code format

This commit is contained in:
van Hauser 2020-06-01 12:30:55 +02:00
parent bca7ce8043
commit 0de25f08ba
4 changed files with 43 additions and 23 deletions

View File

@ -24,34 +24,41 @@ int main(int argc, char **argv) {
__AFL_INIT(); __AFL_INIT();
unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF; unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;
while(__AFL_LOOP(2147483647)) { while (__AFL_LOOP(2147483647)) {
unsigned int len = __AFL_FUZZ_TESTCASE_LEN; unsigned int len = __AFL_FUZZ_TESTCASE_LEN;
#ifdef _AFL_DOCUMENT_MUTATIONS #ifdef _AFL_DOCUMENT_MUTATIONS
static unsigned int counter = 0; static unsigned int counter = 0;
char fn[32]; char fn[32];
sprintf(fn, "%09u:test-instr", counter); sprintf(fn, "%09u:test-instr", counter);
int fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600); int fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
if (fd_doc >= 0) { if (fd_doc >= 0) {
if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) { if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
fprintf(stderr, "write of mutation file failed: %s\n", fn); fprintf(stderr, "write of mutation file failed: %s\n", fn);
unlink(fn); unlink(fn);
} }
close(fd_doc); close(fd_doc);
} }
counter++; counter++;
#endif #endif
if (!len) continue; if (!len) continue;
if (buf[0] == '0') if (buf[0] == '0')
printf("Looks like a zero to me!\n"); printf("Looks like a zero to me!\n");
else if (buf[0] == '1') else if (buf[0] == '1')
printf("Pretty sure that is a one!\n"); printf("Pretty sure that is a one!\n");
else else
printf("Neither one or zero? How quaint!\n"); printf("Neither one or zero? How quaint!\n");
} }
return 0; return 0;

View File

@ -74,11 +74,11 @@ u8 __afl_area_initial[MAP_INITIAL_SIZE];
#else #else
u8 __afl_area_initial[MAP_SIZE]; u8 __afl_area_initial[MAP_SIZE];
#endif #endif
u8 *__afl_area_ptr = __afl_area_initial; u8 * __afl_area_ptr = __afl_area_initial;
u8 *__afl_dictionary; u8 * __afl_dictionary;
u8 *__afl_fuzz_ptr; u8 * __afl_fuzz_ptr;
u32 __afl_fuzz_len; u32 __afl_fuzz_len;
u32 __afl_fuzz_len_dummy; u32 __afl_fuzz_len_dummy;
u32 *__afl_fuzz_len_shmem = &__afl_fuzz_len_dummy; u32 *__afl_fuzz_len_shmem = &__afl_fuzz_len_dummy;
u32 __afl_final_loc; u32 __afl_final_loc;
@ -165,8 +165,9 @@ static void __afl_map_shm_fuzz() {
exit(1); exit(1);
} }
__afl_fuzz_len_shmem = (u32*) mmap(NULL, sizeof(int), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0); __afl_fuzz_len_shmem = (u32 *)mmap(NULL, sizeof(int), PROT_READ | PROT_WRITE,
MAP_SHARED | MAP_ANONYMOUS, -1, 0);
} }
@ -450,22 +451,31 @@ static void __afl_start_snapshots(void) {
*__afl_fuzz_len_shmem = __afl_fuzz_len = (was_killed >> 8); *__afl_fuzz_len_shmem = __afl_fuzz_len = (was_killed >> 8);
was_killed = (was_killed & 0xff); was_killed = (was_killed & 0xff);
#ifdef _AFL_DOCUMENT_MUTATIONS #ifdef _AFL_DOCUMENT_MUTATIONS
if (__afl_fuzz_ptr) { if (__afl_fuzz_ptr) {
static uint32_t counter = 0; static uint32_t counter = 0;
char fn[32]; char fn[32];
sprintf(fn, "%09u:forkserver", counter); sprintf(fn, "%09u:forkserver", counter);
s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600); s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
if (fd_doc >= 0) { if (fd_doc >= 0) {
if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) { if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
fprintf(stderr, "write of mutation file failed: %s\n", fn); fprintf(stderr, "write of mutation file failed: %s\n", fn);
unlink(fn); unlink(fn);
} }
close(fd_doc); close(fd_doc);
} }
counter++; counter++;
} }
#endif
#endif
/* If we stopped the child in persistent mode, but there was a race /* If we stopped the child in persistent mode, but there was a race
condition and afl-fuzz already issued SIGKILL, write off the old condition and afl-fuzz already issued SIGKILL, write off the old
@ -646,19 +656,28 @@ static void __afl_start_forkserver(void) {
#ifdef _AFL_DOCUMENT_MUTATIONS #ifdef _AFL_DOCUMENT_MUTATIONS
if (__afl_fuzz_ptr) { if (__afl_fuzz_ptr) {
static uint32_t counter = 0; static uint32_t counter = 0;
char fn[32]; char fn[32];
sprintf(fn, "%09u:forkserver", counter); sprintf(fn, "%09u:forkserver", counter);
s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600); s32 fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
if (fd_doc >= 0) { if (fd_doc >= 0) {
if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) { if (write(fd_doc, __afl_fuzz_ptr, __afl_fuzz_len) != __afl_fuzz_len) {
fprintf(stderr, "write of mutation file failed: %s\n", fn); fprintf(stderr, "write of mutation file failed: %s\n", fn);
unlink(fn); unlink(fn);
} }
close(fd_doc); close(fd_doc);
} }
counter++; counter++;
} }
#endif #endif
/* If we stopped the child in persistent mode, but there was a race /* If we stopped the child in persistent mode, but there was a race

View File

@ -1949,7 +1949,6 @@ static void handle_skipreq(int sig) {
} }
/* Setup shared map for fuzzing with input via sharedmem */ /* Setup shared map for fuzzing with input via sharedmem */
void setup_testcase_shmem(afl_state_t *afl) { void setup_testcase_shmem(afl_state_t *afl) {
@ -1978,7 +1977,6 @@ void setup_testcase_shmem(afl_state_t *afl) {
} }
/* Do a PATH search and find target binary to see that it exists and /* Do a PATH search and find target binary to see that it exists and
isn't a shell script - a common and painful mistake. We also check for isn't a shell script - a common and painful mistake. We also check for
a valid ELF header and for evidence of AFL instrumentation. */ a valid ELF header and for evidence of AFL instrumentation. */

View File

@ -1179,11 +1179,7 @@ int main(int argc, char **argv_orig, char **envp) {
check_binary(afl, argv[optind]); check_binary(afl, argv[optind]);
if (afl->shmem_testcase_mode) { if (afl->shmem_testcase_mode) { setup_testcase_shmem(afl); }
setup_testcase_shmem(afl);
}
afl->start_time = get_cur_time(); afl->start_time = get_cur_time();