larger map, stats reload fix, code format

docs/Changelog.md

@@ -26,6 +26,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
       `-i` or resumes (as these have most likely already been done)
     - fix crash for very, very fast targets+systems (thanks to mhlakhani
       for reporting)
+    - on restarts (-i)/autoresume (AFL_AUTORESUME) the stats are now
+      reloaded and used, thanks to Vimal Joseph for this PR! 
     - if determinstic mode is active (-D, or -M without -d) then we sync
       after every queue entry as this can take very long time otherwise
     - better detection if a target needs a large shared map

instrumentation/afl-compiler-rt.o.c

@@ -70,7 +70,7 @@
    run. It will end up as .comm, so it shouldn't be too wasteful. */
 
 #if MAP_SIZE <= 65536
-  #define MAP_INITIAL_SIZE 1048576
+  #define MAP_INITIAL_SIZE 2097152
 #else
   #define MAP_INITIAL_SIZE MAP_SIZE
 #endif

instrumentation/afl-llvm-lto-instrumentation.so.cc

@@ -69,7 +69,8 @@ class AFLLTOPass : public ModulePass {
 
     if (getenv("AFL_DEBUG")) debug = 1;
     if ((ptr = getenv("AFL_LLVM_LTO_STARTID")) != NULL)
-      if ((afl_global_id = (uint32_t)atoi(ptr)) < 0 || afl_global_id >= MAP_SIZE)
+      if ((afl_global_id = (uint32_t)atoi(ptr)) < 0 ||
+          afl_global_id >= MAP_SIZE)
         FATAL("AFL_LLVM_LTO_STARTID value of \"%s\" is not between 0 and %u\n",
               ptr, MAP_SIZE - 1);
 

qemu_mode/libqasan/dlmalloc.c

@@ -3907,6 +3907,7 @@ static void internal_malloc_stats(mstate m) {
         clear_smallmap(M, I);                                                  \
                                                                                \
       } else if (RTCHECK(B == smallbin_at(M, I) ||                             \
+                                                                               \
                          (ok_address(M, B) && B->fd == P))) {                  \
                                                                                \
         F->bk = B;                                                             \
@@ -4117,6 +4118,7 @@ static void internal_malloc_stats(mstate m) {
           XP->child[1] = R;                                        \
                                                                    \
       } else                                                       \
+                                                                   \
         CORRUPTION_ERROR_ACTION(M);                                \
       if (R != 0) {                                                \
                                                                    \
@@ -4132,6 +4134,7 @@ static void internal_malloc_stats(mstate m) {
               C0->parent = R;                                      \
                                                                    \
             } else                                                 \
+                                                                   \
               CORRUPTION_ERROR_ACTION(M);                          \
                                                                    \
           }                                                        \
@@ -4143,11 +4146,13 @@ static void internal_malloc_stats(mstate m) {
               C1->parent = R;                                      \
                                                                    \
             } else                                                 \
+                                                                   \
               CORRUPTION_ERROR_ACTION(M);                          \
                                                                    \
           }                                                        \
                                                                    \
         } else                                                     \
+                                                                   \
           CORRUPTION_ERROR_ACTION(M);                              \
                                                                    \
       }                                                            \

src/afl-fuzz-bitmap.c

@@ -325,7 +325,8 @@ u8 *describe_op(afl_state_t *afl, u8 new_bits, size_t max_description_len) {
 
     }
 
-    sprintf(ret + strlen(ret), ",time:%llu", get_cur_time() - afl->start_time);
+    sprintf(ret + strlen(ret), ",time:%llu",
+            get_cur_time() + afl->prev_run_time - afl->start_time);
 
     if (afl->current_custom_fuzz &&
         afl->current_custom_fuzz->afl_custom_describe) {

src/afl-fuzz-statsd.c

@@ -1,3 +1,8 @@
+/*
+ * This implements rpc.statsd support, see docs/rpc_statsd.md
+ *
+ */
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <sys/socket.h>
@@ -226,37 +231,39 @@ int statsd_format_metric(afl_state_t *afl, char *buff, size_t bufflen) {
   */
   if (afl->statsd_metric_format_type == STATSD_TAGS_TYPE_SUFFIX) {
 
-    snprintf(buff, bufflen, afl->statsd_metric_format,
+    snprintf(
+        buff, bufflen, afl->statsd_metric_format,
         afl->queue_cycle ? (afl->queue_cycle - 1) : 0, tags,
         afl->cycles_wo_finds, tags, afl->fsrv.total_execs, tags,
         afl->fsrv.total_execs /
-                 ((double)(get_cur_time() - afl->start_time) / 1000),
+            ((double)(get_cur_time() + afl->prev_run_time - afl->start_time) /
+             1000),
         tags, afl->queued_paths, tags, afl->queued_favored, tags,
         afl->queued_discovered, tags, afl->queued_imported, tags,
-             afl->max_depth, tags, afl->current_entry, tags,
+        afl->max_depth, tags, afl->current_entry, tags, afl->pending_favored,
-             afl->pending_favored, tags, afl->pending_not_fuzzed, tags,
+        tags, afl->pending_not_fuzzed, tags, afl->queued_variable, tags,
-             afl->queued_variable, tags, afl->unique_crashes, tags,
+        afl->unique_crashes, tags, afl->unique_hangs, tags, afl->total_crashes,
-             afl->unique_hangs, tags, afl->total_crashes, tags,
+        tags, afl->slowest_exec_ms, tags,
-             afl->slowest_exec_ms, tags,
+        count_non_255_bytes(afl, afl->virgin_bits), tags, afl->var_byte_count,
-             count_non_255_bytes(afl, afl->virgin_bits), tags,
+        tags, afl->expand_havoc, tags);
-             afl->var_byte_count, tags, afl->expand_havoc, tags);
 
   } else if (afl->statsd_metric_format_type == STATSD_TAGS_TYPE_MID) {
 
-    snprintf(buff, bufflen, afl->statsd_metric_format, tags,
+    snprintf(
+        buff, bufflen, afl->statsd_metric_format, tags,
         afl->queue_cycle ? (afl->queue_cycle - 1) : 0, tags,
         afl->cycles_wo_finds, tags, afl->fsrv.total_execs, tags,
         afl->fsrv.total_execs /
-                 ((double)(get_cur_time() - afl->start_time) / 1000),
+            ((double)(get_cur_time() + afl->prev_run_time - afl->start_time) /
+             1000),
         tags, afl->queued_paths, tags, afl->queued_favored, tags,
         afl->queued_discovered, tags, afl->queued_imported, tags,
-             afl->max_depth, tags, afl->current_entry, tags,
+        afl->max_depth, tags, afl->current_entry, tags, afl->pending_favored,
-             afl->pending_favored, tags, afl->pending_not_fuzzed, tags,
+        tags, afl->pending_not_fuzzed, tags, afl->queued_variable, tags,
-             afl->queued_variable, tags, afl->unique_crashes, tags,
+        afl->unique_crashes, tags, afl->unique_hangs, tags, afl->total_crashes,
-             afl->unique_hangs, tags, afl->total_crashes, tags,
+        tags, afl->slowest_exec_ms, tags,
-             afl->slowest_exec_ms, tags,
+        count_non_255_bytes(afl, afl->virgin_bits), tags, afl->var_byte_count,
-             count_non_255_bytes(afl, afl->virgin_bits), tags,
+        tags, afl->expand_havoc);
-             afl->var_byte_count, tags, afl->expand_havoc);
 
   }
 

utils/afl_untracer/afl-untracer.c

@@ -480,9 +480,9 @@ void setup_trap_instrumentation(void) {
     // Index into the coverage bitmap for the current trap instruction.
 #ifdef __aarch64__
   uint64_t bitmap_index = 0;
-#ifdef __APPLE__
+  #ifdef __APPLE__
   pthread_jit_write_protect_np(0);
-#endif
+  #endif
 #else
   uint32_t bitmap_index = 0;
 #endif
@@ -627,13 +627,13 @@ static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
   // Must re-execute the instruction, so decrement PC by one instruction.
   ucontext_t *ctx = (ucontext_t *)context;
 #if defined(__APPLE__) && defined(__LP64__)
-#if defined(__x86_64__)
+  #if defined(__x86_64__)
   ctx->uc_mcontext->__ss.__rip -= 1;
   addr = ctx->uc_mcontext->__ss.__rip;
-#else
+  #else
   ctx->uc_mcontext->__ss.__pc -= 4;
   addr = ctx->uc_mcontext->__ss.__pc;
-#endif
+  #endif
 #elif defined(__linux__)
   #if defined(__x86_64__) || defined(__i386__)
   ctx->uc_mcontext.gregs[REG_RIP] -= 1;