Roll src/third_party/afl/src/ 2.14b..2.30b (16 versions).

third_party/afl/src/llvm_mode/afl-llvm-rt.o.c

 /*
    american fuzzy lop - LLVM instrumentation bootstrap
    ---------------------------------------------------
 
    Written by Laszlo Szekeres <lszekeres@google.com> and
               Michal Zalewski <lcamtuf@google.com>
 
    LLVM integration design comes from Laszlo Szekeres.
 
    Copyright 2015, 2016 Google Inc. All rights reserved.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at:
 
      http://www.apache.org/licenses/LICENSE-2.0
 
    This code is the rewrite of afl-as.h's main_payload.
 
 */
 
 #include "../config.h"
 #include "../types.h"
 
 #include <stdio.h>
 #include <stdlib.h>
 #include <signal.h>
 #include <unistd.h>
+#include <string.h>
 #include <assert.h>
 
 #include <sys/mman.h>
 #include <sys/shm.h>
 #include <sys/wait.h>
 #include <sys/types.h>
 
 
 /* Globals needed by the injected instrumentation. The __afl_area_initial region
    is used for instrumentation output before __afl_map_shm() has a chance to run.
@@ skipping 123 matching lines @@
 
 /* A simplified persistent mode handler, used as explained in README.llvm. */
 
 int __afl_persistent_loop(unsigned int max_cnt) {
 
   static u8  first_pass = 1;
   static u32 cycle_cnt;
 
   if (first_pass) {
 
+    /* Make sure that every iteration of __AFL_LOOP() starts with a clean slate.
+       On subsequent calls, the parent will take care of that, but on the first
+       iteration, it's our job to erase any trace of whatever happened
+       before the loop. */
+
+    if (is_persistent) {
+
+      memset(__afl_area_ptr, 0, MAP_SIZE);
+      __afl_area_ptr[0] = 1;
+      __afl_prev_loc = 0;
+    }
+
     cycle_cnt  = max_cnt;
     first_pass = 0;
     return 1;
 
   }
 
-  if (is_persistent && --cycle_cnt) {
+  if (is_persistent) {
 
-    raise(SIGSTOP);
-    return 1;
+    if (--cycle_cnt) {
 
-  } else return 0;
+      raise(SIGSTOP);
+
+      __afl_area_ptr[0] = 1;
+      __afl_prev_loc = 0;
+
+      return 1;
+
+    } else {
+
+      /* When exiting __AFL_LOOP(), make sure that the subsequent code that
+         follows the loop is not traced. We do that by pivoting back to the
+         dummy output region. */
+
+      __afl_area_ptr = __afl_area_initial;
+
+    }
+
+  }
+
+  return 0;
 
 }
 
 
 /* This one can be called from user code when deferred forkserver mode
     is enabled. */
 
 void __afl_manual_init(void) {
 
   static u8 init_done;
@@ skipping 80 matching lines @@
   inst_ratio_scaled = inst_ratio_scaled * MIN(4096, MAP_SIZE) / 100;
 
 }
 
 
 /* Work around a short-lived bug in LLVM with -fsanitize-coverage=trace-pc. */
 
 void __sanitizer_cov_module_init(void) __attribute__((weak));
 void __sanitizer_cov_module_init(void) { }