mini improvements
MODIFY
TODO.md
TODO.md
- afl-plot to support multiple plot_data
- afl_custom_fuzz_splice_optin()
- intel-pt tracer
+ - own sancov for llvm 12
## Further down the road

MODIFY
src/afl-fuzz-one.c
src/afl-fuzz-one.c
@@ -2540,7 +2540,7 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
#else
- if (afl->pending_favored) {
+ if (likely(afl->pending_favored)) {
/* If we have any favored, non-fuzzed new arrivals in the queue,
possibly skip to them at the expense of already-fuzzed or non-favored

MODIFY
src/afl-fuzz-queue.c
src/afl-fuzz-queue.c
@@ -179,9 +179,9 @@ void mark_as_variable(afl_state_t *afl, struct queue_entry *q) {
void mark_as_redundant(afl_state_t *afl, struct queue_entry *q, u8 state) {
- u8 fn[PATH_MAX];
+ if (likely(state == q->fs_redundant)) { return; }
- if (state == q->fs_redundant) { return; }
+ u8 fn[PATH_MAX];
q->fs_redundant = state;
@@ -521,13 +521,13 @@ void update_bitmap_score(afl_state_t *afl, struct queue_entry *q) {
void cull_queue(afl_state_t *afl) {
+ if (likely(!afl->score_changed || afl->non_instrumented_mode)) { return; }
+
struct queue_entry *q;
u32 len = (afl->fsrv.map_size >> 3);
u32 i;
u8 * temp_v = afl->map_tmp_buf;
- if (afl->non_instrumented_mode || !afl->score_changed) { return; }
-
afl->score_changed = 0;
memset(temp_v, 255, len);

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -1378,11 +1378,10 @@ int main(int argc, char **argv_orig, char **envp) {
u32 runs_in_current_cycle = (u32)-1;
u32 prev_queued_paths = 0;
-
- while (1) {
-
u8 skipped_fuzz;
+ while (likely(!afl->stop_soon)) {
+
cull_queue(afl);
if (unlikely((!afl->old_seed_selection &&
@@ -1418,8 +1417,8 @@ int main(int argc, char **argv_orig, char **envp) {
/* If we had a full queue cycle with no new finds, try
recombination strategies next. */
- if (afl->queued_paths == prev_queued &&
- (get_cur_time() - afl->start_time) >= 3600) {
+ if (unlikely(afl->queued_paths == prev_queued &&
+ (get_cur_time() - afl->start_time) >= 3600)) {
if (afl->use_splicing) {
@@ -1534,9 +1533,12 @@ int main(int argc, char **argv_orig, char **envp) {
}
+ ++runs_in_current_cycle;
+
+ do {
+
if (likely(!afl->old_seed_selection)) {
- ++runs_in_current_cycle;
if (unlikely(prev_queued_paths < afl->queued_paths)) {
// we have new queue entries since the last run, recreate alias table
@@ -1552,28 +1554,28 @@ int main(int argc, char **argv_orig, char **envp) {
skipped_fuzz = fuzz_one(afl);
- if (!skipped_fuzz && !afl->stop_soon && afl->sync_id) {
+ if (unlikely(!afl->stop_soon && exit_1)) { afl->stop_soon = 2; }
- if (unlikely(afl->is_main_node)) {
+ if (unlikely(afl->old_seed_selection)) {
- if (!(sync_interval_cnt++ % (SYNC_INTERVAL / 3))) { sync_fuzzers(afl); }
+ afl->queue_cur = afl->queue_cur->next;
+ ++afl->current_entry;
- } else {
+ }
- if (!(sync_interval_cnt++ % SYNC_INTERVAL)) { sync_fuzzers(afl); }
+ } while (skipped_fuzz && afl->queue_cur && !afl->stop_soon);
- }
+ if (!afl->stop_soon && afl->sync_id) {
- }
+ if (unlikely(afl->is_main_node)) {
- if (!afl->stop_soon && exit_1) { afl->stop_soon = 2; }
+ if (!(sync_interval_cnt++ % (SYNC_INTERVAL / 3))) { sync_fuzzers(afl); }
- if (afl->stop_soon) { break; }
+ } else {
- if (unlikely(afl->old_seed_selection)) {
+ if (!(sync_interval_cnt++ % SYNC_INTERVAL)) { sync_fuzzers(afl); }
- afl->queue_cur = afl->queue_cur->next;
- ++afl->current_entry;
+ }
}

MODIFY
src/afl-showmap.c
src/afl-showmap.c
@@ -209,8 +209,8 @@ static u32 write_results_to_file(afl_forkserver_t *fsrv, u8 *outfile) {
if (!outfile) { FATAL("Output filename not set (Bug in AFL++?)"); }
- if (cmin_mode && (fsrv->last_run_timed_out
- || (!caa && child_crashed != cco))) {
+ if (cmin_mode &&
+ (fsrv->last_run_timed_out || (!caa && child_crashed != cco))) {
return ret;
@@ -298,7 +298,8 @@ static void showmap_run_target_forkserver(afl_forkserver_t *fsrv, u8 *mem,
if (!quiet_mode) { SAYF(cRST "-- Program output ends --\n"); }
- if (!fsrv->last_run_timed_out && !stop_soon && WIFSIGNALED(fsrv->child_status)) {
+ if (!fsrv->last_run_timed_out && !stop_soon &&
+ WIFSIGNALED(fsrv->child_status)) {
child_crashed = 1;
@@ -1202,6 +1203,7 @@ int main(int argc, char **argv_orig, char **envp) {
ret = child_crashed * 2 + fsrv->last_run_timed_out;
}
+
if (fsrv->target_path) { ck_free(fsrv->target_path); }
afl_fsrv_deinit(fsrv);

mini improvements