real fix plus code format
MODIFY
include/android-ashmem.h
include/android-ashmem.h
#define ASHMEM_DEVICE "/dev/ashmem"
int shmctl(int __shmid, int __cmd, struct shmid_ds *__buf) {
+
int ret = 0;
if (__cmd == IPC_RMID) {
+
int length = ioctl(__shmid, ASHMEM_GET_SIZE, NULL);
struct ashmem_pin pin = {0, length};
ret = ioctl(__shmid, ASHMEM_UNPIN, &pin);
close(__shmid);
+
}
return ret;
+
}
int shmget(key_t __key, size_t __size, int __shmflg) {
+
(void)__shmflg;
int fd, ret;
char ourkey[11];
fd = open(ASHMEM_DEVICE, O_RDWR);
- if (fd < 0)
- return fd;
+ if (fd < 0) return fd;
sprintf(ourkey, "%d", __key);
ret = ioctl(fd, ASHMEM_SET_NAME, ourkey);
- if (ret < 0)
- goto error;
+ if (ret < 0) goto error;
ret = ioctl(fd, ASHMEM_SET_SIZE, __size);
- if (ret < 0)
- goto error;
+ if (ret < 0) goto error;
return fd;
error:
close(fd);
return ret;
+
}
void *shmat(int __shmid, const void *__shmaddr, int __shmflg) {
+
(void)__shmflg;
int size;
void *ptr;
size = ioctl(__shmid, ASHMEM_GET_SIZE, NULL);
- if (size < 0) {
- return NULL;
- }
+ if (size < 0) { return NULL; }
ptr = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, __shmid, 0);
- if (ptr == MAP_FAILED) {
- return NULL;
- }
+ if (ptr == MAP_FAILED) { return NULL; }
return ptr;
+
}
#endif /* !_ANDROID_ASHMEM_H */
#endif /* !__ANDROID__ */
+

MODIFY
src/afl-fuzz-init.c
src/afl-fuzz-init.c
@@ -1027,7 +1027,7 @@ void perform_dry_run(afl_state_t *afl) {
struct queue_entry *p = afl->queue;
- if (!p->disabled && !p->was_fuzzed) {
+ if (!p->was_fuzzed) {
--afl->pending_not_fuzzed;
--afl->active_paths;
@@ -1128,16 +1128,6 @@ restart_outer_cull_loop:
if (!p->cal_failed && p->exec_cksum == q->exec_cksum) {
duplicates = 1;
- if (!p->disabled && !q->disabled && !p->was_fuzzed && !q->was_fuzzed) {
-
- --afl->pending_not_fuzzed;
- afl->active_paths--;
-
- } else {
-
- FATAL("disabled entry? this should not happen, please report!");
-
- }
// We do not remove any of the memory allocated because for
// splicing the data might still be interesting.
@@ -1147,6 +1137,14 @@ restart_outer_cull_loop:
// we keep the shorter file
if (p->len >= q->len) {
+ if (!p->was_fuzzed) {
+
+ p->was_fuzzed = 1;
+ --afl->pending_not_fuzzed;
+ afl->active_paths--;
+
+ }
+
p->disabled = 1;
p->perf_score = 0;
q->next = p->next;
@@ -1154,6 +1152,14 @@ restart_outer_cull_loop:
} else {
+ if (!q->was_fuzzed) {
+
+ q->was_fuzzed = 1;
+ --afl->pending_not_fuzzed;
+ afl->active_paths--;
+
+ }
+
q->disabled = 1;
q->perf_score = 0;
if (prev)

MODIFY
src/afl-showmap.c
src/afl-showmap.c
@@ -317,8 +317,16 @@ static void showmap_run_target_forkserver(afl_forkserver_t *fsrv, u8 *mem,
}
- if (fsrv->trace_bits[0] == 1) { fsrv->trace_bits[0] = 0; have_coverage = 1; }
- else { have_coverage = 0; }
+ if (fsrv->trace_bits[0] == 1) {
+
+ fsrv->trace_bits[0] = 0;
+ have_coverage = 1;
+
+ } else {
+
+ have_coverage = 0;
+
+ }
if (!no_classify) { classify_counts(fsrv); }
@@ -493,8 +501,16 @@ static void showmap_run_target(afl_forkserver_t *fsrv, char **argv) {
}
- if (fsrv->trace_bits[0] == 1) { fsrv->trace_bits[0] = 0; have_coverage = 1; }
- else { have_coverage = 0; }
+ if (fsrv->trace_bits[0] == 1) {
+
+ fsrv->trace_bits[0] = 0;
+ have_coverage = 1;
+
+ } else {
+
+ have_coverage = 0;
+
+ }
if (!no_classify) { classify_counts(fsrv); }

MODIFY
utils/afl_frida/afl-frida.c
utils/afl_frida/afl-frida.c
@@ -166,10 +166,15 @@ int main(int argc, char** argv) {
void *dl = NULL;
if (argc > 2) {
+
dl = dlopen(argv[1], RTLD_LAZY);
+
} else {
+
dl = dlopen(TARGET_LIBRARY, RTLD_LAZY);
+
}
+
if (!dl) {
if (argc > 2)
@@ -197,6 +202,7 @@ int main(int argc, char** argv) {
// END STEP 2
if (!getenv("AFL_FRIDA_TEST_INPUT")) {
+
gum_init_embedded();
if (!gum_stalker_is_supported()) {
@@ -292,10 +298,12 @@ int main(int argc, char** argv) {
gum_deinit_embedded();
} else {
+
char buf[8 * 1024] = {0};
int count = read(0, buf, sizeof(buf));
buf[8 * 1024 - 1] = '\0';
(*o_function)(buf, count);
+
}
return 0;

real fix plus code format