afl-sharedmem.c: fix leaks on error paths (SysV shared memory)
MODIFY
include/debug.h
include/debug.h
\
} while (0)
-/* Die with FAULT() or PFAULT() depending on the value of res (used to
+/* Die with FATAL() or PFATAL() depending on the value of res (used to
interpret different failure modes for read(), write(), etc). */
#define RPFATAL(res, x...) \

MODIFY
src/afl-sharedmem.c
src/afl-sharedmem.c
@@ -239,7 +239,10 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
shm->cmplog_shm_id = shmget(IPC_PRIVATE, sizeof(struct cmp_map),
IPC_CREAT | IPC_EXCL | 0600);
- if (shm->cmplog_shm_id < 0) { PFATAL("shmget() failed"); }
+ if (shm->cmplog_shm_id < 0) {
+ shmctl(shm->shm_id, IPC_RMID, NULL); // do not leak shmem
+ PFATAL("shmget() failed");
+ }
}
@@ -266,7 +269,13 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
shm->map = shmat(shm->shm_id, NULL, 0);
- if (shm->map == (void *)-1 || !shm->map) { PFATAL("shmat() failed"); }
+ if (shm->map == (void *)-1 || !shm->map) {
+ shmctl(shm->shm_id, IPC_RMID, NULL); // do not leak shmem
+ if (shm->cmplog_mode) {
+ shmctl(shm->cmplog_shm_id, IPC_RMID, NULL); // do not leak shmem
+ }
+ PFATAL("shmat() failed");
+ }
if (shm->cmplog_mode) {
@@ -274,6 +283,10 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size,
if (shm->cmp_map == (void *)-1 || !shm->cmp_map) {
+ shmctl(shm->shm_id, IPC_RMID, NULL); // do not leak shmem
+ if (shm->cmplog_mode) {
+ shmctl(shm->cmplog_shm_id, IPC_RMID, NULL); // do not leak shmem
+ }
PFATAL("shmat() failed");
}

afl-sharedmem.c: fix leaks on error paths (SysV shared memory)