Skip to content

Commit 9f6b012

Browse files
vanhauser-thcvanhauser-thc
authored
Merge pull request #2117 from AFLplusplus/dev
push to stable
2 parents fd71341 + ec0b83f commit 9f6b012

25 files changed

+421
-231
lines changed

‎README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22

33
<img align="right" src="https://raw.githubusercontent.com/AFLplusplus/Website/main/static/aflpp_bg.svg" alt="AFL++ logo" width="250" heigh="250">
44

5-
Release version: [4.20c](https://github.com/AFLplusplus/AFLplusplus/releases)
5+
Release version: [4.21c](https://github.com/AFLplusplus/AFLplusplus/releases)
66

7-
GitHub version: 4.21a
7+
GitHub version: 4.21c
88

99
Repository:
1010
[https://github.com/AFLplusplus/AFLplusplus](https://github.com/AFLplusplus/AFLplusplus)

‎TODO.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
## Must
44

5+
- fast restart of afl-fuzz if cmdline + target hash is the same
6+
- check for null ptr for xml/curl/g_ string transform functions
57
- hardened_usercopy=0 page_alloc.shuffle=0
68
- add value_profile but only enable after 15 minutes without finds
79
- cmplog max items env?
@@ -11,7 +13,6 @@
1113
- afl-showmap -f support
1214
- afl-fuzz multicore wrapper script
1315
- when trimming then perform crash detection
14-
- cyclomatic complexity: 2 + calls + edges - blocks
1516

1617

1718
## Should

‎custom_mutators/grammar_mutator/GRAMMAR_VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
5ed4f8d
1+
95a6857

‎custom_mutators/grammar_mutator/grammar_mutator

‎docs/Changelog.md

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,16 @@
33
This is the list of all noteworthy changes made in every public
44
release of the tool. See README.md for the general instruction manual.
55

6-
### Version ++4.21a (dev)
6+
### Version ++4.21c (release)
77
* afl-fuzz
88
- fixed a regression in afl-fuzz that resulted in a 5-10% performace loss
99
do a switch from gettimeofday() to clock_gettime() which should be rather
1010
three times faster. The reason for this is unknown.
11+
- new queue selection algorithm based on 2 core years of queue data
12+
analysis. gives a noticable improvement on coverage although the results
13+
seem counterintuitive :-)
1114
- added AFL_DISABLE_REDUNDANT for huge queues
15+
- added `AFL_NO_SYNC` environment variable that does what you think it does
1216
- fix AFL_PERSISTENT_RECORD
1317
- run custom_post_process after standard trimming
1418
- prevent filenames in the queue that have spaces
@@ -19,6 +23,9 @@
1923
- -V timing is now accurately the fuzz time (without syncing), before
2024
long calibration times and syncing could result in now fuzzing being
2125
made when the time was already run out until then, thanks to @eqv!
26+
- fix -n uninstrumented mode when ending fuzzing
27+
- enhanced the ASAN configuration
28+
- make afl-fuzz use less memory with cmplog and fix a memleak
2229
* afl-cc:
2330
- re-enable i386 support that was accidently disabled
2431
- fixes for LTO and outdated afl-gcc mode for i386
@@ -32,7 +39,8 @@
3239
* afl-showmap
3340
- fix memory leak on shmem testcase usage (thanks to @ndrewh)
3441
- minor fix to collect coverage -C (thanks to @bet4it)
35-
* enhanced the ASAN configuration
42+
* Fixed a shmem mmap bug (that rarely came up on MacOS)
43+
* libtokencap: script generate_libtoken_dict.sh added by @a-shvedov
3644

3745

3846
### Version ++4.20c (release)

‎docs/env_variables.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -588,6 +588,9 @@ checks or alter some of the more exotic semantics of the tool:
588588
between fuzzing instances synchronization. Default sync time is 30 minutes,
589589
note that time is halved for -M main nodes.
590590
591+
- `AFL_NO_SYNC` disables any syncing whatsoever and takes priority on all
592+
other syncing parameters.
593+
591594
- Setting `AFL_TARGET_ENV` causes AFL++ to set extra environment variables for
592595
the target binary. Example: `AFL_TARGET_ENV="VAR1=1 VAR2='a b c'" afl-fuzz
593596
... `. This exists mostly for things like `LD_LIBRARY_PATH` but it would

‎frida_mode/src/instrument/instrument_x64_cache.c

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,23 @@ void instrument_cache_init(void) {
4949

5050
if (setrlimit(RLIMIT_AS, &data_limit) != 0) {
5151

52-
FFATAL("Failed to setrlimit: %d", errno);
52+
FWARNF("Failed to setrlimit: %d, you may need root or CAP_SYS_RESOURCE",
53+
errno);
5354

5455
}
5556

5657
map_base =
5758
gum_memory_allocate(NULL, instrument_cache_size, instrument_cache_size,
5859
GUM_PAGE_READ | GUM_PAGE_WRITE);
59-
if (map_base == MAP_FAILED) { FFATAL("Failed to map segment: %d", errno); }
60+
if (map_base == MAP_FAILED) {
61+
62+
FFATAL(
63+
"Failed to map segment: %d. This can be caused by failure to setrlimit."
64+
"Disabling or reducing the size of the allocation using "
65+
"AFL_FRIDA_INST_NO_CACHE or AFL_FRIDA_INST_CACHE_SIZE may help",
66+
errno);
67+
68+
}
6069

6170
FOKF(cBLU "Instrumentation" cRST " - " cGRN "cache addr:" cYEL " [0x%016lX]",
6271
GUM_ADDRESS(map_base));

‎frida_mode/src/ranges.c

Lines changed: 15 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -194,24 +194,23 @@ static gboolean print_ranges_callback(const GumRangeDetails *details,
194194

195195
if (details->file == NULL) {
196196

197-
FVERBOSE("\t0x%016" G_GINT64_MODIFIER "x-0x%016" G_GINT64_MODIFIER
198-
"X %c%c%c",
199-
details->range->base_address,
200-
details->range->base_address + details->range->size,
201-
details->protection & GUM_PAGE_READ ? 'R' : '-',
202-
details->protection & GUM_PAGE_WRITE ? 'W' : '-',
203-
details->protection & GUM_PAGE_EXECUTE ? 'X' : '-');
197+
OKF("\t0x%016" G_GINT64_MODIFIER "x-0x%016" G_GINT64_MODIFIER "X %c%c%c",
198+
details->range->base_address,
199+
details->range->base_address + details->range->size,
200+
details->protection & GUM_PAGE_READ ? 'R' : '-',
201+
details->protection & GUM_PAGE_WRITE ? 'W' : '-',
202+
details->protection & GUM_PAGE_EXECUTE ? 'X' : '-');
204203

205204
} else {
206205

207-
FVERBOSE("\t0x%016" G_GINT64_MODIFIER "x-0x%016" G_GINT64_MODIFIER
208-
"X %c%c%c %s(0x%016" G_GINT64_MODIFIER "x)",
209-
details->range->base_address,
210-
details->range->base_address + details->range->size,
211-
details->protection & GUM_PAGE_READ ? 'R' : '-',
212-
details->protection & GUM_PAGE_WRITE ? 'W' : '-',
213-
details->protection & GUM_PAGE_EXECUTE ? 'X' : '-',
214-
details->file->path, details->file->offset);
206+
OKF("\t0x%016" G_GINT64_MODIFIER "x-0x%016" G_GINT64_MODIFIER
207+
"X %c%c%c %s(0x%016" G_GINT64_MODIFIER "x)",
208+
details->range->base_address,
209+
details->range->base_address + details->range->size,
210+
details->protection & GUM_PAGE_READ ? 'R' : '-',
211+
details->protection & GUM_PAGE_WRITE ? 'W' : '-',
212+
details->protection & GUM_PAGE_EXECUTE ? 'X' : '-', details->file->path,
213+
details->file->offset);
215214

216215
}
217216

@@ -581,7 +580,7 @@ static GArray *merge_ranges(GArray *a) {
581580

582581
void ranges_print_debug_maps(void) {
583582

584-
FVERBOSE("Maps");
583+
OKF("Maps");
585584
gum_process_enumerate_ranges(GUM_PAGE_NO_ACCESS, print_ranges_callback, NULL);
586585

587586
}

‎include/afl-fuzz.h

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -457,7 +457,7 @@ typedef struct afl_env_vars {
457457
afl_no_startup_calibration, afl_no_warn_instability,
458458
afl_post_process_keep_original, afl_crashing_seeds_as_new_crash,
459459
afl_final_sync, afl_ignore_seed_problems, afl_disable_redundant,
460-
afl_sha1_filenames;
460+
afl_sha1_filenames, afl_no_sync;
461461

462462
u8 *afl_tmpdir, *afl_custom_mutator_library, *afl_python_module, *afl_path,
463463
*afl_hang_tmout, *afl_forksrv_init_tmout, *afl_preload,
@@ -656,6 +656,7 @@ typedef struct afl_state {
656656
switch_fuzz_mode, /* auto or fixed fuzz mode */
657657
calibration_time_us, /* Time spend on calibration */
658658
sync_time_us, /* Time spend on sync */
659+
cmplog_time_us, /* Time spend on cmplog */
659660
trim_time_us; /* Time spend on trimming */
660661

661662
u32 slowest_exec_ms, /* Slowest testcase non hang in ms */
@@ -1226,6 +1227,7 @@ void show_init_stats(afl_state_t *);
12261227
void update_calibration_time(afl_state_t *afl, u64 *time);
12271228
void update_trim_time(afl_state_t *afl, u64 *time);
12281229
void update_sync_time(afl_state_t *afl, u64 *time);
1230+
void update_cmplog_time(afl_state_t *afl, u64 *time);
12291231

12301232
/* StatsD */
12311233

@@ -1276,6 +1278,7 @@ void get_core_count(afl_state_t *);
12761278
void fix_up_sync(afl_state_t *);
12771279
void check_asan_opts(afl_state_t *);
12781280
void check_binary(afl_state_t *, u8 *);
1281+
u64 get_binary_hash(u8 *fn);
12791282
void check_if_tty(afl_state_t *);
12801283
void save_cmdline(afl_state_t *, u32, char **);
12811284
void read_foreign_testcases(afl_state_t *, int);

‎include/config.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
/* Version string: */
2727

2828
// c = release, a = volatile github dev, e = experimental branch
29-
#define VERSION "++4.21a"
29+
#define VERSION "++4.21c"
3030

3131
/******************************************************
3232
* *
@@ -324,9 +324,9 @@
324324
#define SYNC_INTERVAL 8
325325

326326
/* Sync time (minimum time between syncing in ms, time is halfed for -M main
327-
nodes) - default is 30 minutes: */
327+
nodes) - default is 20 minutes: */
328328

329-
#define SYNC_TIME (30 * 60 * 1000)
329+
#define SYNC_TIME (20 * 60 * 1000)
330330

331331
/* Output directory reuse grace period (minutes): */
332332

0 commit comments

Comments
 (0)