afl-fuzz.c
void start_forkserver(s32 *fork_PID, s32 *fsrv_ctlFD, s32 *fsrv_stFD, s32 FSRV_FD, char **fsrv_argv) {

  int st_pipe[2], ctl_pipe[2];
  int status;

  /* Open control and status pipes and verify their success. */

  if (pipe(st_pipe) == -1 || pipe(ctl_pipe) == -1)
    PFATAL("pipe() failed for file '%s'", fsrv_argv[0]);

  /* Fork off (the forkserver) and check success. */

  *fork_PID = fork();
  if (*fork_PID < 0) 
    PFATAL("fork() failed for file '%s'", fsrv_argv[0]);

  /* Enter child (forkserver). */

  if (*fork_PID == 0) {

    /* Isolate process. Configure STDOUT/STDERR since we 
     * don't care about those. */

    setsid();
    dup2(dev_null_fd, 1); 
    dup2(dev_null_fd, 2); 

    /* If testcase path is specified, stdin is /dev/null; 
     * otherwise, testcase FD is cloned instead. */

    if (out_file) {
      dup2(dev_null_fd, 0);
    } 
    else {
      dup2(out_fd, 0);
      close(out_fd);
    }

    /* Set up control and status pipes, close the unneeded original fds. */

    if (dup2(ctl_pipe[0], FSRV_FD) < 0)
      PFATAL("dup2() failed for file '%s'", fsrv_argv[0]);

    if (dup2(st_pipe[1], FSRV_FD + 1) < 0)
      PFATAL("dup2() failed for file '%s'", fsrv_argv[0]);

    close(ctl_pipe[0]);
    close(ctl_pipe[1]);
    close(st_pipe[0]);
    close(st_pipe[1]);
    close(dev_null_fd);

    /* This should improve performance a bit, since it 
     * stops the linker from doing extra work post-fork(). */

    if (!getenv("LD_BIND_LAZY")) 
      setenv("LD_BIND_NOW", "1", 0);

    if (execv(fsrv_argv[0], fsrv_argv) < 0)
      PFATAL("execv() failed for file '%s'", fsrv_argv[0]);
      
    exit(0);  
  }
  
  else {
    /* Close the unneeded endpoints. */

    close(ctl_pipe[0]);
    close(st_pipe[1]);
    
    *fsrv_ctlFD = ctl_pipe[1];
    *fsrv_stFD = st_pipe[0];

    /* Read initialization message (hopefully 4 bytes!) 
     * We use a counter to check forkserver stalling. */

    int read_count = 0;
    while(read(*fsrv_stFD, &status, 4) != 4){
      read_count++;
      if (read_count == 9999) {
        FATAL("Forkserver not responding for file '%s'!", fsrv_argv[0]);
      }
      continue;
    }
    return;

    /* If the above failed, try to identify what step failed. */ 
    if (waitpid(*fork_PID, &status, 0) <= 0)
      PFATAL("waitpid() failed for file '%s'", fsrv_argv[0]);

    if (WIFSIGNALED(status))
      FATAL("Forkserver for file '%s' crashed with signal %d", fsrv_argv[0], WTERMSIG(status));

    FATAL("Forkserver handshake failed for file '%s'!", fsrv_argv[0]);

    return;
  }
}
/* We reworked this function to launch whatever forkserver 
   is specified via the arguments. Created by LH. */
We reworked this function to launch whatever forkserver
is specified via the arguments. Created by LH.
We reworked this function to launch whatever forkserver is specified via the arguments . Created by LH .
void start_forkserver(s32 *fork_PID, s32 *fsrv_ctlFD, s32 *fsrv_stFD, s32 FSRV_FD, char **fsrv_argv) {
  int st_pipe[2], ctl_pipe[2];
  int status;
  if (pipe(st_pipe) == -1 || pipe(ctl_pipe) == -1)
    PFATAL("pipe() failed for file '%s'", fsrv_argv[0]);
  *fork_PID = fork();
  if (*fork_PID < 0) 
    PFATAL("fork() failed for file '%s'", fsrv_argv[0]);
  if (*fork_PID == 0) {
    setsid();
    dup2(dev_null_fd, 1); 
    dup2(dev_null_fd, 2); 
    if (out_file) {
      dup2(dev_null_fd, 0);
    } 
    else {
      dup2(out_fd, 0);
      close(out_fd);
    }
    if (dup2(ctl_pipe[0], FSRV_FD) < 0)
      PFATAL("dup2() failed for file '%s'", fsrv_argv[0]);
    if (dup2(st_pipe[1], FSRV_FD + 1) < 0)
      PFATAL("dup2() failed for file '%s'", fsrv_argv[0]);
    close(ctl_pipe[0]);
    close(ctl_pipe[1]);
    close(st_pipe[0]);
    close(st_pipe[1]);
    close(dev_null_fd);
    if (!getenv("LD_BIND_LAZY")) 
      setenv("LD_BIND_NOW", "1", 0);
    if (execv(fsrv_argv[0], fsrv_argv) < 0)
      PFATAL("execv() failed for file '%s'", fsrv_argv[0]);
    exit(0);  
  }
  else {
    close(ctl_pipe[0]);
    close(st_pipe[1]);
    *fsrv_ctlFD = ctl_pipe[1];
    *fsrv_stFD = st_pipe[0];
    int read_count = 0;
    while(read(*fsrv_stFD, &status, 4) != 4){
      read_count++;
      if (read_count == 9999) {
        FATAL("Forkserver not responding for file '%s'!", fsrv_argv[0]);
      }
      continue;
    }
    return;
    if (waitpid(*fork_PID, &status, 0) <= 0)
      PFATAL("waitpid() failed for file '%s'", fsrv_argv[0]);
    if (WIFSIGNALED(status))
      FATAL("Forkserver for file '%s' crashed with signal %d", fsrv_argv[0], WTERMSIG(status));
    FATAL("Forkserver handshake failed for file '%s'!", fsrv_argv[0]);
    return;
  }
}
void start_forkserver ( s32 * fork_PID , s32 * fsrv_ctlFD , s32 * fsrv_stFD , s32 FSRV_FD , char * * fsrv_argv ) { int st_pipe [ 2 ] , ctl_pipe [ 2 ] ; int status ; if ( pipe ( st_pipe ) == -1 || pipe ( ctl_pipe ) == -1 ) PFATAL ( " " , fsrv_argv [ 0 ] ) ; * fork_PID = fork ( ) ; if ( * fork_PID < 0 ) PFATAL ( " " , fsrv_argv [ 0 ] ) ; if ( * fork_PID == 0 ) { setsid ( ) ; dup2 ( dev_null_fd , 1 ) ; dup2 ( dev_null_fd , 2 ) ; if ( out_file ) { dup2 ( dev_null_fd , 0 ) ; } else { dup2 ( out_fd , 0 ) ; close ( out_fd ) ; } if ( dup2 ( ctl_pipe [ 0 ] , FSRV_FD ) < 0 ) PFATAL ( " " , fsrv_argv [ 0 ] ) ; if ( dup2 ( st_pipe [ 1 ] , FSRV_FD + 1 ) < 0 ) PFATAL ( " " , fsrv_argv [ 0 ] ) ; close ( ctl_pipe [ 0 ] ) ; close ( ctl_pipe [ 1 ] ) ; close ( st_pipe [ 0 ] ) ; close ( st_pipe [ 1 ] ) ; close ( dev_null_fd ) ; if ( ! getenv ( " " ) ) setenv ( " " , " " , 0 ) ; if ( execv ( fsrv_argv [ 0 ] , fsrv_argv ) < 0 ) PFATAL ( " " , fsrv_argv [ 0 ] ) ; exit ( 0 ) ; } else { close ( ctl_pipe [ 0 ] ) ; close ( st_pipe [ 1 ] ) ; * fsrv_ctlFD = ctl_pipe [ 1 ] ; * fsrv_stFD = st_pipe [ 0 ] ; int read_count = 0 ; while ( read ( * fsrv_stFD , & status , 4 ) != 4 ) { read_count ++ ; if ( read_count == 9999 ) { FATAL ( " " , fsrv_argv [ 0 ] ) ; } continue ; } return ; if ( waitpid ( * fork_PID , & status , 0 ) <= 0 ) PFATAL ( " " , fsrv_argv [ 0 ] ) ; if ( WIFSIGNALED ( status ) ) FATAL ( " " , fsrv_argv [ 0 ] , WTERMSIG ( status ) ) ; FATAL ( " " , fsrv_argv [ 0 ] ) ; return ; } }
We reworked this function to launch whatever forkserver
is specified via the arguments.
We reworked this function to launch whatever forkserver is specified via the arguments .
/* Open control and status pipes and verify their success. */ /* Fork off (the forkserver) and check success. */ /* Enter child (forkserver). */ /* Isolate process. Configure STDOUT/STDERR since we 
     * don't care about those. */ /* If testcase path is specified, stdin is /dev/null; 
     * otherwise, testcase FD is cloned instead. */ /* Set up control and status pipes, close the unneeded original fds. */ /* This should improve performance a bit, since it 
     * stops the linker from doing extra work post-fork(). */ /* Close the unneeded endpoints. */ /* Read initialization message (hopefully 4 bytes!) 
     * We use a counter to check forkserver stalling. */ /* If the above failed, try to identify what step failed. */