/* american fuzzy lop++ - cmplog execution routines ------------------------------------------------ Originally written by Michal Zalewski Forkserver design by Jann Horn Now maintained by by Marc Heuse , Heiko Eißfeldt and Andrea Fioraldi Copyright 2016, 2017 Google Inc. All rights reserved. Copyright 2019-2020 AFLplusplus Project. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at: http://www.apache.org/licenses/LICENSE-2.0 Shared code to handle the shared memory. This is used by the fuzzer as well the other components like afl-tmin, afl-showmap, etc... */ #include #include "afl-fuzz.h" #include "cmplog.h" typedef struct cmplog_data { } cmplog_data_t; void cmplog_exec_child(afl_forkserver_t *fsrv, char **argv) { setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1); if (!fsrv->qemu_mode && argv[0] != fsrv->cmplog_binary) argv[0] = fsrv->cmplog_binary; execv(argv[0], argv); } u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len) { u8 fault; if (afl->post_handler) { u8 *post_buf = NULL; size_t post_len = afl->post_handler(afl->post_data, out_buf, len, &post_buf); if (!post_buf || !post_len) return 0; out_buf = post_buf; len = post_len; } write_to_testcase(afl, out_buf, len); fault = fuzz_run_target(afl, &afl->cmplog_fsrv, afl->fsrv.exec_tmout); if (afl->stop_soon) return 1; if (fault == FSRV_RUN_TMOUT) { if (afl->subseq_tmouts++ > TMOUT_LIMIT) { ++afl->cur_skipped_paths; return 1; } } else afl->subseq_tmouts = 0; /* Users can hit us with SIGUSR1 to request the current input to be abandoned. */ if (afl->skip_requested) { afl->skip_requested = 0; ++afl->cur_skipped_paths; return 1; } /* This handles FAULT_ERROR for us: */ /* afl->queued_discovered += save_if_interesting(afl, argv, out_buf, len, fault); if (!(afl->stage_cur % afl->stats_update_freq) || afl->stage_cur + 1 == afl->stage_max) show_stats(afl); */ return 0; }