cmplog forkserver tidying
MODIFY
include/forkserver.h
include/forkserver.h
@@ -80,10 +80,11 @@ typedef struct afl_forkserver {
} afl_forkserver_t;
void afl_fsrv_init(afl_forkserver_t *fsrv);
+void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from);
void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
volatile u8 *stop_soon_p, u8 debug_child_output);
+void afl_fsrv_killall(void);
void afl_fsrv_deinit(afl_forkserver_t *fsrv);
-void afl_fsrv_killall();
#ifdef __APPLE__
#define MSG_FORK_ON_APPLE \

MODIFY
src/afl-analyze.c
src/afl-analyze.c
@@ -639,7 +639,7 @@ static void handle_stop_sig(int sig) {
/* Do basic preparations - persistent fds, filenames, etc. */
-static void set_up_environment() {
+static void set_up_environment(void) {
u8 *x;

MODIFY
src/afl-forkserver.c
src/afl-forkserver.c
@@ -74,7 +74,6 @@ void afl_fsrv_init(afl_forkserver_t *fsrv) {
fsrv->exec_tmout = EXEC_TIMEOUT;
fsrv->mem_limit = MEM_LIMIT;
fsrv->child_pid = -1;
- fsrv->out_dir_fd = -1;
fsrv->map_size = MAP_SIZE;
fsrv->use_fauxsrv = 0;
fsrv->prev_timed_out = 0;
@@ -85,6 +84,32 @@ void afl_fsrv_init(afl_forkserver_t *fsrv) {
}
+/* Initialize a new forkserver instance, duplicating "global" settings */
+void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) {
+
+ fsrv_to->use_stdin = from->use_stdin;
+ fsrv_to->dev_null_fd = from->dev_null_fd;
+ fsrv_to->exec_tmout = from->exec_tmout;
+ fsrv_to->mem_limit = from->mem_limit;
+ fsrv_to->map_size = from->map_size;
+
+#ifndef HAVE_ARC4RANDOM
+ fsrv_to->dev_urandom_fd = from->dev_urandom_fd;
+#endif
+
+ // These are forkserver specific.
+ fsrv_to->out_fd = -1;
+ fsrv_to->out_dir_fd = -1;
+ fsrv_to->child_pid = -1;
+ fsrv_to->use_fauxsrv = 0;
+ fsrv_to->prev_timed_out = 0;
+
+ fsrv_to->init_child_func = fsrv_exec_child;
+
+ list_append(&fsrv_list, fsrv_to);
+
+}
+
/* Internal forkserver for dumb_mode=1 and non-forkserver mode runs.
It execvs for each fork, forwarding exit codes and child pids to afl. */
@@ -599,11 +624,19 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
}
+static void afl_fsrv_kill(afl_forkserver_t *fsrv) {
+
+ if (fsrv->child_pid > 0) kill(fsrv->child_pid, SIGKILL);
+ if (fsrv->fsrv_pid > 0) kill(fsrv->fsrv_pid, SIGKILL);
+ if (waitpid(fsrv->fsrv_pid, NULL, 0) <= 0) { WARNF("error waitpid\n"); }
+
+}
+
void afl_fsrv_killall() {
LIST_FOREACH(&fsrv_list, afl_forkserver_t, {
- if (el->child_pid > 0) kill(el->child_pid, SIGKILL);
+ afl_fsrv_kill(el);
});
@@ -611,6 +644,7 @@ void afl_fsrv_killall() {
void afl_fsrv_deinit(afl_forkserver_t *fsrv) {
+ afl_fsrv_kill(fsrv);
list_remove(&fsrv_list, fsrv);
}

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -1020,7 +1020,9 @@ int main(int argc, char **argv_orig, char **envp) {
if (afl->cmplog_binary) {
SAYF("Spawning cmplog forkserver");
- memcpy(&afl->cmplog_fsrv, &afl->fsrv, sizeof(afl->fsrv));
+ afl_fsrv_init_dup(&afl->cmplog_fsrv, &afl->fsrv);
+ // TODO: this is semi-nice
+ afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child_output);
@@ -1123,28 +1125,6 @@ int main(int argc, char **argv_orig, char **envp) {
}
- // if (afl->queue_cur) show_stats(afl);
-
- /*
- * ATTENTION - the following 10 lines were copied from a PR to Google's afl
- * repository - and slightly fixed.
- * These lines have nothing to do with the purpose of original PR though.
- * Looks like when an exit condition was completed (AFL_BENCH_JUST_ONE,
- * AFL_EXIT_WHEN_DONE or AFL_BENCH_UNTIL_CRASH) the child and forkserver
- * where not killed?
- */
- /* if we stopped programmatically, we kill the forkserver and the current
- runner. if we stopped manually, this is done by the signal handler */
- if (afl->stop_soon == 2) {
-
- if (afl->fsrv.child_pid > 0) kill(afl->fsrv.child_pid, SIGKILL);
- if (afl->fsrv.fsrv_pid > 0) kill(afl->fsrv.fsrv_pid, SIGKILL);
- /* Now that we've killed the forkserver, we wait for it to be able to get
- * rusage stats. */
- if (waitpid(afl->fsrv.fsrv_pid, NULL, 0) <= 0) { WARNF("error waitpid\n"); }
-
- }
-
write_bitmap(afl);
maybe_update_plot_file(afl, 0, 0);
save_auto(afl);

MODIFY
src/afl-sharedmem.c
src/afl-sharedmem.c
@@ -95,7 +95,7 @@ void afl_shm_deinit(sharedmem_t *shm) {
/* At exit, remove all leftover maps */
-void afl_shm_atexit() {
+void afl_shm_atexit(void) {
LIST_FOREACH(&shm_list, sharedmem_t, { afl_shm_deinit(el); });

MODIFY
src/third_party/libradamsa/libradamsa.c
src/third_party/libradamsa/libradamsa.c
@@ -2177,7 +2177,7 @@ static uint llen(word *ptr) {
return len;
}
-static void set_signal_handler() {
+static void set_signal_handler(void) {
struct sigaction sa;
sa.sa_handler = signal_handler;
sigemptyset(&sa.sa_mask);
@@ -2312,7 +2312,7 @@ static word prim_set(word wptr, hval pos, word val) {
return (word) new;
}
-static void setdown() {
+static void setdown(void) {
tcsetattr(0, TCSANOW, &tsettings); /* return stdio settings */
}
@@ -30773,7 +30773,7 @@ int secondary(int nargs, char **argv) {
return 127;
}
-void radamsa_init() {
+void radamsa_init(void) {
int nobjs=0, nwords=0;
hp = (byte *) &heap; /* builtin heap */
state = IFALSE;

MODIFY
src/third_party/libradamsa/radamsa.h
src/third_party/libradamsa/radamsa.h
#include <inttypes.h>
#include <stddef.h>
-extern void radamsa_init();
+extern void radamsa_init(void);
extern size_t radamsa(uint8_t *ptr, size_t len,
uint8_t *target, size_t max,
@@ -11,5 +11,3 @@ extern size_t radamsa_inplace(uint8_t *ptr,
size_t len,
size_t max,
unsigned int seed);
-
-

MODIFY
test/unittests/unit_maybe_alloc.c
test/unittests/unit_maybe_alloc.c
@@ -71,7 +71,7 @@ static void test_nonpow2_size(void **state) {
}
-static void test_zero_size() {
+static void test_zero_size(void **state) {
char *buf = NULL;
size_t size = 0;

cmplog forkserver tidying