block the usage of mopt with optionals mutators (redqueen/radamsa/etc...)

llvm_mode/afl-clang-fast.c

@@ -423,8 +423,7 @@ static void edit_params(u32 argc, char** argv) {
         break;
 
       case 32:
-        cc_params[cc_par_cnt++] =
+        cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-32.o", obj_path);
-            alloc_printf("%s/afl-llvm-rt-32.o", obj_path);
 
         if (access(cc_params[cc_par_cnt - 1], R_OK))
           FATAL("-m32 is not supported by your compiler");
@@ -432,8 +431,7 @@ static void edit_params(u32 argc, char** argv) {
         break;
 
       case 64:
-        cc_params[cc_par_cnt++] =
+        cc_params[cc_par_cnt++] = alloc_printf("%s/afl-llvm-rt-64.o", obj_path);
-            alloc_printf("%s/afl-llvm-rt-64.o", obj_path);
 
         if (access(cc_params[cc_par_cnt - 1], R_OK))
           FATAL("-m64 is not supported by your compiler");

llvm_mode/afl-llvm-rt.o.c

@@ -473,20 +473,18 @@ void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t* Cases) {
 // to avoid to call it on .text addresses
 static int area_is_mapped(void* ptr, size_t len) {
 
-  char * p = ptr;
+  char* p = ptr;
-  char * page = (char*)((uintptr_t)p & ~(sysconf(_SC_PAGE_SIZE) -1));
+  char* page = (char*)((uintptr_t)p & ~(sysconf(_SC_PAGE_SIZE) - 1));
 
   int r = msync(page, (p - page) + len, MS_ASYNC);
-  if (r < 0)
+  if (r < 0) return errno != ENOMEM;
-    return errno != ENOMEM;
   return 1;
 
 }
 
 void __cmplog_rtn_hook(void* ptr1, void* ptr2) {
 
-  if (!area_is_mapped(ptr1, 32) || !area_is_mapped(ptr2, 32))
+  if (!area_is_mapped(ptr1, 32) || !area_is_mapped(ptr2, 32)) return;
-    return;
 
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
@@ -500,7 +498,10 @@ void __cmplog_rtn_hook(void* ptr1, void* ptr2) {
   __afl_cmp_map->headers[k].shape = 31;
 
   hits &= CMP_MAP_RTN_H - 1;
-  __builtin_memcpy(((struct cmpfn_operands*)__afl_cmp_map->log[k])[hits].v0, ptr1, 32);
+  __builtin_memcpy(((struct cmpfn_operands*)__afl_cmp_map->log[k])[hits].v0,
-  __builtin_memcpy(((struct cmpfn_operands*)__afl_cmp_map->log[k])[hits].v1, ptr2, 32);
+                   ptr1, 32);
+  __builtin_memcpy(((struct cmpfn_operands*)__afl_cmp_map->log[k])[hits].v1,
+                   ptr2, 32);
 
 }
+

llvm_mode/cmplog-routines-pass.cc

@@ -108,14 +108,15 @@ bool CmpLogRoutines::hookRtns(Module &M) {
   LLVMContext &           C = M.getContext();
 
   Type *       VoidTy = Type::getVoidTy(C);
-  PointerType * VoidPtrTy = PointerType::get(VoidTy, 0);
+  PointerType *VoidPtrTy = PointerType::get(VoidTy, 0);
 
 #if LLVM_VERSION_MAJOR < 9
   Constant *
 #else
   FunctionCallee
 #endif
-      c = M.getOrInsertFunction("__cmplog_rtn_hook", VoidTy, VoidPtrTy, VoidPtrTy
+      c = M.getOrInsertFunction("__cmplog_rtn_hook", VoidTy, VoidPtrTy,
+                                VoidPtrTy
 #if LLVM_VERSION_MAJOR < 5
                                 ,
                                 NULL
@@ -255,13 +256,12 @@ bool CmpLogRoutines::hookRtns(Module &M) {
 
           FunctionType *FT = Callee->getFunctionType();
 
-          bool isPtrRtn =
+          bool isPtrRtn = FT->getNumParams() >= 2 &&
-              FT->getNumParams() >= 2 && !FT->getReturnType()->isVoidTy() &&
+                          !FT->getReturnType()->isVoidTy() &&
                           FT->getParamType(0) == FT->getParamType(1) &&
                           FT->getParamType(0)->isPointerTy();
 
-          if (!isPtrRtn)
+          if (!isPtrRtn) continue;
-            continue;
 
           calls.push_back(callInst);
 
@@ -278,13 +278,12 @@ bool CmpLogRoutines::hookRtns(Module &M) {
 
   for (auto &callInst : calls) {
 
-    Value *v1P = callInst->getArgOperand(0),
+    Value *v1P = callInst->getArgOperand(0), *v2P = callInst->getArgOperand(1);
-          *v2P = callInst->getArgOperand(1);
 
     IRBuilder<> IRB(callInst->getParent());
     IRB.SetInsertPoint(callInst);
 
-    std::vector<Value*> args;
+    std::vector<Value *> args;
     args.push_back(v1P);
     args.push_back(v2P);
 
@@ -301,7 +300,8 @@ bool CmpLogRoutines::hookRtns(Module &M) {
 bool CmpLogRoutines::runOnModule(Module &M) {
 
   if (getenv("AFL_QUIET") == NULL)
-    llvm::errs() << "Running cmplog-routines-pass by andreafioraldi@gmail.com\n";
+    llvm::errs()
+        << "Running cmplog-routines-pass by andreafioraldi@gmail.com\n";
   hookRtns(M);
   verifyModule(M);
 

src/afl-forkserver.c

@@ -154,8 +154,7 @@ void init_forkserver(char **argv) {
   int                     status;
   s32                     rlen;
 
-  if (!getenv("AFL_QUIET"))
+  if (!getenv("AFL_QUIET")) ACTF("Spinning up the fork server...");
-    ACTF("Spinning up the fork server...");
 
   if (pipe(st_pipe) || pipe(ctl_pipe)) PFATAL("pipe() failed");
 
@@ -312,8 +311,7 @@ void init_forkserver(char **argv) {
 
   if (rlen == 4) {
 
-    if (!getenv("AFL_QUIET"))
+    if (!getenv("AFL_QUIET")) OKF("All right - fork server is up.");
-      OKF("All right - fork server is up.");
     return;
 
   }

src/afl-fuzz-init.c

@@ -303,6 +303,12 @@ void setup_custom_mutator(void) {
 
   if (!fn) return;
 
+  if (limit_time_sig)
+    FATAL(
+        "MOpt and custom mutator are mutually exclusive. We accept pull "
+        "requests that integrates MOpt with the optional mutators "
+        "(custom/radamsa/redquenn/...).");
+
   ACTF("Loading custom mutator library from '%s'...", fn);
 
   dh = dlopen(fn, RTLD_NOW);

src/afl-fuzz-python.c

@@ -35,6 +35,12 @@ int init_py() {
 
   if (module_name) {
 
+    if (limit_time_sig)
+      FATAL(
+          "MOpt and Python mutator are mutually exclusive. We accept pull "
+          "requests that integrates MOpt with the optional mutators "
+          "(custom/radamsa/redquenn/...).");
+
 #if PY_MAJOR_VERSION >= 3
     PyObject* py_name = PyUnicode_FromString(module_name);
 #else

src/afl-fuzz-redqueen.c

@@ -146,8 +146,7 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) {
 
   }
 
-  if (stage_cur)
+  if (stage_cur) queue_cur->fully_colorized = 1;
-    queue_cur->fully_colorized = 1;
 
   new_hit_cnt = queued_paths + unique_crashes;
   stage_finds[STAGE_COLORIZATION] += new_hit_cnt - orig_hit_cnt;
@@ -426,10 +425,9 @@ u8 rtn_extend_encoding(struct cmp_header* h, u8* pattern, u8* repl, u32 idx,
 
   for (i = 0; i < its_len; ++i) {
 
-    if (pattern[idx + i] != orig_buf[idx + i] || *status == 1)
+    if (pattern[idx + i] != orig_buf[idx + i] || *status == 1) break;
-      break;
 
-    buf[idx +i] = repl[idx + i];
+    buf[idx + i] = repl[idx + i];
     if (unlikely(its_fuzz(buf, len, status))) return 1;
 
   }
@@ -457,7 +455,8 @@ u8 rtn_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) {
 
     // opt not in the paper
     for (j = 0; j < i; ++j)
-      if (!memcmp(&((struct cmpfn_operands*)cmp_map->log[key])[j], o, sizeof(struct cmpfn_operands)))
+      if (!memcmp(&((struct cmpfn_operands*)cmp_map->log[key])[j], o,
+                  sizeof(struct cmpfn_operands)))
         goto rtn_fuzz_next_iter;
 
     for (idx = 0; idx < len && fails < 8; ++idx) {
@@ -538,11 +537,13 @@ u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len,
     if (!cmp_map->headers[k].hits) continue;
 
     if (cmp_map->headers[k].type == CMP_TYPE_INS) {
-      if (unlikely(cmp_fuzz(k, orig_buf, buf, len)))
+
-        goto exit_its;
+      if (unlikely(cmp_fuzz(k, orig_buf, buf, len))) goto exit_its;
+
     } else {
-      if (unlikely(rtn_fuzz(k, orig_buf, buf, len)))
+
-        goto exit_its;
+      if (unlikely(rtn_fuzz(k, orig_buf, buf, len))) goto exit_its;
+
     }
 
   }

src/afl-fuzz.c

@@ -624,6 +624,12 @@ int main(int argc, char** argv, char** envp) {
 
   if (use_radamsa) {
 
+    if (limit_time_sig)
+      FATAL(
+          "MOpt and Radamsa are mutually exclusive. We accept pull requests "
+          "that integrates MOpt with the optional mutators "
+          "(custom/radamsa/redquenn/...).");
+
     OKF("Using Radamsa add-on");
 
     u8*   libradamsa_path = get_libradamsa_path(argv[0]);
@@ -892,6 +898,12 @@ int main(int argc, char** argv, char** envp) {
 
   if (cmplog_binary) {
 
+    if (limit_time_sig)
+      FATAL(
+          "MOpt and CmpLog are mutually exclusive. We accept pull requests "
+          "that integrates MOpt with the optional mutators "
+          "(custom/radamsa/redquenn/...).");
+
     if (unicorn_mode)
       FATAL("CmpLog and Unicorn mode are not compatible at the moment, sorry");
     if (!qemu_mode) check_binary(cmplog_binary);