Merge branch 'master' into colorization

.gitignore

@@ -25,4 +25,9 @@ llvm-[0-9]*.src
 # Don't track UCD files
 UCD-scripts/UCD-*
 UCD-scripts/generated*
+#
+# Don't track tex generated files
+*.log
+*.aux
+*.bcf
 

CMakeLists.txt

@@ -25,16 +25,24 @@ option(DISABLE_DUAL_ABI "Disable GCC Dual ABI support" OFF)
 option(CARRYPACK_MANAGER "Use CarryPack Manager to reduce space required for carries. For testing only." OFF)
 option(USE_ADDRESS_SANITIZER "Enables use of address sanitizer in debug mode if available" OFF)
 
-# Framework build style: default is collection of static libraries
-option(BUILD_SHARED_LIBS "Build framework as a collection of shared libraries" ON)
-option(BUILD_SINGLE_SHARED_LIB "Build framework as a single shared library" OFF)
-
-if(BUILD_SHARED_LIBS AND BUILD_SINGLE_SHARED_LIB)
-    set(BUILD_SHARED_LIBS OFF)
+# Build Artifact Configuration
+set(ARTIFACT_MODE "Multiple" CACHE STRING "Build framework into a single artifact (Single) or multiple artifacts (Multiple)")
+set(ARTIFACT_TYPE "Static" CACHE STRING "Build frameword as shared (Shared) or static (Static) libraries")
+
+# Validate framework build style
+set(VALID_BUILD_MODE "Single" "Multiple")
+set(VALID_BUILD_TYPE "Shared" "Static")
+list(FIND VALID_BUILD_MODE ${ARTIFACT_MODE} __am_index)
+if(__am_index EQUAL -1)
+    message(FATAL_ERROR "ARTIFACT_MODE must be either Single or Multiple")
+endif()
+list(FIND VALID_BUILD_TYPE ${ARTIFACT_TYPE} __at_index)
+if(__at_index EQUAL -1)
+    message(FATAL_ERROR "ARTIFACT_TYPE must be either Shared or Static")
 endif()
 
 # Target for single shared library
-set(PARABIX_MONO_TARGET parabix_framework)
+set(PARABIX_MONO_TARGET parabix)
 
 
 # Ensure custom FindXYZ.cmake files are found
@@ -115,11 +123,15 @@ set(CMAKE_MACOSX_RPATH ON)
 
 # Enable all warnings
 set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wall -pedantic")
+if (${LLVM_PACKAGE_VERSION} VERSION_LESS "6.0")
+# LLVM 5 and earlier generate many warnings about deprecated declarations; suppress these.
+set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wno-deprecated-declarations")
+endif()
 
 include(CheckCXXCompilerFlag)
 check_cxx_compiler_flag("-fvisibility-inlines-hidden" SUPPORTS_FVISIBILITY_INLINES_HIDDEN_FLAG)
 if(SUPPORTS_FVISIBILITY_INLINES_HIDDEN_FLAG)
-    set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -fvisibility-inlines-hidden")
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fvisibility-inlines-hidden")
 endif()
 
 # no pie disables the generation of position-independent executables, which is a default security feature of newer compiles
@@ -175,7 +187,7 @@ endfunction(parabix_set_library_name)
 
 include(CMakeParseArguments)
 
-if (CMAKE_BUILD_TYPE STREQUAL "Debug" AND NOT BUILD_SHARED_LIBS)
+if (CMAKE_BUILD_TYPE STREQUAL "Debug" AND ARTIFACT_TYPE STREQUAL "Static")
     set(CMAKE_POSITION_INDEPENDENT_CODE OFF)
 
     # Add assertion debug symbol support checks
@@ -218,16 +230,15 @@ function(parabix_add_module)
     if(NOT ARG_NAME)
         message(FATAL_ERROR "parabix_add_module: A target name is required")
     endif()
-    if(BUILD_SINGLE_SHARED_LIB)
+    if(ARTIFACT_MODE STREQUAL "Single")
         foreach(SRC ${ARG_SRC})
             target_sources(${PARABIX_MONO_TARGET} PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/${SRC})
         endforeach()
     else()
-        if(BUILD_SHARED_LIBS)
-            add_library(${ARG_NAME} SHARED ${ARG_SRC})
-            parabix_set_library_name(${ARG_NAME})
-        else() # build static
+        if(ARTIFACT_TYPE STREQUAL "Static")
             add_library(${ARG_NAME} STATIC ${ARG_SRC})
+        else()
+            add_library(${ARG_NAME} SHARED ${ARG_SRC})
         endif()
         parabix_set_library_name(${ARG_NAME})
         target_link_libraries(${ARG_NAME} ${ARG_DEPS})
@@ -249,7 +260,7 @@ function(parabix_add_executable)
         message(FATAL_ERROR "parabix_add_executable: A target name is required")
     endif()
     add_executable(${ARG_NAME} ${ARG_SRC})
-    if(BUILD_SINGLE_SHARED_LIB)
+    if(ARTIFACT_MODE STREQUAL "Single")
         target_link_libraries(${ARG_NAME} ${PARABIX_MONO_TARGET})
     else()
         target_link_libraries(${ARG_NAME} ${ARG_DEPS})
@@ -274,8 +285,12 @@ endfunction(parabix_add_pablo_src)
 
 ###   Add Subdirectories   ###
 
-if(BUILD_SINGLE_SHARED_LIB)
-    add_library(${PARABIX_MONO_TARGET} SHARED "")
+if(ARTIFACT_MODE STREQUAL "Single")
+    if(ARTIFACT_TYPE STREQUAL "Static")
+        add_library(${PARABIX_MONO_TARGET} STATIC "")
+    else()
+        add_library(${PARABIX_MONO_TARGET} SHARED "")
+    endif()
 endif()
 
 # Framework Libraries
@@ -328,8 +343,8 @@ add_subdirectory(tools/util)
 # Kernel Tests
 add_subdirectory(tests)
 
-# Target definition for single shared library
-if(BUILD_SINGLE_SHARED_LIB)
+# Target definition for single library
+if(ARTIFACT_MODE STREQUAL "Single")
     target_link_libraries(${PARABIX_MONO_TARGET} ${REQ_LLVM_LIBRARIES} ${Boost_LIBRARIES})
 endif()
 

QA/FuzzTesting/AFL-Files/Makefile

-#
-# american fuzzy lop - makefile
-# -----------------------------
-#
-# Written and maintained by Michal Zalewski <lcamtuf@google.com>
-# 
-# Copyright 2013, 2014, 2015, 2016 Google Inc. All rights reserved.
-# 
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-# 
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-
-PROGNAME    = afl
-VERSION     = 2.08b
-
-PREFIX     ?= /usr/local
-BIN_PATH    = $(PREFIX)/bin
-HELPER_PATH = $(PREFIX)/lib/afl
-DOC_PATH    = $(PREFIX)/share/doc/afl
-MISC_PATH   = $(PREFIX)/share/afl
-
-# PROGS intentionally omit afl-as, which gets installed to its own dir.
-
-PROGS       = afl-gcc afl-fuzz afl-showmap afl-tmin afl-gotcpu afl-analyze
-SH_PROGS    = afl-plot afl-cmin afl-whatsup
-
-CFLAGS     ?= -O3 -funroll-loops
-CFLAGS     += -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign \
-	      -DAFL_PATH=\"$(HELPER_PATH)\" -DDOC_PATH=\"$(DOC_PATH)\" \
-	      -DBIN_PATH=\"$(BIN_PATH)\" -DVERSION=\"$(VERSION)\"
-
-ifneq "$(filter Linux GNU%,$(shell uname))" ""
-  LDFLAGS  += -ldl
-endif
-
-ifeq "$(findstring clang, $(shell $(CC) --version 2>/dev/null))" ""
-  TEST_CC   = afl-gcc
-else
-  TEST_CC   = afl-clang
-endif
-
-COMM_HDR    = alloc-inl.h config.h debug.h types.h
-
-all: test_x86 $(PROGS) afl-as test_build all_done
-
-ifndef AFL_NO_X86
-
-test_x86:
-	@echo "[*] Checking for the ability to compile x86 code..."
-	@echo 'main() { __asm__("xorb %al, %al"); }' | $(CC) -w -x c - -o .test || ( echo; echo "Oops, looks like your compiler can't generate x86 code."; echo; echo "You can still try using the LLVM or QEMU mode, but see docs/INSTALL first."; echo "To ignore this error, set AFL_NO_X86=1."; echo; exit 1 )
-	@rm -f .test
-	@echo "[+] Everything seems to be working, ready to compile."
-
-else
-
-test_x86:
-	@echo "[!] Note: skipping x86 compilation checks (AFL_NO_X86 set)."
-
-endif
-
-afl-gcc: afl-gcc.c $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $@.c -o $@ $(LDFLAGS)
-	set -e; for i in afl-g++ afl-clang afl-clang++; do ln -sf afl-gcc $$i; done
-
-afl-as: afl-as.c afl-as.h $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $@.c -o $@ $(LDFLAGS) 
-	ln -sf afl-as as
-
-afl-fuzz: afl-fuzz.c $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $@.c -o $@ $(LDFLAGS)
-
-afl-showmap: afl-showmap.c $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $@.c -o $@ $(LDFLAGS)
-
-afl-tmin: afl-tmin.c $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $@.c -o $@ $(LDFLAGS)
-
-afl-analyze: afl-analyze.c $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $@.c -o $@ $(LDFLAGS)
-
-afl-gotcpu: afl-gotcpu.c $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $@.c -o $@ $(LDFLAGS)
-
-ifndef AFL_NO_X86
-
-test_build: afl-gcc afl-as afl-showmap
-	@echo "[*] Testing the CC wrapper and instrumentation output..."
-	unset AFL_USE_ASAN AFL_USE_MSAN; AFL_QUIET=1 AFL_INST_RATIO=100 AFL_PATH=. ./$(TEST_CC) $(CFLAGS) test-instr.c -o test-instr $(LDFLAGS)
-	echo 0 | ./afl-showmap -m none -q -o .test-instr0 ./test-instr
-	echo 1 | ./afl-showmap -m none -q -o .test-instr1 ./test-instr
-	@rm -f test-instr
-	@cmp -s .test-instr0 .test-instr1; DR="$$?"; rm -f .test-instr0 .test-instr1; if [ "$$DR" = "0" ]; then echo; echo "Oops, the instrumentation does not seem to be behaving correctly!"; echo; echo "Please ping <lcamtuf@google.com> to troubleshoot the issue."; echo; exit 1; fi
-	@echo "[+] All right, the instrumentation seems to be working!"
-
-else
-
-test_build: afl-gcc afl-as afl-showmap
-	@echo "[!] Note: skipping build tests (you may need to use LLVM or QEMU mode)."
-
-endif
-
-all_done: test_build
-	@echo "[+] All done! Be sure to review README - it's pretty short and useful."
-	@if [ "`uname`" = "Darwin" ]; then printf "\nWARNING: Fuzzing on MacOS X is slow because of the unusually high overhead of\nfork() on this OS. Consider using Linux or *BSD. You can also use VirtualBox\n(virtualbox.org) to put AFL inside a Linux or *BSD VM.\n\n"; fi
-	@! tty <&1 >/dev/null || printf "\033[0;30mNOTE: If you can read this, your terminal probably uses white background.\nThis will make the UI hard to read. See docs/status_screen.txt for advice.\033[0m\n" 2>/dev/null
-
-.NOTPARALLEL: clean
-
-clean:
-	rm -f $(PROGS) afl-as as afl-g++ afl-clang afl-clang++ *.o *~ a.out core core.[1-9][0-9]* *.stackdump test .test test-instr .test-instr0 .test-instr1 qemu_mode/qemu-2.3.0.tar.bz2 afl-qemu-trace
-	rm -rf out_dir qemu_mode/qemu-2.3.0
-	$(MAKE) -C llvm_mode clean
-
-install: all
-	mkdir -p -m 755 $${DESTDIR}$(BIN_PATH) $${DESTDIR}$(HELPER_PATH) $${DESTDIR}$(DOC_PATH) $${DESTDIR}$(MISC_PATH)
-	rm -f $${DESTDIR}$(BIN_PATH)/afl-plot.sh
-	install -m 755 $(PROGS) $(SH_PROGS) $${DESTDIR}$(BIN_PATH)
-	rm -f $${DESTDIR}$(BIN_PATH)/afl-as
-	if [ -f afl-qemu-trace ]; then install -m 755 afl-qemu-trace $${DESTDIR}$(BIN_PATH); fi
-	if [ -f afl-clang-fast -a -f afl-llvm-pass.so -a -f afl-llvm-rt.o ]; then set -e; install -m 755 afl-clang-fast $${DESTDIR}$(BIN_PATH); ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang-fast++; install -m 755 afl-llvm-pass.so afl-llvm-rt.o $${DESTDIR}$(HELPER_PATH); fi
-	if [ -f afl-llvm-rt-32.o ]; then set -e; install -m 755 afl-llvm-rt-32.o $${DESTDIR}$(HELPER_PATH); fi
-	if [ -f afl-llvm-rt-64.o ]; then set -e; install -m 755 afl-llvm-rt-64.o $${DESTDIR}$(HELPER_PATH); fi
-	set -e; for i in afl-g++ afl-clang afl-clang++; do ln -sf afl-gcc $${DESTDIR}$(BIN_PATH)/$$i; done
-	install -m 755 afl-as $${DESTDIR}$(HELPER_PATH)
-	ln -sf afl-as $${DESTDIR}$(HELPER_PATH)/as
-	install -m 644 docs/README docs/ChangeLog docs/*.txt $${DESTDIR}$(DOC_PATH)
-	cp -r testcases/ $${DESTDIR}$(MISC_PATH)
-
-publish: clean
-	test "`basename $$PWD`" = "afl" || exit 1
-	test -f ~/www/afl/releases/$(PROGNAME)-$(VERSION).tgz; if [ "$$?" = "0" ]; then echo; echo "Change program version in Makefile, mmkay?"; echo; exit 1; fi
-	cd ..; rm -rf $(PROGNAME)-$(VERSION); cp -pr $(PROGNAME) $(PROGNAME)-$(VERSION); \
-	  tar -cvz -f ~/www/afl/releases/$(PROGNAME)-$(VERSION).tgz $(PROGNAME)-$(VERSION)
-	chmod 644 ~/www/afl/releases/$(PROGNAME)-$(VERSION).tgz
-	( cd ~/www/afl/releases/; ln -s -f $(PROGNAME)-$(VERSION).tgz $(PROGNAME)-latest.tgz )
-	cat docs/README >~/www/afl/README.txt
-	cat docs/status_screen.txt >~/www/afl/status_screen.txt
-	cat docs/historical_notes.txt >~/www/afl/historical_notes.txt
-	cat docs/technical_details.txt >~/www/afl/technical_details.txt
-	cat docs/ChangeLog >~/www/afl/ChangeLog.txt
-	cat docs/QuickStartGuide.txt >~/www/afl/QuickStartGuide.txt
-	echo -n "$(VERSION)" >~/www/afl/version.txt

QA/FuzzTesting/AFL-Files/QuickStartGuide.txt

-docs/QuickStartGuide.txt
\ No newline at end of file

QA/FuzzTesting/AFL-Files/README

-docs/README
\ No newline at end of file

QA/FuzzTesting/AFL-Files/afl-as.c

-/*
-   american fuzzy lop - wrapper for GNU as
-   ---------------------------------------
-
-   Written and maintained by Michal Zalewski <lcamtuf@google.com>
-
-   Copyright 2013, 2014, 2015 Google Inc. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   The sole purpose of this wrapper is to preprocess assembly files generated
-   by GCC / clang and inject the instrumentation bits included from afl-as.h. It
-   is automatically invoked by the toolchain when compiling programs using
-   afl-gcc / afl-clang.
-
-   Note that it's an explicit non-goal to instrument hand-written assembly,
-   be it in separate .s files or in __asm__ blocks. The only aspiration this
-   utility has right now is to be able to skip them gracefully and allow the
-   compilation process to continue.
-
-   That said, see experimental/clang_asm_normalize/ for a solution that may
-   allow clang users to make things work even with hand-crafted assembly. Just
-   note that there is no equivalent for GCC.
-
- */
-
-#define AFL_MAIN
-
-#include "config.h"
-#include "types.h"
-#include "debug.h"
-#include "alloc-inl.h"
-
-#include "afl-as.h"
-
-#include <stdio.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <string.h>
-#include <time.h>
-#include <ctype.h>
-#include <fcntl.h>
-
-#include <sys/wait.h>
-#include <sys/time.h>
-
-static u8** as_params;          /* Parameters passed to the real 'as'   */
-
-static u8*  input_file;         /* Originally specified input file      */
-static u8*  modified_file;      /* Instrumented file for the real 'as'  */
-
-static u8   be_quiet,           /* Quiet mode (no stderr output)        */
-            clang_mode,         /* Running in clang mode?               */
-            pass_thru,          /* Just pass data through?              */
-            just_version;       /* Just show version?                   */
-
-static u32  inst_ratio = 100,   /* Instrumentation probability (%)      */
-            as_par_cnt = 1;     /* Number of params to 'as'             */
-
-/* If we don't find --32 or --64 in the command line, default to 
-   instrumentation for whichever mode we were compiled with. This is not
-   perfect, but should do the trick for almost all use cases. */
-
-#ifdef __x86_64__
-
-static u8   use_64bit = 1;
-
-#else
-
-static u8   use_64bit = 0;
-
-#ifdef __APPLE__
-#  error "Sorry, 32-bit Apple platforms are not supported."
-#endif /* __APPLE__ */
-
-#endif /* ^__x86_64__ */
-
-
-/* Examine and modify parameters to pass to 'as'. Note that the file name
-   is always the last parameter passed by GCC, so we exploit this property
-   to keep the code simple. */
-
-static void edit_params(int argc, char** argv) {
-
-  u8 *tmp_dir = getenv("TMPDIR"), *afl_as = getenv("AFL_AS");
-  u32 i;
-
-#ifdef __APPLE__
-
-  u8 use_clang_as = 0;
-
-  /* On MacOS X, the Xcode cctool 'as' driver is a bit stale and does not work
-     with the code generated by newer versions of clang that are hand-built
-     by the user. See the thread here: http://goo.gl/HBWDtn.
-
-     To work around this, when using clang and running without AFL_AS
-     specified, we will actually call 'clang -c' instead of 'as -q' to
-     compile the assembly file.
-
-     The tools aren't cmdline-compatible, but at least for now, we can
-     seemingly get away with this by making only very minor tweaks. Thanks
-     to Nico Weber for the idea. */
-
-  if (clang_mode && !afl_as) {
-
-    use_clang_as = 1;
-
-    afl_as = getenv("AFL_CC");
-    if (!afl_as) afl_as = getenv("AFL_CXX");
-    if (!afl_as) afl_as = "clang";
-
-  }
-
-#endif /* __APPLE__ */
-
-  /* Although this is not documented, GCC also uses TEMP and TMP when TMPDIR
-     is not set. We need to check these non-standard variables to properly
-     handle the pass_thru logic later on. */
-
-  if (!tmp_dir) tmp_dir = getenv("TEMP");
-  if (!tmp_dir) tmp_dir = getenv("TMP");
-  if (!tmp_dir) tmp_dir = "/tmp";
-
-  as_params = ck_alloc((argc + 32) * sizeof(u8*));
-
-  as_params[0] = afl_as ? afl_as : (u8*)"as";
-
-  as_params[argc] = 0;
-
-  for (i = 1; i < argc - 1; i++) {
-
-    if (!strcmp(argv[i], "--64")) use_64bit = 1;
-    else if (!strcmp(argv[i], "--32")) use_64bit = 0;
-
-#ifdef __APPLE__
-
-    /* The Apple case is a bit different... */
-
-    if (!strcmp(argv[i], "-arch") && i + 1 < argc) {
-
-      if (!strcmp(argv[i + 1], "x86_64")) use_64bit = 1;
-      else if (!strcmp(argv[i + 1], "i386"))
-        FATAL("Sorry, 32-bit Apple platforms are not supported.");
-
-    }
-
-    /* Strip options that set the preference for a particular upstream
-       assembler in Xcode. */
-
-    if (clang_mode && (!strcmp(argv[i], "-q") || !strcmp(argv[i], "-Q")))
-      continue;
-
-#endif /* __APPLE__ */
-
-    as_params[as_par_cnt++] = argv[i];
-
-  }
-
-#ifdef __APPLE__
-
-  /* When calling clang as the upstream assembler, append -c -x assembler
-     and hope for the best. */
-
-  if (use_clang_as) {
-
-    as_params[as_par_cnt++] = "-c";
-    as_params[as_par_cnt++] = "-x";
-    as_params[as_par_cnt++] = "assembler";
-
-  }
-
-#endif /* __APPLE__ */
-
-  input_file = argv[argc - 1];
-
-  if (input_file[0] == '-') {
-
-    if (!strcmp(input_file + 1, "-version")) {
-      just_version = 1;
-      modified_file = input_file;
-      goto wrap_things_up;
-    }
-
-    if (input_file[1]) FATAL("Incorrect use (not called through afl-gcc?)");
-      else input_file = NULL;
-
-  } else {
-
-    /* Check if this looks like a standard invocation as a part of an attempt
-       to compile a program, rather than using gcc on an ad-hoc .s file in
-       a format we may not understand. This works around an issue compiling
-       NSS. */
-
-    if (strncmp(input_file, tmp_dir, strlen(tmp_dir)) &&
-        strncmp(input_file, "/var/tmp/", 9) &&
-        strncmp(input_file, "/tmp/", 5)) pass_thru = 1;
-
-  }
-
-  modified_file = alloc_printf("%s/.afl-%u-%u.s", tmp_dir, getpid(),
-                               (u32)time(NULL));
-
-wrap_things_up:
-
-  as_params[as_par_cnt++] = modified_file;
-  as_params[as_par_cnt]   = NULL;
-
-}
-
-
-/* Process input file, generate modified_file. Insert instrumentation in all
-   the appropriate places. */
-
-static void add_instrumentation(void) {
-
-  static u8 line[MAX_LINE];
-
-  FILE* inf;
-  FILE* outf;
-  s32 outfd;
-  u32 ins_lines = 0;
-
-  u8  instr_ok = 0, skip_csect = 0, skip_next_label = 0,
-      skip_intel = 0, skip_app = 0, instrument_next = 0;
-
-#ifdef __APPLE__
-
-  u8* colon_pos;
-
-#endif /* __APPLE__ */
-
-  if (input_file) {
-
-    inf = fopen(input_file, "r");
-    if (!inf) PFATAL("Unable to read '%s'", input_file);
-
-  } else inf = stdin;
-
-  outfd = open(modified_file, O_WRONLY | O_EXCL | O_CREAT, 0600);
-
-  if (outfd < 0) PFATAL("Unable to write to '%s'", modified_file);
-
-  outf = fdopen(outfd, "w");
-
-  if (!outf) PFATAL("fdopen() failed");  
-
-  while (fgets(line, MAX_LINE, inf)) {
-
-    /* In some cases, we want to defer writing the instrumentation trampoline
-       until after all the labels, macros, comments, etc. If we're in this
-       mode, and if the line starts with a tab followed by a character, dump
-       the trampoline now. */
-
-    if (!pass_thru && !skip_intel && !skip_app && !skip_csect && instr_ok &&
-        instrument_next && line[0] == '\t' && isalpha(line[1])) {
-
-      fprintf(outf, use_64bit ? trampoline_fmt_64 : trampoline_fmt_32,
-              R(MAP_SIZE));
-
-      instrument_next = 0;
-      ins_lines++;
-
-    }
-
-    /* Output the actual line, call it a day in pass-thru mode. */
-
-    fputs(line, outf);
-
-    if (pass_thru) continue;
-
-    /* All right, this is where the actual fun begins. For one, we only want to
-       instrument the .text section. So, let's keep track of that in processed
-       files - and let's set instr_ok accordingly. */
-
-    if (line[0] == '\t' && line[1] == '.') {
-
-      /* OpenBSD puts jump tables directly inline with the code, which is
-         a bit annoying. They use a specific format of p2align directives
-         around them, so we use that as a signal. */
-
-      if (!clang_mode && instr_ok && !strncmp(line + 2, "p2align ", 8) &&
-          isdigit(line[10]) && line[11] == '\n') skip_next_label = 1;
-
-      if (!strncmp(line + 2, "text\n", 5) ||
-          !strncmp(line + 2, "section\t.text", 13) ||
-          !strncmp(line + 2, "section\t__TEXT,__text", 21) ||
-          !strncmp(line + 2, "section __TEXT,__text", 21)) {
-        instr_ok = 1;
-        continue; 
-      }
-
-      if (!strncmp(line + 2, "section\t", 8) ||
-          !strncmp(line + 2, "section ", 8) ||
-          !strncmp(line + 2, "bss\n", 4) ||
-          !strncmp(line + 2, "data\n", 5)) {
-        instr_ok = 0;
-        continue;
-      }
-
-    }
-
-    /* Detect off-flavor assembly (rare, happens in gdb). When this is
-       encountered, we set skip_csect until the opposite directive is
-       seen, and we do not instrument. */
-
-    if (strstr(line, ".code")) {
-
-      if (strstr(line, ".code32")) skip_csect = use_64bit;
-      if (strstr(line, ".code64")) skip_csect = !use_64bit;
-
-    }
-
-    /* Detect syntax changes, as could happen with hand-written assembly.
-       Skip Intel blocks, resume instrumentation when back to AT&T. */
-
-    if (strstr(line, ".intel_syntax")) skip_intel = 1;
-    if (strstr(line, ".att_syntax")) skip_intel = 0;
-
-    /* Detect and skip ad-hoc __asm__ blocks, likewise skipping them. */
-
-    if (line[0] == '#' || line[1] == '#') {
-
-      if (strstr(line, "#APP")) skip_app = 1;
-      if (strstr(line, "#NO_APP")) skip_app = 0;
-
-    }
-
-    /* If we're in the right mood for instrumenting, check for function
-       names or conditional labels. This is a bit messy, but in essence,
-       we want to catch:
-
-         ^main:      - function entry point (always instrumented)
-         ^.L0:       - GCC branch label
-         ^.LBB0_0:   - clang branch label (but only in clang mode)
-         ^\tjnz foo  - conditional branches
-
-       ...but not:
-
-         ^# BB#0:    - clang comments
-         ^ # BB#0:   - ditto
-         ^.Ltmp0:    - clang non-branch labels
-         ^.LC0       - GCC non-branch labels
-         ^.LBB0_0:   - ditto (when in GCC mode)
-         ^\tjmp foo  - non-conditional jumps
-
-       Additionally, clang and GCC on MacOS X follow a different convention
-       with no leading dots on labels, hence the weird maze of #ifdefs
-       later on.
-
-     */
-
-    if (skip_intel || skip_app || skip_csect || !instr_ok ||
-        line[0] == '#' || line[0] == ' ') continue;
-
-    /* Conditional branch instruction (jnz, etc). We append the instrumentation
-       right after the branch (to instrument the not-taken path) and at the
-       branch destination label (handled later on). */
-
-    if (line[0] == '\t') {
-
-      if (line[1] == 'j' && line[2] != 'm' && R(100) < inst_ratio) {
-
-        fprintf(outf, use_64bit ? trampoline_fmt_64 : trampoline_fmt_32,
-                R(MAP_SIZE));
-
-        ins_lines++;
-
-      }
-
-      continue;
-
-    }
-
-    /* Label of some sort. This may be a branch destination, but we need to
-       tread carefully and account for several different formatting
-       conventions. */
-
-#ifdef __APPLE__
-
-    /* Apple: L<whatever><digit>: */
-
-    if ((colon_pos = strstr(line, ":"))) {
-
-      if (line[0] == 'L' && isdigit(*(colon_pos - 1))) {
-
-#else
-
-    /* Everybody else: .L<whatever>: */
-
-    if (strstr(line, ":")) {
-
-      if (line[0] == '.') {
-
-#endif /* __APPLE__ */
-
-        /* .L0: or LBB0_0: style jump destination */
-
-#ifdef __APPLE__
-
-        /* Apple: L<num> / LBB<num> */
-
-        if ((isdigit(line[1]) || (clang_mode && !strncmp(line, "LBB", 3)))
-            && R(100) < inst_ratio) {
-
-#else
-
-        /* Apple: .L<num> / .LBB<num> */
-
-        if ((isdigit(line[2]) || (clang_mode && !strncmp(line + 1, "LBB", 3)))
-            && R(100) < inst_ratio) {
-
-#endif /* __APPLE__ */
-
-          /* An optimization is possible here by adding the code only if the
-             label is mentioned in the code in contexts other than call / jmp.
-             That said, this complicates the code by requiring two-pass
-             processing (messy with stdin), and results in a speed gain
-             typically under 10%, because compilers are generally pretty good
-             about not generating spurious intra-function jumps.
-
-             We use deferred output chiefly to avoid disrupting
-             .Lfunc_begin0-style exception handling calculations (a problem on
-             MacOS X). */
-
-          if (!skip_next_label) instrument_next = 1; else skip_next_label = 0;
-
-        }
-
-      } else {
-
-        /* Function label (always instrumented, deferred mode). */
-
-        instrument_next = 1;
-    
-      }
-
-    }
-
-  }
-
-  if (ins_lines)
-    fputs(use_64bit ? main_payload_64 : main_payload_32, outf);
-
-  if (input_file) fclose(inf);
-  fclose(outf);
-
-  if (!be_quiet) {
-
-    if (!ins_lines) WARNF("No instrumentation targets found%s.",
-                          pass_thru ? " (pass-thru mode)" : "");
-    else OKF("Instrumented %u locations (%s-bit, %s mode, ratio %u%%).",
-             ins_lines, use_64bit ? "64" : "32",
-             getenv("AFL_HARDEN") ? "hardened" : "non-hardened",
-             inst_ratio);
- 
-  }
-
-}
-
-
-/* Main entry point */
-
-int main(int argc, char** argv) {
-
-  s32 pid;
-  u32 rand_seed;
-  int status;
-  u8* inst_ratio_str = getenv("AFL_INST_RATIO");
-
-  struct timeval tv;
-  struct timezone tz;
-
-  clang_mode = !!getenv(CLANG_ENV_VAR);
-
-  if (isatty(2) && !getenv("AFL_QUIET")) {
-
-    SAYF(cCYA "afl-as " cBRI VERSION cRST " by <lcamtuf@google.com>\n");
- 
-  } else be_quiet = 1;
-
-  if (argc < 2) {
-
-    SAYF("\n"
-         "This is a helper application for afl-fuzz. It is a wrapper around GNU 'as',\n"
-         "executed by the toolchain whenever using afl-gcc or afl-clang. You probably\n"
-         "don't want to run this program directly.\n\n"
-
-         "Rarely, when dealing with extremely complex projects, it may be advisable to\n"
-         "set AFL_INST_RATIO to a value less than 100 in order to reduce the odds of\n"
-         "instrumenting every discovered branch.\n\n");
-
-    exit(1);
-
-  }
-
-  gettimeofday(&tv, &tz);
-
-  rand_seed = tv.tv_sec ^ tv.tv_usec ^ getpid();
-
-  srandom(rand_seed);
-
-  edit_params(argc, argv);
-
-  if (inst_ratio_str) {
-
-    if (sscanf(inst_ratio_str, "%u", &inst_ratio) != 1 || inst_ratio > 100) 
-      FATAL("Bad value of AFL_INST_RATIO (must be between 0 and 100)");
-
-  }
-
-  if (getenv(AS_LOOP_ENV_VAR))
-    FATAL("Endless loop when calling 'as' (remove '.' from your PATH)");
-
-  setenv(AS_LOOP_ENV_VAR, "1", 1);
-
-  /* When compiling with ASAN, we don't have a particularly elegant way to skip
-     ASAN-specific branches. But we can probabilistically compensate for
-     that... */
-
-  if (getenv("AFL_USE_ASAN") || getenv("AFL_USE_MSAN")) inst_ratio /= 3;
-
-  if (!just_version) add_instrumentation();
-
-  if (!(pid = fork())) {
-
-    execvp(as_params[0], (char**)as_params);
-    FATAL("Oops, failed to execute '%s' - check your PATH", as_params[0]);
-
-  }
-
-  if (pid < 0) PFATAL("fork() failed");
-
-  if (waitpid(pid, &status, 0) <= 0) PFATAL("waitpid() failed");
-
-  if (!getenv("AFL_KEEP_ASSEMBLY")) unlink(modified_file);
-
-  exit(WEXITSTATUS(status));
-
-}
-

QA/FuzzTesting/AFL-Files/afl-clang

-afl-gcc
\ No newline at end of file

QA/FuzzTesting/AFL-Files/afl-clang++

-afl-gcc
\ No newline at end of file

QA/FuzzTesting/AFL-Files/afl-cmin

-#!/usr/bin/env bash
-#
-# american fuzzy lop - corpus minimization tool
-# ---------------------------------------------
-#
-# Written and maintained by Michal Zalewski <lcamtuf@google.com>
-#
-# Copyright 2014, 2015 Google Inc. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# This tool tries to find the smallest subset of files in the input directory
-# that still trigger the full range of instrumentation data points seen in
-# the starting corpus. This has two uses:
-#
-#   - Screening large corpora of input files before using them as a seed for
-#     afl-fuzz. The tool will remove functionally redundant files and likely
-#     leave you with a much smaller set.
-#
-#     (In this case, you probably also want to consider running afl-tmin on
-#     the individual files later on to reduce their size.)
-#
-#   - Minimizing the corpus generated organically by afl-fuzz, perhaps when
-#     planning to feed it to more resource-intensive tools. The tool achieves
-#     this by removing all entries that used to trigger unique behaviors in the
-#     past, but have been made obsolete by later finds.
-#
-# Note that the tool doesn't modify the files themselves. For that, you want
-# afl-tmin.
-#
-# This script must use bash because other shells may have hardcoded limits on
-# array sizes.
-#
-
-echo "corpus minimization tool for afl-fuzz by <lcamtuf@google.com>"
-echo
-
-#########
-# SETUP #
-#########
-
-# Process command-line options...
-
-MEM_LIMIT=100
-TIMEOUT=none
-
-unset IN_DIR OUT_DIR STDIN_FILE EXTRA_PAR MEM_LIMIT_GIVEN \
-  AFL_CMIN_CRASHES_ONLY AFL_CMIN_ALLOW_ANY QEMU_MODE
-
-while getopts "+i:o:f:m:t:eQC" opt; do
-
-  case "$opt" in 
-
-    "i")
-         IN_DIR="$OPTARG"
-         ;;
-
-    "o")
-         OUT_DIR="$OPTARG"
-         ;;
-    "f")
-         STDIN_FILE="$OPTARG"
-         ;;
-    "m")
-         MEM_LIMIT="$OPTARG"
-         MEM_LIMIT_GIVEN=1
-         ;;
-    "t")
-         TIMEOUT="$OPTARG"
-         ;;
-    "e")
-         EXTRA_PAR="$EXTRA_PAR -e"
-         ;;
-    "C")
-         export AFL_CMIN_CRASHES_ONLY=1
-         ;;
-    "Q")
-         EXTRA_PAR="$EXTRA_PAR -Q"
-         test "$MEM_LIMIT_GIVEN" = "" && MEM_LIMIT=250
-         QEMU_MODE=1
-         ;;
-    "?")
-         exit 1
-         ;;
-
-   esac
-
-done
-
-shift $((OPTIND-1))
-
-TARGET_BIN="$1"
-
-if [ "$TARGET_BIN" = "" -o "$IN_DIR" = "" -o "$OUT_DIR" = "" ]; then
-
-  cat 1>&2 <<_EOF_
-Usage: $0 [ options ] -- /path/to/target_app [ ... ]
-
-Required parameters:
-
-  -i dir        - input directory with the starting corpus
-  -o dir        - output directory for minimized files
-
-Execution control settings:
-
-  -f file       - location read by the fuzzed program (stdin)
-  -m megs       - memory limit for child process ($MEM_LIMIT MB)
-  -t msec       - run time limit for child process (none)
-  -Q            - use binary-only instrumentation (QEMU mode)
-
-Minimization settings:
-
-  -C            - keep crashing inputs, reject everything else
-  -e            - solve for edge coverage only, ignore hit counts
-
-For additional tips, please consult docs/README.
-
-_EOF_
-  exit 1
-fi
-
-# Do a sanity check to discourage the use of /tmp, since we can't really
-# handle this safely from a shell script.
-
-echo "$IN_DIR" | grep -qE '^(/var)?/tmp/'
-T1="$?"
-
-echo "$TARGET_BIN" | grep -qE '^(/var)?/tmp/'
-T2="$?"
-
-echo "$OUT_DIR" | grep -qE '^(/var)?/tmp/'
-T3="$?"
-
-echo "$STDIN_FILE" | grep -qE '^(/var)?/tmp/'
-T4="$?"
-
-echo "$PWD" | grep -qE '^(/var)?/tmp/'
-T5="$?"
-
-if [ "$T1" = "0" -o "$T2" = "0" -o "$T3" = "0" -o "$T4" = "0" -o "$T5" = "0" ]; then
-  echo "[-] Error: do not use this script in /tmp or /var/tmp." 1>&2
-  exit 1
-fi
-
-# If @@ is specified, but there's no -f, let's come up with a temporary input
-# file name.
-
-TRACE_DIR="$OUT_DIR/.traces"
-
-if [ "$STDIN_FILE" = "" ]; then
-
-  if echo "$*" | grep -qF '@@'; then
-    STDIN_FILE="$TRACE_DIR/.cur_input"
-  fi
-
-fi
-
-# Check for obvious errors.
-
-if [ ! "$MEM_LIMIT" = "none" ]; then
-
-  if [ "$MEM_LIMIT" -lt "5" ]; then
-    echo "[-] Error: dangerously low memory limit." 1>&2
-    exit 1
-  fi
-
-fi
-
-if [ ! "$TIMEOUT" = "none" ]; then
-
-  if [ "$TIMEOUT" -lt "10" ]; then
-    echo "[-] Error: dangerously low timeout." 1>&2
-    exit 1
-  fi
-
-fi
-
-if [ ! -f "$TARGET_BIN" -o ! -x "$TARGET_BIN" ]; then
-
-  TNEW="`which "$TARGET_BIN" 2>/dev/null`"
-
-  if [ ! -f "$TNEW" -o ! -x "$TNEW" ]; then
-    echo "[-] Error: binary '$TARGET_BIN' not found or not executable." 1>&2
-    exit 1
-  fi
-
-  TARGET_BIN="$TNEW"
-
-fi
-
-if [ "$AFL_SKIP_BIN_CHECK" = "" -a "$QEMU_MODE" = "" ]; then
-
-  if ! grep -qF "__AFL_SHM_ID" "$TARGET_BIN"; then
-    echo "[-] Error: binary '$TARGET_BIN' doesn't appear to be instrumented." 1>&2
-    exit 1
-  fi
-
-fi
-
-if [ ! -d "$IN_DIR" ]; then
-  echo "[-] Error: directory '$IN_DIR' not found." 1>&2
-  exit 1
-fi
-
-test -d "$IN_DIR/queue" && IN_DIR="$IN_DIR/queue"
-
-find "$OUT_DIR" -name 'id[:_]*' -maxdepth 1 -exec rm -- {} \; 2>/dev/null
-rm -rf "$TRACE_DIR" 2>/dev/null
-
-rmdir "$OUT_DIR" 2>/dev/null
-
-if [ -d "$OUT_DIR" ]; then
-  echo "[-] Error: directory '$OUT_DIR' exists and is not empty - delete it first." 1>&2
-  exit 1
-fi
-
-mkdir -m 700 -p "$TRACE_DIR" || exit 1
-
-if [ ! "$STDIN_FILE" = "" ]; then
-  rm -f "$STDIN_FILE" || exit 1
-  touch "$STDIN_FILE" || exit 1
-fi
-
-if [ "$AFL_PATH" = "" ]; then
-  SHOWMAP="${0%/afl-cmin}/afl-showmap"
-else
-  SHOWMAP="$AFL_PATH/afl-showmap"
-fi
-
-if [ ! -x "$SHOWMAP" ]; then
-  echo "[-] Error: can't find 'afl-showmap' - please set AFL_PATH." 1>&2
-  rm -rf "$TRACE_DIR"
-  exit 1
-fi
-
-IN_COUNT=$((`ls -- "$IN_DIR" 2>/dev/null | wc -l`))
-
-if [ "$IN_COUNT" = "0" ]; then
-  echo "No inputs in the target directory - nothing to be done."
-  rm -rf "$TRACE_DIR"
-  exit 1
-fi
-
-FIRST_FILE=`ls "$IN_DIR" | head -1`
-
-if ln "$IN_DIR/$FIRST_FILE" "$TRACE_DIR/.link_test" 2>/dev/null; then
-  CP_TOOL=ln
-else
-  CP_TOOL=cp
-fi
-
-# Make sure that we can actually get anything out of afl-showmap before we
-# waste too much time.
-
-echo "[*] Testing the target binary..."
-
-if [ "$STDIN_FILE" = "" ]; then
-
-  AFL_CMIN_ALLOW_ANY=1 "$SHOWMAP" -m "$MEM_LIMIT" -t "$TIMEOUT" -o "$TRACE_DIR/.run_test" -Z $EXTRA_PAR -- "$@" <"$IN_DIR/$FIRST_FILE"
-
-else
-
-  cp "$IN_DIR/$FIRST_FILE" "$STDIN_FILE"
-  AFL_CMIN_ALLOW_ANY=1 "$SHOWMAP" -m "$MEM_LIMIT" -t "$TIMEOUT" -o "$TRACE_DIR/.run_test" -Z $EXTRA_PAR -A "$STDIN_FILE" -- "$@" </dev/null
-
-fi
-
-FIRST_COUNT=$((`grep -c . "$TRACE_DIR/.run_test"`))
-
-if [ "$FIRST_COUNT" -gt "0" ]; then
-
-  echo "[+] OK, $FIRST_COUNT tuples recorded."
-
-else
-
-  echo "[-] Error: no instrumentation output detected (perhaps crash or timeout)." 1>&2
-  test "$AFL_KEEP_TRACES" = "" && rm -rf "$TRACE_DIR"
-  exit 1
-
-fi
-
-# Let's roll!
-
-#############################
-# STEP 1: COLLECTING TRACES #
-#############################
-
-echo "[*] Obtaining traces for input files in '$IN_DIR'..."
-
-(
-
-  CUR=0
-
-  if [ "$STDIN_FILE" = "" ]; then
-
-    while read -r fn; do
-
-      CUR=$((CUR+1))
-      printf "\\r    Processing file $CUR/$IN_COUNT... "
-
-      "$SHOWMAP" -m "$MEM_LIMIT" -t "$TIMEOUT" -o "$TRACE_DIR/$fn" -Z $EXTRA_PAR -- "$@" <"$IN_DIR/$fn"
-
-    done < <(ls "$IN_DIR")
-
-  else
-
-    while read -r fn; do
-
-      CUR=$((CUR+1))
-      printf "\\r    Processing file $CUR/$IN_COUNT... "
-
-      cp "$IN_DIR/$fn" "$STDIN_FILE"
-
-      "$SHOWMAP" -m "$MEM_LIMIT" -t "$TIMEOUT" -o "$TRACE_DIR/$fn" -Z $EXTRA_PAR -A "$STDIN_FILE" -- "$@" </dev/null
-
-    done < <(ls "$IN_DIR")
-
-
-  fi
-
-)
-
-echo
-
-##########################
-# STEP 2: SORTING TUPLES #
-##########################
-
-# With this out of the way, we sort all tuples by popularity across all
-# datasets. The reasoning here is that we won't be able to avoid the files
-# that trigger unique tuples anyway, so we will want to start with them and
-# see what's left.
-
-echo "[*] Sorting trace sets (this may take a while)..."
-
-ls "$IN_DIR" | sed "s#^#$TRACE_DIR/#" | tr '\n' '\0' | xargs -0 -n 1 cat | \
-  sort | uniq -c | sort -n >"$TRACE_DIR/.all_uniq"
-
-TUPLE_COUNT=$((`grep -c . "$TRACE_DIR/.all_uniq"`))
-
-echo "[+] Found $TUPLE_COUNT unique tuples across $IN_COUNT files."
-
-#####################################
-# STEP 3: SELECTING CANDIDATE FILES #
-#####################################
-
-# The next step is to find the best candidate for each tuple. The "best"
-# part is understood simply as the smallest input that includes a particular
-# tuple in its trace. Empirical evidence suggests that this produces smaller
-# datasets than more involved algorithms that could be still pulled off in
-# a shell script.
-
-echo "[*] Finding best candidates for each tuple..."
-
-CUR=0
-
-while read -r fn; do
-
-  CUR=$((CUR+1))
-  printf "\\r    Processing file $CUR/$IN_COUNT... "
-
-  sed "s#\$# $fn#" "$TRACE_DIR/$fn" >>"$TRACE_DIR/.candidate_list"
-
-done < <(ls -rS "$IN_DIR")
-
-echo
-
-##############################
-# STEP 4: LOADING CANDIDATES #
-##############################
-
-# At this point, we have a file of tuple-file pairs, sorted by file size
-# in ascending order (as a consequence of ls -rS). By doing sort keyed
-# only by tuple (-k 1,1) and configured to output only the first line for
-# every key (-s -u), we end up with the smallest file for each tuple.
-
-echo "[*] Sorting candidate list (be patient)..."
-
-sort -k1,1 -s -u "$TRACE_DIR/.candidate_list" | \
-  sed 's/^/BEST_FILE[/;s/ /]="/;s/$/"/' >"$TRACE_DIR/.candidate_script"
-
-if [ ! -s "$TRACE_DIR/.candidate_script" ]; then
-  echo "[-] Error: no traces obtained from test cases, check syntax!"
-  test "$AFL_KEEP_TRACES" = "" && rm -rf "$TRACE_DIR"
-  exit 1
-fi
-
-# The sed command converted the sorted list to a shell script that populates
-# BEST_FILE[tuple]="fname". Let's load that!
-
-. "$TRACE_DIR/.candidate_script"
-
-##########################
-# STEP 5: WRITING OUTPUT #
-##########################
-
-# The final trick is to grab the top pick for each tuple, unless said tuple is
-# already set due to the inclusion of an earlier candidate; and then put all
-# tuples associated with the newly-added file to the "already have" list. The
-# loop works from least popular tuples and toward the most common ones.
-
-echo "[*] Processing candidates and writing output files..."
-
-CUR=0
-
-touch "$TRACE_DIR/.already_have"
-
-while read -r cnt tuple; do
-
-  CUR=$((CUR+1))
-  printf "\\r    Processing tuple $CUR/$TUPLE_COUNT... "
-
-  # If we already have this tuple, skip it.
-
-  grep -q "^$tuple\$" "$TRACE_DIR/.already_have" && continue
-
-  FN=${BEST_FILE[tuple]}
-
-  $CP_TOOL "$IN_DIR/$FN" "$OUT_DIR/$FN"
-
-  if [ "$((CUR % 5))" = "0" ]; then
-    sort -u "$TRACE_DIR/$FN" "$TRACE_DIR/.already_have" >"$TRACE_DIR/.tmp"
-    mv -f "$TRACE_DIR/.tmp" "$TRACE_DIR/.already_have"
-  else
-    cat "$TRACE_DIR/$FN" >>"$TRACE_DIR/.already_have"
-  fi
-
-done <"$TRACE_DIR/.all_uniq"
-
-echo
-
-OUT_COUNT=`ls -- "$OUT_DIR" | wc -l`
-
-if [ "$OUT_COUNT" = "1" ]; then
-  echo "[!] WARNING: All test cases had the same traces, check syntax!"
-fi
-
-echo "[+] Narrowed down to $OUT_COUNT files, saved in '$OUT_DIR'."
-echo
-
-test "$AFL_KEEP_TRACES" = "" && rm -rf "$TRACE_DIR"
-
-exit 0

QA/FuzzTesting/AFL-Files/afl-g++

-afl-gcc
\ No newline at end of file

QA/FuzzTesting/AFL-Files/afl-gcc.c

-/*
-   american fuzzy lop - wrapper for GCC and clang
-   ----------------------------------------------
-
-   Written and maintained by Michal Zalewski <lcamtuf@google.com>
-
-   Copyright 2013, 2014, 2015 Google Inc. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   This program is a drop-in replacement for GCC or clang. The most common way
-   of using it is to pass the path to afl-gcc or afl-clang via CC when invoking
-   ./configure.
-
-   (Of course, use CXX and point it to afl-g++ / afl-clang++ for C++ code.)
-
-   The wrapper needs to know the path to afl-as (renamed to 'as'). The default
-   is /usr/local/lib/afl/. A convenient way to specify alternative directories
-   would be to set AFL_PATH.
-
-   If AFL_HARDEN is set, the wrapper will compile the target app with various
-   hardening options that may help detect memory management issues more
-   reliably. You can also specify AFL_USE_ASAN to enable ASAN.
-
-   If you want to call a non-default compiler as a next step of the chain,
-   specify its location via AFL_CC or AFL_CXX.
-
- */
-
-#define AFL_MAIN
-
-#include "config.h"
-#include "types.h"
-#include "debug.h"
-#include "alloc-inl.h"
-
-#include <stdio.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <string.h>
-
-static u8*  as_path;                /* Path to the AFL 'as' wrapper      */
-static u8** cc_params;              /* Parameters passed to the real CC  */
-static u32  cc_par_cnt = 1;         /* Param count, including argv0      */
-static u8   be_quiet,               /* Quiet mode                        */
-            clang_mode;             /* Invoked as afl-clang*?            */
-
-
-/* Try to find our "fake" GNU assembler in AFL_PATH or at the location derived
-   from argv[0]. If that fails, abort. */
-
-static void find_as(u8* argv0) {
-
-  u8 *afl_path = getenv("AFL_PATH");
-  u8 *slash, *tmp;
-
-  if (afl_path) {
-
-    tmp = alloc_printf("%s/as", afl_path);
-
-    if (!access(tmp, X_OK)) {
-      as_path = afl_path;
-      ck_free(tmp);
-      return;
-    }
-
-    ck_free(tmp);
-
-  }
-
-  slash = strrchr(argv0, '/');
-
-  if (slash) {
-
-    u8 *dir;
-
-    *slash = 0;
-    dir = ck_strdup(argv0);
-    *slash = '/';
-
-    tmp = alloc_printf("%s/afl-as", dir);
-
-    if (!access(tmp, X_OK)) {
-      as_path = dir;
-      ck_free(tmp);
-      return;
-    }
-
-    ck_free(tmp);
-    ck_free(dir);
-
-  }
-
-  if (!access(AFL_PATH "/as", X_OK)) {
-    as_path = AFL_PATH;
-    return;
-  }
-
-  FATAL("Unable to find AFL wrapper binary for 'as'. Please set AFL_PATH");
- 
-}
-
-
-/* Copy argv to cc_params, making the necessary edits. */
-
-static void edit_params(u32 argc, char** argv) {
-
-  u8 fortify_set = 0, asan_set = 0;
-  u8 *name;
-
-#if defined(__FreeBSD__) && defined(__x86_64__)
-  u8 m32_set = 0;
-#endif
-
-  cc_params = ck_alloc((argc + 64) * sizeof(u8*));
-
-  name = strrchr(argv[0], '/');
-  if (!name) name = argv[0]; else name++;
-
-  if (!strncmp(name, "afl-clang", 9)) {
-
-    clang_mode = 1;
-
-    setenv(CLANG_ENV_VAR, "1", 1);
-
-    if (!strcmp(name, "afl-clang++")) {
-      u8* alt_cxx = getenv("AFL_CXX");
-      cc_params[0] = alt_cxx ? alt_cxx : (u8*)"clang++";
-    } else {
-      u8* alt_cc = getenv("AFL_CC");
-      cc_params[0] = alt_cc ? alt_cc : (u8*)"clang";
-    }
-
-  } else {
-
-    /* With GCJ and Eclipse installed, you can actually compile Java! The
-       instrumentation will work (amazingly). Alas, unhandled exceptions do
-       not call abort(), so afl-fuzz would need to be modified to equate
-       non-zero exit codes with crash conditions when working with Java
-       binaries. Meh. */
-
-#ifdef __APPLE__
-
-    if (!strcmp(name, "afl-g++")) cc_params[0] = getenv("AFL_CXX");
-    else if (!strcmp(name, "afl-gcj")) cc_params[0] = getenv("AFL_GCJ");
-    else cc_params[0] = getenv("AFL_CC");
-
-    if (!cc_params[0]) {
-
-      SAYF("\n" cLRD "[-] " cRST
-           "On Apple systems, 'gcc' is usually just a wrapper for clang. Please use the\n"
-           "    'afl-clang' utility instead of 'afl-gcc'. If you really have GCC installed,\n"
-           "    set AFL_CC or AFL_CXX to specify the correct path to that compiler.\n");
-
-      FATAL("AFL_CC or AFL_CXX required on MacOS X");
-
-    }
-
-#else
-
-    if (!strcmp(name, "afl-g++")) {
-      u8* alt_cxx = getenv("AFL_CXX");
-      cc_params[0] = alt_cxx ? alt_cxx : (u8*)"g++";
-    } else if (!strcmp(name, "afl-gcj")) {
-      u8* alt_cc = getenv("AFL_GCJ");
-      cc_params[0] = alt_cc ? alt_cc : (u8*)"gcj";
-    } else {
-      u8* alt_cc = getenv("AFL_CC");
-      cc_params[0] = alt_cc ? alt_cc : (u8*)"gcc";
-    }
-
-#endif /* __APPLE__ */
-
-  }
-
-  while (--argc) {
-    u8* cur = *(++argv);
-
-    if (!strncmp(cur, "-B", 2)) {
-
-      if (!be_quiet) WARNF("-B is already set, overriding");
-
-      if (!cur[2] && argc > 1) { argc--; argv++; }
-      continue;
-
-    }
-
-    if (!strcmp(cur, "-integrated-as")) continue;
-
-    if (!strcmp(cur, "-pipe")) continue;
-
-#if defined(__FreeBSD__) && defined(__x86_64__)
-    if (!strcmp(cur, "-m32")) m32_set = 1;
-#endif
-
-    if (!strcmp(cur, "-fsanitize=address") ||
-        !strcmp(cur, "-fsanitize=memory")) asan_set = 1;
-
-    if (strstr(cur, "FORTIFY_SOURCE")) fortify_set = 1;
-
-    cc_params[cc_par_cnt++] = cur;
-
-  }
-
-  cc_params[cc_par_cnt++] = "-B";
-  cc_params[cc_par_cnt++] = as_path;
-
-  if (clang_mode)
-    cc_params[cc_par_cnt++] = "-no-integrated-as";
-
-  if (getenv("AFL_HARDEN")) {
-
-    cc_params[cc_par_cnt++] = "-fstack-protector-all";
-
-    if (!fortify_set)
-      cc_params[cc_par_cnt++] = "-D_FORTIFY_SOURCE=2";
-
-  }
-
-  if (asan_set) {
-
-    /* Pass this on to afl-as to adjust map density. */
-
-    setenv("AFL_USE_ASAN", "1", 1);
-
-  } else if (getenv("AFL_USE_ASAN")) {
-
-    cc_params[cc_par_cnt++] = "-fsanitize=address";
-
-    if (getenv("AFL_USE_MSAN"))
-      FATAL("ASAN and MSAN are mutually exclusive");
-
-  } else if (getenv("AFL_USE_MSAN")) {
-
-    cc_params[cc_par_cnt++] = "-fsanitize=memory";
-
-    if (getenv("AFL_USE_ASAN"))
-      FATAL("ASAN and MSAN are mutually exclusive");
-
-  }
-
-  if (!getenv("AFL_DONT_OPTIMIZE")) {
-
-#if defined(__FreeBSD__) && defined(__x86_64__)
-
-    /* On 64-bit FreeBSD systems, clang -g -m32 is broken, but -m32 itself
-       works OK. This has nothing to do with us, but let's avoid triggering
-       that bug. */
-
-    if (!clang_mode || !m32_set)
-      cc_params[cc_par_cnt++] = "-g";
-
-#else
-
-      cc_params[cc_par_cnt++] = "-g";
-
-#endif
-
-    cc_params[cc_par_cnt++] = "-O3";
-    cc_params[cc_par_cnt++] = "-funroll-loops";
-    cc_params[cc_par_cnt++] = "-D__AFL_COMPILER=1";
-
-  }
-
-  cc_params[cc_par_cnt] = NULL;
-
-}
-
-
-/* Main entry point */
-
-int main(int argc, char** argv) {
-
-  if (isatty(2) && !getenv("AFL_QUIET")) {
-
-    SAYF(cCYA "afl-cc " cBRI VERSION cRST " by <lcamtuf@google.com>\n");
-
-  } else be_quiet = 1;
-
-  if (argc < 2) {
-
-    SAYF("\n"
-         "This is a helper application for afl-fuzz. It serves as a drop-in replacement\n"
-         "for gcc or clang, letting you recompile third-party code with the required\n"
-         "runtime instrumentation. A common use pattern would be one of the following:\n\n"
-
-         "  CC=%s/afl-gcc ./configure\n"
-         "  CXX=%s/afl-g++ ./configure\n\n"
-
-         "You can specify custom next-stage toolchain via AFL_CC, AFL_CXX, and AFL_AS.\n"
-         "Setting AFL_HARDEN enables hardening optimizations in the compiled code.\n\n",
-         BIN_PATH, BIN_PATH);
-
-    exit(1);
-
-  }
-
-
-  find_as(argv[0]);
-
-  edit_params(argc, argv);
-
-  execvp(cc_params[0], (char**)cc_params);
-
-  FATAL("Oops, failed to execute '%s' - check your PATH", cc_params[0]);
-
-  return 0;
-
-}

QA/FuzzTesting/AFL-Files/afl-gotcpu.c

-/*
-   american fuzzy lop - free CPU gizmo
-   -----------------------------------
-
-   Written and maintained by Michal Zalewski <lcamtuf@google.com>
-
-   Copyright 2015, 2016 Google Inc. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   This tool provides a fairly accurate measurement of CPU preemption rate.
-   It is meant to complement the quick-and-dirty load average widget shown
-   in the afl-fuzz UI. See docs/parallel_fuzzing.txt for more info.
-
-   For some work loads, the tool may actually suggest running more instances
-   than you have CPU cores. This can happen if the tested program is spending
-   a portion of its run time waiting for I/O, rather than being 100%
-   CPU-bound.
-
-   The idea for the getrusage()-based approach comes from Jakub Wilk.
-
- */
-
-#define AFL_MAIN
-#define _GNU_SOURCE
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <sched.h>
-
-#include <sys/time.h>
-#include <sys/times.h>
-#include <sys/resource.h>
-
-#include "types.h"
-#include "debug.h"
-
-#ifdef __linux__
-#  define HAVE_AFFINITY 1
-#endif /* __linux__ */
-
-
-/* Get unix time in microseconds. */
-
-static u64 get_cur_time_us(void) {
-
-  struct timeval tv;
-  struct timezone tz;
-
-  gettimeofday(&tv, &tz);
-
-  return (tv.tv_sec * 1000000ULL) + tv.tv_usec;
-
-}
-
-
-/* Get CPU usage in microseconds. */
-
-static u64 get_cpu_usage_us(void) {
-
-  struct rusage u;
-
-  getrusage(RUSAGE_SELF, &u);
-
-  return (u.ru_utime.tv_sec * 1000000ULL) + u.ru_utime.tv_usec +
-         (u.ru_stime.tv_sec * 1000000ULL) + u.ru_stime.tv_usec;
-
-}
-
-
-/* Measure preemption rate. */
-
-static u32 measure_preemption(u32 target_ms) {
-
-  static volatile u32 v1, v2;
-
-  u64 st_t, en_t, st_c, en_c, real_delta, slice_delta;
-  s32 loop_repeats = 0;
-
-  st_t = get_cur_time_us();
-  st_c = get_cpu_usage_us();
-
-repeat_loop:
-
-  v1 = CTEST_BUSY_CYCLES;
-
-  while (v1--) v2++;
-  sched_yield();
-
-  en_t = get_cur_time_us();
-
-  if (en_t - st_t < target_ms * 1000) {
-    loop_repeats++;
-    goto repeat_loop;
-  }
-
-  /* Let's see what percentage of this time we actually had a chance to
-     run, and how much time was spent in the penalty box. */
-
-  en_c = get_cpu_usage_us();
-
-  real_delta  = (en_t - st_t) / 1000;
-  slice_delta = (en_c - st_c) / 1000;
-
-  return real_delta * 100 / slice_delta;
-
-}
-
-
-/* Do the benchmark thing. */
-
-int main(int argc, char** argv) {
-
-#ifdef HAVE_AFFINITY
-
-  u32 cpu_cnt = sysconf(_SC_NPROCESSORS_ONLN),
-      idle_cpus = 0, maybe_cpus = 0, i;
-
-  SAYF(cCYA "afl-gotcpu " cBRI VERSION cRST " by <lcamtuf@google.com>\n");
-
-  ACTF("Measuring per-core preemption rate (this will take %0.02f sec)...",
-       ((double)CTEST_CORE_TRG_MS) * cpu_cnt / 1000);
-
-  for (i = 0; i < cpu_cnt; i++) {
-
-    cpu_set_t c;
-    u32 util_perc;
-
-    CPU_ZERO(&c);
-    CPU_SET(i, &c);
-
-    if (sched_setaffinity(0, sizeof(c), &c))
-      PFATAL("sched_setaffinity failed");
-
-    util_perc = measure_preemption(CTEST_CORE_TRG_MS);
-
-    if (util_perc < 105) {
-
-      SAYF("    Core #%u: " cLGN "AVAILABLE\n" cRST, i); 
-      maybe_cpus++;
-      idle_cpus++;
-
-    } else if (util_perc < 130) {
-
-      SAYF("    Core #%u: " cYEL "CAUTION " cRST "(%u%%)\n", i, util_perc); 
-      maybe_cpus++;
-
-    } else {
-
-      SAYF("    Core #%u: " cLRD "OVERBOOKED " cRST "(%u%%)\n" cRST, i,
-           util_perc);
-
-    }
-
-  }
-
-  SAYF(cGRA "\n>>> ");
-
-  if (idle_cpus) {
-
-    if (maybe_cpus == idle_cpus) {
-
-      SAYF(cLGN "PASS: " cRST "You can run more processes on %u core%s.",
-           idle_cpus, idle_cpus > 1 ? "s" : "");
-
-    } else {
-
-      SAYF(cLGN "PASS: " cRST "You can run more processes on %u to %u core%s.",
-           idle_cpus, maybe_cpus, maybe_cpus > 1 ? "s" : "");
-
-    }
-
-    SAYF(cGRA " <<<" cRST "\n\n");
-    return 0;
-
-  }
-
-  if (maybe_cpus) {
-
-    SAYF(cYEL "CAUTION: " cRST "You may still have %u core%s available.",
-         maybe_cpus, maybe_cpus > 1 ? "s" : "");
-    SAYF(cGRA " <<<" cRST "\n\n");
-    return 1;
-
-  }
-
-  SAYF(cLRD "FAIL: " cRST "All cores are overbooked.");
-  SAYF(cGRA " <<<" cRST "\n\n");
-  return 2;
-
-#else
-
-  u32 util_perc;
-
-  SAYF(cCYA "afl-gotcpu " cBRI VERSION cRST " by <lcamtuf@google.com>\n");
-
-  /* Run a busy loop for CTEST_TARGET_MS. */
-
-  ACTF("Measuring gross preemption rate (this will take %0.02f sec)...",
-       ((double)CTEST_TARGET_MS) / 1000);
-
-  util_perc = measure_preemption(CTEST_TARGET_MS);
-
-  /* Deliver the final verdict. */
-
-  SAYF(cGRA "\n>>> ");
-
-  if (util_perc < 105) {
-
-    SAYF(cLGN "PASS: " cRST "You can probably run additional processes.");
-
-  } else if (util_perc < 130) {
-
-    SAYF(cYEL "CAUTION: " cRST "Your CPU may be somewhat overbooked (%u%%).",
-         util_perc);
-
-  } else {
-
-    SAYF(cLRD "FAIL: " cRST "Your CPU is overbooked (%u%%).", util_perc);
-
-  }
-
-  SAYF(cGRA " <<<" cRST "\n\n");
-
-  return (util_perc > 105) + (util_perc > 130);
-
-#endif /* ^HAVE_AFFINITY */
-
-}