code format

include/afl-fuzz.h

@@ -163,7 +163,7 @@ struct queue_entry {
   u32 tc_ref;                           /* Trace bytes ref count            */
 
   u8 *testcase_buf;                     /* The testcase buffer, if loaded.  */
-  u32 testcase_refs;                             /* count of users of testcase buf   */
+  u32 testcase_refs;                    /* count of users of testcase buf   */
 
   struct queue_entry *next;             /* Next element, if any             */
 
@@ -669,7 +669,8 @@ typedef struct afl_state {
 
   /* How many queue entries currently have cached testcases */
   u32 q_testcase_cache_count;
-  /* Refs to each queue entry with cached testcase (for eviction, if cache_count is too large) */
+  /* Refs to each queue entry with cached testcase (for eviction, if cache_count
+   * is too large) */
   struct queue_entry *q_testcase_cache[TESTCASE_CACHE_SIZE];
 
 } afl_state_t;

include/config.h

@@ -300,7 +300,8 @@ Decrease if RAM usage is high. */
 #define TESTCASE_CACHE_SIZE 2048
 
 #if TESTCASE_CACHE_SIZE < 4
-  #error "Dangerously low cache size: Set TESTCASE_CACHE_SIZE to 4 or more in config.h!
+  #error \
+      "Dangerously low cache size: Set TESTCASE_CACHE_SIZE to 4 or more in config.h!
 #endif
 
 /* Maximum line length passed from GCC to 'as' and used for parsing

src/afl-fuzz-one.c

@@ -1710,8 +1710,10 @@ custom_mutator_stage:
                                   target_len, max_seed_size);
 
           if (new_buf) {
+
             queue_testcase_release(afl, target);
             new_buf = NULL;
+
           }
 
           if (unlikely(!mutated_buf)) {
@@ -2302,7 +2304,9 @@ havoc_stage:
 
             u32 tid;
             do {
+
               tid = rand_below(afl, afl->queued_paths);
+
             } while (tid == afl->current_entry);
 
             struct queue_entry *target = afl->queue_buf[tid];
@@ -2310,12 +2314,13 @@ havoc_stage:
             /* Make sure that the target has a reasonable length. */
 
             while (target && (target->len < 2 || target == afl->queue_cur)) {
+
               target = target->next;
+
             }
 
             if (!target) { break; }
 
-
             u32 new_len = target->len;
 
             /* Get the testcase contents for splicing. */
@@ -2323,16 +2328,21 @@ havoc_stage:
 
             u8 overwrite = 0;
             if (temp_len >= 2 && rand_below(afl, 2)) {
+
               overwrite = 1;
-            }
-            else if (temp_len + HAVOC_BLK_XL >= MAX_FILE) {
+
+            } else if (temp_len + HAVOC_BLK_XL >= MAX_FILE) {
 
               if (temp_len >= 2) {
+
                 overwrite = 1;
+
               } else {
+
                 queue_testcase_release(afl, target);
                 new_buf = NULL;
                 break;
+
               }
 
             }
@@ -2497,7 +2507,8 @@ retry_splicing:
        the last differing byte. Bail out if the difference is just a single
        byte or so. */
 
-    locate_diffs(in_buf, splice_buf, MIN(len, (s64)target->len), &f_diff, &l_diff);
+    locate_diffs(in_buf, splice_buf, MIN(len, (s64)target->len), &f_diff,
+                 &l_diff);
 
     if (f_diff < 0 || l_diff < 2 || f_diff == l_diff) { goto retry_splicing; }
 
@@ -4503,7 +4514,8 @@ pacemaker_fuzzing:
 
         len = target->len;
         memcpy(new_buf, in_buf, split_at);
-        memcpy(new_buf + split_at, splicing_buf + split_at, target->len - split_at);
+        memcpy(new_buf + split_at, splicing_buf + split_at,
+               target->len - split_at);
         afl_swap_bufs(AFL_BUF_PARAM(in), AFL_BUF_PARAM(in_scratch));
         in_buf = new_buf;
         out_buf = afl_realloc(AFL_BUF_PARAM(out), len);

src/afl-fuzz-queue.c

@@ -770,24 +770,33 @@ u32 calculate_score(afl_state_t *afl, struct queue_entry *q) {
 
 /* Tell afl that this testcase may be evicted from the cache */
 inline void queue_testcase_release(afl_state_t *afl, struct queue_entry *q) {
-  (void) afl;
+
+  (void)afl;
   q->testcase_refs--;
-  if (unlikely(q->testcase_refs < 0)) { FATAL("Testcase refcount smaller than 0"); }
+  if (unlikely(q->testcase_refs < 0)) {
+
+    FATAL("Testcase refcount smaller than 0");
+
+  }
+
 }
 
 /* Returns the testcase buf from the file behind this queue entry.
   Increases the refcount. */
 u8 *queue_testcase_take(afl_state_t *afl, struct queue_entry *q) {
+
   if (!q->testcase_buf) {
+
     u32 tid = 0;
     /* Buf not cached, let's do that now */
 
     if (likely(afl->q_testcase_cache_count == TESTCASE_CACHE_SIZE)) {
+
       /* Cache full. We neet to evict one to map one.
       Get a random one which is not in use */
       do {
 
-          tid = rand_below(afl, afl->q_testcase_cache_count);
+        tid = rand_below(afl, afl->q_testcase_cache_count);
 
       } while (afl->q_testcase_cache[tid]->testcase_refs > 0);
 
@@ -795,21 +804,19 @@ u8 *queue_testcase_take(afl_state_t *afl, struct queue_entry *q) {
       /* free the current buf from cache */
       munmap(old_cached->testcase_buf, old_cached->len);
       old_cached->testcase_buf = NULL;
-      
+
     } else {
+
       tid = afl->q_testcase_cache_count;
       afl->q_testcase_cache_count++;
+
     }
 
     /* Map the test case into memory. */
 
     int fd = open(q->fname, O_RDONLY);
 
-    if (unlikely(fd < 0)) {
-
-      PFATAL("Unable to open '%s'", q->fname);
-
-    }
+    if (unlikely(fd < 0)) { PFATAL("Unable to open '%s'", q->fname); }
 
     u32 len = q->len;
 
@@ -827,8 +834,15 @@ u8 *queue_testcase_take(afl_state_t *afl, struct queue_entry *q) {
     afl->q_testcase_cache[tid] = q;
 
   }
+
   q->testcase_refs++;
-  if (!q->testcase_buf) { FATAL("Testcase buf is NULL, this should never happen"); }
+  if (!q->testcase_buf) {
+
+    FATAL("Testcase buf is NULL, this should never happen");
+
+  }
+
   return q->testcase_buf;
 
 }
+

src/afl-fuzz.c

@@ -1153,7 +1153,9 @@ int main(int argc, char **argv_orig, char **envp) {
   if (extras_dir_cnt) {
 
     for (i = 0; i < extras_dir_cnt; i++) {
+
       load_extras(afl, extras_dir[i]);
+
     }
 
     dedup_extras(afl);