, char **argv_orig, char **envp) {
   afl->fsrv.trace_bits =
       afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
 
-  if (!afl->in_bitmap) { memset(afl->virgin_bits, 255, afl->fsrv.map_size); }
-  memset(afl->virgin_tmout, 255, afl->fsrv.map_size);
-  memset(afl->virgin_crash, 255, afl->fsrv.map_size);
-
-  if (map_size != real_map_size) {
+  if (real_map_size && map_size != real_map_size) {
 
     afl->fsrv.map_size = real_map_size;
     if (afl->cmplog_binary) afl->cmplog_fsrv.map_size = real_map_size;
 
   }
 
+  if (!afl->in_bitmap) { memset(afl->virgin_bits, 255, afl->fsrv.map_size); }
+  memset(afl->virgin_tmout, 255, afl->fsrv.map_size);
+  memset(afl->virgin_crash, 255, afl->fsrv.map_size);
+
   init_count_class16();
 
   if (afl->is_main_node && check_main_node_exists(afl) == 1) {
@@ -1260,7 +1263,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-  if (afl->fsrv.taint_mode) {
+  if (afl->taint_mode) {
 
     ACTF("Spawning qemu_taint forkserver");
 
@@ -1268,7 +1271,6 @@ int main(int argc, char **argv_orig, char **envp) {
     setenv("AFL_DISABLE_LLVM_INSTRUMENTATION", "1", 0);
 
     afl_fsrv_init_dup(&afl->taint_fsrv, &afl->fsrv);
-    afl->taint_fsrv.qemu_mode = 2;
     afl->taint_fsrv.taint_mode = 1;
     afl->taint_fsrv.trace_bits = afl->fsrv.trace_bits;
 
@@ -1399,7 +1401,7 @@ int main(int argc, char **argv_orig, char **envp) {
               break;
             case 1:
               if (afl->limit_time_sig == 0 && !afl->custom_only &&
-                  !afl->python_only && !afl->fsrv.taint_mode) {
+                  !afl->python_only && !afl->taint_mode) {
 
                 afl->limit_time_sig = -1;
                 afl->limit_time_puppet = 0;
@@ -1588,7 +1590,7 @@ stop_fuzzing:
   }
 
   if (afl->cmplog_binary) afl_fsrv_deinit(&afl->cmplog_fsrv);
-  if (afl->fsrv.taint_mode) afl_fsrv_deinit(&afl->taint_fsrv);
+  if (afl->taint_mode) afl_fsrv_deinit(&afl->taint_fsrv);
   afl_fsrv_deinit(&afl->fsrv);
   if (afl->orig_cmdline) { ck_free(afl->orig_cmdline); }
   if (afl->argv_taint) { ck_free(afl->argv_taint); }
-- 
cgit 1.4.1


From 220dc4a43d197f5ff451627a9923b874805c02aa Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 11 Aug 2020 16:25:35 +0200
Subject: review done, pray

---
 include/afl-fuzz.h   |   3 +-
 src/afl-fuzz-init.c  |   3 +-
 src/afl-fuzz-one.c   | 152 ++++++++++++++++++++++++++++++++++++++++-----------
 src/afl-fuzz-queue.c |   6 +-
 src/afl-fuzz-run.c   |  10 +++-
 src/afl-fuzz.c       |  17 ++++--
 6 files changed, 144 insertions(+), 47 deletions(-)

(limited to 'src/afl-fuzz-queue.c')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index c578c583..e251183c 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -444,7 +444,8 @@ typedef struct afl_state {
       python_only,                      /* Python-only mode                 */
       is_main_node,                     /* if this is the main node         */
       is_secondary_node,                /* if this is a secondary instance  */
-      taint_needs_splode;               /* explode fuzz input               */
+      taint_needs_splode,               /* explode fuzz input               */
+      taint_mode;
 
   u32 stats_update_freq;                /* Stats update frequency (execs)   */
 
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 669bd65a..0150e18a 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -961,8 +961,7 @@ void perform_dry_run(afl_state_t *afl) {
     }
 
     /* perform taint gathering on the input seed */
-    if (afl->taint_mode)
-      perform_taint_run(afl, q, q->fname, use_mem, q->len);
+    if (afl->taint_mode) perform_taint_run(afl, q, q->fname, use_mem, q->len);
 
     q = q->next;
 
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 69f885ca..7718256f 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -462,18 +462,23 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
   if (unlikely(afl->taint_mode)) {
 
-    tmp_val = afl->queue_cycle % 2;
+    tmp_val = afl->queue_cycle % 2;  // starts with 1
     ret_val = 0;
 
-    if (unlikely(afl->queue_cur->cal_failed)) goto abandon_entry;
-    if (unlikely(!afl->queue_cur->passed_det) && !tmp_val) goto abandon_entry;
-    if (tmp_val == 1 && !afl->queue_cur->taint_bytes_all) goto abandon_entry;
-    if (tmp_val == 0 && !afl->queue_cur->taint_bytes_new) goto abandon_entry;
+    if (unlikely(afl->queue_cur->cal_failed && !tmp_val)) goto abandon_entry;
+    if (unlikely(!afl->skip_deterministic && !afl->queue_cur->passed_det &&
+                 !tmp_val))
+      goto abandon_entry;
+    if ((!afl->queue_cur->taint_bytes_new ||
+         afl->queue_cur->taint_bytes_new == afl->queue_cur->len) &&
+        !tmp_val)
+      goto abandon_entry;
 
     ret_val = 1;
 
     s32 dst = 0, i;
     temp_len = len = afl->queue_cur->len;
+    s32 j = 0;  // tmp
 
     fd = open(afl->queue_cur->fname, O_RDONLY);
     afl->taint_src = mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
@@ -486,15 +491,27 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
       case 1:  // fuzz only tainted bytes
 
+        // special case: all or nothing tainted. in this case we act like
+        // nothing is special. this is not the taint you are looking for ...
+        if (!afl->queue_cur->taint_bytes_all ||
+            afl->queue_cur->taint_bytes_all == (u32)len) {
+
+          orig_in = in_buf = afl->taint_src;
+          afl->taint_needs_splode = 0;
+          break;
+
+        }
+
         fd = open(afl->taint_input_file, O_RDONLY);
         temp_len = len = afl->taint_len = afl->queue_cur->taint_bytes_all;
         orig_in = in_buf =
-            mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+            mmap(0, len >= MAX_FILE - 65536 ? MAX_FILE : len + 65536,
+                 PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
         if (fd < 0 || (ssize_t)in_buf == -1)
           FATAL("unable to open '%s'", afl->taint_input_file);
         close(fd);
 
-        fd = open(afl->queue_cur->fname_taint, O_RDWR);
+        fd = open(afl->queue_cur->fname_taint, O_RDONLY);
         afl->taint_map = mmap(0, afl->queue_cur->len, PROT_READ | PROT_WRITE,
                               MAP_PRIVATE, fd, 0);
         if (fd < 0 || (ssize_t)in_buf == -1)
@@ -504,6 +521,29 @@ u8 fuzz_one_original(afl_state_t *afl) {
         for (i = 0; i < (s32)afl->queue_cur->len && dst < len; i++)
           if (afl->taint_map[i]) in_buf[dst++] = afl->taint_src[i];
 
+        // FIXME DEBUG TODO XXX
+        for (i = 0; i < (s32)afl->queue_cur->len; i++) {
+
+          switch (afl->taint_map[i]) {
+
+            case 0x0:
+              break;
+            case '!':
+              j++;
+              break;
+            default:
+              FATAL(
+                  "invalid taint map entry byte 0x%02x at position %d "
+                  "(passed_det:%d)\n",
+                  afl->taint_map[i], i, afl->queue_cur->passed_det);
+
+          }
+
+        }
+
+        if (j != len)
+          FATAL("different taint values in map vs in queue (%d != %d)", j, len);
+
         break;
 
       case 0:  // fuzz only newly tainted bytes
@@ -511,12 +551,14 @@ u8 fuzz_one_original(afl_state_t *afl) {
         fd = open(afl->taint_input_file, O_RDONLY);
         temp_len = len = afl->taint_len = afl->queue_cur->taint_bytes_new;
         orig_in = in_buf =
-            mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+            mmap(0, len >= MAX_FILE - 65536 ? MAX_FILE : len + 65536,
+                 PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
         if (fd < 0 || (ssize_t)in_buf == -1)
           FATAL("unable to open '%s'", afl->taint_input_file);
         close(fd);
 
         u8 *fn = alloc_printf("%s.new", afl->queue_cur->fname_taint);
+        if (!fn) FATAL("OOM");
         fd = open(fn, O_RDWR);
         afl->taint_map = mmap(0, afl->queue_cur->len, PROT_READ | PROT_WRITE,
                               MAP_PRIVATE, fd, 0);
@@ -528,14 +570,35 @@ u8 fuzz_one_original(afl_state_t *afl) {
         for (i = 0; i < (s32)afl->queue_cur->len && dst < len; i++)
           if (afl->taint_map[i]) in_buf[dst++] = afl->taint_src[i];
 
+        // FIXME DEBUG TODO XXX
+        for (i = 0; i < (s32)afl->queue_cur->len; i++) {
+
+          switch (afl->taint_map[i]) {
+
+            case 0x0:
+              break;
+            case '!':
+              j++;
+              break;
+            default:
+              FATAL(
+                  "invalid taint map entry byte 0x%02x at position %d "
+                  "(passed_det:%d)\n",
+                  afl->taint_map[i], i, afl->queue_cur->passed_det);
+
+          }
+
+        }
+
+        if (j != len)
+          FATAL("different taint values in map vs in queue (%d != %d)", j, len);
+
         break;
 
     }
 
   } else {
 
-    afl->taint_needs_splode = 0;
-
     /* Map the test case into memory. */
 
     fd = open(afl->queue_cur->fname, O_RDONLY);
@@ -574,8 +637,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
    * CALIBRATION (only if failed earlier on) *
    *******************************************/
 
-  if (unlikely(afl->queue_cur->cal_failed &&
-               (!afl->taint_needs_splode || tmp_val == 1))) {
+  if (unlikely(afl->queue_cur->cal_failed)) {
 
     u8 res = FSRV_RUN_TMOUT;
 
@@ -583,8 +645,12 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
       afl->queue_cur->exec_cksum = 0;
 
-      res =
-          calibrate_case(afl, afl->queue_cur, in_buf, afl->queue_cycle - 1, 0);
+      if (unlikely(afl->taint_needs_splode))
+        res = calibrate_case(afl, afl->queue_cur, afl->taint_src,
+                             afl->queue_cycle - 1, 0);
+      else
+        res = calibrate_case(afl, afl->queue_cur, in_buf, afl->queue_cycle - 1,
+                             0);
 
       if (unlikely(res == FSRV_RUN_ERROR)) {
 
@@ -607,8 +673,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
    * TRIMMING *
    ************/
 
-  if (!afl->non_instrumented_mode && !afl->queue_cur->trim_done &&
-      !afl->disable_trim && !afl->taint_needs_splode) {
+  if (unlikely(!afl->non_instrumented_mode && !afl->queue_cur->trim_done &&
+               !afl->disable_trim && !afl->taint_needs_splode)) {
 
     u8 res = trim_case(afl, afl->queue_cur, in_buf);
 
@@ -645,13 +711,26 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
   if (afl->shm.cmplog_mode && !afl->queue_cur->fully_colorized) {
 
-    if (input_to_state_stage(afl, in_buf, out_buf, len,
-                             afl->queue_cur->exec_cksum)) {
+    int res;
+    if (unlikely(afl->taint_needs_splode)) {
 
-      goto abandon_entry;
+      len = afl->queue_cur->len;
+      memcpy(out_buf, afl->taint_src, len);
+      res = input_to_state_stage(afl, afl->taint_src, out_buf, len,
+                                 afl->queue_cur->exec_cksum);
+      // just abandon as success
+      ret_val = 0;
+      res = 1;
+
+    } else {
+
+      res = input_to_state_stage(afl, in_buf, out_buf, len,
+                                 afl->queue_cur->exec_cksum);
 
     }
 
+    if (unlikely(res)) { goto abandon_entry; }
+
   }
 
   /* Skip right away if -d is given, if it has not been chosen sufficiently
@@ -2288,37 +2367,46 @@ havoc_stage:
 
             copy_len = choose_block_len(afl, afl->queue_cur->len - 1);
             copy_from = rand_below(afl, afl->queue_cur->len - copy_len + 1);
+            copy_to = rand_below(afl, temp_len + 1);
 
           } else {
 
             copy_len = choose_block_len(afl, temp_len - 1);
             copy_from = rand_below(afl, temp_len - copy_len + 1);
+            copy_to = rand_below(afl, temp_len - copy_len + 1);
 
           }
 
-          copy_to = rand_below(afl, temp_len - copy_len + 1);
-          if (unlikely(copy_to > (u32)temp_len))
-            copy_to = rand_below(afl, temp_len);
-
           if (rand_below(afl, 4)) {
 
             if (copy_from != copy_to) {
 
               if (unlikely(afl->taint_needs_splode)) {
 
-                if (copy_to > (u32)temp_len)
-                  copy_to = rand_below(afl, temp_len);
+                if (temp_len >= (s32)(copy_to + copy_len)) {
 
-                // fprintf(stderr, "\nout_buf %p + copy_to %u, src %p + %u,
-                // copy_len %u -- len %u\n", out_buf , copy_to, afl->taint_src ,
-                // copy_from, copy_len, afl->taint_len, afl->queue_cur->len);
-                memmove(out_buf + copy_to, afl->taint_src + copy_from,
-                        copy_len);
+                  memcpy(out_buf + copy_to, afl->taint_src + copy_from,
+                         copy_len);
 
-              } else
+                } else {
+
+                  u8 *new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch),
+                                              copy_to + copy_len);
+                  memcpy(new_buf, in_buf, copy_to);
+                  memcpy(new_buf + copy_to, afl->taint_src + copy_from,
+                         copy_len);
+                  swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch));
+                  out_buf = new_buf;
+                  temp_len = copy_to + copy_len;
+
+                }
+
+              } else {
 
                 memmove(out_buf + copy_to, out_buf + copy_from, copy_len);
 
+              }
+
             }
 
           } else {
@@ -2698,7 +2786,7 @@ abandon_entry:
 
   ++afl->queue_cur->fuzz_level;
 
-  if (afl->taint_needs_splode) {
+  if (unlikely(afl->taint_needs_splode)) {
 
     munmap(afl->taint_src, afl->queue_cur->len);
     munmap(orig_in, afl->taint_len);
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index bb44e465..a1fe146b 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -420,11 +420,7 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u8 *mem, u32 len,
   afl->last_path_time = get_cur_time();
 
   /* trigger the tain gathering if this is not a dry run */
-  if (afl->taint_mode && mem) {
-
-    perform_taint_run(afl, q, fname, mem, len);
-
-  }
+  if (afl->taint_mode && mem) { perform_taint_run(afl, q, fname, mem, len); }
 
   /* only redqueen currently uses is_ascii */
   if (afl->shm.cmplog_mode) q->is_ascii = check_if_text(q);
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 5f928333..94cfc383 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -878,9 +878,11 @@ u8 common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
   if (unlikely(afl->taint_needs_splode)) {
 
     s32 new_len = afl->queue_cur->len + len - afl->taint_len;
-    if (new_len < 4) new_len = 4;
-    if (new_len > MAX_FILE) new_len = MAX_FILE;
-    u8 *new_buf = ck_maybe_grow(BUF_PARAMS(in_scratch), new_len);
+    if (new_len < 4)
+      new_len = 4;
+    else if (new_len > MAX_FILE)
+      new_len = MAX_FILE;
+    u8 *new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch), new_len);
 
     u32 i, taint = 0;
     for (i = 0; i < (u32)new_len; i++) {
@@ -892,6 +894,8 @@ u8 common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
 
     }
 
+    swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch));
+
     out_buf = new_buf;
     len = new_len;
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index bead2ed9..106aa550 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -894,9 +894,18 @@ int main(int argc, char **argv_orig, char **envp) {
     if (afl->taint_mode) { FATAL("-A and -n are mutually exclusive"); }
 
   }
-  
-  if (afl->limit_time_sig != 0 && afl->taint_mode) { FATAL("-A and -L are mutually exclusive"); }
-  if (afl->unicorn_mode != 0 && afl->taint_mode) { FATAL("-A and -U are mutually exclusive"); }
+
+  if (afl->limit_time_sig != 0 && afl->taint_mode) {
+
+    FATAL("-A and -L are mutually exclusive");
+
+  }
+
+  if (afl->unicorn_mode != 0 && afl->taint_mode) {
+
+    FATAL("-A and -U are mutually exclusive");
+
+  }
 
   if (get_afl_env("AFL_DISABLE_TRIM")) { afl->disable_trim = 1; }
 
@@ -1309,7 +1318,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
     OKF("Taint forkserver successfully started");
 
-    const rlim_t  kStackSize = 256L * 1024L * 1024L;  // min stack size = 256 Mb
+    const rlim_t  kStackSize = 128L * 1024L * 1024L;  // min stack size = 128 Mb
     struct rlimit rl;
     rl.rlim_cur = kStackSize;
     if (getrlimit(RLIMIT_STACK, &rl) != 0)
-- 
cgit 1.4.1


From b604f5eafcebb816026e198df0ea66ebcbf18421 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 11 Aug 2020 18:06:18 +0200
Subject: finalize first beta! yay!

---
 README.md                            | 14 ++++++++------
 examples/aflpp_driver/aflpp_driver.c | 28 ----------------------------
 src/afl-fuzz-init.c                  |  9 +++++++--
 src/afl-fuzz-one.c                   |  2 +-
 src/afl-fuzz-queue.c                 |  2 +-
 5 files changed, 17 insertions(+), 38 deletions(-)

(limited to 'src/afl-fuzz-queue.c')

diff --git a/README.md b/README.md
index 2b9bc588..6e324cb0 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # qemu_taint variant.
 
+UPDATE: **WORKS NOW** **PLEASE TEST** **:-)**
+
 ## HOWTO
 
 cd qemu_taint && ./build_qemu_taint.sh
@@ -8,13 +10,13 @@ afl-fuzz -A ...
 
 ## CAVEATS
 
- * segfaults ~10-15 minutes in ...
-
- * shmem persistent mode does not work
- * custom mutators? dunno if they work or not
- * MOpt works but totally ignores the taint information
+ * llvm shmem persistent mode does not and can not not work
+ * MOpt works but totally ignores the taint information, so disabled here
+ * custom mutators? dunno if they work or not. depends on how they work.
  * not tested with qemu_mode
- * if all seed entries are fully touched it might not work
+ * there are several debug checks to ensure the data is fine which slows down
+   fuzzing, if the beta experiment runs fine these will be improved and it
+   will result in quite a speed gain.
 
 ## THE TAINT
 
diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 81782c67..8e0b554a 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -107,8 +107,6 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
 #endif
 
 int                   __afl_sharedmem_fuzzing = 0;
-extern unsigned char *__afl_area_ptr;
-// extern struct cmp_map *__afl_cmp_map;
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
@@ -246,28 +244,8 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
 }
 
-__attribute__((constructor(1))) void __afl_protect(void) {
-
-  setenv("__AFL_DEFER_FORKSRV", "1", 1);
-  __afl_area_ptr = (unsigned char *)mmap(
-      (void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-      MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr = (unsigned char *)mmap((void *)0x10000, MAX_DUMMY_SIZE,
-                                           PROT_READ | PROT_WRITE,
-                                           MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr =
-        (unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-                              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  // __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
-
-}
-
 int main(int argc, char **argv) {
 
-  fprintf(stderr, "map is at %p\n", __afl_area_ptr);
-
   printf(
       "======================= INFO =========================\n"
       "This binary is built for afl++.\n"
@@ -307,8 +285,6 @@ int main(int argc, char **argv) {
 
     if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
 
-      munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
-      __afl_area_ptr = NULL;
       __afl_manual_init();
 
     }
@@ -321,15 +297,11 @@ int main(int argc, char **argv) {
 
   if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
 
-    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
-    __afl_area_ptr = NULL;
     fprintf(stderr, "performing manual init\n");
     __afl_manual_init();
 
   }
 
-  fprintf(stderr, "map is now at %p\n", __afl_area_ptr);
-
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
   // on the first execution of LLVMFuzzerTestOneInput is ignored.
   LLVMFuzzerTestOneInput(dummy_input, 1);
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 0150e18a..359eef85 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -771,9 +771,13 @@ void perform_dry_run(afl_state_t *afl) {
     close(fd);
 
     res = calibrate_case(afl, q, use_mem, 0, 1);
-    ck_free(use_mem);
 
-    if (afl->stop_soon) { return; }
+    if (afl->stop_soon) {
+
+      ck_free(use_mem);
+      return;
+
+    }
 
     if (res == afl->crash_mode || res == FSRV_RUN_NOBITS) {
 
@@ -962,6 +966,7 @@ void perform_dry_run(afl_state_t *afl) {
 
     /* perform taint gathering on the input seed */
     if (afl->taint_mode) perform_taint_run(afl, q, q->fname, use_mem, q->len);
+    ck_free(use_mem);
 
     q = q->next;
 
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 7718256f..4db6febf 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -2342,7 +2342,7 @@ havoc_stage:
             }
 
             /* Tail */
-            memcpy(new_buf + clone_to + clone_len, out_buf + clone_to,
+            memmove(new_buf + clone_to + clone_len, out_buf + clone_to,
                    temp_len - clone_to);
 
             swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch));
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index a1fe146b..43794018 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -122,7 +122,7 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
     afl->taint_fsrv.map_size = plen;  // speed :)
     write_to_testcase(afl, mem, len);
-    if (afl_fsrv_run_target(&afl->taint_fsrv, afl->fsrv.exec_tmout,
+    if (afl_fsrv_run_target(&afl->taint_fsrv, afl->fsrv.exec_tmout * 4,
                             &afl->stop_soon) == 0) {
 
       bytes = q->taint_bytes_all =
-- 
cgit 1.4.1