cleanup minor issues
MODIFY
src/afl-fuzz-bitmap.c
src/afl-fuzz-bitmap.c
@@ -183,6 +183,8 @@ u32 count_bits_len(afl_state_t *afl, u8 *mem, u32 len) {
u32 i = (len >> 2);
u32 ret = 0;
+ (void)(afl);
+
if (len % 4) i++;
while (i--) {
@@ -241,6 +243,8 @@ u32 count_bytes_len(afl_state_t *afl, u8 *mem, u32 len) {
u32 i = (len >> 2);
u32 ret = 0;
+ (void)(afl);
+
while (i--) {
u32 v = *(ptr++);

MODIFY
src/afl-fuzz-one.c
src/afl-fuzz-one.c
@@ -472,12 +472,12 @@ u8 fuzz_one_original(afl_state_t *afl) {
ret_val = 1;
- u32 dst = 0, i;
+ s32 dst = 0, i;
temp_len = len = afl->queue_cur->len;
fd = open(afl->queue_cur->fname, O_RDONLY);
afl->taint_src = mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
- if (fd < 0 || (size_t)afl->taint_src == -1)
+ if (fd < 0 || (ssize_t)afl->taint_src == -1)
FATAL("unable to open '%s'", afl->queue_cur->fname);
close(fd);
afl->taint_needs_splode = 1;
@@ -490,18 +490,18 @@ u8 fuzz_one_original(afl_state_t *afl) {
temp_len = len = afl->taint_len = afl->queue_cur->taint_bytes_all;
orig_in = in_buf =
mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
- if (fd < 0 || (size_t)in_buf == -1)
+ if (fd < 0 || (ssize_t)in_buf == -1)
FATAL("unable to open '%s'", afl->taint_input_file);
close(fd);
fd = open(afl->queue_cur->fname_taint, O_RDWR);
afl->taint_map = mmap(0, afl->queue_cur->len, PROT_READ | PROT_WRITE,
MAP_PRIVATE, fd, 0);
- if (fd < 0 || (size_t)in_buf == -1)
+ if (fd < 0 || (ssize_t)in_buf == -1)
FATAL("unable to open '%s'", afl->queue_cur->fname_taint);
close(fd);
- for (i = 0; i < afl->queue_cur->len && dst < len; i++)
+ for (i = 0; i < (s32)afl->queue_cur->len && dst < len; i++)
if (afl->taint_map[i]) in_buf[dst++] = afl->taint_src[i];
break;
@@ -512,7 +512,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
temp_len = len = afl->taint_len = afl->queue_cur->taint_bytes_new;
orig_in = in_buf =
mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
- if (fd < 0 || (size_t)in_buf == -1)
+ if (fd < 0 || (ssize_t)in_buf == -1)
FATAL("unable to open '%s'", afl->taint_input_file);
close(fd);
@@ -520,12 +520,12 @@ u8 fuzz_one_original(afl_state_t *afl) {
fd = open(fn, O_RDWR);
afl->taint_map = mmap(0, afl->queue_cur->len, PROT_READ | PROT_WRITE,
MAP_PRIVATE, fd, 0);
- if (fd < 0 || (size_t)in_buf == -1)
+ if (fd < 0 || (ssize_t)in_buf == -1)
FATAL("unable to open '%s' for %u bytes", fn, len);
close(fd);
ck_free(fn);
- for (i = 0; i < afl->queue_cur->len && dst < len; i++)
+ for (i = 0; i < (s32)afl->queue_cur->len && dst < len; i++)
if (afl->taint_map[i]) in_buf[dst++] = afl->taint_src[i];
break;
@@ -2297,7 +2297,8 @@ havoc_stage:
}
copy_to = rand_below(afl, temp_len - copy_len + 1);
- if (unlikely(copy_to > temp_len)) copy_to = rand_below(afl, temp_len);
+ if (unlikely(copy_to > (u32)temp_len))
+ copy_to = rand_below(afl, temp_len);
if (rand_below(afl, 4)) {
@@ -2305,7 +2306,8 @@ havoc_stage:
if (unlikely(afl->taint_needs_splode)) {
- if (copy_to > temp_len) copy_to = rand_below(afl, temp_len);
+ if (copy_to > (u32)temp_len)
+ copy_to = rand_below(afl, temp_len);
// fprintf(stderr, "\nout_buf %p + copy_to %u, src %p + %u,
// copy_len %u -- len %u\n", out_buf , copy_to, afl->taint_src ,

MODIFY
src/afl-fuzz-queue.c
src/afl-fuzz-queue.c
@@ -108,7 +108,6 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
u8 * ptr, *fn = fname;
u32 bytes = 0, plen = len;
- s32 fd = -1;
struct queue_entry *prev = q->prev;
if (plen % 4) plen = plen + 4 - (len % 4);
@@ -170,7 +169,7 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
u8 *bufr = mmap(0, prev->len, PROT_READ, MAP_PRIVATE, r, 0);
- if ((size_t)bufr != -1) {
+ if ((ssize_t)bufr != -1) {
u32 i;
u8 *tmp = ck_maybe_grow(BUF_PARAMS(in_scratch), plen);

MODIFY
src/afl-fuzz-run.c
src/afl-fuzz-run.c
@@ -883,7 +883,7 @@ u8 common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
u8 *new_buf = ck_maybe_grow(BUF_PARAMS(in_scratch), new_len);
u32 i, taint = 0;
- for (i = 0; i < new_len; i++) {
+ for (i = 0; i < (u32)new_len; i++) {
if (i >= afl->taint_len || i >= afl->queue_cur->len || afl->taint_map[i])
new_buf[i] = out_buf[taint++];

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -1095,7 +1095,7 @@ int main(int argc, char **argv_orig, char **envp) {
if (map_size != real_map_size) {
afl->fsrv.map_size = real_map_size;
- if (afl->cmplog_binary) afl->cmplog_fsrv.map_size;
+ if (afl->cmplog_binary) afl->cmplog_fsrv.map_size = real_map_size;
}

cleanup minor issues