general maintance
MODIFY
TODO
TODO
Roadmap 2.55d:
==============
+afl-fuzz:
+ - radamsa mutator
+
gcc_plugin:
- needs to be rewritten
- whitelist support
@@ -18,7 +21,8 @@ qemu_mode:
custom_mutators:
- rip what Superion is doing into custom mutators for js, php, etc.
-unit testing / or large testcase campaign
+enhance test/test.sh script for checking if compcov features are working
+correctly (especially float splitting)
The far away future:

MODIFY
docs/ChangeLog
docs/ChangeLog
@@ -32,6 +32,7 @@ Version ++2.54d (dev):
and saves all mutations of the first run on the first file into out/queue/mutations
- libtokencap and libdislocator now compile to the afl_root directory and are
installed to the .../lib/afl directory when present during make install
+ - more BSD support, e.g. free CPU binding code for FreeBSD (thanks to devnexen)
- reducing duplicate code in afl-fuzz
- added "make help"
- removed compile warnings from python internal stuff

MODIFY
llvm_mode/afl-llvm-pass.so.cc
llvm_mode/afl-llvm-pass.so.cc
@@ -105,7 +105,9 @@ bool AFLCoverage::runOnModule(Module &M) {
SAYF(cCYA "afl-llvm-pass" VERSION cRST " by <lszekeres@google.com>\n");
- } else if (getenv("AFL_QUIET")) be_quiet = 1;
+ } else if (getenv("AFL_QUIET"))
+
+ be_quiet = 1;
/* Decide instrumentation ratio */
@@ -222,9 +224,9 @@ bool AFLCoverage::runOnModule(Module &M) {
cur_loc = AFL_R(MAP_SIZE);
/* There is a problem with Ubuntu 18.04 and llvm 6.0 (see issue #63).
- The inline function successors() is not inlined and also not found at runtime :-(
- As I am unable to detect Ubuntu18.04 heree, the next best thing is to disable
- this optional optimization for LLVM 6.0.0 and Linux */
+ The inline function successors() is not inlined and also not found at runtime
+ :-( As I am unable to detect Ubuntu18.04 heree, the next best thing is to
+ disable this optional optimization for LLVM 6.0.0 and Linux */
#if !(LLVM_VERSION_MAJOR == 6 && LLVM_VERSION_MINOR == 0) || !defined __linux__
// only instrument if this basic block is the destination of a previous
// basic block that has multiple successors

MODIFY
llvm_mode/split-compares-pass.so.cc
llvm_mode/split-compares-pass.so.cc
@@ -294,7 +294,11 @@ bool SplitComparesTransform::simplifyIntSignedness(Module &M) {
if (!intTyOp0 || !intTyOp1) { continue; }
/* i think this is not possible but to lazy to look it up */
- if (intTyOp0->getBitWidth() != intTyOp1->getBitWidth()) { continue; }
+ if (intTyOp0->getBitWidth() != intTyOp1->getBitWidth()) {
+
+ continue;
+
+ }
icomps.push_back(selectcmpInst);
@@ -412,6 +416,7 @@ bool SplitComparesTransform::simplifyIntSignedness(Module &M) {
}
size_t SplitComparesTransform::nextPowerOfTwo(size_t in) {
+
--in;
in |= in >> 1;
in |= in >> 2;
@@ -419,23 +424,28 @@ size_t SplitComparesTransform::nextPowerOfTwo(size_t in) {
// in |= in >> 8;
// in |= in >> 16;
return in + 1;
+
}
/* splits fcmps into two nested fcmps with sign compare and the rest */
size_t SplitComparesTransform::splitFPCompares(Module &M) {
+
size_t count = 0;
LLVMContext &C = M.getContext();
const DataLayout &dl = M.getDataLayout();
- /* define unions with floating point and (sign, exponent, mantissa) triples */
+ /* define unions with floating point and (sign, exponent, mantissa) triples
+ */
if (dl.isLittleEndian()) {
- }
- else if (dl.isBigEndian()) {
- }
- else {
+
+ } else if (dl.isBigEndian()) {
+
+ } else {
+
return count;
+
}
std::vector<CmpInst *> fcomps;
@@ -477,6 +487,7 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
}
}
+
if (!fcomps.size()) { return count; }
IntegerType *Int1Ty = IntegerType::getInt1Ty(C);
@@ -492,37 +503,42 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
op0_size = op0->getType()->getPrimitiveSizeInBits();
op1_size = op1->getType()->getPrimitiveSizeInBits();
- if (op0_size != op1_size) {
- continue;
- }
+ if (op0_size != op1_size) { continue; }
const unsigned int sizeInBits = op0->getType()->getPrimitiveSizeInBits();
- const unsigned int precision = sizeInBits == 32 ? 24 :
- sizeInBits == 64 ? 53 :
- sizeInBits == 128 ? 113 :
- sizeInBits == 16 ? 11 :
- 65;
+ const unsigned int precision =
+ sizeInBits == 32
+ ? 24
+ : sizeInBits == 64
+ ? 53
+ : sizeInBits == 128 ? 113 : sizeInBits == 16 ? 11 : 65;
const unsigned shiftR_exponent = precision - 1;
- const unsigned long long mask_fraction = ((1 << (precision - 2))) | ((1 << (precision - 2)) - 1);
- const unsigned long long mask_exponent = (1 << (sizeInBits - precision)) - 1;
+ const unsigned long long mask_fraction =
+ ((1 << (precision - 2))) | ((1 << (precision - 2)) - 1);
+ const unsigned long long mask_exponent =
+ (1 << (sizeInBits - precision)) - 1;
// round up sizes to the next power of two
// this should help with integer compare splitting
size_t exTySizeBytes = ((sizeInBits - precision + 7) >> 3);
size_t frTySizeBytes = ((precision - 1 + 7) >> 3);
- IntegerType *IntExponentTy = IntegerType::get(C, nextPowerOfTwo(exTySizeBytes) << 3);
- IntegerType *IntFractionTy = IntegerType::get(C, nextPowerOfTwo(frTySizeBytes) << 3);
+ IntegerType *IntExponentTy =
+ IntegerType::get(C, nextPowerOfTwo(exTySizeBytes) << 3);
+ IntegerType *IntFractionTy =
+ IntegerType::get(C, nextPowerOfTwo(frTySizeBytes) << 3);
BasicBlock *end_bb = bb->splitBasicBlock(BasicBlock::iterator(FcmpInst));
/* create the integers from floats directly */
Instruction *b_op0, *b_op1;
- b_op0 = CastInst::Create(Instruction::BitCast, op0, IntegerType::get(C, op0_size));
+ b_op0 = CastInst::Create(Instruction::BitCast, op0,
+ IntegerType::get(C, op0_size));
bb->getInstList().insert(bb->getTerminator()->getIterator(), b_op0);
- b_op1 = CastInst::Create(Instruction::BitCast, op1, IntegerType::get(C, op1_size));
+ b_op1 = CastInst::Create(Instruction::BitCast, op1,
+ IntegerType::get(C, op1_size));
bb->getInstList().insert(bb->getTerminator()->getIterator(), b_op1);
/* isolate signs of value of floating point type */
@@ -531,20 +547,23 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
* the original operands so only the first bit remains.*/
Instruction *s_s0, *t_s0, *s_s1, *t_s1, *icmp_sign_bit;
- s_s0 = BinaryOperator::Create(Instruction::LShr, b_op0,
+ s_s0 = BinaryOperator::Create(
+ Instruction::LShr, b_op0,
ConstantInt::get(b_op0->getType(), op0_size - 1));
bb->getInstList().insert(bb->getTerminator()->getIterator(), s_s0);
t_s0 = new TruncInst(s_s0, Int1Ty);
bb->getInstList().insert(bb->getTerminator()->getIterator(), t_s0);
- s_s1 = BinaryOperator::Create(Instruction::LShr, b_op1,
+ s_s1 = BinaryOperator::Create(
+ Instruction::LShr, b_op1,
ConstantInt::get(b_op1->getType(), op1_size - 1));
bb->getInstList().insert(bb->getTerminator()->getIterator(), s_s1);
t_s1 = new TruncInst(s_s1, Int1Ty);
bb->getInstList().insert(bb->getTerminator()->getIterator(), t_s1);
/* compare of the sign bits */
- icmp_sign_bit = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_s0, t_s1);
+ icmp_sign_bit =
+ CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_s0, t_s1);
bb->getInstList().insert(bb->getTerminator()->getIterator(), icmp_sign_bit);
/* create a new basic block which is executed if the signedness bits are
@@ -570,28 +589,48 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
/* isolate the exponents */
Instruction *s_e0, *m_e0, *t_e0, *s_e1, *m_e1, *t_e1;
- s_e0 = BinaryOperator::Create(Instruction::LShr, b_op0, ConstantInt::get(b_op0->getType(), shiftR_exponent));
- s_e1 = BinaryOperator::Create(Instruction::LShr, b_op1, ConstantInt::get(b_op1->getType(), shiftR_exponent));
- signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), s_e0);
- signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), s_e1);
+ s_e0 = BinaryOperator::Create(
+ Instruction::LShr, b_op0,
+ ConstantInt::get(b_op0->getType(), shiftR_exponent));
+ s_e1 = BinaryOperator::Create(
+ Instruction::LShr, b_op1,
+ ConstantInt::get(b_op1->getType(), shiftR_exponent));
+ signequal_bb->getInstList().insert(
+ signequal_bb->getTerminator()->getIterator(), s_e0);
+ signequal_bb->getInstList().insert(
+ signequal_bb->getTerminator()->getIterator(), s_e1);
t_e0 = new TruncInst(s_e0, IntExponentTy);
t_e1 = new TruncInst(s_e1, IntExponentTy);
- signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), t_e0);
- signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), t_e1);
+ signequal_bb->getInstList().insert(
+ signequal_bb->getTerminator()->getIterator(), t_e0);
+ signequal_bb->getInstList().insert(
+ signequal_bb->getTerminator()->getIterator(), t_e1);
if (sizeInBits - precision < exTySizeBytes * 8) {
- m_e0 = BinaryOperator::Create(Instruction::And, t_e0, ConstantInt::get(t_e0->getType(), mask_exponent));
- m_e1 = BinaryOperator::Create(Instruction::And, t_e1, ConstantInt::get(t_e1->getType(), mask_exponent));
- signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), m_e0);
- signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), m_e1);
+
+ m_e0 = BinaryOperator::Create(
+ Instruction::And, t_e0,
+ ConstantInt::get(t_e0->getType(), mask_exponent));
+ m_e1 = BinaryOperator::Create(
+ Instruction::And, t_e1,
+ ConstantInt::get(t_e1->getType(), mask_exponent));
+ signequal_bb->getInstList().insert(
+ signequal_bb->getTerminator()->getIterator(), m_e0);
+ signequal_bb->getInstList().insert(
+ signequal_bb->getTerminator()->getIterator(), m_e1);
+
} else {
+
m_e0 = t_e0;
m_e1 = t_e1;
+
}
+
/* compare the exponents of the operands */
Instruction *icmp_exponent_result;
switch (FcmpInst->getPredicate()) {
+
case CmpInst::FCMP_OEQ:
icmp_exponent_result =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, m_e0, m_e1);
@@ -605,63 +644,95 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
Instruction *icmp_exponent;
icmp_exponent =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_UGT, m_e0, m_e1);
- signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), icmp_exponent);
- icmp_exponent_result = BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0);
+ signequal_bb->getInstList().insert(
+ signequal_bb->getTerminator()->getIterator(), icmp_exponent);
+ icmp_exponent_result =
+ BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0);
break;
case CmpInst::FCMP_OLT:
icmp_exponent =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_ULT, m_e0, m_e1);
- signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), icmp_exponent);
- icmp_exponent_result = BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0);
+ signequal_bb->getInstList().insert(
+ signequal_bb->getTerminator()->getIterator(), icmp_exponent);
+ icmp_exponent_result =
+ BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0);
break;
- default:
- continue;
+ default: continue;
+
}
- signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), icmp_exponent_result);
+
+ signequal_bb->getInstList().insert(
+ signequal_bb->getTerminator()->getIterator(), icmp_exponent_result);
{
+
auto term = signequal_bb->getTerminator();
/* if the exponents are different do a fraction cmp */
BranchInst::Create(middle_bb, end_bb, icmp_exponent_result, signequal_bb);
term->eraseFromParent();
- }
+ }
/* isolate the mantissa aka fraction */
Instruction *t_f0, *t_f1;
bool needTrunc = IntFractionTy->getPrimitiveSizeInBits() < op0_size;
-//errs() << "Fractions: IntFractionTy size " << IntFractionTy->getPrimitiveSizeInBits() << ", op0_size " << op0_size << ", needTrunc " << needTrunc << "\n";
+ // errs() << "Fractions: IntFractionTy size " <<
+ // IntFractionTy->getPrimitiveSizeInBits() << ", op0_size " << op0_size << ",
+ // needTrunc " << needTrunc << "\n";
if (precision - 1 < frTySizeBytes * 8) {
+
Instruction *m_f0, *m_f1;
- m_f0 = BinaryOperator::Create(Instruction::And, b_op0, ConstantInt::get(b_op0->getType(), mask_fraction));
- m_f1 = BinaryOperator::Create(Instruction::And, b_op1, ConstantInt::get(b_op1->getType(), mask_fraction));
- middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), m_f0);
- middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), m_f1);
+ m_f0 = BinaryOperator::Create(
+ Instruction::And, b_op0,
+ ConstantInt::get(b_op0->getType(), mask_fraction));
+ m_f1 = BinaryOperator::Create(
+ Instruction::And, b_op1,
+ ConstantInt::get(b_op1->getType(), mask_fraction));
+ middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(),
+ m_f0);
+ middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(),
+ m_f1);
if (needTrunc) {
+
t_f0 = new TruncInst(m_f0, IntFractionTy);
t_f1 = new TruncInst(m_f1, IntFractionTy);
- middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f0);
- middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f1);
+ middle_bb->getInstList().insert(
+ middle_bb->getTerminator()->getIterator(), t_f0);
+ middle_bb->getInstList().insert(
+ middle_bb->getTerminator()->getIterator(), t_f1);
+
} else {
+
t_f0 = m_f0;
t_f1 = m_f1;
+
}
+
} else {
+
if (needTrunc) {
+
t_f0 = new TruncInst(b_op0, IntFractionTy);
t_f1 = new TruncInst(b_op1, IntFractionTy);
- middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f0);
- middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f1);
+ middle_bb->getInstList().insert(
+ middle_bb->getTerminator()->getIterator(), t_f0);
+ middle_bb->getInstList().insert(
+ middle_bb->getTerminator()->getIterator(), t_f1);
+
} else {
+
t_f0 = b_op0;
t_f1 = b_op1;
+
}
+
}
/* compare the fractions of the operands */
Instruction *icmp_fraction_result;
switch (FcmpInst->getPredicate()) {
+
case CmpInst::FCMP_OEQ:
icmp_fraction_result =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_f0, t_f1);
@@ -675,23 +746,30 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
Instruction *icmp_fraction;
icmp_fraction =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_UGT, t_f0, t_f1);
- middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), icmp_fraction);
- icmp_fraction_result = BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0);
+ middle_bb->getInstList().insert(
+ middle_bb->getTerminator()->getIterator(), icmp_fraction);
+ icmp_fraction_result =
+ BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0);
break;
case CmpInst::FCMP_OLT:
icmp_fraction =
CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_ULT, t_f0, t_f1);
- middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), icmp_fraction);
- icmp_fraction_result = BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0);
+ middle_bb->getInstList().insert(
+ middle_bb->getTerminator()->getIterator(), icmp_fraction);
+ icmp_fraction_result =
+ BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0);
break;
- default:
- continue;
+ default: continue;
+
}
- middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), icmp_fraction_result);
+
+ middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(),
+ icmp_fraction_result);
PHINode *PN = PHINode::Create(Int1Ty, 3, "");
switch (FcmpInst->getPredicate()) {
+
case CmpInst::FCMP_OEQ:
/* unequal signs cannot be equal values */
/* goto false branch */
@@ -725,13 +803,14 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
PN->addIncoming(icmp_exponent_result, signequal_bb);
PN->addIncoming(icmp_fraction_result, middle_bb);
break;
- default:
- continue;
+ default: continue;
+
}
BasicBlock::iterator ii(FcmpInst);
ReplaceInstWithInst(FcmpInst->getParent()->getInstList(), ii, PN);
++count;
+
}
return count;
@@ -740,6 +819,7 @@ size_t SplitComparesTransform::splitFPCompares(Module &M) {
/* splits icmps of size bitw into two nested icmps with bitw/2 size each */
size_t SplitComparesTransform::splitIntCompares(Module &M, unsigned bitw) {
+
size_t count = 0;
LLVMContext &C = M.getContext();
@@ -938,7 +1018,9 @@ size_t SplitComparesTransform::splitIntCompares(Module &M, unsigned bitw) {
ReplaceInstWithInst(IcmpInst->getParent()->getInstList(), ii, PN);
}
+
++count;
+
}
return count;
@@ -958,27 +1040,29 @@ bool SplitComparesTransform::runOnModule(Module &M) {
simplifyIntSignedness(M);
if (getenv("AFL_QUIET") == NULL)
- errs() << "Split-compare-pass by laf.intel@gmail.com, extended by heiko@hexco.de\n";
+ errs() << "Split-compare-pass by laf.intel@gmail.com, extended by "
+ "heiko@hexco.de\n";
- errs() << "Split-floatingpoint-compare-pass: " << splitFPCompares(M) << " FP comparisons splitted\n";
+ errs() << "Split-floatingpoint-compare-pass: " << splitFPCompares(M)
+ << " FP comparisons splitted\n";
switch (bitw) {
case 64:
- errs() << "Split-integer-compare-pass " << bitw << "bit: "
- << splitIntCompares(M, bitw) << " splitted\n";
+ errs() << "Split-integer-compare-pass " << bitw
+ << "bit: " << splitIntCompares(M, bitw) << " splitted\n";
bitw >>= 1;
[[clang::fallthrough]]; /*FALLTHRU*/ /* FALLTHROUGH */
case 32:
- errs() << "Split-integer-compare-pass " << bitw << "bit: "
- << splitIntCompares(M, bitw) << " splitted\n";
+ errs() << "Split-integer-compare-pass " << bitw
+ << "bit: " << splitIntCompares(M, bitw) << " splitted\n";
bitw >>= 1;
[[clang::fallthrough]]; /*FALLTHRU*/ /* FALLTHROUGH */
case 16:
- errs() << "Split-integer-compare-pass " << bitw << "bit: "
- << splitIntCompares(M, bitw) << " splitted\n";
+ errs() << "Split-integer-compare-pass " << bitw
+ << "bit: " << splitIntCompares(M, bitw) << " splitted\n";
bitw >>= 1;
break;

MODIFY
qemu_mode/patches/afl-qemu-cpu-inl.h
qemu_mode/patches/afl-qemu-cpu-inl.h
@@ -217,11 +217,11 @@ static void afl_setup(void) {
}
- if (getenv("AFL_QEMU_PERSISTENT_GPR"))
- persistent_save_gpr = 1;
+ if (getenv("AFL_QEMU_PERSISTENT_GPR")) persistent_save_gpr = 1;
if (getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"))
- persisent_retaddr_offset = strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 16);
+ persisent_retaddr_offset =
+ strtoll(getenv("AFL_QEMU_PERSISTENT_RETADDR_OFFSET"), NULL, 16);
if (getenv("AFL_QEMU_PERSISTENT_CNT"))
afl_persistent_cnt = strtoll(getenv("AFL_QEMU_PERSISTENT_CNT"), NULL, 16);

MODIFY
src/afl-fuzz-globals.c
src/afl-fuzz-globals.c
@@ -263,3 +263,4 @@ PyObject *py_functions[PY_FUNC_COUNT];
u8 do_document;
u32 document_counter;
#endif
+

MODIFY
src/afl-fuzz-init.c
src/afl-fuzz-init.c
@@ -126,16 +126,22 @@ void bind_to_free_cpu(void) {
procs = ck_alloc(nprocs);
if (sysctl(s_name, s_name_l, procs, &nprocs, NULL, 0) != 0) {
+
ck_free(procs);
return;
+
}
for (i = 0; i < proccount; i++) {
- if (procs[i].ki_oncpu < sizeof(cpu_used))
- cpu_used[procs[i].ki_oncpu] = 1;
+
+ if (procs[i].ki_oncpu < sizeof(cpu_used)) cpu_used[procs[i].ki_oncpu] = 1;
+
}
ck_free(procs);
+#else
+#warning \
+ "For this platform we do not have free CPU binding code yet. If poxxible, please supply a PR to https://github.com/vanhauser-thc/AFLplusplus"
#endif
for (i = 0; i < cpu_core_count; ++i)
@@ -166,7 +172,10 @@ void bind_to_free_cpu(void) {
#if defined(__linux__)
if (sched_setaffinity(0, sizeof(c), &c)) PFATAL("sched_setaffinity failed");
#elif defined(__FreeBSD__)
- if (pthread_setaffinity_np(pthread_self(), sizeof(c), &c)) PFATAL("pthread_setaffinity failed");
+ if (pthread_setaffinity_np(pthread_self(), sizeof(c), &c))
+ PFATAL("pthread_setaffinity failed");
+#else
+ // this will need something for other platforms
#endif
}
@@ -815,7 +824,8 @@ double get_runnable_processes(void) {
static double res;
-#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__)
+#if defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || \
+ defined(__NetBSD__)
/* I don't see any portable sysctl or so that would quickly give us the
number of runnable processes; the 1-minute load average can be a
@@ -1542,6 +1552,7 @@ void check_cpu_governor(void) {
min / 1024, max / 1024);
FATAL("Suboptimal CPU scaling governor");
#endif
+
}
/* Count the number of logical CPU cores. */

MODIFY
src/afl-fuzz-one.c
src/afl-fuzz-one.c
@@ -4231,7 +4231,6 @@ pacemaker_fuzzing:
#define core_fuzzing(a) common_fuzzing((a), MOpt_globals_core)
-
void pso_updating(void) {
g_now += 1;
@@ -4314,17 +4313,25 @@ u8 fuzz_one(char** argv) {
#ifdef _AFL_DOCUMENT_MUTATIONS
if (do_document == 0) {
+
char* fn = alloc_printf("%s/mutations", out_dir);
if (fn) {
+
do_document = mkdir(fn, 0700); // if it exists we do not care
do_document = 1;
ck_free(fn);
+
} else
+
PFATAL("malloc()");
+
} else {
+
do_document = 2;
stop_soon = 2;
+
}
+
#endif
if (limit_time_sig == 0) {

MODIFY
src/afl-fuzz-run.c
src/afl-fuzz-run.c
@@ -178,15 +178,21 @@ u8 run_target(char** argv, u32 timeout) {
if ((res = read(fsrv_st_fd, &status, 4)) != 4) {
if (stop_soon) return 0;
- SAYF("\n" cLRD "[-] " cRST
+ SAYF(
+ "\n" cLRD "[-] " cRST
"Unable to communicate with fork server. Some possible reasons:\n\n"
- " - You've run out of memory. Use -m to increase the the memory limit\n"
+ " - You've run out of memory. Use -m to increase the the memory "
+ "limit\n"
" to something higher than %lld.\n"
" - The binary or one of the libraries it uses manages to create\n"
" threads before the forkserver initializes.\n"
- " - The binary, at least in some circumstances, exits in a way that\n"
- " also kills the parent process - raise() could be the culprit.\n\n"
- "If all else fails you can disable the fork server via AFL_NO_FORKSRV=1.\n", mem_limit);
+ " - The binary, at least in some circumstances, exits in a way "
+ "that\n"
+ " also kills the parent process - raise() could be the "
+ "culprit.\n\n"
+ "If all else fails you can disable the fork server via "
+ "AFL_NO_FORKSRV=1.\n",
+ mem_limit);
RPFATAL(res, "Unable to communicate with fork server");
}
@@ -262,14 +268,22 @@ void write_to_testcase(void* mem, u32 len) {
#ifdef _AFL_DOCUMENT_MUTATIONS
s32 doc_fd;
- char *fn = alloc_printf("%s/mutations/%09u:%s", out_dir, document_counter++, describe_op(0));
+ char* fn = alloc_printf("%s/mutations/%09u:%s", out_dir, document_counter++,
+ describe_op(0));
if (fn != NULL) {
+
if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600)) >= 0) {
- if (write(doc_fd, mem, len) != len) PFATAL("write to mutation file failed: %s", fn);
+
+ if (write(doc_fd, mem, len) != len)
+ PFATAL("write to mutation file failed: %s", fn);
close(doc_fd);
+
}
+
ck_free(fn);
+
}
+
#endif
if (out_file) {

MODIFY
src/afl-gotcpu.c
src/afl-gotcpu.c
@@ -173,8 +173,7 @@ int main(int argc, char** argv) {
cpuset_t* c;
c = cpuset_create();
- if (c == NULL)
- PFATAL("cpuset_create failed");
+ if (c == NULL) PFATAL("cpuset_create failed");
cpuset_set(i, c);
#endif

MODIFY
test/test.sh
test/test.sh
@@ -179,7 +179,7 @@ test -e ../afl-clang-fast && {
../afl-clang-fast -o test-persistent ../experimental/persistent_demo/persistent_demo.c > /dev/null 2>&1
test -e test-persistent && {
echo foo | ../afl-showmap -o /dev/null -q -r ./test-persistent && {
- $ECHO "$GREEN[+] lvm_mode persistent mode feature works correctly"
+ $ECHO "$GREEN[+] llvm_mode persistent mode feature works correctly"
} || $ECHO "$RED[!] llvm_mode persistent mode feature failed to work"
} || $ECHO "$RED[!] llvm_mode persistent mode feature compilation failed"
rm -f test-persistent

general maintance