From 51a346bcbeb66d159b01c6fd37616824c32ee569 Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Thu, 19 Mar 2020 19:22:57 +0100
Subject: 50% less globals

---
 src/afl-fuzz-run.c | 43 ++++++++++++++-----------------------------
 1 file changed, 14 insertions(+), 29 deletions(-)

(limited to 'src/afl-fuzz-run.c')

diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index cdec75e8..c65cdce3 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -28,14 +28,7 @@
 #include <signal.h>
 
 /* Execute target application, monitoring for timeouts. Return status
-   information. The called program will update afl->fsrv.trace_bits[]. */
-
-void timeout_handle(union sigval timer_data) {
-
-  pid_t child_pid = timer_data.sival_int;
-  if (child_pid > 0) kill(child_pid, SIGKILL);
-
-}
+   information. The called program will update afl->fsrv.trace_bits. */
 
 u8 run_target(afl_state_t *afl, u32 timeout) {
 
@@ -44,9 +37,7 @@ u8 run_target(afl_state_t *afl, u32 timeout) {
 
   fd_set readfds;
 
-  static struct timeval it;
-  static u32            prev_timed_out = 0;
-
+  struct timeval it;
   int status = 0;
   u32 tb4;
 
@@ -63,7 +54,7 @@ u8 run_target(afl_state_t *afl, u32 timeout) {
   /* we have the fork server (or faux server) up and running, so simply
       tell it to have at it, and then read back PID. */
 
-  if ((res = write(afl->fsrv.fsrv_ctl_fd, &prev_timed_out, 4)) != 4) {
+  if ((res = write(afl->fsrv.fsrv_ctl_fd, &afl->fsrv.prev_timed_out, 4)) != 4) {
 
     if (afl->stop_soon) return 0;
     RPFATAL(res, "Unable to request new process from fork server (OOM?)");
@@ -144,7 +135,7 @@ u8 run_target(afl_state_t *afl, u32 timeout) {
   classify_counts((u32 *)afl->fsrv.trace_bits);
 #endif                                                     /* ^WORD_SIZE_64 */
 
-  prev_timed_out = afl->fsrv.child_timed_out;
+  afl->fsrv.prev_timed_out = afl->fsrv.child_timed_out;
 
   /* Report outcome to caller. */
 
@@ -299,8 +290,6 @@ static void write_with_gap(afl_state_t *afl, void *mem, u32 len, u32 skip_at,
 u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
                   u32 handicap, u8 from_queue) {
 
-  static u8 first_trace[MAP_SIZE];
-
   u8 fault = 0, new_bits = 0, var_detected = 0,
      first_run = (q->exec_cksum == 0);
 
@@ -331,7 +320,7 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
       afl->shm.cmplog_mode)
     init_cmplog_forkserver(afl);
 
-  if (q->exec_cksum) memcpy(first_trace, afl->fsrv.trace_bits, MAP_SIZE);
+  if (q->exec_cksum) memcpy(afl->first_trace, afl->fsrv.trace_bits, MAP_SIZE);
 
   start_us = get_cur_time_us();
 
@@ -372,7 +361,7 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
 
         for (i = 0; i < MAP_SIZE; ++i) {
 
-          if (!afl->var_bytes[i] && first_trace[i] != afl->fsrv.trace_bits[i]) {
+          if (!afl->var_bytes[i] && afl->first_trace[i] != afl->fsrv.trace_bits[i]) {
 
             afl->var_bytes[i] = 1;
             afl->stage_max = CAL_CYCLES_LONG;
@@ -386,7 +375,7 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
       } else {
 
         q->exec_cksum = cksum;
-        memcpy(first_trace, afl->fsrv.trace_bits, MAP_SIZE);
+        memcpy(afl->first_trace, afl->fsrv.trace_bits, MAP_SIZE);
 
       }
 
@@ -471,8 +460,6 @@ void sync_fuzzers(afl_state_t *afl) {
 
   while ((sd_ent = readdir(sd))) {
 
-    static u8 stage_tmp[128];
-
     DIR *          qd;
     struct dirent *qd_ent;
     u8 *           qd_path, *qd_synced_path;
@@ -511,8 +498,9 @@ void sync_fuzzers(afl_state_t *afl) {
 
     /* Show stats */
 
-    sprintf(stage_tmp, "sync %u", ++sync_cnt);
-    afl->stage_name = stage_tmp;
+    snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "sync %u", ++sync_cnt);
+
+    if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf;
     afl->stage_cur = 0;
     afl->stage_max = 0;
 
@@ -608,9 +596,6 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
   if (afl->mutator && afl->mutator->afl_custom_trim)
     return trim_case_custom(afl, q, in_buf);
 
-  static u8 tmp[64];
-  static u8 clean_trace[MAP_SIZE];
-
   u8  needs_write = 0, fault = 0;
   u32 trim_exec = 0;
   u32 remove_len;
@@ -622,7 +607,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
 
   if (q->len < 5) return 0;
 
-  afl->stage_name = tmp;
+  if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf;
   afl->bytes_trim_in += q->len;
 
   /* Select initial chunk len, starting with large steps. */
@@ -638,7 +623,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
 
     u32 remove_pos = remove_len;
 
-    sprintf(tmp, "trim %s/%s", DI(remove_len), DI(remove_len));
+    snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s", DI(remove_len), DI(remove_len));
 
     afl->stage_cur = 0;
     afl->stage_max = q->len / remove_len;
@@ -680,7 +665,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
         if (!needs_write) {
 
           needs_write = 1;
-          memcpy(clean_trace, afl->fsrv.trace_bits, MAP_SIZE);
+          memcpy(afl->clean_trace, afl->fsrv.trace_bits, MAP_SIZE);
 
         }
 
@@ -722,7 +707,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
     ck_write(fd, in_buf, q->len, q->fname);
     close(fd);
 
-    memcpy(afl->fsrv.trace_bits, clean_trace, MAP_SIZE);
+    memcpy(afl->fsrv.trace_bits, afl->clean_trace, MAP_SIZE);
     update_bitmap_score(afl, q);
 
   }
-- 
cgit 1.4.1


From b6fa63abdfb62fba1a00d9b5401ee69cf1bced1a Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Thu, 19 Mar 2020 19:23:58 +0100
Subject: code format

---
 include/afl-fuzz.h                           | 15 ++++-----
 qemu_mode/patches/afl-qemu-tcg-runtime-inl.h |  4 +--
 src/afl-forkserver.c                         |  2 +-
 src/afl-fuzz-cmplog.c                        | 15 ++++-----
 src/afl-fuzz-init.c                          |  4 +--
 src/afl-fuzz-misc.c                          |  4 +--
 src/afl-fuzz-mutators.c                      |  3 +-
 src/afl-fuzz-one.c                           | 13 +++++---
 src/afl-fuzz-queue.c                         |  2 +-
 src/afl-fuzz-run.c                           | 16 ++++++----
 src/afl-fuzz-stats.c                         | 46 +++++++++++++++++-----------
 src/afl-showmap.c                            |  2 +-
 src/afl-tmin.c                               |  2 +-
 13 files changed, 74 insertions(+), 54 deletions(-)

(limited to 'src/afl-fuzz-run.c')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 913b08e6..28156268 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -109,7 +109,8 @@
 #define CASE_PREFIX "id_"
 #endif                                                    /* ^!SIMPLE_FILES */
 
-#define STAGE_BUF_SIZE (64) /* usable size of the stage name buf in afl_state */
+#define STAGE_BUF_SIZE (64) /* usable size of the stage name buf in afl_state \
+                             */
 
 extern s8  interesting_8[INTERESTING_8_LEN];
 extern s16 interesting_16[INTERESTING_8_LEN + INTERESTING_16_LEN];
@@ -542,7 +543,7 @@ typedef struct afl_state {
 
   /* cmplog forkserver ids */
   s32 cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd;
-  u32            cmplog_prev_timed_out;
+  u32 cmplog_prev_timed_out;
 
   u8 describe_op_buf_256[256]; /* describe_op will use this to return a string
                                   up to 256 */
@@ -559,13 +560,13 @@ typedef struct afl_state {
 #endif
 
   /* statis file */
-  double        last_bitmap_cvg, last_stability, last_eps;
+  double last_bitmap_cvg, last_stability, last_eps;
 
   /* plot file saves from last run */
   u32 plot_prev_qp, plot_prev_pf, plot_prev_pnf, plot_prev_ce, plot_prev_md;
   u64 plot_prev_qc, plot_prev_uc, plot_prev_uh;
 
-  u64    stats_last_stats_ms, stats_last_plot_ms, stats_last_ms, stats_last_execs;
+  u64 stats_last_stats_ms, stats_last_plot_ms, stats_last_ms, stats_last_execs;
   double stats_avg_exec;
 
   u8 clean_trace[MAP_SIZE];
@@ -800,9 +801,9 @@ u8 has_new_bits(afl_state_t *, u8 *);
 
 /* Misc */
 
-u8 *DI(u64);
-u8 *DF(double);
-u8 *DMS(u64);
+u8 * DI(u64);
+u8 * DF(double);
+u8 * DMS(u64);
 void DTD(u8 *, size_t, u64, u64);
 
 /* Extras */
diff --git a/qemu_mode/patches/afl-qemu-tcg-runtime-inl.h b/qemu_mode/patches/afl-qemu-tcg-runtime-inl.h
index b7cd71bb..1526f09c 100644
--- a/qemu_mode/patches/afl-qemu-tcg-runtime-inl.h
+++ b/qemu_mode/patches/afl-qemu-tcg-runtime-inl.h
@@ -185,8 +185,8 @@ void HELPER(afl_cmplog_rtn)(CPUArchState *env) {
   if (!area_is_mapped(stack, sizeof(target_ulong) * 2)) return;
 
   // when this hook is executed, the retaddr is not on stack yet
-  void *ptr1 = g2h(stack[0]);
-  void *ptr2 = g2h(stack[1]);
+  void *    ptr1 = g2h(stack[0]);
+  void *    ptr2 = g2h(stack[1]);
 
 #else
 
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index a77684a7..68ffe28d 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -168,7 +168,7 @@ void afl_fsrv_init(afl_forkserver_t *fsrv) {
 static void afl_fauxsrv_execv(afl_forkserver_t *fsrv, char **argv) {
 
   unsigned char tmp[4] = {0};
-  pid_t                child_pid = -1;
+  pid_t         child_pid = -1;
 
   /* Phone home and tell the parent that we're OK. If parent isn't there,
      assume we're not running in forkserver mode and just execute program. */
diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c
index 7af7b84c..6211548b 100644
--- a/src/afl-fuzz-cmplog.c
+++ b/src/afl-fuzz-cmplog.c
@@ -32,9 +32,9 @@
 void init_cmplog_forkserver(afl_state_t *afl) {
 
   struct timeval timeout;
-  int                   st_pipe[2], ctl_pipe[2];
-  int                   status;
-  s32                   rlen;
+  int            st_pipe[2], ctl_pipe[2];
+  int            status;
+  s32            rlen;
 
   ACTF("Spinning up the cmplog fork server...");
 
@@ -373,9 +373,9 @@ void init_cmplog_forkserver(afl_state_t *afl) {
 u8 run_cmplog_target(afl_state_t *afl, u32 timeout) {
 
   struct timeval it;
-  int status = 0;
-  int sret;
-  u64 exec_ms;
+  int            status = 0;
+  int            sret;
+  u64            exec_ms;
 
   u32 tb4;
   s32 res;
@@ -394,7 +394,8 @@ u8 run_cmplog_target(afl_state_t *afl, u32 timeout) {
   /* Since we always have a forkserver (or a fauxserver) running, we can simply
   tell them to have at it and read back the pid from it.*/
 
-  if ((res = write(afl->cmplog_fsrv_ctl_fd, &afl->cmplog_prev_timed_out, 4)) != 4) {
+  if ((res = write(afl->cmplog_fsrv_ctl_fd, &afl->cmplog_prev_timed_out, 4)) !=
+      4) {
 
     if (afl->stop_soon) return 0;
     RPFATAL(res,
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 8acb305c..ab455417 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -797,7 +797,7 @@ void pivot_inputs(afl_state_t *afl) {
 
 u32 find_start_position(afl_state_t *afl) {
 
-  u8 tmp[4096] = {0};                 /* Ought to be enough for anybody. */
+  u8 tmp[4096] = {0};                    /* Ought to be enough for anybody. */
 
   u8 *fn, *off;
   s32 fd, i;
@@ -834,7 +834,7 @@ u32 find_start_position(afl_state_t *afl) {
 
 void find_timeout(afl_state_t *afl) {
 
-  u8 tmp[4096] = {0};                /* Ought to be enough for anybody. */
+  u8 tmp[4096] = {0};                    /* Ought to be enough for anybody. */
 
   u8 *fn, *off;
   s32 fd, i;
diff --git a/src/afl-fuzz-misc.c b/src/afl-fuzz-misc.c
index d0db79d6..90e0ee8a 100644
--- a/src/afl-fuzz-misc.c
+++ b/src/afl-fuzz-misc.c
@@ -166,8 +166,8 @@ u8 *DMS(u64 val) {
 
 void DTD(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) {
 
-  u64       delta;
-  s32       t_d, t_h, t_m, t_s;
+  u64 delta;
+  s32 t_d, t_h, t_m, t_s;
 
   if (!event_ms) snprintf(buf, len, "none seen yet");
 
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 5d39c2ee..9788da49 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -196,7 +196,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
   u32 trim_exec = 0;
   u32 orig_len = q->len;
 
-  if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf;
+  if (afl->stage_name != afl->stage_name_buf)
+    afl->stage_name = afl->stage_name_buf;
   afl->bytes_trim_in += q->len;
 
   /* Initialize trimming in the custom mutator */
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index ebb863ca..c1458dbb 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -1680,7 +1680,8 @@ havoc_stage:
     perf_score = orig_perf;
 
     snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "splice %u", splice_cycle);
-    if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf;
+    if (afl->stage_name != afl->stage_name_buf)
+      afl->stage_name = afl->stage_name_buf;
     afl->stage_short = "splice";
     afl->stage_max = SPLICE_HAVOC * perf_score / afl->havoc_div / 100;
 
@@ -3573,9 +3574,10 @@ pacemaker_fuzzing:
 
     perf_score = orig_perf;
 
-    snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, MOpt_globals.splice_stageformat,
-             splice_cycle);
-    if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf;
+    snprintf(afl->stage_name_buf, STAGE_BUF_SIZE,
+             MOpt_globals.splice_stageformat, splice_cycle);
+    if (afl->stage_name != afl->stage_name_buf)
+      afl->stage_name = afl->stage_name_buf;
     afl->stage_short = MOpt_globals.splice_stagenameshort;
     afl->stage_max = SPLICE_HAVOC * perf_score / afl->havoc_div / 100;
 
@@ -3623,7 +3625,8 @@ pacemaker_fuzzing:
       } else {
 
         perf_score = orig_perf;
-        snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, MOpt_globals.splice_stageformat, splice_cycle);
+        snprintf(afl->stage_name_buf, STAGE_BUF_SIZE,
+                 MOpt_globals.splice_stageformat, splice_cycle);
         afl->stage_name = afl->stage_name_buf;
         afl->stage_short = MOpt_globals.splice_stagenameshort;
         afl->stage_max = SPLICE_HAVOC * perf_score / afl->havoc_div / 100;
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 00bad48f..8a995727 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -254,7 +254,7 @@ void update_bitmap_score(afl_state_t *afl, struct queue_entry *q) {
 void cull_queue(afl_state_t *afl) {
 
   struct queue_entry *q;
-  u8           temp_v[MAP_SIZE >> 3];
+  u8                  temp_v[MAP_SIZE >> 3];
   u32                 i;
 
   if (afl->dumb_mode || !afl->score_changed) return;
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index c65cdce3..500c5ba2 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -38,8 +38,8 @@ u8 run_target(afl_state_t *afl, u32 timeout) {
   fd_set readfds;
 
   struct timeval it;
-  int status = 0;
-  u32 tb4;
+  int            status = 0;
+  u32            tb4;
 
   afl->fsrv.child_timed_out = 0;
 
@@ -361,7 +361,8 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
 
         for (i = 0; i < MAP_SIZE; ++i) {
 
-          if (!afl->var_bytes[i] && afl->first_trace[i] != afl->fsrv.trace_bits[i]) {
+          if (!afl->var_bytes[i] &&
+              afl->first_trace[i] != afl->fsrv.trace_bits[i]) {
 
             afl->var_bytes[i] = 1;
             afl->stage_max = CAL_CYCLES_LONG;
@@ -500,7 +501,8 @@ void sync_fuzzers(afl_state_t *afl) {
 
     snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "sync %u", ++sync_cnt);
 
-    if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf;
+    if (afl->stage_name != afl->stage_name_buf)
+      afl->stage_name = afl->stage_name_buf;
     afl->stage_cur = 0;
     afl->stage_max = 0;
 
@@ -607,7 +609,8 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
 
   if (q->len < 5) return 0;
 
-  if (afl->stage_name != afl->stage_name_buf) afl->stage_name = afl->stage_name_buf;
+  if (afl->stage_name != afl->stage_name_buf)
+    afl->stage_name = afl->stage_name_buf;
   afl->bytes_trim_in += q->len;
 
   /* Select initial chunk len, starting with large steps. */
@@ -623,7 +626,8 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
 
     u32 remove_pos = remove_len;
 
-    snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s", DI(remove_len), DI(remove_len));
+    snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s", DI(remove_len),
+             DI(remove_len));
 
     afl->stage_cur = 0;
     afl->stage_max = q->len / remove_len;
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index d4b27625..c89820d8 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -192,20 +192,22 @@ static void check_term_size(afl_state_t *afl) {
 
 void show_stats(afl_state_t *afl) {
 
-  double        t_byte_ratio, stab_ratio;
+  double t_byte_ratio, stab_ratio;
 
   u64 cur_ms;
   u32 t_bytes, t_bits;
 
   u32 banner_len, banner_pad;
   u8  tmp[256];
-  u8 time_tmp[64];
+  u8  time_tmp[64];
 
   cur_ms = get_cur_time();
 
   /* If not enough time has passed since last UI update, bail out. */
 
-  if (cur_ms - afl->stats_last_ms < 1000 / UI_TARGET_HZ && !afl->force_ui_update) return;
+  if (cur_ms - afl->stats_last_ms < 1000 / UI_TARGET_HZ &&
+      !afl->force_ui_update)
+    return;
 
   /* Check if we're past the 10 minute mark. */
 
@@ -215,18 +217,22 @@ void show_stats(afl_state_t *afl) {
 
   if (!afl->stats_last_execs) {
 
-    afl->stats_avg_exec = ((double)afl->total_execs) * 1000 / (cur_ms - afl->start_time);
+    afl->stats_avg_exec =
+        ((double)afl->total_execs) * 1000 / (cur_ms - afl->start_time);
 
   } else {
 
-    double cur_avg = ((double)(afl->total_execs - afl->stats_last_execs)) * 1000 / (cur_ms - afl->stats_last_ms);
+    double cur_avg = ((double)(afl->total_execs - afl->stats_last_execs)) *
+                     1000 / (cur_ms - afl->stats_last_ms);
 
     /* If there is a dramatic (5x+) jump in speed, reset the indicator
        more quickly. */
 
-    if (cur_avg * 5 < afl->stats_avg_exec || cur_avg / 5 > afl->stats_avg_exec) afl->stats_avg_exec = cur_avg;
+    if (cur_avg * 5 < afl->stats_avg_exec || cur_avg / 5 > afl->stats_avg_exec)
+      afl->stats_avg_exec = cur_avg;
 
-    afl->stats_avg_exec = afl->stats_avg_exec * (1.0 - 1.0 / AVG_SMOOTHING) + cur_avg * (1.0 / AVG_SMOOTHING);
+    afl->stats_avg_exec = afl->stats_avg_exec * (1.0 - 1.0 / AVG_SMOOTHING) +
+                          cur_avg * (1.0 / AVG_SMOOTHING);
 
   }
 
@@ -348,9 +354,9 @@ void show_stats(afl_state_t *afl) {
 
   /* Lord, forgive me this. */
 
-  SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
+  SAYF(SET_G1 bSTG bLT bH bSTOP                         cCYA
        " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA
-       " overall results " bSTG bH2 bH2 bRT "\n");
+       " overall results " bSTG bH2 bH2                 bRT "\n");
 
   if (afl->dumb_mode) {
 
@@ -383,7 +389,8 @@ void show_stats(afl_state_t *afl) {
 
   DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->start_time);
   SAYF(bV bSTOP "        run time : " cRST "%-33s " bSTG bV bSTOP
-                "  cycles done : %s%-5s " bSTG              bV "\n", time_tmp, tmp, DI(afl->queue_cycle - 1));
+                "  cycles done : %s%-5s " bSTG              bV "\n",
+       time_tmp, tmp, DI(afl->queue_cycle - 1));
 
   /* We want to warn people about not seeing new paths after a full cycle,
      except when resuming fuzzing or running in non-instrumented mode. */
@@ -420,18 +427,20 @@ void show_stats(afl_state_t *afl) {
 
   DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_crash_time);
   SAYF(bV bSTOP " last uniq crash : " cRST "%-33s " bSTG bV bSTOP
-                " uniq crashes : %s%-6s" bSTG               bV "\n", time_tmp, afl->unique_crashes ? cLRD : cRST, tmp);
+                " uniq crashes : %s%-6s" bSTG               bV "\n",
+       time_tmp, afl->unique_crashes ? cLRD : cRST, tmp);
 
   sprintf(tmp, "%s%s", DI(afl->unique_hangs),
           (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
 
   DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_hang_time);
   SAYF(bV bSTOP "  last uniq hang : " cRST "%-33s " bSTG bV bSTOP
-                "   uniq hangs : " cRST "%-6s" bSTG         bV "\n", time_tmp, tmp);
+                "   uniq hangs : " cRST "%-6s" bSTG         bV "\n",
+       time_tmp, tmp);
 
-  SAYF(bVR bH bSTOP            cCYA
+  SAYF(bVR bH bSTOP                                          cCYA
        " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA
-       " map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
+       " map coverage " bSTG bH bHT bH20 bH2                 bVL "\n");
 
   /* This gets funny because we want to print several variable-length variables
      together, but then cram them into a fixed-width field - so we need to
@@ -460,9 +469,9 @@ void show_stats(afl_state_t *afl) {
 
   SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp);
 
-  SAYF(bVR bH bSTOP            cCYA
+  SAYF(bVR bH bSTOP                                         cCYA
        " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
-       " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
+       " findings in depth " bSTG bH10 bH5 bH2 bH2          bVL "\n");
 
   sprintf(tmp, "%s (%0.02f%%)", DI(afl->queued_favored),
           ((double)afl->queued_favored) * 100 / afl->queued_paths);
@@ -526,13 +535,14 @@ void show_stats(afl_state_t *afl) {
   }
 
   sprintf(tmp, "%s (%s%s unique)", DI(afl->total_tmouts),
-          DI(afl->unique_tmouts), (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
+          DI(afl->unique_tmouts),
+          (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
 
   SAYF(bSTG bV bSTOP "  total tmouts : " cRST "%-22s" bSTG bV "\n", tmp);
 
   /* Aaaalmost there... hold on! */
 
-  SAYF(bVR bH cCYA                      bSTOP
+  SAYF(bVR bH cCYA                                                     bSTOP
        " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA
        " path geometry " bSTG bH5 bH2 bVL "\n");
 
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index cc771c5a..712b50bd 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -264,7 +264,7 @@ static u8 run_target_forkserver(afl_forkserver_t *fsrv, char **argv, u8 *mem,
                                 u32 len) {
 
   struct itimerval it;
-  int                     status = 0;
+  int              status = 0;
 
   memset(fsrv->trace_bits, 0, MAP_SIZE);
   MEM_BARRIER();
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 9a3a72da..9238abab 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -399,7 +399,7 @@ static u8 run_target(afl_forkserver_t *fsrv, char **argv, u8 *mem, u32 len,
                      u8 first_run) {
 
   struct itimerval it;
-  int                     status = 0;
+  int              status = 0;
 
   u32 cksum;
 
-- 
cgit 1.4.1


From 5b9d306cdfac1cb2a32373a0d4028abffb7ce979 Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Thu, 19 Mar 2020 22:54:09 +0100
Subject: no more (?) statics

---
 include/afl-fuzz.h      |  13 ++--
 src/afl-forkserver.c    |  26 +++----
 src/afl-fuzz-bitmap.c   |   6 +-
 src/afl-fuzz-cmplog.c   |  10 ++-
 src/afl-fuzz-extras.c   |  19 ++++--
 src/afl-fuzz-init.c     |  13 ++--
 src/afl-fuzz-misc.c     |  88 ++++++++++++------------
 src/afl-fuzz-mutators.c |   5 +-
 src/afl-fuzz-run.c      |   7 +-
 src/afl-fuzz-stats.c    | 178 +++++++++++++++++++++++++++---------------------
 10 files changed, 207 insertions(+), 158 deletions(-)

(limited to 'src/afl-fuzz-run.c')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 28156268..1a798239 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -109,8 +109,9 @@
 #define CASE_PREFIX "id_"
 #endif                                                    /* ^!SIMPLE_FILES */
 
-#define STAGE_BUF_SIZE (64) /* usable size of the stage name buf in afl_state \
-                             */
+#define STAGE_BUF_SIZE                                   \
+  (64) /* usable size of the stage name buf in afl_state \
+        */
 
 extern s8  interesting_8[INTERESTING_8_LEN];
 extern s16 interesting_16[INTERESTING_8_LEN + INTERESTING_16_LEN];
@@ -801,10 +802,10 @@ u8 has_new_bits(afl_state_t *, u8 *);
 
 /* Misc */
 
-u8 * DI(u64);
-u8 * DF(double);
-u8 * DMS(u64);
-void DTD(u8 *, size_t, u64, u64);
+u8 *DI(u8 *, size_t, u64);
+u8 *DF(u8 *, size_t, double);
+u8 *DMS(u8 *, size_t, u64);
+u8 *DTD(u8 *, size_t, u64, u64);
 
 /* Extras */
 
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 6755a73c..75b69178 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -55,16 +55,16 @@ static void forkserver_stringify_int(u8 *buf, size_t len, u64 val) {
 
   u8 cur = 0;
 
-#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast)    \
-  do {                                                    \
-                                                          \
-    if (val < (_divisor) * (_limit_mult)) {               \
-                                                          \
-      snprintf(buf, len, _fmt, ((_cast)val) / (_divisor));\
-      return;                                             \
-                                                          \
-    }                                                     \
-                                                          \
+#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast)     \
+  do {                                                     \
+                                                           \
+    if (val < (_divisor) * (_limit_mult)) {                \
+                                                           \
+      snprintf(buf, len, _fmt, ((_cast)val) / (_divisor)); \
+      return;                                              \
+                                                           \
+    }                                                      \
+                                                           \
   } while (0)
 
   cur = (cur + 1) % 12;
@@ -454,7 +454,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv) {
     } else {
 
       u8 mem_limit_buf[16];
-      forkserver_stringify_int(mem_limit_buf, sizeof(mem_limit_buf), fsrv->mem_limit << 20);
+      forkserver_stringify_int(mem_limit_buf, sizeof(mem_limit_buf),
+                               fsrv->mem_limit << 20);
 
       SAYF("\n" cLRD "[-] " cRST
            "Whoops, the target binary crashed suddenly, "
@@ -524,7 +525,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv) {
   } else {
 
     u8 mem_limit_buf[16];
-    forkserver_stringify_int(mem_limit_buf, sizeof(mem_limit_buf), fsrv->mem_limit << 20);
+    forkserver_stringify_int(mem_limit_buf, sizeof(mem_limit_buf),
+                             fsrv->mem_limit << 20);
 
     SAYF(
         "\n" cLRD "[-] " cRST
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index de5d147e..86474adc 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -465,6 +465,8 @@ static void write_crash_readme(afl_state_t *afl) {
   s32   fd;
   FILE *f;
 
+  u8 int_buf[16];
+
   fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
   ck_free(fn);
 
@@ -501,7 +503,9 @@ static void write_crash_readme(afl_state_t *afl) {
 
       "  https://github.com/AFLplusplus/AFLplusplus\n\n",
 
-      afl->orig_cmdline, DMS(afl->fsrv.mem_limit << 20));  /* ignore errors */
+      afl->orig_cmdline,
+      DMS(int_buf, sizeof(int_buf),
+          afl->fsrv.mem_limit << 20));                     /* ignore errors */
 
   fclose(f);
 
diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c
index 6211548b..5f7909cc 100644
--- a/src/afl-fuzz-cmplog.c
+++ b/src/afl-fuzz-cmplog.c
@@ -264,6 +264,8 @@ void init_cmplog_forkserver(afl_state_t *afl) {
 
     } else {
 
+      u8 int_buf[16];
+
       SAYF("\n" cLRD "[-] " cRST
            "Whoops, the target binary crashed suddenly, "
            "before receiving any input\n"
@@ -296,7 +298,8 @@ void init_cmplog_forkserver(afl_state_t *afl) {
            "options\n"
            "      fail, poke <afl-users@googlegroups.com> for troubleshooting "
            "tips.\n",
-           DMS(afl->fsrv.mem_limit << 20), afl->fsrv.mem_limit - 1);
+           DMS(int_buf, sizeof(int_buf), afl->fsrv.mem_limit << 20),
+           afl->fsrv.mem_limit - 1);
 
     }
 
@@ -331,6 +334,8 @@ void init_cmplog_forkserver(afl_state_t *afl) {
 
   } else {
 
+    u8 int_buf[16];
+
     SAYF(
         "\n" cLRD "[-] " cRST
         "Hmm, looks like the target binary terminated "
@@ -362,7 +367,8 @@ void init_cmplog_forkserver(afl_state_t *afl) {
               "never\n"
               "      reached before the program terminates.\n\n"
             : "",
-        DMS(afl->fsrv.mem_limit << 20), afl->fsrv.mem_limit - 1);
+        DMS(int_buf, sizeof(int_buf), afl->fsrv.mem_limit << 20),
+        afl->fsrv.mem_limit - 1);
 
   }
 
diff --git a/src/afl-fuzz-extras.c b/src/afl-fuzz-extras.c
index ff4c0ae2..256489f5 100644
--- a/src/afl-fuzz-extras.c
+++ b/src/afl-fuzz-extras.c
@@ -55,6 +55,8 @@ void load_extras_file(afl_state_t *afl, u8 *fname, u32 *min_len, u32 *max_len,
   u8 *  lptr;
   u32   cur_line = 0;
 
+  u8 int_bufs[2][16];
+
   f = fopen(fname, "r");
 
   if (!f) PFATAL("Unable to open '%s'", fname);
@@ -170,8 +172,9 @@ void load_extras_file(afl_state_t *afl, u8 *fname, u32 *min_len, u32 *max_len,
     afl->extras[afl->extras_cnt].len = klen;
 
     if (afl->extras[afl->extras_cnt].len > MAX_DICT_FILE)
-      FATAL("Keyword too big in line %u (%s, limit is %s)", cur_line, DMS(klen),
-            DMS(MAX_DICT_FILE));
+      FATAL("Keyword too big in line %u (%s, limit is %s)", cur_line,
+            DMS(int_bufs[0], sizeof(int_bufs[0]), klen),
+            DMS(int_bufs[1], sizeof(int_bufs[1]), MAX_DICT_FILE));
 
     if (*min_len > klen) *min_len = klen;
     if (*max_len < klen) *max_len = klen;
@@ -193,6 +196,8 @@ void load_extras(afl_state_t *afl, u8 *dir) {
   u32            min_len = MAX_DICT_FILE, max_len = 0, dict_level = 0;
   u8 *           x;
 
+  u8 int_bufs[2][16];
+
   /* If the name ends with @, extract level and continue. */
 
   if ((x = strchr(dir, '@'))) {
@@ -238,8 +243,9 @@ void load_extras(afl_state_t *afl, u8 *dir) {
     }
 
     if (st.st_size > MAX_DICT_FILE)
-      FATAL("Extra '%s' is too big (%s, limit is %s)", fn, DMS(st.st_size),
-            DMS(MAX_DICT_FILE));
+      FATAL("Extra '%s' is too big (%s, limit is %s)", fn,
+            DMS(int_bufs[0], sizeof(int_bufs[0]), st.st_size),
+            DMS(int_bufs[1], sizeof(int_bufs[1]), MAX_DICT_FILE));
 
     if (min_len > st.st_size) min_len = st.st_size;
     if (max_len < st.st_size) max_len = st.st_size;
@@ -273,11 +279,12 @@ check_and_sort:
         compare_extras_len);
 
   OKF("Loaded %u extra tokens, size range %s to %s.", afl->extras_cnt,
-      DMS(min_len), DMS(max_len));
+      DMS(int_bufs[0], sizeof(int_bufs[0]), min_len),
+      DMS(int_bufs[1], sizeof(int_bufs[1]), max_len));
 
   if (max_len > 32)
     WARNF("Some tokens are relatively large (%s) - consider trimming.",
-          DMS(max_len));
+          DMS(int_bufs[0], sizeof(int_bufs[0]), max_len));
 
   if (afl->extras_cnt > MAX_DET_EXTRAS)
     WARNF("More than %d tokens - will use them probabilistically.",
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 48ccbe9c..4d68ee78 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -323,6 +323,8 @@ void read_testcases(afl_state_t *afl) {
   u32             i;
   u8 *            fn1;
 
+  u8 int_buf[12][16];
+
   /* Auto-detect non-in-place resumption attempts. */
 
   fn1 = alloc_printf("%s/queue", afl->in_dir);
@@ -389,8 +391,9 @@ void read_testcases(afl_state_t *afl) {
     }
 
     if (st.st_size > MAX_FILE)
-      FATAL("Test case '%s' is too big (%s, limit is %s)", fn2, DMS(st.st_size),
-            DMS(MAX_FILE));
+      FATAL("Test case '%s' is too big (%s, limit is %s)", fn2,
+            DMS(int_buf[0], sizeof(int_buf[0]), st.st_size),
+            DMS(int_buf[1], sizeof(int_buf[1]), MAX_FILE));
 
     /* Check for metadata that indicates that deterministic fuzzing
        is complete for this entry. We don't want to repeat deterministic
@@ -553,6 +556,8 @@ void perform_dry_run(afl_state_t *afl) {
 
         if (afl->fsrv.mem_limit) {
 
+          u8 int_tmp[16];
+
           SAYF("\n" cLRD "[-] " cRST
                "Oops, the program crashed with one of the test cases provided. "
                "There are\n"
@@ -593,8 +598,8 @@ void perform_dry_run(afl_state_t *afl) {
                "other options\n"
                "      fail, poke <afl-users@googlegroups.com> for "
                "troubleshooting tips.\n",
-               DMS(afl->fsrv.mem_limit << 20), afl->fsrv.mem_limit - 1,
-               doc_path);
+               DMS(int_tmp, sizeof(int_tmp), afl->fsrv.mem_limit << 20),
+               afl->fsrv.mem_limit - 1, doc_path);
 
         } else {
 
diff --git a/src/afl-fuzz-misc.c b/src/afl-fuzz-misc.c
index 90e0ee8a..c6117bd9 100644
--- a/src/afl-fuzz-misc.c
+++ b/src/afl-fuzz-misc.c
@@ -25,27 +25,22 @@
 
 #include "afl-fuzz.h"
 
-/* Describe integer. Uses 12 cyclic static buffers for return values. The value
-   returned should be five characters or less for all the integers we reasonably
-   expect to see. */
-
-u8 *DI(u64 val) {
-
-  static u8 tmp[12][16];
-  static u8 cur;
-
-  cur = (cur + 1) % 12;
-
-#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast)    \
-  do {                                                    \
-                                                          \
-    if (val < (_divisor) * (_limit_mult)) {               \
-                                                          \
-      sprintf(tmp[cur], _fmt, ((_cast)val) / (_divisor)); \
-      return tmp[cur];                                    \
-                                                          \
-    }                                                     \
-                                                          \
+/* Describe integer. The buf should be
+   at least 6 bytes to fit all ints we randomly see.
+   Will return buf for convenience. */
+
+u8 *DI(u8 *buf, size_t len, u64 val) {
+\
+#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast)     \
+  do {                                                     \
+                                                           \
+    if (val < (_divisor) * (_limit_mult)) {                \
+                                                           \
+      snprintf(buf, len, _fmt, ((_cast)val) / (_divisor)); \
+      return buf;                                          \
+                                                           \
+    }                                                      \
+                                                           \
   } while (0)
 
   /* 0-9999 */
@@ -82,44 +77,38 @@ u8 *DI(u64 val) {
   CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 99.95, "%0.01fT", double);
 
   /* 100T+ */
-  strcpy(tmp[cur], "infty");
-  return tmp[cur];
+  strncpy(buf, "infty", len);
+  buf[len - 1] = '\0';
 
-}
+  return buf;
 
-/* Describe float. Similar to the above, except with a single
-   static buffer. */
+}
 
-u8 *DF(double val) {
+/* Describe float. Similar as int. */
 
-  static u8 tmp[16];
+u8 *DF(u8 *buf, size_t len, double val) {
 
   if (val < 99.995) {
 
-    sprintf(tmp, "%0.02f", val);
-    return tmp;
+    snprintf(buf, len, "%0.02f", val);
 
-  }
+  } else if (val < 999.95) {
+
+    snprintf(buf, len, "%0.01f", val);
 
-  if (val < 999.95) {
+  } else {
 
-    sprintf(tmp, "%0.01f", val);
-    return tmp;
+    DI(buf, len, (u64)val);
 
   }
 
-  return DI((u64)val);
+  return buf;
 
 }
 
 /* Describe integer as memory size. */
 
-u8 *DMS(u64 val) {
-
-  static u8 tmp[12][16];
-  static u8 cur;
-
-  cur = (cur + 1) % 12;
+u8 *DMS(u8 *buf, size_t len, u64 val) {
 
   /* 0-9999 */
   CHK_FORMAT(1, 10000, "%llu B", u64);
@@ -157,17 +146,21 @@ u8 *DMS(u64 val) {
 #undef CHK_FORMAT
 
   /* 100T+ */
-  strcpy(tmp[cur], "infty");
-  return tmp[cur];
+  strncpy(buf, "infty", len - 1);
+  buf[len - 1] = '\0';
+
+  return buf;
 
 }
 
-/* Describe time delta as string. */
+/* Describe time delta as string.
+   Returns a pointer to buf for convenience. */
 
-void DTD(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) {
+u8 *DTD(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) {
 
   u64 delta;
   s32 t_d, t_h, t_m, t_s;
+  u8  int_buf[16];
 
   if (!event_ms) snprintf(buf, len, "none seen yet");
 
@@ -178,7 +171,10 @@ void DTD(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) {
   t_m = (delta / 1000 / 60) % 60;
   t_s = (delta / 1000) % 60;
 
-  snprintf(buf, len, "%s days, %d hrs, %d min, %d sec", DI(t_d), t_h, t_m, t_s);
+  DI(int_buf, sizeof(int_buf), t_d);
+  snprintf(buf, len, "%s days, %d hrs, %d min, %d sec", int_buf, t_h, t_m, t_s);
+
+  return buf;
 
 }
 
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 9788da49..032c61fe 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -196,6 +196,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
   u32 trim_exec = 0;
   u32 orig_len = q->len;
 
+  u8 int_buf[16];
+
   if (afl->stage_name != afl->stage_name_buf)
     afl->stage_name = afl->stage_name_buf;
   afl->bytes_trim_in += q->len;
@@ -210,7 +212,8 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
 
   while (afl->stage_cur < afl->stage_max) {
 
-    snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "ptrim %s", DI(trim_exec));
+    snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "ptrim %s",
+             DI(int_buf, sizeof(int_buf), trim_exec));
 
     u32 cksum;
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 500c5ba2..c8153857 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -603,6 +603,8 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
   u32 remove_len;
   u32 len_p2;
 
+  u8 int_bufs[2][16];
+
   /* Although the trimmer will be less useful when variable behavior is
      detected, it will still work to some extent, so we don't check for
      this. */
@@ -626,8 +628,9 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
 
     u32 remove_pos = remove_len;
 
-    snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s", DI(remove_len),
-             DI(remove_len));
+    snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s",
+             DI(int_bufs[0], sizeof(int_bufs[0]), remove_len),
+             DI(int_bufs[1], sizeof(int_bufs[1]), remove_len));
 
     afl->stage_cur = 0;
     afl->stage_max = q->len / remove_len;
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index c89820d8..dcd4f542 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -201,6 +201,9 @@ void show_stats(afl_state_t *afl) {
   u8  tmp[256];
   u8  time_tmp[64];
 
+  u8 int_buf[16][16];
+#define IB(i) int_buf[(i)], sizeof(int_buf[(i)])
+
   cur_ms = get_cur_time();
 
   /* If not enough time has passed since last UI update, bail out. */
@@ -390,7 +393,7 @@ void show_stats(afl_state_t *afl) {
   DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->start_time);
   SAYF(bV bSTOP "        run time : " cRST "%-33s " bSTG bV bSTOP
                 "  cycles done : %s%-5s " bSTG              bV "\n",
-       time_tmp, tmp, DI(afl->queue_cycle - 1));
+       time_tmp, tmp, DI(IB(0), afl->queue_cycle - 1));
 
   /* We want to warn people about not seeing new paths after a full cycle,
      except when resuming fuzzing or running in non-instrumented mode. */
@@ -417,12 +420,12 @@ void show_stats(afl_state_t *afl) {
   }
 
   SAYF(bSTG bV bSTOP "  total paths : " cRST "%-5s " bSTG bV "\n",
-       DI(afl->queued_paths));
+       DI(IB(0), afl->queued_paths));
 
   /* Highlight crashes in red if found, denote going over the KEEP_UNIQUE_CRASH
      limit with a '+' appended to the count. */
 
-  sprintf(tmp, "%s%s", DI(afl->unique_crashes),
+  sprintf(tmp, "%s%s", DI(IB(0), afl->unique_crashes),
           (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : "");
 
   DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_crash_time);
@@ -430,7 +433,7 @@ void show_stats(afl_state_t *afl) {
                 " uniq crashes : %s%-6s" bSTG               bV "\n",
        time_tmp, afl->unique_crashes ? cLRD : cRST, tmp);
 
-  sprintf(tmp, "%s%s", DI(afl->unique_hangs),
+  sprintf(tmp, "%s%s", DI(IB(0), afl->unique_hangs),
           (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
 
   DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_hang_time);
@@ -446,7 +449,7 @@ void show_stats(afl_state_t *afl) {
      together, but then cram them into a fixed-width field - so we need to
      put them in a temporary buffer first. */
 
-  sprintf(tmp, "%s%s%u (%0.01f%%)", DI(afl->current_entry),
+  sprintf(tmp, "%s%s%u (%0.01f%%)", DI(IB(0), afl->current_entry),
           afl->queue_cur->favored ? "." : "*", afl->queue_cur->fuzz_level,
           ((double)afl->current_entry * 100) / afl->queued_paths);
 
@@ -460,7 +463,7 @@ void show_stats(afl_state_t *afl) {
                          : ((t_bytes < 200 && !afl->dumb_mode) ? cPIN : cRST),
        tmp);
 
-  sprintf(tmp, "%s (%0.02f%%)", DI(afl->cur_skipped_paths),
+  sprintf(tmp, "%s (%0.02f%%)", DI(IB(0), afl->cur_skipped_paths),
           ((double)afl->cur_skipped_paths * 100) / afl->queued_paths);
 
   SAYF(bV bSTOP " paths timed out : " cRST "%-16s " bSTG bV, tmp);
@@ -473,7 +476,7 @@ void show_stats(afl_state_t *afl) {
        " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
        " findings in depth " bSTG bH10 bH5 bH2 bH2          bVL "\n");
 
-  sprintf(tmp, "%s (%0.02f%%)", DI(afl->queued_favored),
+  sprintf(tmp, "%s (%0.02f%%)", DI(IB(0), afl->queued_favored),
           ((double)afl->queued_favored) * 100 / afl->queued_paths);
 
   /* Yeah... it's still going on... halp? */
@@ -484,37 +487,38 @@ void show_stats(afl_state_t *afl) {
 
   if (!afl->stage_max) {
 
-    sprintf(tmp, "%s/-", DI(afl->stage_cur));
+    sprintf(tmp, "%s/-", DI(IB(0), afl->stage_cur));
 
   } else {
 
-    sprintf(tmp, "%s/%s (%0.02f%%)", DI(afl->stage_cur), DI(afl->stage_max),
+    sprintf(tmp, "%s/%s (%0.02f%%)", DI(IB(0), afl->stage_cur),
+            DI(IB(1), afl->stage_max),
             ((double)afl->stage_cur) * 100 / afl->stage_max);
 
   }
 
   SAYF(bV bSTOP " stage execs : " cRST "%-21s" bSTG bV bSTOP, tmp);
 
-  sprintf(tmp, "%s (%0.02f%%)", DI(afl->queued_with_cov),
+  sprintf(tmp, "%s (%0.02f%%)", DI(IB(0), afl->queued_with_cov),
           ((double)afl->queued_with_cov) * 100 / afl->queued_paths);
 
   SAYF("  new edges on : " cRST "%-22s" bSTG bV "\n", tmp);
 
-  sprintf(tmp, "%s (%s%s unique)", DI(afl->total_crashes),
-          DI(afl->unique_crashes),
+  sprintf(tmp, "%s (%s%s unique)", DI(IB(0), afl->total_crashes),
+          DI(IB(1), afl->unique_crashes),
           (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : "");
 
   if (afl->crash_mode) {
 
     SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP
                   "   new crashes : %s%-22s" bSTG         bV "\n",
-         DI(afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp);
+         DI(IB(0), afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp);
 
   } else {
 
     SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP
                   " total crashes : %s%-22s" bSTG         bV "\n",
-         DI(afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp);
+         DI(IB(0), afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp);
 
   }
 
@@ -522,21 +526,21 @@ void show_stats(afl_state_t *afl) {
 
   if (afl->stats_avg_exec < 100) {
 
-    sprintf(tmp, "%s/sec (%s)", DF(afl->stats_avg_exec),
-            afl->stats_avg_exec < 20 ? "zzzz..." : "slow!");
+    snprintf(tmp, sizeof(tmp), "%s/sec (%s)", DF(IB(0), afl->stats_avg_exec),
+             afl->stats_avg_exec < 20 ? "zzzz..." : "slow!");
 
     SAYF(bV bSTOP "  exec speed : " cLRD "%-20s ", tmp);
 
   } else {
 
-    sprintf(tmp, "%s/sec", DF(afl->stats_avg_exec));
+    snprintf(tmp, sizeof(tmp), "%s/sec", DF(IB(0), afl->stats_avg_exec));
     SAYF(bV bSTOP "  exec speed : " cRST "%-20s ", tmp);
 
   }
 
-  sprintf(tmp, "%s (%s%s unique)", DI(afl->total_tmouts),
-          DI(afl->unique_tmouts),
-          (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
+  snprintf(tmp, sizeof(tmp), "%s (%s%s unique)", DI(IB(0), afl->total_tmouts),
+           DI(IB(1), afl->unique_tmouts),
+           (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
 
   SAYF(bSTG bV bSTOP "  total tmouts : " cRST "%-22s" bSTG bV "\n", tmp);
 
@@ -548,74 +552,84 @@ void show_stats(afl_state_t *afl) {
 
   if (afl->skip_deterministic) {
 
-    strcpy(tmp, "n/a, n/a, n/a");
+    strncpy(tmp, "n/a, n/a, n/a", sizeof(tmp) - 1);
+    tmp[sizeof(tmp) - 1] = '\0';
 
   } else {
 
-    sprintf(
-        tmp, "%s/%s, %s/%s, %s/%s", DI(afl->stage_finds[STAGE_FLIP1]),
-        DI(afl->stage_cycles[STAGE_FLIP1]), DI(afl->stage_finds[STAGE_FLIP2]),
-        DI(afl->stage_cycles[STAGE_FLIP2]), DI(afl->stage_finds[STAGE_FLIP4]),
-        DI(afl->stage_cycles[STAGE_FLIP4]));
+    snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
+             DI(IB(0), afl->stage_finds[STAGE_FLIP1]),
+             DI(IB(1), afl->stage_cycles[STAGE_FLIP1]),
+             DI(IB(2), afl->stage_finds[STAGE_FLIP2]),
+             DI(IB(3), afl->stage_cycles[STAGE_FLIP2]),
+             DI(IB(3), afl->stage_finds[STAGE_FLIP4]),
+             DI(IB(5), afl->stage_cycles[STAGE_FLIP4]));
 
   }
 
   SAYF(bV bSTOP "   bit flips : " cRST "%-36s " bSTG bV bSTOP
                 "    levels : " cRST "%-10s" bSTG       bV "\n",
-       tmp, DI(afl->max_depth));
+       tmp, DI(IB(0), afl->max_depth));
 
   if (!afl->skip_deterministic)
-    sprintf(
-        tmp, "%s/%s, %s/%s, %s/%s", DI(afl->stage_finds[STAGE_FLIP8]),
-        DI(afl->stage_cycles[STAGE_FLIP8]), DI(afl->stage_finds[STAGE_FLIP16]),
-        DI(afl->stage_cycles[STAGE_FLIP16]), DI(afl->stage_finds[STAGE_FLIP32]),
-        DI(afl->stage_cycles[STAGE_FLIP32]));
+    snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
+             DI(IB(0), afl->stage_finds[STAGE_FLIP8]),
+             DI(IB(1), afl->stage_cycles[STAGE_FLIP8]),
+             DI(IB(2), afl->stage_finds[STAGE_FLIP16]),
+             DI(IB(3), afl->stage_cycles[STAGE_FLIP16]),
+             DI(IB(4), afl->stage_finds[STAGE_FLIP32]),
+             DI(IB(5), afl->stage_cycles[STAGE_FLIP32]));
 
   SAYF(bV bSTOP "  byte flips : " cRST "%-36s " bSTG bV bSTOP
                 "   pending : " cRST "%-10s" bSTG       bV "\n",
-       tmp, DI(afl->pending_not_fuzzed));
+       tmp, DI(IB(0), afl->pending_not_fuzzed));
 
   if (!afl->skip_deterministic)
-    sprintf(tmp, "%s/%s, %s/%s, %s/%s", DI(afl->stage_finds[STAGE_ARITH8]),
-            DI(afl->stage_cycles[STAGE_ARITH8]),
-            DI(afl->stage_finds[STAGE_ARITH16]),
-            DI(afl->stage_cycles[STAGE_ARITH16]),
-            DI(afl->stage_finds[STAGE_ARITH32]),
-            DI(afl->stage_cycles[STAGE_ARITH32]));
+    snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
+             DI(IB(0), afl->stage_finds[STAGE_ARITH8]),
+             DI(IB(1), afl->stage_cycles[STAGE_ARITH8]),
+             DI(IB(2), afl->stage_finds[STAGE_ARITH16]),
+             DI(IB(3), afl->stage_cycles[STAGE_ARITH16]),
+             DI(IB(4), afl->stage_finds[STAGE_ARITH32]),
+             DI(IB(5), afl->stage_cycles[STAGE_ARITH32]));
 
   SAYF(bV bSTOP " arithmetics : " cRST "%-36s " bSTG bV bSTOP
                 "  pend fav : " cRST "%-10s" bSTG       bV "\n",
-       tmp, DI(afl->pending_favored));
+       tmp, DI(IB(0), afl->pending_favored));
 
   if (!afl->skip_deterministic)
-    sprintf(tmp, "%s/%s, %s/%s, %s/%s", DI(afl->stage_finds[STAGE_INTEREST8]),
-            DI(afl->stage_cycles[STAGE_INTEREST8]),
-            DI(afl->stage_finds[STAGE_INTEREST16]),
-            DI(afl->stage_cycles[STAGE_INTEREST16]),
-            DI(afl->stage_finds[STAGE_INTEREST32]),
-            DI(afl->stage_cycles[STAGE_INTEREST32]));
+    sprintf(tmp, "%s/%s, %s/%s, %s/%s",
+            DI(IB(0), afl->stage_finds[STAGE_INTEREST8]),
+            DI(IB(1), afl->stage_cycles[STAGE_INTEREST8]),
+            DI(IB(2), afl->stage_finds[STAGE_INTEREST16]),
+            DI(IB(3), afl->stage_cycles[STAGE_INTEREST16]),
+            DI(IB(4), afl->stage_finds[STAGE_INTEREST32]),
+            DI(IB(5), afl->stage_cycles[STAGE_INTEREST32]));
 
   SAYF(bV bSTOP "  known ints : " cRST "%-36s " bSTG bV bSTOP
                 " own finds : " cRST "%-10s" bSTG       bV "\n",
-       tmp, DI(afl->queued_discovered));
+       tmp, DI(IB(0), afl->queued_discovered));
 
   if (!afl->skip_deterministic)
-    sprintf(tmp, "%s/%s, %s/%s, %s/%s", DI(afl->stage_finds[STAGE_EXTRAS_UO]),
-            DI(afl->stage_cycles[STAGE_EXTRAS_UO]),
-            DI(afl->stage_finds[STAGE_EXTRAS_UI]),
-            DI(afl->stage_cycles[STAGE_EXTRAS_UI]),
-            DI(afl->stage_finds[STAGE_EXTRAS_AO]),
-            DI(afl->stage_cycles[STAGE_EXTRAS_AO]));
+    snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
+             DI(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]),
+             DI(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]),
+             DI(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]),
+             DI(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]),
+             DI(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]),
+             DI(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO]));
 
   SAYF(bV bSTOP "  dictionary : " cRST "%-36s " bSTG bV bSTOP
                 "  imported : " cRST "%-10s" bSTG       bV "\n",
-       tmp, afl->sync_id ? DI(afl->queued_imported) : (u8 *)"n/a");
+       tmp, afl->sync_id ? DI(IB(0), afl->queued_imported) : (u8 *)"n/a");
 
-  sprintf(
-      tmp, "%s/%s, %s/%s, %s/%s", DI(afl->stage_finds[STAGE_HAVOC]),
-      DI(afl->stage_cycles[STAGE_HAVOC]), DI(afl->stage_finds[STAGE_SPLICE]),
-      DI(afl->stage_cycles[STAGE_SPLICE]), DI(afl->stage_finds[STAGE_RADAMSA]),
-      DI(afl->stage_cycles[STAGE_RADAMSA]));
+  snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
+           DI(IB(0), afl->stage_finds[STAGE_HAVOC]),
+           DI(IB(2), afl->stage_cycles[STAGE_HAVOC]),
+           DI(IB(3), afl->stage_finds[STAGE_SPLICE]),
+           DI(IB(4), afl->stage_cycles[STAGE_SPLICE]),
+           DI(IB(5), afl->stage_finds[STAGE_RADAMSA]),
+           DI(IB(6), afl->stage_cycles[STAGE_RADAMSA]));
 
   SAYF(bV bSTOP "   havoc/rad : " cRST "%-36s " bSTG bV bSTOP, tmp);
 
@@ -635,24 +649,26 @@ void show_stats(afl_state_t *afl) {
 
   if (afl->shm.cmplog_mode) {
 
-    sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s",
-            DI(afl->stage_finds[STAGE_PYTHON]),
-            DI(afl->stage_cycles[STAGE_PYTHON]),
-            DI(afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
-            DI(afl->stage_cycles[STAGE_CUSTOM_MUTATOR]),
-            DI(afl->stage_finds[STAGE_COLORIZATION]),
-            DI(afl->stage_cycles[STAGE_COLORIZATION]),
-            DI(afl->stage_finds[STAGE_ITS]), DI(afl->stage_cycles[STAGE_ITS]));
+    snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s, %s/%s",
+             DI(IB(0), afl->stage_finds[STAGE_PYTHON]),
+             DI(IB(1), afl->stage_cycles[STAGE_PYTHON]),
+             DI(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
+             DI(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]),
+             DI(IB(4), afl->stage_finds[STAGE_COLORIZATION]),
+             DI(IB(5), afl->stage_cycles[STAGE_COLORIZATION]),
+             DI(IB(6), afl->stage_finds[STAGE_ITS]),
+             DI(IB(7), afl->stage_cycles[STAGE_ITS]));
 
     SAYF(bV bSTOP "   custom/rq : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
          tmp);
 
   } else {
 
-    sprintf(tmp, "%s/%s, %s/%s", DI(afl->stage_finds[STAGE_PYTHON]),
-            DI(afl->stage_cycles[STAGE_PYTHON]),
-            DI(afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
-            DI(afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
+    snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s",
+             DI(IB(0), afl->stage_finds[STAGE_PYTHON]),
+             DI(IB(1), afl->stage_cycles[STAGE_PYTHON]),
+             DI(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
+             DI(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
 
     SAYF(bV bSTOP "   py/custom : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
          tmp);
@@ -668,7 +684,7 @@ void show_stats(afl_state_t *afl) {
     sprintf(tmp, "%0.02f%%/%s, ",
             ((double)(afl->bytes_trim_in - afl->bytes_trim_out)) * 100 /
                 afl->bytes_trim_in,
-            DI(afl->trim_execs));
+            DI(IB(0), afl->trim_execs));
 
   }
 
@@ -693,8 +709,8 @@ void show_stats(afl_state_t *afl) {
 
   if (afl->mutator) {
 
-    sprintf(tmp, "%s/%s", DI(afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
-            DI(afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
+    sprintf(tmp, "%s/%s", DI(IB(0), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
+            DI(IB(1), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
     SAYF(bV bSTOP " custom mut. : " cRST "%-36s " bSTG bV RESET_G1, tmp);
 
   } else {
@@ -749,6 +765,8 @@ void show_stats(afl_state_t *afl) {
   /* Last line */
   SAYF(SET_G1 "\n" bSTG bLB bH30 bH20 bH2 bRB bSTOP cRST RESET_G1);
 
+#undef IB
+
   /* Hallelujah! */
 
   fflush(0);
@@ -767,6 +785,9 @@ void show_init_stats(afl_state_t *afl) {
   u64                 avg_us = 0;
   u32                 max_len = 0;
 
+  u8 int_buf[12][16];
+#define IB(i) int_buf[(i)], sizeof(int_buf[(i)])
+
   if (afl->total_cal_cycles) avg_us = afl->total_cal_us / afl->total_cal_cycles;
 
   while (q) {
@@ -802,10 +823,10 @@ void show_init_stats(afl_state_t *afl) {
 
     if (max_len > 50 * 1024)
       WARNF(cLRD "Some test cases are huge (%s) - see %s/perf_tips.md!",
-            DMS(max_len), doc_path);
+            DMS(IB(0), max_len), doc_path);
     else if (max_len > 10 * 1024)
-      WARNF("Some test cases are big (%s) - see %s/perf_tips.md.", DMS(max_len),
-            doc_path);
+      WARNF("Some test cases are big (%s) - see %s/perf_tips.md.",
+            DMS(IB(0), max_len), doc_path);
 
     if (afl->useless_at_start && !afl->in_bitmap)
       WARNF(cLRD "Some test cases look useless. Consider using a smaller set.");
@@ -829,7 +850,7 @@ void show_init_stats(afl_state_t *afl) {
       max_bits,
       ((double)afl->total_bitmap_size) /
           (afl->total_bitmap_entries ? afl->total_bitmap_entries : 1),
-      DI(min_us), DI(max_us), DI(avg_us));
+      DI(IB(0), min_us), DI(IB(1), max_us), DI(IB(2), avg_us));
 
   if (!afl->timeout_given) {
 
@@ -873,6 +894,7 @@ void show_init_stats(afl_state_t *afl) {
     afl->hang_tmout = MIN(EXEC_TIMEOUT, afl->fsrv.exec_tmout * 2 + 100);
 
   OKF("All set and ready to roll!");
+#undef IB
 
 }
 
-- 
cgit 1.4.1


From c6db05c5ae11e2a33df8aa450d6ccac7d6109a02 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sat, 21 Mar 2020 21:10:38 +0100
Subject: test.sh with -no-pie

---
 Makefile               | 18 +++++++++++++-----
 README.md              |  1 +
 include/afl-fuzz.h     |  3 +++
 src/afl-fuzz-bitmap.c  |  1 +
 src/afl-fuzz-globals.c |  2 ++
 src/afl-fuzz-init.c    |  1 +
 src/afl-fuzz-one.c     |  2 ++
 src/afl-fuzz-run.c     |  2 ++
 src/afl-fuzz.c         |  2 ++
 test/test.sh           | 10 +++++-----
 10 files changed, 32 insertions(+), 10 deletions(-)

(limited to 'src/afl-fuzz-run.c')

diff --git a/Makefile b/Makefile
index 018efe29..9913c603 100644
--- a/Makefile
+++ b/Makefile
@@ -151,6 +151,18 @@ ifdef STATIC
   LDFLAGS += -lm -lpthread -lz -lutil
 endif
 
+ifdef ASAN_BUILD
+  $(info Compiling ASAN version of binaries)
+  CFLAGS+=-fsanitize=address
+  LDFLAGS+=-fsanitize=address
+endif
+
+ifdef PROFILING
+  $(info Compiling profiling version of binaries)
+  CFLAGS+=-pg
+  LDFLAGS+=-pg
+endif
+
 ifeq "$(shell echo '$(HASH)include <sys/ipc.h>@$(HASH)include <sys/shm.h>@int main() { int _id = shmget(IPC_PRIVATE, 65536, IPC_CREAT | IPC_EXCL | 0600); shmctl(_id, IPC_RMID, 0); return 0;}' | tr @ '\n' | $(CC) -x c - -o .test2 2>/dev/null && echo 1 || echo 0 ; rm -f .test2 )" "1"
 	SHMAT_OK=1
 else
@@ -165,11 +177,6 @@ ifeq "$(TEST_MMAP)" "1"
 	LDFLAGS+=-Wno-deprecated-declarations
 endif
 
-ifdef ASAN_BUILD
-  CFLAGS+=-fsanitize=address
-	LDFLAGS+=-fsanitize=address
-endif
-
 all:	test_x86 test_shm test_python ready $(PROGS) afl-as test_build all_done
 
 man:    $(MANPAGES) 
@@ -208,6 +215,7 @@ help:
 	@echo "=========================================="
 	@echo STATIC - compile AFL++ static
 	@echo ASAN_BUILD - compiles with memory sanitizer for debug purposes
+	@echo PROFILING - compile afl-fuzz with profiling information
 	@echo AFL_NO_X86 - if compiling on non-intel/amd platforms
 	@echo "=========================================="
 	@echo e.g.: make ASAN_BUILD=1
diff --git a/README.md b/README.md
index 1476b440..8982d76a 100644
--- a/README.md
+++ b/README.md
@@ -174,6 +174,7 @@ These build options exist:
 
 * STATIC - compile AFL++ static
 * ASAN_BUILD - compiles with memory sanitizer for debug purposes
+* PROFILING - compile with profiling information (gprof)
 * AFL_NO_X86 - if compiling on non-intel/amd platforms
 * LLVM_CONFIG - if your distro doesn't use the standard name for llvm-config (e.g. Debian)
 
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 1d83f335..ef68ba5d 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -118,6 +118,9 @@ extern s16 interesting_16[INTERESTING_8_LEN + INTERESTING_16_LEN];
 extern s32
     interesting_32[INTERESTING_8_LEN + INTERESTING_16_LEN + INTERESTING_32_LEN];
 
+extern u32 bmcnt, initcnt, one1cnt, one2cnt, runcnt;
+
+
 struct queue_entry {
 
   u8 *fname;                            /* File name for the test case      */
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 86474adc..06078fc2 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -578,6 +578,7 @@ u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
     /* Try to calibrate inline; this also calls update_bitmap_score() when
        successful. */
 
+    bmcnt++;
     res = calibrate_case(afl, afl->queue_top, mem, afl->queue_cycle - 1, 0);
 
     if (res == FAULT_ERROR) FATAL("Unable to execute target application");
diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c
index 88633a1b..108952e4 100644
--- a/src/afl-fuzz-globals.c
+++ b/src/afl-fuzz-globals.c
@@ -38,6 +38,8 @@ u8 *doc_path = NULL;                    /* gath to documentation dir        */
 
 /* Initialize MOpt "globals" for this afl state */
 
+u32 bmcnt, initcnt, one1cnt, one2cnt, runcnt;
+
 static void init_mopt_globals(afl_state_t *afl) {
 
   MOpt_globals_t *core = &afl->mopt_globals_core;
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index c3f3fac0..456415f9 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -473,6 +473,7 @@ void perform_dry_run(afl_state_t *afl) {
 
     close(fd);
 
+    initcnt++;
     res = calibrate_case(afl, q, use_mem, 0, 1);
     ck_free(use_mem);
 
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index c1458dbb..5211d565 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -442,6 +442,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
     if (afl->queue_cur->cal_failed < CAL_CHANCES) {
 
+      one1cnt++;
       res =
           calibrate_case(afl, afl->queue_cur, in_buf, afl->queue_cycle - 1, 0);
 
@@ -2460,6 +2461,7 @@ u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
 
     if (afl->queue_cur->cal_failed < CAL_CHANCES) {
 
+      one2cnt++;
       res =
           calibrate_case(afl, afl->queue_cur, in_buf, afl->queue_cycle - 1, 0);
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index c8153857..6fbb7539 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -303,6 +303,8 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
      trying to calibrate already-added finds. This helps avoid trouble due
      to intermittent latency. */
 
+  runcnt++;
+
   if (!from_queue || afl->resuming_fuzz)
     use_tmout = MAX(afl->fsrv.exec_tmout + CAL_TMOUT_ADD,
                     afl->fsrv.exec_tmout * CAL_TMOUT_PERC / 100);
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 15caa65f..9692c1cb 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1196,6 +1196,8 @@ stop_fuzzing:
 
   OKF("We're done here. Have a nice day!\n");
 
+printf("%u %u %u %u %u\n", bmcnt, initcnt, one1cnt, one2cnt, runcnt);
+
   exit(0);
 
 }
diff --git a/test/test.sh b/test/test.sh
index 5246a3ec..19231e50 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -653,7 +653,7 @@ test -e ../libradamsa.so && {
 
 $ECHO "$BLUE[*] Testing: qemu_mode"
 test -e ../afl-qemu-trace && {
-  gcc -pie -fPIE -o test-instr ../test-instr.c
+  gcc -no-pie -fPIE -o test-instr ../test-instr.c
   gcc -o test-compcov test-compcov.c
   test -e test-instr -a -e test-compcov && {
     {
@@ -678,8 +678,8 @@ test -e ../afl-qemu-trace && {
       $ECHO "$GREY[*] running afl-fuzz for qemu_mode AFL_ENTRYPOINT, this will take approx 6 seconds"
       {
         {
-          export AFL_ENTRYPOINT=`expr 0x4$(nm test-instr | grep "T main" | awk '{print $1}' | sed 's/^.......//')`
-          $ECHO AFL_ENTRYPOINT=$AFL_ENTRYPOINT - $(m test-instr | grep "T main") - $(file ./test-instr)
+          export AFL_ENTRYPOINT=`expr 0x4$(nm test-instr | grep "T main" | awk '{print $1}' )`
+          #$ECHO AFL_ENTRYPOINT=$AFL_ENTRYPOINT - $(nm test-instr | grep "T main") - $(file ./test-instr)
           ../afl-fuzz -m ${MEM_LIMIT} -V2 -Q -i in -o out -- ./test-instr
           unset AFL_ENTRYPOINT
         } >>errors 2>&1
@@ -727,9 +727,9 @@ test -e ../afl-qemu-trace && {
       test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc" -o "$SYS" = "aarch64" -o ! "${SYS%%arm*}" && {
         $ECHO "$GREY[*] running afl-fuzz for persistent qemu_mode, this will take approx 10 seconds"
         {
-          export AFL_QEMU_PERSISTENT_ADDR=`expr 0x4$(nm test-instr | grep "T main" | awk '{print $1}' | sed 's/^.......//')`
+          export AFL_QEMU_PERSISTENT_ADDR=`expr 0x4$(nm test-instr | grep "T main" | awk '{print $1}' )`
           export AFL_QEMU_PERSISTENT_GPR=1
-          $ECHO "Info: AFL_QEMU_PERSISTENT_ADDR=$AFL_QEMU_PERSISTENT_ADDR <= $(nm test-instr | grep "T main" | awk '{print $1}')"
+          #$ECHO "Info: AFL_QEMU_PERSISTENT_ADDR=$AFL_QEMU_PERSISTENT_ADDR <= $(nm test-instr | grep "T main" | awk '{print $1}')"
           file test-instr
           ../afl-fuzz -m ${MEM_LIMIT} -V10 -Q -i in -o out -- ./test-instr
           unset AFL_QEMU_PERSISTENT_ADDR
-- 
cgit 1.4.1


From f8d717d195c526ded57005ef11cf5662d1641a77 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sat, 21 Mar 2020 21:42:32 +0100
Subject: test.sh fix

---
 src/afl-fuzz-run.c |  4 ++--
 test/test.sh       | 11 ++++++-----
 2 files changed, 8 insertions(+), 7 deletions(-)

(limited to 'src/afl-fuzz-run.c')

diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 6fbb7539..7a789cfb 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -303,8 +303,6 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
      trying to calibrate already-added finds. This helps avoid trouble due
      to intermittent latency. */
 
-  runcnt++;
-
   if (!from_queue || afl->resuming_fuzz)
     use_tmout = MAX(afl->fsrv.exec_tmout + CAL_TMOUT_ADD,
                     afl->fsrv.exec_tmout * CAL_TMOUT_PERC / 100);
@@ -440,6 +438,8 @@ abort_calibration:
 
   if (!first_run) show_stats(afl);
 
+  runcnt++;
+
   return fault;
 
 }
diff --git a/test/test.sh b/test/test.sh
index 19231e50..606fb5ac 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -653,7 +653,7 @@ test -e ../libradamsa.so && {
 
 $ECHO "$BLUE[*] Testing: qemu_mode"
 test -e ../afl-qemu-trace && {
-  gcc -no-pie -fPIE -o test-instr ../test-instr.c
+  gcc -no-pie -o test-instr ../test-instr.c
   gcc -o test-compcov test-compcov.c
   test -e test-instr -a -e test-compcov && {
     {
@@ -678,8 +678,8 @@ test -e ../afl-qemu-trace && {
       $ECHO "$GREY[*] running afl-fuzz for qemu_mode AFL_ENTRYPOINT, this will take approx 6 seconds"
       {
         {
-          export AFL_ENTRYPOINT=`expr 0x4$(nm test-instr | grep "T main" | awk '{print $1}' )`
-          #$ECHO AFL_ENTRYPOINT=$AFL_ENTRYPOINT - $(nm test-instr | grep "T main") - $(file ./test-instr)
+          export AFL_ENTRYPOINT=`expr 0x$(nm test-instr | grep "T main" | awk '{print $1}' )`
+          $ECHO AFL_ENTRYPOINT=$AFL_ENTRYPOINT - $(nm test-instr | grep "T main") - $(file ./test-instr)
           ../afl-fuzz -m ${MEM_LIMIT} -V2 -Q -i in -o out -- ./test-instr
           unset AFL_ENTRYPOINT
         } >>errors 2>&1
@@ -727,9 +727,10 @@ test -e ../afl-qemu-trace && {
       test "$SYS" = "i686" -o "$SYS" = "x86_64" -o "$SYS" = "amd64" -o "$SYS" = "i86pc" -o "$SYS" = "aarch64" -o ! "${SYS%%arm*}" && {
         $ECHO "$GREY[*] running afl-fuzz for persistent qemu_mode, this will take approx 10 seconds"
         {
-          export AFL_QEMU_PERSISTENT_ADDR=`expr 0x4$(nm test-instr | grep "T main" | awk '{print $1}' )`
+          export AFL_QEMU_PERSISTENT_ADDR=`expr 0x$(nm test-instr | grep "T main" | awk '{print $1}' | sed 's/0*//' )`
           export AFL_QEMU_PERSISTENT_GPR=1
-          #$ECHO "Info: AFL_QEMU_PERSISTENT_ADDR=$AFL_QEMU_PERSISTENT_ADDR <= $(nm test-instr | grep "T main" | awk '{print $1}')"
+          $ECHO "Info: AFL_QEMU_PERSISTENT_ADDR=$AFL_QEMU_PERSISTENT_ADDR <= $(nm test-instr | grep "T main" | awk '{print $1}')"
+          env|grep AFL_|sort
           file test-instr
           ../afl-fuzz -m ${MEM_LIMIT} -V10 -Q -i in -o out -- ./test-instr
           unset AFL_QEMU_PERSISTENT_ADDR
-- 
cgit 1.4.1


From 54d01fec43c8b649fdc04350262d5982f1e4ae85 Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Sat, 21 Mar 2020 21:43:58 +0100
Subject: moved string formatting to header

---
 include/afl-fuzz.h      |   7 --
 include/common.h        | 167 +++++++++++++++++++++++++++++++++++++++++
 src/afl-forkserver.c    |  73 ++----------------
 src/afl-fuzz-bitmap.c   |   6 +-
 src/afl-fuzz-cmplog.c   |   9 ++-
 src/afl-fuzz-extras.c   |  24 +++---
 src/afl-fuzz-init.c     |  11 +--
 src/afl-fuzz-misc.c     | 187 ----------------------------------------------
 src/afl-fuzz-mutators.c |   4 +-
 src/afl-fuzz-run.c      |   6 +-
 src/afl-fuzz-stats.c    | 195 +++++++++++++++++++++++++-----------------------
 11 files changed, 307 insertions(+), 382 deletions(-)
 delete mode 100644 src/afl-fuzz-misc.c

(limited to 'src/afl-fuzz-run.c')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index ef68ba5d..643d58bd 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -804,13 +804,6 @@ u8 *describe_op(afl_state_t *, u8);
 u8 save_if_interesting(afl_state_t *, void *, u32, u8);
 u8 has_new_bits(afl_state_t *, u8 *);
 
-/* Misc */
-
-u8 *DI(u8 *, size_t, u64);
-u8 *DF(u8 *, size_t, double);
-u8 *DMS(u8 *, size_t, u64);
-u8 *DTD(u8 *, size_t, u64, u64);
-
 /* Extras */
 
 void load_extras_file(afl_state_t *, u8 *, u32 *, u32 *, u32);
diff --git a/include/common.h b/include/common.h
index 28c11049..11ae1e66 100644
--- a/include/common.h
+++ b/include/common.h
@@ -27,10 +27,16 @@
 #ifndef __AFLCOMMON_H
 #define __AFLCOMMON_H
 
+#include <stdio.h>
+#include <string.h>
 #include <sys/time.h>
 #include "types.h"
 #include "stdbool.h"
 
+/* STRINGIFY_VAL_SIZE_MAX will fit all stringify_ strings. */
+
+#define STRINGIFY_VAL_SIZE_MAX (16)
+
 void detect_file_args(char **argv, u8 *prog_in, u8 *use_stdin);
 void check_environment_vars(char **env);
 
@@ -67,5 +73,166 @@ static u64 get_cur_time_us(void) {
 
 }
 
+/* Describe integer. The buf should be
+   at least 6 bytes to fit all ints we randomly see.
+   Will return buf for convenience. */
+
+static u8 *stringify_int(u8 *buf, size_t len, u64 val) {
+
+#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast)     \
+  do {                                                     \
+                                                           \
+    if (val < (_divisor) * (_limit_mult)) {                \
+                                                           \
+      snprintf(buf, len, _fmt, ((_cast)val) / (_divisor)); \
+      return buf;                                          \
+                                                           \
+    }                                                      \
+                                                           \
+  } while (0)
+
+  /* 0-9999 */
+  CHK_FORMAT(1, 10000, "%llu", u64);
+
+  /* 10.0k - 99.9k */
+  CHK_FORMAT(1000, 99.95, "%0.01fk", double);
+
+  /* 100k - 999k */
+  CHK_FORMAT(1000, 1000, "%lluk", u64);
+
+  /* 1.00M - 9.99M */
+  CHK_FORMAT(1000 * 1000, 9.995, "%0.02fM", double);
+
+  /* 10.0M - 99.9M */
+  CHK_FORMAT(1000 * 1000, 99.95, "%0.01fM", double);
+
+  /* 100M - 999M */
+  CHK_FORMAT(1000 * 1000, 1000, "%lluM", u64);
+
+  /* 1.00G - 9.99G */
+  CHK_FORMAT(1000LL * 1000 * 1000, 9.995, "%0.02fG", double);
+
+  /* 10.0G - 99.9G */
+  CHK_FORMAT(1000LL * 1000 * 1000, 99.95, "%0.01fG", double);
+
+  /* 100G - 999G */
+  CHK_FORMAT(1000LL * 1000 * 1000, 1000, "%lluG", u64);
+
+  /* 1.00T - 9.99G */
+  CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 9.995, "%0.02fT", double);
+
+  /* 10.0T - 99.9T */
+  CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 99.95, "%0.01fT", double);
+
+  /* 100T+ */
+  strncpy(buf, "infty", len);
+  buf[len - 1] = '\0';
+
+  return buf;
+
+}
+
+/* Describe float. Similar as int. */
+
+static u8 *stringify_float(u8 *buf, size_t len, double val) {
+
+  if (val < 99.995) {
+
+    snprintf(buf, len, "%0.02f", val);
+
+  } else if (val < 999.95) {
+
+    snprintf(buf, len, "%0.01f", val);
+
+  } else {
+
+    stringify_int(buf, len, (u64)val);
+
+  }
+
+  return buf;
+
+}
+
+/* Describe integer as memory size. */
+
+static u8 *stringify_mem_size(u8 *buf, size_t len, u64 val) {
+
+  /* 0-9999 */
+  CHK_FORMAT(1, 10000, "%llu B", u64);
+
+  /* 10.0k - 99.9k */
+  CHK_FORMAT(1024, 99.95, "%0.01f kB", double);
+
+  /* 100k - 999k */
+  CHK_FORMAT(1024, 1000, "%llu kB", u64);
+
+  /* 1.00M - 9.99M */
+  CHK_FORMAT(1024 * 1024, 9.995, "%0.02f MB", double);
+
+  /* 10.0M - 99.9M */
+  CHK_FORMAT(1024 * 1024, 99.95, "%0.01f MB", double);
+
+  /* 100M - 999M */
+  CHK_FORMAT(1024 * 1024, 1000, "%llu MB", u64);
+
+  /* 1.00G - 9.99G */
+  CHK_FORMAT(1024LL * 1024 * 1024, 9.995, "%0.02f GB", double);
+
+  /* 10.0G - 99.9G */
+  CHK_FORMAT(1024LL * 1024 * 1024, 99.95, "%0.01f GB", double);
+
+  /* 100G - 999G */
+  CHK_FORMAT(1024LL * 1024 * 1024, 1000, "%llu GB", u64);
+
+  /* 1.00T - 9.99G */
+  CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 9.995, "%0.02f TB", double);
+
+  /* 10.0T - 99.9T */
+  CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 99.95, "%0.01f TB", double);
+
+#undef CHK_FORMAT
+
+  /* 100T+ */
+  strncpy(buf, "infty", len - 1);
+  buf[len - 1] = '\0';
+
+  return buf;
+
+}
+
+/* Describe time delta as string.
+   Returns a pointer to buf for convenience. */
+
+static u8 *stringify_time_diff(u8 *buf, size_t len, u64 cur_ms,
+                                      u64 event_ms) {
+
+  u64 delta;
+  s32 t_d, t_h, t_m, t_s;
+  u8  val_buf[STRINGIFY_VAL_SIZE_MAX];
+
+  if (!event_ms) {
+
+    snprintf(buf, len, "none seen yet");
+
+  } else {
+
+    delta = cur_ms - event_ms;
+
+    t_d = delta / 1000 / 60 / 60 / 24;
+    t_h = (delta / 1000 / 60 / 60) % 24;
+    t_m = (delta / 1000 / 60) % 60;
+    t_s = (delta / 1000) % 60;
+
+    stringify_int(val_buf, sizeof(val_buf), t_d);
+    snprintf(buf, len, "%s days, %d hrs, %d min, %d sec", val_buf, t_h, t_m,
+             t_s);
+
+  }
+
+  return buf;
+
+}
+
 #endif
 
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 75b69178..2dd7a9f0 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -51,65 +51,6 @@
 
 extern u8 *doc_path;
 
-static void forkserver_stringify_int(u8 *buf, size_t len, u64 val) {
-
-  u8 cur = 0;
-
-#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast)     \
-  do {                                                     \
-                                                           \
-    if (val < (_divisor) * (_limit_mult)) {                \
-                                                           \
-      snprintf(buf, len, _fmt, ((_cast)val) / (_divisor)); \
-      return;                                              \
-                                                           \
-    }                                                      \
-                                                           \
-  } while (0)
-
-  cur = (cur + 1) % 12;
-
-  /* 0-9999 */
-  CHK_FORMAT(1, 10000, "%llu B", u64);
-
-  /* 10.0k - 99.9k */
-  CHK_FORMAT(1024, 99.95, "%0.01f kB", double);
-
-  /* 100k - 999k */
-  CHK_FORMAT(1024, 1000, "%llu kB", u64);
-
-  /* 1.00M - 9.99M */
-  CHK_FORMAT(1024 * 1024, 9.995, "%0.02f MB", double);
-
-  /* 10.0M - 99.9M */
-  CHK_FORMAT(1024 * 1024, 99.95, "%0.01f MB", double);
-
-  /* 100M - 999M */
-  CHK_FORMAT(1024 * 1024, 1000, "%llu MB", u64);
-
-  /* 1.00G - 9.99G */
-  CHK_FORMAT(1024LL * 1024 * 1024, 9.995, "%0.02f GB", double);
-
-  /* 10.0G - 99.9G */
-  CHK_FORMAT(1024LL * 1024 * 1024, 99.95, "%0.01f GB", double);
-
-  /* 100G - 999G */
-  CHK_FORMAT(1024LL * 1024 * 1024, 1000, "%llu GB", u64);
-
-  /* 1.00T - 9.99G */
-  CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 9.995, "%0.02f TB", double);
-
-  /* 10.0T - 99.9T */
-  CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 99.95, "%0.01f TB", double);
-
-#undef CHK_FORMAT
-
-  /* 100T+ */
-  strncpy(buf, "infty", len - 1);
-  buf[len - 1] = '\0';
-
-}
-
 list_t fsrv_list = {.element_prealloc_count = 0};
 
 /* Initializes the struct */
@@ -453,9 +394,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv) {
 
     } else {
 
-      u8 mem_limit_buf[16];
-      forkserver_stringify_int(mem_limit_buf, sizeof(mem_limit_buf),
-                               fsrv->mem_limit << 20);
+      u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
 
       SAYF("\n" cLRD "[-] " cRST
            "Whoops, the target binary crashed suddenly, "
@@ -489,7 +428,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv) {
            "options\n"
            "      fail, poke <afl-users@googlegroups.com> for troubleshooting "
            "tips.\n",
-           mem_limit_buf, fsrv->mem_limit - 1);
+           stringify_mem_size(val_buf, sizeof(val_buf), fsrv->mem_limit << 20),
+           fsrv->mem_limit - 1);
 
     }
 
@@ -524,9 +464,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv) {
 
   } else {
 
-    u8 mem_limit_buf[16];
-    forkserver_stringify_int(mem_limit_buf, sizeof(mem_limit_buf),
-                             fsrv->mem_limit << 20);
+    u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
 
     SAYF(
         "\n" cLRD "[-] " cRST
@@ -559,7 +497,8 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv) {
               "never\n"
               "      reached before the program terminates.\n\n"
             : "",
-        mem_limit_buf, fsrv->mem_limit - 1);
+        stringify_int(val_buf, sizeof(val_buf), fsrv->mem_limit << 20),
+        fsrv->mem_limit - 1);
 
   }
 
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 06078fc2..6375cb57 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -465,7 +465,7 @@ static void write_crash_readme(afl_state_t *afl) {
   s32   fd;
   FILE *f;
 
-  u8 int_buf[16];
+  u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
 
   fd = open(fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
   ck_free(fn);
@@ -504,8 +504,8 @@ static void write_crash_readme(afl_state_t *afl) {
       "  https://github.com/AFLplusplus/AFLplusplus\n\n",
 
       afl->orig_cmdline,
-      DMS(int_buf, sizeof(int_buf),
-          afl->fsrv.mem_limit << 20));                     /* ignore errors */
+      stringify_mem_size(val_buf, sizeof(val_buf),
+                         afl->fsrv.mem_limit << 20));      /* ignore errors */
 
   fclose(f);
 
diff --git a/src/afl-fuzz-cmplog.c b/src/afl-fuzz-cmplog.c
index 5f7909cc..6c6f05ac 100644
--- a/src/afl-fuzz-cmplog.c
+++ b/src/afl-fuzz-cmplog.c
@@ -264,7 +264,7 @@ void init_cmplog_forkserver(afl_state_t *afl) {
 
     } else {
 
-      u8 int_buf[16];
+      u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
 
       SAYF("\n" cLRD "[-] " cRST
            "Whoops, the target binary crashed suddenly, "
@@ -298,7 +298,8 @@ void init_cmplog_forkserver(afl_state_t *afl) {
            "options\n"
            "      fail, poke <afl-users@googlegroups.com> for troubleshooting "
            "tips.\n",
-           DMS(int_buf, sizeof(int_buf), afl->fsrv.mem_limit << 20),
+           stringify_mem_size(val_buf, sizeof(val_buf),
+                              afl->fsrv.mem_limit << 20),
            afl->fsrv.mem_limit - 1);
 
     }
@@ -334,7 +335,7 @@ void init_cmplog_forkserver(afl_state_t *afl) {
 
   } else {
 
-    u8 int_buf[16];
+    u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
 
     SAYF(
         "\n" cLRD "[-] " cRST
@@ -367,7 +368,7 @@ void init_cmplog_forkserver(afl_state_t *afl) {
               "never\n"
               "      reached before the program terminates.\n\n"
             : "",
-        DMS(int_buf, sizeof(int_buf), afl->fsrv.mem_limit << 20),
+        stringify_mem_size(val_buf, sizeof(val_buf), afl->fsrv.mem_limit << 20),
         afl->fsrv.mem_limit - 1);
 
   }
diff --git a/src/afl-fuzz-extras.c b/src/afl-fuzz-extras.c
index 256489f5..e9995d08 100644
--- a/src/afl-fuzz-extras.c
+++ b/src/afl-fuzz-extras.c
@@ -55,7 +55,7 @@ void load_extras_file(afl_state_t *afl, u8 *fname, u32 *min_len, u32 *max_len,
   u8 *  lptr;
   u32   cur_line = 0;
 
-  u8 int_bufs[2][16];
+  u8 val_bufs[2][STRINGIFY_VAL_SIZE_MAX];
 
   f = fopen(fname, "r");
 
@@ -172,9 +172,10 @@ void load_extras_file(afl_state_t *afl, u8 *fname, u32 *min_len, u32 *max_len,
     afl->extras[afl->extras_cnt].len = klen;
 
     if (afl->extras[afl->extras_cnt].len > MAX_DICT_FILE)
-      FATAL("Keyword too big in line %u (%s, limit is %s)", cur_line,
-            DMS(int_bufs[0], sizeof(int_bufs[0]), klen),
-            DMS(int_bufs[1], sizeof(int_bufs[1]), MAX_DICT_FILE));
+      FATAL(
+          "Keyword too big in line %u (%s, limit is %s)", cur_line,
+          stringify_mem_size(val_bufs[0], sizeof(val_bufs[0]), klen),
+          stringify_mem_size(val_bufs[1], sizeof(val_bufs[1]), MAX_DICT_FILE));
 
     if (*min_len > klen) *min_len = klen;
     if (*max_len < klen) *max_len = klen;
@@ -196,7 +197,7 @@ void load_extras(afl_state_t *afl, u8 *dir) {
   u32            min_len = MAX_DICT_FILE, max_len = 0, dict_level = 0;
   u8 *           x;
 
-  u8 int_bufs[2][16];
+  u8 val_bufs[2][STRINGIFY_VAL_SIZE_MAX];
 
   /* If the name ends with @, extract level and continue. */
 
@@ -243,9 +244,10 @@ void load_extras(afl_state_t *afl, u8 *dir) {
     }
 
     if (st.st_size > MAX_DICT_FILE)
-      FATAL("Extra '%s' is too big (%s, limit is %s)", fn,
-            DMS(int_bufs[0], sizeof(int_bufs[0]), st.st_size),
-            DMS(int_bufs[1], sizeof(int_bufs[1]), MAX_DICT_FILE));
+      FATAL(
+          "Extra '%s' is too big (%s, limit is %s)", fn,
+          stringify_mem_size(val_bufs[0], sizeof(val_bufs[0]), st.st_size),
+          stringify_mem_size(val_bufs[1], sizeof(val_bufs[1]), MAX_DICT_FILE));
 
     if (min_len > st.st_size) min_len = st.st_size;
     if (max_len < st.st_size) max_len = st.st_size;
@@ -279,12 +281,12 @@ check_and_sort:
         compare_extras_len);
 
   OKF("Loaded %u extra tokens, size range %s to %s.", afl->extras_cnt,
-      DMS(int_bufs[0], sizeof(int_bufs[0]), min_len),
-      DMS(int_bufs[1], sizeof(int_bufs[1]), max_len));
+      stringify_mem_size(val_bufs[0], sizeof(val_bufs[0]), min_len),
+      stringify_mem_size(val_bufs[1], sizeof(val_bufs[1]), max_len));
 
   if (max_len > 32)
     WARNF("Some tokens are relatively large (%s) - consider trimming.",
-          DMS(int_bufs[0], sizeof(int_bufs[0]), max_len));
+          stringify_mem_size(val_bufs[0], sizeof(val_bufs[0]), max_len));
 
   if (afl->extras_cnt > MAX_DET_EXTRAS)
     WARNF("More than %d tokens - will use them probabilistically.",
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 456415f9..918801d0 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -323,7 +323,7 @@ void read_testcases(afl_state_t *afl) {
   u32             i;
   u8 *            fn1;
 
-  u8 int_buf[2][16];
+  u8 val_buf[2][STRINGIFY_VAL_SIZE_MAX];
 
   /* Auto-detect non-in-place resumption attempts. */
 
@@ -392,8 +392,8 @@ void read_testcases(afl_state_t *afl) {
 
     if (st.st_size > MAX_FILE)
       FATAL("Test case '%s' is too big (%s, limit is %s)", fn2,
-            DMS(int_buf[0], sizeof(int_buf[0]), st.st_size),
-            DMS(int_buf[1], sizeof(int_buf[1]), MAX_FILE));
+            stringify_mem_size(val_buf[0], sizeof(val_buf[0]), st.st_size),
+            stringify_mem_size(val_buf[1], sizeof(val_buf[1]), MAX_FILE));
 
     /* Check for metadata that indicates that deterministic fuzzing
        is complete for this entry. We don't want to repeat deterministic
@@ -557,7 +557,7 @@ void perform_dry_run(afl_state_t *afl) {
 
         if (afl->fsrv.mem_limit) {
 
-          u8 int_buf[16];
+          u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
 
           SAYF("\n" cLRD "[-] " cRST
                "Oops, the program crashed with one of the test cases provided. "
@@ -599,7 +599,8 @@ void perform_dry_run(afl_state_t *afl) {
                "other options\n"
                "      fail, poke <afl-users@googlegroups.com> for "
                "troubleshooting tips.\n",
-               DMS(int_buf, sizeof(int_buf), afl->fsrv.mem_limit << 20),
+               stringify_mem_size(val_buf, sizeof(val_buf),
+                                  afl->fsrv.mem_limit << 20),
                afl->fsrv.mem_limit - 1, doc_path);
 
         } else {
diff --git a/src/afl-fuzz-misc.c b/src/afl-fuzz-misc.c
deleted file mode 100644
index 20a7c6d0..00000000
--- a/src/afl-fuzz-misc.c
+++ /dev/null
@@ -1,187 +0,0 @@
-/*
-   american fuzzy lop++ - misc stuffs from Mordor
-   ----------------------------------------------
-
-   Originally written by Michal Zalewski
-
-   Now maintained by Marc Heuse <mh@mh-sec.de>,
-                        Heiko Eißfeldt <heiko.eissfeldt@hexco.de> and
-                        Andrea Fioraldi <andreafioraldi@gmail.com>
-
-   Copyright 2016, 2017 Google Inc. All rights reserved.
-   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   This is the real deal: the program takes an instrumented binary and
-   attempts a variety of basic fuzzing tricks, paying close attention to
-   how they affect the execution path.
-
- */
-
-#include "afl-fuzz.h"
-
-/* Describe integer. The buf should be
-   at least 6 bytes to fit all ints we randomly see.
-   Will return buf for convenience. */
-
-u8 *DI(u8 *buf, size_t len, u64 val) {
-\
-#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast)     \
-  do {                                                     \
-                                                           \
-    if (val < (_divisor) * (_limit_mult)) {                \
-                                                           \
-      snprintf(buf, len, _fmt, ((_cast)val) / (_divisor)); \
-      return buf;                                          \
-                                                           \
-    }                                                      \
-                                                           \
-  } while (0)
-
-  /* 0-9999 */
-  CHK_FORMAT(1, 10000, "%llu", u64);
-
-  /* 10.0k - 99.9k */
-  CHK_FORMAT(1000, 99.95, "%0.01fk", double);
-
-  /* 100k - 999k */
-  CHK_FORMAT(1000, 1000, "%lluk", u64);
-
-  /* 1.00M - 9.99M */
-  CHK_FORMAT(1000 * 1000, 9.995, "%0.02fM", double);
-
-  /* 10.0M - 99.9M */
-  CHK_FORMAT(1000 * 1000, 99.95, "%0.01fM", double);
-
-  /* 100M - 999M */
-  CHK_FORMAT(1000 * 1000, 1000, "%lluM", u64);
-
-  /* 1.00G - 9.99G */
-  CHK_FORMAT(1000LL * 1000 * 1000, 9.995, "%0.02fG", double);
-
-  /* 10.0G - 99.9G */
-  CHK_FORMAT(1000LL * 1000 * 1000, 99.95, "%0.01fG", double);
-
-  /* 100G - 999G */
-  CHK_FORMAT(1000LL * 1000 * 1000, 1000, "%lluG", u64);
-
-  /* 1.00T - 9.99G */
-  CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 9.995, "%0.02fT", double);
-
-  /* 10.0T - 99.9T */
-  CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 99.95, "%0.01fT", double);
-
-  /* 100T+ */
-  strncpy(buf, "infty", len);
-  buf[len - 1] = '\0';
-
-  return buf;
-
-}
-
-/* Describe float. Similar as int. */
-
-u8 *DF(u8 *buf, size_t len, double val) {
-
-  if (val < 99.995) {
-
-    snprintf(buf, len, "%0.02f", val);
-
-  } else if (val < 999.95) {
-
-    snprintf(buf, len, "%0.01f", val);
-
-  } else {
-
-    DI(buf, len, (u64)val);
-
-  }
-
-  return buf;
-
-}
-
-/* Describe integer as memory size. */
-
-u8 *DMS(u8 *buf, size_t len, u64 val) {
-
-  /* 0-9999 */
-  CHK_FORMAT(1, 10000, "%llu B", u64);
-
-  /* 10.0k - 99.9k */
-  CHK_FORMAT(1024, 99.95, "%0.01f kB", double);
-
-  /* 100k - 999k */
-  CHK_FORMAT(1024, 1000, "%llu kB", u64);
-
-  /* 1.00M - 9.99M */
-  CHK_FORMAT(1024 * 1024, 9.995, "%0.02f MB", double);
-
-  /* 10.0M - 99.9M */
-  CHK_FORMAT(1024 * 1024, 99.95, "%0.01f MB", double);
-
-  /* 100M - 999M */
-  CHK_FORMAT(1024 * 1024, 1000, "%llu MB", u64);
-
-  /* 1.00G - 9.99G */
-  CHK_FORMAT(1024LL * 1024 * 1024, 9.995, "%0.02f GB", double);
-
-  /* 10.0G - 99.9G */
-  CHK_FORMAT(1024LL * 1024 * 1024, 99.95, "%0.01f GB", double);
-
-  /* 100G - 999G */
-  CHK_FORMAT(1024LL * 1024 * 1024, 1000, "%llu GB", u64);
-
-  /* 1.00T - 9.99G */
-  CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 9.995, "%0.02f TB", double);
-
-  /* 10.0T - 99.9T */
-  CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 99.95, "%0.01f TB", double);
-
-#undef CHK_FORMAT
-
-  /* 100T+ */
-  strncpy(buf, "infty", len - 1);
-  buf[len - 1] = '\0';
-
-  return buf;
-
-}
-
-/* Describe time delta as string.
-   Returns a pointer to buf for convenience. */
-
-u8 *DTD(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) {
-
-  u64 delta;
-  s32 t_d, t_h, t_m, t_s;
-  u8  int_buf[16];
-
-  if (!event_ms) {
-
-    snprintf(buf, len, "none seen yet");
-
-  } else {
-
-    delta = cur_ms - event_ms;
-
-    t_d = delta / 1000 / 60 / 60 / 24;
-    t_h = (delta / 1000 / 60 / 60) % 24;
-    t_m = (delta / 1000 / 60) % 60;
-    t_s = (delta / 1000) % 60;
-
-    DI(int_buf, sizeof(int_buf), t_d);
-    snprintf(buf, len, "%s days, %d hrs, %d min, %d sec", int_buf, t_h, t_m,
-             t_s);
-
-  }
-
-  return buf;
-
-}
-
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 032c61fe..5312aec9 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -196,7 +196,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
   u32 trim_exec = 0;
   u32 orig_len = q->len;
 
-  u8 int_buf[16];
+  u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
 
   if (afl->stage_name != afl->stage_name_buf)
     afl->stage_name = afl->stage_name_buf;
@@ -213,7 +213,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
   while (afl->stage_cur < afl->stage_max) {
 
     snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "ptrim %s",
-             DI(int_buf, sizeof(int_buf), trim_exec));
+             stringify_int(val_buf, sizeof(val_buf), trim_exec));
 
     u32 cksum;
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 7a789cfb..3f0a5962 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -605,7 +605,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
   u32 remove_len;
   u32 len_p2;
 
-  u8 int_bufs[2][16];
+  u8 val_bufs[2][STRINGIFY_VAL_SIZE_MAX];
 
   /* Although the trimmer will be less useful when variable behavior is
      detected, it will still work to some extent, so we don't check for
@@ -631,8 +631,8 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
     u32 remove_pos = remove_len;
 
     snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s",
-             DI(int_bufs[0], sizeof(int_bufs[0]), remove_len),
-             DI(int_bufs[1], sizeof(int_bufs[1]), remove_len));
+             stringify_int(val_bufs[0], sizeof(val_bufs[0]), remove_len),
+             stringify_int(val_bufs[1], sizeof(val_bufs[1]), remove_len));
 
     afl->stage_cur = 0;
     afl->stage_max = q->len / remove_len;
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index 55b60408..5b5c93bf 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -205,8 +205,8 @@ void show_stats(afl_state_t *afl) {
   u8  tmp[256];
   u8  time_tmp[64];
 
-  u8 int_buf[8][16];
-#define IB(i) int_buf[(i)], sizeof(int_buf[(i)])
+  u8 val_buf[8][STRINGIFY_VAL_SIZE_MAX];
+#define IB(i) val_buf[(i)], sizeof(val_buf[(i)])
 
   cur_ms = get_cur_time();
 
@@ -361,9 +361,9 @@ void show_stats(afl_state_t *afl) {
 
   /* Lord, forgive me this. */
 
-  SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
+  SAYF(SET_G1 bSTG bLT bH bSTOP                         cCYA
        " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA
-       " overall results " bSTG bH2 bH2 bRT "\n");
+       " overall results " bSTG bH2 bH2                 bRT "\n");
 
   if (afl->dumb_mode) {
 
@@ -394,10 +394,10 @@ void show_stats(afl_state_t *afl) {
 
   }
 
-  DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->start_time);
+  stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->start_time);
   SAYF(bV bSTOP "        run time : " cRST "%-33s " bSTG bV bSTOP
                 "  cycles done : %s%-5s " bSTG              bV "\n",
-       time_tmp, tmp, DI(IB(0), afl->queue_cycle - 1));
+       time_tmp, tmp, stringify_int(IB(0), afl->queue_cycle - 1));
 
   /* We want to warn people about not seeing new paths after a full cycle,
      except when resuming fuzzing or running in non-instrumented mode. */
@@ -406,7 +406,8 @@ void show_stats(afl_state_t *afl) {
       (afl->last_path_time || afl->resuming_fuzz || afl->queue_cycle == 1 ||
        afl->in_bitmap || afl->crash_mode)) {
 
-    DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_path_time);
+    stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms,
+                        afl->last_path_time);
     SAYF(bV bSTOP "   last new path : " cRST "%-33s ", time_tmp);
 
   } else {
@@ -424,36 +425,36 @@ void show_stats(afl_state_t *afl) {
   }
 
   SAYF(bSTG bV bSTOP "  total paths : " cRST "%-5s " bSTG bV "\n",
-       DI(IB(0), afl->queued_paths));
+       stringify_int(IB(0), afl->queued_paths));
 
   /* Highlight crashes in red if found, denote going over the KEEP_UNIQUE_CRASH
      limit with a '+' appended to the count. */
 
-  sprintf(tmp, "%s%s", DI(IB(0), afl->unique_crashes),
+  sprintf(tmp, "%s%s", stringify_int(IB(0), afl->unique_crashes),
           (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : "");
 
-  DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_crash_time);
+  stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->last_crash_time);
   SAYF(bV bSTOP " last uniq crash : " cRST "%-33s " bSTG bV bSTOP
                 " uniq crashes : %s%-6s" bSTG               bV "\n",
        time_tmp, afl->unique_crashes ? cLRD : cRST, tmp);
 
-  sprintf(tmp, "%s%s", DI(IB(0), afl->unique_hangs),
+  sprintf(tmp, "%s%s", stringify_int(IB(0), afl->unique_hangs),
           (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
 
-  DTD(time_tmp, sizeof(time_tmp), cur_ms, afl->last_hang_time);
+  stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->last_hang_time);
   SAYF(bV bSTOP "  last uniq hang : " cRST "%-33s " bSTG bV bSTOP
                 "   uniq hangs : " cRST "%-6s" bSTG         bV "\n",
        time_tmp, tmp);
 
-  SAYF(bVR bH bSTOP            cCYA
+  SAYF(bVR bH bSTOP                                          cCYA
        " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA
-       " map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
+       " map coverage " bSTG bH bHT bH20 bH2                 bVL "\n");
 
   /* This gets funny because we want to print several variable-length variables
      together, but then cram them into a fixed-width field - so we need to
      put them in a temporary buffer first. */
 
-  sprintf(tmp, "%s%s%u (%0.01f%%)", DI(IB(0), afl->current_entry),
+  sprintf(tmp, "%s%s%u (%0.01f%%)", stringify_int(IB(0), afl->current_entry),
           afl->queue_cur->favored ? "." : "*", afl->queue_cur->fuzz_level,
           ((double)afl->current_entry * 100) / afl->queued_paths);
 
@@ -467,7 +468,7 @@ void show_stats(afl_state_t *afl) {
                          : ((t_bytes < 200 && !afl->dumb_mode) ? cPIN : cRST),
        tmp);
 
-  sprintf(tmp, "%s (%0.02f%%)", DI(IB(0), afl->cur_skipped_paths),
+  sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->cur_skipped_paths),
           ((double)afl->cur_skipped_paths * 100) / afl->queued_paths);
 
   SAYF(bV bSTOP " paths timed out : " cRST "%-16s " bSTG bV, tmp);
@@ -476,11 +477,11 @@ void show_stats(afl_state_t *afl) {
 
   SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp);
 
-  SAYF(bVR bH bSTOP            cCYA
+  SAYF(bVR bH bSTOP                                         cCYA
        " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
-       " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
+       " findings in depth " bSTG bH10 bH5 bH2 bH2          bVL "\n");
 
-  sprintf(tmp, "%s (%0.02f%%)", DI(IB(0), afl->queued_favored),
+  sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_favored),
           ((double)afl->queued_favored) * 100 / afl->queued_paths);
 
   /* Yeah... it's still going on... halp? */
@@ -491,38 +492,40 @@ void show_stats(afl_state_t *afl) {
 
   if (!afl->stage_max) {
 
-    sprintf(tmp, "%s/-", DI(IB(0), afl->stage_cur));
+    sprintf(tmp, "%s/-", stringify_int(IB(0), afl->stage_cur));
 
   } else {
 
-    sprintf(tmp, "%s/%s (%0.02f%%)", DI(IB(0), afl->stage_cur),
-            DI(IB(1), afl->stage_max),
+    sprintf(tmp, "%s/%s (%0.02f%%)", stringify_int(IB(0), afl->stage_cur),
+            stringify_int(IB(1), afl->stage_max),
             ((double)afl->stage_cur) * 100 / afl->stage_max);
 
   }
 
   SAYF(bV bSTOP " stage execs : " cRST "%-21s" bSTG bV bSTOP, tmp);
 
-  sprintf(tmp, "%s (%0.02f%%)", DI(IB(0), afl->queued_with_cov),
+  sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_with_cov),
           ((double)afl->queued_with_cov) * 100 / afl->queued_paths);
 
   SAYF("  new edges on : " cRST "%-22s" bSTG bV "\n", tmp);
 
-  sprintf(tmp, "%s (%s%s unique)", DI(IB(0), afl->total_crashes),
-          DI(IB(1), afl->unique_crashes),
+  sprintf(tmp, "%s (%s%s unique)", stringify_int(IB(0), afl->total_crashes),
+          stringify_int(IB(1), afl->unique_crashes),
           (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : "");
 
   if (afl->crash_mode) {
 
     SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP
                   "   new crashes : %s%-22s" bSTG         bV "\n",
-         DI(IB(0), afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp);
+         stringify_int(IB(0), afl->total_execs),
+         afl->unique_crashes ? cLRD : cRST, tmp);
 
   } else {
 
     SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP
                   " total crashes : %s%-22s" bSTG         bV "\n",
-         DI(IB(0), afl->total_execs), afl->unique_crashes ? cLRD : cRST, tmp);
+         stringify_int(IB(0), afl->total_execs),
+         afl->unique_crashes ? cLRD : cRST, tmp);
 
   }
 
@@ -530,27 +533,30 @@ void show_stats(afl_state_t *afl) {
 
   if (afl->stats_avg_exec < 100) {
 
-    snprintf(tmp, sizeof(tmp), "%s/sec (%s)", DF(IB(0), afl->stats_avg_exec),
+    snprintf(tmp, sizeof(tmp), "%s/sec (%s)",
+             stringify_float(IB(0), afl->stats_avg_exec),
              afl->stats_avg_exec < 20 ? "zzzz..." : "slow!");
 
     SAYF(bV bSTOP "  exec speed : " cLRD "%-20s ", tmp);
 
   } else {
 
-    snprintf(tmp, sizeof(tmp), "%s/sec", DF(IB(0), afl->stats_avg_exec));
+    snprintf(tmp, sizeof(tmp), "%s/sec",
+             stringify_float(IB(0), afl->stats_avg_exec));
     SAYF(bV bSTOP "  exec speed : " cRST "%-20s ", tmp);
 
   }
 
-  snprintf(tmp, sizeof(tmp), "%s (%s%s unique)", DI(IB(0), afl->total_tmouts),
-           DI(IB(1), afl->unique_tmouts),
+  snprintf(tmp, sizeof(tmp), "%s (%s%s unique)",
+           stringify_int(IB(0), afl->total_tmouts),
+           stringify_int(IB(1), afl->unique_tmouts),
            (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
 
   SAYF(bSTG bV bSTOP "  total tmouts : " cRST "%-22s" bSTG bV "\n", tmp);
 
   /* Aaaalmost there... hold on! */
 
-  SAYF(bVR bH cCYA                      bSTOP
+  SAYF(bVR bH cCYA                                                     bSTOP
        " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA
        " path geometry " bSTG bH5 bH2 bVL "\n");
 
@@ -562,78 +568,79 @@ void show_stats(afl_state_t *afl) {
   } else {
 
     snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
-             DI(IB(0), afl->stage_finds[STAGE_FLIP1]),
-             DI(IB(1), afl->stage_cycles[STAGE_FLIP1]),
-             DI(IB(2), afl->stage_finds[STAGE_FLIP2]),
-             DI(IB(3), afl->stage_cycles[STAGE_FLIP2]),
-             DI(IB(3), afl->stage_finds[STAGE_FLIP4]),
-             DI(IB(5), afl->stage_cycles[STAGE_FLIP4]));
+             stringify_int(IB(0), afl->stage_finds[STAGE_FLIP1]),
+             stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP1]),
+             stringify_int(IB(2), afl->stage_finds[STAGE_FLIP2]),
+             stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP2]),
+             stringify_int(IB(3), afl->stage_finds[STAGE_FLIP4]),
+             stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP4]));
 
   }
 
   SAYF(bV bSTOP "   bit flips : " cRST "%-36s " bSTG bV bSTOP
                 "    levels : " cRST "%-10s" bSTG       bV "\n",
-       tmp, DI(IB(0), afl->max_depth));
+       tmp, stringify_int(IB(0), afl->max_depth));
 
   if (!afl->skip_deterministic)
     snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
-             DI(IB(0), afl->stage_finds[STAGE_FLIP8]),
-             DI(IB(1), afl->stage_cycles[STAGE_FLIP8]),
-             DI(IB(2), afl->stage_finds[STAGE_FLIP16]),
-             DI(IB(3), afl->stage_cycles[STAGE_FLIP16]),
-             DI(IB(4), afl->stage_finds[STAGE_FLIP32]),
-             DI(IB(5), afl->stage_cycles[STAGE_FLIP32]));
+             stringify_int(IB(0), afl->stage_finds[STAGE_FLIP8]),
+             stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP8]),
+             stringify_int(IB(2), afl->stage_finds[STAGE_FLIP16]),
+             stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP16]),
+             stringify_int(IB(4), afl->stage_finds[STAGE_FLIP32]),
+             stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP32]));
 
   SAYF(bV bSTOP "  byte flips : " cRST "%-36s " bSTG bV bSTOP
                 "   pending : " cRST "%-10s" bSTG       bV "\n",
-       tmp, DI(IB(0), afl->pending_not_fuzzed));
+       tmp, stringify_int(IB(0), afl->pending_not_fuzzed));
 
   if (!afl->skip_deterministic)
     snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
-             DI(IB(0), afl->stage_finds[STAGE_ARITH8]),
-             DI(IB(1), afl->stage_cycles[STAGE_ARITH8]),
-             DI(IB(2), afl->stage_finds[STAGE_ARITH16]),
-             DI(IB(3), afl->stage_cycles[STAGE_ARITH16]),
-             DI(IB(4), afl->stage_finds[STAGE_ARITH32]),
-             DI(IB(5), afl->stage_cycles[STAGE_ARITH32]));
+             stringify_int(IB(0), afl->stage_finds[STAGE_ARITH8]),
+             stringify_int(IB(1), afl->stage_cycles[STAGE_ARITH8]),
+             stringify_int(IB(2), afl->stage_finds[STAGE_ARITH16]),
+             stringify_int(IB(3), afl->stage_cycles[STAGE_ARITH16]),
+             stringify_int(IB(4), afl->stage_finds[STAGE_ARITH32]),
+             stringify_int(IB(5), afl->stage_cycles[STAGE_ARITH32]));
 
   SAYF(bV bSTOP " arithmetics : " cRST "%-36s " bSTG bV bSTOP
                 "  pend fav : " cRST "%-10s" bSTG       bV "\n",
-       tmp, DI(IB(0), afl->pending_favored));
+       tmp, stringify_int(IB(0), afl->pending_favored));
 
   if (!afl->skip_deterministic)
     sprintf(tmp, "%s/%s, %s/%s, %s/%s",
-            DI(IB(0), afl->stage_finds[STAGE_INTEREST8]),
-            DI(IB(1), afl->stage_cycles[STAGE_INTEREST8]),
-            DI(IB(2), afl->stage_finds[STAGE_INTEREST16]),
-            DI(IB(3), afl->stage_cycles[STAGE_INTEREST16]),
-            DI(IB(4), afl->stage_finds[STAGE_INTEREST32]),
-            DI(IB(5), afl->stage_cycles[STAGE_INTEREST32]));
+            stringify_int(IB(0), afl->stage_finds[STAGE_INTEREST8]),
+            stringify_int(IB(1), afl->stage_cycles[STAGE_INTEREST8]),
+            stringify_int(IB(2), afl->stage_finds[STAGE_INTEREST16]),
+            stringify_int(IB(3), afl->stage_cycles[STAGE_INTEREST16]),
+            stringify_int(IB(4), afl->stage_finds[STAGE_INTEREST32]),
+            stringify_int(IB(5), afl->stage_cycles[STAGE_INTEREST32]));
 
   SAYF(bV bSTOP "  known ints : " cRST "%-36s " bSTG bV bSTOP
                 " own finds : " cRST "%-10s" bSTG       bV "\n",
-       tmp, DI(IB(0), afl->queued_discovered));
+       tmp, stringify_int(IB(0), afl->queued_discovered));
 
   if (!afl->skip_deterministic)
     snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
-             DI(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]),
-             DI(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]),
-             DI(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]),
-             DI(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]),
-             DI(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]),
-             DI(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO]));
+             stringify_int(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]),
+             stringify_int(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]),
+             stringify_int(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]),
+             stringify_int(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]),
+             stringify_int(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]),
+             stringify_int(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO]));
 
   SAYF(bV bSTOP "  dictionary : " cRST "%-36s " bSTG bV bSTOP
                 "  imported : " cRST "%-10s" bSTG       bV "\n",
-       tmp, afl->sync_id ? DI(IB(0), afl->queued_imported) : (u8 *)"n/a");
+       tmp,
+       afl->sync_id ? stringify_int(IB(0), afl->queued_imported) : (u8 *)"n/a");
 
   snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
-           DI(IB(0), afl->stage_finds[STAGE_HAVOC]),
-           DI(IB(2), afl->stage_cycles[STAGE_HAVOC]),
-           DI(IB(3), afl->stage_finds[STAGE_SPLICE]),
-           DI(IB(4), afl->stage_cycles[STAGE_SPLICE]),
-           DI(IB(5), afl->stage_finds[STAGE_RADAMSA]),
-           DI(IB(6), afl->stage_cycles[STAGE_RADAMSA]));
+           stringify_int(IB(0), afl->stage_finds[STAGE_HAVOC]),
+           stringify_int(IB(2), afl->stage_cycles[STAGE_HAVOC]),
+           stringify_int(IB(3), afl->stage_finds[STAGE_SPLICE]),
+           stringify_int(IB(4), afl->stage_cycles[STAGE_SPLICE]),
+           stringify_int(IB(5), afl->stage_finds[STAGE_RADAMSA]),
+           stringify_int(IB(6), afl->stage_cycles[STAGE_RADAMSA]));
 
   SAYF(bV bSTOP "   havoc/rad : " cRST "%-36s " bSTG bV bSTOP, tmp);
 
@@ -654,14 +661,14 @@ void show_stats(afl_state_t *afl) {
   if (afl->shm.cmplog_mode) {
 
     snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s, %s/%s",
-             DI(IB(0), afl->stage_finds[STAGE_PYTHON]),
-             DI(IB(1), afl->stage_cycles[STAGE_PYTHON]),
-             DI(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
-             DI(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]),
-             DI(IB(4), afl->stage_finds[STAGE_COLORIZATION]),
-             DI(IB(5), afl->stage_cycles[STAGE_COLORIZATION]),
-             DI(IB(6), afl->stage_finds[STAGE_ITS]),
-             DI(IB(7), afl->stage_cycles[STAGE_ITS]));
+             stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
+             stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
+             stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
+             stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]),
+             stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]),
+             stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]),
+             stringify_int(IB(6), afl->stage_finds[STAGE_ITS]),
+             stringify_int(IB(7), afl->stage_cycles[STAGE_ITS]));
 
     SAYF(bV bSTOP "   custom/rq : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
          tmp);
@@ -669,10 +676,10 @@ void show_stats(afl_state_t *afl) {
   } else {
 
     snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s",
-             DI(IB(0), afl->stage_finds[STAGE_PYTHON]),
-             DI(IB(1), afl->stage_cycles[STAGE_PYTHON]),
-             DI(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
-             DI(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
+             stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
+             stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
+             stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
+             stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
 
     SAYF(bV bSTOP "   py/custom : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
          tmp);
@@ -688,7 +695,7 @@ void show_stats(afl_state_t *afl) {
     sprintf(tmp, "%0.02f%%/%s, ",
             ((double)(afl->bytes_trim_in - afl->bytes_trim_out)) * 100 /
                 afl->bytes_trim_in,
-            DI(IB(0), afl->trim_execs));
+            stringify_int(IB(0), afl->trim_execs));
 
   }
 
@@ -713,8 +720,9 @@ void show_stats(afl_state_t *afl) {
 
   if (afl->mutator) {
 
-    sprintf(tmp, "%s/%s", DI(IB(0), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
-            DI(IB(1), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
+    sprintf(tmp, "%s/%s",
+            stringify_int(IB(0), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
+            stringify_int(IB(1), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
     SAYF(bV bSTOP " custom mut. : " cRST "%-36s " bSTG bV RESET_G1, tmp);
 
   } else {
@@ -789,8 +797,8 @@ void show_init_stats(afl_state_t *afl) {
   u64                 avg_us = 0;
   u32                 max_len = 0;
 
-  u8 int_bufs[4][16];
-#define IB(i) int_bufs[(i)], sizeof(int_bufs[(i)])
+  u8 val_bufs[4][STRINGIFY_VAL_SIZE_MAX];
+#define IB(i) val_bufs[(i)], sizeof(val_bufs[(i)])
 
   if (afl->total_cal_cycles) avg_us = afl->total_cal_us / afl->total_cal_cycles;
 
@@ -827,10 +835,10 @@ void show_init_stats(afl_state_t *afl) {
 
     if (max_len > 50 * 1024)
       WARNF(cLRD "Some test cases are huge (%s) - see %s/perf_tips.md!",
-            DMS(IB(0), max_len), doc_path);
+            stringify_mem_size(IB(0), max_len), doc_path);
     else if (max_len > 10 * 1024)
       WARNF("Some test cases are big (%s) - see %s/perf_tips.md.",
-            DMS(IB(0), max_len), doc_path);
+            stringify_mem_size(IB(0), max_len), doc_path);
 
     if (afl->useless_at_start && !afl->in_bitmap)
       WARNF(cLRD "Some test cases look useless. Consider using a smaller set.");
@@ -854,7 +862,8 @@ void show_init_stats(afl_state_t *afl) {
       max_bits,
       ((double)afl->total_bitmap_size) /
           (afl->total_bitmap_entries ? afl->total_bitmap_entries : 1),
-      DI(IB(0), min_us), DI(IB(1), max_us), DI(IB(2), avg_us));
+      stringify_int(IB(0), min_us), stringify_int(IB(1), max_us),
+      stringify_int(IB(2), avg_us));
 
   if (!afl->timeout_given) {
 
-- 
cgit 1.4.1


From 5cf342683414616d4cecc55155226cf77cb2e20f Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sat, 21 Mar 2020 22:17:57 +0100
Subject: remove debug code

---
 include/afl-fuzz.h     | 3 ---
 src/afl-fuzz-bitmap.c  | 1 -
 src/afl-fuzz-globals.c | 2 --
 src/afl-fuzz-init.c    | 1 -
 src/afl-fuzz-one.c     | 2 --
 src/afl-fuzz-run.c     | 2 --
 src/afl-fuzz.c         | 2 --
 7 files changed, 13 deletions(-)

(limited to 'src/afl-fuzz-run.c')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 643d58bd..fce03d04 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -118,9 +118,6 @@ extern s16 interesting_16[INTERESTING_8_LEN + INTERESTING_16_LEN];
 extern s32
     interesting_32[INTERESTING_8_LEN + INTERESTING_16_LEN + INTERESTING_32_LEN];
 
-extern u32 bmcnt, initcnt, one1cnt, one2cnt, runcnt;
-
-
 struct queue_entry {
 
   u8 *fname;                            /* File name for the test case      */
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 6375cb57..d4318725 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -578,7 +578,6 @@ u8 save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
     /* Try to calibrate inline; this also calls update_bitmap_score() when
        successful. */
 
-    bmcnt++;
     res = calibrate_case(afl, afl->queue_top, mem, afl->queue_cycle - 1, 0);
 
     if (res == FAULT_ERROR) FATAL("Unable to execute target application");
diff --git a/src/afl-fuzz-globals.c b/src/afl-fuzz-globals.c
index 108952e4..88633a1b 100644
--- a/src/afl-fuzz-globals.c
+++ b/src/afl-fuzz-globals.c
@@ -38,8 +38,6 @@ u8 *doc_path = NULL;                    /* gath to documentation dir        */
 
 /* Initialize MOpt "globals" for this afl state */
 
-u32 bmcnt, initcnt, one1cnt, one2cnt, runcnt;
-
 static void init_mopt_globals(afl_state_t *afl) {
 
   MOpt_globals_t *core = &afl->mopt_globals_core;
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 918801d0..6bdc4853 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -473,7 +473,6 @@ void perform_dry_run(afl_state_t *afl) {
 
     close(fd);
 
-    initcnt++;
     res = calibrate_case(afl, q, use_mem, 0, 1);
     ck_free(use_mem);
 
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 5211d565..c1458dbb 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -442,7 +442,6 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
     if (afl->queue_cur->cal_failed < CAL_CHANCES) {
 
-      one1cnt++;
       res =
           calibrate_case(afl, afl->queue_cur, in_buf, afl->queue_cycle - 1, 0);
 
@@ -2461,7 +2460,6 @@ u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
 
     if (afl->queue_cur->cal_failed < CAL_CHANCES) {
 
-      one2cnt++;
       res =
           calibrate_case(afl, afl->queue_cur, in_buf, afl->queue_cycle - 1, 0);
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 3f0a5962..8c075bdb 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -438,8 +438,6 @@ abort_calibration:
 
   if (!first_run) show_stats(afl);
 
-  runcnt++;
-
   return fault;
 
 }
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 9692c1cb..15caa65f 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1196,8 +1196,6 @@ stop_fuzzing:
 
   OKF("We're done here. Have a nice day!\n");
 
-printf("%u %u %u %u %u\n", bmcnt, initcnt, one1cnt, one2cnt, runcnt);
-
   exit(0);
 
 }
-- 
cgit 1.4.1


From cbde30e9d46a0fdd5fc53d46c31c76ca2c715520 Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Mon, 23 Mar 2020 00:14:03 +0100
Subject: less branches, cleanup

---
 include/afl-fuzz.h      |  4 +---
 src/afl-fuzz-mutators.c |  3 +--
 src/afl-fuzz-one.c      |  6 ++----
 src/afl-fuzz-run.c      |  6 ++----
 src/afl-fuzz-stats.c    | 14 +++++++-------
 5 files changed, 13 insertions(+), 20 deletions(-)

(limited to 'src/afl-fuzz-run.c')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 5e6b3d9e..1a621625 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -109,9 +109,7 @@
 #define CASE_PREFIX "id_"
 #endif                                                    /* ^!SIMPLE_FILES */
 
-#define STAGE_BUF_SIZE                                   \
-  (64) /* usable size of the stage name buf in afl_state \
-        */
+#define STAGE_BUF_SIZE (64)  /* usable size for stage name buf in afl_state */
 
 extern s8  interesting_8[INTERESTING_8_LEN];
 extern s16 interesting_16[INTERESTING_8_LEN + INTERESTING_16_LEN];
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 0d9d2a6f..b70344c6 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -198,8 +198,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
 
   u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
 
-  if (afl->stage_name != afl->stage_name_buf)
-    afl->stage_name = afl->stage_name_buf;
+  afl->stage_name = afl->stage_name_buf;
   afl->bytes_trim_in += q->len;
 
   /* Initialize trimming in the custom mutator */
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 4dea5e45..cc150cfe 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -1682,8 +1682,7 @@ havoc_stage:
     perf_score = orig_perf;
 
     snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "splice %u", splice_cycle);
-    if (unlikely(afl->stage_name != afl->stage_name_buf))
-      afl->stage_name = afl->stage_name_buf;
+    afl->stage_name = afl->stage_name_buf;
     afl->stage_short = "splice";
     afl->stage_max = SPLICE_HAVOC * perf_score / afl->havoc_div / 100;
 
@@ -3581,8 +3580,7 @@ pacemaker_fuzzing:
 
     snprintf(afl->stage_name_buf, STAGE_BUF_SIZE,
              MOpt_globals.splice_stageformat, splice_cycle);
-    if (afl->stage_name != afl->stage_name_buf)
-      afl->stage_name = afl->stage_name_buf;
+    afl->stage_name = afl->stage_name_buf;
     afl->stage_short = MOpt_globals.splice_stagenameshort;
     afl->stage_max = SPLICE_HAVOC * perf_score / afl->havoc_div / 100;
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 8c075bdb..11b101be 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -501,8 +501,7 @@ void sync_fuzzers(afl_state_t *afl) {
 
     snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "sync %u", ++sync_cnt);
 
-    if (afl->stage_name != afl->stage_name_buf)
-      afl->stage_name = afl->stage_name_buf;
+    afl->stage_name = afl->stage_name_buf;
     afl->stage_cur = 0;
     afl->stage_max = 0;
 
@@ -611,8 +610,7 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
 
   if (q->len < 5) return 0;
 
-  if (afl->stage_name != afl->stage_name_buf)
-    afl->stage_name = afl->stage_name_buf;
+  afl->stage_name = afl->stage_name_buf;
   afl->bytes_trim_in += q->len;
 
   /* Select initial chunk len, starting with large steps. */
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index ab2b83c6..5b5c93bf 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -361,9 +361,9 @@ void show_stats(afl_state_t *afl) {
 
   /* Lord, forgive me this. */
 
-  SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
+  SAYF(SET_G1 bSTG bLT bH bSTOP                         cCYA
        " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA
-       " overall results " bSTG bH2 bH2 bRT "\n");
+       " overall results " bSTG bH2 bH2                 bRT "\n");
 
   if (afl->dumb_mode) {
 
@@ -446,9 +446,9 @@ void show_stats(afl_state_t *afl) {
                 "   uniq hangs : " cRST "%-6s" bSTG         bV "\n",
        time_tmp, tmp);
 
-  SAYF(bVR bH bSTOP            cCYA
+  SAYF(bVR bH bSTOP                                          cCYA
        " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA
-       " map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
+       " map coverage " bSTG bH bHT bH20 bH2                 bVL "\n");
 
   /* This gets funny because we want to print several variable-length variables
      together, but then cram them into a fixed-width field - so we need to
@@ -477,9 +477,9 @@ void show_stats(afl_state_t *afl) {
 
   SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp);
 
-  SAYF(bVR bH bSTOP            cCYA
+  SAYF(bVR bH bSTOP                                         cCYA
        " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
-       " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
+       " findings in depth " bSTG bH10 bH5 bH2 bH2          bVL "\n");
 
   sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_favored),
           ((double)afl->queued_favored) * 100 / afl->queued_paths);
@@ -556,7 +556,7 @@ void show_stats(afl_state_t *afl) {
 
   /* Aaaalmost there... hold on! */
 
-  SAYF(bVR bH cCYA                      bSTOP
+  SAYF(bVR bH cCYA                                                     bSTOP
        " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA
        " path geometry " bSTG bH5 bH2 bVL "\n");
 
-- 
cgit 1.4.1


From 83f925ccc9c871998f9d7a905387fd83f8e3f4af Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Mon, 23 Mar 2020 15:02:26 +0100
Subject: unsafer

---
 include/common.h        | 160 +++++++++++++++++++++++++++++++++++++++++-
 src/afl-fuzz-mutators.c |   3 +-
 src/afl-fuzz-run.c      |   6 +-
 src/afl-fuzz-stats.c    | 183 ++++++++++++++++++++++++------------------------
 4 files changed, 254 insertions(+), 98 deletions(-)

(limited to 'src/afl-fuzz-run.c')

diff --git a/include/common.h b/include/common.h
index 1bfafc8b..97076004 100644
--- a/include/common.h
+++ b/include/common.h
@@ -78,7 +78,7 @@ static u64 get_cur_time_us(void) {
    Will return buf for convenience. */
 
 static u8 *stringify_int(u8 *buf, size_t len, u64 val) {
-\
+
 #define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast)     \
   do {                                                     \
                                                            \
@@ -233,5 +233,163 @@ static u8 *stringify_time_diff(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) {
 
 }
 
+
+/* Unsafe Describe integer. The buf sizes are not checked.
+   This is unsafe but fast.
+   Will return buf for convenience. */
+
+static u8 *u_stringify_int(u8 *buf, u64 val) {
+
+#define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast)     \
+  do {                                                     \
+                                                           \
+    if (val < (_divisor) * (_limit_mult)) {                \
+                                                           \
+      sprintf(buf, _fmt, ((_cast)val) / (_divisor));       \
+      return buf;                                          \
+                                                           \
+    }                                                      \
+                                                           \
+  } while (0)
+
+  /* 0-9999 */
+  CHK_FORMAT(1, 10000, "%llu", u64);
+
+  /* 10.0k - 99.9k */
+  CHK_FORMAT(1000, 99.95, "%0.01fk", double);
+
+  /* 100k - 999k */
+  CHK_FORMAT(1000, 1000, "%lluk", u64);
+
+  /* 1.00M - 9.99M */
+  CHK_FORMAT(1000 * 1000, 9.995, "%0.02fM", double);
+
+  /* 10.0M - 99.9M */
+  CHK_FORMAT(1000 * 1000, 99.95, "%0.01fM", double);
+
+  /* 100M - 999M */
+  CHK_FORMAT(1000 * 1000, 1000, "%lluM", u64);
+
+  /* 1.00G - 9.99G */
+  CHK_FORMAT(1000LL * 1000 * 1000, 9.995, "%0.02fG", double);
+
+  /* 10.0G - 99.9G */
+  CHK_FORMAT(1000LL * 1000 * 1000, 99.95, "%0.01fG", double);
+
+  /* 100G - 999G */
+  CHK_FORMAT(1000LL * 1000 * 1000, 1000, "%lluG", u64);
+
+  /* 1.00T - 9.99G */
+  CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 9.995, "%0.02fT", double);
+
+  /* 10.0T - 99.9T */
+  CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 99.95, "%0.01fT", double);
+
+  /* 100T+ */
+  strcpy(buf, "infty");
+
+  return buf;
+
+}
+
+/* Unsafe describe float. Similar as unsafe int. */
+
+static u8 *u_stringify_float(u8 *buf, double val) {
+
+  if (val < 99.995) {
+
+    sprintf(buf, "%0.02f", val);
+
+  } else if (val < 999.95) {
+
+    sprintf(buf, "%0.01f", val);
+
+  } else {
+
+    return u_stringify_int(buf, (u64)val);
+
+  }
+
+  return buf;
+
+}
+
+/* Unsafe describe integer as memory size. */
+
+static u8 *u_stringify_mem_size(u8 *buf, u64 val) {
+
+  /* 0-9999 */
+  CHK_FORMAT(1, 10000, "%llu B", u64);
+
+  /* 10.0k - 99.9k */
+  CHK_FORMAT(1024, 99.95, "%0.01f kB", double);
+
+  /* 100k - 999k */
+  CHK_FORMAT(1024, 1000, "%llu kB", u64);
+
+  /* 1.00M - 9.99M */
+  CHK_FORMAT(1024 * 1024, 9.995, "%0.02f MB", double);
+
+  /* 10.0M - 99.9M */
+  CHK_FORMAT(1024 * 1024, 99.95, "%0.01f MB", double);
+
+  /* 100M - 999M */
+  CHK_FORMAT(1024 * 1024, 1000, "%llu MB", u64);
+
+  /* 1.00G - 9.99G */
+  CHK_FORMAT(1024LL * 1024 * 1024, 9.995, "%0.02f GB", double);
+
+  /* 10.0G - 99.9G */
+  CHK_FORMAT(1024LL * 1024 * 1024, 99.95, "%0.01f GB", double);
+
+  /* 100G - 999G */
+  CHK_FORMAT(1024LL * 1024 * 1024, 1000, "%llu GB", u64);
+
+  /* 1.00T - 9.99G */
+  CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 9.995, "%0.02f TB", double);
+
+  /* 10.0T - 99.9T */
+  CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 99.95, "%0.01f TB", double);
+
+#undef CHK_FORMAT
+
+  /* 100T+ */
+  strcpy(buf, "infty");
+
+  return buf;
+
+}
+
+/* Unsafe describe time delta as string.
+   Returns a pointer to buf for convenience. */
+
+static u8 *u_stringify_time_diff(u8 *buf, u64 cur_ms, u64 event_ms) {
+
+  u64 delta;
+  s32 t_d, t_h, t_m, t_s;
+  u8  val_buf[STRINGIFY_VAL_SIZE_MAX];
+
+  if (!event_ms) {
+
+    sprintf(buf, "none seen yet");
+
+  } else {
+
+    delta = cur_ms - event_ms;
+
+    t_d = delta / 1000 / 60 / 60 / 24;
+    t_h = (delta / 1000 / 60 / 60) % 24;
+    t_m = (delta / 1000 / 60) % 60;
+    t_s = (delta / 1000) % 60;
+
+    u_stringify_int(val_buf, t_d);
+    sprintf(buf, "%s days, %d hrs, %d min, %d sec", val_buf, t_h, t_m, t_s);
+
+  }
+
+  return buf;
+
+}
+
 #endif
 
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index b70344c6..c158aa6f 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -211,8 +211,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
 
   while (afl->stage_cur < afl->stage_max) {
 
-    snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "ptrim %s",
-             stringify_int(val_buf, sizeof(val_buf), trim_exec));
+    sprintf(afl->stage_name_buf, "ptrim %s", u_stringify_int(val_buf, trim_exec));
 
     u32 cksum;
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 11b101be..8c4b5941 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -626,9 +626,9 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
 
     u32 remove_pos = remove_len;
 
-    snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "trim %s/%s",
-             stringify_int(val_bufs[0], sizeof(val_bufs[0]), remove_len),
-             stringify_int(val_bufs[1], sizeof(val_bufs[1]), remove_len));
+    sprintf(afl->stage_name_buf, "trim %s/%s",
+             u_stringify_int(val_bufs[0], remove_len),
+             u_stringify_int(val_bufs[1], remove_len));
 
     afl->stage_cur = 0;
     afl->stage_max = q->len / remove_len;
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index ab2b83c6..dc16df8f 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -206,7 +206,7 @@ void show_stats(afl_state_t *afl) {
   u8  time_tmp[64];
 
   u8 val_buf[8][STRINGIFY_VAL_SIZE_MAX];
-#define IB(i) val_buf[(i)], sizeof(val_buf[(i)])
+#define IB(i) (val_buf[(i)])
 
   cur_ms = get_cur_time();
 
@@ -394,10 +394,10 @@ void show_stats(afl_state_t *afl) {
 
   }
 
-  stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->start_time);
+  u_stringify_time_diff(time_tmp, cur_ms, afl->start_time);
   SAYF(bV bSTOP "        run time : " cRST "%-33s " bSTG bV bSTOP
                 "  cycles done : %s%-5s " bSTG              bV "\n",
-       time_tmp, tmp, stringify_int(IB(0), afl->queue_cycle - 1));
+       time_tmp, tmp, u_stringify_int(IB(0), afl->queue_cycle - 1));
 
   /* We want to warn people about not seeing new paths after a full cycle,
      except when resuming fuzzing or running in non-instrumented mode. */
@@ -406,7 +406,7 @@ void show_stats(afl_state_t *afl) {
       (afl->last_path_time || afl->resuming_fuzz || afl->queue_cycle == 1 ||
        afl->in_bitmap || afl->crash_mode)) {
 
-    stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms,
+    u_stringify_time_diff(time_tmp, cur_ms,
                         afl->last_path_time);
     SAYF(bV bSTOP "   last new path : " cRST "%-33s ", time_tmp);
 
@@ -425,23 +425,23 @@ void show_stats(afl_state_t *afl) {
   }
 
   SAYF(bSTG bV bSTOP "  total paths : " cRST "%-5s " bSTG bV "\n",
-       stringify_int(IB(0), afl->queued_paths));
+       u_stringify_int(IB(0), afl->queued_paths));
 
   /* Highlight crashes in red if found, denote going over the KEEP_UNIQUE_CRASH
      limit with a '+' appended to the count. */
 
-  sprintf(tmp, "%s%s", stringify_int(IB(0), afl->unique_crashes),
+  sprintf(tmp, "%s%s", u_stringify_int(IB(0), afl->unique_crashes),
           (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : "");
 
-  stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->last_crash_time);
+  u_stringify_time_diff(time_tmp, cur_ms, afl->last_crash_time);
   SAYF(bV bSTOP " last uniq crash : " cRST "%-33s " bSTG bV bSTOP
                 " uniq crashes : %s%-6s" bSTG               bV "\n",
        time_tmp, afl->unique_crashes ? cLRD : cRST, tmp);
 
-  sprintf(tmp, "%s%s", stringify_int(IB(0), afl->unique_hangs),
+  sprintf(tmp, "%s%s", u_stringify_int(IB(0), afl->unique_hangs),
           (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
 
-  stringify_time_diff(time_tmp, sizeof(time_tmp), cur_ms, afl->last_hang_time);
+  u_stringify_time_diff(time_tmp, cur_ms, afl->last_hang_time);
   SAYF(bV bSTOP "  last uniq hang : " cRST "%-33s " bSTG bV bSTOP
                 "   uniq hangs : " cRST "%-6s" bSTG         bV "\n",
        time_tmp, tmp);
@@ -454,7 +454,7 @@ void show_stats(afl_state_t *afl) {
      together, but then cram them into a fixed-width field - so we need to
      put them in a temporary buffer first. */
 
-  sprintf(tmp, "%s%s%u (%0.01f%%)", stringify_int(IB(0), afl->current_entry),
+  sprintf(tmp, "%s%s%u (%0.01f%%)", u_stringify_int(IB(0), afl->current_entry),
           afl->queue_cur->favored ? "." : "*", afl->queue_cur->fuzz_level,
           ((double)afl->current_entry * 100) / afl->queued_paths);
 
@@ -468,7 +468,7 @@ void show_stats(afl_state_t *afl) {
                          : ((t_bytes < 200 && !afl->dumb_mode) ? cPIN : cRST),
        tmp);
 
-  sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->cur_skipped_paths),
+  sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->cur_skipped_paths),
           ((double)afl->cur_skipped_paths * 100) / afl->queued_paths);
 
   SAYF(bV bSTOP " paths timed out : " cRST "%-16s " bSTG bV, tmp);
@@ -481,7 +481,7 @@ void show_stats(afl_state_t *afl) {
        " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
        " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
 
-  sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_favored),
+  sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_favored),
           ((double)afl->queued_favored) * 100 / afl->queued_paths);
 
   /* Yeah... it's still going on... halp? */
@@ -492,39 +492,39 @@ void show_stats(afl_state_t *afl) {
 
   if (!afl->stage_max) {
 
-    sprintf(tmp, "%s/-", stringify_int(IB(0), afl->stage_cur));
+    sprintf(tmp, "%s/-", u_stringify_int(IB(0), afl->stage_cur));
 
   } else {
 
-    sprintf(tmp, "%s/%s (%0.02f%%)", stringify_int(IB(0), afl->stage_cur),
-            stringify_int(IB(1), afl->stage_max),
+    sprintf(tmp, "%s/%s (%0.02f%%)", u_stringify_int(IB(0), afl->stage_cur),
+            u_stringify_int(IB(1), afl->stage_max),
             ((double)afl->stage_cur) * 100 / afl->stage_max);
 
   }
 
   SAYF(bV bSTOP " stage execs : " cRST "%-21s" bSTG bV bSTOP, tmp);
 
-  sprintf(tmp, "%s (%0.02f%%)", stringify_int(IB(0), afl->queued_with_cov),
+  sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_with_cov),
           ((double)afl->queued_with_cov) * 100 / afl->queued_paths);
 
   SAYF("  new edges on : " cRST "%-22s" bSTG bV "\n", tmp);
 
-  sprintf(tmp, "%s (%s%s unique)", stringify_int(IB(0), afl->total_crashes),
-          stringify_int(IB(1), afl->unique_crashes),
+  sprintf(tmp, "%s (%s%s unique)", u_stringify_int(IB(0), afl->total_crashes),
+          u_stringify_int(IB(1), afl->unique_crashes),
           (afl->unique_crashes >= KEEP_UNIQUE_CRASH) ? "+" : "");
 
   if (afl->crash_mode) {
 
     SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP
                   "   new crashes : %s%-22s" bSTG         bV "\n",
-         stringify_int(IB(0), afl->total_execs),
+         u_stringify_int(IB(0), afl->total_execs),
          afl->unique_crashes ? cLRD : cRST, tmp);
 
   } else {
 
     SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP
                   " total crashes : %s%-22s" bSTG         bV "\n",
-         stringify_int(IB(0), afl->total_execs),
+         u_stringify_int(IB(0), afl->total_execs),
          afl->unique_crashes ? cLRD : cRST, tmp);
 
   }
@@ -533,23 +533,23 @@ void show_stats(afl_state_t *afl) {
 
   if (afl->stats_avg_exec < 100) {
 
-    snprintf(tmp, sizeof(tmp), "%s/sec (%s)",
-             stringify_float(IB(0), afl->stats_avg_exec),
+    sprintf(tmp, "%s/sec (%s)",
+             u_stringify_float(IB(0), afl->stats_avg_exec),
              afl->stats_avg_exec < 20 ? "zzzz..." : "slow!");
 
     SAYF(bV bSTOP "  exec speed : " cLRD "%-20s ", tmp);
 
   } else {
 
-    snprintf(tmp, sizeof(tmp), "%s/sec",
-             stringify_float(IB(0), afl->stats_avg_exec));
+    sprintf(tmp, "%s/sec",
+             u_stringify_float(IB(0), afl->stats_avg_exec));
     SAYF(bV bSTOP "  exec speed : " cRST "%-20s ", tmp);
 
   }
 
-  snprintf(tmp, sizeof(tmp), "%s (%s%s unique)",
-           stringify_int(IB(0), afl->total_tmouts),
-           stringify_int(IB(1), afl->unique_tmouts),
+  sprintf(tmp, "%s (%s%s unique)",
+           u_stringify_int(IB(0), afl->total_tmouts),
+           u_stringify_int(IB(1), afl->unique_tmouts),
            (afl->unique_hangs >= KEEP_UNIQUE_HANG) ? "+" : "");
 
   SAYF(bSTG bV bSTOP "  total tmouts : " cRST "%-22s" bSTG bV "\n", tmp);
@@ -562,85 +562,84 @@ void show_stats(afl_state_t *afl) {
 
   if (afl->skip_deterministic) {
 
-    strncpy(tmp, "n/a, n/a, n/a", sizeof(tmp) - 1);
-    tmp[sizeof(tmp) - 1] = '\0';
+    strcpy(tmp, "n/a, n/a, n/a");
 
   } else {
 
-    snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
-             stringify_int(IB(0), afl->stage_finds[STAGE_FLIP1]),
-             stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP1]),
-             stringify_int(IB(2), afl->stage_finds[STAGE_FLIP2]),
-             stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP2]),
-             stringify_int(IB(3), afl->stage_finds[STAGE_FLIP4]),
-             stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP4]));
+    sprintf(tmp, "%s/%s, %s/%s, %s/%s",
+             u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP1]),
+             u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP1]),
+             u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP2]),
+             u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP2]),
+             u_stringify_int(IB(3), afl->stage_finds[STAGE_FLIP4]),
+             u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP4]));
 
   }
 
   SAYF(bV bSTOP "   bit flips : " cRST "%-36s " bSTG bV bSTOP
                 "    levels : " cRST "%-10s" bSTG       bV "\n",
-       tmp, stringify_int(IB(0), afl->max_depth));
+       tmp, u_stringify_int(IB(0), afl->max_depth));
 
   if (!afl->skip_deterministic)
-    snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
-             stringify_int(IB(0), afl->stage_finds[STAGE_FLIP8]),
-             stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP8]),
-             stringify_int(IB(2), afl->stage_finds[STAGE_FLIP16]),
-             stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP16]),
-             stringify_int(IB(4), afl->stage_finds[STAGE_FLIP32]),
-             stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP32]));
+    sprintf(tmp, "%s/%s, %s/%s, %s/%s",
+             u_stringify_int(IB(0), afl->stage_finds[STAGE_FLIP8]),
+             u_stringify_int(IB(1), afl->stage_cycles[STAGE_FLIP8]),
+             u_stringify_int(IB(2), afl->stage_finds[STAGE_FLIP16]),
+             u_stringify_int(IB(3), afl->stage_cycles[STAGE_FLIP16]),
+             u_stringify_int(IB(4), afl->stage_finds[STAGE_FLIP32]),
+             u_stringify_int(IB(5), afl->stage_cycles[STAGE_FLIP32]));
 
   SAYF(bV bSTOP "  byte flips : " cRST "%-36s " bSTG bV bSTOP
                 "   pending : " cRST "%-10s" bSTG       bV "\n",
-       tmp, stringify_int(IB(0), afl->pending_not_fuzzed));
+       tmp, u_stringify_int(IB(0), afl->pending_not_fuzzed));
 
   if (!afl->skip_deterministic)
-    snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
-             stringify_int(IB(0), afl->stage_finds[STAGE_ARITH8]),
-             stringify_int(IB(1), afl->stage_cycles[STAGE_ARITH8]),
-             stringify_int(IB(2), afl->stage_finds[STAGE_ARITH16]),
-             stringify_int(IB(3), afl->stage_cycles[STAGE_ARITH16]),
-             stringify_int(IB(4), afl->stage_finds[STAGE_ARITH32]),
-             stringify_int(IB(5), afl->stage_cycles[STAGE_ARITH32]));
+    sprintf(tmp, "%s/%s, %s/%s, %s/%s",
+             u_stringify_int(IB(0), afl->stage_finds[STAGE_ARITH8]),
+             u_stringify_int(IB(1), afl->stage_cycles[STAGE_ARITH8]),
+             u_stringify_int(IB(2), afl->stage_finds[STAGE_ARITH16]),
+             u_stringify_int(IB(3), afl->stage_cycles[STAGE_ARITH16]),
+             u_stringify_int(IB(4), afl->stage_finds[STAGE_ARITH32]),
+             u_stringify_int(IB(5), afl->stage_cycles[STAGE_ARITH32]));
 
   SAYF(bV bSTOP " arithmetics : " cRST "%-36s " bSTG bV bSTOP
                 "  pend fav : " cRST "%-10s" bSTG       bV "\n",
-       tmp, stringify_int(IB(0), afl->pending_favored));
+       tmp, u_stringify_int(IB(0), afl->pending_favored));
 
   if (!afl->skip_deterministic)
     sprintf(tmp, "%s/%s, %s/%s, %s/%s",
-            stringify_int(IB(0), afl->stage_finds[STAGE_INTEREST8]),
-            stringify_int(IB(1), afl->stage_cycles[STAGE_INTEREST8]),
-            stringify_int(IB(2), afl->stage_finds[STAGE_INTEREST16]),
-            stringify_int(IB(3), afl->stage_cycles[STAGE_INTEREST16]),
-            stringify_int(IB(4), afl->stage_finds[STAGE_INTEREST32]),
-            stringify_int(IB(5), afl->stage_cycles[STAGE_INTEREST32]));
+            u_stringify_int(IB(0), afl->stage_finds[STAGE_INTEREST8]),
+            u_stringify_int(IB(1), afl->stage_cycles[STAGE_INTEREST8]),
+            u_stringify_int(IB(2), afl->stage_finds[STAGE_INTEREST16]),
+            u_stringify_int(IB(3), afl->stage_cycles[STAGE_INTEREST16]),
+            u_stringify_int(IB(4), afl->stage_finds[STAGE_INTEREST32]),
+            u_stringify_int(IB(5), afl->stage_cycles[STAGE_INTEREST32]));
 
   SAYF(bV bSTOP "  known ints : " cRST "%-36s " bSTG bV bSTOP
                 " own finds : " cRST "%-10s" bSTG       bV "\n",
-       tmp, stringify_int(IB(0), afl->queued_discovered));
+       tmp, u_stringify_int(IB(0), afl->queued_discovered));
 
   if (!afl->skip_deterministic)
-    snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
-             stringify_int(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]),
-             stringify_int(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]),
-             stringify_int(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]),
-             stringify_int(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]),
-             stringify_int(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]),
-             stringify_int(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO]));
+    sprintf(tmp, "%s/%s, %s/%s, %s/%s",
+             u_stringify_int(IB(0), afl->stage_finds[STAGE_EXTRAS_UO]),
+             u_stringify_int(IB(1), afl->stage_cycles[STAGE_EXTRAS_UO]),
+             u_stringify_int(IB(2), afl->stage_finds[STAGE_EXTRAS_UI]),
+             u_stringify_int(IB(3), afl->stage_cycles[STAGE_EXTRAS_UI]),
+             u_stringify_int(IB(4), afl->stage_finds[STAGE_EXTRAS_AO]),
+             u_stringify_int(IB(5), afl->stage_cycles[STAGE_EXTRAS_AO]));
 
   SAYF(bV bSTOP "  dictionary : " cRST "%-36s " bSTG bV bSTOP
                 "  imported : " cRST "%-10s" bSTG       bV "\n",
        tmp,
-       afl->sync_id ? stringify_int(IB(0), afl->queued_imported) : (u8 *)"n/a");
+       afl->sync_id ? u_stringify_int(IB(0), afl->queued_imported) : (u8 *)"n/a");
 
-  snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s",
-           stringify_int(IB(0), afl->stage_finds[STAGE_HAVOC]),
-           stringify_int(IB(2), afl->stage_cycles[STAGE_HAVOC]),
-           stringify_int(IB(3), afl->stage_finds[STAGE_SPLICE]),
-           stringify_int(IB(4), afl->stage_cycles[STAGE_SPLICE]),
-           stringify_int(IB(5), afl->stage_finds[STAGE_RADAMSA]),
-           stringify_int(IB(6), afl->stage_cycles[STAGE_RADAMSA]));
+  sprintf(tmp, "%s/%s, %s/%s, %s/%s",
+           u_stringify_int(IB(0), afl->stage_finds[STAGE_HAVOC]),
+           u_stringify_int(IB(2), afl->stage_cycles[STAGE_HAVOC]),
+           u_stringify_int(IB(3), afl->stage_finds[STAGE_SPLICE]),
+           u_stringify_int(IB(4), afl->stage_cycles[STAGE_SPLICE]),
+           u_stringify_int(IB(5), afl->stage_finds[STAGE_RADAMSA]),
+           u_stringify_int(IB(6), afl->stage_cycles[STAGE_RADAMSA]));
 
   SAYF(bV bSTOP "   havoc/rad : " cRST "%-36s " bSTG bV bSTOP, tmp);
 
@@ -660,26 +659,26 @@ void show_stats(afl_state_t *afl) {
 
   if (afl->shm.cmplog_mode) {
 
-    snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s, %s/%s, %s/%s",
-             stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
-             stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
-             stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
-             stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]),
-             stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]),
-             stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]),
-             stringify_int(IB(6), afl->stage_finds[STAGE_ITS]),
-             stringify_int(IB(7), afl->stage_cycles[STAGE_ITS]));
+    sprintf(tmp, "%s/%s, %s/%s, %s/%s, %s/%s",
+             u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
+             u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
+             u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
+             u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]),
+             u_stringify_int(IB(4), afl->stage_finds[STAGE_COLORIZATION]),
+             u_stringify_int(IB(5), afl->stage_cycles[STAGE_COLORIZATION]),
+             u_stringify_int(IB(6), afl->stage_finds[STAGE_ITS]),
+             u_stringify_int(IB(7), afl->stage_cycles[STAGE_ITS]));
 
     SAYF(bV bSTOP "   custom/rq : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
          tmp);
 
   } else {
 
-    snprintf(tmp, sizeof(tmp), "%s/%s, %s/%s",
-             stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
-             stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
-             stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
-             stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
+    sprintf(tmp, "%s/%s, %s/%s",
+             u_stringify_int(IB(0), afl->stage_finds[STAGE_PYTHON]),
+             u_stringify_int(IB(1), afl->stage_cycles[STAGE_PYTHON]),
+             u_stringify_int(IB(2), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
+             u_stringify_int(IB(3), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
 
     SAYF(bV bSTOP "   py/custom : " cRST "%-36s " bSTG bVR bH20 bH2 bH bRB "\n",
          tmp);
@@ -695,7 +694,7 @@ void show_stats(afl_state_t *afl) {
     sprintf(tmp, "%0.02f%%/%s, ",
             ((double)(afl->bytes_trim_in - afl->bytes_trim_out)) * 100 /
                 afl->bytes_trim_in,
-            stringify_int(IB(0), afl->trim_execs));
+            u_stringify_int(IB(0), afl->trim_execs));
 
   }
 
@@ -721,8 +720,8 @@ void show_stats(afl_state_t *afl) {
   if (afl->mutator) {
 
     sprintf(tmp, "%s/%s",
-            stringify_int(IB(0), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
-            stringify_int(IB(1), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
+            u_stringify_int(IB(0), afl->stage_finds[STAGE_CUSTOM_MUTATOR]),
+            u_stringify_int(IB(1), afl->stage_cycles[STAGE_CUSTOM_MUTATOR]));
     SAYF(bV bSTOP " custom mut. : " cRST "%-36s " bSTG bV RESET_G1, tmp);
 
   } else {
-- 
cgit 1.4.1