fixed gcc analyzer warnings
MODIFY
include/alloc-inl.h
include/alloc-inl.h
@@ -94,7 +94,8 @@ static inline void *DFL_ck_alloc_nozero(u32 size) {
}
-/* Allocate a buffer, returning zeroed memory. */
+/* Allocate a buffer, returning zeroed memory.
+ Returns null for 0 size */
static inline void *DFL_ck_alloc(u32 size) {

MODIFY
src/afl-as.c
src/afl-as.c
@@ -131,6 +131,11 @@ static void edit_params(int argc, char **argv) {
if (!tmp_dir) { tmp_dir = "/tmp"; }
as_params = ck_alloc((argc + 32) * sizeof(u8 *));
+ if (unlikely((argc + 32) < argc || !as_params)) {
+
+ FATAL("Too many parameters passed to as");
+
+ }
as_params[0] = afl_as ? afl_as : (u8 *)"as";

MODIFY
src/afl-common.c
src/afl-common.c
@@ -108,6 +108,7 @@ char **argv_cpy_dup(int argc, char **argv) {
int i = 0;
char **ret = ck_alloc((argc + 1) * sizeof(char *));
+ if (unlikely(!ret)) { FATAL("Amount of arguments specified is too high"); }
for (i = 0; i < argc; i++) {
@@ -130,6 +131,7 @@ void argv_cpy_free(char **argv) {
while (argv[i]) {
ck_free(argv[i]);
+ argv[i] = NULL;
i++;
}
@@ -142,9 +144,13 @@ void argv_cpy_free(char **argv) {
char **get_qemu_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
- char **new_argv = ck_alloc(sizeof(char *) * (argc + 4));
+ if (!unlikely(own_loc)) { FATAL("BUG: param own_loc is NULL"); }
+
u8 *tmp, *cp = NULL, *rsl, *own_copy;
+ char **new_argv = ck_alloc(sizeof(char *) * (argc + 4));
+ if (unlikely(!new_argv)) { FATAL("Illegal amount of arguments specified"); }
+
memcpy(&new_argv[3], &argv[1], (int)(sizeof(char *)) * (argc - 1));
new_argv[argc + 3] = NULL;
@@ -224,9 +230,13 @@ char **get_qemu_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
char **get_wine_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
- char **new_argv = ck_alloc(sizeof(char *) * (argc + 3));
+ if (!unlikely(own_loc)) { FATAL("BUG: param own_loc is NULL"); }
+
u8 *tmp, *cp = NULL, *rsl, *own_copy;
+ char **new_argv = ck_alloc(sizeof(char *) * (argc + 3));
+ if (unlikely(!new_argv)) { FATAL("Illegal amount of arguments specified"); }
+
memcpy(&new_argv[2], &argv[1], (int)(sizeof(char *)) * (argc - 1));
new_argv[argc + 2] = NULL;
@@ -335,6 +345,8 @@ u8 *find_binary(u8 *fname) {
struct stat st;
+ if (unlikely(!fname)) { FATAL("No binary supplied"); }
+
if (strchr(fname, '/') || !(env_path = getenv("PATH"))) {
target_path = ck_strdup(fname);
@@ -356,6 +368,14 @@ u8 *find_binary(u8 *fname) {
if (delim) {
cur_elem = ck_alloc(delim - env_path + 1);
+ if (unlikely(!cur_elem)) {
+
+ FATAL(
+ "Unexpected overflow when processing ENV. This should never "
+ "happend.");
+
+ }
+
memcpy(cur_elem, env_path, delim - env_path);
delim++;

MODIFY
src/afl-fuzz-init.c
src/afl-fuzz-init.c
@@ -772,10 +772,17 @@ void perform_dry_run(afl_state_t *afl) {
while (q) {
- u8 *use_mem;
+ u8 use_mem[MAX_FILE];
u8 res;
s32 fd;
+ if (unlikely(!q->len)) {
+
+ WARNF("Skipping 0-sized entry in queue (%s)", q->fname);
+ continue;
+
+ }
+
u8 *fn = strrchr(q->fname, '/') + 1;
ACTF("Attempting dry run with '%s'...", fn);
@@ -783,9 +790,8 @@ void perform_dry_run(afl_state_t *afl) {
fd = open(q->fname, O_RDONLY);
if (fd < 0) { PFATAL("Unable to open '%s'", q->fname); }
- use_mem = ck_alloc_nozero(q->len);
-
- if (read(fd, use_mem, q->len) != (ssize_t)q->len) {
+ u32 read_len = MIN(q->len, (u32)MAX_FILE);
+ if (read(fd, use_mem, read_len) != (ssize_t)read_len) {
FATAL("Short read from '%s'", q->fname);
@@ -794,7 +800,6 @@ void perform_dry_run(afl_state_t *afl) {
close(fd);
res = calibrate_case(afl, q, use_mem, 0, 1);
- ck_free(use_mem);
if (afl->stop_soon) { return; }
@@ -2449,6 +2454,8 @@ void setup_testcase_shmem(afl_state_t *afl) {
void check_binary(afl_state_t *afl, u8 *fname) {
+ if (unlikely(!fname)) { FATAL("BUG: Binary name is NULL"); }
+
u8 * env_path = 0;
struct stat st;
@@ -2477,6 +2484,7 @@ void check_binary(afl_state_t *afl, u8 *fname) {
if (delim) {
cur_elem = ck_alloc(delim - env_path + 1);
+ if (unlikely(!cur_elem)) { FATAL("Unexpected large PATH"); }
memcpy(cur_elem, env_path, delim - env_path);
++delim;

MODIFY
src/afl-fuzz-run.c
src/afl-fuzz-run.c
@@ -94,9 +94,9 @@ write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
if (unlikely(afl->custom_mutators_count)) {
- u8 * new_buf = NULL;
ssize_t new_size = len;
- void * new_mem = mem;
+ u8 * new_mem = mem;
+ u8 * new_buf = NULL;
LIST_FOREACH(&afl->custom_mutator_list, struct custom_mutator, {
@@ -152,13 +152,13 @@ static void write_with_gap(afl_state_t *afl, u8 *mem, u32 len, u32 skip_at,
if (unlikely(!mem_trimmed)) { PFATAL("alloc"); }
ssize_t new_size = len - skip_len;
- void * new_mem = mem;
- u8 * new_buf = NULL;
+ u8 * new_mem = mem;
bool post_process_skipped = true;
if (unlikely(afl->custom_mutators_count)) {
+ u8 *new_buf = NULL;
new_mem = mem_trimmed;
LIST_FOREACH(&afl->custom_mutator_list, struct custom_mutator, {
@@ -207,7 +207,7 @@ static void write_with_gap(afl_state_t *afl, u8 *mem, u32 len, u32 skip_at,
// If we did post_processing, copy directly from the new_buf bufer
- memcpy(afl->fsrv.shmem_fuzz, new_buf, new_size);
+ memcpy(afl->fsrv.shmem_fuzz, new_mem, new_size);
}
@@ -265,7 +265,7 @@ static void write_with_gap(afl_state_t *afl, u8 *mem, u32 len, u32 skip_at,
if (!post_process_skipped) {
- ck_write(fd, new_buf, new_size, afl->fsrv.out_file);
+ ck_write(fd, new_mem, new_size, afl->fsrv.out_file);
} else {

fixed gcc analyzer warnings