1 /*
2 american fuzzy lop++ - cmplog execution routines
3 ------------------------------------------------
4
5 Originally written by Michal Zalewski
6
7 Forkserver design by Jann Horn <jannhorn@googlemail.com>
8
9 Now maintained by by Marc Heuse <mh@mh-sec.de>,
10 Heiko Eißfeldt <heiko.eissfeldt@hexco.de> and
11 Andrea Fioraldi <andreafioraldi@gmail.com>
12
13 Copyright 2016, 2017 Google Inc. All rights reserved.
14 Copyright 2019-2022 AFLplusplus Project. All rights reserved.
15
16 Licensed under the Apache License, Version 2.0 (the "License");
17 you may not use this file except in compliance with the License.
18 You may obtain a copy of the License at:
19
20 https://www.apache.org/licenses/LICENSE-2.0
21
22 Shared code to handle the shared memory. This is used by the fuzzer
23 as well the other components like afl-tmin, afl-showmap, etc...
24
25 */
26
27 #include <sys/select.h>
28
29 #include "afl-fuzz.h"
30 #include "cmplog.h"
31
cmplog_exec_child(afl_forkserver_t * fsrv,char ** argv)32 void cmplog_exec_child(afl_forkserver_t *fsrv, char **argv) {
33
34 setenv("___AFL_EINS_ZWEI_POLIZEI___", "1", 1);
35
36 if (fsrv->qemu_mode) { setenv("AFL_DISABLE_LLVM_INSTRUMENTATION", "1", 0); }
37
38 if (!fsrv->qemu_mode && !fsrv->frida_mode && argv[0] != fsrv->cmplog_binary) {
39
40 argv[0] = fsrv->cmplog_binary;
41
42 }
43
44 execv(argv[0], argv);
45
46 }
47
common_fuzz_cmplog_stuff(afl_state_t * afl,u8 * out_buf,u32 len)48 u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
49
50 u8 fault;
51
52 write_to_testcase(afl, (void **)&out_buf, len, 0);
53
54 fault = fuzz_run_target(afl, &afl->cmplog_fsrv, afl->fsrv.exec_tmout);
55
56 if (afl->stop_soon) { return 1; }
57
58 if (fault == FSRV_RUN_TMOUT) {
59
60 if (afl->subseq_tmouts++ > TMOUT_LIMIT) {
61
62 ++afl->cur_skipped_items;
63 return 1;
64
65 }
66
67 } else {
68
69 afl->subseq_tmouts = 0;
70
71 }
72
73 /* Users can hit us with SIGUSR1 to request the current input
74 to be abandoned. */
75
76 if (afl->skip_requested) {
77
78 afl->skip_requested = 0;
79 ++afl->cur_skipped_items;
80 return 1;
81
82 }
83
84 return 0;
85
86 }
87
88