fixed alloc errors, code format
MODIFY
examples/afl_network_proxy/afl-network-server.c
examples/afl_network_proxy/afl-network-server.c
@@ -358,8 +358,8 @@ int recv_testcase(int s, void **buf) {
if ((size & 0xff000000) != 0xff000000) {
- *buf = afl_realloc((void **)&buf, size);
- if (unlikely(!buf)) { PFATAL("Alloc"); }
+ *buf = afl_realloc(buf, size);
+ if (unlikely(!*buf)) { PFATAL("Alloc"); }
received = 0;
// fprintf(stderr, "unCOMPRESS (%u)\n", size);
while (received < size &&
@@ -371,8 +371,8 @@ int recv_testcase(int s, void **buf) {
#ifdef USE_DEFLATE
u32 clen;
size -= 0xff000000;
- *buf = afl_realloc((void **)&buf, size);
- if (unlikely(!buf)) { PFATAL("Alloc"); }
+ *buf = afl_realloc(buf, size);
+ if (unlikely(!*buf)) { PFATAL("Alloc"); }
received = 0;
while (received < 4 &&
(ret = recv(s, &clen + received, 4 - received, 0)) > 0)

MODIFY
include/alloc-inl.h
include/alloc-inl.h
@@ -694,7 +694,8 @@ static inline void *afl_realloc(void **buf, size_t size_needed) {
}
/* alloc */
- struct afl_alloc_buf *newer_buf = (struct afl_alloc_buf *)realloc(new_buf, next_size);
+ struct afl_alloc_buf *newer_buf =
+ (struct afl_alloc_buf *)realloc(new_buf, next_size);
if (unlikely(!newer_buf)) {
free(new_buf); // avoid a leak
@@ -707,7 +708,6 @@ static inline void *afl_realloc(void **buf, size_t size_needed) {
}
-
new_buf->complete_size = next_size;
*buf = (void *)(new_buf->buf);
return *buf;
@@ -736,7 +736,8 @@ static inline void *afl_realloc_exact(void **buf, size_t size_needed) {
if (unlikely(current_size == size_needed)) { return *buf; }
/* alloc */
- struct afl_alloc_buf *newer_buf = (struct afl_alloc_buf *)realloc(new_buf, size_needed);
+ struct afl_alloc_buf *newer_buf =
+ (struct afl_alloc_buf *)realloc(new_buf, size_needed);
if (unlikely(!newer_buf)) {
free(new_buf); // avoid a leak

MODIFY
src/afl-cc.c
src/afl-cc.c
@@ -1327,9 +1327,11 @@ int main(int argc, char **argv, char **envp) {
"filename\n");
#if LLVM_MAJOR < 9
-#define COUNTER_BEHAVIOUR " AFL_LLVM_NOT_ZERO: use cycling trace counters that skip zero\n"
+ #define COUNTER_BEHAVIOUR \
+ " AFL_LLVM_NOT_ZERO: use cycling trace counters that skip zero\n"
#else
-#define COUNTER_BEHAVIOUR " AFL_LLVM_SKIP_NEVERZERO: do not skip zero on trace counters\n"
+ #define COUNTER_BEHAVIOUR \
+ " AFL_LLVM_SKIP_NEVERZERO: do not skip zero on trace counters\n"
#endif
if (have_llvm)
SAYF(

MODIFY
src/afl-fuzz-python.c
src/afl-fuzz-python.c
@@ -96,7 +96,7 @@ static size_t fuzz_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf,
mutated_size = PyByteArray_Size(py_value);
*out_buf = afl_realloc(BUF_PARAMS(fuzz), mutated_size);
- if (unlikely(!out_buf)) { PFATAL("alloc"); }
+ if (unlikely(!*out_buf)) { PFATAL("alloc"); }
memcpy(*out_buf, PyByteArray_AsString(py_value), mutated_size);
Py_DECREF(py_value);
@@ -579,7 +579,7 @@ size_t trim_py(void *py_mutator, u8 **out_buf) {
ret = PyByteArray_Size(py_value);
*out_buf = afl_realloc(BUF_PARAMS(trim), ret);
- if (unlikely(!out_buf)) { PFATAL("alloc"); }
+ if (unlikely(!*out_buf)) { PFATAL("alloc"); }
memcpy(*out_buf, PyByteArray_AsString(py_value), ret);
Py_DECREF(py_value);
@@ -645,7 +645,7 @@ size_t havoc_mutation_py(void *py_mutator, u8 *buf, size_t buf_size,
/* A new buf is needed... */
*out_buf = afl_realloc(BUF_PARAMS(havoc), mutated_size);
- if (unlikely(!out_buf)) { PFATAL("alloc"); }
+ if (unlikely(!*out_buf)) { PFATAL("alloc"); }
}

MODIFY
src/afl-fuzz-queue.c
src/afl-fuzz-queue.c
@@ -56,7 +56,12 @@ void create_alias_table(afl_state_t *afl) {
int * S = (u32 *)afl_realloc(AFL_BUF_PARAM(out_scratch), n * sizeof(u32));
int * L = (u32 *)afl_realloc(AFL_BUF_PARAM(in_scratch), n * sizeof(u32));
- if (!P || !S || !L) { FATAL("could not aquire memory for alias table"); }
+ if (!P || !S || !L || !afl->alias_table || !afl->alias_probability) {
+
+ FATAL("could not aquire memory for alias table");
+
+ }
+
memset((void *)afl->alias_table, 0, n * sizeof(u32));
memset((void *)afl->alias_probability, 0, n * sizeof(double));

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -350,6 +350,7 @@ int main(int argc, char **argv_orig, char **envp) {
case 's': {
+ if (optarg == NULL) { FATAL("No valid seed provided. Got NULL."); }
rand_set_seed(afl, strtoul(optarg, 0L, 10));
afl->fixed_seed = 1;
break;
@@ -419,6 +420,7 @@ int main(int argc, char **argv_orig, char **envp) {
case 'i': /* input dir */
if (afl->in_dir) { FATAL("Multiple -i options not supported"); }
+ if (afl->in_dir == NULL) { FATAL("Invalid -i option (got NULL)."); }
afl->in_dir = optarg;
if (!strcmp(afl->in_dir, "-")) { afl->in_place_resume = 1; }

fixed alloc errors, code format