ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-18 12:48:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

User defined kill signal value (#678)

Browse Source 
* Adding AFL_KILL_SIGNAL environment variable

Controlling the kill signal used to end forked processes.

* Checking validity of AFL_KILL_SIGNAL env variable

This commit also sets a valid value in the environment to avoid
duplicating code in at_exit(). Changing data type of
fsrv->kill_signal to u8 to match last_kill_signal.

* Adding afl_kill_signal to AFL (environment) state

This commit simply introduces a struct member for future use. The
env variable is not used from the afl struct but from fsrv, where
its validity is checked, resulting in a FATAL in case of errors.
This commit is contained in:
buherator
2021-01-07 22:35:34 +01:00
committed by GitHub
parent 52c221fc48
commit 9cdf5c4150
6 changed files with 63 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
src/afl-forkserver.c
View File

@ -95,6 +95,29 @@ void afl_fsrv_init(afl_forkserver_t *fsrv) {
fsrv->uses_asan = false;
fsrv->init_child_func = fsrv_exec_child;
fsrv->kill_signal = SIGKILL;
char *kill_signal_env = get_afl_env("AFL_KILL_SIGNAL");
if (kill_signal_env) {
char *endptr;
u8 signal_code;
signal_code = (u8)strtoul(kill_signal_env, &endptr, 10);
/* Did we manage to parse the full string? */
if (*endptr != '\0' || endptr == kill_signal_env) {
FATAL("Invalid kill signal value!");
}
fsrv->kill_signal = signal_code;
} else {
/* Using hardcoded code for SIGKILL for the sake of simplicity */
setenv("AFL_KILL_SIGNAL", "9", 1);
}
list_append(&fsrv_list, fsrv);
@ -126,6 +149,8 @@ void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) {
fsrv_to->init_child_func = from->init_child_func;
// Note: do not copy ->add_extra_func
fsrv_to->kill_signal = from->kill_signal;
list_append(&fsrv_list, fsrv_to);
}
@ -559,12 +584,12 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
if (!time_ms) {
kill(fsrv->fsrv_pid, SIGKILL);
kill(fsrv->fsrv_pid, fsrv->kill_signal);
} else if (time_ms > fsrv->init_tmout) {
fsrv->last_run_timed_out = 1;
kill(fsrv->fsrv_pid, SIGKILL);
kill(fsrv->fsrv_pid, fsrv->kill_signal);
} else {
@ -944,10 +969,10 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
static void afl_fsrv_kill(afl_forkserver_t *fsrv) {
if (fsrv->child_pid > 0) { kill(fsrv->child_pid, SIGKILL); }
if (fsrv->child_pid > 0) { kill(fsrv->child_pid, fsrv->kill_signal); }
if (fsrv->fsrv_pid > 0) {
kill(fsrv->fsrv_pid, SIGKILL);
kill(fsrv->fsrv_pid, fsrv->kill_signal);
if (waitpid(fsrv->fsrv_pid, NULL, 0) <= 0) { WARNF("error waitpid\n"); }
}
@ -1091,7 +1116,7 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
/* If there was no response from forkserver after timeout seconds,
we kill the child. The forkserver should inform us afterwards */
kill(fsrv->child_pid, SIGKILL);
kill(fsrv->child_pid, fsrv->kill_signal);
fsrv->last_run_timed_out = 1;
if (read(fsrv->fsrv_st_fd, &fsrv->child_status, 4) < 4) { exec_ms = 0; }
@ -1137,6 +1162,15 @@ fsrv_run_result_t afl_fsrv_run_target(afl_forkserver_t *fsrv, u32 timeout,
/* Report outcome to caller. */
/* TODO We use SIGTERM here as an indicator of Xen mode,
although it's not equivalent! */
if (fsrv->kill_signal == SIGTERM && !*stop_soon_p &&
fsrv->last_run_timed_out) {
return FSRV_RUN_TMOUT;
}
if (WIFSIGNALED(fsrv->child_status) && !*stop_soon_p) {
fsrv->last_kill_signal = WTERMSIG(fsrv->child_status);