add gcc_plugin to code formatter and run it

Makefile

@@ -213,6 +213,9 @@ code-format:
 	./.custom-format.py -i llvm_mode/*.c
 	./.custom-format.py -i llvm_mode/*.h
 	./.custom-format.py -i llvm_mode/*.cc
+	./.custom-format.py -i gcc_plugin/*.c
+	./.custom-format.py -i gcc_plugin/*.h
+	./.custom-format.py -i gcc_plugin/*.cc
 	./.custom-format.py -i qemu_mode/patches/*.h
 	./.custom-format.py -i qemu_mode/libcompcov/*.c
 	./.custom-format.py -i qemu_mode/libcompcov/*.cc

gcc_plugin/afl-gcc-fast.c

@@ -40,7 +40,6 @@ static u8*  obj_path;               /* Path to runtime libraries         */
 static u8** cc_params;                 /* Parameters passed to the real CC  */
 static u32  cc_par_cnt = 1;            /* Param count, including argv0      */
 
-
 /* Try to find the runtime libraries. If that fails, abort. */
 
 static void find_obj(u8* argv0) {
@@ -53,9 +52,11 @@ static void find_obj(u8* argv0) {
     tmp = alloc_printf("%s/afl-gcc-rt.o", afl_path);
 
     if (!access(tmp, R_OK)) {
+
       obj_path = afl_path;
       ck_free(tmp);
       return;
+
     }
 
     ck_free(tmp);
@@ -75,9 +76,11 @@ static void find_obj(u8* argv0) {
     tmp = alloc_printf("%s/afl-gcc-rt.o", dir);
 
     if (!access(tmp, R_OK)) {
+
       obj_path = dir;
       ck_free(tmp);
       return;
+
     }
 
     ck_free(tmp);
@@ -86,13 +89,17 @@ static void find_obj(u8* argv0) {
   }
 
   if (!access(AFL_PATH "/afl-gcc-rt.o", R_OK)) {
+
     obj_path = AFL_PATH;
     return;
+
   }
 
-  FATAL("Unable to find 'afl-gcc-rt.o' or 'afl-gcc-pass.so'. Please set AFL_PATH");
+  FATAL(
-}
+      "Unable to find 'afl-gcc-rt.o' or 'afl-gcc-pass.so'. Please set "
+      "AFL_PATH");
 
+}
 
 /* Copy argv to cc_params, making the necessary edits. */
 
@@ -104,18 +111,23 @@ static void edit_params(u32 argc, char** argv) {
   cc_params = ck_alloc((argc + 64) * sizeof(u8*));
 
   name = strrchr(argv[0], '/');
-  if (!name) name = argv[0]; else ++name;
+  if (!name)
+    name = argv[0];
+  else
+    ++name;
 
   if (!strcmp(name, "afl-g++-fast")) {
+
     u8* alt_cxx = getenv("AFL_CXX");
     cc_params[0] = alt_cxx ? alt_cxx : (u8*)"g++";
+
   } else {
+
     u8* alt_cc = getenv("AFL_CC");
     cc_params[0] = alt_cc ? alt_cc : (u8*)"gcc";
+
   }
 
-
-
   char* fplugin_arg = alloc_printf("-fplugin=%s/afl-gcc-pass.so", obj_path);
   cc_params[cc_par_cnt++] = fplugin_arg;
 
@@ -124,6 +136,7 @@ static void edit_params(u32 argc, char** argv) {
   if (argc == 1 && !strcmp(argv[1], "-v")) maybe_linking = 0;
 
   while (--argc) {
+
     u8* cur = *(++argv);
 
 #if defined(__x86_64__)
@@ -133,10 +146,11 @@ static void edit_params(u32 argc, char** argv) {
     if (!strcmp(cur, "-x")) x_set = 1;
 
     if (!strcmp(cur, "-c") || !strcmp(cur, "-S") || !strcmp(cur, "-E") ||
-        !strcmp(cur, "-v")) maybe_linking = 0;
+        !strcmp(cur, "-v"))
+      maybe_linking = 0;
 
-    if (!strcmp(cur, "-fsanitize=address") ||
+    if (!strcmp(cur, "-fsanitize=address") || !strcmp(cur, "-fsanitize=memory"))
-        !strcmp(cur, "-fsanitize=memory")) asan_set = 1;
+      asan_set = 1;
 
     if (strstr(cur, "FORTIFY_SOURCE")) fortify_set = 1;
 
@@ -150,8 +164,7 @@ static void edit_params(u32 argc, char** argv) {
 
     cc_params[cc_par_cnt++] = "-fstack-protector-all";
 
-    if (!fortify_set)
+    if (!fortify_set) cc_params[cc_par_cnt++] = "-D_FORTIFY_SOURCE=2";
-      cc_params[cc_par_cnt++] = "-D_FORTIFY_SOURCE=2";
 
   }
 
@@ -217,9 +230,11 @@ static void edit_params(u32 argc, char** argv) {
 
    */
 
-  cc_params[cc_par_cnt++] = "-D__AFL_LOOP(_A)="
+  cc_params[cc_par_cnt++] =
+      "-D__AFL_LOOP(_A)="
       "({ static volatile char *_B __attribute__((used)); "
-    " _B = (char*)\"" PERSIST_SIG "\"; "
+      " _B = (char*)\"" PERSIST_SIG
+      "\"; "
 #ifdef __APPLE__
       "int _L(unsigned int) __asm__(\"___afl_persistent_loop\"); "
 #else
@@ -227,9 +242,11 @@ static void edit_params(u32 argc, char** argv) {
 #endif                                                        /* ^__APPLE__ */
       "_L(_A); })";
 
-  cc_params[cc_par_cnt++] = "-D__AFL_INIT()="
+  cc_params[cc_par_cnt++] =
+      "-D__AFL_INIT()="
       "do { static volatile char *_A __attribute__((used)); "
-    " _A = (char*)\"" DEFER_SIG "\"; "
+      " _A = (char*)\"" DEFER_SIG
+      "\"; "
 #ifdef __APPLE__
       "void _I(void) __asm__(\"___afl_manual_init\"); "
 #else
@@ -240,8 +257,10 @@ static void edit_params(u32 argc, char** argv) {
   if (maybe_linking) {
 
     if (x_set) {
+
       cc_params[cc_par_cnt++] = "-x";
       cc_params[cc_par_cnt++] = "none";
+
     }
 
     cc_params[cc_par_cnt++] = alloc_printf("%s/afl-gcc-rt.o", obj_path);
@@ -252,27 +271,35 @@ static void edit_params(u32 argc, char** argv) {
 
 }
 
-
 /* Main entry point */
 
 int main(int argc, char** argv) {
 
   if (argc < 2 || strcmp(argv[1], "-h") == 0) {
 
-    printf(cCYA "afl-gcc-fast" VERSION cRST " initially by <aseipp@pobox.com>, maintainer: hexcoder-\n"
+    printf(
+        cCYA
+        "afl-gcc-fast" VERSION cRST
+        " initially by <aseipp@pobox.com>, maintainer: hexcoder-\n"
         "\n"
-         "This is a helper application for afl-fuzz. It serves as a drop-in replacement\n"
+        "This is a helper application for afl-fuzz. It serves as a drop-in "
-         "for gcc, letting you recompile third-party code with the required runtime\n"
+        "replacement\n"
-         "instrumentation. A common use pattern would be one of the following:\n\n"
+        "for gcc, letting you recompile third-party code with the required "
+        "runtime\n"
+        "instrumentation. A common use pattern would be one of the "
+        "following:\n\n"
 
         "  CC=%s/afl-gcc-fast ./configure\n"
         "  CXX=%s/afl-g++-fast ./configure\n\n"
 
-         "In contrast to the traditional afl-gcc tool, this version is implemented as\n"
+        "In contrast to the traditional afl-gcc tool, this version is "
-         "a GCC plugin and tends to offer improved performance with slow programs\n"
+        "implemented as\n"
+        "a GCC plugin and tends to offer improved performance with slow "
+        "programs\n"
         "(similarly to the LLVM plugin used by afl-clang-fast).\n\n"
 
-         "You can specify custom next-stage toolchain via AFL_CC and AFL_CXX. Setting\n"
+        "You can specify custom next-stage toolchain via AFL_CC and AFL_CXX. "
+        "Setting\n"
         "AFL_HARDEN enables hardening optimizations in the compiled code.\n\n",
         BIN_PATH, BIN_PATH);
 
@@ -280,7 +307,8 @@ int main(int argc, char** argv) {
 
   } else if (isatty(2) && !getenv("AFL_QUIET")) {
 
-    SAYF(cCYA "afl-gcc-fast" VERSION cRST " initially by <aseipp@pobox.com>, maintainer: hexcoder-\n");
+    SAYF(cCYA "afl-gcc-fast" VERSION cRST
+              " initially by <aseipp@pobox.com>, maintainer: hexcoder-\n");
 
   }
 
@@ -288,9 +316,12 @@ int main(int argc, char** argv) {
 
   edit_params(argc, argv);
   /*if (isatty(2) && !getenv("AFL_QUIET")) {
+
             printf("Calling \"%s\" with:\n", cc_params[0]);
             for(int i=1; i<cc_par_cnt; i++) printf("%s\n", cc_params[i]);
+
     }
+
   */
   execvp(cc_params[0], (char**)cc_params);
 
@@ -299,3 +330,4 @@ int main(int argc, char** argv) {
   return 0;
 
 }
+

gcc_plugin/afl-gcc-pass.so.cc

@@ -52,7 +52,8 @@
 #include "../config.h"
 #include "../include/debug.h"
 
-/* clear helper AFL types pulls in, which intervene with gcc-plugin geaders from GCC-8 */
+/* clear helper AFL types pulls in, which intervene with gcc-plugin geaders from
+ * GCC-8 */
 #ifdef likely
 #undef likely
 #endif
@@ -60,7 +61,6 @@
 #undef unlikely
 #endif
 
-
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -98,13 +98,13 @@ static bool inst_ext = true;
 static std::list<std::string> myWhitelist;
 
 static unsigned int ext_call_instrument(function *fun) {
+
   /* Instrument all the things! */
   basic_block bb;
   unsigned    finst_blocks = 0;
   unsigned    fcnt_blocks = 0;
 
-	tree fntype = build_function_type_list(
+  tree fntype = build_function_type_list(void_type_node,          /* return */
-		void_type_node,   /* return */
                                          uint32_type_node,          /* args */
                                          NULL_TREE);                /* done */
   tree fndecl = build_fn_decl("__afl_trace", fntype);
@@ -114,6 +114,7 @@ static unsigned int ext_call_instrument(function *fun) {
   DECL_ARTIFICIAL(fndecl) = 1;                      /* Injected by compiler */
 
   FOR_EACH_BB_FN(bb, fun) {
+
     gimple_seq           fcall;
     gimple_seq           seq = NULL;
     gimple_stmt_iterator bentry;
@@ -128,22 +129,25 @@ static unsigned int ext_call_instrument(function *fun) {
     edge          ep;
     edge_iterator eip;
     FOR_EACH_EDGE(ep, eip, bb->preds) {
+
       int count = 0;
-			if (more_than_one == -1)
+      if (more_than_one == -1) more_than_one = 0;
-				more_than_one = 0;
 
       basic_block   Pred = ep->src;
       edge          es;
       edge_iterator eis;
       FOR_EACH_EDGE(es, eis, Pred->succs) {
+
         basic_block Succ = es->dest;
         if (Succ != NULL) count++;
+
       }
-			if (count > 1)
+
-				more_than_one = 1;
+      if (count > 1) more_than_one = 1;
+
     }
-		if (more_than_one != 1)
+
-			continue;
+    if (more_than_one != 1) continue;
 
     /* Bail on this block if we trip the specified ratio */
     if (R(100) >= inst_ratio) continue;
@@ -158,7 +162,10 @@ static unsigned int ext_call_instrument(function *fun) {
      * void __afl_trace(u32 x);
      */
 
-		fcall = gimple_build_call(fndecl, 1, cur_loc);  /* generate the function _call_ to above built reference, with *1* parameter -> the random const for the location */
+    fcall = gimple_build_call(
+        fndecl, 1,
+        cur_loc); /* generate the function _call_ to above built reference, with
+                     *1* parameter -> the random const for the location */
     gimple_seq_add_stmt(&seq, fcall);         /* and insert into a sequence */
 
     /* Done - grab the entry to the block and insert sequence */
@@ -166,24 +173,26 @@ static unsigned int ext_call_instrument(function *fun) {
     gsi_insert_seq_before(&bentry, seq, GSI_SAME_STMT);
 
     ++finst_blocks;
+
   }
 
   /* Say something nice. */
   if (!be_quiet) {
+
     if (!finst_blocks)
       WARNF(G_("No instrumentation targets found in " cBRI "%s" cRST),
             function_name(fun));
     else if (finst_blocks < fcnt_blocks)
       OKF(G_("Instrumented %2u /%2u locations in " cBRI "%s" cRST),
-					finst_blocks, fcnt_blocks,
+          finst_blocks, fcnt_blocks, function_name(fun));
-					function_name(fun));
     else
-			OKF(G_("Instrumented %2u locations in " cBRI "%s" cRST ),
+      OKF(G_("Instrumented %2u locations in " cBRI "%s" cRST), finst_blocks,
-					finst_blocks,
           function_name(fun));
+
   }
 
   return 0;
+
 }
 
 static unsigned int inline_instrument(function *fun) {
@@ -195,7 +204,8 @@ static unsigned int inline_instrument(function *fun) {
 
   /* Set up global type declarations */
   tree map_type = build_pointer_type(unsigned_char_type_node);
-	tree map_ptr_g = build_decl(UNKNOWN_LOCATION, VAR_DECL,
+  tree map_ptr_g =
+      build_decl(UNKNOWN_LOCATION, VAR_DECL,
                  get_identifier_with_length("__afl_area_ptr", 14), map_type);
   TREE_USED(map_ptr_g) = 1;
   TREE_STATIC(map_ptr_g) = 1;                          /* Defined elsewhere */
@@ -205,7 +215,8 @@ static unsigned int inline_instrument(function *fun) {
   rest_of_decl_compilation(map_ptr_g, 1, 0);
 
   tree prev_loc_g = build_decl(UNKNOWN_LOCATION, VAR_DECL,
-	  get_identifier_with_length("__afl_prev_loc", 14), uint32_type_node);
+                               get_identifier_with_length("__afl_prev_loc", 14),
+                               uint32_type_node);
   TREE_USED(prev_loc_g) = 1;
   TREE_STATIC(prev_loc_g) = 1;                         /* Defined elsewhere */
   DECL_EXTERNAL(prev_loc_g) = 1;                        /* External linkage */
@@ -214,6 +225,7 @@ static unsigned int inline_instrument(function *fun) {
   rest_of_decl_compilation(prev_loc_g, 1, 0);
 
   FOR_EACH_BB_FN(bb, fun) {
+
     gimple_seq           seq = NULL;
     gimple_stmt_iterator bentry;
     ++fcnt_blocks;
@@ -227,22 +239,25 @@ static unsigned int inline_instrument(function *fun) {
     edge          ep;
     edge_iterator eip;
     FOR_EACH_EDGE(ep, eip, bb->preds) {
+
       int count = 0;
-			if (more_than_one == -1)
+      if (more_than_one == -1) more_than_one = 0;
-				more_than_one = 0;
 
       basic_block   Pred = ep->src;
       edge          es;
       edge_iterator eis;
       FOR_EACH_EDGE(es, eis, Pred->succs) {
+
         basic_block Succ = es->dest;
         if (Succ != NULL) count++;
+
       }
-			if (count > 1)
+
-				more_than_one = 1;
+      if (count > 1) more_than_one = 1;
+
     }
-		if (more_than_one != 1)
+
-			continue;
+    if (more_than_one != 1) continue;
 
     /* Bail on this block if we trip the specified ratio */
     if (R(100) >= inst_ratio) continue;
@@ -327,25 +342,26 @@ static unsigned int inline_instrument(function *fun) {
     gsi_insert_seq_before(&bentry, seq, GSI_NEW_STMT);
 
     ++finst_blocks;
+
   }
 
   /* Say something nice. */
   if (!be_quiet) {
+
     if (!finst_blocks)
       WARNF(G_("No instrumentation targets found in " cBRI "%s" cRST),
             function_name(fun));
     else if (finst_blocks < fcnt_blocks)
       OKF(G_("Instrumented %2u /%2u locations in " cBRI "%s" cRST),
-					finst_blocks, fcnt_blocks,
+          finst_blocks, fcnt_blocks, function_name(fun));
-					function_name(fun));
     else
-			OKF(G_("Instrumented   %2u   locations in " cBRI "%s" cRST ),
+      OKF(G_("Instrumented   %2u   locations in " cBRI "%s" cRST), finst_blocks,
-					finst_blocks,
           function_name(fun));
+
   }
 
-
   return 0;
+
 }
 
 /* -------------------------------------------------------------------------- */
@@ -369,64 +385,86 @@ static const struct pass_data afl_pass_data = {
     // names. Do not remove this. Do not taunt Happy Fun
     // Ball.
     .todo_flags_finish = TODO_update_ssa | TODO_verify_il | TODO_cleanup_cfg,
+
 };
 
 namespace {
 
 class afl_pass : public gimple_opt_pass {
+
  private:
   bool do_ext_call;
 
  public:
-	afl_pass(bool ext_call, gcc::context *g) : gimple_opt_pass(afl_pass_data, g), do_ext_call(ext_call) {}
+  afl_pass(bool ext_call, gcc::context *g)
+      : gimple_opt_pass(afl_pass_data, g), do_ext_call(ext_call) {
+
+  }
 
   virtual unsigned int execute(function *fun) {
 
     if (!myWhitelist.empty()) {
+
       bool instrumentBlock = false;
 
       /* EXPR_FILENAME
-			This macro returns the name of the file in which the entity was declared, as
+      This macro returns the name of the file in which the entity was declared,
-			a char*. For an entity declared implicitly by the compiler (like __builtin_
+      as a char*. For an entity declared implicitly by the compiler (like
-			memcpy), this will be the string "<internal>".
+      __builtin_ memcpy), this will be the string "<internal>".
       */
       const char *fname = DECL_SOURCE_FILE(fun->decl);
 
-			if (0 != strncmp("<internal>", fname, 10)
+      if (0 != strncmp("<internal>", fname, 10) &&
-			    && 0 != strncmp("<built-in>", fname, 10))
+          0 != strncmp("<built-in>", fname, 10)) {
-			{
+
         std::string instFilename(fname);
 
         /* Continue only if we know where we actually are */
         if (!instFilename.empty()) {
-					for (std::list<std::string>::iterator it = myWhitelist.begin(); it != myWhitelist.end(); ++it) {
+
+          for (std::list<std::string>::iterator it = myWhitelist.begin();
+               it != myWhitelist.end(); ++it) {
+
             /* We don't check for filename equality here because
              * filenames might actually be full paths. Instead we
              * check that the actual filename ends in the filename
              * specified in the list. */
             if (instFilename.length() >= it->length()) {
-							if (instFilename.compare(instFilename.length() - it->length(), it->length(), *it) == 0) {
+
+              if (instFilename.compare(instFilename.length() - it->length(),
+                                       it->length(), *it) == 0) {
+
                 instrumentBlock = true;
                 break;
+
               }
+
             }
+
           }
+
         }
+
       }
 
       /* Either we couldn't figure out our location or the location is
        * not whitelisted, so we skip instrumentation. */
       if (!instrumentBlock) return 0;
+
     }
 
     return do_ext_call ? ext_call_instrument(fun) : inline_instrument(fun);
+
   }
+
 };                                                        /* class afl_pass */
 
-}  /* anon namespace */
+}  // namespace
 
 static struct opt_pass *make_afl_pass(bool ext_call, gcc::context *ctxt) {
+
   return new afl_pass(ext_call, ctxt);
+
 }
 
 /* -------------------------------------------------------------------------- */
@@ -435,8 +473,10 @@ static struct opt_pass *make_afl_pass(bool ext_call, gcc::context *ctxt) {
 int plugin_is_GPL_compatible = 1;
 
 static struct plugin_info afl_plugin_info = {
+
     .version = "20191015",
     .help = "AFL++ gcc plugin\n",
+
 };
 
 int plugin_init(struct plugin_name_args *  plugin_info,
@@ -459,47 +499,67 @@ int plugin_init(struct plugin_name_args *plugin_info,
   afl_pass_info.pos_op = PASS_POS_INSERT_AFTER;
 
   if (!plugin_default_version_check(version, &gcc_version)) {
+
     FATAL(G_("Incompatible gcc/plugin versions!"));
+
   }
 
   /* Show a banner */
   if (isatty(2) && !getenv("AFL_QUIET")) {
-		SAYF(G_(cCYA "afl-gcc-pass" VERSION cRST " initially by <aseipp@pobox.com>, maintainer: hexcoder-\n"));
+
+    SAYF(G_(cCYA "afl-gcc-pass" VERSION cRST
+                 " initially by <aseipp@pobox.com>, maintainer: hexcoder-\n"));
+
   } else
+
     be_quiet = 1;
 
   /* Decide instrumentation ratio */
   char *inst_ratio_str = getenv("AFL_INST_RATIO");
 
   if (inst_ratio_str) {
-		if (sscanf(inst_ratio_str, "%u", &inst_ratio) != 1 || !inst_ratio || inst_ratio > 100)
+
+    if (sscanf(inst_ratio_str, "%u", &inst_ratio) != 1 || !inst_ratio ||
+        inst_ratio > 100)
       FATAL(G_("Bad value of AFL_INST_RATIO (must be between 1 and 100)"));
     else {
+
       if (!be_quiet)
         ACTF(G_("%s instrumentation at ratio of %u%% in %s mode."),
-					inst_ext ? G_("Call-based") : G_("Inline"),
+             inst_ext ? G_("Call-based") : G_("Inline"), inst_ratio,
-					inst_ratio,
              getenv("AFL_HARDEN") ? G_("hardened") : G_("non-hardened"));
+
     }
+
   }
 
   char *instWhiteListFilename = getenv("AFL_GCC_WHITELIST");
   if (instWhiteListFilename) {
+
     std::string   line;
     std::ifstream fileStream;
     fileStream.open(instWhiteListFilename);
-          if (!fileStream)
+    if (!fileStream) fatal_error(0, "Unable to open AFL_GCC_WHITELIST");
-            fatal_error(0, "Unable to open AFL_GCC_WHITELIST");
     getline(fileStream, line);
     while (fileStream) {
+
       myWhitelist.push_back(line);
       getline(fileStream, line);
+
     }
+
   } else if (!be_quiet && getenv("AFL_LLVM_WHITELIST"))
-          SAYF(cYEL "[-] " cRST "AFL_LLVM_WHITELIST environment variable detected - did you mean AFL_GCC_WHITELIST?\n");
+
+    SAYF(cYEL "[-] " cRST
+              "AFL_LLVM_WHITELIST environment variable detected - did you mean "
+              "AFL_GCC_WHITELIST?\n");
 
   /* Go go gadget */
-	register_callback(plugin_info->base_name, PLUGIN_INFO, NULL, &afl_plugin_info);
+  register_callback(plugin_info->base_name, PLUGIN_INFO, NULL,
-	register_callback(plugin_info->base_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &afl_pass_info);
+                    &afl_plugin_info);
+  register_callback(plugin_info->base_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
+                    &afl_pass_info);
   return 0;
+
 }
+

gcc_plugin/afl-gcc-rt.o.c

@@ -34,27 +34,27 @@
 #include <sys/wait.h>
 #include <sys/types.h>
 
-
 /* Globals needed by the injected instrumentation. The __afl_area_initial region
-   is used for instrumentation output before __afl_map_shm() has a chance to run.
+   is used for instrumentation output before __afl_map_shm() has a chance to
-   It will end up as .comm, so it shouldn't be too wasteful. */
+   run. It will end up as .comm, so it shouldn't be too wasteful. */
 
 u8  __afl_area_initial[MAP_SIZE];
 u8 *__afl_area_ptr = __afl_area_initial;
 u32 __afl_prev_loc;
 
-
 /* Running in persistent mode? */
 
 static u8 is_persistent;
 
 /* Trace a basic block with some ID */
 void __afl_trace(u32 x) {
+
   u32 l = __afl_prev_loc;
   u32 n = l ^ x;
   *(__afl_area_ptr + n) += 1;
   __afl_prev_loc = (x >> 1);
   return;
+
 }
 
 /* SHM setup. */
@@ -86,7 +86,6 @@ static void __afl_map_shm(void) {
 
 }
 
-
 /* Fork server logic. */
 
 static void __afl_start_forkserver(void) {
@@ -115,8 +114,10 @@ static void __afl_start_forkserver(void) {
        process. */
 
     if (child_stopped && was_killed) {
+
       child_stopped = 0;
       if (waitpid(child_pid, &status, 0) < 0) exit(1);
+
     }
 
     if (!child_stopped) {
@@ -150,8 +151,7 @@ static void __afl_start_forkserver(void) {
 
     if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) exit(1);
 
-    if (waitpid(child_pid, &status, is_persistent ? WUNTRACED : 0) < 0)
+    if (waitpid(child_pid, &status, is_persistent ? WUNTRACED : 0) < 0) exit(1);
-      exit(1);
 
     /* In persistent mode, the child stops itself with SIGSTOP to indicate
        a successful run. In this case, we want to wake it up without forking
@@ -167,7 +167,6 @@ static void __afl_start_forkserver(void) {
 
 }
 
-
 /* A simplified persistent mode handler, used as explained in README.llvm. */
 
 int __afl_persistent_loop(unsigned int max_cnt) {
@@ -188,11 +187,12 @@ int __afl_persistent_loop(unsigned int max_cnt) {
     raise(SIGSTOP);
     return 1;
 
-  } else return 0;
+  } else
+
+    return 0;
 
 }
 
-
 /* This one can be called from user code when deferred forkserver mode
     is enabled. */
 
@@ -210,7 +210,6 @@ void __afl_manual_init(void) {
 
 }
 
-
 /* Proper initialization routine. */
 
 __attribute__((constructor(101))) void __afl_auto_init(void) {
@@ -222,3 +221,4 @@ __attribute__((constructor(101))) void __afl_auto_init(void) {
   __afl_manual_init();
 
 }
+

src/afl-fuzz-bitmap.c

@@ -684,9 +684,11 @@ u8 save_if_interesting(char** argv, void* mem, u32 len, u8 fault) {
 
       ++unique_crashes;
 
-      if (infoexec) // if the user wants to be informed on new crashes - do that
+      if (infoexec)  // if the user wants to be informed on new crashes - do
+                     // that
         if (system(infoexec) == -1)
-          hnb += 0; // we dont care if system errors, but we dont want a compiler warning either
+          hnb += 0;  // we dont care if system errors, but we dont want a
+                     // compiler warning either
 
       last_crash_time = get_cur_time();
       last_crash_execs = total_execs;

src/afl-fuzz-init.c

@@ -138,7 +138,8 @@ void bind_to_free_cpu(void) {
 
   for (i = 0; i < proccount; i++) {
 
-    if (procs[i].ki_oncpu < sizeof(cpu_used) && procs[i].ki_pctcpu > 2) cpu_used[procs[i].ki_oncpu] = 1;
+    if (procs[i].ki_oncpu < sizeof(cpu_used) && procs[i].ki_pctcpu > 2)
+      cpu_used[procs[i].ki_oncpu] = 1;
 
   }
 
@@ -166,7 +167,8 @@ void bind_to_free_cpu(void) {
 
   for (i = 0; i < proccount; i++) {
 
-    if (procs[i].p_cpuid < sizeof(cpu_used) && procs[i].p_pctcpu > 0) cpu_used[procs[i].p_cpuid] = 1;
+    if (procs[i].p_cpuid < sizeof(cpu_used) && procs[i].p_pctcpu > 0)
+      cpu_used[procs[i].p_cpuid] = 1;
 
   }
 

src/afl-fuzz-run.c

@@ -288,8 +288,7 @@ void write_to_testcase(void* mem, u32 len) {
 
   if (out_file) {
 
-    unlink(out_file);                                     /* Ignore errors.
+    unlink(out_file);                                     /* Ignore errors. */
-    // */
 
     fd = open(out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
 
@@ -331,8 +330,7 @@ void write_with_gap(void* mem, u32 len, u32 skip_at, u32 skip_len) {
 
   if (out_file) {
 
-    unlink(out_file);                                     /* Ignore errors.
+    unlink(out_file);                                     /* Ignore errors. */
-    // */
 
     fd = open(out_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
 

src/afl-fuzz.c

@@ -76,7 +76,8 @@ static void usage(u8* argv0) {
       "Other stuff:\n"
       "  -T text       - text banner to show on the screen\n"
       "  -M / -S id    - distributed mode (see parallel_fuzzing.txt)\n"
-      "  -I command    - execute this command/script when a new crash is found\n"
+      "  -I command    - execute this command/script when a new crash is "
+      "found\n"
       "  -B bitmap.txt - mutate a specific test case, use the out/fuzz_bitmap "
       "file\n"
       "  -C            - crash exploration mode (the peruvian rabbit thing)\n"
@@ -138,10 +139,7 @@ int main(int argc, char** argv) {
 
     switch (opt) {
 
-      case 'I':
+      case 'I': infoexec = optarg; break;
-
-        infoexec = optarg;
-        break;
 
       case 's': {
 

test-instr.c

@@ -35,7 +35,8 @@ int main(int argc, char** argv) {
 
   }
 
-  // we support three input cases (plus a 4th if stdin is used but there is no input)
+  // we support three input cases (plus a 4th if stdin is used but there is no
+  // input)
   if (buf[0] == '0')
     printf("Looks like a zero to me!\n");
   else if (buf[0] == '1')
@@ -46,3 +47,4 @@ int main(int argc, char** argv) {
   return 0;
 
 }
+

unicorn_mode/patches/afl-unicorn-tcg-runtime-inl.h

@@ -84,11 +84,7 @@ void HELPER(afl_compcov_log_64)(void* uc_ptr, uint64_t cur_loc, uint64_t arg1,
             if ((arg1 & 0xff0000) == (arg2 & 0xff0000)) {
 
               INC_AFL_AREA(cur_loc + 1);
-              if ((arg1 & 0xff00) == (arg2 & 0xff00)) {
+              if ((arg1 & 0xff00) == (arg2 & 0xff00)) { INC_AFL_AREA(cur_loc); }
-
-                INC_AFL_AREA(cur_loc);
-
-              }
 
             }