fix scan-build issues
MODIFY
instrumentation/LLVMInsTrim.so.cc
instrumentation/LLVMInsTrim.so.cc
@@ -459,7 +459,7 @@ struct InsTrim : public ModulePass {
BasicBlock *PBB = *PI;
auto It = PredMap.insert({PBB, genLabel()});
unsigned Label = It.first->second;
- cur_loc = Label;
+ // cur_loc = Label;
PN->addIncoming(ConstantInt::get(Int32Ty, Label), PBB);
}

MODIFY
instrumentation/SanitizerCoverageLTO.so.cc
instrumentation/SanitizerCoverageLTO.so.cc
@@ -760,7 +760,7 @@ bool ModuleSanitizerCoverage::instrumentModule(
if (literalLength + 1 == optLength) {
Str2.append("\0", 1); // add null byte
- addedNull = true;
+ // addedNull = true;
}

MODIFY
instrumentation/afl-llvm-common.cc
instrumentation/afl-llvm-common.cc
@@ -351,7 +351,7 @@ static std::string getSourceName(llvm::Function *F) {
if (cDILoc) { instFilename = cDILoc->getFilename(); }
- if (instFilename.str().empty()) {
+ if (instFilename.str().empty() && cDILoc) {
/* If the original location is empty, try using the inlined location
*/

MODIFY
instrumentation/afl-llvm-dict2file.so.cc
instrumentation/afl-llvm-dict2file.so.cc
@@ -430,7 +430,6 @@ bool AFLdict2filePass::runOnModule(Module &M) {
if (literalLength + 1 == optLength) {
Str2.append("\0", 1); // add null byte
- addedNull = true;
}

MODIFY
instrumentation/afl-llvm-lto-instrumentation.so.cc
instrumentation/afl-llvm-lto-instrumentation.so.cc
@@ -546,7 +546,7 @@ bool AFLLTOPass::runOnModule(Module &M) {
if (literalLength + 1 == optLength) {
Str2.append("\0", 1); // add null byte
- addedNull = true;
+ // addedNull = true;
}

MODIFY
instrumentation/afl-llvm-pass.so.cc
instrumentation/afl-llvm-pass.so.cc
@@ -538,6 +538,7 @@ bool AFLCoverage::runOnModule(Module &M) {
Store = IRB.CreateStore(ConstantInt::get(Int32Ty, cur_loc >> 1),
AFLPrevLoc);
+ Store->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
}

MODIFY
instrumentation/compare-transform-pass.so.cc
instrumentation/compare-transform-pass.so.cc
@@ -391,7 +391,7 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
if (val && !val->empty()) {
Str2 = StringRef(*val);
- HasStr2 = true;
+ // HasStr2 = true;
}

MODIFY
instrumentation/split-compares-pass.so.cc
instrumentation/split-compares-pass.so.cc
@@ -407,6 +407,7 @@ bool SplitComparesTransform::simplifyIntSignedness(Module &M) {
auto op1 = IcmpInst->getOperand(1);
IntegerType *intTyOp0 = dyn_cast<IntegerType>(op0->getType());
+ if (!intTyOp0) { continue; }
unsigned bitw = intTyOp0->getBitWidth();
IntegerType *IntType = IntegerType::get(C, bitw);
@@ -606,10 +607,11 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
: sizeInBits == 64 ? 53
: sizeInBits == 128 ? 113
: sizeInBits == 16 ? 11
- /* sizeInBits == 80 */
- : 65;
+ : sizeInBits == 80 ? 65
+ : sizeInBits - 8;
const unsigned shiftR_exponent = precision - 1;
+ // BUG FIXME TODO: u64 does not work for > 64 bit ... e.g. 80 and 128 bit
const unsigned long long mask_fraction =
(1ULL << (shiftR_exponent - 1)) | ((1ULL << (shiftR_exponent - 1)) - 1);
const unsigned long long mask_exponent =
@@ -1300,12 +1302,9 @@ bool SplitComparesTransform::runOnModule(Module &M) {
case 64:
count += splitIntCompares(M, bitw);
- /*
- if (!be_quiet)
- errs() << "Split-integer-compare-pass " << bitw << "bit: " <<
- count
+ if (debug)
+ errs() << "Split-integer-compare-pass " << bitw << "bit: " << count
<< " split\n";
- */
bitw >>= 1;
#if LLVM_VERSION_MAJOR > 3 || \
(LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR > 7)
@@ -1313,12 +1312,9 @@ bool SplitComparesTransform::runOnModule(Module &M) {
#endif
case 32:
count += splitIntCompares(M, bitw);
- /*
- if (!be_quiet)
- errs() << "Split-integer-compare-pass " << bitw << "bit: " <<
- count
+ if (debug)
+ errs() << "Split-integer-compare-pass " << bitw << "bit: " << count
<< " split\n";
- */
bitw >>= 1;
#if LLVM_VERSION_MAJOR > 3 || \
(LLVM_VERSION_MAJOR == 3 && LLVM_VERSION_MINOR > 7)
@@ -1326,13 +1322,10 @@ bool SplitComparesTransform::runOnModule(Module &M) {
#endif
case 16:
count += splitIntCompares(M, bitw);
- /*
- if (!be_quiet)
- errs() << "Split-integer-compare-pass " << bitw << "bit: " <<
- count
+ if (debug)
+ errs() << "Split-integer-compare-pass " << bitw << "bit: " << count
<< " split\n";
- */
- bitw >>= 1;
+ // bitw >>= 1;
break;
default:

MODIFY
src/afl-cc.c
src/afl-cc.c
@@ -315,16 +315,9 @@ static void edit_params(u32 argc, char **argv, char **envp) {
u8 fortify_set = 0, asan_set = 0, x_set = 0, bit_mode = 0, shared_linking = 0,
preprocessor_only = 0, have_unroll = 0, have_o = 0, have_pic = 0,
have_c = 0;
- u8 *name;
cc_params = ck_alloc((argc + 128) * sizeof(u8 *));
- name = strrchr(argv[0], '/');
- if (!name)
- name = argv[0];
- else
- ++name;
-
if (lto_mode) {
if (lto_flag[0] != '-')

MODIFY
src/afl-fuzz-init.c
src/afl-fuzz-init.c
@@ -1242,7 +1242,7 @@ static void link_or_copy(u8 *old_path, u8 *new_path) {
void pivot_inputs(afl_state_t *afl) {
- struct queue_entry *q = afl->queue;
+ struct queue_entry *q;
u32 id = 0, i;
ACTF("Creating hard links for all input files...");

MODIFY
src/afl-fuzz-redqueen.c
src/afl-fuzz-redqueen.c
@@ -1415,7 +1415,7 @@ static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
} else if (b[k] == 0xff) {
- ++cons_0;
+ ++cons_ff;
} else {
@@ -1473,7 +1473,7 @@ static void try_to_add_to_dictN(afl_state_t *afl, u128 v, u8 size) {
} else if (b[k] == 0xff) {
- ++cons_0;
+ ++cons_ff;
} else {
@@ -2410,7 +2410,21 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
// manually clear the full cmp_map
memset(afl->shm.cmp_map, 0, sizeof(struct cmp_map));
- if (unlikely(common_fuzz_cmplog_stuff(afl, orig_buf, len))) { return 1; }
+ if (unlikely(common_fuzz_cmplog_stuff(afl, orig_buf, len))) {
+
+ afl->queue_cur->colorized = CMPLOG_LVL_MAX;
+ while (taint) {
+
+ t = taint->next;
+ ck_free(taint);
+ taint = t;
+
+ }
+
+ return 1;
+
+ }
+
if (unlikely(!afl->orig_cmp_map)) {
afl->orig_cmp_map = ck_alloc_nozero(sizeof(struct cmp_map));
@@ -2419,7 +2433,20 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
memcpy(afl->orig_cmp_map, afl->shm.cmp_map, sizeof(struct cmp_map));
memset(afl->shm.cmp_map->headers, 0, sizeof(struct cmp_header) * CMP_MAP_W);
- if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) { return 1; }
+ if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) {
+
+ afl->queue_cur->colorized = CMPLOG_LVL_MAX;
+ while (taint) {
+
+ t = taint->next;
+ ck_free(taint);
+ taint = t;
+
+ }
+
+ return 1;
+
+ }
#ifdef _DEBUG
dump("ORIG", orig_buf, len);
@@ -2530,7 +2557,6 @@ exit_its:
afl->queue_cur->colorized = CMPLOG_LVL_MAX;
ck_free(afl->queue_cur->cmplog_colorinput);
- t = taint;
while (taint) {
t = taint->next;

fix scan-build issues