Merge remote-tracking branch 'upstream/main'

Author: Marcondiro

.github/workflows/build_and_test.yml

@@ -120,6 +120,10 @@ jobs:
       # ---- build normal and examples ----
       - name: Run a normal build
         run: cargo build --verbose
+      # - name: Run libafl_qemu usermode tests
+      #   run: cd libafl_qemu && cargo test
+      # - name: Run libafl_qemu systemmode tests
+      #   run: cd libafl_qemu && cargo test --no-default-features --features x86_64,systemmode
       - name: Build examples
         run: cargo build --examples --verbose
 
@@ -223,6 +227,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: taiki-e/install-action@cargo-hack
+      - run: rustup upgrade
       # Note: We currently only specify minimum rust versions for the default workspace members
       - run: cargo hack check --rust-version -p libafl -p libafl_bolts -p libafl_derive -p libafl_cc -p libafl_targets
 
@@ -378,10 +383,11 @@ jobs:
           - ./fuzzers/binary_only/qemu_coverage
           - ./fuzzers/binary_only/qemu_launcher
         arch:
-          - aarch64
-          - arm
-          - i386
-          - ppc
+          # unless somebody pays us for the servers.
+          # - aarch64
+          # - arm
+          # - i386
+          # - ppc
           - x86_64
 
     runs-on: [ self-hosted, qemu ]

.gitignore

@@ -74,6 +74,14 @@ libafl_nyx/packer
 harness
 program
 fuzzer_libpng*
-forkserver_simple
 
 *.patch
+
+# Sometimes this happens
+rustc-ice-*
+
+# perf files
+*.mm_profdata
+
+# backup files
+*.bak

Cargo.toml

@@ -148,6 +148,10 @@ all = { level = "deny", priority = -1 }
 pedantic = { level = "deny", priority = -1 }
 cargo_common_metadata = "deny"
 
+alloc_instead_of_core = "deny"
+std_instead_of_alloc = "deny"
+std_instead_of_core = "deny"
+
 # Warn
 cargo = { level = "warn", priority = -1 }
 

bindings/pylibafl/Cargo.toml

@@ -5,7 +5,7 @@ version = "0.15.1"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/AFLplusplus/LibAFL/"
 keywords = ["fuzzing", "testing", "security", "python"]
-edition = "2021"
+edition = "2024"
 categories = ["development-tools::testing", "emulators", "embedded", "os"]
 
 [dependencies]

docs/src/advanced_features/no_std.md

@@ -31,7 +31,7 @@ Here, we use it in Rust. `external_current_millis` is then called from LibAFL.
 Note that it needs to be `no_mangle` in order to get picked up by LibAFL at linktime:
 
 ```rust,ignore
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn external_current_millis() -> u64 {
     unsafe { my_real_seconds()*1000 }
 }

docs/src/core_concepts/executor.md

@@ -32,7 +32,9 @@ As you can see from the forkserver example,
 //Coverage map shared between observer and executor
 let mut shmem = StdShMemProvider::new().unwrap().new_shmem(MAP_SIZE).unwrap();
 //let the forkserver know the shmid
-shmem.write_to_env("__AFL_SHM_ID").unwrap();
+unsafe {
+    shmem.write_to_env("__AFL_SHM_ID").unwrap();
+}
 let mut shmem_buf = shmem.as_slice_mut();
 ```
 

fuzzers/baby/baby_fuzzer_swap_differential/Cargo.toml

@@ -21,7 +21,7 @@ debug = true
 
 [build-dependencies]
 anyhow = "1.0.89"
-bindgen = "0.70.1"
+bindgen = "0.71.1"
 cc = "=1.2.7"      # fix me later
 
 [dependencies]

fuzzers/baby/backtrace_baby_fuzzers/forkserver_executor/src/main.rs

@@ -40,7 +40,9 @@ pub fn main() {
 
     let mut shmem = shmem_provider.new_shmem(MAP_SIZE).unwrap();
     //let the forkserver know the shmid
-    shmem.write_to_env("__AFL_SHM_ID").unwrap();
+    unsafe {
+        shmem.write_to_env("__AFL_SHM_ID").unwrap();
+    }
     let shmem_map: &mut [u8; MAP_SIZE] = shmem
         .as_slice_mut()
         .try_into()

fuzzers/binary_only/qemu_launcher/injection_test/.gitignore

@@ -0,0 +1,2 @@
+injection_test
+static

fuzzers/forkserver/forkserver_libafl_cc/src/main.rs

@@ -97,7 +97,9 @@ pub fn main() {
     // The coverage map shared between observer and executor
     let mut shmem = shmem_provider.new_shmem(MAP_SIZE).unwrap();
     // let the forkserver know the shmid
-    shmem.write_to_env("__AFL_SHM_ID").unwrap();
+    unsafe {
+        shmem.write_to_env("__AFL_SHM_ID").unwrap();
+    }
     let shmem_buf = shmem.as_slice_mut();
     // the next line is not needed
     // unsafe { EDGES_MAP_PTR = shmem_buf.as_mut_ptr() };