1 /*
2 american fuzzy lop++ - cmplog execution routines
3 ------------------------------------------------
4
5 Originally written by Michal Zalewski
6
7 Forkserver design by Jann Horn <[email protected]>
8
9 Now maintained by by Marc Heuse <[email protected]>,
10 Heiko Eißfeldt <[email protected]> and
11 Andrea Fioraldi <[email protected]>
12
13 Copyright 2016, 2017 Google Inc. All rights reserved.
14 Copyright 2019-2024 AFLplusplus Project. All rights reserved.
15
16 Licensed under the Apache License, Version 2.0 (the "License");
17 you may not use this file except in compliance with the License.
18 You may obtain a copy of the License at:
19
20 https://www.apache.org/licenses/LICENSE-2.0
21
22 Shared code to handle the shared memory. This is used by the fuzzer
23 as well the other components like afl-tmin, afl-showmap, etc...
24
25 */
26
27 #include <sys/select.h>
28
29 #include "afl-fuzz.h"
30 #include "cmplog.h"
31
cmplog_exec_child(afl_forkserver_t * fsrv,char ** argv)32 void cmplog_exec_child(afl_forkserver_t *fsrv, char **argv) {
33
34 setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1);
35
36 if (fsrv->qemu_mode || fsrv->cs_mode) {
37
38 setenv("AFL_DISABLE_LLVM_INSTRUMENTATION", "1", 0);
39
40 }
41
42 if (!fsrv->qemu_mode && !fsrv->frida_mode && argv[0] != fsrv->cmplog_binary) {
43
44 fsrv->target_path = argv[0] = fsrv->cmplog_binary;
45
46 }
47
48 execv(fsrv->target_path, argv);
49
50 }
51
common_fuzz_cmplog_stuff(afl_state_t * afl,u8 * out_buf,u32 len)52 u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
53
54 u8 fault;
55 u32 tmp_len = write_to_testcase(afl, (void **)&out_buf, len, 0);
56
57 if (likely(tmp_len)) {
58
59 len = tmp_len;
60
61 } else {
62
63 len = write_to_testcase(afl, (void **)&out_buf, len, 1);
64
65 }
66
67 fault = fuzz_run_target(afl, &afl->cmplog_fsrv, afl->fsrv.exec_tmout);
68
69 if (afl->stop_soon) { return 1; }
70
71 if (fault == FSRV_RUN_TMOUT) {
72
73 if (afl->subseq_tmouts++ > TMOUT_LIMIT) {
74
75 ++afl->cur_skipped_items;
76 return 1;
77
78 }
79
80 } else {
81
82 afl->subseq_tmouts = 0;
83
84 }
85
86 /* Users can hit us with SIGUSR1 to request the current input
87 to be abandoned. */
88
89 if (afl->skip_requested) {
90
91 afl->skip_requested = 0;
92 ++afl->cur_skipped_items;
93 return 1;
94
95 }
96
97 return 0;
98
99 }
100
101