diff --git a/src/afl-cc.c b/src/afl-cc.c index 5e7a9c9e16498367f1b0699a595582c92e5b925c..53fba1e7b3e3ff01365a81ec2c9c56712be82b3e 100644 --- a/src/afl-cc.c +++ b/src/afl-cc.c @@ -668,8 +668,8 @@ static void edit_params(u32 argc, char **argv, char **envp) { #if defined(AFL_CLANG_LDPATH) && LLVM_MAJOR >= 15 // The NewPM implementation only works fully since LLVM 15. - cc_params[cc_par_cnt++] = - alloc_printf("-Wl,--load-pass-plugin=%s/SanitizerCoverageLTO.so", obj_path); + cc_params[cc_par_cnt++] = alloc_printf( + "-Wl,--load-pass-plugin=%s/SanitizerCoverageLTO.so", obj_path); #elif defined(AFL_CLANG_LDPATH) && LLVM_MAJOR >= 13 cc_params[cc_par_cnt++] = "-Wl,--lto-legacy-pass-manager"; cc_params[cc_par_cnt++] = diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c index 4ffcfd2b27296fe9a6fe48335a2438599e0f90ee..e41d29fda24d8e1a1e4274e75b4ec2735db5a699 100644 --- a/src/afl-fuzz-init.c +++ b/src/afl-fuzz-init.c @@ -2420,7 +2420,9 @@ void get_core_count(afl_state_t *afl) { } else if ((s64)cur_runnable + 1 <= (s64)afl->cpu_core_count) { - OKF("Try parallel jobs - see %s/parallel_fuzzing.md.", doc_path); + OKF("Try parallel jobs - see " + "%s/fuzzing_in_depth.md#c-using-multiple-cores", + doc_path); } diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 1f0fcab15568e2275ecb48d576790a3ba7fe7fb4..294c42f6bb5c0c7e2187147e6304cd9f45fc2c2a 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -192,9 +192,9 @@ static void usage(u8 *argv0, int more_help) { "executions.\n\n" "Other stuff:\n" - " -M/-S id - distributed mode (see docs/parallel_fuzzing.md)\n" - " -M auto-sets -D, -Z (use -d to disable -D) and no " - "trimming\n" + " -M/-S id - distributed mode (-M sets -Z and disables trimming)\n" + " see docs/fuzzing_in_depth.md#c-using-multiple-cores\n" + " for effective recommendations for parallel fuzzing.\n" " -F path - sync to a foreign fuzzer queue directory (requires " "-M, can\n" " be specified up to %u times)\n" diff --git a/src/afl-gotcpu.c b/src/afl-gotcpu.c index 539206ce8a8a0c73271af25f643fc8c7b932448e..eee642fb9fef6850f093228c5901fa1102bc36b1 100644 --- a/src/afl-gotcpu.c +++ b/src/afl-gotcpu.c @@ -19,7 +19,8 @@ This tool provides a fairly accurate measurement of CPU preemption rate. It is meant to complement the quick-and-dirty load average widget shown - in the afl-fuzz UI. See docs/parallel_fuzzing.md for more info. + in the afl-fuzz UI. See docs/fuzzing_in_depth.md#c-using-multiple-cores + for more info. For some work loads, the tool may actually suggest running more instances than you have CPU cores. This can happen if the tested program is spending diff --git a/utils/aflpp_driver/aflpp_driver.c b/utils/aflpp_driver/aflpp_driver.c index 52b98f417bea9f737431ff7ec14a343d80a25794..7e553723ed9021c352fd03bb116a129ff3bc76a5 100644 --- a/utils/aflpp_driver/aflpp_driver.c +++ b/utils/aflpp_driver/aflpp_driver.c @@ -198,7 +198,9 @@ size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) { } // Execute any files provided as parameters. -static int ExecuteFilesOnyByOne(int argc, char **argv) { +static int ExecuteFilesOnyByOne(int argc, char **argv, + int (*callback)(const uint8_t *data, + size_t size)) { unsigned char *buf = (unsigned char *)malloc(MAX_FILE); @@ -234,7 +236,7 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) { prev_length = length; printf("Reading %zu bytes from %s\n", length, argv[i]); - LLVMFuzzerTestOneInput(buf, length); + callback(buf, length); printf("Execution successful.\n"); } @@ -312,7 +314,7 @@ int LLVMFuzzerRunDriver(int *argcp, char ***argvp, __afl_sharedmem_fuzzing = 0; __afl_manual_init(); - return ExecuteFilesOnyByOne(argc, argv); + return ExecuteFilesOnyByOne(argc, argv, callback); } else if (argc == 2 && argv[1][0] == '-') { @@ -328,7 +330,7 @@ int LLVMFuzzerRunDriver(int *argcp, char ***argvp, if (argc == 2) { __afl_manual_init(); } - return ExecuteFilesOnyByOne(argc, argv); + return ExecuteFilesOnyByOne(argc, argv, callback); } @@ -338,7 +340,7 @@ int LLVMFuzzerRunDriver(int *argcp, char ***argvp, // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization // on the first execution of LLVMFuzzerTestOneInput is ignored. - LLVMFuzzerTestOneInput(dummy_input, 4); + callback(dummy_input, 4); __asan_poison_memory_region(__afl_fuzz_ptr, MAX_FILE); size_t prev_length = 0; @@ -375,7 +377,7 @@ int LLVMFuzzerRunDriver(int *argcp, char ***argvp, while (__afl_persistent_loop(N)) { - LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len); + callback(__afl_fuzz_ptr, *__afl_fuzz_len); }