move taint_mode var
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index adb75a2..5647532 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -497,7 +497,7 @@
char pid_buf[16];
sprintf(pid_buf, "%d", fsrv->fsrv_pid);
- if (fsrv->qemu_mode == 2) {
+ if (fsrv->taint_mode) {
setenv("__AFL_TARGET_PID3", pid_buf, 1);
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 432e064..669bd65 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -961,7 +961,7 @@
}
/* perform taint gathering on the input seed */
- if (afl->fsrv.taint_mode)
+ if (afl->taint_mode)
perform_taint_run(afl, q, q->fname, use_mem, q->len);
q = q->next;
@@ -1502,7 +1502,7 @@
if (delete_files(fn, CASE_PREFIX)) { goto dir_cleanup_failed; }
ck_free(fn);
- if (afl->fsrv.taint_mode) {
+ if (afl->taint_mode) {
fn = alloc_printf("%s/taint", afl->out_dir);
mkdir(fn, 0755); // ignore errors
@@ -1745,7 +1745,7 @@
/* Taint directory if taint_mode. */
- if (afl->fsrv.taint_mode) {
+ if (afl->taint_mode) {
tmp = alloc_printf("%s/taint", afl->out_dir);
if (mkdir(tmp, 0700)) { PFATAL("Unable to create '%s'", tmp); }
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 4b2fd90..69f885c 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -460,7 +460,7 @@
u32 tmp_val = 0;
- if (unlikely(afl->fsrv.taint_mode)) {
+ if (unlikely(afl->taint_mode)) {
tmp_val = afl->queue_cycle % 2;
ret_val = 0;
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index b56e10f..bb44e46 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -220,6 +220,7 @@
} else {
+ FATAL("count not create '%s'", fnw);
q->taint_bytes_new = 0;
}
@@ -419,7 +420,7 @@
afl->last_path_time = get_cur_time();
/* trigger the tain gathering if this is not a dry run */
- if (afl->fsrv.taint_mode && mem) {
+ if (afl->taint_mode && mem) {
perform_taint_run(afl, q, fname, mem, len);
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 058f8c2..5f92833 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -349,7 +349,7 @@
}
- if (unlikely(afl->fsrv.taint_mode))
+ if (unlikely(afl->taint_mode))
q->exec_cksum = 0;
else if (q->exec_cksum) {
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index e623836..bead2ed 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -288,7 +288,7 @@
switch (opt) {
case 'A':
- afl->fsrv.taint_mode = 1;
+ afl->taint_mode = 1;
if (!mem_limit_given) { afl->fsrv.mem_limit = MEM_LIMIT_QEMU; }
break;
@@ -829,10 +829,10 @@
}
- if (afl->fsrv.taint_mode && afl->fsrv.map_size < MAX_FILE) {
+ if (afl->taint_mode && afl->fsrv.map_size < MAX_FILE) {
real_map_size = map_size;
- map_size = afl->fsrv.map_size = afl->shm.map_size = MAX_FILE;
+ map_size = MAX_FILE;
}
@@ -891,9 +891,12 @@
if (afl->crash_mode) { FATAL("-C and -n are mutually exclusive"); }
if (afl->fsrv.qemu_mode) { FATAL("-Q and -n are mutually exclusive"); }
if (afl->unicorn_mode) { FATAL("-U and -n are mutually exclusive"); }
- if (afl->fsrv.taint_mode) { FATAL("-A and -n are mutually exclusive"); }
+ if (afl->taint_mode) { FATAL("-A and -n are mutually exclusive"); }
}
+
+ if (afl->limit_time_sig != 0 && afl->taint_mode) { FATAL("-A and -L are mutually exclusive"); }
+ if (afl->unicorn_mode != 0 && afl->taint_mode) { FATAL("-A and -U are mutually exclusive"); }
if (get_afl_env("AFL_DISABLE_TRIM")) { afl->disable_trim = 1; }
@@ -992,7 +995,7 @@
if (afl->afl_env.afl_preload) {
- if (afl->fsrv.qemu_mode || afl->fsrv.taint_mode) {
+ if (afl->fsrv.qemu_mode || afl->taint_mode) {
u8 *qemu_preload = getenv("QEMU_SET_ENV");
u8 *afl_preload = getenv("AFL_PRELOAD");
@@ -1088,17 +1091,17 @@
afl->fsrv.trace_bits =
afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
- if (!afl->in_bitmap) { memset(afl->virgin_bits, 255, afl->fsrv.map_size); }
- memset(afl->virgin_tmout, 255, afl->fsrv.map_size);
- memset(afl->virgin_crash, 255, afl->fsrv.map_size);
-
- if (map_size != real_map_size) {
+ if (real_map_size && map_size != real_map_size) {
afl->fsrv.map_size = real_map_size;
if (afl->cmplog_binary) afl->cmplog_fsrv.map_size = real_map_size;
}
+ if (!afl->in_bitmap) { memset(afl->virgin_bits, 255, afl->fsrv.map_size); }
+ memset(afl->virgin_tmout, 255, afl->fsrv.map_size);
+ memset(afl->virgin_crash, 255, afl->fsrv.map_size);
+
init_count_class16();
if (afl->is_main_node && check_main_node_exists(afl) == 1) {
@@ -1260,7 +1263,7 @@
}
- if (afl->fsrv.taint_mode) {
+ if (afl->taint_mode) {
ACTF("Spawning qemu_taint forkserver");
@@ -1268,7 +1271,6 @@
setenv("AFL_DISABLE_LLVM_INSTRUMENTATION", "1", 0);
afl_fsrv_init_dup(&afl->taint_fsrv, &afl->fsrv);
- afl->taint_fsrv.qemu_mode = 2;
afl->taint_fsrv.taint_mode = 1;
afl->taint_fsrv.trace_bits = afl->fsrv.trace_bits;
@@ -1399,7 +1401,7 @@
break;
case 1:
if (afl->limit_time_sig == 0 && !afl->custom_only &&
- !afl->python_only && !afl->fsrv.taint_mode) {
+ !afl->python_only && !afl->taint_mode) {
afl->limit_time_sig = -1;
afl->limit_time_puppet = 0;
@@ -1588,7 +1590,7 @@
}
if (afl->cmplog_binary) afl_fsrv_deinit(&afl->cmplog_fsrv);
- if (afl->fsrv.taint_mode) afl_fsrv_deinit(&afl->taint_fsrv);
+ if (afl->taint_mode) afl_fsrv_deinit(&afl->taint_fsrv);
afl_fsrv_deinit(&afl->fsrv);
if (afl->orig_cmdline) { ck_free(afl->orig_cmdline); }
if (afl->argv_taint) { ck_free(afl->argv_taint); }
