llvm bug workaround for lto extint
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -49,6 +49,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
CLANG for old afl-clang
- fixed a potential crash in the LAF feature
- workaround for llvm 13
+ - workaround for llvm internal lto bug that lets not bitcast from _ExtInt()
- qemuafl
- QASan (address sanitizer for Qemu) ported to qemuafl!
See qemu_mode/libqasan/README.md

MODIFY
include/envs.h
include/envs.h
@@ -16,6 +16,7 @@ static char *afl_environment_deprecated[] = {
static char *afl_environment_variables[] = {
+ "_AFL_LTO_COMPILE",
"AFL_ALIGNED_ALLOC",
"AFL_ALLOW_TMP",
"AFL_ANALYZE_HEX",

MODIFY
instrumentation/cmplog-instructions-pass.cc
instrumentation/cmplog-instructions-pass.cc
@@ -113,6 +113,8 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
IntegerType *Int64Ty = IntegerType::getInt64Ty(C);
IntegerType *Int128Ty = IntegerType::getInt128Ty(C);
+ char *is_lto = getenv("_AFL_LTO_COMPILE");
+
#if LLVM_VERSION_MAJOR < 9
Constant *
#else
@@ -265,10 +267,20 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
unsigned int max_size = Val->getType()->getIntegerBitWidth(), cast_size;
unsigned char do_cast = 0;
- if (!SI->getNumCases() || max_size < 16 || max_size % 8) {
+ if (!SI->getNumCases() || max_size < 16) { continue; }
+
+ if (max_size % 8) {
+
+ if (is_lto) {
+
+ continue; // LTO cannot bitcast from _ExtInt() :(
+
+ } else {
- // if (!be_quiet) errs() << "skip trivial switch..\n";
- continue;
+ max_size = (((max_size / 8) + 1) * 8);
+ do_cast = 1;
+
+ }
}
@@ -285,6 +297,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
}
+ if (is_lto) { continue; } // LTO cannot bitcast _ExtInt() :(
max_size = 128;
do_cast = 1;
@@ -301,6 +314,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
cast_size = max_size;
break;
default:
+ if (is_lto) { continue; } // LTO cannot bitcast _ExtInt() :(
cast_size = 128;
do_cast = 1;
@@ -540,7 +554,22 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
}
- if (!max_size || max_size % 8 || max_size < 16) { continue; }
+ if (!max_size || max_size < 16) { continue; }
+
+ if (max_size % 8) {
+
+ if (is_lto) {
+
+ continue; // LTO cannot bitcast from _ExtInt() :(
+
+ } else {
+
+ max_size = (((max_size / 8) + 1) * 8);
+ do_cast = 1;
+
+ }
+
+ }
if (max_size > 128) {
@@ -552,6 +581,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
}
+ if (is_lto) { continue; } // LTO cannot bitcast from _ExtInt() :(
max_size = 128;
do_cast = 1;
@@ -568,6 +598,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
cast_size = max_size;
break;
default:
+ if (is_lto) { continue; } // LTO cannot bitcast from _ExtInt() :(
cast_size = 128;
do_cast = 1;

MODIFY
qemu_mode/libqasan/dlmalloc.c
qemu_mode/libqasan/dlmalloc.c
@@ -3917,6 +3917,7 @@ static void internal_malloc_stats(mstate m) {
\
} else if (RTCHECK(B == smallbin_at(M, I) || \
\
+ \
(ok_address(M, B) && B->fd == P))) { \
\
F->bk = B; \
@@ -4128,6 +4129,7 @@ static void internal_malloc_stats(mstate m) {
\
} else \
\
+ \
CORRUPTION_ERROR_ACTION(M); \
if (R != 0) { \
\
@@ -4144,6 +4146,7 @@ static void internal_malloc_stats(mstate m) {
\
} else \
\
+ \
CORRUPTION_ERROR_ACTION(M); \
\
} \
@@ -4156,12 +4159,14 @@ static void internal_malloc_stats(mstate m) {
\
} else \
\
+ \
CORRUPTION_ERROR_ACTION(M); \
\
} \
\
} else \
\
+ \
CORRUPTION_ERROR_ACTION(M); \
\
} \

MODIFY
src/afl-cc.c
src/afl-cc.c
@@ -1875,6 +1875,8 @@ int main(int argc, char **argv, char **envp) {
edit_params(argc, argv, envp);
+ if (lto_mode) { setenv("_AFL_LTO_COMPILE", "1", 1); }
+
if (debug) {
DEBUGF("cd '%s';", getthecwd());

MODIFY
src/afl-fuzz-redqueen.c
src/afl-fuzz-redqueen.c
@@ -1533,6 +1533,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
is_n = 1;
}
+
#endif
for (i = 0; i < loggeds; ++i) {

llvm bug workaround for lto extint