From 26d477167850914be1404cca6d2f9e28d2102e1d Mon Sep 17 00:00:00 2001 From: Kobrin Eli Date: Sat, 15 Oct 2022 13:06:11 +0300 Subject: Fix exit_on_time (#1555) --- src/afl-fuzz-stats.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index 713f3a3c..ef5c698c 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -1410,12 +1410,13 @@ void show_stats_pizza(afl_state_t *afl) { /* AFL_EXIT_ON_TIME. */ - if (unlikely(afl->last_find_time && !afl->non_instrumented_mode && - afl->afl_env.afl_exit_on_time && - (cur_ms - afl->last_find_time) > afl->exit_on_time)) { + /* If no coverage was found yet, check whether run time is greater than exit_on_time. */ + if (unlikely(!afl->non_instrumented_mode && afl->afl_env.afl_exit_on_time && + (afl->last_find_time && (cur_ms - afl->last_find_time) > afl->exit_on_time || + !afl->last_find_time && + (afl->prev_run_time + cur_ms - afl->start_time) > afl->exit_on_time))) { afl->stop_soon = 2; - } if (unlikely(afl->total_crashes && afl->afl_env.afl_bench_until_crash)) { -- cgit 1.4.1 From 23580e2cb6f6f92741190e1757f5020e9cd9cc88 Mon Sep 17 00:00:00 2001 From: "Edward J. Schwartz" Date: Tue, 18 Oct 2022 12:55:59 -0400 Subject: Fix afl-showmap usage output (#1560) --- src/afl-showmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 0b724758..b2bf91aa 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -822,8 +822,8 @@ static void usage(u8 *argv0) { " -o file - file to write the trace data to\n\n" "Execution control settings:\n" - " -t msec - timeout for each run (none)\n" - " -m megs - memory limit for child process (%u MB)\n" + " -t msec - timeout for each run (1000)\n" + " -m megs - memory limit for child process (none)\n" #if defined(__linux__) && defined(__aarch64__) " -A - use binary-only instrumentation (ARM CoreSight mode)\n" #endif -- cgit 1.4.1 From 9a77a6fa928b3f69729761ffa7294745789c684f Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Wed, 19 Oct 2022 08:50:17 +0200 Subject: nits --- GNUmakefile.llvm | 1 - src/afl-showmap.c | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/GNUmakefile.llvm b/GNUmakefile.llvm index 2349e587..4dc5a56e 100644 --- a/GNUmakefile.llvm +++ b/GNUmakefile.llvm @@ -89,7 +89,6 @@ endif ifeq "$(LLVM_HAVE_LTO)" "1" $(info [+] llvm_mode detected llvm 11+, enabling afl-lto LTO implementation) LLVM_LTO = 1 - #TEST_MMAP = 1 endif ifeq "$(LLVM_LTO)" "0" diff --git a/src/afl-showmap.c b/src/afl-showmap.c index b2bf91aa..4cc079ea 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -822,8 +822,8 @@ static void usage(u8 *argv0) { " -o file - file to write the trace data to\n\n" "Execution control settings:\n" - " -t msec - timeout for each run (1000)\n" - " -m megs - memory limit for child process (none)\n" + " -t msec - timeout for each run (default: 1000ms)\n" + " -m megs - memory limit for child process (default: none)\n" #if defined(__linux__) && defined(__aarch64__) " -A - use binary-only instrumentation (ARM CoreSight mode)\n" #endif -- cgit 1.4.1 From ca9854a924bf6358aff7a54c8825917f711b35ff Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Wed, 19 Oct 2022 10:17:12 +0200 Subject: nits --- src/afl-fuzz-stats.c | 15 ++++++++++----- src/afl-showmap.c | 2 +- 2 files changed, 11 insertions(+), 6 deletions(-) (limited to 'src') diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c index ef5c698c..61956dc3 100644 --- a/src/afl-fuzz-stats.c +++ b/src/afl-fuzz-stats.c @@ -1410,13 +1410,18 @@ void show_stats_pizza(afl_state_t *afl) { /* AFL_EXIT_ON_TIME. */ - /* If no coverage was found yet, check whether run time is greater than exit_on_time. */ + /* If no coverage was found yet, check whether run time is greater than + * exit_on_time. */ + + if (unlikely( + !afl->non_instrumented_mode && afl->afl_env.afl_exit_on_time && + ((afl->last_find_time && + (cur_ms - afl->last_find_time) > afl->exit_on_time) || + (!afl->last_find_time && (afl->prev_run_time + cur_ms - + afl->start_time) > afl->exit_on_time)))) { - if (unlikely(!afl->non_instrumented_mode && afl->afl_env.afl_exit_on_time && - (afl->last_find_time && (cur_ms - afl->last_find_time) > afl->exit_on_time || - !afl->last_find_time && - (afl->prev_run_time + cur_ms - afl->start_time) > afl->exit_on_time))) { afl->stop_soon = 2; + } if (unlikely(afl->total_crashes && afl->afl_env.afl_bench_until_crash)) { diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 4cc079ea..5e3fb67d 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -873,7 +873,7 @@ static void usage(u8 *argv0) { "printed to stdout\n" "AFL_QUIET: do not print extra informational output\n" "AFL_NO_FORKSRV: run target via execve instead of using the forkserver\n", - argv0, MEM_LIMIT, doc_path); + argv0, doc_path); exit(1); -- cgit 1.4.1 From 0e908d5b1e4f35da1926d66d97778e436d555cf9 Mon Sep 17 00:00:00 2001 From: "Edward J. Schwartz" Date: Thu, 20 Oct 2022 08:26:55 -0400 Subject: Fix -rpath argument --- src/afl-cc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src') diff --git a/src/afl-cc.c b/src/afl-cc.c index 469aa825..cd2061e6 100644 --- a/src/afl-cc.c +++ b/src/afl-cc.c @@ -955,7 +955,7 @@ static void edit_params(u32 argc, char **argv, char **envp) { if (plusplus_mode && strlen(libdir) && strncmp(libdir, "/usr", 4) && strncmp(libdir, "/lib", 4)) { - cc_params[cc_par_cnt++] = "-rpath"; + cc_params[cc_par_cnt++] = "-Wl,-rpath"; cc_params[cc_par_cnt++] = libdir; } else { -- cgit 1.4.1 From f84ea696606b3dd6ae40006e5efb9f178651e916 Mon Sep 17 00:00:00 2001 From: Nils Bars Date: Thu, 20 Oct 2022 13:14:29 +0200 Subject: Fix child reaping on fuzzer termination This commit contains the following changes: - Call `waitpid()` on the child and the fork server when terminating the fuzzer; thus, we do not end up with zombies. - Rename `fsrv.kill_signal` to `fsrv.child_kill_signal`, since the documentation states that the signal is used to terminate the *child*. - Use SIGTERM instead of fsrv.(child)_kill_signal, thus the fork server can always reap the child. --- include/forkserver.h | 3 +-- instrumentation/afl-compiler-rt.o.c | 2 +- src/afl-analyze.c | 5 ++--- src/afl-forkserver.c | 17 ++++++++--------- src/afl-fuzz-init.c | 1 - src/afl-fuzz-state.c | 13 +++++++++---- src/afl-fuzz.c | 3 +-- src/afl-showmap.c | 5 ++--- src/afl-tmin.c | 5 ++--- 9 files changed, 26 insertions(+), 28 deletions(-) (limited to 'src') diff --git a/include/forkserver.h b/include/forkserver.h index 59ce0ee7..59624194 100644 --- a/include/forkserver.h +++ b/include/forkserver.h @@ -163,7 +163,7 @@ typedef struct afl_forkserver { void (*add_extra_func)(void *afl_ptr, u8 *mem, u32 len); - u8 kill_signal; + u8 child_kill_signal; u8 persistent_mode; #ifdef __linux__ @@ -222,4 +222,3 @@ void afl_fsrv_kill(afl_forkserver_t *fsrv); #endif /* ^RLIMIT_AS */ #endif - diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c index 20069824..8c09d9d8 100644 --- a/instrumentation/afl-compiler-rt.o.c +++ b/instrumentation/afl-compiler-rt.o.c @@ -159,6 +159,7 @@ static void at_exit(int signal) { if (unlikely(child_pid > 0)) { kill(child_pid, SIGKILL); + waitpid(child_pid, NULL, 0); child_pid = -1; } @@ -2407,4 +2408,3 @@ void __afl_set_persistent_mode(u8 mode) { } #undef write_error - diff --git a/src/afl-analyze.c b/src/afl-analyze.c index a21f014f..f21acd7f 100644 --- a/src/afl-analyze.c +++ b/src/afl-analyze.c @@ -114,7 +114,7 @@ static void kill_child() { if (fsrv.child_pid > 0) { - kill(fsrv.child_pid, fsrv.kill_signal); + kill(fsrv.child_pid, fsrv.child_kill_signal); fsrv.child_pid = -1; } @@ -1115,7 +1115,7 @@ int main(int argc, char **argv_orig, char **envp) { } - fsrv.kill_signal = + fsrv.child_kill_signal = parse_afl_kill_signal_env(getenv("AFL_KILL_SIGNAL"), SIGKILL); read_initial_file(); @@ -1151,4 +1151,3 @@ int main(int argc, char **argv_orig, char **envp) { exit(0); } - diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c index 628ff590..71da7fde 100644 --- a/src/afl-forkserver.c +++ b/src/afl-forkserver.c @@ -100,7 +100,7 @@ void afl_fsrv_init(afl_forkserver_t *fsrv) { fsrv->init_tmout = EXEC_TIMEOUT * FORK_WAIT_MULT; fsrv->mem_limit = MEM_LIMIT; fsrv->out_file = NULL; - fsrv->kill_signal = SIGKILL; + fsrv->child_kill_signal = SIGKILL; /* exec related stuff */ fsrv->child_pid = -1; @@ -134,7 +134,7 @@ void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) { fsrv_to->no_unlink = from->no_unlink; fsrv_to->uses_crash_exitcode = from->uses_crash_exitcode; fsrv_to->crash_exitcode = from->crash_exitcode; - fsrv_to->kill_signal = from->kill_signal; + fsrv_to->child_kill_signal = from->child_kill_signal; fsrv_to->debug = from->debug; // These are forkserver specific. @@ -793,7 +793,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv, s32 tmp_pid = fsrv->fsrv_pid; if (tmp_pid > 0) { - kill(tmp_pid, fsrv->kill_signal); + kill(tmp_pid, fsrv->child_kill_signal); fsrv->fsrv_pid = -1; } @@ -804,7 +804,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv, s32 tmp_pid = fsrv->fsrv_pid; if (tmp_pid > 0) { - kill(tmp_pid, fsrv->kill_signal); + kill(tmp_pid, fsrv->child_kill_signal); fsrv->fsrv_pid = -1; } @@ -1242,10 +1242,10 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv, void afl_fsrv_kill(afl_forkserver_t *fsrv) { - if (fsrv->child_pid > 0) { kill(fsrv->child_pid, fsrv->kill_signal); } + if (fsrv->child_pid > 0) { kill(fsrv->child_pid, fsrv->child_kill_signal); } if (fsrv->fsrv_pid > 0) { - kill(fsrv->fsrv_pid, fsrv->kill_signal); + kill(fsrv->fsrv_pid, SIGTERM); if (waitpid(fsrv->fsrv_pid, NULL, 0) <= 0) { WARNF("error waitpid\n"); } } @@ -1545,7 +1545,7 @@ afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout, s32 tmp_pid = fsrv->child_pid; if (tmp_pid > 0) { - kill(tmp_pid, fsrv->kill_signal); + kill(tmp_pid, fsrv->child_kill_signal); fsrv->child_pid = -1; } @@ -1605,7 +1605,7 @@ afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout, /* Did we timeout? */ if (unlikely(fsrv->last_run_timed_out)) { - fsrv->last_kill_signal = fsrv->kill_signal; + fsrv->last_kill_signal = fsrv->child_kill_signal; return FSRV_RUN_TMOUT; } @@ -1688,4 +1688,3 @@ void afl_fsrv_deinit(afl_forkserver_t *fsrv) { list_remove(&fsrv_list, fsrv); } - diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index e41d29fd..fded44ac 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -2963,4 +2963,3 @@ void save_cmdline(afl_state_t *afl, u32 argc, char **argv) { *buf = 0; } - diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c index 5199f7e6..8bbef87c 100644 --- a/src/afl-fuzz-state.c +++ b/src/afl-fuzz-state.c @@ -23,6 +23,7 @@ */ +#include #include "afl-fuzz.h" #include "envs.h" @@ -653,9 +654,14 @@ void afl_states_stop(void) { }); LIST_FOREACH(&afl_states, afl_state_t, { - - if (el->fsrv.child_pid > 0) kill(el->fsrv.child_pid, el->fsrv.kill_signal); - if (el->fsrv.fsrv_pid > 0) kill(el->fsrv.fsrv_pid, el->fsrv.kill_signal); + /* NOTE: We need to make sure that the parent (the forkserver) reap the child (see below). */ + if (el->fsrv.child_pid > 0) kill(el->fsrv.child_pid, el->fsrv.child_kill_signal); + if (el->fsrv.fsrv_pid > 0) { + /* This must be SIGTERM, to allow the forkserver to reap the child before exiting. */ + kill(el->fsrv.fsrv_pid, SIGTERM); + /* Make sure the forkserver does not end up as zombie. */ + waitpid(el->fsrv.fsrv_pid, NULL, 0); + } }); @@ -672,4 +678,3 @@ void afl_states_request_skip(void) { LIST_FOREACH(&afl_states, afl_state_t, { el->skip_requested = 1; }); } - diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index d116822a..c9eeeca1 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -1358,7 +1358,7 @@ int main(int argc, char **argv_orig, char **envp) { #endif - afl->fsrv.kill_signal = + afl->fsrv.child_kill_signal = parse_afl_kill_signal_env(afl->afl_env.afl_kill_signal, SIGKILL); setup_signal_handlers(); @@ -2683,4 +2683,3 @@ stop_fuzzing: } #endif /* !AFL_LIB */ - diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 5e3fb67d..730a4ff1 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -129,7 +129,7 @@ static void kill_child() { timed_out = 1; if (fsrv->child_pid > 0) { - kill(fsrv->child_pid, fsrv->kill_signal); + kill(fsrv->child_pid, fsrv->child_kill_signal); fsrv->child_pid = -1; } @@ -1258,7 +1258,7 @@ int main(int argc, char **argv_orig, char **envp) { : 0); be_quiet = save_be_quiet; - fsrv->kill_signal = + fsrv->child_kill_signal = parse_afl_kill_signal_env(getenv("AFL_KILL_SIGNAL"), SIGKILL); if (new_map_size) { @@ -1472,4 +1472,3 @@ int main(int argc, char **argv_orig, char **envp) { exit(ret); } - diff --git a/src/afl-tmin.c b/src/afl-tmin.c index 694c9c21..e2145c32 100644 --- a/src/afl-tmin.c +++ b/src/afl-tmin.c @@ -113,7 +113,7 @@ static void kill_child() { if (fsrv->child_pid > 0) { - kill(fsrv->child_pid, fsrv->kill_signal); + kill(fsrv->child_pid, fsrv->child_kill_signal); fsrv->child_pid = -1; } @@ -1195,7 +1195,7 @@ int main(int argc, char **argv_orig, char **envp) { } - fsrv->kill_signal = + fsrv->child_kill_signal = parse_afl_kill_signal_env(getenv("AFL_KILL_SIGNAL"), SIGKILL); if (getenv("AFL_CRASH_EXITCODE")) { @@ -1351,4 +1351,3 @@ int main(int argc, char **argv_orig, char **envp) { exit(0); } - -- cgit 1.4.1 From 7512316b46a25180729ff8c568a6061a0ab19fea Mon Sep 17 00:00:00 2001 From: Nils Bars Date: Fri, 21 Oct 2022 12:13:43 +0200 Subject: Add AFL_FORK_SERVER_KILL_SIGNAL environment variable. The AFL_FORK_SERVER_KILL_SIGNAL variable allows to configure the signal used to kill the fork server on termination. --- afl-cmin | 2 ++ docs/env_variables.md | 11 +++++++++-- include/afl-fuzz.h | 5 ++--- include/common.h | 10 +++++----- include/envs.h | 2 +- include/forkserver.h | 2 ++ src/afl-analyze.c | 5 ++++- src/afl-common.c | 33 +++++++++------------------------ src/afl-forkserver.c | 4 ++-- src/afl-fuzz-state.c | 10 +++++++--- src/afl-fuzz.c | 4 +++- src/afl-showmap.c | 6 +++++- src/afl-tmin.c | 7 ++++++- 13 files changed, 57 insertions(+), 44 deletions(-) (limited to 'src') diff --git a/afl-cmin b/afl-cmin index 8fe35ced..a9806892 100755 --- a/afl-cmin +++ b/afl-cmin @@ -123,6 +123,8 @@ function usage() { "AFL_FORKSRV_INIT_TMOUT: time the fuzzer waits for the forkserver to come up\n" \ "AFL_KEEP_TRACES: leave the temporary /.traces directory\n" \ "AFL_KILL_SIGNAL: Signal delivered to child processes on timeout (default: SIGKILL)\n" \ +"AFL_FORK_SERVER_KILL_SIGNAL: Signal delivered to fork server processes on termination\n" +" (default: SIGTERM)\n" "AFL_NO_FORKSRV: run target via execve instead of using the forkserver\n" \ "AFL_CMIN_ALLOW_ANY: write tuples for crashing inputs also\n" \ "AFL_PATH: path for the afl-showmap binary if not found anywhere in PATH\n" \ diff --git a/docs/env_variables.md b/docs/env_variables.md index 1abe9438..6fd08910 100644 --- a/docs/env_variables.md +++ b/docs/env_variables.md @@ -409,11 +409,18 @@ checks or alter some of the more exotic semantics of the tool: the afl-fuzz -g/-G command line option to control the minimum/maximum of fuzzing input generated. - - `AFL_KILL_SIGNAL`: Set the signal ID to be delivered to child processes on - timeout. Unless you implement your own targets or instrumentation, you + - `AFL_KILL_SIGNAL`: Set the signal ID to be delivered to child processes + on timeout. Unless you implement your own targets or instrumentation, you likely don't have to set it. By default, on timeout and on exit, `SIGKILL` (`AFL_KILL_SIGNAL=9`) will be delivered to the child. + - `AFL_FORK_SERVER_KILL_SIGNAL`: Set the signal ID to be delivered to the + fork server when AFL++ is terminated. Unless you implement your + fork server, you likely do not have to set it. By default, `SIGTERM` + (`AFL_FORK_SERVER_KILL_SIGNAL=15`) will be delivered to the fork server. + NOTE: Uncatchable signals, such as `SIGKILL`, cause child processes of + the fork server to be orphaned and leaves them in a zombie state. + - `AFL_MAP_SIZE` sets the size of the shared map that afl-analyze, afl-fuzz, afl-showmap, and afl-tmin create to gather instrumentation data from the target. This must be equal or larger than the size the target was compiled diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 23c20cc4..73c3b09f 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -393,8 +393,8 @@ typedef struct afl_env_vars { *afl_hang_tmout, *afl_forksrv_init_tmout, *afl_preload, *afl_max_det_extras, *afl_statsd_host, *afl_statsd_port, *afl_crash_exitcode, *afl_statsd_tags_flavor, *afl_testcache_size, - *afl_testcache_entries, *afl_kill_signal, *afl_target_env, - *afl_persistent_record, *afl_exit_on_time; + *afl_testcache_entries, *afl_child_kill_signal, *afl_fsrv_kill_signal, + *afl_target_env, *afl_persistent_record, *afl_exit_on_time; } afl_env_vars_t; @@ -1268,4 +1268,3 @@ void queue_testcase_store_mem(afl_state_t *afl, struct queue_entry *q, u8 *mem); #endif #endif - diff --git a/include/common.h b/include/common.h index a983bb0e..34732197 100644 --- a/include/common.h +++ b/include/common.h @@ -67,10 +67,11 @@ u8 *find_binary(u8 *fname); u8 *find_afl_binary(u8 *own_loc, u8 *fname); -/* Parses the kill signal environment variable, FATALs on error. - If the env is not set, sets the env to default_signal for the signal handlers - and returns the default_signal. */ -int parse_afl_kill_signal_env(u8 *afl_kill_signal_env, int default_signal); +/* Parses the (numeric) kill signal environment variable passed + via `numeric_signal_as_str`. + If NULL is passed, the `default_signal` value is returned. + FATALs if `numeric_signal_as_str` is not a valid integer .*/ +int parse_afl_kill_signal(u8 *numeric_signal_as_str, int default_signal); /* Read a bitmap from file fname to memory This is for the -B option again. */ @@ -133,4 +134,3 @@ FILE *create_ffile(u8 *fn); s32 create_file(u8 *fn); #endif - diff --git a/include/envs.h b/include/envs.h index 2204a100..33c09780 100644 --- a/include/envs.h +++ b/include/envs.h @@ -110,6 +110,7 @@ static char *afl_environment_variables[] = { "AFL_INST_RATIO", "AFL_KEEP_TIMEOUTS", "AFL_KILL_SIGNAL", + "AFL_FORK_SERVER_KILL_SIGNAL", "AFL_KEEP_TRACES", "AFL_KEEP_ASSEMBLY", "AFL_LD_HARD_FAIL", @@ -239,4 +240,3 @@ static char *afl_environment_variables[] = { extern char *afl_environment_variables[]; #endif - diff --git a/include/forkserver.h b/include/forkserver.h index 59624194..bfd441d4 100644 --- a/include/forkserver.h +++ b/include/forkserver.h @@ -164,6 +164,8 @@ typedef struct afl_forkserver { void (*add_extra_func)(void *afl_ptr, u8 *mem, u32 len); u8 child_kill_signal; + u8 fsrv_kill_signal; + u8 persistent_mode; #ifdef __linux__ diff --git a/src/afl-analyze.c b/src/afl-analyze.c index f21acd7f..cbcd2ede 100644 --- a/src/afl-analyze.c +++ b/src/afl-analyze.c @@ -1116,7 +1116,10 @@ int main(int argc, char **argv_orig, char **envp) { } fsrv.child_kill_signal = - parse_afl_kill_signal_env(getenv("AFL_KILL_SIGNAL"), SIGKILL); + parse_afl_kill_signal(getenv("AFL_KILL_SIGNAL"), SIGKILL); + fsrv.fsrv_kill_signal = + parse_afl_kill_signal(getenv("AFL_FORK_SERVER_KILL_SIGNAL"), SIGTERM); + read_initial_file(); (void)check_binary_signatures(fsrv.target_path); diff --git a/src/afl-common.c b/src/afl-common.c index f3e78ac5..75b463ed 100644 --- a/src/afl-common.c +++ b/src/afl-common.c @@ -456,38 +456,24 @@ u8 *find_afl_binary(u8 *own_loc, u8 *fname) { } -/* Parses the kill signal environment variable, FATALs on error. - If the env is not set, sets the env to default_signal for the signal handlers - and returns the default_signal. */ -int parse_afl_kill_signal_env(u8 *afl_kill_signal_env, int default_signal) { - if (afl_kill_signal_env && afl_kill_signal_env[0]) { +int parse_afl_kill_signal(u8 *numeric_signal_as_str, int default_signal) { + + if (numeric_signal_as_str && numeric_signal_as_str[0]) { char *endptr; u8 signal_code; - signal_code = (u8)strtoul(afl_kill_signal_env, &endptr, 10); + signal_code = (u8)strtoul(numeric_signal_as_str, &endptr, 10); /* Did we manage to parse the full string? */ - if (*endptr != '\0' || endptr == (char *)afl_kill_signal_env) { - - FATAL("Invalid AFL_KILL_SIGNAL: %s (expected unsigned int)", - afl_kill_signal_env); - + if (*endptr != '\0' || endptr == (char *)numeric_signal_as_str) { + FATAL("Invalid signal name: %s", numeric_signal_as_str); + } else { + return signal_code; } - return signal_code; - - } else { - - char *sigstr = alloc_printf("%d", default_signal); - if (!sigstr) { FATAL("Failed to alloc mem for signal buf"); } - - /* Set the env for signal handler */ - setenv("AFL_KILL_SIGNAL", sigstr, 1); - free(sigstr); - return default_signal; - } + return default_signal; } static inline unsigned int helper_min3(unsigned int a, unsigned int b, @@ -1253,4 +1239,3 @@ s32 create_file(u8 *fn) { return fd; } - diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c index 71da7fde..72db3c2e 100644 --- a/src/afl-forkserver.c +++ b/src/afl-forkserver.c @@ -1245,8 +1245,8 @@ void afl_fsrv_kill(afl_forkserver_t *fsrv) { if (fsrv->child_pid > 0) { kill(fsrv->child_pid, fsrv->child_kill_signal); } if (fsrv->fsrv_pid > 0) { - kill(fsrv->fsrv_pid, SIGTERM); - if (waitpid(fsrv->fsrv_pid, NULL, 0) <= 0) { WARNF("error waitpid\n"); } + kill(fsrv->fsrv_pid, fsrv->fsrv_kill_signal); + waitpid(fsrv->fsrv_pid, NULL, 0); } diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c index 8bbef87c..ae6cb6c7 100644 --- a/src/afl-fuzz-state.c +++ b/src/afl-fuzz-state.c @@ -485,10 +485,15 @@ void read_afl_environment(afl_state_t *afl, char **envp) { #endif } else if (!strncmp(env, "AFL_KILL_SIGNAL", + afl_environment_variable_len)) { + + afl->afl_env.afl_child_kill_signal = + (u8 *)get_afl_env(afl_environment_variables[i]); + } else if (!strncmp(env, "AFL_FORK_SERVER_KILL_SIGNAL", afl_environment_variable_len)) { - afl->afl_env.afl_kill_signal = + afl->afl_env.afl_fsrv_kill_signal = (u8 *)get_afl_env(afl_environment_variables[i]); } else if (!strncmp(env, "AFL_TARGET_ENV", @@ -657,8 +662,7 @@ void afl_states_stop(void) { /* NOTE: We need to make sure that the parent (the forkserver) reap the child (see below). */ if (el->fsrv.child_pid > 0) kill(el->fsrv.child_pid, el->fsrv.child_kill_signal); if (el->fsrv.fsrv_pid > 0) { - /* This must be SIGTERM, to allow the forkserver to reap the child before exiting. */ - kill(el->fsrv.fsrv_pid, SIGTERM); + kill(el->fsrv.fsrv_pid, el->fsrv.fsrv_kill_signal); /* Make sure the forkserver does not end up as zombie. */ waitpid(el->fsrv.fsrv_pid, NULL, 0); } diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index c9eeeca1..573a6b42 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -1359,7 +1359,9 @@ int main(int argc, char **argv_orig, char **envp) { #endif afl->fsrv.child_kill_signal = - parse_afl_kill_signal_env(afl->afl_env.afl_kill_signal, SIGKILL); + parse_afl_kill_signal(afl->afl_env.afl_child_kill_signal, SIGKILL); + afl->fsrv.fsrv_kill_signal = + parse_afl_kill_signal(afl->afl_env.afl_fsrv_kill_signal, SIGTERM); setup_signal_handlers(); check_asan_opts(afl); diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 730a4ff1..80a9e766 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -866,6 +866,8 @@ static void usage(u8 *argv0) { "startup (in milliseconds)\n" "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, " "etc. (default: SIGKILL)\n" + "AFL_FORK_SERVER_KILL_SIGNAL: Signal delivered to fork server processes on termination" + " (default: SIGTERM)\n" "AFL_MAP_SIZE: the shared memory size for that target. must be >= the " "size the target was compiled for\n" "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n" @@ -1259,7 +1261,9 @@ int main(int argc, char **argv_orig, char **envp) { be_quiet = save_be_quiet; fsrv->child_kill_signal = - parse_afl_kill_signal_env(getenv("AFL_KILL_SIGNAL"), SIGKILL); + parse_afl_kill_signal(getenv("AFL_KILL_SIGNAL"), SIGKILL); + fsrv->fsrv_kill_signal = + parse_afl_kill_signal(getenv("AFL_FORK_SERVER_KILL_SIGNAL"), SIGTERM); if (new_map_size) { diff --git a/src/afl-tmin.c b/src/afl-tmin.c index e2145c32..d4660eb1 100644 --- a/src/afl-tmin.c +++ b/src/afl-tmin.c @@ -881,6 +881,8 @@ static void usage(u8 *argv0) { "AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash\n" "AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in milliseconds)\n" "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL)\n" + "AFL_FORK_SERVER_KILL_SIGNAL: Signal delivered to fork server processes on termination\n" + " (default: SIGTERM)\n" "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n" " the target was compiled for\n" "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n" @@ -1196,7 +1198,10 @@ int main(int argc, char **argv_orig, char **envp) { } fsrv->child_kill_signal = - parse_afl_kill_signal_env(getenv("AFL_KILL_SIGNAL"), SIGKILL); + parse_afl_kill_signal(getenv("AFL_KILL_SIGNAL"), SIGKILL); + fsrv->fsrv_kill_signal = + parse_afl_kill_signal(getenv("AFL_FORK_SERVER_KILL_SIGNAL"), SIGTERM); + if (getenv("AFL_CRASH_EXITCODE")) { -- cgit 1.4.1 From 102b749c0734165f1cb121397e4a4c307666b8eb Mon Sep 17 00:00:00 2001 From: Nils Bars Date: Mon, 24 Oct 2022 17:52:04 +0200 Subject: AFL_FORK_SERVER_KILL_SIGNAL backwards compatiblity If `AFL_KILL_SIGNAL` is set, `AFL_FORK_SERVER_KILL_SIGNAL` is set to the same value. --- docs/env_variables.md | 4 ++++ include/common.h | 6 ++++++ src/afl-analyze.c | 5 +---- src/afl-common.c | 23 +++++++++++++++++++++++ src/afl-fuzz.c | 8 ++++---- src/afl-showmap.c | 5 +---- src/afl-tmin.c | 5 +---- 7 files changed, 40 insertions(+), 16 deletions(-) (limited to 'src') diff --git a/docs/env_variables.md b/docs/env_variables.md index 6fd08910..d1c13e15 100644 --- a/docs/env_variables.md +++ b/docs/env_variables.md @@ -418,6 +418,10 @@ checks or alter some of the more exotic semantics of the tool: fork server when AFL++ is terminated. Unless you implement your fork server, you likely do not have to set it. By default, `SIGTERM` (`AFL_FORK_SERVER_KILL_SIGNAL=15`) will be delivered to the fork server. + If only `AFL_KILL_SIGNAL` is provided, `AFL_FORK_SERVER_KILL_SIGNAL` will + be set to same value as `AFL_KILL_SIGNAL` to provide backward compatibility. + If `AFL_FORK_SERVER_KILL_SIGNAL` is also set, it takes precedence. + NOTE: Uncatchable signals, such as `SIGKILL`, cause child processes of the fork server to be orphaned and leaves them in a zombie state. diff --git a/include/common.h b/include/common.h index 34732197..c1ba0f20 100644 --- a/include/common.h +++ b/include/common.h @@ -32,6 +32,7 @@ #include #include #include +#include "forkserver.h" #include "types.h" /* STRINGIFY_VAL_SIZE_MAX will fit all stringify_ strings. */ @@ -73,6 +74,11 @@ u8 *find_afl_binary(u8 *own_loc, u8 *fname); FATALs if `numeric_signal_as_str` is not a valid integer .*/ int parse_afl_kill_signal(u8 *numeric_signal_as_str, int default_signal); +/* Configure the signals that are used to kill the forkserver + and the forked childs. If `afl_kill_signal_env` or `afl_fsrv_kill_signal_env` + is NULL, the appropiate values are read from the environment. */ +void configure_afl_kill_signals(afl_forkserver_t *fsrv, char* afl_kill_signal_env, char* afl_fsrv_kill_signal_env); + /* Read a bitmap from file fname to memory This is for the -B option again. */ diff --git a/src/afl-analyze.c b/src/afl-analyze.c index cbcd2ede..d356874d 100644 --- a/src/afl-analyze.c +++ b/src/afl-analyze.c @@ -1115,10 +1115,7 @@ int main(int argc, char **argv_orig, char **envp) { } - fsrv.child_kill_signal = - parse_afl_kill_signal(getenv("AFL_KILL_SIGNAL"), SIGKILL); - fsrv.fsrv_kill_signal = - parse_afl_kill_signal(getenv("AFL_FORK_SERVER_KILL_SIGNAL"), SIGTERM); + configure_afl_kill_signals(&fsrv, NULL, NULL); read_initial_file(); diff --git a/src/afl-common.c b/src/afl-common.c index 75b463ed..f2934817 100644 --- a/src/afl-common.c +++ b/src/afl-common.c @@ -25,6 +25,7 @@ #include #include +#include "forkserver.h" #ifndef _GNU_SOURCE #define _GNU_SOURCE #endif @@ -47,6 +48,7 @@ #include #include #include +#include u8 be_quiet = 0; u8 *doc_path = ""; @@ -476,6 +478,27 @@ int parse_afl_kill_signal(u8 *numeric_signal_as_str, int default_signal) { return default_signal; } +void configure_afl_kill_signals(afl_forkserver_t *fsrv, char* afl_kill_signal_env, char* afl_fsrv_kill_signal_env) { + afl_kill_signal_env = afl_kill_signal_env ? + afl_kill_signal_env : getenv("AFL_KILL_SIGNAL"); + afl_fsrv_kill_signal_env = afl_fsrv_kill_signal_env ? + afl_fsrv_kill_signal_env : getenv("AFL_FORK_SERVER_KILL_SIGNAL"); + + fsrv->child_kill_signal = + parse_afl_kill_signal(afl_kill_signal_env, SIGKILL); + + if (afl_kill_signal_env && !afl_fsrv_kill_signal_env) { + /* + Set AFL_FORK_SERVER_KILL_SIGNAL to the value of AFL_KILL_SIGNAL for backwards + compatibility. However, if AFL_FORK_SERVER_KILL_SIGNAL is set, is takes precedence. + */ + afl_fsrv_kill_signal_env = afl_kill_signal_env; + } + fsrv->fsrv_kill_signal = + parse_afl_kill_signal(afl_fsrv_kill_signal_env, SIGTERM); + +} + static inline unsigned int helper_min3(unsigned int a, unsigned int b, unsigned int c) { diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 573a6b42..7e4e20a0 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -25,6 +25,7 @@ #include "afl-fuzz.h" #include "cmplog.h" +#include "common.h" #include #include #ifndef USEMMAP @@ -1358,10 +1359,9 @@ int main(int argc, char **argv_orig, char **envp) { #endif - afl->fsrv.child_kill_signal = - parse_afl_kill_signal(afl->afl_env.afl_child_kill_signal, SIGKILL); - afl->fsrv.fsrv_kill_signal = - parse_afl_kill_signal(afl->afl_env.afl_fsrv_kill_signal, SIGTERM); + configure_afl_kill_signals(&afl->fsrv, + afl->afl_env.afl_child_kill_signal, + afl->afl_env.afl_fsrv_kill_signal); setup_signal_handlers(); check_asan_opts(afl); diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 80a9e766..19288c04 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -1260,10 +1260,7 @@ int main(int argc, char **argv_orig, char **envp) { : 0); be_quiet = save_be_quiet; - fsrv->child_kill_signal = - parse_afl_kill_signal(getenv("AFL_KILL_SIGNAL"), SIGKILL); - fsrv->fsrv_kill_signal = - parse_afl_kill_signal(getenv("AFL_FORK_SERVER_KILL_SIGNAL"), SIGTERM); + configure_afl_kill_signals(fsrv, NULL, NULL); if (new_map_size) { diff --git a/src/afl-tmin.c b/src/afl-tmin.c index d4660eb1..43636b6f 100644 --- a/src/afl-tmin.c +++ b/src/afl-tmin.c @@ -1197,10 +1197,7 @@ int main(int argc, char **argv_orig, char **envp) { } - fsrv->child_kill_signal = - parse_afl_kill_signal(getenv("AFL_KILL_SIGNAL"), SIGKILL); - fsrv->fsrv_kill_signal = - parse_afl_kill_signal(getenv("AFL_FORK_SERVER_KILL_SIGNAL"), SIGTERM); + configure_afl_kill_signals(fsrv, NULL, NULL); if (getenv("AFL_CRASH_EXITCODE")) { -- cgit 1.4.1 From 2cbe49c6eb9fa3514289a088e68c847949d9d4cc Mon Sep 17 00:00:00 2001 From: Nils Bars Date: Mon, 24 Oct 2022 18:08:29 +0200 Subject: Update usage messages --- afl-cmin | 5 +++-- src/afl-fuzz.c | 3 +++ src/afl-showmap.c | 9 +++++---- src/afl-tmin.c | 3 ++- 4 files changed, 13 insertions(+), 7 deletions(-) (limited to 'src') diff --git a/afl-cmin b/afl-cmin index a9806892..15b61f89 100755 --- a/afl-cmin +++ b/afl-cmin @@ -123,8 +123,9 @@ function usage() { "AFL_FORKSRV_INIT_TMOUT: time the fuzzer waits for the forkserver to come up\n" \ "AFL_KEEP_TRACES: leave the temporary /.traces directory\n" \ "AFL_KILL_SIGNAL: Signal delivered to child processes on timeout (default: SIGKILL)\n" \ -"AFL_FORK_SERVER_KILL_SIGNAL: Signal delivered to fork server processes on termination\n" -" (default: SIGTERM)\n" +"AFL_FORK_SERVER_KILL_SIGNAL: Signal delivered to fork server processes on termination\n" \ +" (default: SIGTERM). If this is not set and AFL_KILL_SIGNAL is set,\n" \ +" this will be set to the same value as AFL_KILL_SIGNAL.\n" \ "AFL_NO_FORKSRV: run target via execve instead of using the forkserver\n" \ "AFL_CMIN_ALLOW_ANY: write tuples for crashing inputs also\n" \ "AFL_PATH: path for the afl-showmap binary if not found anywhere in PATH\n" \ diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 7e4e20a0..d8d804ae 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -262,6 +262,9 @@ static void usage(u8 *argv0, int more_help) { "AFL_INPUT_LEN_MIN/AFL_INPUT_LEN_MAX: like -g/-G set min/max fuzz length produced\n" "AFL_PIZZA_MODE: 1 - enforce pizza mode, 0 - disable for April 1st\n" "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL)\n" + "AFL_FORK_SERVER_KILL_SIGNAL: Signal delivered to fork server processes on termination\n" + " (default: SIGTERM). If this is not set and AFL_KILL_SIGNAL is set,\n" + " this will be set to the same value.\n" "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n" " the target was compiled for\n" "AFL_MAX_DET_EXTRAS: if more entries are in the dictionary list than this value\n" diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 19288c04..31091e8e 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -864,10 +864,11 @@ static void usage(u8 *argv0) { "AFL_DEBUG: enable extra developer output\n" "AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during " "startup (in milliseconds)\n" - "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, " - "etc. (default: SIGKILL)\n" - "AFL_FORK_SERVER_KILL_SIGNAL: Signal delivered to fork server processes on termination" - " (default: SIGTERM)\n" + "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout,\n" + " etc. (default: SIGKILL)\n" + "AFL_FORK_SERVER_KILL_SIGNAL: Signal delivered to fork server processes on termination\n" + " (default: SIGTERM). If this is not set and AFL_KILL_SIGNAL is set,\n" + " this will be set to the same value as AFL_KILL_SIGNAL.\n" "AFL_MAP_SIZE: the shared memory size for that target. must be >= the " "size the target was compiled for\n" "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n" diff --git a/src/afl-tmin.c b/src/afl-tmin.c index 43636b6f..b346f65c 100644 --- a/src/afl-tmin.c +++ b/src/afl-tmin.c @@ -882,7 +882,8 @@ static void usage(u8 *argv0) { "AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in milliseconds)\n" "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL)\n" "AFL_FORK_SERVER_KILL_SIGNAL: Signal delivered to fork server processes on termination\n" - " (default: SIGTERM)\n" + " (default: SIGTERM). If this is not set and AFL_KILL_SIGNAL is set,\n" + " this will be set to the same value as AFL_KILL_SIGNAL.\n" "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n" " the target was compiled for\n" "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n" -- cgit 1.4.1 From 05e0825d66d938308842c25c4c74b5cdd4a885eb Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Mon, 24 Oct 2022 20:06:57 +0200 Subject: changelog update --- docs/Changelog.md | 2 ++ include/afl-fuzz.h | 1 + include/common.h | 5 ++++- include/envs.h | 1 + include/forkserver.h | 1 + instrumentation/afl-compiler-rt.o.c | 1 + src/afl-analyze.c | 2 +- src/afl-common.c | 32 ++++++++++++++++++++++---------- src/afl-forkserver.c | 1 + src/afl-fuzz-init.c | 1 + src/afl-fuzz-state.c | 12 ++++++++++-- src/afl-fuzz.c | 6 +++--- src/afl-showmap.c | 10 +++++++--- src/afl-tmin.c | 2 +- 14 files changed, 56 insertions(+), 21 deletions(-) (limited to 'src') diff --git a/docs/Changelog.md b/docs/Changelog.md index 80916858..38e2e6bc 100644 --- a/docs/Changelog.md +++ b/docs/Changelog.md @@ -13,6 +13,8 @@ scripts - afl-fuzz: - force writing all stats on exit + - ensure targets are killed on exit + - `AFL_FORK_SERVER_KILL_SIGNAL` added - afl-cc: - make gcc_mode (afl-gcc-fast) work with gcc down to version 3.6 - qemu_mode: diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 73c3b09f..c8ca8e9b 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -1268,3 +1268,4 @@ void queue_testcase_store_mem(afl_state_t *afl, struct queue_entry *q, u8 *mem); #endif #endif + diff --git a/include/common.h b/include/common.h index c1ba0f20..f6d1dd1a 100644 --- a/include/common.h +++ b/include/common.h @@ -77,7 +77,9 @@ int parse_afl_kill_signal(u8 *numeric_signal_as_str, int default_signal); /* Configure the signals that are used to kill the forkserver and the forked childs. If `afl_kill_signal_env` or `afl_fsrv_kill_signal_env` is NULL, the appropiate values are read from the environment. */ -void configure_afl_kill_signals(afl_forkserver_t *fsrv, char* afl_kill_signal_env, char* afl_fsrv_kill_signal_env); +void configure_afl_kill_signals(afl_forkserver_t *fsrv, + char *afl_kill_signal_env, + char *afl_fsrv_kill_signal_env); /* Read a bitmap from file fname to memory This is for the -B option again. */ @@ -140,3 +142,4 @@ FILE *create_ffile(u8 *fn); s32 create_file(u8 *fn); #endif + diff --git a/include/envs.h b/include/envs.h index 33c09780..0731e86e 100644 --- a/include/envs.h +++ b/include/envs.h @@ -240,3 +240,4 @@ static char *afl_environment_variables[] = { extern char *afl_environment_variables[]; #endif + diff --git a/include/forkserver.h b/include/forkserver.h index bfd441d4..a8a7e777 100644 --- a/include/forkserver.h +++ b/include/forkserver.h @@ -224,3 +224,4 @@ void afl_fsrv_kill(afl_forkserver_t *fsrv); #endif /* ^RLIMIT_AS */ #endif + diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c index 8c09d9d8..b46759d0 100644 --- a/instrumentation/afl-compiler-rt.o.c +++ b/instrumentation/afl-compiler-rt.o.c @@ -2408,3 +2408,4 @@ void __afl_set_persistent_mode(u8 mode) { } #undef write_error + diff --git a/src/afl-analyze.c b/src/afl-analyze.c index d356874d..757c9306 100644 --- a/src/afl-analyze.c +++ b/src/afl-analyze.c @@ -1117,7 +1117,6 @@ int main(int argc, char **argv_orig, char **envp) { configure_afl_kill_signals(&fsrv, NULL, NULL); - read_initial_file(); (void)check_binary_signatures(fsrv.target_path); @@ -1151,3 +1150,4 @@ int main(int argc, char **argv_orig, char **envp) { exit(0); } + diff --git a/src/afl-common.c b/src/afl-common.c index f2934817..6f5e4a38 100644 --- a/src/afl-common.c +++ b/src/afl-common.c @@ -458,7 +458,6 @@ u8 *find_afl_binary(u8 *own_loc, u8 *fname) { } - int parse_afl_kill_signal(u8 *numeric_signal_as_str, int default_signal) { if (numeric_signal_as_str && numeric_signal_as_str[0]) { @@ -468,32 +467,44 @@ int parse_afl_kill_signal(u8 *numeric_signal_as_str, int default_signal) { signal_code = (u8)strtoul(numeric_signal_as_str, &endptr, 10); /* Did we manage to parse the full string? */ if (*endptr != '\0' || endptr == (char *)numeric_signal_as_str) { + FATAL("Invalid signal name: %s", numeric_signal_as_str); + } else { + return signal_code; + } } return default_signal; + } -void configure_afl_kill_signals(afl_forkserver_t *fsrv, char* afl_kill_signal_env, char* afl_fsrv_kill_signal_env) { - afl_kill_signal_env = afl_kill_signal_env ? - afl_kill_signal_env : getenv("AFL_KILL_SIGNAL"); - afl_fsrv_kill_signal_env = afl_fsrv_kill_signal_env ? - afl_fsrv_kill_signal_env : getenv("AFL_FORK_SERVER_KILL_SIGNAL"); +void configure_afl_kill_signals(afl_forkserver_t *fsrv, + char *afl_kill_signal_env, + char *afl_fsrv_kill_signal_env) { - fsrv->child_kill_signal = - parse_afl_kill_signal(afl_kill_signal_env, SIGKILL); + afl_kill_signal_env = + afl_kill_signal_env ? afl_kill_signal_env : getenv("AFL_KILL_SIGNAL"); + afl_fsrv_kill_signal_env = afl_fsrv_kill_signal_env + ? afl_fsrv_kill_signal_env + : getenv("AFL_FORK_SERVER_KILL_SIGNAL"); + + fsrv->child_kill_signal = parse_afl_kill_signal(afl_kill_signal_env, SIGKILL); if (afl_kill_signal_env && !afl_fsrv_kill_signal_env) { + /* - Set AFL_FORK_SERVER_KILL_SIGNAL to the value of AFL_KILL_SIGNAL for backwards - compatibility. However, if AFL_FORK_SERVER_KILL_SIGNAL is set, is takes precedence. + Set AFL_FORK_SERVER_KILL_SIGNAL to the value of AFL_KILL_SIGNAL for + backwards compatibility. However, if AFL_FORK_SERVER_KILL_SIGNAL is set, is + takes precedence. */ afl_fsrv_kill_signal_env = afl_kill_signal_env; + } + fsrv->fsrv_kill_signal = parse_afl_kill_signal(afl_fsrv_kill_signal_env, SIGTERM); @@ -1262,3 +1273,4 @@ s32 create_file(u8 *fn) { return fd; } + diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c index 72db3c2e..a241f2c6 100644 --- a/src/afl-forkserver.c +++ b/src/afl-forkserver.c @@ -1688,3 +1688,4 @@ void afl_fsrv_deinit(afl_forkserver_t *fsrv) { list_remove(&fsrv_list, fsrv); } + diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index fded44ac..e41d29fd 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -2963,3 +2963,4 @@ void save_cmdline(afl_state_t *afl, u32 argc, char **argv) { *buf = 0; } + diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c index ae6cb6c7..8bd465f0 100644 --- a/src/afl-fuzz-state.c +++ b/src/afl-fuzz-state.c @@ -485,12 +485,14 @@ void read_afl_environment(afl_state_t *afl, char **envp) { #endif } else if (!strncmp(env, "AFL_KILL_SIGNAL", + afl_environment_variable_len)) { afl->afl_env.afl_child_kill_signal = (u8 *)get_afl_env(afl_environment_variables[i]); } else if (!strncmp(env, "AFL_FORK_SERVER_KILL_SIGNAL", + afl_environment_variable_len)) { afl->afl_env.afl_fsrv_kill_signal = @@ -659,12 +661,17 @@ void afl_states_stop(void) { }); LIST_FOREACH(&afl_states, afl_state_t, { - /* NOTE: We need to make sure that the parent (the forkserver) reap the child (see below). */ - if (el->fsrv.child_pid > 0) kill(el->fsrv.child_pid, el->fsrv.child_kill_signal); + + /* NOTE: We need to make sure that the parent (the forkserver) reap the + * child (see below). */ + if (el->fsrv.child_pid > 0) + kill(el->fsrv.child_pid, el->fsrv.child_kill_signal); if (el->fsrv.fsrv_pid > 0) { + kill(el->fsrv.fsrv_pid, el->fsrv.fsrv_kill_signal); /* Make sure the forkserver does not end up as zombie. */ waitpid(el->fsrv.fsrv_pid, NULL, 0); + } }); @@ -682,3 +689,4 @@ void afl_states_request_skip(void) { LIST_FOREACH(&afl_states, afl_state_t, { el->skip_requested = 1; }); } + diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index d8d804ae..6ff4d266 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -1362,9 +1362,8 @@ int main(int argc, char **argv_orig, char **envp) { #endif - configure_afl_kill_signals(&afl->fsrv, - afl->afl_env.afl_child_kill_signal, - afl->afl_env.afl_fsrv_kill_signal); + configure_afl_kill_signals(&afl->fsrv, afl->afl_env.afl_child_kill_signal, + afl->afl_env.afl_fsrv_kill_signal); setup_signal_handlers(); check_asan_opts(afl); @@ -2688,3 +2687,4 @@ stop_fuzzing: } #endif /* !AFL_LIB */ + diff --git a/src/afl-showmap.c b/src/afl-showmap.c index 31091e8e..ce1f8004 100644 --- a/src/afl-showmap.c +++ b/src/afl-showmap.c @@ -866,9 +866,12 @@ static void usage(u8 *argv0) { "startup (in milliseconds)\n" "AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout,\n" " etc. (default: SIGKILL)\n" - "AFL_FORK_SERVER_KILL_SIGNAL: Signal delivered to fork server processes on termination\n" - " (default: SIGTERM). If this is not set and AFL_KILL_SIGNAL is set,\n" - " this will be set to the same value as AFL_KILL_SIGNAL.\n" + "AFL_FORK_SERVER_KILL_SIGNAL: Signal delivered to fork server processes " + "on termination\n" + " (default: SIGTERM). If this is not set and " + "AFL_KILL_SIGNAL is set,\n" + " this will be set to the same value as " + "AFL_KILL_SIGNAL.\n" "AFL_MAP_SIZE: the shared memory size for that target. must be >= the " "size the target was compiled for\n" "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n" @@ -1474,3 +1477,4 @@ int main(int argc, char **argv_orig, char **envp) { exit(ret); } + diff --git a/src/afl-tmin.c b/src/afl-tmin.c index b346f65c..3a27b879 100644 --- a/src/afl-tmin.c +++ b/src/afl-tmin.c @@ -1200,7 +1200,6 @@ int main(int argc, char **argv_orig, char **envp) { configure_afl_kill_signals(fsrv, NULL, NULL); - if (getenv("AFL_CRASH_EXITCODE")) { long exitcode = strtol(getenv("AFL_CRASH_EXITCODE"), NULL, 10); @@ -1354,3 +1353,4 @@ int main(int argc, char **argv_orig, char **envp) { exit(0); } + -- cgit 1.4.1