more refactoring and update changelog
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -10,7 +10,16 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
### Version ++2.63d (development):
- - LTO mode now requires llvm11 - but compiles all targets! :)
+ - llvm_mode LTO mode:
+ - now requires llvm11 - but compiles all targets! :)
+ - autodictionary feature added, enable with AFL_LLVM_LTO_AUTODICTIONARY
+ - variable map size usage
+ - afl-fuzz:
+ - variable map size support added (only LTO mode can use this)
+ - snapshot feature usage now visible in UI
+ - extended forkserver: map_size and more information is communicated to
+ afl-fuzz (and afl-fuzz acts accordingly)
+ - more refactoring
- if AFL_CC/AFL_CXX is set but empty afl compilers did fail, fixed
(this bug is in vanilla afl too)

MODIFY
include/afl-fuzz.h
include/afl-fuzz.h
@@ -331,7 +331,8 @@ typedef struct afl_env_vars {
u8 afl_skip_cpufreq, afl_exit_when_done, afl_no_affinity, afl_skip_bin_check,
afl_dumb_forksrv, afl_import_first, afl_custom_mutator_only, afl_no_ui,
afl_force_ui, afl_i_dont_care_about_missing_crashes, afl_bench_just_one,
- afl_bench_until_crash, afl_debug_child_output, afl_autoresume;
+ afl_bench_until_crash, afl_debug_child_output, afl_autoresume,
+ afl_cal_fast;
u8 *afl_tmpdir, *afl_post_library, *afl_custom_mutator_library,
*afl_python_module, *afl_path, *afl_hang_tmout, *afl_skip_crashes,

MODIFY
include/cmplog.h
include/cmplog.h
@@ -79,6 +79,5 @@ struct cmp_map {
void cmplog_exec_child(afl_forkserver_t *fsrv, char **argv);
-
#endif

MODIFY
src/afl-forkserver.c
src/afl-forkserver.c
@@ -187,6 +187,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
FATAL("Different forkserver not compatible with fauxserver");
fsrv->init_child_func = afl_fauxsrv_execv;
+
}
if (pipe(st_pipe) || pipe(ctl_pipe)) PFATAL("pipe() failed");

MODIFY
src/afl-fuzz-cmplog.c
src/afl-fuzz-cmplog.c
#include "cmplog.h"
typedef struct cmplog_data {
+
} cmplog_data_t;
void cmplog_exec_child(afl_forkserver_t *fsrv, char **argv) {
@@ -38,479 +39,12 @@ void cmplog_exec_child(afl_forkserver_t *fsrv, char **argv) {
if (!fsrv->qemu_mode && argv[0] != fsrv->cmplog_binary) {
-#if 0
- afl->fsrv.child_timed_out = 0;
- afl->cmplog_fsrv_pid = fork();
-
- if (afl->cmplog_fsrv_pid < 0) PFATAL("fork() failed");
-
- if (!afl->cmplog_fsrv_pid) {
-
- /* CHILD PROCESS */
-
- struct rlimit r;
-
- /* Umpf. On OpenBSD, the default fd limit for root users is set to
- soft 128. Let's try to fix that... */
-
- if (!getrlimit(RLIMIT_NOFILE, &r) && r.rlim_cur < FORKSRV_FD + 2) {
-
- r.rlim_cur = FORKSRV_FD + 2;
- setrlimit(RLIMIT_NOFILE, &r); /* Ignore errors */
-
- }
-
- if (afl->fsrv.mem_limit) {
-
- r.rlim_max = r.rlim_cur = ((rlim_t)afl->fsrv.mem_limit) << 20;
-
-#ifdef RLIMIT_AS
- setrlimit(RLIMIT_AS, &r); /* Ignore errors */
-#else
- /* This takes care of OpenBSD, which doesn't have RLIMIT_AS, but
- according to reliable sources, RLIMIT_DATA covers anonymous
- maps - so we should be getting good protection against OOM bugs. */
-
- setrlimit(RLIMIT_DATA, &r); /* Ignore errors */
-#endif /* ^RLIMIT_AS */
-
- }
-
- /* Dumping cores is slow and can lead to anomalies if SIGKILL is delivered
- before the dump is complete. */
-
- // r.rlim_max = r.rlim_cur = 0;
- // setrlimit(RLIMIT_CORE, &r); /* Ignore errors */
-
- /* Isolate the process and configure standard descriptors. If
- afl->fsrv.out_file is specified, stdin is /dev/null; otherwise,
- afl->fsrv.out_fd is cloned instead. */
-
- setsid();
-
- if (!(afl->afl_env.afl_debug_child_output)) {
-
- dup2(afl->fsrv.dev_null_fd, 1);
- dup2(afl->fsrv.dev_null_fd, 2);
-
- }
-
- if (!afl->fsrv.use_stdin) {
-
- dup2(afl->fsrv.dev_null_fd, 0);
-
- } else {
-
- dup2(afl->fsrv.out_fd, 0);
- close(afl->fsrv.out_fd);
-
- }
-
- /* Set up control and status pipes, close the unneeded original fds. */
-
- if (dup2(ctl_pipe[0], FORKSRV_FD) < 0) PFATAL("dup2() failed");
- if (dup2(st_pipe[1], FORKSRV_FD + 1) < 0) PFATAL("dup2() failed");
-
- close(ctl_pipe[0]);
- close(ctl_pipe[1]);
- close(st_pipe[0]);
- close(st_pipe[1]);
-
- close(afl->fsrv.out_dir_fd);
- close(afl->fsrv.dev_null_fd);
-#ifndef HAVE_ARC4RANDOM
- close(afl->fsrv.dev_urandom_fd);
-#endif
- if (afl->fsrv.plot_file != NULL) fclose(afl->fsrv.plot_file);
-
- /* This should improve performance a bit, since it stops the linker from
- doing extra work post-fork(). */
-
- if (!getenv("LD_BIND_LAZY")) setenv("LD_BIND_NOW", "1", 0);
-
- /* Set sane defaults for ASAN if nothing else specified. */
-
- setenv("ASAN_OPTIONS",
- "abort_on_error=1:"
- "detect_leaks=0:"
- "malloc_context_size=0:"
- "symbolize=0:"
- "allocator_may_return_null=1",
- 0);
-
- /* MSAN is tricky, because it doesn't support abort_on_error=1 at this
- point. So, we do this in a very hacky way. */
-
- setenv("MSAN_OPTIONS",
- "exit_code=" STRINGIFY(MSAN_ERROR) ":"
- "symbolize=0:"
- "abort_on_error=1:"
- "malloc_context_size=0:"
- "allocator_may_return_null=1:"
- "msan_track_origins=0",
- 0);
-
- setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1);
-
- if (!afl->qemu_mode && afl->argv[0] != afl->cmplog_binary) {
-
- ck_free(afl->argv[0]);
- afl->argv[0] = afl->cmplog_binary;
-
- }
-
- execv(afl->argv[0], afl->argv);
-
- /* Use a distinctive bitmap signature to tell the parent about execv()
- falling through. */
-
- *(u32 *)afl->fsrv.trace_bits = EXEC_FAIL_SIG;
- exit(0);
-
- }
-
- /* PARENT PROCESS */
-
- /* Close the unneeded endpoints. */
-
- close(ctl_pipe[0]);
- close(st_pipe[1]);
-
- afl->cmplog_fsrv_ctl_fd = ctl_pipe[1];
- afl->cmplog_fsrv_st_fd = st_pipe[0];
-
- /* Wait for the fork server to come up, but don't wait too long. */
-
- rlen = 0;
- if (afl->fsrv.exec_tmout) {
-
- rlen = 4;
- u32 timeout_ms = afl->fsrv.exec_tmout * FORK_WAIT_MULT;
- /* Reuse readfds as exceptfds to see when the child closed the pipe */
- u32 exec_ms = read_timed(afl->cmplog_fsrv_st_fd, &status, rlen, timeout_ms,
- &afl->stop_soon);
-
- if (!exec_ms) {
-
- PFATAL("Error in timed read");
-
- } else if (exec_ms > timeout_ms) {
-
- afl->fsrv.child_timed_out = 1;
- kill(afl->cmplog_fsrv_pid, SIGKILL);
- rlen = read(afl->cmplog_fsrv_st_fd, &status, 4);
-
- }
-
- } else {
-
- rlen = read(afl->cmplog_fsrv_st_fd, &status, 4);
-
- }
-
- /* If we have a four-byte "hello" message from the server, we're all set.
- Otherwise, try to figure out what went wrong. */
-
- if (afl->fsrv.child_timed_out)
- FATAL(
- "Timeout while initializing cmplog fork server (adjusting -t may "
- "help)");
-
- if (rlen == 4) {
-
- OKF("All right - fork server is up.");
- return;
-
- }
-
- if (waitpid(afl->cmplog_fsrv_pid, &status, 0) <= 0)
- PFATAL("waitpid() failed");
-
- if (WIFSIGNALED(status)) {
-
- if (afl->fsrv.mem_limit && afl->fsrv.mem_limit < 500 &&
- afl->fsrv.uses_asan) {
-
- SAYF("\n" cLRD "[-] " cRST
- "Whoops, the target binary crashed suddenly, "
- "before receiving any input\n"
- " from the fuzzer! Since it seems to be built with ASAN and you "
- "have a\n"
- " restrictive memory limit configured, this is expected; please "
- "read\n"
- " %s/notes_for_asan.md for help.\n",
- doc_path);
-
- } else if (!afl->fsrv.mem_limit) {
-
- SAYF("\n" cLRD "[-] " cRST
- "Whoops, the target binary crashed suddenly, "
- "before receiving any input\n"
- " from the fuzzer! There are several probable explanations:\n\n"
-
- " - The binary is just buggy and explodes entirely on its own. "
- "If so, you\n"
- " need to fix the underlying problem or find a better "
- "replacement.\n\n"
-
- MSG_FORK_ON_APPLE
-
- " - Less likely, there is a horrible bug in the fuzzer. If other "
- "options\n"
- " fail, poke <afl-users@googlegroups.com> for troubleshooting "
- "tips.\n");
-
- } else {
-
- u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
-
- SAYF("\n" cLRD "[-] " cRST
- "Whoops, the target binary crashed suddenly, "
- "before receiving any input\n"
- " from the fuzzer! There are several probable explanations:\n\n"
-
- " - The current memory limit (%s) is too restrictive, causing "
- "the\n"
- " target to hit an OOM condition in the dynamic linker. Try "
- "bumping up\n"
- " the limit with the -m setting in the command line. A simple "
- "way confirm\n"
- " this diagnosis would be:\n\n"
-
- MSG_ULIMIT_USAGE
- " /path/to/fuzzed_app )\n\n"
-
- " Tip: you can use http://jwilk.net/software/recidivm to "
- "quickly\n"
- " estimate the required amount of virtual memory for the "
- "binary.\n\n"
-
- " - The binary is just buggy and explodes entirely on its own. "
- "If so, you\n"
- " need to fix the underlying problem or find a better "
- "replacement.\n\n"
-
- MSG_FORK_ON_APPLE
-
- " - Less likely, there is a horrible bug in the fuzzer. If other "
- "options\n"
- " fail, poke <afl-users@googlegroups.com> for troubleshooting "
- "tips.\n",
- stringify_mem_size(val_buf, sizeof(val_buf),
- afl->fsrv.mem_limit << 20),
- afl->fsrv.mem_limit - 1);
-
- }
-
- FATAL("Cmplog fork server crashed with signal %d", WTERMSIG(status));
-
- }
-
- if (*(u32 *)afl->fsrv.trace_bits == EXEC_FAIL_SIG)
- FATAL("Unable to execute target application ('%s')", afl->argv[0]);
-
- if (afl->fsrv.mem_limit && afl->fsrv.mem_limit < 500 && afl->fsrv.uses_asan) {
-
- SAYF("\n" cLRD "[-] " cRST
- "Hmm, looks like the target binary terminated "
- "before we could complete a\n"
- " handshake with the injected code. Since it seems to be built "
- "with ASAN and\n"
- " you have a restrictive memory limit configured, this is "
- "expected; please\n"
- " read %s/notes_for_asan.md for help.\n",
- doc_path);
-
- } else if (!afl->fsrv.mem_limit) {
-
- SAYF("\n" cLRD "[-] " cRST
- "Hmm, looks like the target binary terminated "
- "before we could complete a\n"
- " handshake with the injected code. Perhaps there is a horrible "
- "bug in the\n"
- " fuzzer. Poke <afl-users@googlegroups.com> for troubleshooting "
- "tips.\n");
-
- } else {
-
- u8 val_buf[STRINGIFY_VAL_SIZE_MAX];
-
- SAYF(
- "\n" cLRD "[-] " cRST
- "Hmm, looks like the target binary terminated "
- "before we could complete a\n"
- " handshake with the injected code. There are %s probable "
- "explanations:\n\n"
-
- "%s"
- " - The current memory limit (%s) is too restrictive, causing an "
- "OOM\n"
- " fault in the dynamic linker. This can be fixed with the -m "
- "option. A\n"
- " simple way to confirm the diagnosis may be:\n\n"
-
- MSG_ULIMIT_USAGE
- " /path/to/fuzzed_app )\n\n"
-
- " Tip: you can use http://jwilk.net/software/recidivm to quickly\n"
- " estimate the required amount of virtual memory for the "
- "binary.\n\n"
-
- " - Less likely, there is a horrible bug in the fuzzer. If other "
- "options\n"
- " fail, poke <afl-users@googlegroups.com> for troubleshooting "
- "tips.\n",
- getenv(DEFER_ENV_VAR) ? "three" : "two",
- getenv(DEFER_ENV_VAR)
- ? " - You are using deferred forkserver, but __AFL_INIT() is "
- "never\n"
- " reached before the program terminates.\n\n"
- : "",
- stringify_mem_size(val_buf, sizeof(val_buf), afl->fsrv.mem_limit << 20),
- afl->fsrv.mem_limit - 1);
-
- }
-
- FATAL("Cmplog fork server handshake failed");
-
-}
-
-u8 run_cmplog_target(afl_state_t *afl, u32 timeout) {
-
- int status = 0;
- u32 exec_ms;
-
- u32 tb4;
- s32 res;
-
- afl->fsrv.child_timed_out = 0;
-
- /* After this memset, afl->fsrv.trace_bits[] are effectively volatile, so we
- must prevent any earlier operations from venturing into that
- territory. */
-
- memset(afl->fsrv.trace_bits, 0, afl->fsrv.map_size);
- MEM_BARRIER();
-
- /* Since we always have a forkserver (or a fauxserver) running, we can simply
- tell them to have at it and read back the pid from it.*/
-
- if ((res = write(afl->cmplog_fsrv_ctl_fd, &afl->cmplog_prev_timed_out, 4)) !=
- 4) {
-
- if (afl->stop_soon) return 0;
- RPFATAL(res,
- "Unable to request new process from cmplog fork server (OOM?)");
-
- }
-
- if ((res = read(afl->cmplog_fsrv_st_fd, &afl->cmplog_child_pid, 4)) != 4) {
-
- if (afl->stop_soon) return 0;
- RPFATAL(res,
- "Unable to request new process from cmplog fork server (OOM?)");
-
- }
-
- if (afl->cmplog_child_pid <= 0)
- FATAL("Cmplog fork server is misbehaving (OOM?)");
-
- /* Configure timeout, as requested by user, then wait for child to terminate.
- */
- exec_ms =
- read_timed(afl->cmplog_fsrv_st_fd, &status, 4, timeout, &afl->stop_soon);
-
- if (exec_ms > timeout) {
-
- /* If there was no response from forkserver after timeout seconds,
- we kill the child. The forkserver should inform us afterwards */
-
- kill(afl->cmplog_child_pid, SIGKILL);
- afl->fsrv.child_timed_out = 1;
-
- /* After killing the child, the forkserver should tell us */
- if (!read(afl->cmplog_fsrv_st_fd, &status, 4)) exec_ms = 0;
-
- }
-
- if (!exec_ms) { // Something went wrong.
-
- if (afl->stop_soon) return 0;
- SAYF("\n" cLRD "[-] " cRST
- "Unable to communicate with fork server. Some possible reasons:\n\n"
- " - You've run out of memory. Use -m to increase the the memory "
- "limit\n"
- " to something higher than %lld.\n"
- " - The binary or one of the libraries it uses manages to create\n"
- " threads before the forkserver initializes.\n"
- " - The binary, at least in some circumstances, exits in a way "
- "that\n"
- " also kills the parent process - raise() could be the "
- "culprit.\n\n"
- "If all else fails you can disable the fork server via "
- "AFL_NO_FORKSRV=1.\n",
- afl->fsrv.mem_limit);
- RPFATAL(res, "Unable to communicate with fork server");
-
- }
-
- if (!WIFSTOPPED(status)) afl->cmplog_child_pid = 0;
-
- if (afl->slowest_exec_ms < exec_ms) afl->slowest_exec_ms = exec_ms;
-
- ++afl->total_execs;
-
- /* Any subsequent operations on afl->fsrv.trace_bits must not be moved by the
- compiler below this point. Past this location, afl->fsrv.trace_bits[]
- behave very normally and do not have to be treated as volatile. */
-
- MEM_BARRIER();
-
- tb4 = *(u32 *)afl->fsrv.trace_bits;
-
-#ifdef WORD_SIZE_64
- classify_counts(afl, (u64 *)afl->fsrv.trace_bits);
-#else
- classify_counts(afl, (u32 *)afl->fsrv.trace_bits);
-#endif /* ^WORD_SIZE_64 */
-
- afl->cmplog_prev_timed_out = afl->fsrv.child_timed_out;
-
- /* Report outcome to caller. */
-
- if (WIFSIGNALED(status) && !afl->stop_soon) {
-
- afl->kill_signal = WTERMSIG(status);
-
- if (afl->fsrv.child_timed_out && afl->kill_signal == SIGKILL)
- return FAULT_TMOUT;
-
- return FAULT_CRASH;
-
- }
-
- /* A somewhat nasty hack for MSAN, which doesn't support abort_on_error and
- must use a special exit code. */
-
- if (afl->fsrv.uses_asan && WEXITSTATUS(status) == MSAN_ERROR) {
-
- afl->kill_signal = 0;
- return FAULT_CRASH;
-
- }
-
- if ((afl->dumb_mode == 1 || afl->no_forkserver) && tb4 == EXEC_FAIL_SIG)
- return FAULT_ERROR;
-
- return FAULT_NONE;
-#else
ck_free(argv[0]);
argv[0] = fsrv->cmplog_binary;
}
execv(argv[0], argv);
-#endif
}
@@ -571,3 +105,4 @@ u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
return 0;
}
+

MODIFY
src/afl-fuzz-mutators.c
src/afl-fuzz-mutators.c
@@ -34,7 +34,7 @@ void load_custom_mutator_py(afl_state_t *, char *);
void setup_custom_mutator(afl_state_t *afl) {
/* Try mutator library first */
- u8 *fn = getenv("AFL_CUSTOM_MUTATOR_LIBRARY");
+ u8 *fn = afl->afl_env.afl_custom_mutator_library;
if (fn) {
@@ -52,7 +52,7 @@ void setup_custom_mutator(afl_state_t *afl) {
/* Try Python module */
#ifdef USE_PYTHON
- u8 *module_name = getenv("AFL_PYTHON_MODULE");
+ u8 *module_name = afl->afl_env.afl_python_module;
if (module_name) {
@@ -67,7 +67,7 @@ void setup_custom_mutator(afl_state_t *afl) {
}
#else
- if (getenv("AFL_PYTHON_MODULE"))
+ if (afl->afl_env.afl_python_module)
FATAL("Your AFL binary was built without Python support");
#endif

MODIFY
src/afl-fuzz-run.c
src/afl-fuzz-run.c
@@ -69,8 +69,7 @@ u8 run_target(afl_state_t *afl, afl_forkserver_t *fsrv, u32 timeout) {
if (fsrv->child_pid <= 0) FATAL("Fork server is misbehaving (OOM?)");
- exec_ms =
- read_timed(fsrv->fsrv_st_fd, &status, 4, timeout, &afl->stop_soon);
+ exec_ms = read_timed(fsrv->fsrv_st_fd, &status, 4, timeout, &afl->stop_soon);
if (exec_ms > timeout) {
@@ -312,10 +311,17 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
count its spin-up time toward binary calibration. */
if (!afl->fsrv.fsrv_pid) {
- if (afl->shm.cmplog_mode && afl->fsrv.init_child_func != cmplog_exec_child) {
+
+ if (afl->shm.cmplog_mode &&
+ afl->fsrv.init_child_func != cmplog_exec_child) {
+
FATAL("BUG in afl-fuzz detected. Cmplog mode not set correctly.");
+
}
- afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child_output);
+
+ afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
+ afl->afl_env.afl_debug_child_output);
+
}
if (q->exec_cksum)

MODIFY
src/afl-fuzz-state.c
src/afl-fuzz-state.c
@@ -284,6 +284,13 @@ void read_afl_environment(afl_state_t *afl, char **envp) {
afl->afl_env.afl_autoresume =
get_afl_env(afl_environment_variables[i]) ? 1 : 0;
+ } else if (!strncmp(env, "AFL_CAL_FAST",
+
+ afl_environment_variable_len)) {
+
+ afl->afl_env.afl_cal_fast =
+ get_afl_env(afl_environment_variables[i]) ? 1 : 0;
+
} else if (!strncmp(env, "AFL_TMPDIR",
afl_environment_variable_len)) {

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -248,6 +248,7 @@ int main(int argc, char **argv_orig, char **envp) {
afl_state_init(afl);
afl_fsrv_init(&afl->fsrv);
+ if (get_afl_env("AFL_DEBUG")) afl->debug = 1;
read_afl_environment(afl, envp);
exit_1 = !!afl->afl_env.afl_bench_just_one;
@@ -690,7 +691,7 @@ int main(int argc, char **argv_orig, char **envp) {
OKF("MOpt Mutator from github.com/puppet-meteor/MOpt-AFL");
if (afl->sync_id && afl->force_deterministic &&
- getenv("AFL_CUSTOM_MUTATOR_ONLY"))
+ afl->afl_env.afl_custom_mutator_only)
WARNF(
"Using -M master with the AFL_CUSTOM_MUTATOR_ONLY mutator options will "
"result in no deterministic mutations being done!");
@@ -865,7 +866,7 @@ int main(int argc, char **argv_orig, char **envp) {
check_if_tty(afl);
if (afl->afl_env.afl_force_ui) afl->not_on_tty = 0;
- if (get_afl_env("AFL_CAL_FAST")) {
+ if (afl->afl_env.afl_cal_fast) {
/* Use less calibration cycles, for slow applications */
afl->cal_cycles = 3;
@@ -873,8 +874,6 @@ int main(int argc, char **argv_orig, char **envp) {
}
- if (get_afl_env("AFL_DEBUG")) afl->debug = 1;
-
if (afl->afl_env.afl_custom_mutator_only) {
/* This ensures we don't proceed to havoc/splice */
@@ -1024,7 +1023,8 @@ int main(int argc, char **argv_orig, char **envp) {
SAYF("Spawning cmplog forkserver");
memcpy(&afl->cmplog_fsrv, &afl->fsrv, sizeof(afl->fsrv));
afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
- afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child_output);
+ afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
+ afl->afl_env.afl_debug_child_output);
}

MODIFY
src/afl-showmap.c
src/afl-showmap.c
@@ -949,7 +949,8 @@ int main(int argc, char **argv_orig, char **envp) {
}
- afl_fsrv_start(fsrv, use_argv, &stop_soon, get_afl_env("AFL_DEBUG_CHILD_OUTPUT")? 1 :0);
+ afl_fsrv_start(fsrv, use_argv, &stop_soon,
+ get_afl_env("AFL_DEBUG_CHILD_OUTPUT") ? 1 : 0);
while (done == 0 && (dir_ent = readdir(dir_in))) {

MODIFY
src/afl-tmin.c
src/afl-tmin.c
@@ -1131,7 +1131,8 @@ int main(int argc, char **argv_orig, char **envp) {
read_initial_file();
- afl_fsrv_start(fsrv, use_argv, &stop_soon, get_afl_env("AFL_DEBUG_CHILD_OUTPUT")? 1 :0);
+ afl_fsrv_start(fsrv, use_argv, &stop_soon,
+ get_afl_env("AFL_DEBUG_CHILD_OUTPUT") ? 1 : 0);
ACTF("Performing dry run (mem limit = %llu MB, timeout = %u ms%s)...",
fsrv->mem_limit, fsrv->exec_tmout, edges_only ? ", edges only" : "");

more refactoring and update changelog