From 33abd70647789fc0e3960e76351bec5793944918 Mon Sep 17 00:00:00 2001
From: hexcoder- <heiko@hexco.de>
Date: Sat, 2 Jan 2021 20:06:02 +0100
Subject: typo

---
 src/afl-fuzz.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/afl-fuzz.c')

diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 2af374f2..897c2f1e 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1534,7 +1534,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   if (!afl->pending_not_fuzzed) {
 
-    FATAL("We need at least on valid input seed that does not crash!");
+    FATAL("We need at least one valid input seed that does not crash!");
 
   }
 
-- 
cgit 1.4.1


From c6e038fe25789caa8da777f53154de1bd7b4e178 Mon Sep 17 00:00:00 2001
From: hexcoder- <heiko@hexco.de>
Date: Mon, 4 Jan 2021 20:40:53 +0100
Subject: code cleanups (shadowed vars, (un)signed type mismatches, format
 types, etc.)

---
 include/afl-fuzz.h      |  4 +--
 include/config.h        | 46 +++++++++++++++---------------
 src/afl-analyze.c       |  4 +--
 src/afl-cc.c            | 74 ++++++++++++++++++++++++++++---------------------
 src/afl-common.c        | 20 ++++++-------
 src/afl-forkserver.c    |  4 +--
 src/afl-fuzz-bitmap.c   |  2 +-
 src/afl-fuzz-extras.c   |  6 ++--
 src/afl-fuzz-mutators.c | 28 ++++++++++++-------
 src/afl-fuzz-one.c      | 24 ++++++++--------
 src/afl-fuzz-queue.c    |  5 ++--
 src/afl-fuzz-redqueen.c |  9 ++++--
 src/afl-fuzz-run.c      |  2 +-
 src/afl-fuzz-stats.c    |  8 +++---
 src/afl-fuzz.c          |  8 +++---
 src/afl-ld-lto.c        |  6 ++--
 src/afl-showmap.c       | 12 ++++----
 src/afl-tmin.c          |  4 +--
 18 files changed, 144 insertions(+), 122 deletions(-)

(limited to 'src/afl-fuzz.c')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index d6a322cc..ede54f0e 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -573,7 +573,7 @@ typedef struct afl_state {
 
   u8 stage_name_buf[STAGE_BUF_SIZE];    /* reused stagename buf with len 64 */
 
-  s32 stage_cur, stage_max;             /* Stage progression                */
+  u32 stage_cur, stage_max;             /* Stage progression                */
   s32 splicing_with;                    /* Splicing with which test case?   */
 
   u32 main_node_id, main_node_max;      /*   Main instance job splitting    */
@@ -648,7 +648,7 @@ typedef struct afl_state {
   double                 last_avg_execs_saved;
 
 /* foreign sync */
-#define FOREIGN_SYNCS_MAX 32
+#define FOREIGN_SYNCS_MAX 32U
   u8                  foreign_sync_cnt;
   struct foreign_sync foreign_syncs[FOREIGN_SYNCS_MAX];
 
diff --git a/include/config.h b/include/config.h
index e8a49270..7c75e9c9 100644
--- a/include/config.h
+++ b/include/config.h
@@ -80,11 +80,11 @@
 /* Default timeout for fuzzed code (milliseconds). This is the upper bound,
    also used for detecting hangs; the actual value is auto-scaled: */
 
-#define EXEC_TIMEOUT 1000
+#define EXEC_TIMEOUT 1000U
 
 /* Timeout rounding factor when auto-scaling (milliseconds): */
 
-#define EXEC_TM_ROUND 20
+#define EXEC_TM_ROUND 20U
 
 /* 64bit arch MACRO */
 #if (defined(__x86_64__) || defined(__arm64__) || defined(__aarch64__))
@@ -93,48 +93,48 @@
 
 /* Default memory limit for child process (MB) 0 = disabled : */
 
-#define MEM_LIMIT 0
+#define MEM_LIMIT 0U
 
 /* Default memory limit when running in QEMU mode (MB) 0 = disabled : */
 
-#define MEM_LIMIT_QEMU 0
+#define MEM_LIMIT_QEMU 0U
 
 /* Default memory limit when running in Unicorn mode (MB) 0 = disabled : */
 
-#define MEM_LIMIT_UNICORN 0
+#define MEM_LIMIT_UNICORN 0U
 
 /* Number of calibration cycles per every new test case (and for test
    cases that show variable behavior): */
 
-#define CAL_CYCLES 8
-#define CAL_CYCLES_LONG 40
+#define CAL_CYCLES 8U
+#define CAL_CYCLES_LONG 40U
 
 /* Number of subsequent timeouts before abandoning an input file: */
 
-#define TMOUT_LIMIT 250
+#define TMOUT_LIMIT 250U
 
 /* Maximum number of unique hangs or crashes to record: */
 
-#define KEEP_UNIQUE_HANG 500
-#define KEEP_UNIQUE_CRASH 5000
+#define KEEP_UNIQUE_HANG 500U
+#define KEEP_UNIQUE_CRASH 5000U
 
 /* Baseline number of random tweaks during a single 'havoc' stage: */
 
-#define HAVOC_CYCLES 256
-#define HAVOC_CYCLES_INIT 1024
+#define HAVOC_CYCLES 256U
+#define HAVOC_CYCLES_INIT 1024U
 
 /* Maximum multiplier for the above (should be a power of two, beware
    of 32-bit int overflows): */
 
-#define HAVOC_MAX_MULT 64
-#define HAVOC_MAX_MULT_MOPT 64
+#define HAVOC_MAX_MULT 64U
+#define HAVOC_MAX_MULT_MOPT 64U
 
 /* Absolute minimum number of havoc cycles (after all adjustments): */
 
-#define HAVOC_MIN 12
+#define HAVOC_MIN 12U
 
 /* Power Schedule Divisor */
-#define POWER_BETA 1
+#define POWER_BETA 1U
 #define MAX_FACTOR (POWER_BETA * 32)
 
 /* Maximum stacking for havoc-stage tweaks. The actual value is calculated
@@ -146,19 +146,19 @@
    In other words, the default (n = 4) produces 2, 4, 8, 16
    stacked tweaks: */
 
-#define HAVOC_STACK_POW2 4
+#define HAVOC_STACK_POW2 4U
 
 /* Caps on block sizes for cloning and deletion operations. Each of these
    ranges has a 33% probability of getting picked, except for the first
    two cycles where smaller blocks are favored: */
 
-#define HAVOC_BLK_SMALL 32
-#define HAVOC_BLK_MEDIUM 128
-#define HAVOC_BLK_LARGE 1500
+#define HAVOC_BLK_SMALL 32U
+#define HAVOC_BLK_MEDIUM 128U
+#define HAVOC_BLK_LARGE 1500U
 
 /* Extra-large blocks, selected very rarely (<5% of the time): */
 
-#define HAVOC_BLK_XL 32768
+#define HAVOC_BLK_XL 32768U
 
 /* Probabilities of skipping non-favored entries in the queue, expressed as
    percentages: */
@@ -188,11 +188,11 @@
 
 /* Maximum size of input file, in bytes (keep under 100MB): */
 
-#define MAX_FILE (1 * 1024 * 1024)
+#define MAX_FILE (1 * 1024 * 1024U)
 
 /* The same, for the test case minimizer: */
 
-#define TMIN_MAX_FILE (10 * 1024 * 1024)
+#define TMIN_MAX_FILE (10 * 1024 * 1024U)
 
 /* Block normalization steps for afl-tmin: */
 
diff --git a/src/afl-analyze.c b/src/afl-analyze.c
index 6dac415b..8fc4434a 100644
--- a/src/afl-analyze.c
+++ b/src/afl-analyze.c
@@ -903,8 +903,8 @@ static void usage(u8 *argv0) {
       "Execution control settings:\n"
 
       "  -f file       - input file read by the tested program (stdin)\n"
-      "  -t msec       - timeout for each run (%d ms)\n"
-      "  -m megs       - memory limit for child process (%d MB)\n"
+      "  -t msec       - timeout for each run (%u ms)\n"
+      "  -m megs       - memory limit for child process (%u MB)\n"
       "  -Q            - use binary-only instrumentation (QEMU mode)\n"
       "  -U            - use unicorn-based instrumentation (Unicorn mode)\n"
       "  -W            - use qemu-based instrumentation with Wine (Wine "
diff --git a/src/afl-cc.c b/src/afl-cc.c
index e6a6718e..180ab3c4 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -120,8 +120,10 @@ char compiler_mode_string[7][12] = {
 
 u8 *getthecwd() {
 
-  static u8 fail[] = "";
-  if (getcwd(cwd, sizeof(cwd)) == NULL) return fail;
+  if (getcwd(cwd, sizeof(cwd)) == NULL) {
+    static u8 fail[] = "";
+    return fail;
+  }
   return cwd;
 
 }
@@ -654,9 +656,9 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
     }
 
-    u32 idx;
     if (lto_mode && argc > 1) {
 
+      u32 idx;
       for (idx = 1; idx < argc; idx++) {
 
         if (!strncasecmp(argv[idx], "-fpic", 5)) have_pic = 1;
@@ -1208,12 +1210,12 @@ int main(int argc, char **argv, char **envp) {
 
   if (getenv("AFL_LLVM_INSTRUMENT")) {
 
-    u8 *ptr = strtok(getenv("AFL_LLVM_INSTRUMENT"), ":,;");
+    u8 *ptr2 = strtok(getenv("AFL_LLVM_INSTRUMENT"), ":,;");
 
-    while (ptr) {
+    while (ptr2) {
 
-      if (strncasecmp(ptr, "afl", strlen("afl")) == 0 ||
-          strncasecmp(ptr, "classic", strlen("classic")) == 0) {
+      if (strncasecmp(ptr2, "afl", strlen("afl")) == 0 ||
+          strncasecmp(ptr2, "classic", strlen("classic")) == 0) {
 
         if (instrument_mode == INSTRUMENT_LTO) {
 
@@ -1229,8 +1231,8 @@ int main(int argc, char **argv, char **envp) {
 
       }
 
-      if (strncasecmp(ptr, "pc-guard", strlen("pc-guard")) == 0 ||
-          strncasecmp(ptr, "pcguard", strlen("pcguard")) == 0) {
+      if (strncasecmp(ptr2, "pc-guard", strlen("pc-guard")) == 0 ||
+          strncasecmp(ptr2, "pcguard", strlen("pcguard")) == 0) {
 
         if (!instrument_mode || instrument_mode == INSTRUMENT_PCGUARD)
           instrument_mode = INSTRUMENT_PCGUARD;
@@ -1241,8 +1243,8 @@ int main(int argc, char **argv, char **envp) {
       }
 
       // this is a hidden option
-      if (strncasecmp(ptr, "llvmnative", strlen("llvmnative")) == 0 ||
-          strncasecmp(ptr, "llvm-native", strlen("llvm-native")) == 0) {
+      if (strncasecmp(ptr2, "llvmnative", strlen("llvmnative")) == 0 ||
+          strncasecmp(ptr2, "llvm-native", strlen("llvm-native")) == 0) {
 
         if (!instrument_mode || instrument_mode == INSTRUMENT_LLVMNATIVE)
           instrument_mode = INSTRUMENT_LLVMNATIVE;
@@ -1252,8 +1254,8 @@ int main(int argc, char **argv, char **envp) {
 
       }
 
-      if (strncasecmp(ptr, "cfg", strlen("cfg")) == 0 ||
-          strncasecmp(ptr, "instrim", strlen("instrim")) == 0) {
+      if (strncasecmp(ptr2, "cfg", strlen("cfg")) == 0 ||
+          strncasecmp(ptr2, "instrim", strlen("instrim")) == 0) {
 
         if (instrument_mode == INSTRUMENT_LTO) {
 
@@ -1269,7 +1271,7 @@ int main(int argc, char **argv, char **envp) {
 
       }
 
-      if (strncasecmp(ptr, "lto", strlen("lto")) == 0) {
+      if (strncasecmp(ptr2, "lto", strlen("lto")) == 0) {
 
         lto_mode = 1;
         if (!instrument_mode || instrument_mode == INSTRUMENT_LTO)
@@ -1280,7 +1282,7 @@ int main(int argc, char **argv, char **envp) {
 
       }
 
-      if (strcasecmp(ptr, "gcc") == 0) {
+      if (strcasecmp(ptr2, "gcc") == 0) {
 
         if (!instrument_mode || instrument_mode == INSTRUMENT_GCC)
           instrument_mode = INSTRUMENT_GCC;
@@ -1291,7 +1293,7 @@ int main(int argc, char **argv, char **envp) {
 
       }
 
-      if (strcasecmp(ptr, "clang") == 0) {
+      if (strcasecmp(ptr2, "clang") == 0) {
 
         if (!instrument_mode || instrument_mode == INSTRUMENT_CLANG)
           instrument_mode = INSTRUMENT_CLANG;
@@ -1302,29 +1304,29 @@ int main(int argc, char **argv, char **envp) {
 
       }
 
-      if (strncasecmp(ptr, "ctx", strlen("ctx")) == 0) {
+      if (strncasecmp(ptr2, "ctx", strlen("ctx")) == 0) {
 
         instrument_opt_mode |= INSTRUMENT_OPT_CTX;
         setenv("AFL_LLVM_CTX", "1", 1);
 
       }
 
-      if (strncasecmp(ptr, "ngram", strlen("ngram")) == 0) {
+      if (strncasecmp(ptr2, "ngram", strlen("ngram")) == 0) {
 
-        ptr += strlen("ngram");
-        while (*ptr && (*ptr < '0' || *ptr > '9'))
-          ptr++;
+        ptr2 += strlen("ngram");
+        while (*ptr2 && (*ptr2 < '0' || *ptr2 > '9'))
+          ptr2++;
 
-        if (!*ptr) {
+        if (!*ptr2) {
 
-          if ((ptr = getenv("AFL_LLVM_NGRAM_SIZE")) == NULL)
+          if ((ptr2 = getenv("AFL_LLVM_NGRAM_SIZE")) == NULL)
             FATAL(
                 "you must set the NGRAM size with (e.g. for value 2) "
                 "AFL_LLVM_INSTRUMENT=ngram-2");
 
         }
 
-        ngram_size = atoi(ptr);
+        ngram_size = atoi(ptr2);
         if (ngram_size < 2 || ngram_size > NGRAM_SIZE_MAX)
           FATAL(
               "NGRAM instrumentation option must be between 2 and "
@@ -1332,12 +1334,12 @@ int main(int argc, char **argv, char **envp) {
               "(%u)",
               NGRAM_SIZE_MAX);
         instrument_opt_mode |= (INSTRUMENT_OPT_NGRAM);
-        ptr = alloc_printf("%u", ngram_size);
-        setenv("AFL_LLVM_NGRAM_SIZE", ptr, 1);
+        ptr2 = alloc_printf("%u", ngram_size);
+        setenv("AFL_LLVM_NGRAM_SIZE", ptr2, 1);
 
       }
 
-      ptr = strtok(NULL, ":,;");
+      ptr2 = strtok(NULL, ":,;");
 
     }
 
@@ -1448,20 +1450,28 @@ int main(int argc, char **argv, char **envp) {
         "  The best is LTO but it often needs RANLIB and AR settings outside "
         "of afl-cc.\n\n");
 
+#if LLVM_MAJOR > 10 || (LLVM_MAJOR == 10 && LLVM_MINOR > 0)
+#define NATIVE_MSG \
+        "  NATIVE:  use llvm's native PCGUARD instrumentation (less " \
+        "performant)\n"
+#else
+#define NATIVE_MSG ""
+#endif
+
     SAYF(
         "Sub-Modes: (set via env AFL_LLVM_INSTRUMENT, afl-cc selects the best "
         "available)\n"
         "  PCGUARD: Dominator tree instrumentation (best!) (README.llvm.md)\n"
-#if LLVM_MAJOR > 10 || (LLVM_MAJOR == 10 && LLVM_MINOR > 0)
-        "  NATIVE:  use llvm's native PCGUARD instrumentation (less "
-        "performant)\n"
-#endif
+
+	NATIVE_MSG
+
         "  CLASSIC: decision target instrumentation (README.llvm.md)\n"
         "  CTX:     CLASSIC + callee context (instrumentation/README.ctx.md)\n"
         "  NGRAM-x: CLASSIC + previous path "
         "((instrumentation/README.ngram.md)\n"
         "  INSTRIM: Dominator tree (for LLVM <= 6.0) "
         "(instrumentation/README.instrim.md)\n\n");
+#undef NATIVE_MSG
 
     SAYF(
         "Features: (see documentation links)\n"
@@ -1625,7 +1635,7 @@ int main(int argc, char **argv, char **envp) {
       if (!instrument_mode) {
 
         instrument_mode = INSTRUMENT_CFG;
-        ptr = instrument_mode_string[instrument_mode];
+        //ptr = instrument_mode_string[instrument_mode];
 
       }
 
diff --git a/src/afl-common.c b/src/afl-common.c
index 1928663d..21cb6ab4 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -696,16 +696,16 @@ u8 *stringify_mem_size(u8 *buf, size_t len, u64 val) {
 
 u8 *stringify_time_diff(u8 *buf, size_t len, u64 cur_ms, u64 event_ms) {
 
-  u64 delta;
-  s32 t_d, t_h, t_m, t_s;
-  u8  val_buf[STRINGIFY_VAL_SIZE_MAX];
-
   if (!event_ms) {
 
     snprintf(buf, len, "none seen yet");
 
   } else {
 
+    u64 delta;
+    s32 t_d, t_h, t_m, t_s;
+    u8  val_buf[STRINGIFY_VAL_SIZE_MAX];
+
     delta = cur_ms - event_ms;
 
     t_d = delta / 1000 / 60 / 60 / 24;
@@ -858,16 +858,16 @@ u8 *u_stringify_mem_size(u8 *buf, u64 val) {
 
 u8 *u_stringify_time_diff(u8 *buf, u64 cur_ms, u64 event_ms) {
 
-  u64 delta;
-  s32 t_d, t_h, t_m, t_s;
-  u8  val_buf[STRINGIFY_VAL_SIZE_MAX];
-
   if (!event_ms) {
 
     sprintf(buf, "none seen yet");
 
   } else {
 
+    u64 delta;
+    s32 t_d, t_h, t_m, t_s;
+    u8  val_buf[STRINGIFY_VAL_SIZE_MAX];
+
     delta = cur_ms - event_ms;
 
     t_d = delta / 1000 / 60 / 60 / 24;
@@ -895,8 +895,8 @@ u32 get_map_size(void) {
     map_size = atoi(ptr);
     if (map_size < 8 || map_size > (1 << 29)) {
 
-      FATAL("illegal AFL_MAP_SIZE %u, must be between %u and %u", map_size, 8,
-            1 << 29);
+      FATAL("illegal AFL_MAP_SIZE %u, must be between %u and %u", map_size, 8U,
+            1U << 29);
 
     }
 
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 90fa55e9..d6195cb5 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -213,7 +213,7 @@ restart_select:
 static void afl_fauxsrv_execv(afl_forkserver_t *fsrv, char **argv) {
 
   unsigned char tmp[4] = {0, 0, 0, 0};
-  pid_t         child_pid = -1;
+  pid_t         child_pid;
 
   if (!be_quiet) { ACTF("Using Fauxserver:"); }
 
@@ -1104,7 +1104,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
          "Unable to communicate with fork server. Some possible reasons:\n\n"
          "    - You've run out of memory. Use -m to increase the the memory "
          "limit\n"
-         "      to something higher than %lld.\n"
+         "      to something higher than %llu.\n"
          "    - The binary or one of the libraries it uses manages to "
          "create\n"
          "      threads before the forkserver initializes.\n"
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 62a8211c..85a01f98 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -703,7 +703,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
         if (!classified) {
 
           classify_counts(&afl->fsrv);
-          classified = 1;
+//          classified = 1;
 
         }
 
diff --git a/src/afl-fuzz-extras.c b/src/afl-fuzz-extras.c
index 171cce96..04f0878c 100644
--- a/src/afl-fuzz-extras.c
+++ b/src/afl-fuzz-extras.c
@@ -266,7 +266,7 @@ static void extras_check_and_sort(afl_state_t *afl, u32 min_len, u32 max_len,
 
   if (afl->extras_cnt > afl->max_det_extras) {
 
-    WARNF("More than %d tokens - will use them probabilistically.",
+    WARNF("More than %u tokens - will use them probabilistically.",
           afl->max_det_extras);
 
   }
@@ -431,7 +431,6 @@ void dedup_extras(afl_state_t *afl) {
 /* Adds a new extra / dict entry. */
 void add_extra(afl_state_t *afl, u8 *mem, u32 len) {
 
-  u8  val_bufs[2][STRINGIFY_VAL_SIZE_MAX];
   u32 i, found = 0;
 
   for (i = 0; i < afl->extras_cnt; i++) {
@@ -451,6 +450,7 @@ void add_extra(afl_state_t *afl, u8 *mem, u32 len) {
 
   if (len > MAX_DICT_FILE) {
 
+    u8  val_bufs[2][STRINGIFY_VAL_SIZE_MAX];
     WARNF("Extra '%.*s' is too big (%s, limit is %s), skipping file!", (int)len,
           mem, stringify_mem_size(val_bufs[0], sizeof(val_bufs[0]), len),
           stringify_mem_size(val_bufs[1], sizeof(val_bufs[1]), MAX_DICT_FILE));
@@ -481,7 +481,7 @@ void add_extra(afl_state_t *afl, u8 *mem, u32 len) {
 
   if (afl->extras_cnt == afl->max_det_extras + 1) {
 
-    WARNF("More than %d tokens - will use them probabilistically.",
+    WARNF("More than %u tokens - will use them probabilistically.",
           afl->max_det_extras);
 
   }
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 0c85458e..5da692d3 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -316,16 +316,20 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
 
   /* Initialize trimming in the custom mutator */
   afl->stage_cur = 0;
-  afl->stage_max = mutator->afl_custom_init_trim(mutator->data, in_buf, q->len);
-  if (unlikely(afl->stage_max) < 0) {
+  s32 retval = mutator->afl_custom_init_trim(mutator->data, in_buf, q->len);
+  if (unlikely(retval) < 0) {
 
-    FATAL("custom_init_trim error ret: %d", afl->stage_max);
+    FATAL("custom_init_trim error ret: %d", retval);
 
+  } else {
+
+    afl->stage_max = retval;
+ 
   }
 
   if (afl->not_on_tty && afl->debug) {
 
-    SAYF("[Custom Trimming] START: Max %d iterations, %u bytes", afl->stage_max,
+    SAYF("[Custom Trimming] START: Max %u iterations, %u bytes", afl->stage_max,
          q->len);
 
   }
@@ -343,7 +347,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
 
     if (unlikely(!retbuf)) {
 
-      FATAL("custom_trim failed (ret %zd)", retlen);
+      FATAL("custom_trim failed (ret %zu)", retlen);
 
     } else if (unlikely(retlen > orig_len)) {
 
@@ -409,7 +413,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
 
       if (afl->not_on_tty && afl->debug) {
 
-        SAYF("[Custom Trimming] SUCCESS: %d/%d iterations (now at %u bytes)",
+        SAYF("[Custom Trimming] SUCCESS: %u/%u iterations (now at %u bytes)",
              afl->stage_cur, afl->stage_max, q->len);
 
       }
@@ -417,16 +421,20 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
     } else {
 
       /* Tell the custom mutator that the trimming was unsuccessful */
-      afl->stage_cur = mutator->afl_custom_post_trim(mutator->data, 0);
-      if (unlikely(afl->stage_cur < 0)) {
+      s32 retval2 = mutator->afl_custom_post_trim(mutator->data, 0);
+      if (unlikely(retval2 < 0)) {
+
+        FATAL("Error ret in custom_post_trim: %d", retval2);
+
+      } else {
 
-        FATAL("Error ret in custom_post_trim: %d", afl->stage_cur);
+        afl->stage_cur = retval2;
 
       }
 
       if (afl->not_on_tty && afl->debug) {
 
-        SAYF("[Custom Trimming] FAILURE: %d/%d iterations", afl->stage_cur,
+        SAYF("[Custom Trimming] FAILURE: %u/%u iterations", afl->stage_cur,
              afl->stage_max);
 
       }
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index e6fa6064..f9509e86 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -368,7 +368,7 @@ static void locate_diffs(u8 *ptr1, u8 *ptr2, u32 len, s32 *first, s32 *last) {
 
 u8 fuzz_one_original(afl_state_t *afl) {
 
-  s32 len, temp_len;
+  u32 len, temp_len;
   u32 j;
   u32 i;
   u8 *in_buf, *out_buf, *orig_in, *ex_tmp, *eff_map = 0;
@@ -545,7 +545,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
   else
     orig_perf = perf_score = calculate_score(afl, afl->queue_cur);
 
-  if (unlikely(perf_score <= 0)) { goto abandon_entry; }
+  if (unlikely(perf_score == 0)) { goto abandon_entry; }
 
   if (unlikely(afl->shm.cmplog_mode && !afl->queue_cur->fully_colorized)) {
 
@@ -902,7 +902,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
   orig_hit_cnt = new_hit_cnt;
 
-  for (i = 0; (s32)i < len - 1; ++i) {
+  for (i = 0; i < len - 1; ++i) {
 
     /* Let's consult the effector map... */
 
@@ -945,7 +945,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
   orig_hit_cnt = new_hit_cnt;
 
-  for (i = 0; (s32)i < len - 3; ++i) {
+  for (i = 0; i < len - 3; ++i) {
 
     /* Let's consult the effector map... */
     if (!eff_map[EFF_APOS(i)] && !eff_map[EFF_APOS(i + 1)] &&
@@ -1405,7 +1405,7 @@ skip_arith:
 
   orig_hit_cnt = new_hit_cnt;
 
-  for (i = 0; (s32)i < len - 1; ++i) {
+  for (i = 0; i < len - 1; ++i) {
 
     u16 orig = *(u16 *)(out_buf + i);
 
@@ -1493,7 +1493,7 @@ skip_arith:
 
   orig_hit_cnt = new_hit_cnt;
 
-  for (i = 0; (s32)i < len - 3; i++) {
+  for (i = 0; i < len - 3; i++) {
 
     u32 orig = *(u32 *)(out_buf + i);
 
@@ -1850,7 +1850,7 @@ custom_mutator_stage:
 
           if (unlikely(!mutated_buf)) {
 
-            FATAL("Error in custom_fuzz. Size returned: %zd", mutated_size);
+            FATAL("Error in custom_fuzz. Size returned: %zu", mutated_size);
 
           }
 
@@ -2026,7 +2026,7 @@ havoc_stage:
                 el->data, out_buf, temp_len, &custom_havoc_buf, MAX_FILE);
             if (unlikely(!custom_havoc_buf)) {
 
-              FATAL("Error in custom_havoc (return %zd)", new_len);
+              FATAL("Error in custom_havoc (return %zu)", new_len);
 
             }
 
@@ -2458,7 +2458,7 @@ havoc_stage:
                 u32 use_extra = rand_below(afl, afl->a_extras_cnt);
                 u32 extra_len = afl->a_extras[use_extra].len;
 
-                if ((s32)extra_len > temp_len) { break; }
+                if (extra_len > temp_len) { break; }
 
                 u32 insert_at = rand_below(afl, temp_len - extra_len + 1);
 #ifdef INTROSPECTION
@@ -2476,7 +2476,7 @@ havoc_stage:
                 u32 use_extra = rand_below(afl, afl->extras_cnt);
                 u32 extra_len = afl->extras[use_extra].len;
 
-                if ((s32)extra_len > temp_len) { break; }
+                if (extra_len > temp_len) { break; }
 
                 u32 insert_at = rand_below(afl, temp_len - extra_len + 1);
 #ifdef INTROSPECTION
@@ -2577,7 +2577,7 @@ havoc_stage:
               u32 copy_from, copy_to, copy_len;
 
               copy_len = choose_block_len(afl, new_len - 1);
-              if ((s32)copy_len > temp_len) copy_len = temp_len;
+              if (copy_len > temp_len) copy_len = temp_len;
 
               copy_from = rand_below(afl, new_len - copy_len + 1);
               copy_to = rand_below(afl, temp_len - copy_len + 1);
@@ -2952,7 +2952,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
   else
     orig_perf = perf_score = calculate_score(afl, afl->queue_cur);
 
-  if (unlikely(perf_score <= 0)) { goto abandon_entry; }
+  if (unlikely(perf_score == 0)) { goto abandon_entry; }
 
   if (unlikely(afl->shm.cmplog_mode && !afl->queue_cur->fully_colorized)) {
 
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 9a0d199e..cd41bafc 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -489,11 +489,12 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
 
 void destroy_queue(afl_state_t *afl) {
 
-  struct queue_entry *q;
   u32                 i;
 
   for (i = 0; i < afl->queued_paths; i++) {
 
+    struct queue_entry *q;
+
     q = afl->queue_buf[i];
     ck_free(q->fname);
     ck_free(q->trace_mini);
@@ -996,7 +997,7 @@ inline void queue_testcase_retake(afl_state_t *afl, struct queue_entry *q,
 
       if (unlikely(!q->testcase_buf)) {
 
-        PFATAL("Unable to malloc '%s' with len %d", q->fname, len);
+        PFATAL("Unable to malloc '%s' with len %u", q->fname, len);
 
       }
 
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index c5db8fa1..7dba1caa 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -445,6 +445,9 @@ static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
 
   u32 k;
   u8  cons_ff = 0, cons_0 = 0;
+
+  if (shape > sizeof(v)) FATAL("shape is greater than %zu, please report!", sizeof(v));
+
   for (k = 0; k < shape; ++k) {
 
     if (b[k] == 0) {
@@ -453,7 +456,7 @@ static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
 
     } else if (b[k] == 0xff) {
 
-      ++cons_0;
+      ++cons_ff;
 
     } else {
 
@@ -667,12 +670,12 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
 
   u8 status = 0;
   // opt not in the paper
-  u32 fails = 0;
+//  u32 fails = 0;
   u8  found_one = 0;
 
   for (i = 0; i < loggeds; ++i) {
 
-    fails = 0;
+    u32 fails = 0;
 
     struct cmpfn_operands *o =
         &((struct cmpfn_operands *)afl->shm.cmp_map->log[key])[i];
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 339fb9c3..11d8204b 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -682,7 +682,7 @@ void sync_fuzzers(afl_state_t *afl) {
     // same time. If so, the first temporary main node running again will demote
     // themselves so this is not an issue
 
-    u8 path[PATH_MAX];
+//    u8 path2[PATH_MAX];
     afl->is_main_node = 1;
     sprintf(path, "%s/is_main_node", afl->out_dir);
     int fd = open(path, O_CREAT | O_RDWR, 0644);
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index 1c211da6..c8366174 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -31,7 +31,6 @@
 
 void write_setup_file(afl_state_t *afl, u32 argc, char **argv) {
 
-  char *val;
   u8    fn[PATH_MAX];
   snprintf(fn, PATH_MAX, "%s/fuzzer_setup", afl->out_dir);
   FILE *f = create_ffile(fn);
@@ -44,6 +43,7 @@ void write_setup_file(afl_state_t *afl, u32 argc, char **argv) {
 
   for (i = 0; i < s_afl_env; ++i) {
 
+    char *val;
     if ((val = getenv(afl_environment_variables[i])) != NULL) {
 
       fprintf(f, "%s=%s\n", afl_environment_variables[i], val);
@@ -228,7 +228,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
 
       if (afl->virgin_bits[i] != 0xff) {
 
-        fprintf(f, " %d[%02x]", i, afl->virgin_bits[i]);
+        fprintf(f, " %u[%02x]", i, afl->virgin_bits[i]);
 
       }
 
@@ -238,7 +238,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
     fprintf(f, "var_bytes        :");
     for (i = 0; i < afl->fsrv.map_size; i++) {
 
-      if (afl->var_bytes[i]) { fprintf(f, " %d", i); }
+      if (afl->var_bytes[i]) { fprintf(f, " %u", i); }
 
     }
 
@@ -1163,7 +1163,7 @@ void show_init_stats(afl_state_t *afl) {
 
   } else {
 
-    ACTF("-t option specified. We'll use an exec timeout of %d ms.",
+    ACTF("-t option specified. We'll use an exec timeout of %u ms.",
          afl->fsrv.exec_tmout);
 
   }
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 897c2f1e..e239b47f 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -99,8 +99,8 @@ static void usage(u8 *argv0, int more_help) {
       "                  lin, quad> -- see docs/power_schedules.md\n"
       "  -f file       - location read by the fuzzed program (default: stdin "
       "or @@)\n"
-      "  -t msec       - timeout for each run (auto-scaled, 50-%d ms)\n"
-      "  -m megs       - memory limit for child process (%d MB, 0 = no limit)\n"
+      "  -t msec       - timeout for each run (auto-scaled, 50-%u ms)\n"
+      "  -m megs       - memory limit for child process (%u MB, 0 = no limit)\n"
       "  -Q            - use binary-only instrumentation (QEMU mode)\n"
       "  -U            - use unicorn-based instrumentation (Unicorn mode)\n"
       "  -W            - use qemu-based instrumentation with Wine (Wine "
@@ -299,7 +299,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   s32 opt, i, auto_sync = 0 /*, user_set_cache = 0*/;
   u64 prev_queued = 0;
-  u32 sync_interval_cnt = 0, seek_to = 0, show_help = 0, map_size = MAP_SIZE;
+  u32 sync_interval_cnt = 0, seek_to = 0, show_help = 0, map_size = get_map_size();
   u8 *extras_dir[4];
   u8  mem_limit_given = 0, exit_1 = 0, debug = 0,
      extras_dir_cnt = 0 /*, have_p = 0*/;
@@ -326,7 +326,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   if (get_afl_env("AFL_DEBUG")) { debug = afl->debug = 1; }
 
-  map_size = get_map_size();
+//  map_size = get_map_size();
   afl_state_init(afl, map_size);
   afl->debug = debug;
   afl_fsrv_init(&afl->fsrv);
diff --git a/src/afl-ld-lto.c b/src/afl-ld-lto.c
index fccdb1a5..1d54fda0 100644
--- a/src/afl-ld-lto.c
+++ b/src/afl-ld-lto.c
@@ -187,7 +187,7 @@ static void edit_params(int argc, char **argv) {
 
   if (debug)
     DEBUGF(
-        "passthrough=%s instrim=%d, gold_pos=%d, gold_present=%s "
+        "passthrough=%s instrim=%u, gold_pos=%u, gold_present=%s "
         "inst_present=%s rt_present=%s rt_lto_present=%s\n",
         passthrough ? "true" : "false", instrim, gold_pos,
         gold_present ? "true" : "false", inst_present ? "true" : "false",
@@ -253,10 +253,10 @@ static void edit_params(int argc, char **argv) {
 int main(int argc, char **argv) {
 
   s32  pid, i, status;
-  u8 * ptr;
+//  u8 * ptr;
   char thecwd[PATH_MAX];
 
-  if ((ptr = getenv("AFL_LD_CALLER")) != NULL) {
+  if (getenv("AFL_LD_CALLER") != NULL) {
 
     FATAL("ld loop detected! Set AFL_REAL_LD!\n");
 
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 355b2dc3..c0223a07 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -662,7 +662,7 @@ static void usage(u8 *argv0) {
 
       "Execution control settings:\n"
       "  -t msec       - timeout for each run (none)\n"
-      "  -m megs       - memory limit for child process (%d MB)\n"
+      "  -m megs       - memory limit for child process (%u MB)\n"
       "  -Q            - use binary-only instrumentation (QEMU mode)\n"
       "  -U            - use Unicorn-based instrumentation (Unicorn mode)\n"
       "  -W            - use qemu-based instrumentation with Wine (Wine mode)\n"
@@ -1014,7 +1014,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
     DIR *          dir_in, *dir_out = NULL;
     struct dirent *dir_ent;
-    int            done = 0;
+//    int            done = 0;
     u8             infile[PATH_MAX], outfile[PATH_MAX];
     u8             wait_for_gdb = 0;
 #if !defined(DT_REG)
@@ -1090,11 +1090,11 @@ int main(int argc, char **argv_orig, char **envp) {
 
     if (get_afl_env("AFL_DEBUG")) {
 
-      int i = optind;
+      int j = optind;
       DEBUGF("%s:", fsrv->target_path);
-      while (argv[i] != NULL) {
+      while (argv[j] != NULL) {
 
-        SAYF(" \"%s\"", argv[i++]);
+        SAYF(" \"%s\"", argv[j++]);
 
       }
 
@@ -1143,7 +1143,7 @@ int main(int argc, char **argv_orig, char **envp) {
     if (fsrv->support_shmem_fuzz && !fsrv->use_shmem_fuzz)
       shm_fuzz = deinit_shmem(fsrv, shm_fuzz);
 
-    while (done == 0 && (dir_ent = readdir(dir_in))) {
+    while ((dir_ent = readdir(dir_in))) {
 
       if (dir_ent->d_name[0] == '.') {
 
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index ed928c7c..09d97f58 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -835,8 +835,8 @@ static void usage(u8 *argv0) {
       "Execution control settings:\n"
 
       "  -f file       - input file read by the tested program (stdin)\n"
-      "  -t msec       - timeout for each run (%d ms)\n"
-      "  -m megs       - memory limit for child process (%d MB)\n"
+      "  -t msec       - timeout for each run (%u ms)\n"
+      "  -m megs       - memory limit for child process (%u MB)\n"
       "  -Q            - use binary-only instrumentation (QEMU mode)\n"
       "  -U            - use unicorn-based instrumentation (Unicorn mode)\n"
       "  -W            - use qemu-based instrumentation with Wine (Wine "
-- 
cgit 1.4.1


From 6c095b3937565e0e3c645cab706269e8c764701e Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 4 Jan 2021 23:13:56 +0100
Subject: code format

---
 instrumentation/afl-compiler-rt.o.c                | 19 ++++++++++++++-----
 instrumentation/afl-llvm-lto-instrumentation.so.cc |  6 +++---
 instrumentation/cmplog-instructions-pass.cc        | 14 +++++++-------
 instrumentation/compare-transform-pass.so.cc       | 21 ++++++++++++---------
 src/afl-cc.c                                       | 15 +++++++++------
 src/afl-fuzz-bitmap.c                              |  2 +-
 src/afl-fuzz-extras.c                              |  2 +-
 src/afl-fuzz-mutators.c                            |  2 +-
 src/afl-fuzz-queue.c                               |  2 +-
 src/afl-fuzz-redqueen.c                            |  7 ++++---
 src/afl-fuzz-run.c                                 |  2 +-
 src/afl-fuzz-stats.c                               |  2 +-
 src/afl-fuzz.c                                     |  5 +++--
 src/afl-ld-lto.c                                   |  4 ++--
 src/afl-showmap.c                                  |  6 +++---
 15 files changed, 63 insertions(+), 46 deletions(-)

(limited to 'src/afl-fuzz.c')

diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 0b6c6e47..fdfc8d58 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -691,17 +691,26 @@ static void __afl_start_forkserver(void) {
 
   void (*old_sigchld_handler)(int) = 0;  // = signal(SIGCHLD, SIG_DFL);
 
-  if (__afl_map_size <= FS_OPT_MAX_MAPSIZE)
+  if (__afl_map_size <= FS_OPT_MAX_MAPSIZE) {
+
     status_for_fsrv |= (FS_OPT_SET_MAPSIZE(__afl_map_size) | FS_OPT_MAPSIZE);
-  if (__afl_dictionary_len && __afl_dictionary) status_for_fsrv |= FS_OPT_AUTODICT;
-  if (__afl_sharedmem_fuzzing != 0) status_for_fsrv |= FS_OPT_SHDMEM_FUZZ;
-  if (status_for_fsrv) status_for_fsrv |= (FS_OPT_ENABLED);
+
+  }
+
+  if (__afl_dictionary_len && __afl_dictionary) {
+
+    status_for_fsrv |= FS_OPT_AUTODICT;
+
+  }
+
+  if (__afl_sharedmem_fuzzing != 0) { status_for_fsrv |= FS_OPT_SHDMEM_FUZZ; }
+  if (status_for_fsrv) { status_for_fsrv |= (FS_OPT_ENABLED); }
   memcpy(tmp, &status_for_fsrv, 4);
 
   /* Phone home and tell the parent that we're OK. If parent isn't there,
      assume we're not running in forkserver mode and just execute program. */
 
-  if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
+  if (write(FORKSRV_FD + 1, tmp, 4) != 4) { return; }
 
   if (__afl_sharedmem_fuzzing || (__afl_dictionary_len && __afl_dictionary)) {
 
diff --git a/instrumentation/afl-llvm-lto-instrumentation.so.cc b/instrumentation/afl-llvm-lto-instrumentation.so.cc
index 89d49936..9cacacf9 100644
--- a/instrumentation/afl-llvm-lto-instrumentation.so.cc
+++ b/instrumentation/afl-llvm-lto-instrumentation.so.cc
@@ -100,9 +100,9 @@ class AFLLTOPass : public ModulePass {
 
 bool AFLLTOPass::runOnModule(Module &M) {
 
-  LLVMContext &                    C = M.getContext();
-  std::vector<std::string>         dictionary;
-//  std::vector<CallInst *>          calls;
+  LLVMContext &            C = M.getContext();
+  std::vector<std::string> dictionary;
+  //  std::vector<CallInst *>          calls;
   DenseMap<Value *, std::string *> valueMap;
   std::vector<BasicBlock *>        BlockList;
   char *                           ptr;
diff --git a/instrumentation/cmplog-instructions-pass.cc b/instrumentation/cmplog-instructions-pass.cc
index 154bec2b..3499ccf0 100644
--- a/instrumentation/cmplog-instructions-pass.cc
+++ b/instrumentation/cmplog-instructions-pass.cc
@@ -234,9 +234,9 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
       auto ty0 = op0->getType();
       if (ty0->isHalfTy()
 #if LLVM_VERSION_MAJOR >= 11
-       || ty0->isBFloatTy()
+          || ty0->isBFloatTy()
 #endif
-       )
+      )
         max_size = 16;
       else if (ty0->isFloatTy())
         max_size = 32;
@@ -253,15 +253,15 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
         if (intTyOp0 && intTyOp1) {
 
           max_size = intTyOp0->getBitWidth() > intTyOp1->getBitWidth()
-                       ? intTyOp0->getBitWidth()
-                       : intTyOp1->getBitWidth();
+                         ? intTyOp0->getBitWidth()
+                         : intTyOp1->getBitWidth();
           args.push_back(V0);
           args.push_back(V1);
-          
+
         } else {
-        
+
           max_size = 0;
-        
+
         }
 
       }
diff --git a/instrumentation/compare-transform-pass.so.cc b/instrumentation/compare-transform-pass.so.cc
index 887970a0..da5cf7e9 100644
--- a/instrumentation/compare-transform-pass.so.cc
+++ b/instrumentation/compare-transform-pass.so.cc
@@ -68,7 +68,7 @@ class CompareTransform : public ModulePass {
   const char *getPassName() const override {
 
 #else
-  StringRef getPassName() const override {
+  StringRef      getPassName() const override {
 
 #endif
     return "transforms compare functions";
@@ -106,23 +106,26 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
   FunctionCallee tolowerFn;
 #endif
   {
+
 #if LLVM_VERSION_MAJOR < 9
-  Constant *
+    Constant *
 #else
-  FunctionCallee
+    FunctionCallee
 #endif
-      c = M.getOrInsertFunction("tolower", Int32Ty, Int32Ty
+        c = M.getOrInsertFunction("tolower", Int32Ty, Int32Ty
 #if LLVM_VERSION_MAJOR < 5
-                                ,
-                                NULL
+                                  ,
+                                  NULL
 #endif
-      );
+        );
 #if LLVM_VERSION_MAJOR < 9
-  tolowerFn = cast<Function>(c);
+    tolowerFn = cast<Function>(c);
 #else
-  tolowerFn = c;
+    tolowerFn = c;
 #endif
+
   }
+
   /* iterate over all functions, bbs and instruction and add suitable calls to
    * strcmp/memcmp/strncmp/strcasecmp/strncasecmp */
   for (auto &F : M) {
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 180ab3c4..db2dcd14 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -121,9 +121,12 @@ char compiler_mode_string[7][12] = {
 u8 *getthecwd() {
 
   if (getcwd(cwd, sizeof(cwd)) == NULL) {
+
     static u8 fail[] = "";
     return fail;
+
   }
+
   return cwd;
 
 }
@@ -1451,11 +1454,11 @@ int main(int argc, char **argv, char **envp) {
         "of afl-cc.\n\n");
 
 #if LLVM_MAJOR > 10 || (LLVM_MAJOR == 10 && LLVM_MINOR > 0)
-#define NATIVE_MSG \
-        "  NATIVE:  use llvm's native PCGUARD instrumentation (less " \
-        "performant)\n"
+  #define NATIVE_MSG                                              \
+    "  NATIVE:  use llvm's native PCGUARD instrumentation (less " \
+    "performant)\n"
 #else
-#define NATIVE_MSG ""
+  #define NATIVE_MSG ""
 #endif
 
     SAYF(
@@ -1463,7 +1466,7 @@ int main(int argc, char **argv, char **envp) {
         "available)\n"
         "  PCGUARD: Dominator tree instrumentation (best!) (README.llvm.md)\n"
 
-	NATIVE_MSG
+        NATIVE_MSG
 
         "  CLASSIC: decision target instrumentation (README.llvm.md)\n"
         "  CTX:     CLASSIC + callee context (instrumentation/README.ctx.md)\n"
@@ -1635,7 +1638,7 @@ int main(int argc, char **argv, char **envp) {
       if (!instrument_mode) {
 
         instrument_mode = INSTRUMENT_CFG;
-        //ptr = instrument_mode_string[instrument_mode];
+        // ptr = instrument_mode_string[instrument_mode];
 
       }
 
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 85a01f98..ed8c2510 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -703,7 +703,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
         if (!classified) {
 
           classify_counts(&afl->fsrv);
-//          classified = 1;
+          //          classified = 1;
 
         }
 
diff --git a/src/afl-fuzz-extras.c b/src/afl-fuzz-extras.c
index 04f0878c..a3583651 100644
--- a/src/afl-fuzz-extras.c
+++ b/src/afl-fuzz-extras.c
@@ -450,7 +450,7 @@ void add_extra(afl_state_t *afl, u8 *mem, u32 len) {
 
   if (len > MAX_DICT_FILE) {
 
-    u8  val_bufs[2][STRINGIFY_VAL_SIZE_MAX];
+    u8 val_bufs[2][STRINGIFY_VAL_SIZE_MAX];
     WARNF("Extra '%.*s' is too big (%s, limit is %s), skipping file!", (int)len,
           mem, stringify_mem_size(val_bufs[0], sizeof(val_bufs[0]), len),
           stringify_mem_size(val_bufs[1], sizeof(val_bufs[1]), MAX_DICT_FILE));
diff --git a/src/afl-fuzz-mutators.c b/src/afl-fuzz-mutators.c
index 5da692d3..089707b9 100644
--- a/src/afl-fuzz-mutators.c
+++ b/src/afl-fuzz-mutators.c
@@ -324,7 +324,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
   } else {
 
     afl->stage_max = retval;
- 
+
   }
 
   if (afl->not_on_tty && afl->debug) {
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index cd41bafc..7b8c039b 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -489,7 +489,7 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
 
 void destroy_queue(afl_state_t *afl) {
 
-  u32                 i;
+  u32 i;
 
   for (i = 0; i < afl->queued_paths; i++) {
 
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index 7dba1caa..28585afe 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -446,7 +446,8 @@ static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
   u32 k;
   u8  cons_ff = 0, cons_0 = 0;
 
-  if (shape > sizeof(v)) FATAL("shape is greater than %zu, please report!", sizeof(v));
+  if (shape > sizeof(v))
+    FATAL("shape is greater than %zu, please report!", sizeof(v));
 
   for (k = 0; k < shape; ++k) {
 
@@ -670,8 +671,8 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
 
   u8 status = 0;
   // opt not in the paper
-//  u32 fails = 0;
-  u8  found_one = 0;
+  //  u32 fails = 0;
+  u8 found_one = 0;
 
   for (i = 0; i < loggeds; ++i) {
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 11d8204b..41557707 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -682,7 +682,7 @@ void sync_fuzzers(afl_state_t *afl) {
     // same time. If so, the first temporary main node running again will demote
     // themselves so this is not an issue
 
-//    u8 path2[PATH_MAX];
+    //    u8 path2[PATH_MAX];
     afl->is_main_node = 1;
     sprintf(path, "%s/is_main_node", afl->out_dir);
     int fd = open(path, O_CREAT | O_RDWR, 0644);
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index c8366174..e86f2aeb 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -31,7 +31,7 @@
 
 void write_setup_file(afl_state_t *afl, u32 argc, char **argv) {
 
-  u8    fn[PATH_MAX];
+  u8 fn[PATH_MAX];
   snprintf(fn, PATH_MAX, "%s/fuzzer_setup", afl->out_dir);
   FILE *f = create_ffile(fn);
   u32   i;
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index e239b47f..063134fb 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -299,7 +299,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
   s32 opt, i, auto_sync = 0 /*, user_set_cache = 0*/;
   u64 prev_queued = 0;
-  u32 sync_interval_cnt = 0, seek_to = 0, show_help = 0, map_size = get_map_size();
+  u32 sync_interval_cnt = 0, seek_to = 0, show_help = 0,
+      map_size = get_map_size();
   u8 *extras_dir[4];
   u8  mem_limit_given = 0, exit_1 = 0, debug = 0,
      extras_dir_cnt = 0 /*, have_p = 0*/;
@@ -326,7 +327,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   if (get_afl_env("AFL_DEBUG")) { debug = afl->debug = 1; }
 
-//  map_size = get_map_size();
+  //  map_size = get_map_size();
   afl_state_init(afl, map_size);
   afl->debug = debug;
   afl_fsrv_init(&afl->fsrv);
diff --git a/src/afl-ld-lto.c b/src/afl-ld-lto.c
index 1d54fda0..7a4d9132 100644
--- a/src/afl-ld-lto.c
+++ b/src/afl-ld-lto.c
@@ -252,8 +252,8 @@ static void edit_params(int argc, char **argv) {
 
 int main(int argc, char **argv) {
 
-  s32  pid, i, status;
-//  u8 * ptr;
+  s32 pid, i, status;
+  //  u8 * ptr;
   char thecwd[PATH_MAX];
 
   if (getenv("AFL_LD_CALLER") != NULL) {
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index c0223a07..d50601fc 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -1014,9 +1014,9 @@ int main(int argc, char **argv_orig, char **envp) {
 
     DIR *          dir_in, *dir_out = NULL;
     struct dirent *dir_ent;
-//    int            done = 0;
-    u8             infile[PATH_MAX], outfile[PATH_MAX];
-    u8             wait_for_gdb = 0;
+    //    int            done = 0;
+    u8 infile[PATH_MAX], outfile[PATH_MAX];
+    u8 wait_for_gdb = 0;
 #if !defined(DT_REG)
     struct stat statbuf;
 #endif
-- 
cgit 1.4.1


From 9cdf5c415015e4e80b577c021b8b9fcf8a3d58fb Mon Sep 17 00:00:00 2001
From: buherator <buherator@silentsignal.hu>
Date: Thu, 7 Jan 2021 22:35:34 +0100
Subject: User defined kill signal value (#678)

* Adding AFL_KILL_SIGNAL environment variable

Controlling the kill signal used to end forked processes.

* Checking validity of AFL_KILL_SIGNAL env variable

This commit also sets a valid value in the environment to avoid
duplicating code in at_exit(). Changing data type of
fsrv->kill_signal to u8 to match last_kill_signal.

* Adding afl_kill_signal to AFL (environment) state

This commit simply introduces a struct member for future use. The
env variable is not used from the afl struct but from fsrv, where
its validity is checked, resulting in a FATAL in case of errors.
---
 include/afl-fuzz.h   |  2 +-
 include/envs.h       |  1 +
 include/forkserver.h |  2 ++
 src/afl-forkserver.c | 44 +++++++++++++++++++++++++++++++++++++++-----
 src/afl-fuzz-state.c | 11 +++++++++--
 src/afl-fuzz.c       | 13 +++++++++++--
 6 files changed, 63 insertions(+), 10 deletions(-)

(limited to 'src/afl-fuzz.c')

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index ede54f0e..988a907d 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -381,7 +381,7 @@ typedef struct afl_env_vars {
       *afl_hang_tmout, *afl_forksrv_init_tmout, *afl_skip_crashes, *afl_preload,
       *afl_max_det_extras, *afl_statsd_host, *afl_statsd_port,
       *afl_crash_exitcode, *afl_statsd_tags_flavor, *afl_testcache_size,
-      *afl_testcache_entries;
+      *afl_testcache_entries, *afl_kill_signal;
 
 } afl_env_vars_t;
 
diff --git a/include/envs.h b/include/envs.h
index e4e49c4d..97367fae 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -61,6 +61,7 @@ static char *afl_environment_variables[] = {
     "AFL_IMPORT_FIRST",
     "AFL_INST_LIBS",
     "AFL_INST_RATIO",
+    "AFL_KILL_SIGNAL",
     "AFL_KEEP_TRACES",
     "AFL_KEEP_ASSEMBLY",
     "AFL_LD_HARD_FAIL",
diff --git a/include/forkserver.h b/include/forkserver.h
index 8e029266..3019e289 100644
--- a/include/forkserver.h
+++ b/include/forkserver.h
@@ -99,6 +99,8 @@ typedef struct afl_forkserver {
 
   void (*add_extra_func)(void *afl_ptr, u8 *mem, u32 len);
 
+  u8 kill_signal;
+
 } afl_forkserver_t;
 
 typedef enum fsrv_run_result {
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index d6195cb5..70fb9572 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -95,6 +95,29 @@ void afl_fsrv_init(afl_forkserver_t *fsrv) {
   fsrv->uses_asan = false;
 
   fsrv->init_child_func = fsrv_exec_child;
+  fsrv->kill_signal = SIGKILL;
+
+  char *kill_signal_env = get_afl_env("AFL_KILL_SIGNAL");
+  if (kill_signal_env) {
+
+    char *endptr;
+    u8    signal_code;
+    signal_code = (u8)strtoul(kill_signal_env, &endptr, 10);
+    /* Did we manage to parse the full string? */
+    if (*endptr != '\0' || endptr == kill_signal_env) {
+
+      FATAL("Invalid kill signal value!");
+
+    }
+
+    fsrv->kill_signal = signal_code;
+
+  } else {
+
+    /* Using hardcoded code for SIGKILL for the sake of simplicity */
+    setenv("AFL_KILL_SIGNAL", "9", 1);
+
+  }
 
   list_append(&fsrv_list, fsrv);
 
@@ -126,6 +149,8 @@ void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) {
   fsrv_to->init_child_func = from->init_child_func;
   // Note: do not copy ->add_extra_func
 
+  fsrv_to->kill_signal = from->kill_signal;
+
   list_append(&fsrv_list, fsrv_to);
 
 }
@@ -559,12 +584,12 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
     if (!time_ms) {
 
-      kill(fsrv->fsrv_pid, SIGKILL);
+      kill(fsrv->fsrv_pid, fsrv->kill_signal);
 
     } else if (time_ms > fsrv->init_tmout) {
 
       fsrv->last_run_timed_out = 1;
-      kill(fsrv->fsrv_pid, SIGKILL);
+      kill(fsrv->fsrv_pid, fsrv->kill_signal);
 
     } else {
 
@@ -944,10 +969,10 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
 static void afl_fsrv_kill(afl_forkserver_t *fsrv) {
 
-  if (fsrv->child_pid > 0) { kill(fsrv->child_pid, SIGKILL); }
+  if (fsrv->child_pid > 0) { kill(fsrv->child_pid, fsrv->kill_signal); }
   if (fsrv->fsrv_pid > 0) {
 
-    kill(fsrv->fsrv_pid, SIGKILL);
+    kill(fsrv->fsrv_pid, fsrv->kill_signal);
     if (waitpid(fsrv->fsrv_pid, NULL, 0) <= 0) { WARNF("error waitpid\n"); }
 
   }
@@ -1091,7 +1116,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
     /* If there was no response from forkserver after timeout seconds,
     we kill the child. The forkserver should inform us afterwards */
 
-    kill(fsrv->child_pid, SIGKILL);
+    kill(fsrv->child_pid, fsrv->kill_signal);
     fsrv->last_run_timed_out = 1;
     if (read(fsrv->fsrv_st_fd, &fsrv->child_status, 4) < 4) { exec_ms = 0; }
 
@@ -1137,6 +1162,15 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
 
   /* Report outcome to caller. */
 
+  /* TODO We use SIGTERM here as an indicator of Xen mode,
+     although it's not equivalent! */
+  if (fsrv->kill_signal == SIGTERM && !*stop_soon_p &&
+      fsrv->last_run_timed_out) {
+
+    return FSRV_RUN_TMOUT;
+
+  }
+
   if (WIFSIGNALED(fsrv->child_status) && !*stop_soon_p) {
 
     fsrv->last_kill_signal = WTERMSIG(fsrv->child_status);
diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c
index 34456c0d..60c9684c 100644
--- a/src/afl-fuzz-state.c
+++ b/src/afl-fuzz-state.c
@@ -418,6 +418,13 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
                 (u8 *)get_afl_env(afl_environment_variables[i]);
 #endif
 
+          } else if (!strncmp(env, "AFL_KILL_SIGNAL",
+
+                              afl_environment_variable_len)) {
+
+            afl->afl_env.afl_kill_signal =
+                (u8 *)get_afl_env(afl_environment_variables[i]);
+
           }
 
         } else {
@@ -524,8 +531,8 @@ void afl_states_stop(void) {
 
   LIST_FOREACH(&afl_states, afl_state_t, {
 
-    if (el->fsrv.child_pid > 0) kill(el->fsrv.child_pid, SIGKILL);
-    if (el->fsrv.fsrv_pid > 0) kill(el->fsrv.fsrv_pid, SIGKILL);
+    if (el->fsrv.child_pid > 0) kill(el->fsrv.child_pid, el->fsrv.kill_signal);
+    if (el->fsrv.fsrv_pid > 0) kill(el->fsrv.fsrv_pid, el->fsrv.kill_signal);
 
   });
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 063134fb..00625f2e 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -76,8 +76,17 @@ static void at_exit() {
 
   }
 
-  if (pid1 > 0) { kill(pid1, SIGKILL); }
-  if (pid2 > 0) { kill(pid2, SIGKILL); }
+  u8 kill_signal = SIGKILL;
+
+  /* AFL_KILL_SIGNAL should already be initialized by afl_fsrv_init() */
+  if (getenv("AFL_KILL_SIGNAL")) {
+
+    kill_signal = atoi(getenv("AFL_KILL_SIGNAL"));
+
+  }
+
+  if (pid1 > 0) { kill(pid1, kill_signal); }
+  if (pid2 > 0) { kill(pid2, kill_signal); }
 
 }
 
-- 
cgit 1.4.1


From a06b25538fd7b6eef6755094aa4678c2cb5333fd Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Thu, 7 Jan 2021 23:21:10 +0100
Subject: cleaned up AFL_KILL_SIGNAL

---
 afl-cmin              |  1 +
 docs/Changelog.md     |  2 +-
 docs/env_variables.md |  4 ++++
 src/afl-forkserver.c  | 45 +++++++--------------------------------------
 src/afl-fuzz.c        | 30 +++++++++++++++++++++++++++++-
 src/afl-showmap.c     | 37 +++++++++++++++++++++++++++++++++----
 src/afl-tmin.c        | 29 +++++++++++++++++++++++++++++
 7 files changed, 104 insertions(+), 44 deletions(-)

(limited to 'src/afl-fuzz.c')

diff --git a/afl-cmin b/afl-cmin
index eef2b7ef..726e90ab 100755
--- a/afl-cmin
+++ b/afl-cmin
@@ -120,6 +120,7 @@ function usage() {
 "AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash\n" \
 "AFL_FORKSRV_INIT_TMOUT: time the fuzzer waits for the target to come up, initially\n" \
 "AFL_KEEP_TRACES: leave the temporary <out_dir>/.traces directory\n" \
+"AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL)\n"
 "AFL_PATH: path for the afl-showmap binary if not found anywhere else\n" \
 "AFL_SKIP_BIN_CHECK: skip check for target binary\n"
    exit 1
diff --git a/docs/Changelog.md b/docs/Changelog.md
index 03b8e036..81ac91b0 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -32,7 +32,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
     already building with all cores, the gcc plugin needs only one.
   - added dummy Makefile to instrumentation/
   - Updated utils/afl_frida to be 5% faster
-
+  - Added AFL_KILL_SIGNAL env variable for custom targets (thanks @v-p-b)
 
 ### Version ++3.00c (release)
   - llvm_mode/ and gcc_plugin/ moved to instrumentation/
diff --git a/docs/env_variables.md b/docs/env_variables.md
index e6b9381b..26128b01 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -350,6 +350,10 @@ checks or alter some of the more exotic semantics of the tool:
   - Note that `AFL_POST_LIBRARY` is deprecated, use `AFL_CUSTOM_MUTATOR_LIBRARY`
     instead (see below).
 
+  - `AFL_KILL_SIGNAL`: Set the signal ID to be delivered to child processes on timeout.
+    Unless you implement your own targets or instrumentation, you likely don't have to set it.
+    By default, on timeout and on exit, `SIGKILL` (`AFL_KILL_SIGNAL=9`) will be delivered to the child.
+
   - Setting `AFL_CUSTOM_MUTATOR_LIBRARY` to a shared library with
     afl_custom_fuzz() creates additional mutations through this library.
     If afl-fuzz is compiled with Python (which is autodetected during builing
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 70fb9572..b7aa87f8 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -84,6 +84,7 @@ void afl_fsrv_init(afl_forkserver_t *fsrv) {
   fsrv->init_tmout = EXEC_TIMEOUT * FORK_WAIT_MULT;
   fsrv->mem_limit = MEM_LIMIT;
   fsrv->out_file = NULL;
+  fsrv->kill_signal = SIGKILL;
 
   /* exec related stuff */
   fsrv->child_pid = -1;
@@ -95,30 +96,6 @@ void afl_fsrv_init(afl_forkserver_t *fsrv) {
   fsrv->uses_asan = false;
 
   fsrv->init_child_func = fsrv_exec_child;
-  fsrv->kill_signal = SIGKILL;
-
-  char *kill_signal_env = get_afl_env("AFL_KILL_SIGNAL");
-  if (kill_signal_env) {
-
-    char *endptr;
-    u8    signal_code;
-    signal_code = (u8)strtoul(kill_signal_env, &endptr, 10);
-    /* Did we manage to parse the full string? */
-    if (*endptr != '\0' || endptr == kill_signal_env) {
-
-      FATAL("Invalid kill signal value!");
-
-    }
-
-    fsrv->kill_signal = signal_code;
-
-  } else {
-
-    /* Using hardcoded code for SIGKILL for the sake of simplicity */
-    setenv("AFL_KILL_SIGNAL", "9", 1);
-
-  }
-
   list_append(&fsrv_list, fsrv);
 
 }
@@ -139,6 +116,7 @@ void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) {
   fsrv_to->no_unlink = from->no_unlink;
   fsrv_to->uses_crash_exitcode = from->uses_crash_exitcode;
   fsrv_to->crash_exitcode = from->crash_exitcode;
+  fsrv_to->kill_signal = from->kill_signal;
 
   // These are forkserver specific.
   fsrv_to->out_dir_fd = -1;
@@ -149,8 +127,6 @@ void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) {
   fsrv_to->init_child_func = from->init_child_func;
   // Note: do not copy ->add_extra_func
 
-  fsrv_to->kill_signal = from->kill_signal;
-
   list_append(&fsrv_list, fsrv_to);
 
 }
@@ -1162,25 +1138,18 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
 
   /* Report outcome to caller. */
 
-  /* TODO We use SIGTERM here as an indicator of Xen mode,
-     although it's not equivalent! */
-  if (fsrv->kill_signal == SIGTERM && !*stop_soon_p &&
-      fsrv->last_run_timed_out) {
+  /* Did we timeout? */
+  if (unlikely(fsrv->last_run_timed_out)) {
 
+    fsrv->last_kill_signal = fsrv->kill_signal;
     return FSRV_RUN_TMOUT;
 
   }
 
-  if (WIFSIGNALED(fsrv->child_status) && !*stop_soon_p) {
+  /* Did we crash? */
+  if (unlikely(WIFSIGNALED(fsrv->child_status) && !*stop_soon_p)) {
 
     fsrv->last_kill_signal = WTERMSIG(fsrv->child_status);
-
-    if (fsrv->last_run_timed_out && fsrv->last_kill_signal == SIGKILL) {
-
-      return FSRV_RUN_TMOUT;
-
-    }
-
     return FSRV_RUN_CRASH;
 
   }
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 00625f2e..5c363c63 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -194,10 +194,11 @@ static void usage(u8 *argv0, int more_help) {
       "AFL_EXPAND_HAVOC_NOW: immediately enable expand havoc mode (default: after 60 minutes and a cycle without finds)\n"
       "AFL_FAST_CAL: limit the calibration stage to three cycles for speedup\n"
       "AFL_FORCE_UI: force showing the status screen (for virtual consoles)\n"
-      "AFL_HANG_TMOUT: override timeout value (in milliseconds)\n"
       "AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in milliseconds)\n"
+      "AFL_HANG_TMOUT: override timeout value (in milliseconds)\n"
       "AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: don't warn about core dump handlers\n"
       "AFL_IMPORT_FIRST: sync and import test cases from other fuzzer instances first\n"
+      "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL)\n"
       "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n"
       "              the target was compiled for\n"
       "AFL_MAX_DET_EXTRAS: if more entries are in the dictionary list than this value\n"
@@ -986,6 +987,33 @@ int main(int argc, char **argv_orig, char **envp) {
 
   #endif
 
+  afl->fsrv.kill_signal = SIGKILL;
+  if (afl->afl_env.afl_kill_signal) {
+
+    char *endptr;
+    u8    signal_code;
+    signal_code = (u8)strtoul(afl->afl_env.afl_kill_signal, &endptr, 10);
+    /* Did we manage to parse the full string? */
+    if (*endptr != '\0' || endptr == (char *)afl->afl_env.afl_kill_signal) {
+
+      FATAL("Invalid AFL_KILL_SIGNAL: %s (expected unsigned int)",
+            afl->afl_env.afl_kill_signal);
+
+    }
+
+    afl->fsrv.kill_signal = signal_code;
+
+  } else {
+
+    char *sigstr = alloc_printf("%d", (int)SIGKILL);
+    if (!sigstr) { FATAL("Failed to alloc mem for signal buf"); }
+
+    /* Set the env for signal handler */
+    setenv("AFL_KILL_SIGNAL", sigstr, 1);
+    free(sigstr);
+
+  }
+
   setup_signal_handlers();
   check_asan_opts(afl);
 
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index d50601fc..2c9c38ed 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -693,12 +693,13 @@ static void usage(u8 *argv0) {
       "AFL_CRASH_EXITCODE: optional child exit code to be interpreted as "
       "crash\n"
       "AFL_DEBUG: enable extra developer output\n"
-      "AFL_MAP_SIZE: the shared memory size for that target. must be >= the "
-      "size\n"
-      "              the target was compiled for\n"
-      "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
       "AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during "
       "startup (in milliseconds)\n"
+      "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, "
+      "etc. (default: SIGKILL)\n"
+      "AFL_MAP_SIZE: the shared memory size for that target. must be >= the "
+      "size the target was compiled for\n"
+      "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
       "AFL_QUIET: do not print extra informational output\n",
       argv0, MEM_LIMIT, doc_path);
 
@@ -1115,6 +1116,34 @@ int main(int argc, char **argv_orig, char **envp) {
 
     }
 
+    fsrv->kill_signal = SIGKILL;
+    char *afl_kill_signal_env = getenv("AFL_KILL_SIGNAL");
+    if (afl_kill_signal_env && afl_kill_signal_env[0]) {
+
+      char *endptr;
+      u8    signal_code;
+      signal_code = (u8)strtoul(afl_kill_signal_env, &endptr, 10);
+      /* Did we manage to parse the full string? */
+      if (*endptr != '\0' || endptr == afl_kill_signal_env) {
+
+        FATAL("Invalid AFL_KILL_SIGNAL: %s (expected unsigned int)",
+              afl_kill_signal_env);
+
+      }
+
+      fsrv->kill_signal = signal_code;
+
+    } else {
+
+      char *sigstr = alloc_printf("%d", (int)SIGKILL);
+      if (!sigstr) { FATAL("Failed to alloc mem for signal buf"); }
+
+      /* Set the env for signal handler */
+      setenv("AFL_KILL_SIGNAL", sigstr, 1);
+      free(sigstr);
+
+    }
+
     if (getenv("AFL_CRASH_EXITCODE")) {
 
       long exitcode = strtol(getenv("AFL_CRASH_EXITCODE"), NULL, 10);
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 09d97f58..342de9c8 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -855,6 +855,7 @@ static void usage(u8 *argv0) {
       "Environment variables used:\n"
       "AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash\n"
       "AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in milliseconds)\n"
+      "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL)\n"
       "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n"
       "              the target was compiled for\n"
       "AFL_PRELOAD:  LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
@@ -1134,6 +1135,34 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
+  fsrv->kill_signal = SIGKILL;
+  char *afl_kill_signal_env = getenv("AFL_KILL_SIGNAL");
+  if (afl_kill_signal_env && afl_kill_signal_env[0]) {
+
+    char *endptr;
+    u8    signal_code;
+    signal_code = (u8)strtoul(afl_kill_signal_env, &endptr, 10);
+    /* Did we manage to parse the full string? */
+    if (*endptr != '\0' || endptr == afl_kill_signal_env) {
+
+      FATAL("Invalid AFL_KILL_SIGNAL: %s (expected unsigned int)",
+            afl_kill_signal_env);
+
+    }
+
+    fsrv->kill_signal = signal_code;
+
+  } else {
+
+    char *sigstr = alloc_printf("%d", (int)SIGKILL);
+    if (!sigstr) { FATAL("Failed to alloc mem for signal buf"); }
+
+    /* Set the env for signal handler */
+    setenv("AFL_KILL_SIGNAL", sigstr, 1);
+    free(sigstr);
+
+  }
+
   if (getenv("AFL_CRASH_EXITCODE")) {
 
     long exitcode = strtol(getenv("AFL_CRASH_EXITCODE"), NULL, 10);
-- 
cgit 1.4.1


From 34732e3c5ede9020ff1802f0f0827e3731217dce Mon Sep 17 00:00:00 2001
From: Dominik Maier <domenukk@gmail.com>
Date: Fri, 8 Jan 2021 11:36:40 +0100
Subject: refactored kill signal env parsing

---
 include/common.h  |  5 +++++
 src/afl-common.c  | 34 ++++++++++++++++++++++++++++++++++
 src/afl-fuzz.c    | 32 ++++----------------------------
 src/afl-showmap.c | 29 ++---------------------------
 src/afl-tmin.c    | 29 ++---------------------------
 5 files changed, 47 insertions(+), 82 deletions(-)

(limited to 'src/afl-fuzz.c')

diff --git a/include/common.h b/include/common.h
index 125c3abf..9490ec5f 100644
--- a/include/common.h
+++ b/include/common.h
@@ -56,6 +56,11 @@ extern u8 *doc_path;                    /* path to documentation dir        */
 
 u8 *find_binary(u8 *fname);
 
+/* Parses the kill signal environment variable, FATALs on error.
+  If the env is not set, sets the env to default_signal for the signal handlers
+  and returns the default_signal. */
+int parse_afl_kill_signal_env(u8 *afl_kill_signal_env, int default_signal);
+
 /* Read a bitmap from file fname to memory
    This is for the -B option again. */
 
diff --git a/src/afl-common.c b/src/afl-common.c
index 21cb6ab4..3a7d0ce5 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -424,6 +424,40 @@ u8 *find_binary(u8 *fname) {
 
 }
 
+/* Parses the kill signal environment variable, FATALs on error.
+  If the env is not set, sets the env to default_signal for the signal handlers
+  and returns the default_signal. */
+int parse_afl_kill_signal_env(u8 *afl_kill_signal_env, int default_signal) {
+
+  if (afl_kill_signal_env && afl_kill_signal_env[0]) {
+
+    char *endptr;
+    u8    signal_code;
+    signal_code = (u8)strtoul(afl_kill_signal_env, &endptr, 10);
+    /* Did we manage to parse the full string? */
+    if (*endptr != '\0' || endptr == (char *)afl_kill_signal_env) {
+
+      FATAL("Invalid AFL_KILL_SIGNAL: %s (expected unsigned int)",
+            afl_kill_signal_env);
+
+    }
+
+    return signal_code;
+
+  } else {
+
+    char *sigstr = alloc_printf("%d", default_signal);
+    if (!sigstr) { FATAL("Failed to alloc mem for signal buf"); }
+
+    /* Set the env for signal handler */
+    setenv("AFL_KILL_SIGNAL", sigstr, 1);
+    free(sigstr);
+    return default_signal;
+
+  }
+
+}
+
 void check_environment_vars(char **envp) {
 
   if (be_quiet) { return; }
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 5c363c63..37f8db8a 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -76,9 +76,9 @@ static void at_exit() {
 
   }
 
-  u8 kill_signal = SIGKILL;
+  int kill_signal = SIGKILL;
 
-  /* AFL_KILL_SIGNAL should already be initialized by afl_fsrv_init() */
+  /* AFL_KILL_SIGNAL should already be a valid int at this point */
   if (getenv("AFL_KILL_SIGNAL")) {
 
     kill_signal = atoi(getenv("AFL_KILL_SIGNAL"));
@@ -987,32 +987,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
   #endif
 
-  afl->fsrv.kill_signal = SIGKILL;
-  if (afl->afl_env.afl_kill_signal) {
-
-    char *endptr;
-    u8    signal_code;
-    signal_code = (u8)strtoul(afl->afl_env.afl_kill_signal, &endptr, 10);
-    /* Did we manage to parse the full string? */
-    if (*endptr != '\0' || endptr == (char *)afl->afl_env.afl_kill_signal) {
-
-      FATAL("Invalid AFL_KILL_SIGNAL: %s (expected unsigned int)",
-            afl->afl_env.afl_kill_signal);
-
-    }
-
-    afl->fsrv.kill_signal = signal_code;
-
-  } else {
-
-    char *sigstr = alloc_printf("%d", (int)SIGKILL);
-    if (!sigstr) { FATAL("Failed to alloc mem for signal buf"); }
-
-    /* Set the env for signal handler */
-    setenv("AFL_KILL_SIGNAL", sigstr, 1);
-    free(sigstr);
-
-  }
+  afl->fsrv.kill_signal =
+      parse_afl_kill_signal_env(afl->afl_env.afl_kill_signal, SIGKILL);
 
   setup_signal_handlers();
   check_asan_opts(afl);
diff --git a/src/afl-showmap.c b/src/afl-showmap.c
index 2c9c38ed..5c9d38e0 100644
--- a/src/afl-showmap.c
+++ b/src/afl-showmap.c
@@ -1116,33 +1116,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
     }
 
-    fsrv->kill_signal = SIGKILL;
-    char *afl_kill_signal_env = getenv("AFL_KILL_SIGNAL");
-    if (afl_kill_signal_env && afl_kill_signal_env[0]) {
-
-      char *endptr;
-      u8    signal_code;
-      signal_code = (u8)strtoul(afl_kill_signal_env, &endptr, 10);
-      /* Did we manage to parse the full string? */
-      if (*endptr != '\0' || endptr == afl_kill_signal_env) {
-
-        FATAL("Invalid AFL_KILL_SIGNAL: %s (expected unsigned int)",
-              afl_kill_signal_env);
-
-      }
-
-      fsrv->kill_signal = signal_code;
-
-    } else {
-
-      char *sigstr = alloc_printf("%d", (int)SIGKILL);
-      if (!sigstr) { FATAL("Failed to alloc mem for signal buf"); }
-
-      /* Set the env for signal handler */
-      setenv("AFL_KILL_SIGNAL", sigstr, 1);
-      free(sigstr);
-
-    }
+    fsrv->kill_signal =
+        parse_afl_kill_signal_env(getenv("AFL_KILL_SIGNAL"), SIGKILL);
 
     if (getenv("AFL_CRASH_EXITCODE")) {
 
diff --git a/src/afl-tmin.c b/src/afl-tmin.c
index 342de9c8..6e2d7708 100644
--- a/src/afl-tmin.c
+++ b/src/afl-tmin.c
@@ -1135,33 +1135,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-  fsrv->kill_signal = SIGKILL;
-  char *afl_kill_signal_env = getenv("AFL_KILL_SIGNAL");
-  if (afl_kill_signal_env && afl_kill_signal_env[0]) {
-
-    char *endptr;
-    u8    signal_code;
-    signal_code = (u8)strtoul(afl_kill_signal_env, &endptr, 10);
-    /* Did we manage to parse the full string? */
-    if (*endptr != '\0' || endptr == afl_kill_signal_env) {
-
-      FATAL("Invalid AFL_KILL_SIGNAL: %s (expected unsigned int)",
-            afl_kill_signal_env);
-
-    }
-
-    fsrv->kill_signal = signal_code;
-
-  } else {
-
-    char *sigstr = alloc_printf("%d", (int)SIGKILL);
-    if (!sigstr) { FATAL("Failed to alloc mem for signal buf"); }
-
-    /* Set the env for signal handler */
-    setenv("AFL_KILL_SIGNAL", sigstr, 1);
-    free(sigstr);
-
-  }
+  fsrv->kill_signal =
+      parse_afl_kill_signal_env(getenv("AFL_KILL_SIGNAL"), SIGKILL);
 
   if (getenv("AFL_CRASH_EXITCODE")) {
 
-- 
cgit 1.4.1