add AFL_EXIT_ON_SEED_ISSUES
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -24,6 +24,9 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
- ensure one fuzzer sync per cycle
- fix afl_custom_queue_new_entry original file name when syncing
from fuzzers
+ - added AFL_EXIT_ON_SEED_ISSUES env that will exit if a seed in
+ -i dir crashes the target or results in a timeout. By default
+ afl++ ignores these and uses them for splicing instead.
- afl-cc:
- Leak Sanitizer support (AFL_USE_LSAN) added by Joshua Rogers, thanks!
- Removed InsTrim instrumentation as it is not as good as PCGUARD

MODIFY
docs/env_variables.md
docs/env_variables.md
@@ -284,6 +284,9 @@ checks or alter some of the more exotic semantics of the tool:
normally indicated by the cycle counter in the UI turning green. May be
convenient for some types of automated jobs.
+ - `AFL_EXIT_ON_SEED_ISSUES` will restore the vanilla afl-fuzz behaviour
+ which does not allow crashes or timeout seeds in the initial -i corpus.
+
- `AFL_MAP_SIZE` sets the size of the shared map that afl-fuzz, afl-showmap,
afl-tmin and afl-analyze create to gather instrumentation data from
the target. This must be equal or larger than the size the target was

MODIFY
include/afl-fuzz.h
include/afl-fuzz.h
@@ -384,7 +384,8 @@ typedef struct afl_env_vars {
afl_dumb_forksrv, afl_import_first, afl_custom_mutator_only, afl_no_ui,
afl_force_ui, afl_i_dont_care_about_missing_crashes, afl_bench_just_one,
afl_bench_until_crash, afl_debug_child, afl_autoresume, afl_cal_fast,
- afl_cycle_schedules, afl_expand_havoc, afl_statsd, afl_cmplog_only_new;
+ afl_cycle_schedules, afl_expand_havoc, afl_statsd, afl_cmplog_only_new,
+ afl_exit_on_seed_issues;
u8 *afl_tmpdir, *afl_custom_mutator_library, *afl_python_module, *afl_path,
*afl_hang_tmout, *afl_forksrv_init_tmout, *afl_skip_crashes, *afl_preload,

MODIFY
include/envs.h
include/envs.h
@@ -49,6 +49,7 @@ static char *afl_environment_variables[] = {
"AFL_DUMB_FORKSRV",
"AFL_ENTRYPOINT",
"AFL_EXIT_WHEN_DONE",
+ "AFL_EXIT_ON_SEED_ISSUES",
"AFL_FAST_CAL",
"AFL_FORCE_UI",
"AFL_FRIDA_DEBUG_MAPS",

MODIFY
src/afl-fuzz-init.c
src/afl-fuzz-init.c
@@ -881,7 +881,7 @@ void perform_dry_run(afl_state_t *afl) {
case FSRV_RUN_TMOUT:
- if (afl->timeout_given) {
+ if (afl->timeout_given && !afl->afl_env.afl_exit_on_seed_issues) {
/* if we have a timeout but a timeout value was given then always
skip. The '+' meaning has been changed! */
@@ -1036,6 +1036,12 @@ void perform_dry_run(afl_state_t *afl) {
}
+ if (afl->afl_env.afl_exit_on_seed_issues) {
+
+ FATAL("As AFL_EXIT_ON_SEED_ISSUES is set, afl-fuzz exits.");
+
+ }
+
/* Remove from fuzzing queue but keep for splicing */
struct queue_entry *p = afl->queue;

MODIFY
src/afl-fuzz-state.c
src/afl-fuzz-state.c
@@ -306,6 +306,13 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
afl->cycle_schedules = afl->afl_env.afl_cycle_schedules =
get_afl_env(afl_environment_variables[i]) ? 1 : 0;
+ } else if (!strncmp(env, "AFL_EXIT_ON_SEED_ISSUES",
+
+ afl_environment_variable_len)) {
+
+ afl->afl_env.afl_exit_on_seed_issues =
+ get_afl_env(afl_environment_variables[i]) ? 1 : 0;
+
} else if (!strncmp(env, "AFL_EXPAND_HAVOC_NOW",
afl_environment_variable_len)) {

add AFL_EXIT_ON_SEED_ISSUES