google / afl Goto Github PK
View Code? Open in Web Editor NEWamerican fuzzy lop - a security-oriented fuzzer
Home Page: https://lcamtuf.coredump.cx/afl/
License: Apache License 2.0
american fuzzy lop - a security-oriented fuzzer
Home Page: https://lcamtuf.coredump.cx/afl/
License: Apache License 2.0
Hello team,
I'll try to be as concise as possible.
Intro: I'm fuzzing a program called "tiff2pdf", version 3.9.7 You can get a copy of it here.
In short, tiff2pdf converts a TIFF image to a PDF document.
Description/summary: When I'm trying to fuzz tiff2pdf with a certain input, it causes AFL to freeze/crush. afl-fuzz doesn't continue after attempting to dry run with the input.
[*] Attempting dry run with 'id:000001,orig:tiff2pdf_error_input'...
Visual proof:
= Stuck for good. Won't continue from this point on. =
Environment:
Ubuntu 16.04.4
AFL 2.56b
Steps to reproduce:
In the directory tiff-3.9.7:
./configure
make
Note: tiff2pdf was compiled with the default makefile option and not with afl-gcc.
gcc -g -O2 -Wall -W -o tiff2pdf tiff2pdf.o ../libtiff/.libs/libtiff.a ../port/.libs/libport.a -llzma -ljbig -ljpeg -lz -lm
Command: ./afl-fuzz -Q -i /path/to/inputdir/ -o /path/to/outputdir/ /path/to/tiff2pdf @@
The input that causes the issue:
tiff2pdf_error_input.zip
An okay input:
seed-0.zip
If you can deliver any insight, or any ideas on how to solve this issue, please let me know. I'll continue debugging with gdb to get to the bottom of this issue.
Extra:
Running tiff2pdf with the troublesome input (without afl-fuzz): https://pastebin.com/BuT5sdyL
Hi! Tell me please
How do I access stderr
stdout
of the program we are testing?
I compiled my program this way (using memory sanitizer):
afl-gcc -fsaninite=address -g main.c -o myprog
Next, I run the fuzzer, but how do I get stderr myprog
??
I would like to know where is the part of the afl algorithm where the seeds change. Where is it implemented? Does it change randomly?
AFL version: 2.56b
Command: afl-fuzz -i fuzz/ -o findings ./lang @@
OS: Manjaro Linux
CPU: Intel Core i5-2400S CPU @ 2.50GHz
On running afl-fuzz I got this message:
Whoops, your system uses on-demand CPU frequency scaling, adjusted
between 1562 and 3222 MHz. Unfortunately, the scaling algorithm in the
kernel is imperfect and can miss the short-lived processes spawned by
afl-fuzz. To keep things moving, run these commands as root:
cd /sys/devices/system/cpu
echo performance | tee cpu*/cpufreq/scaling_governor
You can later go back to the original state by replacing 'performance' with
'ondemand'. If you don't want to change the settings, set AFL_SKIP_CPUFREQ
to make afl-fuzz skip this check - but expect some performance drop.
I followed the directions and fuzzed my program. But when I tried to revert the scaling governors, I got:
[root@will-mac cpu]# echo ondemand | tee cpu*/cpufreq/scaling_governor
ondemand
tee: cpu0/cpufreq/scaling_governor: Invalid argument
tee: cpu1/cpufreq/scaling_governor: Invalid argument
tee: cpu2/cpufreq/scaling_governor: Invalid argument
tee: cpu3/cpufreq/scaling_governor: Invalid argument
After some digging it seems that Sandy Bridge CPUs do not use ondemand
.
Arch Wiki
Forum post
I was able to successfully use powersave
.
Perhaps the message printed by check_cpu_governor
could include the existing value in /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor
rather than always printing "on-demand". I would be happy to patch this myself if it is an acceptable solution.
Is it possible to make afl-analyze accept the AFL_SKIP_BIN_CHECK flag? It does not seem to work properly, as afl-analyze reports my binary is not instrumented.
We probably should probably at least add the configs we use in Chrome in OSS-Fuzz, ie: building AFL with latest clang and using trace-pc-guard
.
I see the patch of add android support, is it ready to use on Android?
if yes, can you provide some documentation? thanks
Hi guys,
Any chance someone can take a look at this SO question?
I think a simple quick answer may help newcomers like myself.
Thanks!
Hi, I checked the code and found that even if the COVERAGE_ONLY
and SKIP_COUNT
is defined in config.h
, the llvm_mode still acts as edge coverage with counter.
Do you think these features should be supported in llvm_mode?
Hi, I was trying to build afl-clang*-fast
toolchains using clang built from source.The compiler wrappers do build successfully, however they fail at the test_build
with the following error:
clang (LLVM option parsing): Unknown command line argument '-sanitizer-coverage-block-threshold=0'. Try: 'clang (LLVM option parsing) --help'
clang (LLVM option parsing): Did you mean ' --sanitizer-coverage-pc-table=0'?
The error does indeed stop occuring if I make the mentioned fix in afl-clang-fast.c
. However, from what I understand these are two completely different flags. The original flags is associated with inlining instrumentation callbacks and the pc-table
flag refers to a feature where PC's corresponding to function/non-function entry blocks is made as a pre-processing step.
My clang version which I built from source is:
clang version 10.0.0 ([email protected]:llvm-mirror/clang.git 65acf43270ea2894dffa0d0b292b92402f80c8cb) ([email protected]:llvm-mirror/llvm.git 2c4ca6832fa6b306ee6a7010bfb80a3f2596f824)
Target: x86_64-unknown-linux-gnu
The command I am using to build llvm_mode is: AFL_TRACE_PC=1 CC=/path/to/built/clang CXX=/path/to/built/clang++ make -C llvm_mode clean all
There is some initial implementation by @alessandrogario in #11.
See #11 (comment) for motivation / goals.
Hi everyone,
AFL source code is now available on GitHub: https://github.com/google/AFL
There is also a new v2.53b release, but it doesn't have any functional changes, i.e. it's essentially the same as 2.52b, except of some minor comments / documentation updates: https://github.com/google/AFL/releases/tag/v2.53b
Excellent choice moving the project to GitHub! Welcome!
What is the background behind the move and what is planned for the future of AFL?
Is AFL now officially a Google project? :-)
Came up during the team meeting today
Looks like the following error is still happening in Kali despite being fixed in Debian & Ubuntu. Fwiw, this issue occurs in the master branch:
$ ./build_qemu_support.sh
=================================================
AFL binary-only instrumentation QEMU build script
=================================================
[*] Performing basic sanity checks...
[+] All checks passed!
[*] Downloading QEMU 2.10.0 from the web...
--2020-07-24 05:18:48-- http://download.qemu-project.org/qemu-2.10.0.tar.xz
Resolving download.qemu-project.org (download.qemu-project.org)... 172.99.69.163
Connecting to download.qemu-project.org (download.qemu-project.org)|172.99.69.163|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://download.qemu.org/qemu-2.10.0.tar.xz [following]
--2020-07-24 05:18:49-- http://download.qemu.org/qemu-2.10.0.tar.xz
Resolving download.qemu.org (download.qemu.org)... 172.99.69.163
Reusing existing connection to download.qemu-project.org:80.
HTTP request sent, awaiting response... 302 Found
Location: https://download.qemu.org/qemu-2.10.0.tar.xz [following]
--2020-07-24 05:18:49-- https://download.qemu.org/qemu-2.10.0.tar.xz
Connecting to download.qemu.org (download.qemu.org)|172.99.69.163|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 25040324 (24M) [application/x-xz]
Saving to: ‘qemu-2.10.0.tar.xz’
qemu-2.10.0.tar.xz 100%[========================================================================================>] 23.88M 12.6MB/s in 1.9s
2020-07-24 05:18:52 (12.6 MB/s) - ‘qemu-2.10.0.tar.xz’ saved [25040324/25040324]
[+] Cryptographic signature on qemu-2.10.0.tar.xz checks out.
[*] Uncompressing archive (this will take a while)...
[+] Unpacking successful.
[*] Configuring QEMU for ...
[*] Applying patches...
patching file linux-user/elfload.c
patching file accel/tcg/cpu-exec.c
patching file linux-user/syscall.c
[+] Patching done.
Install prefix /usr/local
BIOS directory /usr/local/share/qemu
binary directory /usr/local/bin
library directory /usr/local/lib
module directory /usr/local/lib/qemu
libexec directory /usr/local/libexec
include directory /usr/local/include
config directory /usr/local/etc
local state directory /usr/local/var
Manual directory /usr/local/share/man
ELF interp prefix /usr/gnemul/qemu-%M
Source path /opt/afl-dev/qemu_mode/qemu-2.10.0
C compiler cc
Host C compiler cc
C++ compiler c++
Objective-C compiler clang
ARFLAGS rv
CFLAGS -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -g -O3 -ggdb
QEMU_CFLAGS -I/usr/include/pixman-1 -I$(SRC_PATH)/dtc/libfdt -pthread -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -DNCURSES_WIDECHAR -D_DEFAULT_SOURCE -D_XOPEN_SOURCE=600 -fPIE -DPIE -m64 -mcx16 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -fwrapv -Wexpansion-to-defined -Wendif-labels -Wno-shift-negative-value -Wno-missing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits -fstack-protector-strong -I/usr/include/libusb-1.0
LDFLAGS -Wl,--warn-common -Wl,-z,relro -Wl,-z,now -pie -m64 -g
make make
install install
python python -B
smbd /usr/sbin/smbd
module support no
host CPU x86_64
host big endian no
target list x86_64-linux-user
gprof enabled no
sparse enabled no
strip binaries yes
profiler no
static build no
pixman system
SDL support no
GTK support no
GTK GL support no
VTE support no
TLS priority NORMAL
GNUTLS support no
GNUTLS rnd no
libgcrypt no
libgcrypt kdf no
nettle no
nettle kdf no
libtasn1 no
curses support yes
virgl support no
curl support yes
mingw32 support no
Audio drivers oss
Block whitelist (rw)
Block whitelist (ro)
VirtFS support
VNC support no
xen support no
brlapi support no
bluez support yes
Documentation no
PIE yes
vde support no
netmap support no
Linux AIO support no
ATTR/XATTR support yes
Install blobs yes
KVM support yes
HAX support no
TCG support yes
TCG debug enabled no
TCG interpreter no
RDMA support no
fdt support yes
preadv support yes
fdatasync yes
madvise yes
posix_madvise yes
libcap-ng support no
vhost-net support yes
vhost-scsi support yes
vhost-vsock support yes
vhost-user support yes
Trace backends log
spice support no
rbd support no
xfsctl support no
smartcard support no
libusb yes
usb net redir no
OpenGL support no
OpenGL dmabufs no
libiscsi support no
libnfs support no
build guest agent yes
QGA VSS support no
QGA w32 disk info no
QGA MSI support no
seccomp support yes
coroutine backend ucontext
coroutine pool yes
debug stack usage no
crypto afalg no
GlusterFS support no
gcov gcov
gcov enabled no
TPM support yes
libssh2 support no
TPM passthrough yes
QOM debugging yes
Live block migration yes
lzo support no
snappy support no
bzip2 support yes
NUMA host support no
tcmalloc support no
jemalloc support no
avx2 optimization yes
replication support yes
VxHS block device no
[+] Configuration complete.
[*] Attempting to build QEMU (fingers crossed!)...
GEN x86_64-linux-user/config-devices.mak.tmp
GEN x86_64-linux-user/config-devices.mak
GEN config-all-devices.mak
GEN config-host.h
DEP tests/dumptrees.c
DEP tests/trees.S
DEP tests/testutils.c
DEP tests/value-labels.c
DEP tests/asm_tree_dump.c
DEP tests/truncated_property.c
DEP tests/check_path.c
DEP tests/overlay_bad_fixup.c
DEP tests/overlay.c
DEP tests/subnode_iterate.c
DEP tests/property_iterate.c
DEP tests/integer-expressions.c
DEP tests/utilfdt_test.c
DEP tests/path_offset_aliases.c
DEP tests/add_subnode_with_nops.c
DEP tests/dtbs_equal_unordered.c
DEP tests/dtb_reverse.c
DEP tests/dtbs_equal_ordered.c
DEP tests/extra-terminating-null.c
DEP tests/incbin.c
DEP tests/boot-cpuid.c
DEP tests/phandle_format.c
DEP tests/path-references.c
DEP tests/references.c
DEP tests/string_escapes.c
DEP tests/propname_escapes.c
DEP tests/appendprop2.c
DEP tests/appendprop1.c
DEP tests/del_node.c
DEP tests/del_property.c
DEP tests/setprop.c
DEP tests/set_name.c
DEP tests/rw_tree1.c
DEP tests/open_pack.c
DEP tests/nopulate.c
DEP tests/mangle-layout.c
DEP tests/move_and_save.c
DEP tests/sw_tree1.c
DEP tests/nop_node.c
DEP tests/nop_property.c
DEP tests/setprop_inplace.c
DEP tests/stringlist.c
DEP tests/addr_size_cells.c
DEP tests/notfound.c
DEP tests/sized_cells.c
DEP tests/char_literal.c
DEP tests/get_alias.c
DEP tests/node_offset_by_compatible.c
DEP tests/node_check_compatible.c
DEP tests/node_offset_by_phandle.c
DEP tests/node_offset_by_prop_value.c
DEP tests/parent_offset.c
DEP tests/supernode_atdepth_offset.c
DEP tests/get_path.c
DEP tests/get_phandle.c
DEP tests/getprop.c
DEP tests/get_name.c
DEP tests/path_offset.c
DEP tests/subnode_offset.c
DEP tests/find_property.c
DEP tests/root_node.c
DEP tests/get_mem_rsv.c
DEP libfdt/fdt_overlay.c
DEP libfdt/fdt_addresses.c
DEP libfdt/fdt_empty_tree.c
DEP libfdt/fdt_strerror.c
DEP libfdt/fdt_rw.c
DEP libfdt/fdt_sw.c
DEP libfdt/fdt_wip.c
DEP libfdt/fdt_ro.c
DEP libfdt/fdt.c
DEP util.c
DEP fdtput.c
DEP fdtget.c
DEP fdtdump.c
LEX convert-dtsv0-lexer.lex.c
DEP convert-dtsv0-lexer.lex.c
DEP srcpos.c
BISON dtc-parser.tab.c
DEP dtc-parser.tab.c
LEX dtc-lexer.lex.c
DEP dtc-lexer.lex.c
DEP treesource.c
DEP livetree.c
DEP fstree.c
DEP flattree.c
DEP dtc.c
DEP data.c
DEP checks.c
CHK version_gen.h
UPD version_gen.h
DEP util.c
CHK version_gen.h
CC libfdt/fdt.o
CC libfdt/fdt_ro.o
CC libfdt/fdt_wip.o
CC libfdt/fdt_sw.o
CC libfdt/fdt_rw.o
CC libfdt/fdt_strerror.o
CC libfdt/fdt_empty_tree.o
CC libfdt/fdt_addresses.o
CC libfdt/fdt_overlay.o
AR libfdt/libfdt.a
ar: creating libfdt/libfdt.a
a - libfdt/fdt.o
a - libfdt/fdt_ro.o
a - libfdt/fdt_wip.o
a - libfdt/fdt_sw.o
a - libfdt/fdt_rw.o
a - libfdt/fdt_strerror.o
a - libfdt/fdt_empty_tree.o
a - libfdt/fdt_addresses.o
a - libfdt/fdt_overlay.o
GEN qemu-options.def
GEN qmp-commands.h
GEN qapi-types.h
GEN qapi-visit.h
GEN qapi-event.h
GEN qmp-marshal.c
GEN qapi-types.c
GEN qapi-visit.c
GEN qapi-event.c
GEN qmp-introspect.h
GEN qmp-introspect.c
GEN trace/generated-tcg-tracers.h
GEN trace/generated-helpers-wrappers.h
GEN trace/generated-helpers.h
GEN trace/generated-helpers.c
GEN module_block.h
GEN tests/test-qapi-types.h
GEN tests/test-qapi-visit.h
GEN tests/test-qmp-commands.h
GEN tests/test-qapi-event.h
GEN tests/test-qmp-introspect.h
GEN trace-root.h
GEN util/trace.h
GEN crypto/trace.h
GEN io/trace.h
GEN migration/trace.h
GEN block/trace.h
GEN chardev/trace.h
GEN hw/block/trace.h
GEN hw/block/dataplane/trace.h
GEN hw/char/trace.h
GEN hw/intc/trace.h
GEN hw/net/trace.h
GEN hw/virtio/trace.h
GEN hw/audio/trace.h
GEN hw/misc/trace.h
GEN hw/usb/trace.h
GEN hw/scsi/trace.h
GEN hw/nvram/trace.h
GEN hw/display/trace.h
GEN hw/input/trace.h
GEN hw/timer/trace.h
GEN hw/dma/trace.h
GEN hw/sparc/trace.h
GEN hw/sd/trace.h
GEN hw/isa/trace.h
GEN hw/mem/trace.h
GEN hw/i386/trace.h
GEN hw/i386/xen/trace.h
GEN hw/9pfs/trace.h
GEN hw/ppc/trace.h
GEN hw/pci/trace.h
GEN hw/s390x/trace.h
GEN hw/vfio/trace.h
GEN hw/acpi/trace.h
GEN hw/arm/trace.h
GEN hw/alpha/trace.h
GEN hw/xen/trace.h
GEN ui/trace.h
GEN audio/trace.h
GEN net/trace.h
GEN target/arm/trace.h
GEN target/i386/trace.h
GEN target/mips/trace.h
GEN target/sparc/trace.h
GEN target/s390x/trace.h
GEN target/ppc/trace.h
GEN qom/trace.h
GEN linux-user/trace.h
GEN qapi/trace.h
GEN accel/tcg/trace.h
GEN accel/kvm/trace.h
GEN nbd/trace.h
GEN trace-root.c
GEN util/trace.c
GEN crypto/trace.c
GEN io/trace.c
GEN migration/trace.c
GEN block/trace.c
GEN chardev/trace.c
GEN hw/block/trace.c
GEN hw/block/dataplane/trace.c
GEN hw/char/trace.c
GEN hw/intc/trace.c
GEN hw/net/trace.c
GEN hw/virtio/trace.c
GEN hw/audio/trace.c
GEN hw/misc/trace.c
GEN hw/usb/trace.c
GEN hw/scsi/trace.c
GEN hw/nvram/trace.c
GEN hw/display/trace.c
GEN hw/input/trace.c
GEN hw/timer/trace.c
GEN hw/dma/trace.c
GEN hw/sparc/trace.c
GEN hw/sd/trace.c
GEN hw/isa/trace.c
GEN hw/mem/trace.c
GEN hw/i386/trace.c
GEN hw/i386/xen/trace.c
GEN hw/9pfs/trace.c
GEN hw/ppc/trace.c
GEN hw/pci/trace.c
GEN hw/s390x/trace.c
GEN hw/vfio/trace.c
GEN hw/acpi/trace.c
GEN hw/arm/trace.c
GEN hw/alpha/trace.c
GEN hw/xen/trace.c
GEN ui/trace.c
GEN audio/trace.c
GEN net/trace.c
GEN target/arm/trace.c
GEN target/i386/trace.c
GEN target/mips/trace.c
GEN target/sparc/trace.c
GEN target/s390x/trace.c
GEN target/ppc/trace.c
GEN qom/trace.c
GEN linux-user/trace.c
GEN qapi/trace.c
GEN accel/tcg/trace.c
GEN accel/kvm/trace.c
GEN nbd/trace.c
CHK version_gen.h
CC tests/qemu-iotests/socket_scm_helper.o
LINK tests/qemu-iotests/socket_scm_helper
GEN qga/qapi-generated/qga-qapi-types.h
GEN qga/qapi-generated/qga-qapi-visit.h
GEN qga/qapi-generated/qga-qmp-commands.h
CC qga/commands.o
CC qga/guest-agent-command-state.o
CC qga/main.o
qga/main.c: In function ‘ga_log’:
qga/main.c:300:5: warning: ‘GTimeVal’ is deprecated: Use 'GDateTime' instead [-Wdeprecated-declarations]
300 | GTimeVal time;
| ^~~~~~~~
In file included from /usr/include/glib-2.0/glib/galloca.h:32,
from /usr/include/glib-2.0/glib.h:30,
from /opt/afl-dev/qemu_mode/qemu-2.10.0/include/glib-compat.h:19,
from /opt/afl-dev/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:107,
from qga/main.c:13:
/usr/include/glib-2.0/glib/gtypes.h:547:8: note: declared here
547 | struct _GTimeVal
| ^~~~~~~~~
qga/main.c:315:9: warning: ‘g_get_current_time’ is deprecated: Use 'g_get_real_time' instead [-Wdeprecated-declarations]
315 | g_get_current_time(&time);
| ^~~~~~~~~~~~~~~~~~
In file included from /usr/include/glib-2.0/glib/giochannel.h:33,
from /usr/include/glib-2.0/glib.h:54,
from /opt/afl-dev/qemu_mode/qemu-2.10.0/include/glib-compat.h:19,
from /opt/afl-dev/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:107,
from qga/main.c:13:
/usr/include/glib-2.0/glib/gmain.h:679:8: note: declared here
679 | void g_get_current_time (GTimeVal *result);
| ^~~~~~~~~~~~~~~~~~
CC qga/commands-posix.o
CC qga/channel-posix.o
GEN qga/qapi-generated/qga-qapi-types.c
CC qga/qapi-generated/qga-qapi-types.o
GEN qga/qapi-generated/qga-qapi-visit.c
CC qga/qapi-generated/qga-qapi-visit.o
GEN qga/qapi-generated/qga-qmp-marshal.c
CC qga/qapi-generated/qga-qmp-marshal.o
CC qmp-introspect.o
CC qapi-types.o
CC qapi-visit.o
CC qapi-event.o
CC qapi/qapi-visit-core.o
CC qapi/qapi-dealloc-visitor.o
CC qapi/qobject-input-visitor.o
CC qapi/qobject-output-visitor.o
CC qapi/qmp-registry.o
CC qapi/qmp-dispatch.o
CC qapi/string-input-visitor.o
qapi/string-input-visitor.c: In function ‘parse_type_uint64’:
qapi/string-input-visitor.c:261:14: warning: ‘i’ may be used uninitialized in this function [-Wmaybe-uninitialized]
261 | *obj = i;
| ~~~~~^~~
CC qapi/string-output-visitor.o
CC qapi/opts-visitor.o
CC qapi/qapi-clone-visitor.o
CC qapi/qmp-event.o
CC qapi/qapi-util.o
CC qobject/qnull.o
CC qobject/qnum.o
CC qobject/qstring.o
CC qobject/qdict.o
CC qobject/qlist.o
CC qobject/qbool.o
CC qobject/qjson.o
CC qobject/qobject.o
CC qobject/json-lexer.o
CC qobject/json-streamer.o
CC qobject/json-parser.o
CC trace/control.o
CC trace/qmp.o
CC util/osdep.o
CC util/cutils.o
CC util/unicode.o
CC util/qemu-timer-common.o
CC util/bufferiszero.o
CC util/lockcnt.o
CC util/aiocb.o
CC util/async.o
CC util/thread-pool.o
CC util/qemu-timer.o
CC util/main-loop.o
CC util/iohandler.o
CC util/aio-posix.o
CC util/compatfd.o
CC util/event_notifier-posix.o
CC util/mmap-alloc.o
CC util/oslib-posix.o
CC util/qemu-openpty.o
CC util/qemu-thread-posix.o
CC util/memfd.o
util/memfd.c:40:12: error: static declaration of ‘memfd_create’ follows non-static declaration
40 | static int memfd_create(const char *name, unsigned int flags)
| ^~~~~~~~~~~~
In file included from /usr/include/x86_64-linux-gnu/bits/mman-linux.h:111,
from /usr/include/x86_64-linux-gnu/bits/mman.h:34,
from /usr/include/x86_64-linux-gnu/sys/mman.h:41,
from /opt/afl-dev/qemu_mode/qemu-2.10.0/include/sysemu/os-posix.h:29,
from /opt/afl-dev/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:104,
from util/memfd.c:28:
/usr/include/x86_64-linux-gnu/bits/mman-shared.h:50:5: note: previous declaration of ‘memfd_create’ was here
50 | int memfd_create (const char *__name, unsigned int __flags) __THROW;
| ^~~~~~~~~~~~
make: *** [/opt/afl-dev/qemu_mode/qemu-2.10.0/rules.mak:66: util/memfd.o] Error 1
$ lsb_release -a
No LSB modules are available.
Distributor ID: Kali
Description: Kali GNU/Linux Rolling
Release: 2020.3
Codename: kali-rolling
I fuzzed OpenJPEG (https://github.com/uclouvain/openjpeg) with AFL and used libdislocator.so. Because OpenJPEG uses posix_memalign in its code, malloc of libc is called (not malloc in libdislocator.so). Later, free of libdislocator.so is called to free the pointer returned from malloc in libc, so triggers "bad allocator canary on free()" => false crash report.
Reproduce
Command to build OpenJPEG:
CC=gcc CXX=g++ cmake .. -DCMAKE_C_FLAGS="-std=c99 -O0 -ggdb -Wno-error -Wdeclaration-after-statement" -DBUILD_THIRDPARTY:BOOL=ON
Jp2_crash file: https://drive.google.com/open?id=11_u0WKKK71qMTzRLmjJAILs3QIQavlBF
Run opj_decompress with libdislocator:
root@manh-ubuntu16:~/fuzz/fuzz_openjpeg# LD_PRELOAD=/root/fuzz/afl-2.52b/libdislocator/libdislocator.so ./openjpeg/build-noafl/bin/opj_decompress -i ./jp2_crash -o im.pgm
===========================================
The extension of this file is incorrect.
FOUND rash. SHOULD BE .jp2
===========================================
[INFO] Start to read j2k main header (123).
[ERROR] Unknown progression order in COD marker
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
[INFO] Header of tile 1 / 1 has been read.
[ERROR] Failed to decode.
[ERROR] Failed to decode tile 1/1
[ERROR] Failed to decode the codestream in the JP2 file
ERROR -> opj_decompress: failed to decode image!
*** [AFL] bad allocator canary on free() ***
Aborted (core dumped)
Analysis
Run in gdb:
root@manh-ubuntu16:~/fuzz/fuzz_openjpeg# gdb ./openjpeg/build-noafl/bin/opj_decompress
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.5) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./openjpeg/build-noafl/bin/opj_decompress...done.
(gdb) set environment LD_PRELOAD /root/fuzz/afl-2.52b/libdislocator/libdislocator.so
(gdb) watch *0x732008
Hardware watchpoint 2: *0x732008
(gdb) r
Starting program: /root/fuzz/fuzz_openjpeg/openjpeg/build-noafl/bin/opj_decompress -i ./jp2_crash -o im.pgm
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
===========================================
The extension of this file is incorrect.
FOUND rash. SHOULD BE .jp2
===========================================
[INFO] Start to read j2k main header (123).
[ERROR] Unknown progression order in COD marker
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
[INFO] Header of tile 1 / 1 has been read.
Hardware watchpoint 2: *0x732008
Old value = <unreadable>
New value = 139265
sysmalloc (nb=nb@entry=7664, av=av@entry=0x7ffff7228b20 <main_arena>)
at malloc.c:2679
2679 malloc.c: No such file or directory.
(gdb) bt
#0 sysmalloc (nb=nb@entry=7664, av=av@entry=0x7ffff7228b20 <main_arena>)
at malloc.c:2679
#1 0x00007ffff6ee6743 in _int_malloc (
av=av@entry=0x7ffff7228b20 <main_arena>, bytes=bytes@entry=7656)
at malloc.c:3827
#2 0x00007ffff6ee9898 in __GI___libc_malloc (bytes=7656) at malloc.c:2913
#3 malloc_hook_ini (sz=7656, caller=<optimized out>) at hooks.c:32
#4 0x00007ffff6eeb7ae in _mid_memalign (address=<optimized out>, bytes=7656,
alignment=<optimized out>) at malloc.c:3083
#5 __posix_memalign (memptr=0x7fffffff8e90, alignment=<optimized out>,
size=7656) at malloc.c:5028
#6 0x00007ffff79c16a7 in opj_aligned_alloc_n (alignment=16, size=7656)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/opj_malloc.c:61
#7 0x00007ffff79c1845 in opj_aligned_malloc (size=7656)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/opj_malloc.c:209
#8 0x00007ffff799423e in opj_image_data_alloc (size=7656)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/openjpeg.c:1056
#9 0x00007ffff79bb680 in opj_alloc_tile_component_data (
l_tilec=0x7ffff7e9deb0)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/tcd.c:694
#10 0x00007ffff79bdac4 in opj_tcd_decode_tile (p_tcd=0x7ffff7ea3f98,
win_x0=16, win_y0=0, win_x1=49, win_y1=58, numcomps_to_decode=0,
comps_indices=0x0,
p_src=0x7ffff7e79eb5 "ϴ\024\001\337{\030\205\200\200\301\363\204\237\200\064\037P(\f\003\300\325\017\307\313m\264z\017\373jkC\200\200\307\312\"}A\320\371D\200\030\251\070=\303>\240\252 0$]\224x\247;\202\061\227\242B\235\025\373\353\"\241\345f╀\300\371\002", p_max_length=329, p_tile_no=0,
p_cstr_index=0x7ffff7fddfc8, p_manager=0x7ffff7fe8fa8)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/tcd.c:1530
#11 0x00007ffff79828f6 in opj_j2k_decode_tile (p_j2k=0x7ffff7fe4eb0,
p_tile_index=0, p_data=0x0, p_data_size=0, p_stream=0x7ffff7fedf88,
p_manager=0x7ffff7fe8fa8)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/j2k.c:8932
#12 0x00007ffff798731e in opj_j2k_decode_tiles (p_j2k=0x7ffff7fe4eb0,
p_stream=0x7ffff7fedf88, p_manager=0x7ffff7fe8fa8)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/j2k.c:10719
#13 0x00007ffff7980904 in opj_j2k_exec (p_j2k=0x7ffff7fe4eb0,
p_procedure_list=0x7ffff7fd5ff0, p_stream=0x7ffff7fedf88,
p_manager=0x7ffff7fe8fa8)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/j2k.c:8090
#14 0x00007ffff7987eba in opj_j2k_decode (p_j2k=0x7ffff7fe4eb0,
p_stream=0x7ffff7fedf88, p_image=0x7ffff7e9bfd0, p_manager=0x7ffff7fe8fa8)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/j2k.c:11014
#15 0x00007ffff798d2b9 in opj_jp2_decode (jp2=0x7ffff7fe6f50,
p_stream=0x7ffff7fedf88, p_image=0x7ffff7e9bfd0, p_manager=0x7ffff7fe8fa8)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/jp2.c:1603
---Type <return> to continue, or q <return> to quit---
#16 0x00007ffff799361d in opj_decode (p_codec=0x7ffff7fe8f48,
p_stream=0x7ffff7fedf88, p_image=0x7ffff7e9bfd0)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/openjpeg.c:483
#17 0x0000000000413d87 in main (argc=5, argv=0x7fffffffe428)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/bin/jp2/opj_decompress.c:1542
(gdb) c
Continuing.
Hardware watchpoint 2: *0x732008
Old value = 139265
New value = 7665
sysmalloc (nb=nb@entry=7664, av=av@entry=0x7ffff7228b20 <main_arena>)
at malloc.c:2738
2738 in malloc.c
(gdb) c
Continuing.
[ERROR] Failed to decode.
[ERROR] Failed to decode tile 1/1
[ERROR] Failed to decode the codestream in the JP2 file
ERROR -> opj_decompress: failed to decode image!
*** [AFL] bad allocator canary on free() ***
Program received signal SIGABRT, Aborted.
0x00007ffff6e99428 in __GI_raise (sig=sig@entry=6)
at ../sysdeps/unix/sysv/linux/raise.c:54
54 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 0x00007ffff6e99428 in __GI_raise (sig=sig@entry=6)
at ../sysdeps/unix/sysv/linux/raise.c:54
#1 0x00007ffff6e9b02a in __GI_abort () at abort.c:89
#2 0x00007ffff7bd570a in free (ptr=<optimized out>) at libdislocator.so.c:221
#3 0x00007ffff79c18cc in opj_aligned_free (ptr=0x732010)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/opj_malloc.c:228
#4 0x00007ffff7994260 in opj_image_data_free (ptr=0x732010)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/openjpeg.c:1064
#5 0x00007ffff79be77b in opj_tcd_free_tile (p_tcd=0x7ffff7ea3f98)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/tcd.c:1891
#6 0x00007ffff79bb5ef in opj_tcd_destroy (tcd=0x7ffff7ea3f98)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/tcd.c:676
#7 0x00007ffff7981082 in opj_j2k_destroy (p_j2k=0x7ffff7fe4eb0)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/j2k.c:8306
#8 0x00007ffff79902e2 in opj_jp2_destroy (jp2=0x7ffff7fe6f50)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/jp2.c:3012
#9 0x00007ffff7993f5b in opj_destroy_codec (p_codec=0x7ffff7fe8f48)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/lib/openjp2/openjpeg.c:927
#10 0x0000000000413dd9 in main (argc=5, argv=0x7fffffffe428)
at /root/fuzz/fuzz_openjpeg/openjpeg/src/bin/jp2/opj_decompress.c:1545
As you can see, a watch on 0x732008 shows that __posix_memalign is called, which then called malloc in libc, return a pointer of 0x732010. Later, free of libdislocator is called to free the pointer 0x732010 => "[AFL] bad allocator canary on free()" => false report.
Hello, I am trying to fuzz Android Runtime using AFL, am however not able to instrumentalize the code. I have already build AFL and used it to fuzz the target using the dumb mode. Can someone give me an hint on how to modify the project in order to instrumentalize dex2oat? I am not sure on how the different make files have to be modifed.
We just fixed this issue in AFL++: AFLplusplus/AFLplusplus#425
This bug is present also upstream with a high probability (for sure IMO reading the code).
I have copied my target files into the queue folder but it seems that AFL ignores my files. Is there anything that I can do to solve this problem?
It appears that #19 has some unintended results that produce multiple "afl_maybe_log" updates in a single basic block.
As an example, this a basic block from sqlite3, function sqlite3VMPrintf
, compiled with afl-clang-fast (clang-9). At the beginning of this basic block there are three updates to the shared map where there should only be one. I believe this is because the LLVM pass is run before optimizations. As AFL is already constrained by the MAP_SIZE and sensitive to edge collisions, this seems like a bad result. Additionally, having extra instrumentation slows down execution speed.
Is there an alternative solution?
Can libdislocator detect heap buffer overflows?
Anyone familiar with this?
Emailing [email protected] is no longer the correct way to raise issues about AFL, in part because I don't think this email email address is active anymore (see #30) for example.
We should probably replace references to it with the afl-users mailing list or this tracker.
Hi there,
I have some troubles with getting afl-fuzz to work on Kali Linux 2020.2 to work against any binary. This is the tutorial that I have been following.
https://medium.com/@int0x33/day-8-fuzzing-101-with-afl-678828cd7fa7
When I issue the afl-fuzz command it gives me this error.
Sorry if I haven't posted this properly. Let me know if there's any more information you need.
Thanks.
Hello,
I would like to know if the AFL has the ability to use multiple files for input.
The program reads part of the data from the stdin, and the second part-from any file.
Can I fuzz such a program?
I know that the AFL does not support this, but maybe there are some tricks?
thank you very much
I was trying AFL-2.54b with the LLVM trace_pc_guard feature, however it failed to build with LLVM 10.0.0-svn371489 (of course, I commented out -sanitizer-coverage-block-threshold=0
related lines in afl-clang-fast.c).
So it turns out that the execution traces are unexpectedly the same when the inputs are 0 and 1, which can be confirmed by observing the following results:
I got LLVM/Clang from https://apt.llvm.org (Ubuntu 18.04.2 LTS).
I also tried building AFL-2.54b with LLVM-4.0, where there are no issues for builds, and the trace_pc_mode seems working on projects such as exiv2.
Meanwhile, I tried AFLplusplus with the same LLVM/Clang build tools (v10.0), it builds and tests without errors, despite that compared to AFL-2.54b I can see no big changes for the trace_pc_guard feature.
to block non-formatted changes
When I set command
afl-fuzz -i i -o o -f test.sav ./xxx -l test.sav
The program told me I need to relax the -t option
I try to set -t 100+ or other value like 500+
afl-fuzz -t 100+ -i i -o o -f test.sav ./xxx -l test.savIt
It still shows the error
[-] PROGRAM ABORT : All test cases time out, giving up!
Location : perform_dry_run(), afl-fuzz.c:2905
# clang -v
clang version 10.0.0 (https://github.com/llvm/llvm-project.git e84b7a5fe230e42b8e6fe451369874a773bf1867)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /usr/local/bin
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/5
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/5.4.0
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/6
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/6.0.0
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/5.4.0
Candidate multilib: .;@m64
Candidate multilib: 32;@m32
Candidate multilib: x32;@mx32
Selected multilib: .;@m64
# cd /AFL/llvm_mode
# make
[*] Checking for working 'llvm-config'...
[*] Checking for working 'clang'...
[*] Checking for '../afl-showmap'...
[+] All set and ready to build.
clang -O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH=\"/usr/local/lib/afl\" -DBIN_PATH=\"/usr/local/bin\" -DVERSION=\"2.56b\" afl-clang-fast.c -o ../afl-clang-fast
ln -sf afl-clang-fast ../afl-clang-fast++
clang++ `llvm-config --cxxflags` -Wl,-znodelete -fno-rtti -fpic -O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -stdlib=libc++ -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DVERSION=\"2.56b\" -Wno-variadic-macros -shared afl-llvm-pass.so.cc -o ../afl-llvm-pass.so `llvm-config --ldflags`
clang -O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH=\"/usr/local/lib/afl\" -DBIN_PATH=\"/usr/local/bin\" -DVERSION=\"2.56b\" -fPIC -c afl-llvm-rt.o.c -o ../afl-llvm-rt.o
[*] Building 32-bit variant of the runtime (-m32)... success!
[*] Building 64-bit variant of the runtime (-m64)... success!
[*] Testing the CC wrapper and instrumentation output...
unset AFL_USE_ASAN AFL_USE_MSAN AFL_INST_RATIO; AFL_QUIET=1 AFL_PATH=. AFL_CC=clang ../afl-clang-fast -O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH=\"/usr/local/lib/afl\" -DBIN_PATH=\"/usr/local/bin\" -DVERSION=\"2.56b\" ../test-instr.c -o test-instr
error: unable to load plugin '../afl-llvm-pass.so': '../afl-llvm-pass.so: undefined symbol: _ZNK4llvm10ModulePass17createPrinterPassERNS_11raw_ostreamERKNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEE'
Makefile:98: recipe for target 'test_build' failed
make: *** [test_build] Error 1
which after cxxfilt:
llvm::ModulePass::createPrinterPass(llvm::raw_ostream&, std::__1::basic_string<char, std::__1::char_traits, std::__1::allocator > const&) const
but I cannot find any reference to createPrinterPass in afl source code.
# AFL_POST_LIBRARY=afl-tee/out/afl_validate.so AFL_NO_FORKSRV=1 ./AFL/afl-fuzz - i AFL/testcases -t 300+ -o /tmp/state -M $1 -- afl-tee/ca/tee_invoke_svc afl-fuzz 2.56b by <[email protected]> [+] You have 1 CPU core and 1 runnable tasks (utilization: 100%). [*] Checking core_pattern... [*] Loading postprocessor from 'afl-tee/out/afl_validate.so'... [+] Postprocessor installed successfully. [*] Setting up output directories... [*] Scanning 'AFL/testcases'... [+] No auto-generated dictionary tokens to reuse. [*] Creating hard links for all input files... [*] Validating target binary... [*] Attempting dry run with 'id:000000,orig:README.testcases'...
[-] PROGRAM ABORT : No instrumentation detected Location : perform_dry_run(), afl-fuzz.c:2883
Anyone know about this error?
I use afl qemu mode to fuzzing a arm library. I wrote a entrance for that library. Then I test the binary with afl-qemu-trace, and it could return correct result. Then I use command "afl-fuzz -m 8G -i aflin -o aflout -Q ./binary @@" to execute the fuzz. But the main process stucked at "[+] All right - fork server is up.". Then I use ps to see the child process "afl-qemu-trace ./binanry FILE". And I use gdb to attach on it. I found program is stuck at some mutex. Here is the call stack:
#0 __lll_lock_wait () at ../sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:135
#1 0x00007fbcac68d023 in __GI___pthread_mutex_lock (mutex=mutex@entry=0x55948b53e500 <tcg_ctx+288>) at ../nptl/pthread_mutex_lock.c:78
#2 0x000055948b27973a in qemu_mutex_lock (mutex=mutex@entry=0x55948b53e500 <tcg_ctx+288>) at util/qemu-thread-posix.c:65
#3 0x000055948b180e28 in tb_lock () at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/accel/tcg/translate-all.c:170
#4 cpu_restore_state (cpu=cpu@entry=0x55948e180910, retaddr=retaddr@entry=94096477451624) at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/accel/tcg/translate-all.c:353
#5 0x000055948b17d442 in handle_cpu_signal (old_set=0x7ffc60edd2a8, is_write=, address=4010848012, pc=94096477451622) at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/user-exec.c:124
#6 cpu_arm_signal_handler (host_signum=, pinfo=pinfo@entry=0x7ffc60edd2b0, puc=0x7ffc60edd180) at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/user-exec.c:229
#7 0x000055948b1a5f41 in host_signal_handler (host_signum=11, info=0x7ffc60edd2b0, puc=0x7ffc60edd180) at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/linux-user/signal.c:646
#8
#9 0x000055948b1cf566 in gen_intermediate_code (cs=cs@entry=0x55948e180910, tb=tb@entry=0x55948b615480 <static_code_gen_buffer+796080>) at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/target/arm/translate.c:12011
#10 0x000055948b18107e in tb_gen_code (cpu=cpu@entry=0x55948e180910, pc=4010848012, cs_base=0, flags=524416, cflags=, cflags@entry=0) at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/accel/tcg/translate-all.c:1283
#11 0x000055948b17d999 in afl_wait_tsl (fd=3, cpu=0x55948e180910) at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/../patches/afl-qemu-cpu-inl.h:304
#12 afl_forkserver (cpu=cpu@entry=0x55948e180910) at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/../patches/afl-qemu-cpu-inl.h:222
#13 0x000055948b17f2cd in cpu_tb_exec (itb=, itb=, cpu=) at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/accel/tcg/cpu-exec.c:149
#14 cpu_loop_exec_tb (tb_exit=, last_tb=, tb=, cpu=) at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/accel/tcg/cpu-exec.c:583
#15 cpu_exec (cpu=) at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/accel/tcg/cpu-exec.c:681
#16 0x000055948b182ca0 in cpu_loop (env=0x55948e188ba0) at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/linux-user/main.c:570
#17 0x000055948b13cbf0 in main (argc=argc@entry=4, argv=argv@entry=0x7ffc60ede9c8, envp=) at /root/AFL-2.56b/qemu_mode/qemu-2.10.0/linux-user/main.c:4862
#18 0x00007fbcac2b3b97 in __libc_start_main (main=0x55948b13c4c0
I'm getting an Error Trying to build the qemu mode using the build_qemu_support.sh shell script however I am getting the following errors
/opt/AFL/qemu_mode/qemu-2.10.0/linux-user/ioctls.h:173:9: error: ‘SIOCGSTAMP’ undeclared here (not in a function); did you mean ‘SIOCSRARP’?
173 | IOCTL(SIOCGSTAMP, IOC_R, MK_PTR(MK_STRUCT(STRUCT_timeval)))
| ^~~~~~~~~~
/opt/AFL/qemu_mode/qemu-2.10.0/linux-user/syscall.c:5597:23: note: in definition of macro ‘IOCTL’
5597 | { TARGET_ ## cmd, cmd, #cmd, access, 0, { VA_ARGS } },
| ^~~
/opt/AFL/qemu_mode/qemu-2.10.0/linux-user/ioctls.h:174:9: error: ‘SIOCGSTAMPNS’ undeclared here (not in a function); did you mean ‘SIOCGSTAMP_OLD’?
174 | IOCTL(SIOCGSTAMPNS, IOC_R, MK_PTR(MK_STRUCT(STRUCT_timespec)))
| ^~~~~~~~~~~~
/opt/AFL/qemu_mode/qemu-2.10.0/linux-user/syscall.c:5597:23: note: in definition of macro ‘IOCTL’
5597 | { TARGET_ ## cmd, cmd, #cmd, access, 0, { VA_ARGS } },
| ^~~
make[1]: *** [/opt/AFL/qemu_mode/qemu-2.10.0/rules.mak:66: linux-user/syscall.o] Error 1
make: *** [Makefile:326: subdir-x86_64-linux-user] Error 2
The Full ouptut is:
[] Performing basic sanity checks...
[+] All checks passed!
[] Downloading QEMU 2.10.0 from the web...
--2019-10-19 18:06:55-- http://download.qemu-project.org/qemu-2.10.0.tar.xz
Resolving download.qemu-project.org (download.qemu-project.org)... 172.99.69.163
Connecting to download.qemu-project.org (download.qemu-project.org)|172.99.69.163|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://download.qemu.org/qemu-2.10.0.tar.xz [following]
--2019-10-19 18:06:56-- http://download.qemu.org/qemu-2.10.0.tar.xz
Resolving download.qemu.org (download.qemu.org)... 172.99.69.163
Reusing existing connection to download.qemu-project.org:80.
HTTP request sent, awaiting response... 302 Found
Location: https://download.qemu.org/qemu-2.10.0.tar.xz [following]
--2019-10-19 18:06:56-- https://download.qemu.org/qemu-2.10.0.tar.xz
Connecting to download.qemu.org (download.qemu.org)|172.99.69.163|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 25040324 (24M) [application/x-xz]
Saving to: ‘qemu-2.10.0.tar.xz’
qemu-2.10.0.tar.xz 100%[============================================================>] 23.88M 11.3MB/s in 2.1s
2019-10-19 18:06:59 (11.3 MB/s) - ‘qemu-2.10.0.tar.xz’ saved [25040324/25040324]
[+] Cryptographic signature on qemu-2.10.0.tar.xz checks out.
[] Uncompressing archive (this will take a while)...
[+] Unpacking successful.
[] Configuring QEMU for ...
[] Applying patches...
patching file linux-user/elfload.c
patching file accel/tcg/cpu-exec.c
patching file linux-user/syscall.c
patching file configure
patching file util/memfd.c
[+] Patching done.
Install prefix /usr/local
BIOS directory /usr/local/share/qemu
binary directory /usr/local/bin
library directory /usr/local/lib
module directory /usr/local/lib/qemu
libexec directory /usr/local/libexec
include directory /usr/local/include
config directory /usr/local/etc
local state directory /usr/local/var
Manual directory /usr/local/share/man
ELF interp prefix /usr/gnemul/qemu-%M
Source path /opt/AFL/qemu_mode/qemu-2.10.0
C compiler cc
Host C compiler cc
C++ compiler c++
Objective-C compiler clang
ARFLAGS rv
CFLAGS -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -g -O3 -ggdb
QEMU_CFLAGS -I/usr/include/pixman-1 -I$(SRC_PATH)/dtc/libfdt -pthread -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include -DNCURSES_WIDECHAR -D_DEFAULT_SOURCE -D_XOPEN_SOURCE=600 -fPIE -DPIE -m64 -mcx16 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -Wstrict-prototypes -Wredundant-decls -Wall -Wundef -Wwrite-strings -Wmissing-prototypes -fno-strict-aliasing -fno-common -fwrapv -Wexpansion-to-defined -Wendif-labels -Wno-shift-negative-value -Wno-missing-include-dirs -Wempty-body -Wnested-externs -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wold-style-declaration -Wold-style-definition -Wtype-limits -fstack-protector-strong -I/usr/include/p11-kit-1 -I/usr/include/libusb-1.0
LDFLAGS -Wl,--warn-common -lxenctrl -lxenstore -lxenguest -lxenforeignmemory -lxengnttab -lxenevtchn -lxendevicemodel -Wl,-z,relro -Wl,-z,now -pie -m64 -g
make make
install install
python python -B
smbd /usr/sbin/smbd
module support no
host CPU x86_64
host big endian no
target list x86_64-linux-user
gprof enabled no
sparse enabled no
strip binaries yes
profiler no
static build no
pixman system
SDL support no
GTK support no
GTK GL support no
VTE support no
TLS priority NORMAL
GNUTLS support yes
GNUTLS rnd yes
libgcrypt no
libgcrypt kdf no
nettle yes (3.4.1)
nettle kdf yes
libtasn1 yes
curses support yes
virgl support no
curl support yes
mingw32 support no
Audio drivers oss
Block whitelist (rw)
Block whitelist (ro)
VirtFS support
VNC support no
xen support yes
xen ctrl version 41100
pv dom build no
brlapi support no
bluez support yes
Documentation no
PIE yes
vde support no
netmap support no
Linux AIO support no
ATTR/XATTR support yes
Install blobs yes
KVM support yes
HAX support no
TCG support yes
TCG debug enabled no
TCG interpreter no
RDMA support no
fdt support yes
preadv support yes
fdatasync yes
madvise yes
posix_madvise yes
libcap-ng support no
vhost-net support yes
vhost-scsi support yes
vhost-vsock support yes
vhost-user support yes
Trace backends log
spice support no
rbd support no
xfsctl support no
smartcard support no
libusb yes
usb net redir no
OpenGL support no
OpenGL dmabufs no
libiscsi support no
libnfs support no
build guest agent yes
QGA VSS support no
QGA w32 disk info no
QGA MSI support no
seccomp support no
coroutine backend ucontext
coroutine pool yes
debug stack usage no
crypto afalg no
GlusterFS support no
gcov gcov
gcov enabled no
TPM support yes
libssh2 support no
TPM passthrough yes
QOM debugging yes
Live block migration yes
lzo support no
snappy support no
bzip2 support no
NUMA host support yes
tcmalloc support no
jemalloc support no
avx2 optimization yes
replication support yes
VxHS block device no
[+] Configuration complete.
[] Attempting to build QEMU (fingers crossed!)...
GEN x86_64-linux-user/config-devices.mak.tmp
GEN x86_64-linux-user/config-devices.mak
GEN config-all-devices.mak
GEN config-host.h
DEP tests/dumptrees.c
DEP tests/trees.S
DEP tests/testutils.c
DEP tests/value-labels.c
DEP tests/asm_tree_dump.c
DEP tests/truncated_property.c
DEP tests/check_path.c
DEP tests/overlay_bad_fixup.c
DEP tests/overlay.c
DEP tests/subnode_iterate.c
DEP tests/property_iterate.c
DEP tests/integer-expressions.c
DEP tests/utilfdt_test.c
DEP tests/path_offset_aliases.c
DEP tests/add_subnode_with_nops.c
DEP tests/dtbs_equal_unordered.c
DEP tests/dtb_reverse.c
DEP tests/dtbs_equal_ordered.c
DEP tests/extra-terminating-null.c
DEP tests/incbin.c
DEP tests/boot-cpuid.c
DEP tests/phandle_format.c
DEP tests/path-references.c
DEP tests/references.c
DEP tests/string_escapes.c
DEP tests/propname_escapes.c
DEP tests/appendprop2.c
DEP tests/appendprop1.c
DEP tests/del_node.c
DEP tests/del_property.c
DEP tests/setprop.c
DEP tests/set_name.c
DEP tests/rw_tree1.c
DEP tests/open_pack.c
DEP tests/nopulate.c
DEP tests/mangle-layout.c
DEP tests/move_and_save.c
DEP tests/sw_tree1.c
DEP tests/nop_node.c
DEP tests/nop_property.c
DEP tests/setprop_inplace.c
DEP tests/stringlist.c
DEP tests/addr_size_cells.c
DEP tests/notfound.c
DEP tests/sized_cells.c
DEP tests/char_literal.c
DEP tests/get_alias.c
DEP tests/node_offset_by_compatible.c
DEP tests/node_check_compatible.c
DEP tests/node_offset_by_phandle.c
DEP tests/node_offset_by_prop_value.c
DEP tests/parent_offset.c
DEP tests/supernode_atdepth_offset.c
DEP tests/get_path.c
DEP tests/get_phandle.c
DEP tests/getprop.c
DEP tests/get_name.c
DEP tests/path_offset.c
DEP tests/subnode_offset.c
DEP tests/find_property.c
DEP tests/root_node.c
DEP tests/get_mem_rsv.c
DEP libfdt/fdt_overlay.c
DEP libfdt/fdt_addresses.c
DEP libfdt/fdt_empty_tree.c
DEP libfdt/fdt_strerror.c
DEP libfdt/fdt_rw.c
DEP libfdt/fdt_sw.c
DEP libfdt/fdt_wip.c
DEP libfdt/fdt_ro.c
DEP libfdt/fdt.c
DEP util.c
DEP fdtput.c
DEP fdtget.c
DEP fdtdump.c
LEX convert-dtsv0-lexer.lex.c
DEP convert-dtsv0-lexer.lex.c
DEP srcpos.c
BISON dtc-parser.tab.c
DEP dtc-parser.tab.c
LEX dtc-lexer.lex.c
DEP dtc-lexer.lex.c
DEP treesource.c
DEP livetree.c
DEP fstree.c
DEP flattree.c
DEP dtc.c
DEP data.c
DEP checks.c
CHK version_gen.h
UPD version_gen.h
DEP util.c
CHK version_gen.h
CC libfdt/fdt.o
CC libfdt/fdt_ro.o
CC libfdt/fdt_wip.o
CC libfdt/fdt_sw.o
CC libfdt/fdt_rw.o
CC libfdt/fdt_strerror.o
CC libfdt/fdt_empty_tree.o
CC libfdt/fdt_addresses.o
CC libfdt/fdt_overlay.o
AR libfdt/libfdt.a
ar: creating libfdt/libfdt.a
a - libfdt/fdt.o
a - libfdt/fdt_ro.o
a - libfdt/fdt_wip.o
a - libfdt/fdt_sw.o
a - libfdt/fdt_rw.o
a - libfdt/fdt_strerror.o
a - libfdt/fdt_empty_tree.o
a - libfdt/fdt_addresses.o
a - libfdt/fdt_overlay.o
GEN qemu-options.def
GEN qmp-commands.h
GEN qapi-types.h
GEN qapi-visit.h
GEN qapi-event.h
GEN qmp-marshal.c
GEN qapi-types.c
GEN qapi-visit.c
GEN qapi-event.c
GEN qmp-introspect.h
GEN qmp-introspect.c
GEN trace/generated-tcg-tracers.h
GEN trace/generated-helpers-wrappers.h
GEN trace/generated-helpers.h
GEN trace/generated-helpers.c
GEN module_block.h
GEN tests/test-qapi-types.h
GEN tests/test-qapi-visit.h
GEN tests/test-qmp-commands.h
GEN tests/test-qapi-event.h
GEN tests/test-qmp-introspect.h
GEN trace-root.h
GEN util/trace.h
GEN crypto/trace.h
GEN io/trace.h
GEN migration/trace.h
GEN block/trace.h
GEN chardev/trace.h
GEN hw/block/trace.h
GEN hw/block/dataplane/trace.h
GEN hw/char/trace.h
GEN hw/intc/trace.h
GEN hw/net/trace.h
GEN hw/virtio/trace.h
GEN hw/audio/trace.h
GEN hw/misc/trace.h
GEN hw/usb/trace.h
GEN hw/scsi/trace.h
GEN hw/nvram/trace.h
GEN hw/display/trace.h
GEN hw/input/trace.h
GEN hw/timer/trace.h
GEN hw/dma/trace.h
GEN hw/sparc/trace.h
GEN hw/sd/trace.h
GEN hw/isa/trace.h
GEN hw/mem/trace.h
GEN hw/i386/trace.h
GEN hw/i386/xen/trace.h
GEN hw/9pfs/trace.h
GEN hw/ppc/trace.h
GEN hw/pci/trace.h
GEN hw/s390x/trace.h
GEN hw/vfio/trace.h
GEN hw/acpi/trace.h
GEN hw/arm/trace.h
GEN hw/alpha/trace.h
GEN hw/xen/trace.h
GEN ui/trace.h
GEN audio/trace.h
GEN net/trace.h
GEN target/arm/trace.h
GEN target/i386/trace.h
GEN target/mips/trace.h
GEN target/sparc/trace.h
GEN target/s390x/trace.h
GEN target/ppc/trace.h
GEN qom/trace.h
GEN linux-user/trace.h
GEN qapi/trace.h
GEN accel/tcg/trace.h
GEN accel/kvm/trace.h
GEN nbd/trace.h
GEN trace-root.c
GEN util/trace.c
GEN crypto/trace.c
GEN io/trace.c
GEN migration/trace.c
GEN block/trace.c
GEN chardev/trace.c
GEN hw/block/trace.c
GEN hw/block/dataplane/trace.c
GEN hw/char/trace.c
GEN hw/intc/trace.c
GEN hw/net/trace.c
GEN hw/virtio/trace.c
GEN hw/audio/trace.c
GEN hw/misc/trace.c
GEN hw/usb/trace.c
GEN hw/scsi/trace.c
GEN hw/nvram/trace.c
GEN hw/display/trace.c
GEN hw/input/trace.c
GEN hw/timer/trace.c
GEN hw/dma/trace.c
GEN hw/sparc/trace.c
GEN hw/sd/trace.c
GEN hw/isa/trace.c
GEN hw/mem/trace.c
GEN hw/i386/trace.c
GEN hw/i386/xen/trace.c
GEN hw/9pfs/trace.c
GEN hw/ppc/trace.c
GEN hw/pci/trace.c
GEN hw/s390x/trace.c
GEN hw/vfio/trace.c
GEN hw/acpi/trace.c
GEN hw/arm/trace.c
GEN hw/alpha/trace.c
GEN hw/xen/trace.c
GEN ui/trace.c
GEN audio/trace.c
GEN net/trace.c
GEN target/arm/trace.c
GEN target/i386/trace.c
GEN target/mips/trace.c
GEN target/sparc/trace.c
GEN target/s390x/trace.c
GEN target/ppc/trace.c
GEN qom/trace.c
GEN linux-user/trace.c
GEN qapi/trace.c
GEN accel/tcg/trace.c
GEN accel/kvm/trace.c
GEN nbd/trace.c
CHK version_gen.h
CC tests/qemu-iotests/socket_scm_helper.o
LINK tests/qemu-iotests/socket_scm_helper
GEN qga/qapi-generated/qga-qapi-types.h
GEN qga/qapi-generated/qga-qapi-visit.h
GEN qga/qapi-generated/qga-qmp-commands.h
CC qga/commands.o
CC qga/guest-agent-command-state.o
CC qga/main.o
qga/main.c: In function ‘ga_log’:
qga/main.c:300:5: warning: ‘GTimeVal’ is deprecated: Use 'GDateTime' instead [-Wdeprecated-declarations]
300 | GTimeVal time;
| ^~~~~~~~
In file included from /usr/include/glib-2.0/glib/galloca.h:32,
from /usr/include/glib-2.0/glib.h:30,
from /opt/AFL/qemu_mode/qemu-2.10.0/include/glib-compat.h:19,
from /opt/AFL/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:107,
from qga/main.c:13:
/usr/include/glib-2.0/glib/gtypes.h:551:8: note: declared here
551 | struct _GTimeVal
| ^~~~~~~~~
qga/main.c:315:9: warning: ‘g_get_current_time’ is deprecated: Use 'g_get_real_time' instead [-Wdeprecated-declarations]
315 | g_get_current_time(&time);
| ^~~~~~~~~~~~~~~~~~
In file included from /usr/include/glib-2.0/glib/giochannel.h:33,
from /usr/include/glib-2.0/glib.h:54,
from /opt/AFL/qemu_mode/qemu-2.10.0/include/glib-compat.h:19,
from /opt/AFL/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:107,
from qga/main.c:13:
/usr/include/glib-2.0/glib/gmain.h:575:8: note: declared here
575 | void g_get_current_time (GTimeVal *result);
| ^~~~~~~~~~~~~~~~~~
CC qga/commands-posix.o
CC qga/channel-posix.o
GEN qga/qapi-generated/qga-qapi-types.c
CC qga/qapi-generated/qga-qapi-types.o
GEN qga/qapi-generated/qga-qapi-visit.c
CC qga/qapi-generated/qga-qapi-visit.o
GEN qga/qapi-generated/qga-qmp-marshal.c
CC qga/qapi-generated/qga-qmp-marshal.o
CC qmp-introspect.o
CC qapi-types.o
CC qapi-visit.o
CC qapi-event.o
CC qapi/qapi-visit-core.o
CC qapi/qapi-dealloc-visitor.o
CC qapi/qobject-input-visitor.o
CC qapi/qobject-output-visitor.o
CC qapi/qmp-registry.o
CC qapi/qmp-dispatch.o
CC qapi/string-input-visitor.o
qapi/string-input-visitor.c: In function ‘parse_type_uint64’:
qapi/string-input-visitor.c:261:14: warning: ‘i’ may be used uninitialized in this function [-Wmaybe-uninitialized]
261 | *obj = i;
| ~~~~~^~~
CC qapi/string-output-visitor.o
CC qapi/opts-visitor.o
CC qapi/qapi-clone-visitor.o
CC qapi/qmp-event.o
CC qapi/qapi-util.o
CC qobject/qnull.o
CC qobject/qnum.o
CC qobject/qstring.o
CC qobject/qdict.o
CC qobject/qlist.o
CC qobject/qbool.o
CC qobject/qjson.o
CC qobject/qobject.o
CC qobject/json-lexer.o
CC qobject/json-streamer.o
CC qobject/json-parser.o
CC trace/control.o
CC trace/qmp.o
CC util/osdep.o
CC util/cutils.o
CC util/unicode.o
CC util/qemu-timer-common.o
CC util/bufferiszero.o
CC util/lockcnt.o
CC util/aiocb.o
CC util/async.o
CC util/thread-pool.o
CC util/qemu-timer.o
CC util/main-loop.o
CC util/iohandler.o
CC util/aio-posix.o
CC util/compatfd.o
CC util/event_notifier-posix.o
CC util/mmap-alloc.o
CC util/oslib-posix.o
CC util/qemu-openpty.o
CC util/qemu-thread-posix.o
CC util/memfd.o
CC util/envlist.o
CC util/path.o
CC util/module.o
CC util/host-utils.o
CC util/bitmap.o
CC util/bitops.o
CC util/hbitmap.o
CC util/fifo8.o
CC util/acl.o
CC util/cacheinfo.o
CC util/error.o
CC util/qemu-error.o
util/qemu-error.c: In function ‘vreport’:
util/qemu-error.c:201:5: warning: ‘GTimeVal’ is deprecated: Use 'GDateTime' instead [-Wdeprecated-declarations]
201 | GTimeVal tv;
| ^~~~~~~~
In file included from /usr/include/glib-2.0/glib/galloca.h:32,
from /usr/include/glib-2.0/glib.h:30,
from /opt/AFL/qemu_mode/qemu-2.10.0/include/glib-compat.h:19,
from /opt/AFL/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:107,
from util/qemu-error.c:13:
/usr/include/glib-2.0/glib/gtypes.h:551:8: note: declared here
551 | struct GTimeVal
| ^~~~~~~~~
util/qemu-error.c:205:9: warning: ‘g_get_current_time’ is deprecated: Use 'g_get_real_time' instead [-Wdeprecated-declarations]
205 | g_get_current_time(&tv);
| ^~~~~~~~~~~~~~~~~~
In file included from /usr/include/glib-2.0/glib/giochannel.h:33,
from /usr/include/glib-2.0/glib.h:54,
from /opt/AFL/qemu_mode/qemu-2.10.0/include/glib-compat.h:19,
from /opt/AFL/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:107,
from util/qemu-error.c:13:
/usr/include/glib-2.0/glib/gmain.h:575:8: note: declared here
575 | void g_get_current_time (GTimeVal result);
| ^~~~~~~~~~~~~~~~~~
util/qemu-error.c:206:9: warning: ‘g_time_val_to_iso8601’ is deprecated: Use 'g_date_time_format' instead [-Wdeprecated-declarations]
206 | timestr = g_time_val_to_iso8601(&tv);
| ^~~~~~~
In file included from /usr/include/glib-2.0/glib.h:88,
from /opt/AFL/qemu_mode/qemu-2.10.0/include/glib-compat.h:19,
from /opt/AFL/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:107,
from util/qemu-error.c:13:
/usr/include/glib-2.0/glib/gtimer.h:73:10: note: declared here
73 | gchar g_time_val_to_iso8601 (GTimeVal *time) G_GNUC_MALLOC;
| ^~~~~~~~~~~~~~~~~~~~~
CC util/id.o
CC util/iov.o
CC util/qemu-config.o
CC util/qemu-sockets.o
In file included from /usr/include/string.h:494,
from /opt/AFL/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:69,
from util/qemu-sockets.c:18:
In function ‘strncpy’,
inlined from ‘unix_listen_saddr’ at util/qemu-sockets.c:930:5:
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:106:10: warning: ‘__builtin_strncpy’ specified bound 108 equals destination size [-Wstringop-truncation]
106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In function ‘strncpy’,
inlined from ‘unix_connect_saddr.isra.0’ at util/qemu-sockets.c:989:5:
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:106:10: warning: ‘__builtin_strncpy’ specified bound 108 equals destination size [-Wstringop-truncation]
106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CC util/uri.o
CC util/notify.o
CC util/qemu-option.o
CC util/qemu-progress.o
CC util/keyval.o
CC util/hexdump.o
CC util/crc32c.o
CC util/uuid.o
CC util/throttle.o
CC util/getauxval.o
CC util/readline.o
CC util/rcu.o
CC util/qemu-coroutine.o
CC util/qemu-coroutine-lock.o
CC util/qemu-coroutine-io.o
CC util/qemu-coroutine-sleep.o
CC util/coroutine-ucontext.o
CC util/buffer.o
CC util/timed-average.o
CC util/base64.o
CC util/log.o
CC util/qdist.o
CC util/qht.o
CC util/range.o
CC util/stats64.o
CC util/systemd.o
CC trace-root.o
CC util/trace.o
CC crypto/trace.o
CC io/trace.o
CC migration/trace.o
CC block/trace.o
CC chardev/trace.o
CC hw/block/trace.o
CC hw/block/dataplane/trace.o
CC hw/char/trace.o
CC hw/intc/trace.o
CC hw/net/trace.o
CC hw/virtio/trace.o
CC hw/audio/trace.o
CC hw/misc/trace.o
CC hw/usb/trace.o
CC hw/scsi/trace.o
CC hw/nvram/trace.o
CC hw/display/trace.o
CC hw/input/trace.o
CC hw/timer/trace.o
CC hw/dma/trace.o
CC hw/sparc/trace.o
CC hw/sd/trace.o
CC hw/isa/trace.o
CC hw/mem/trace.o
CC hw/i386/trace.o
CC hw/i386/xen/trace.o
CC hw/9pfs/trace.o
CC hw/ppc/trace.o
CC hw/pci/trace.o
CC hw/s390x/trace.o
CC hw/vfio/trace.o
CC hw/acpi/trace.o
CC hw/arm/trace.o
CC hw/alpha/trace.o
CC hw/xen/trace.o
CC ui/trace.o
CC audio/trace.o
CC net/trace.o
CC target/arm/trace.o
CC target/i386/trace.o
CC target/mips/trace.o
CC target/sparc/trace.o
CC target/s390x/trace.o
CC target/ppc/trace.o
CC qom/trace.o
CC linux-user/trace.o
CC qapi/trace.o
CC accel/tcg/trace.o
CC accel/kvm/trace.o
CC nbd/trace.o
AR libqemuutil.a
CC crypto/pbkdf-stub.o
CC stubs/arch-query-cpu-def.o
CC stubs/arch-query-cpu-model-expansion.o
CC stubs/arch-query-cpu-model-comparison.o
CC stubs/arch-query-cpu-model-baseline.o
CC stubs/bdrv-next-monitor-owned.o
CC stubs/blk-commit-all.o
CC stubs/blockdev-close-all-bdrv-states.o
CC stubs/clock-warp.o
CC stubs/cpu-get-clock.o
CC stubs/cpu-get-icount.o
CC stubs/dump.o
CC stubs/error-printf.o
CC stubs/fdset.o
CC stubs/gdbstub.o
CC stubs/get-vm-name.o
CC stubs/iothread.o
CC stubs/iothread-lock.o
CC stubs/is-daemonized.o
CC stubs/machine-init-done.o
CC stubs/migr-blocker.o
CC stubs/change-state-handler.o
CC stubs/monitor.o
CC stubs/notify-event.o
CC stubs/qtest.o
CC stubs/replay.o
CC stubs/runstate-check.o
CC stubs/set-fd-handler.o
CC stubs/slirp.o
CC stubs/sysbus.o
CC stubs/trace-control.o
CC stubs/uuid.o
CC stubs/vm-stop.o
CC stubs/vmstate.o
CC stubs/qmp_pc_dimm_device_list.o
CC stubs/target-monitor-defs.o
CC stubs/target-get-monitor-def.o
CC stubs/pc_madt_cpu_entry.o
CC stubs/vmgenid.o
CC stubs/xen-common.o
CC stubs/xen-hvm.o
AR libqemustub.a
LINK qemu-ga
CC contrib/ivshmem-client/ivshmem-client.o
CC contrib/ivshmem-client/main.o
LINK ivshmem-client
CC contrib/ivshmem-server/ivshmem-server.o
CC contrib/ivshmem-server/main.o
LINK ivshmem-server
CC qemu-nbd.o
CC block.o
CC blockjob.o
CC qemu-io-cmds.o
In file included from /usr/include/stdio.h:867,
from /opt/AFL/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:68,
from qemu-io-cmds.c:11:
In function ‘printf’,
inlined from ‘help_oneline’ at qemu-io-cmds.c:2216:9,
inlined from ‘help_all’ at qemu-io-cmds.c:2241:9,
inlined from ‘help_f’ at qemu-io-cmds.c:2251:9:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:107:10: warning: ‘%s’ directive argument is null [-Wformat-overflow=]
107 | return __printf_chk (__USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ());
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CC replication.o
CC block/raw-format.o
CC block/qcow.o
block/qcow.c: In function ‘qcow_open’:
block/qcow.c:138:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
138 | be32_to_cpus(&header.magic);
| ^~~~~~~~~~~~~
block/qcow.c:139:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
139 | be32_to_cpus(&header.version);
| ^~~~~~~~~~~~~~~
block/qcow.c:140:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
140 | be64_to_cpus(&header.backing_file_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow.c:141:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
141 | be32_to_cpus(&header.backing_file_size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow.c:142:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
142 | be32_to_cpus(&header.mtime);
| ^~~~~~~~~~~~~
block/qcow.c:143:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
143 | be64_to_cpus(&header.size);
| ^~~~~~~~~~~~
block/qcow.c:144:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
144 | be32_to_cpus(&header.crypt_method);
| ^~~~~~~~~~~~~~~~~~~~
block/qcow.c:145:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
145 | be64_to_cpus(&header.l1_table_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~
CC block/vdi.o
block/vdi.c: In function ‘vdi_header_to_cpu’:
block/vdi.c:182:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
182 | le32_to_cpus(&header->signature);
| ^~~~~~~~~~~~~~~~~~
block/vdi.c:183:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
183 | le32_to_cpus(&header->version);
| ^~~~~~~~~~~~~~~~
block/vdi.c:184:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
184 | le32_to_cpus(&header->header_size);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c:185:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
185 | le32_to_cpus(&header->image_type);
| ^~~~~~~~~~~~~~~~~~~
block/vdi.c:186:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
186 | le32_to_cpus(&header->image_flags);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c:187:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
187 | le32_to_cpus(&header->offset_bmap);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c:188:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
188 | le32_to_cpus(&header->offset_data);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c:189:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
189 | le32_to_cpus(&header->cylinders);
| ^~~~~~~~~~~~~~~~~~
block/vdi.c:190:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
190 | le32_to_cpus(&header->heads);
| ^~~~~~~~~~~~~~
block/vdi.c:191:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
191 | le32_to_cpus(&header->sectors);
| ^~~~~~~~~~~~~~~~
block/vdi.c:192:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
192 | le32_to_cpus(&header->sector_size);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c:193:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
193 | le64_to_cpus(&header->disk_size);
| ^~~~~~~~~~~~~~~~~~
block/vdi.c:194:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
194 | le32_to_cpus(&header->block_size);
| ^~~~~~~~~~~~~~~~~~~
block/vdi.c:195:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
195 | le32_to_cpus(&header->block_extra);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c:196:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
196 | le32_to_cpus(&header->blocks_in_image);
| ^~~~~~~~~~~~~~~~~~~~~~~~
block/vdi.c:197:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
197 | le32_to_cpus(&header->blocks_allocated);
| ^~~~~~~~~~~~~~~~~~~~~~~~~
block/vdi.c:198:21: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
198 | qemu_uuid_bswap(&header->uuid_image);
| ^~~~~~~~~~~~~~~~~~~
block/vdi.c:199:21: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
199 | qemu_uuid_bswap(&header->uuid_last_snap);
| ^~~~~~~~~~~~~~~~~~~~~~~
block/vdi.c:200:21: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
200 | qemu_uuid_bswap(&header->uuid_link);
| ^~~~~~~~~~~~~~~~~~
block/vdi.c:201:21: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
201 | qemu_uuid_bswap(&header->uuid_parent);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c: In function ‘vdi_header_to_le’:
block/vdi.c:206:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
206 | cpu_to_le32s(&header->signature);
| ^~~~~~~~~~~~~~~~~~
block/vdi.c:207:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
207 | cpu_to_le32s(&header->version);
| ^~~~~~~~~~~~~~~~
block/vdi.c:208:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
208 | cpu_to_le32s(&header->header_size);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c:209:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
209 | cpu_to_le32s(&header->image_type);
| ^~~~~~~~~~~~~~~~~~~
block/vdi.c:210:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
210 | cpu_to_le32s(&header->image_flags);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c:211:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
211 | cpu_to_le32s(&header->offset_bmap);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c:212:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
212 | cpu_to_le32s(&header->offset_data);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c:213:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
213 | cpu_to_le32s(&header->cylinders);
| ^~~~~~~~~~~~~~~~~~
block/vdi.c:214:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
214 | cpu_to_le32s(&header->heads);
| ^~~~~~~~~~~~~~
block/vdi.c:215:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
215 | cpu_to_le32s(&header->sectors);
| ^~~~~~~~~~~~~~~~
block/vdi.c:216:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
216 | cpu_to_le32s(&header->sector_size);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c:217:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
217 | cpu_to_le64s(&header->disk_size);
| ^~~~~~~~~~~~~~~~~~
block/vdi.c:218:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
218 | cpu_to_le32s(&header->block_size);
| ^~~~~~~~~~~~~~~~~~~
block/vdi.c:219:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
219 | cpu_to_le32s(&header->block_extra);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c:220:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
220 | cpu_to_le32s(&header->blocks_in_image);
| ^~~~~~~~~~~~~~~~~~~~~~~~
block/vdi.c:221:18: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
221 | cpu_to_le32s(&header->blocks_allocated);
| ^~~~~~~~~~~~~~~~~~~~~~~~~
block/vdi.c:222:21: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
222 | qemu_uuid_bswap(&header->uuid_image);
| ^~~~~~~~~~~~~~~~~~~
block/vdi.c:223:21: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
223 | qemu_uuid_bswap(&header->uuid_last_snap);
| ^~~~~~~~~~~~~~~~~~~~~~~
block/vdi.c:224:21: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
224 | qemu_uuid_bswap(&header->uuid_link);
| ^~~~~~~~~~~~~~~~~~
block/vdi.c:225:21: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
225 | qemu_uuid_bswap(&header->uuid_parent);
| ^~~~~~~~~~~~~~~~~~~~
block/vdi.c: In function ‘vdi_open’:
block/vdi.c:440:35: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
440 | } else if (!qemu_uuid_is_null(&header.uuid_link)) {
| ^~~~~~~~~~~~~~~~~
block/vdi.c:444:35: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
444 | } else if (!qemu_uuid_is_null(&header.uuid_parent)) {
| ^~~~~~~~~~~~~~~~~~~
block/vdi.c: In function ‘vdi_create’:
block/vdi.c:798:24: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
798 | qemu_uuid_generate(&header.uuid_image);
| ^~~~~~~~~~~~~~~~~~
block/vdi.c:799:24: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
799 | qemu_uuid_generate(&header.uuid_last_snap);
| ^~~~~~~~~~~~~~~~~~~~~~
CC block/vmdk.o
CC block/cloop.o
CC block/bochs.o
CC block/vpc.o
block/vpc.c: In function ‘vpc_create’:
block/vpc.c:1017:24: warning: taking address of packed member of ‘struct vhd_footer’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1017 | qemu_uuid_generate(&footer->uuid);
| ^~~~~~~~~~~~~
CC block/vvfat.o
CC block/dmg.o
CC block/qcow2.o
block/qcow2.c: In function ‘qcow2_read_extensions’:
block/qcow2.c:207:22: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
207 | be32_to_cpus(&ext.magic);
| ^~~~~~~~~~
block/qcow2.c:208:22: warning: taking address of packed member of ‘struct ’ may result in an unaligned pointer value [-Waddress-of-packed-member]
208 | be32_to_cpus(&ext.len);
| ^~~~~~~~
block/qcow2.c:276:26: warning: taking address of packed member of ‘struct Qcow2CryptoHeaderExtension’ may result in an unaligned pointer value [-Waddress-of-packed-member]
276 | be64_to_cpus(&s->crypto_header.offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:277:26: warning: taking address of packed member of ‘struct Qcow2CryptoHeaderExtension’ may result in an unaligned pointer value [-Waddress-of-packed-member]
277 | be64_to_cpus(&s->crypto_header.length);
| ^~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:330:26: warning: taking address of packed member of ‘struct Qcow2BitmapHeaderExt’ may result in an unaligned pointer value [-Waddress-of-packed-member]
330 | be32_to_cpus(&bitmaps_ext.nb_bitmaps);
| ^~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:331:26: warning: taking address of packed member of ‘struct Qcow2BitmapHeaderExt’ may result in an unaligned pointer value [-Waddress-of-packed-member]
331 | be64_to_cpus(&bitmaps_ext.bitmap_directory_size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:332:26: warning: taking address of packed member of ‘struct Qcow2BitmapHeaderExt’ may result in an unaligned pointer value [-Waddress-of-packed-member]
332 | be64_to_cpus(&bitmaps_ext.bitmap_directory_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c: In function ‘qcow2_do_open’:
block/qcow2.c:1104:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1104 | be32_to_cpus(&header.magic);
| ^~~~~~~~~~~~~
block/qcow2.c:1105:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1105 | be32_to_cpus(&header.version);
| ^~~~~~~~~~~~~~~
block/qcow2.c:1106:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1106 | be64_to_cpus(&header.backing_file_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:1107:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1107 | be32_to_cpus(&header.backing_file_size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:1108:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1108 | be64_to_cpus(&header.size);
| ^~~~~~~~~~~~
block/qcow2.c:1109:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1109 | be32_to_cpus(&header.cluster_bits);
| ^~~~~~~~~~~~~~~~~~~~
block/qcow2.c:1110:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1110 | be32_to_cpus(&header.crypt_method);
| ^~~~~~~~~~~~~~~~~~~~
block/qcow2.c:1111:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1111 | be64_to_cpus(&header.l1_table_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:1112:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1112 | be32_to_cpus(&header.l1_size);
| ^~~~~~~~~~~~~~~
block/qcow2.c:1113:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1113 | be64_to_cpus(&header.refcount_table_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:1114:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1114 | be32_to_cpus(&header.refcount_table_clusters);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:1115:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1115 | be64_to_cpus(&header.snapshots_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:1116:18: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1116 | be32_to_cpus(&header.nb_snapshots);
| ^~~~~~~~~~~~~~~~~~~~
block/qcow2.c:1152:22: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1152 | be64_to_cpus(&header.incompatible_features);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:1153:22: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1153 | be64_to_cpus(&header.compatible_features);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:1154:22: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1154 | be64_to_cpus(&header.autoclear_features);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:1155:22: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1155 | be32_to_cpus(&header.refcount_order);
| ^~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:1156:22: warning: taking address of packed member of ‘struct QCowHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1156 | be32_to_cpus(&header.header_length);
| ^~~~~~~~~~~~~~~~~~~~~
block/qcow2.c: In function ‘qcow2_update_header’:
block/qcow2.c:2279:22: warning: taking address of packed member of ‘struct Qcow2CryptoHeaderExtension’ may result in an unaligned pointer value [-Waddress-of-packed-member]
2279 | cpu_to_be64s(&s->crypto_header.offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:2280:22: warning: taking address of packed member of ‘struct Qcow2CryptoHeaderExtension’ may result in an unaligned pointer value [-Waddress-of-packed-member]
2280 | cpu_to_be64s(&s->crypto_header.length);
| ^~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:2284:22: warning: taking address of packed member of ‘struct Qcow2CryptoHeaderExtension’ may result in an unaligned pointer value [-Waddress-of-packed-member]
2284 | be64_to_cpus(&s->crypto_header.offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2.c:2285:22: warning: taking address of packed member of ‘struct Qcow2CryptoHeaderExtension’ may result in an unaligned pointer value [-Waddress-of-packed-member]
2285 | be64_to_cpus(&s->crypto_header.length);
| ^~~~~~~~~~~~~~~~~~~~~~~~
CC block/qcow2-refcount.o
CC block/qcow2-cluster.o
CC block/qcow2-snapshot.o
CC block/qcow2-cache.o
CC block/qcow2-bitmap.o
block/qcow2-bitmap.c: In function ‘bitmap_dir_entry_to_cpu’:
block/qcow2-bitmap.c:397:18: warning: taking address of packed member of ‘struct Qcow2BitmapDirEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
397 | be64_to_cpus(&entry->bitmap_table_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2-bitmap.c:398:18: warning: taking address of packed member of ‘struct Qcow2BitmapDirEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
398 | be32_to_cpus(&entry->bitmap_table_size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2-bitmap.c:399:18: warning: taking address of packed member of ‘struct Qcow2BitmapDirEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
399 | be32_to_cpus(&entry->flags);
| ^~~~~~~~~~~~~
block/qcow2-bitmap.c:400:18: warning: taking address of packed member of ‘struct Qcow2BitmapDirEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
400 | be16_to_cpus(&entry->name_size);
| ^~~~~~~~~~~~~~~~~
block/qcow2-bitmap.c:401:18: warning: taking address of packed member of ‘struct Qcow2BitmapDirEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
401 | be32_to_cpus(&entry->extra_data_size);
| ^~~~~~~~~~~~~~~~~~~~~~~
block/qcow2-bitmap.c: In function ‘bitmap_dir_entry_to_be’:
block/qcow2-bitmap.c:406:18: warning: taking address of packed member of ‘struct Qcow2BitmapDirEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
406 | cpu_to_be64s(&entry->bitmap_table_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2-bitmap.c:407:18: warning: taking address of packed member of ‘struct Qcow2BitmapDirEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
407 | cpu_to_be32s(&entry->bitmap_table_size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~
block/qcow2-bitmap.c:408:18: warning: taking address of packed member of ‘struct Qcow2BitmapDirEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
408 | cpu_to_be32s(&entry->flags);
| ^~~~~~~~~~~~~
block/qcow2-bitmap.c:409:18: warning: taking address of packed member of ‘struct Qcow2BitmapDirEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
409 | cpu_to_be16s(&entry->name_size);
| ^~~~~~~~~~~~~~~~~
block/qcow2-bitmap.c:410:18: warning: taking address of packed member of ‘struct Qcow2BitmapDirEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
410 | cpu_to_be32s(&entry->extra_data_size);
| ^~~~~~~~~~~~~~~~~~~~~~~
CC block/qed.o
CC block/qed-l2-cache.o
CC block/qed-table.o
CC block/qed-cluster.o
CC block/qed-check.o
CC block/vhdx.o
In file included from block/vhdx.c:26:
./block/vhdx.h: In function ‘leguid_to_cpus’:
./block/vhdx.h:423:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
423 | le32_to_cpus(&guid->data1);
| ^~~~~~~~~~~~
./block/vhdx.h:424:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
424 | le16_to_cpus(&guid->data2);
| ^~~~~~~~~~~~
./block/vhdx.h:425:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
425 | le16_to_cpus(&guid->data3);
| ^~~~~~~~~~~~
./block/vhdx.h: In function ‘cpu_to_leguids’:
./block/vhdx.h:430:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
430 | cpu_to_le32s(&guid->data1);
| ^~~~~~~~~~~~
./block/vhdx.h:431:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
431 | cpu_to_le16s(&guid->data2);
| ^~~~~~~~~~~~
./block/vhdx.h:432:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
432 | cpu_to_le16s(&guid->data3);
| ^~~~~~~~~~~~
block/vhdx.c: In function ‘vhdx_parse_metadata’:
block/vhdx.c:750:18: warning: taking address of packed member of ‘struct VHDXFileParameters’ may result in an unaligned pointer value [-Waddress-of-packed-member]
750 | le32_to_cpus(&s->params.block_size);
| ^~~~~~~~~~~~~~~~~~~~~
block/vhdx.c:751:18: warning: taking address of packed member of ‘struct VHDXFileParameters’ may result in an unaligned pointer value [-Waddress-of-packed-member]
751 | le32_to_cpus(&s->params.data_bits);
| ^~~~~~~~~~~~~~~~~~~~
block/vhdx.c: In function ‘vhdx_create_new_metadata’:
block/vhdx.c:1511:22: warning: taking address of packed member of ‘struct VHDXFileParameters’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1511 | cpu_to_le32s(&mt_file_params->data_bits);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
CC block/vhdx-endian.o
In file included from block/vhdx-endian.c:22:
./block/vhdx.h: In function ‘leguid_to_cpus’:
./block/vhdx.h:423:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
423 | le32_to_cpus(&guid->data1);
| ^~~~~~~~~~~~
./block/vhdx.h:424:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
424 | le16_to_cpus(&guid->data2);
| ^~~~~~~~~~~~
./block/vhdx.h:425:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
425 | le16_to_cpus(&guid->data3);
| ^~~~~~~~~~~~
./block/vhdx.h: In function ‘cpu_to_leguids’:
./block/vhdx.h:430:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
430 | cpu_to_le32s(&guid->data1);
| ^~~~~~~~~~~~
./block/vhdx.h:431:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
431 | cpu_to_le16s(&guid->data2);
| ^~~~~~~~~~~~
./block/vhdx.h:432:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
432 | cpu_to_le16s(&guid->data3);
| ^~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_header_le_import’:
block/vhdx-endian.c:38:18: warning: taking address of packed member of ‘struct VHDXHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
38 | le32_to_cpus(&h->signature);
| ^~~~~~~~~~~~~
block/vhdx-endian.c:39:18: warning: taking address of packed member of ‘struct VHDXHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
39 | le32_to_cpus(&h->checksum);
| ^~~~~~~~~~~~
block/vhdx-endian.c:40:18: warning: taking address of packed member of ‘struct VHDXHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
40 | le64_to_cpus(&h->sequence_number);
| ^~~~~~~~~~~~~~~~~~~
block/vhdx-endian.c:46:18: warning: taking address of packed member of ‘struct VHDXHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
46 | le16_to_cpus(&h->log_version);
| ^~~~~~~~~~~~~~~
block/vhdx-endian.c:47:18: warning: taking address of packed member of ‘struct VHDXHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
47 | le16_to_cpus(&h->version);
| ^~~~~~~~~~~
block/vhdx-endian.c:48:18: warning: taking address of packed member of ‘struct VHDXHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
48 | le32_to_cpus(&h->log_length);
| ^~~~~~~~~~~~~~
block/vhdx-endian.c:49:18: warning: taking address of packed member of ‘struct VHDXHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
49 | le64_to_cpus(&h->log_offset);
| ^~~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_log_desc_le_import’:
block/vhdx-endian.c:83:18: warning: taking address of packed member of ‘struct VHDXLogDescriptor’ may result in an unaligned pointer value [-Waddress-of-packed-member]
83 | le32_to_cpus(&d->signature);
| ^~~~~~~~~~~~~
block/vhdx-endian.c:84:18: warning: taking address of packed member of ‘struct VHDXLogDescriptor’ may result in an unaligned pointer value [-Waddress-of-packed-member]
84 | le64_to_cpus(&d->file_offset);
| ^~~~~~~~~~~~~~~
block/vhdx-endian.c:85:18: warning: taking address of packed member of ‘struct VHDXLogDescriptor’ may result in an unaligned pointer value [-Waddress-of-packed-member]
85 | le64_to_cpus(&d->sequence_number);
| ^~~~~~~~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_log_desc_le_export’:
block/vhdx-endian.c:92:18: warning: taking address of packed member of ‘struct VHDXLogDescriptor’ may result in an unaligned pointer value [-Waddress-of-packed-member]
92 | cpu_to_le32s(&d->signature);
| ^~~~~~~~~~~~~
block/vhdx-endian.c:93:18: warning: taking address of packed member of ‘struct VHDXLogDescriptor’ may result in an unaligned pointer value [-Waddress-of-packed-member]
93 | cpu_to_le32s(&d->trailing_bytes);
| ^~~~~~~~~~~~~~~~~~
block/vhdx-endian.c:94:18: warning: taking address of packed member of ‘struct VHDXLogDescriptor’ may result in an unaligned pointer value [-Waddress-of-packed-member]
94 | cpu_to_le64s(&d->leading_bytes);
| ^~~~~~~~~~~~~~~~~
block/vhdx-endian.c:95:18: warning: taking address of packed member of ‘struct VHDXLogDescriptor’ may result in an unaligned pointer value [-Waddress-of-packed-member]
95 | cpu_to_le64s(&d->file_offset);
| ^~~~~~~~~~~~~~~
block/vhdx-endian.c:96:18: warning: taking address of packed member of ‘struct VHDXLogDescriptor’ may result in an unaligned pointer value [-Waddress-of-packed-member]
96 | cpu_to_le64s(&d->sequence_number);
| ^~~~~~~~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_log_data_le_import’:
block/vhdx-endian.c:103:18: warning: taking address of packed member of ‘struct VHDXLogDataSector’ may result in an unaligned pointer value [-Waddress-of-packed-member]
103 | le32_to_cpus(&d->data_signature);
| ^~~~~~~~~~~~~~~~~~
block/vhdx-endian.c:104:18: warning: taking address of packed member of ‘struct VHDXLogDataSector’ may result in an unaligned pointer value [-Waddress-of-packed-member]
104 | le32_to_cpus(&d->sequence_high);
| ^~~~~~~~~~~~~~~~~
block/vhdx-endian.c:105:18: warning: taking address of packed member of ‘struct VHDXLogDataSector’ may result in an unaligned pointer value [-Waddress-of-packed-member]
105 | le32_to_cpus(&d->sequence_low);
| ^~~~~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_log_data_le_export’:
block/vhdx-endian.c:112:18: warning: taking address of packed member of ‘struct VHDXLogDataSector’ may result in an unaligned pointer value [-Waddress-of-packed-member]
112 | cpu_to_le32s(&d->data_signature);
| ^~~~~~~~~~~~~~~~~~
block/vhdx-endian.c:113:18: warning: taking address of packed member of ‘struct VHDXLogDataSector’ may result in an unaligned pointer value [-Waddress-of-packed-member]
113 | cpu_to_le32s(&d->sequence_high);
| ^~~~~~~~~~~~~~~~~
block/vhdx-endian.c:114:18: warning: taking address of packed member of ‘struct VHDXLogDataSector’ may result in an unaligned pointer value [-Waddress-of-packed-member]
114 | cpu_to_le32s(&d->sequence_low);
| ^~~~~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_log_entry_hdr_le_import’:
block/vhdx-endian.c:121:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
121 | le32_to_cpus(&hdr->signature);
| ^~~~~~~~~~~~~~~
block/vhdx-endian.c:122:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
122 | le32_to_cpus(&hdr->checksum);
| ^~~~~~~~~~~~~~
block/vhdx-endian.c:123:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
123 | le32_to_cpus(&hdr->entry_length);
| ^~~~~~~~~~~~~~~~~~
block/vhdx-endian.c:124:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
124 | le32_to_cpus(&hdr->tail);
| ^~~~~~~~~~
block/vhdx-endian.c:125:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
125 | le64_to_cpus(&hdr->sequence_number);
| ^~~~~~~~~~~~~~~~~~~~~
block/vhdx-endian.c:126:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
126 | le32_to_cpus(&hdr->descriptor_count);
| ^~~~~~~~~~~~~~~~~~~~~~
block/vhdx-endian.c:128:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
128 | le64_to_cpus(&hdr->flushed_file_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~
block/vhdx-endian.c:129:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
129 | le64_to_cpus(&hdr->last_file_offset);
| ^~~~~~~~~~~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_log_entry_hdr_le_export’:
block/vhdx-endian.c:136:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
136 | cpu_to_le32s(&hdr->signature);
| ^~~~~~~~~~~~~~~
block/vhdx-endian.c:137:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
137 | cpu_to_le32s(&hdr->checksum);
| ^~~~~~~~~~~~~~
block/vhdx-endian.c:138:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
138 | cpu_to_le32s(&hdr->entry_length);
| ^~~~~~~~~~~~~~~~~~
block/vhdx-endian.c:139:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
139 | cpu_to_le32s(&hdr->tail);
| ^~~~~~~~~~
block/vhdx-endian.c:140:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
140 | cpu_to_le64s(&hdr->sequence_number);
| ^~~~~~~~~~~~~~~~~~~~~
block/vhdx-endian.c:141:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
141 | cpu_to_le32s(&hdr->descriptor_count);
| ^~~~~~~~~~~~~~~~~~~~~~
block/vhdx-endian.c:143:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
143 | cpu_to_le64s(&hdr->flushed_file_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~
block/vhdx-endian.c:144:18: warning: taking address of packed member of ‘struct VHDXLogEntryHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
144 | cpu_to_le64s(&hdr->last_file_offset);
| ^~~~~~~~~~~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_region_header_le_import’:
block/vhdx-endian.c:153:18: warning: taking address of packed member of ‘struct VHDXRegionTableHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
153 | le32_to_cpus(&hdr->signature);
| ^~~~~~~~~~~~~~~
block/vhdx-endian.c:154:18: warning: taking address of packed member of ‘struct VHDXRegionTableHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
154 | le32_to_cpus(&hdr->checksum);
| ^~~~~~~~~~~~~~
block/vhdx-endian.c:155:18: warning: taking address of packed member of ‘struct VHDXRegionTableHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
155 | le32_to_cpus(&hdr->entry_count);
| ^~~~~~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_region_header_le_export’:
block/vhdx-endian.c:162:18: warning: taking address of packed member of ‘struct VHDXRegionTableHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
162 | cpu_to_le32s(&hdr->signature);
| ^~~~~~~~~~~~~~~
block/vhdx-endian.c:163:18: warning: taking address of packed member of ‘struct VHDXRegionTableHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
163 | cpu_to_le32s(&hdr->checksum);
| ^~~~~~~~~~~~~~
block/vhdx-endian.c:164:18: warning: taking address of packed member of ‘struct VHDXRegionTableHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
164 | cpu_to_le32s(&hdr->entry_count);
| ^~~~~~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_region_entry_le_import’:
block/vhdx-endian.c:172:18: warning: taking address of packed member of ‘struct VHDXRegionTableEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
172 | le64_to_cpus(&e->file_offset);
| ^~~~~~~~~~~~~~~
block/vhdx-endian.c:173:18: warning: taking address of packed member of ‘struct VHDXRegionTableEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
173 | le32_to_cpus(&e->length);
| ^~~~~~~~~~
block/vhdx-endian.c:174:18: warning: taking address of packed member of ‘struct VHDXRegionTableEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
174 | le32_to_cpus(&e->data_bits);
| ^~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_region_entry_le_export’:
block/vhdx-endian.c:182:18: warning: taking address of packed member of ‘struct VHDXRegionTableEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
182 | cpu_to_le64s(&e->file_offset);
| ^~~~~~~~~~~~~~~
block/vhdx-endian.c:183:18: warning: taking address of packed member of ‘struct VHDXRegionTableEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
183 | cpu_to_le32s(&e->length);
| ^~~~~~~~~~
block/vhdx-endian.c:184:18: warning: taking address of packed member of ‘struct VHDXRegionTableEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
184 | cpu_to_le32s(&e->data_bits);
| ^~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_metadata_header_le_import’:
block/vhdx-endian.c:193:18: warning: taking address of packed member of ‘struct VHDXMetadataTableHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
193 | le64_to_cpus(&hdr->signature);
| ^~~~~~~~~~~~~~~
block/vhdx-endian.c:194:18: warning: taking address of packed member of ‘struct VHDXMetadataTableHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
194 | le16_to_cpus(&hdr->entry_count);
| ^~~~~~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_metadata_header_le_export’:
block/vhdx-endian.c:201:18: warning: taking address of packed member of ‘struct VHDXMetadataTableHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
201 | cpu_to_le64s(&hdr->signature);
| ^~~~~~~~~~~~~~~
block/vhdx-endian.c:202:18: warning: taking address of packed member of ‘struct VHDXMetadataTableHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
202 | cpu_to_le16s(&hdr->entry_count);
| ^~~~~~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_metadata_entry_le_import’:
block/vhdx-endian.c:210:18: warning: taking address of packed member of ‘struct VHDXMetadataTableEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
210 | le32_to_cpus(&e->offset);
| ^~~~~~~~~~
block/vhdx-endian.c:211:18: warning: taking address of packed member of ‘struct VHDXMetadataTableEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
211 | le32_to_cpus(&e->length);
| ^~~~~~~~~~
block/vhdx-endian.c:212:18: warning: taking address of packed member of ‘struct VHDXMetadataTableEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
212 | le32_to_cpus(&e->data_bits);
| ^~~~~~~~~~~~~
block/vhdx-endian.c: In function ‘vhdx_metadata_entry_le_export’:
block/vhdx-endian.c:219:18: warning: taking address of packed member of ‘struct VHDXMetadataTableEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
219 | cpu_to_le32s(&e->offset);
| ^~~~~~~~~~
block/vhdx-endian.c:220:18: warning: taking address of packed member of ‘struct VHDXMetadataTableEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
220 | cpu_to_le32s(&e->length);
| ^~~~~~~~~~
block/vhdx-endian.c:221:18: warning: taking address of packed member of ‘struct VHDXMetadataTableEntry’ may result in an unaligned pointer value [-Waddress-of-packed-member]
221 | cpu_to_le32s(&e->data_bits);
| ^~~~~~~~~~~~~
CC block/vhdx-log.o
In file included from block/vhdx-log.c:27:
./block/vhdx.h: In function ‘leguid_to_cpus’:
./block/vhdx.h:423:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
423 | le32_to_cpus(&guid->data1);
| ^~~~~~~~~~~~
./block/vhdx.h:424:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
424 | le16_to_cpus(&guid->data2);
| ^~~~~~~~~~~~
./block/vhdx.h:425:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
425 | le16_to_cpus(&guid->data3);
| ^~~~~~~~~~~~
./block/vhdx.h: In function ‘cpu_to_leguids’:
./block/vhdx.h:430:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
430 | cpu_to_le32s(&guid->data1);
| ^~~~~~~~~~~~
./block/vhdx.h:431:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
431 | cpu_to_le16s(&guid->data2);
| ^~~~~~~~~~~~
./block/vhdx.h:432:18: warning: taking address of packed member of ‘struct MSGUID’ may result in an unaligned pointer value [-Waddress-of-packed-member]
432 | cpu_to_le16s(&guid->data3);
| ^~~~~~~~~~~~
block/vhdx-log.c: In function ‘vhdx_log_raw_to_le_sector’:
block/vhdx-log.c:838:18: warning: taking address of packed member of ‘struct VHDXLogDescriptor’ may result in an unaligned pointer value [-Waddress-of-packed-member]
838 | cpu_to_le64s(&desc->leading_bytes);
| ^~~~~~~~~~~~~~~~~~~~
block/vhdx-log.c:842:18: warning: taking address of packed member of ‘struct VHDXLogDescriptor’ may result in an unaligned pointer value [-Waddress-of-packed-member]
842 | cpu_to_le32s(&desc->trailing_bytes);
| ^~~~~~~~~~~~~~~~~~~~~
CC block/quorum.o
CC block/parallels.o
CC block/blkdebug.o
CC block/blkverify.o
CC block/blkreplay.o
CC block/block-backend.o
CC block/snapshot.o
CC block/qapi.o
CC block/file-posix.o
CC block/null.o
CC block/mirror.o
CC block/commit.o
CC block/io.o
block/io.c: In function ‘bdrv_is_allocated_above’:
block/io.c:1997:44: warning: ‘pnum_inter’ may be used uninitialized in this function [-Wmaybe-uninitialized]
1997 | (intermediate == top || offset + pnum_inter < size_inter)) {
| ~~~~~~~^~~~~~~~~~~~
CC block/throttle-groups.o
CC block/nbd.o
CC block/nbd-client.o
CC block/sheepdog.o
In file included from /usr/include/string.h:494,
from /opt/AFL/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:69,
from block/sheepdog.c:15:
In function ‘strncpy’,
inlined from ‘find_vdi_name’ at block/sheepdog.c:1264:5:
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:106:10: warning: ‘__builtin_strncpy’ specified bound 256 equals destination size [-Wstringop-truncation]
106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CC block/accounting.o
CC block/dirty-bitmap.o
CC block/write-threshold.o
CC block/backup.o
CC block/replication.o
CC block/crypto.o
CC nbd/server.o
CC nbd/client.o
nbd/client.c: In function ‘nbd_receive_option_reply’:
nbd/client.c:152:18: warning: taking address of packed member of ‘struct nbd_opt_reply’ may result in an unaligned pointer value [-Waddress-of-packed-member]
152 | be64_to_cpus(&reply->magic);
| ^~~~~~~~~~~~~
nbd/client.c:153:18: warning: taking address of packed member of ‘struct nbd_opt_reply’ may result in an unaligned pointer value [-Waddress-of-packed-member]
153 | be32_to_cpus(&reply->option);
| ^~~~~~~~~~~~~~
nbd/client.c:154:18: warning: taking address of packed member of ‘struct nbd_opt_reply’ may result in an unaligned pointer value [-Waddress-of-packed-member]
154 | be32_to_cpus(&reply->type);
| ^~~~~~~~~~~~
nbd/client.c:155:18: warning: taking address of packed member of ‘struct nbd_opt_reply’ may result in an unaligned pointer value [-Waddress-of-packed-member]
155 | be32_to_cpus(&reply->length);
| ^~~~~~~~~~~~~~
CC nbd/common.o
CC block/curl.o
CC crypto/init.o
CC crypto/hash.o
CC crypto/hash-nettle.o
CC crypto/hmac.o
CC crypto/hmac-nettle.o
CC crypto/aes.o
CC crypto/desrfb.o
CC crypto/cipher.o
CC crypto/tlscreds.o
CC crypto/tlscredsanon.o
CC crypto/tlscredsx509.o
CC crypto/tlssession.o
CC crypto/secret.o
CC crypto/random-gnutls.o
CC crypto/pbkdf.o
CC crypto/pbkdf-nettle.o
CC crypto/ivgen.o
CC crypto/ivgen-essiv.o
CC crypto/ivgen-plain.o
CC crypto/ivgen-plain64.o
CC crypto/afsplit.o
CC crypto/xts.o
CC crypto/block.o
CC crypto/block-qcow.o
CC crypto/block-luks.o
crypto/block-luks.c: In function ‘qcrypto_block_luks_open’:
crypto/block-luks.c:693:18: warning: taking address of packed member of ‘struct QCryptoBlockLUKSHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
693 | be16_to_cpus(&luks->header.version);
| ^~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:694:18: warning: taking address of packed member of ‘struct QCryptoBlockLUKSHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
694 | be32_to_cpus(&luks->header.payload_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:695:18: warning: taking address of packed member of ‘struct QCryptoBlockLUKSHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
695 | be32_to_cpus(&luks->header.key_bytes);
| ^~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:696:18: warning: taking address of packed member of ‘struct QCryptoBlockLUKSHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
696 | be32_to_cpus(&luks->header.master_key_iterations);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:699:22: warning: taking address of packed member of ‘struct QCryptoBlockLUKSKeySlot’ may result in an unaligned pointer value [-Waddress-of-packed-member]
699 | be32_to_cpus(&luks->header.key_slots[i].active);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:700:22: warning: taking address of packed member of ‘struct QCryptoBlockLUKSKeySlot’ may result in an unaligned pointer value [-Waddress-of-packed-member]
700 | be32_to_cpus(&luks->header.key_slots[i].iterations);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:701:22: warning: taking address of packed member of ‘struct QCryptoBlockLUKSKeySlot’ may result in an unaligned pointer value [-Waddress-of-packed-member]
701 | be32_to_cpus(&luks->header.key_slots[i].key_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:702:22: warning: taking address of packed member of ‘struct QCryptoBlockLUKSKeySlot’ may result in an unaligned pointer value [-Waddress-of-packed-member]
702 | be32_to_cpus(&luks->header.key_slots[i].stripes);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c: In function ‘qcrypto_block_luks_create’:
crypto/block-luks.c:1261:18: warning: taking address of packed member of ‘struct QCryptoBlockLUKSHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1261 | cpu_to_be16s(&luks->header.version);
| ^~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1262:18: warning: taking address of packed member of ‘struct QCryptoBlockLUKSHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1262 | cpu_to_be32s(&luks->header.payload_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1263:18: warning: taking address of packed member of ‘struct QCryptoBlockLUKSHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1263 | cpu_to_be32s(&luks->header.key_bytes);
| ^~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1264:18: warning: taking address of packed member of ‘struct QCryptoBlockLUKSHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1264 | cpu_to_be32s(&luks->header.master_key_iterations);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1267:22: warning: taking address of packed member of ‘struct QCryptoBlockLUKSKeySlot’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1267 | cpu_to_be32s(&luks->header.key_slots[i].active);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1268:22: warning: taking address of packed member of ‘struct QCryptoBlockLUKSKeySlot’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1268 | cpu_to_be32s(&luks->header.key_slots[i].iterations);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1269:22: warning: taking address of packed member of ‘struct QCryptoBlockLUKSKeySlot’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1269 | cpu_to_be32s(&luks->header.key_slots[i].key_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1270:22: warning: taking address of packed member of ‘struct QCryptoBlockLUKSKeySlot’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1270 | cpu_to_be32s(&luks->header.key_slots[i].stripes);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1285:18: warning: taking address of packed member of ‘struct QCryptoBlockLUKSHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1285 | be16_to_cpus(&luks->header.version);
| ^~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1286:18: warning: taking address of packed member of ‘struct QCryptoBlockLUKSHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1286 | be32_to_cpus(&luks->header.payload_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1287:18: warning: taking address of packed member of ‘struct QCryptoBlockLUKSHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1287 | be32_to_cpus(&luks->header.key_bytes);
| ^~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1288:18: warning: taking address of packed member of ‘struct QCryptoBlockLUKSHeader’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1288 | be32_to_cpus(&luks->header.master_key_iterations);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1291:22: warning: taking address of packed member of ‘struct QCryptoBlockLUKSKeySlot’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1291 | be32_to_cpus(&luks->header.key_slots[i].active);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1292:22: warning: taking address of packed member of ‘struct QCryptoBlockLUKSKeySlot’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1292 | be32_to_cpus(&luks->header.key_slots[i].iterations);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1293:22: warning: taking address of packed member of ‘struct QCryptoBlockLUKSKeySlot’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1293 | be32_to_cpus(&luks->header.key_slots[i].key_offset);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
crypto/block-luks.c:1294:22: warning: taking address of packed member of ‘struct QCryptoBlockLUKSKeySlot’ may result in an unaligned pointer value [-Waddress-of-packed-member]
1294 | be32_to_cpus(&luks->header.key_slots[i].stripes);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CC io/channel.o
CC io/channel-buffer.o
CC io/channel-command.o
CC io/channel-file.o
CC io/channel-socket.o
CC io/channel-tls.o
CC io/channel-watch.o
CC io/channel-websock.o
CC io/channel-util.o
CC io/dns-resolver.o
CC io/task.o
CC qom/object.o
CC qom/container.o
CC qom/qom-qobject.o
CC qom/object_interfaces.o
LINK qemu-nbd
GEN qemu-img-cmds.h
CC qemu-img.o
LINK qemu-img
CC qemu-io.o
LINK qemu-io
CC qemu-bridge-helper.o
LINK qemu-bridge-helper
CC cpus-common.o
CC disas/i386.o
CC hw/core/qdev.o
CC hw/core/qdev-properties.o
CC hw/core/bus.o
CC hw/core/reset.o
CC hw/core/fw-path-provider.o
CC hw/core/irq.o
CC hw/core/hotplug.o
CC hw/core/nmi.o
CC qom/cpu.o
CC chardev/char.o
CC chardev/char-fd.o
CC chardev/char-fe.o
CC chardev/char-file.o
CC chardev/char-io.o
CC chardev/char-mux.o
CC chardev/char-null.o
CC chardev/char-parallel.o
CC chardev/char-pipe.o
CC chardev/char-pty.o
CC chardev/char-ringbuf.o
CC chardev/char-serial.o
CC chardev/char-socket.o
CC chardev/char-stdio.o
CC chardev/char-udp.o
GEN x86_64-linux-user/config-target.h
CC x86_64-linux-user/exec.o
CC x86_64-linux-user/tcg/tcg.o
CC x86_64-linux-user/tcg/tcg-op.o
CC x86_64-linux-user/tcg/optimize.o
CC x86_64-linux-user/tcg/tcg-common.o
CC x86_64-linux-user/tcg/tcg-runtime.o
CC x86_64-linux-user/fpu/softfloat.o
CC x86_64-linux-user/disas.o
GEN x86_64-linux-user/gdbstub-xml.c
CC x86_64-linux-user/gdbstub-xml.o
CC x86_64-linux-user/hax-stub.o
CC x86_64-linux-user/gdbstub.o
CC x86_64-linux-user/thunk.o
CC x86_64-linux-user/user-exec.o
CC x86_64-linux-user/user-exec-stub.o
CC x86_64-linux-user/accel/stubs/kvm-stub.o
CC x86_64-linux-user/accel/tcg/cpu-exec.o
In file included from /opt/AFL/qemu_mode/qemu-2.10.0/../patches/../../config.h:27,
from /opt/AFL/qemu_mode/qemu-2.10.0/../patches/afl-qemu-cpu-inl.h:37,
from /opt/AFL/qemu_mode/qemu-2.10.0/accel/tcg/cpu-exec.c:39:
/opt/AFL/qemu_mode/qemu-2.10.0/../patches/../../types.h:91: warning: "likely" redefined
91 | #define likely(_x) __builtin_expect(!!(_x), 1)
|
In file included from /opt/AFL/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:36,
from /opt/AFL/qemu_mode/qemu-2.10.0/accel/tcg/cpu-exec.c:19:
/opt/AFL/qemu_mode/qemu-2.10.0/include/qemu/compiler.h:57: note: this is the location of the previous definition
57 | #define likely(x) __builtin_expect(!!(x), 1)
|
In file included from /opt/AFL/qemu_mode/qemu-2.10.0/../patches/../../config.h:27,
from /opt/AFL/qemu_mode/qemu-2.10.0/../patches/afl-qemu-cpu-inl.h:37,
from /opt/AFL/qemu_mode/qemu-2.10.0/accel/tcg/cpu-exec.c:39:
/opt/AFL/qemu_mode/qemu-2.10.0/../patches/../../types.h:92: warning: "unlikely" redefined
92 | #define unlikely(_x) __builtin_expect(!!(_x), 0)
|
In file included from /opt/AFL/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:36,
from /opt/AFL/qemu_mode/qemu-2.10.0/accel/tcg/cpu-exec.c:19:
/opt/AFL/qemu_mode/qemu-2.10.0/include/qemu/compiler.h:58: note: this is the location of the previous definition
58 | #define unlikely(x) builtin_expect(!!(x), 0)
|
In file included from /opt/AFL/qemu_mode/qemu-2.10.0/accel/tcg/cpu-exec.c:39:
/opt/AFL/qemu_mode/qemu-2.10.0/../patches/afl-qemu-cpu-inl.h:107:19: warning: redundant redeclaration of ‘tb_htable_lookup’ [-Wredundant-decls]
107 | TranslationBlock tb_htable_lookup(CPUState, target_ulong, target_ulong, uint32_t);
| ^~~~~~~~~~~~~~~~
In file included from /opt/AFL/qemu_mode/qemu-2.10.0/accel/tcg/cpu-exec.c:23:
/opt/AFL/qemu_mode/qemu-2.10.0/include/exec/exec-all.h:403:19: note: previous declaration of ‘tb_htable_lookup’ was here
403 | TranslationBlock *tb_htable_lookup(CPUState *cpu, target_ulong pc,
| ^~~~~~~~~~~~~~~~
CC x86_64-linux-user/accel/tcg/cpu-exec-common.o
CC x86_64-linux-user/accel/tcg/translate-all.o
CC x86_64-linux-user/linux-user/main.o
CC x86_64-linux-user/linux-user/syscall.o
/opt/AFL/qemu_mode/qemu-2.10.0/linux-user/ioctls.h:173:9: error: ‘SIOCGSTAMP’ undeclared here (not in a function); did you mean ‘SIOCSRARP’?
173 | IOCTL(SIOCGSTAMP, IOC_R, MK_PTR(MK_STRUCT(STRUCT_timeval)))
| ^~~~~~~~~~
/opt/AFL/qemu_mode/qemu-2.10.0/linux-user/syscall.c:5597:23: note: in definition of macro ‘IOCTL’
5597 | { TARGET ## cmd, cmd, #cmd, access, 0, { VA_ARGS } },
| ^~~
/opt/AFL/qemu_mode/qemu-2.10.0/linux-user/ioctls.h:174:9: error: ‘SIOCGSTAMPNS’ undeclared here (not in a function); did you mean ‘SIOCGSTAMP_OLD’?
174 | IOCTL(SIOCGSTAMPNS, IOC_R, MK_PTR(MK_STRUCT(STRUCT_timespec)))
| ^~~~~~~~~~~~
/opt/AFL/qemu_mode/qemu-2.10.0/linux-user/syscall.c:5597:23: note: in definition of macro ‘IOCTL’
5597 | { TARGET ## cmd, cmd, #cmd, access, 0, { VA_ARGS } },
| ^~~
make[1]: *** [/opt/AFL/qemu_mode/qemu-2.10.0/rules.mak:66: linux-user/syscall.o] Error 1
make: *** [Makefile:326: subdir-x86_64-linux-user] Error 2
Without instrumentation info, how do AFL generate input for target?
Someone might tell you earlier than you, but i will report.
As shown, "stability" is less than 0.
Please look at this link,
https://groups.google.com/forum/#!topic/afl-users/HSGol_yPxiE
It is not a security issue, but
I hope it will be fixed in the next version.
/aki(verifsec)
This is sort of a feature request, sort of me asking for tips on how to go about implementing this in the codebase. After reading the CollAFL paper (https://chao.100871.net/papers/oakland18.pdf), it seems like a collision-resistant hashing when instrumenting is ideal for fuzzing, and also seems like low-hanging fruit. When fuzzing large codebases, collisions are the norm. From a usability perspective, this is bad since code paths won't be explored if they collide!
What needs to be done to implement the hashing mechanism used in the CollAFL paper?
make: Entering directory '/home/runfeng/afl-2.52b/llvm_mode'
[] Checking for working 'llvm-config'...
[] Checking for working 'clang-6.0'...
[] Checking for '../afl-showmap'...
[+] All set and ready to build.
[] Building 32-bit variant of the runtime (-m32)... failed (that's fine)
[*] Testing the CC wrapper and instrumentation output...
unset AFL_USE_ASAN AFL_USE_MSAN AFL_INST_RATIO; AFL_QUIET=1 AFL_PATH=. AFL_CC=clang-6.0 ../afl-clang-fast -O3 -funroll-loops -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH="/usr/local/lib/afl" -DBIN_PATH="/usr/local/bin" -DVERSION="2.52b" ../test-instr.c -o test-instr
/usr/lib/llvm-6.0/bin/clang: symbol lookup error: ../afl-llvm-pass.so: undefined symbol: _ZN4llvm8LoadInstC1EPNS_4TypeEPNS_5ValueERKNS_5TwineEPNS_11InstructionE
clang: error: unable to execute command: No such file or directory
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 6.0.0-1ubuntu2 (tags/RELEASE_600/final)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
clang: note: diagnostic msg: PLEASE submit a bug report to http://llvm.org/bugs/ and include the crash backtrace, preprocessed source, and associated run script.
clang: error: unable to execute command: No such file or directory
clang: note: diagnostic msg: Error generating preprocessed source(s).
Makefile:97: recipe for target 'test_build' failed
make: *** [test_build] Error 255
make: Leaving directory '/home/runfeng/afl-2.52b/llvm_mode'
I tried clang-4.0,clang-6.0,clang-9,clang-10 and llvm-4,6,10 .All those versions causes this same bug.
It would be super helpful if AFL would identify the crash type and collect them as separate things.
For instance, in this case I'm using afl-tmin to minimize a crash that was found. While the output still indeed crashes, it actually crashes at a different heap check:
Original
double free or corruption (!prev)
Aborted (core dumped)
After tmin
free(): invalid next size (normal)
Aborted (core dumped)
It's actually good to know about both type of crashes, and perhaps be able to tmin to get the same exception rather than just "an exception".
Can be done either separately from or together with #4
See config.h
:
#define VERSION "2.56b"
This comes through to the ui banner, and is really confusing.
I am running AFL in Ubuntu 18 in VMware (With "Virtualize Intel" enabled) and after spawning the fork server AFL gives no output..
This is what my command line looks like (QEMU compiled and enabled):
./afl-fuzz -Q -i ../testcases -f /path/to/file/to/fuzz -o /home/user/crashes -- /path/to/bin arguments
This is the output
afl-fuzz 2.56b by <[email protected]>
[+] You have 4 CPU cores and 2 runnable tasks (utilization: 50%).
[+] Try parallel jobs - see /usr/local/share/doc/afl/parallel_fuzzing.txt.
[*] Checking CPU core loadout...
[+] Found a free CPU core, binding to #0.
[*] Checking core_pattern...
[*] Setting up output directories...
[+] Output directory exists but deemed OK to reuse.
[*] Deleting old session data...
[+] Output dir cleanup successful.
[*] Scanning '../testcases'...
[+] No auto-generated dictionary tokens to reuse.
[*] Creating hard links for all input files...
[*] Validating target binary...
[*] Attempting dry run with 'id:000000,orig:XXX'...
[*] Spinning up the fork server...
[+] All right - fork server is up.
Any ideas why so?
How do I change the output of these files to a folder
I use dictionaries and get this
fuzzAppFolder-
-in
-out
-''$'\377\377\377\177''w'
-''$'\377\377\377\177'';w'
-''$'\362\362\362''w'$'\362\362\362\362\362\362\362\362\362''..-'$'\221''((((((('$'\031''((('
-''$'\377\350\003''w'
-''$'\341\371\020''w'
-''$'\377\377\177\377''w'
-''$'\377\377\177\200''w'
-''$'\224\354''w'$'\377\200'
-''$'\377\377''w'$'\177\177\177'
-''$'\350\003''w'
-''$'\200\003''w'
-''$'\377\005''w'
-''$'\001\177''w'
-''$'\377\177\377\377''w'
-''$'\335''w@'$'\343'
-''$'\364''w'$'\364\364\364\364\364\340\364\364\364\364\020'
-''$'\002''ހw'
-''$'\002\377\361''w'
-''$'\003''w'
-''$'\003'';w'
-.........
-........
I'm aware that halt_on_error=0
in ASAN is USE AT YOUR OWN RISK, but I know what I'm doing in this case and I actually do want my program to continue after an unsafe access.
I have a program with a known buffer-overflow. I have compiled this with ASAN and I am able to verify that the program aborts on a buffer-overflow with SIGABRT
. In gdb I see:
Stopped reason: SIGABRT
__GI_raise (sig=sig@entry=0x6) at ../sysdeps/unix/sysv/linux/raise.c:51
On the command line, the program ends with the expected stacktrace and the message Aborted
.
With halt_on_error=0
, the program obviously does not crash on the buffer overflow, but I can eventually get it to crash due to the corruption from the buffer overflow (because of corrupted chunk metadata). In GDB I end up seeing something like this:
Stopped reason: SIGSEGV
0x00000000004e95ba in __asan::GetThreadContextByTidLocked(unsigned int) ()
On the command line, in this case, the program continues after the first stacktrace as expected, and then crashes with another stack trace (expected) and the message:
AddressSanitizer:DEADLYSIGNAL
AddressSanitizer: nested bug in the same thread, aborting.
Based on this I assumed that afl-fuzz would be able to see that the program crashes.
When running with afl-fuzz without the -C
flag, with halt_on_error=1
and with an input that causes a buffer overflow, I get an appropriate error message saying that the input should not be one that causes an outright crash. This is because ASAN causes the program to abort. However, when doing the same thing but with halt_on_error=0
and with the same input that crashed the program in gdb, I find that afl-fuzz does not notice that the program has crashed. It will start up fine even with the crashing input.
Is there something in ASAN that is preventing afl-fuzz from handling the SIGSEGV in this particular case?
I'm pretty new to both afl and ASAN so it's also quite possible I'm just doing something wrong.
The commands I'm running are:
ASAN_OPTIONS=symbolize=0:abort_on_error=1:halt_on_error=0:log_path=./asan-log/asan.log ../afl-fuzz -i seeds -o asan-results -m none ./myprog
and
ASAN_OPTIONS=symbolize=0:abort_on_error=1:halt_on_error=1:log_path=./asan-log/asan.log ../afl-fuzz -i seeds -o asan-results -m none ./myprog
The AFL fork by @jdbirdwell, contains code for network fuzzing. Perhaps it would be nice to merge this to the mainline?
How can I test GUI applications that do not accept data or files from the command line?
Need to write a separate program to initialize, run, and control the interface of another program? Is it possible to make this wrapper in python?
Will the AFL work with processes running from the program we submit to the AFL? (tracking coverage)
AFL -> wrapper(manage UI and data transfer) -> MyGUIapplication
and use like: afl-fuzz -i in -o out ./wrapper
Really need advice or any suggestions.
hello, when i build afl to llvm_mode, creat some error. like below:
➜ llvm_mode make
[] Checking for working 'llvm-config'...
[] Checking for working 'clang'...
[] Checking for '../afl-showmap'...
[+] All set and ready to build.
[] Building 32-bit variant of the runtime (-m32)... failed (that's fine)
[*] Testing the CC wrapper and instrumentation output...
unset AFL_USE_ASAN AFL_USE_MSAN AFL_INST_RATIO; AFL_QUIET=1 AFL_PATH=. AFL_CC=clang ../afl-clang-fast -O3 -funroll-loops -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH="/usr/local/lib/afl" -DBIN_PATH="/usr/local/bin" -DVERSION="2.52b" ../test-instr.c -o test-instr
error: unable to load plugin '../afl-llvm-pass.so': '../afl-llvm-pass.so: undefined symbol: _ZNK4llvm10ModulePass17createPrinterPassERNS_11raw_ostreamERKSs'
make: *** [test_build] Error 1
=============================
my llvm verion is :
➜ llvm11 llvm-as --version
LLVM (http://llvm.org/):
LLVM version 11.0.0git
Optimized build with assertions.
Default target: x86_64-unknown-linux-gnu
Host CPU: cascadelake
➜ llvm11 clang --version
clang version 11.0.0
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /usr/local/llvm11/bin
➜ llvm11
Hi, guys.
In LLVM instrumentation mode, I noticed that the result of cur_location ^ prev_location is stored in a 32 bit int type. However, the size of SHM is 64KB, whose is index is a 64K (64KB divided by 8) type, which is 16 bit type. And I did not see any codes in the pass to translate 32 bit to 16 bit. Will this be a problem?
Hi,
I want to compare AFL to other fuzzers by number of edges covered, but I don't see that statistic in the status screen. I see cycles done and total paths, but not total edges covered. Is there a way to see how many edges are covered?
When I compile on debian buster (I used dockerhub), qemu fails to build due a conflict with memfd_create
(perhaps due to newer libc's including this name). I've not been following qemu dev, so it could just be the version used by AFL needs to be updated.
Here is the build error:
CC util/memfd.o
util/memfd.c:40:12: error: static declaration of 'memfd_create' follows non-static declaration
static int memfd_create(const char *name, unsigned int flags)
^~~~~~~~~~~~
In file included from /usr/include/x86_64-linux-gnu/bits/mman-linux.h:117,
from /usr/include/x86_64-linux-gnu/bits/mman.h:49,
from /usr/include/x86_64-linux-gnu/sys/mman.h:41,
from /workdir/AFL-2.53b/qemu_mode/qemu-2.10.0/include/sysemu/os-posix.h:29,
from /workdir/AFL-2.53b/qemu_mode/qemu-2.10.0/include/qemu/osdep.h:104,
from util/memfd.c:28:
/usr/include/x86_64-linux-gnu/bits/mman-shared.h:46:5: note: previous declaration of 'memfd_create' was here
int memfd_create (const char *__name, unsigned int __flags) __THROW;
^~~~~~~~~~~~
make: *** [/workdir/AFL-2.53b/qemu_mode/qemu-2.10.0/rules.mak:66: util/memfd.o] Error 1
(Sorry for no patch; limit time :( )
afl-2.52b > make
[] Checking for the ability to compile x86 code...
[+] Everything seems to be working, ready to compile.
cc -O3 -funroll-loops -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH="/usr/local/lib/afl" -DDOC_PATH="/usr/local/share/doc/afl" -DBIN_PATH="/usr/local/bin" afl-gcc.c -o afl-gcc -ldl
set -e; for i in afl-g++ afl-clang afl-clang++; do ln -sf afl-gcc $i; done
cc -O3 -funroll-loops -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH="/usr/local/lib/afl" -DDOC_PATH="/usr/local/share/doc/afl" -DBIN_PATH="/usr/local/bin" afl-fuzz.c -o afl-fuzz -ldl
cc -O3 -funroll-loops -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH="/usr/local/lib/afl" -DDOC_PATH="/usr/local/share/doc/afl" -DBIN_PATH="/usr/local/bin" afl-showmap.c -o afl-showmap -ldl
cc -O3 -funroll-loops -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH="/usr/local/lib/afl" -DDOC_PATH="/usr/local/share/doc/afl" -DBIN_PATH="/usr/local/bin" afl-tmin.c -o afl-tmin -ldl
cc -O3 -funroll-loops -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH="/usr/local/lib/afl" -DDOC_PATH="/usr/local/share/doc/afl" -DBIN_PATH="/usr/local/bin" afl-gotcpu.c -o afl-gotcpu -ldl
cc -O3 -funroll-loops -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH="/usr/local/lib/afl" -DDOC_PATH="/usr/local/share/doc/afl" -DBIN_PATH="/usr/local/bin" afl-analyze.c -o afl-analyze -ldl
cc -O3 -funroll-loops -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH="/usr/local/lib/afl" -DDOC_PATH="/usr/local/share/doc/afl" -DBIN_PATH="/usr/local/bin" afl-as.c -o afl-as -ldl
ln -sf afl-as as
[] Testing the CC wrapper and instrumentation output...
unset AFL_USE_ASAN AFL_USE_MSAN; AFL_QUIET=1 AFL_INST_RATIO=100 AFL_PATH=. ./afl-gcc -O3 -funroll-loops -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH="/usr/local/lib/afl" -DDOC_PATH="/usr/local/share/doc/afl" -DBIN_PATH="/usr/local/bin" test-instr.c -o test-instr -ldl
echo 0 | ./afl-showmap -m none -q -o .test-instr0 ./test-instr
echo 1 | ./afl-showmap -m none -q -o .test-instr1 ./test-instr
Oops, the instrumentation does not seem to be behaving correctly!
Please ping [email protected] to troubleshoot the issue.
make: *** [test_build] Error 1
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.