| /* |
| american fuzzy lop++ - error-checking, memory-zeroing alloc routines |
| -------------------------------------------------------------------- |
| |
| Originally written by Michal Zalewski |
| |
| Now maintained by Marc Heuse <mh@mh-sec.de>, |
| Heiko Eißfeldt <heiko.eissfeldt@hexco.de>, |
| Andrea Fioraldi <andreafioraldi@gmail.com>, |
| Dominik Maier <mail@dmnk.co> |
| |
| Copyright 2016, 2017 Google Inc. All rights reserved. |
| Copyright 2019-2024 AFLplusplus Project. All rights reserved. |
| |
| Licensed under the Apache License, Version 2.0 (the "License"); |
| you may not use this file except in compliance with the License. |
| You may obtain a copy of the License at: |
| |
| https://www.apache.org/licenses/LICENSE-2.0 |
| |
| This allocator is not designed to resist malicious attackers (the canaries |
| are small and predictable), but provides a robust and portable way to detect |
| use-after-free, off-by-one writes, stale pointers, and so on. |
| |
| */ |
| |
| #ifndef _HAVE_ALLOC_INL_H |
| #define _HAVE_ALLOC_INL_H |
| |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| #include <stddef.h> |
| |
| #include "config.h" |
| #include "types.h" |
| #include "debug.h" |
| |
| /* Initial size used for afl_realloc */ |
| #define INITIAL_GROWTH_SIZE (64) |
| |
| // Be careful! _WANT_ORIGINAL_AFL_ALLOC is not compatible with custom mutators |
| |
| #ifndef _WANT_ORIGINAL_AFL_ALLOC |
| // AFL++ stuff without memory corruption checks - for speed |
| |
| /* User-facing macro to sprintf() to a dynamically allocated buffer. */ |
| |
| #define alloc_printf(_str...) \ |
| ({ \ |
| \ |
| u8 *_tmp; \ |
| s32 _len = snprintf(NULL, 0, _str); \ |
| if (_len < 0) FATAL("Whoa, snprintf() fails?!"); \ |
| _tmp = ck_alloc(_len + 1); \ |
| snprintf((char *)_tmp, _len + 1, _str); \ |
| _tmp; \ |
| \ |
| }) |
| |
| /* Macro to enforce allocation limits as a last-resort defense against |
| integer overflows. */ |
| |
| #define ALLOC_CHECK_SIZE(_s) \ |
| do { \ |
| \ |
| if ((_s) > MAX_ALLOC) ABORT("Bad alloc request: %u bytes", (_s)); \ |
| \ |
| } while (0) |
| |
| /* Macro to check malloc() failures and the like. */ |
| |
| #define ALLOC_CHECK_RESULT(_r, _s) \ |
| do { \ |
| \ |
| if (!(_r)) ABORT("Out of memory: can't allocate %u bytes", (_s)); \ |
| \ |
| } while (0) |
| |
| /* Allocate a buffer, explicitly not zeroing it. Returns NULL for zero-sized |
| requests. */ |
| |
| static inline void *DFL_ck_alloc_nozero(u32 size) { |
| |
| void *ret; |
| |
| if (!size) { return NULL; } |
| |
| ALLOC_CHECK_SIZE(size); |
| ret = malloc(size); |
| ALLOC_CHECK_RESULT(ret, size); |
| |
| return (void *)ret; |
| |
| } |
| |
| /* Allocate a buffer, returning zeroed memory. |
| Returns null for 0 size */ |
| |
| static inline void *DFL_ck_alloc(u32 size) { |
| |
| void *mem; |
| |
| if (!size) { return NULL; } |
| mem = DFL_ck_alloc_nozero(size); |
| |
| return memset(mem, 0, size); |
| |
| } |
| |
| /* Free memory, checking for double free and corrupted heap. When DEBUG_BUILD |
| is set, the old memory will be also clobbered with 0xFF. */ |
| |
| static inline void DFL_ck_free(void *mem) { |
| |
| if (!mem) { return; } |
| |
| free(mem); |
| |
| } |
| |
| /* Re-allocate a buffer, checking for issues and zeroing any newly-added tail. |
| With DEBUG_BUILD, the buffer is always reallocated to a new addresses and the |
| old memory is clobbered with 0xFF. */ |
| |
| static inline void *DFL_ck_realloc(void *orig, u32 size) { |
| |
| void *ret; |
| |
| if (!size) { |
| |
| DFL_ck_free(orig); |
| return NULL; |
| |
| } |
| |
| ALLOC_CHECK_SIZE(size); |
| |
| /* Catch pointer issues sooner: force relocation and make sure that the |
| original buffer is wiped. */ |
| |
| ret = realloc(orig, size); |
| |
| ALLOC_CHECK_RESULT(ret, size); |
| |
| return (void *)ret; |
| |
| } |
| |
| /* Create a buffer with a copy of a string. Returns NULL for NULL inputs. */ |
| |
| static inline u8 *DFL_ck_strdup(u8 *str) { |
| |
| u8 *ret; |
| u32 size; |
| |
| if (!str) { return NULL; } |
| |
| size = strlen((char *)str) + 1; |
| |
| ALLOC_CHECK_SIZE(size); |
| ret = (u8 *)malloc(size); |
| ALLOC_CHECK_RESULT(ret, size); |
| |
| return (u8 *)memcpy(ret, str, size); |
| |
| } |
| |
| /* In non-debug mode, we just do straightforward aliasing of the above |
| functions to user-visible names such as ck_alloc(). */ |
| |
| #define ck_alloc DFL_ck_alloc |
| #define ck_alloc_nozero DFL_ck_alloc_nozero |
| #define ck_realloc DFL_ck_realloc |
| #define ck_strdup DFL_ck_strdup |
| #define ck_free DFL_ck_free |
| |
| #define alloc_report() |
| |
| #else |
| // This is the original alloc-inl of stock afl |
| |
| /* User-facing macro to sprintf() to a dynamically allocated buffer. */ |
| |
| #define alloc_printf(_str...) \ |
| ({ \ |
| \ |
| u8 *_tmp; \ |
| s32 _len = snprintf(NULL, 0, _str); \ |
| if (_len < 0) FATAL("Whoa, snprintf() fails?!"); \ |
| _tmp = ck_alloc(_len + 1); \ |
| snprintf((char *)_tmp, _len + 1, _str); \ |
| _tmp; \ |
| \ |
| }) |
| |
| /* Macro to enforce allocation limits as a last-resort defense against |
| integer overflows. */ |
| #define ALLOC_CHECK_SIZE(_s) \ |
| do { \ |
| \ |
| if ((_s) > MAX_ALLOC) ABORT("Bad alloc request: %u bytes", (_s)); \ |
| \ |
| } while (0) |
| |
| /* Macro to check malloc() failures and the like. */ |
| |
| #define ALLOC_CHECK_RESULT(_r, _s) \ |
| do { \ |
| \ |
| if (!(_r)) ABORT("Out of memory: can't allocate %u bytes", (_s)); \ |
| \ |
| } while (0) |
| |
| /* Magic tokens used to mark used / freed chunks. */ |
| |
| #define ALLOC_MAGIC_C1 0xFF00FF00 /* Used head (dword) */ |
| #define ALLOC_MAGIC_F 0xFE00FE00 /* Freed head (dword) */ |
| #define ALLOC_MAGIC_C2 0xF0 /* Used tail (byte) */ |
| |
| /* Positions of guard tokens in relation to the user-visible pointer. */ |
| |
| #define ALLOC_C1(_ptr) (((u32 *)(_ptr))[-2]) |
| #define ALLOC_S(_ptr) (((u32 *)(_ptr))[-1]) |
| #define ALLOC_C2(_ptr) (((u8 *)(_ptr))[ALLOC_S(_ptr)]) |
| |
| #define ALLOC_OFF_HEAD 8 |
| #define ALLOC_OFF_TOTAL (ALLOC_OFF_HEAD + 1) |
| |
| /* Sanity-checking macros for pointers. */ |
| |
| #define CHECK_PTR(_p) \ |
| do { \ |
| \ |
| if (_p) { \ |
| \ |
| if (ALLOC_C1(_p) ^ ALLOC_MAGIC_C1) { \ |
| \ |
| if (ALLOC_C1(_p) == ALLOC_MAGIC_F) \ |
| ABORT("Use after free."); \ |
| else \ |
| ABORT("Corrupted head alloc canary."); \ |
| \ |
| } \ |
| if (ALLOC_C2(_p) ^ ALLOC_MAGIC_C2) \ |
| ABORT("Corrupted tail alloc canary."); \ |
| \ |
| } \ |
| \ |
| } while (0) |
| |
| #define CHECK_PTR_EXPR(_p) \ |
| ({ \ |
| \ |
| typeof(_p) _tmp = (_p); \ |
| CHECK_PTR(_tmp); \ |
| _tmp; \ |
| \ |
| }) |
| |
| /* Allocate a buffer, explicitly not zeroing it. Returns NULL for zero-sized |
| requests. */ |
| |
| static inline void *DFL_ck_alloc_nozero(u32 size) { |
| |
| void *ret; |
| |
| if (!size) return NULL; |
| |
| ALLOC_CHECK_SIZE(size); |
| ret = malloc(size + ALLOC_OFF_TOTAL); |
| ALLOC_CHECK_RESULT(ret, size); |
| |
| ret = (char *)ret + ALLOC_OFF_HEAD; |
| |
| ALLOC_C1(ret) = ALLOC_MAGIC_C1; |
| ALLOC_S(ret) = size; |
| ALLOC_C2(ret) = ALLOC_MAGIC_C2; |
| |
| return ret; |
| |
| } |
| |
| /* Allocate a buffer, returning zeroed memory. */ |
| |
| static inline void *DFL_ck_alloc(u32 size) { |
| |
| void *mem; |
| |
| if (!size) return NULL; |
| mem = DFL_ck_alloc_nozero(size); |
| |
| return memset(mem, 0, size); |
| |
| } |
| |
| /* Free memory, checking for double free and corrupted heap. When DEBUG_BUILD |
| is set, the old memory will be also clobbered with 0xFF. */ |
| |
| static inline void DFL_ck_free(void *mem) { |
| |
| if (!mem) return; |
| |
| CHECK_PTR(mem); |
| #ifdef DEBUG_BUILD |
| |
| /* Catch pointer issues sooner. */ |
| memset(mem, 0xFF, ALLOC_S(mem)); |
| |
| #endif /* DEBUG_BUILD */ |
| |
| ALLOC_C1(mem) = ALLOC_MAGIC_F; |
| |
| free((char *)mem - ALLOC_OFF_HEAD); |
| |
| } |
| |
| /* Re-allocate a buffer, checking for issues and zeroing any newly-added tail. |
| With DEBUG_BUILD, the buffer is always reallocated to a new addresses and the |
| old memory is clobbered with 0xFF. */ |
| |
| static inline void *DFL_ck_realloc(void *orig, u32 size) { |
| |
| void *ret; |
| u32 old_size = 0; |
| |
| if (!size) { |
| |
| DFL_ck_free(orig); |
| return NULL; |
| |
| } |
| |
| if (orig) { |
| |
| CHECK_PTR(orig); |
| |
| #ifndef DEBUG_BUILD |
| ALLOC_C1(orig) = ALLOC_MAGIC_F; |
| #endif /* !DEBUG_BUILD */ |
| |
| old_size = ALLOC_S(orig); |
| orig = (char *)orig - ALLOC_OFF_HEAD; |
| |
| ALLOC_CHECK_SIZE(old_size); |
| |
| } |
| |
| ALLOC_CHECK_SIZE(size); |
| |
| #ifndef DEBUG_BUILD |
| |
| ret = realloc(orig, size + ALLOC_OFF_TOTAL); |
| ALLOC_CHECK_RESULT(ret, size); |
| |
| #else |
| |
| /* Catch pointer issues sooner: force relocation and make sure that the |
| original buffer is wiped. */ |
| |
| ret = malloc(size + ALLOC_OFF_TOTAL); |
| ALLOC_CHECK_RESULT(ret, size); |
| |
| if (orig) { |
| |
| memcpy((char *)ret + ALLOC_OFF_HEAD, (char *)orig + ALLOC_OFF_HEAD, |
| MIN(size, old_size)); |
| memset((char *)orig + ALLOC_OFF_HEAD, 0xFF, old_size); |
| |
| ALLOC_C1((char *)orig + ALLOC_OFF_HEAD) = ALLOC_MAGIC_F; |
| |
| free(orig); |
| |
| } |
| |
| #endif /* ^!DEBUG_BUILD */ |
| |
| ret = (char *)ret + ALLOC_OFF_HEAD; |
| |
| ALLOC_C1(ret) = ALLOC_MAGIC_C1; |
| ALLOC_S(ret) = size; |
| ALLOC_C2(ret) = ALLOC_MAGIC_C2; |
| |
| if (size > old_size) memset((char *)ret + old_size, 0, size - old_size); |
| |
| return ret; |
| |
| } |
| |
| /* Create a buffer with a copy of a string. Returns NULL for NULL inputs. */ |
| |
| static inline u8 *DFL_ck_strdup(u8 *str) { |
| |
| void *ret; |
| u32 size; |
| |
| if (!str) return NULL; |
| |
| size = strlen((char *)str) + 1; |
| |
| ALLOC_CHECK_SIZE(size); |
| ret = malloc(size + ALLOC_OFF_TOTAL); |
| ALLOC_CHECK_RESULT(ret, size); |
| |
| ret = (char *)ret + ALLOC_OFF_HEAD; |
| |
| ALLOC_C1(ret) = ALLOC_MAGIC_C1; |
| ALLOC_S(ret) = size; |
| ALLOC_C2(ret) = ALLOC_MAGIC_C2; |
| |
| return memcpy(ret, str, size); |
| |
| } |
| |
| #ifndef DEBUG_BUILD |
| |
| /* In non-debug mode, we just do straightforward aliasing of the above |
| functions to user-visible names such as ck_alloc(). */ |
| |
| #define ck_alloc DFL_ck_alloc |
| #define ck_alloc_nozero DFL_ck_alloc_nozero |
| #define ck_realloc DFL_ck_realloc |
| #define ck_strdup DFL_ck_strdup |
| #define ck_free DFL_ck_free |
| |
| #define alloc_report() |
| |
| #else |
| |
| /* In debugging mode, we also track allocations to detect memory leaks, and |
| the flow goes through one more layer of indirection. */ |
| |
| /* Alloc tracking data structures: */ |
| |
| #define ALLOC_BUCKETS 4096 |
| |
| struct TRK_obj { |
| |
| void *ptr; |
| char *file, *func; |
| u32 line; |
| |
| }; |
| |
| #ifdef AFL_MAIN |
| |
| struct TRK_obj *TRK[ALLOC_BUCKETS]; |
| u32 TRK_cnt[ALLOC_BUCKETS]; |
| |
| #define alloc_report() TRK_report() |
| |
| #else |
| |
| extern struct TRK_obj *TRK[ALLOC_BUCKETS]; |
| extern u32 TRK_cnt[ALLOC_BUCKETS]; |
| |
| #define alloc_report() |
| |
| #endif /* ^AFL_MAIN */ |
| |
| /* Bucket-assigning function for a given pointer: */ |
| |
| #define TRKH(_ptr) (((((u32)(_ptr)) >> 16) ^ ((u32)(_ptr))) % ALLOC_BUCKETS) |
| |
| /* Add a new entry to the list of allocated objects. */ |
| |
| static inline void TRK_alloc_buf(void *ptr, const char *file, const char *func, |
| u32 line) { |
| |
| u32 i, bucket; |
| |
| if (!ptr) return; |
| |
| bucket = TRKH(ptr); |
| |
| /* Find a free slot in the list of entries for that bucket. */ |
| |
| for (i = 0; i < TRK_cnt[bucket]; i++) |
| |
| if (!TRK[bucket][i].ptr) { |
| |
| TRK[bucket][i].ptr = ptr; |
| TRK[bucket][i].file = (char *)file; |
| TRK[bucket][i].func = (char *)func; |
| TRK[bucket][i].line = line; |
| return; |
| |
| } |
| |
| /* No space available - allocate more. */ |
| |
| TRK[bucket] = DFL_ck_realloc(TRK[bucket], |
| (TRK_cnt[bucket] + 1) * sizeof(struct TRK_obj)); |
| |
| TRK[bucket][i].ptr = ptr; |
| TRK[bucket][i].file = (char *)file; |
| TRK[bucket][i].func = (char *)func; |
| TRK[bucket][i].line = line; |
| |
| TRK_cnt[bucket]++; |
| |
| } |
| |
| /* Remove entry from the list of allocated objects. */ |
| |
| static inline void TRK_free_buf(void *ptr, const char *file, const char *func, |
| u32 line) { |
| |
| u32 i, bucket; |
| |
| if (!ptr) return; |
| |
| bucket = TRKH(ptr); |
| |
| /* Find the element on the list... */ |
| |
| for (i = 0; i < TRK_cnt[bucket]; i++) |
| |
| if (TRK[bucket][i].ptr == ptr) { |
| |
| TRK[bucket][i].ptr = 0; |
| return; |
| |
| } |
| |
| WARNF("ALLOC: Attempt to free non-allocated memory in %s (%s:%u)", func, file, |
| line); |
| |
| } |
| |
| /* Do a final report on all non-deallocated objects. */ |
| |
| static inline void TRK_report(void) { |
| |
| u32 i, bucket; |
| |
| fflush(0); |
| |
| for (bucket = 0; bucket < ALLOC_BUCKETS; bucket++) |
| for (i = 0; i < TRK_cnt[bucket]; i++) |
| if (TRK[bucket][i].ptr) |
| WARNF("ALLOC: Memory never freed, created in %s (%s:%u)", |
| TRK[bucket][i].func, TRK[bucket][i].file, TRK[bucket][i].line); |
| |
| } |
| |
| /* Simple wrappers for non-debugging functions: */ |
| |
| static inline void *TRK_ck_alloc(u32 size, const char *file, const char *func, |
| u32 line) { |
| |
| void *ret = DFL_ck_alloc(size); |
| TRK_alloc_buf(ret, file, func, line); |
| return ret; |
| |
| } |
| |
| static inline void *TRK_ck_realloc(void *orig, u32 size, const char *file, |
| const char *func, u32 line) { |
| |
| void *ret = DFL_ck_realloc(orig, size); |
| TRK_free_buf(orig, file, func, line); |
| TRK_alloc_buf(ret, file, func, line); |
| return ret; |
| |
| } |
| |
| static inline void *TRK_ck_strdup(u8 *str, const char *file, const char *func, |
| u32 line) { |
| |
| void *ret = DFL_ck_strdup(str); |
| TRK_alloc_buf(ret, file, func, line); |
| return ret; |
| |
| } |
| |
| static inline void TRK_ck_free(void *ptr, const char *file, const char *func, |
| u32 line) { |
| |
| TRK_free_buf(ptr, file, func, line); |
| DFL_ck_free(ptr); |
| |
| } |
| |
| /* Aliasing user-facing names to tracking functions: */ |
| |
| #define ck_alloc(_p1) TRK_ck_alloc(_p1, __FILE__, __FUNCTION__, __LINE__) |
| |
| #define ck_alloc_nozero(_p1) \ |
| TRK_ck_alloc(_p1, __FILE__, __FUNCTION__, __LINE__) |
| |
| #define ck_realloc(_p1, _p2) \ |
| TRK_ck_realloc(_p1, _p2, __FILE__, __FUNCTION__, __LINE__) |
| |
| #define ck_strdup(_p1) TRK_ck_strdup(_p1, __FILE__, __FUNCTION__, __LINE__) |
| |
| #define ck_free(_p1) TRK_ck_free(_p1, __FILE__, __FUNCTION__, __LINE__) |
| |
| #endif /* ^!DEBUG_BUILD */ |
| |
| #endif /* _WANT_ORIGINAL_AFL_ALLOC */ |
| |
| /* This function calculates the next power of 2 greater or equal its argument. |
| @return The rounded up power of 2 (if no overflow) or 0 on overflow. |
| */ |
| static inline size_t next_pow2(size_t in) { |
| |
| // Commented this out as this behavior doesn't change, according to unittests |
| // if (in == 0 || in > (size_t)-1) { |
| |
| // |
| // return 0; /* avoid undefined behaviour under-/overflow |
| // */ |
| // |
| // } |
| |
| size_t out = in - 1; |
| out |= out >> 1; |
| out |= out >> 2; |
| out |= out >> 4; |
| out |= out >> 8; |
| out |= out >> 16; |
| return out + 1; |
| |
| } |
| |
| /* AFL alloc buffer, the struct is here so we don't need to do fancy ptr |
| * arithmetics */ |
| struct afl_alloc_buf { |
| |
| /* The complete allocated size, including the header of len |
| * AFL_ALLOC_SIZE_OFFSET */ |
| size_t complete_size; |
| /* ptr to the first element of the actual buffer */ |
| u8 buf[0]; |
| |
| }; |
| |
| #define AFL_ALLOC_SIZE_OFFSET (offsetof(struct afl_alloc_buf, buf)) |
| |
| /* Returns the container element to this ptr */ |
| static inline struct afl_alloc_buf *afl_alloc_bufptr(void *buf) { |
| |
| return (struct afl_alloc_buf *)((u8 *)buf - AFL_ALLOC_SIZE_OFFSET); |
| |
| } |
| |
| /* Gets the maximum size of the buf contents (ptr->complete_size - |
| * AFL_ALLOC_SIZE_OFFSET) */ |
| static inline size_t afl_alloc_bufsize(void *buf) { |
| |
| return afl_alloc_bufptr(buf)->complete_size - AFL_ALLOC_SIZE_OFFSET; |
| |
| } |
| |
| /* This function makes sure *size is > size_needed after call. |
| It will realloc *buf otherwise. |
| *size will grow exponentially as per: |
| https://blog.mozilla.org/nnethercote/2014/11/04/please-grow-your-buffers-exponentially/ |
| Will return NULL and free *buf if size_needed is <1 or realloc failed. |
| @return For convenience, this function returns *buf. |
| */ |
| static inline void *afl_realloc(void **buf, size_t size_needed) { |
| |
| struct afl_alloc_buf *new_buf = NULL; |
| |
| size_t current_size = 0; |
| size_t next_size = 0; |
| |
| if (likely(*buf)) { |
| |
| /* the size is always stored at buf - 1*size_t */ |
| new_buf = (struct afl_alloc_buf *)afl_alloc_bufptr(*buf); |
| current_size = new_buf->complete_size; |
| |
| } |
| |
| size_needed += AFL_ALLOC_SIZE_OFFSET; |
| |
| /* No need to realloc */ |
| if (likely(current_size >= size_needed)) { return *buf; } |
| |
| /* No initial size was set */ |
| if (size_needed < INITIAL_GROWTH_SIZE) { |
| |
| next_size = INITIAL_GROWTH_SIZE; |
| |
| } else { |
| |
| /* grow exponentially */ |
| next_size = next_pow2(size_needed); |
| |
| /* handle overflow: fall back to the original size_needed */ |
| if (unlikely(!next_size)) { next_size = size_needed; } |
| |
| } |
| |
| /* alloc */ |
| struct afl_alloc_buf *newer_buf = |
| (struct afl_alloc_buf *)realloc(new_buf, next_size); |
| if (unlikely(!newer_buf)) { |
| |
| free(new_buf); // avoid a leak |
| *buf = NULL; |
| return NULL; |
| |
| } |
| |
| new_buf = newer_buf; |
| memset(((u8 *)new_buf) + current_size, 0, next_size - current_size); |
| |
| new_buf->complete_size = next_size; |
| *buf = (void *)(new_buf->buf); |
| return *buf; |
| |
| } |
| |
| /* afl_realloc_exact uses afl alloc buffers but sets it to a specific size */ |
| |
| static inline void *afl_realloc_exact(void **buf, size_t size_needed) { |
| |
| struct afl_alloc_buf *new_buf = NULL; |
| |
| size_t current_size = 0; |
| |
| if (likely(*buf)) { |
| |
| /* the size is always stored at buf - 1*size_t */ |
| new_buf = (struct afl_alloc_buf *)afl_alloc_bufptr(*buf); |
| current_size = new_buf->complete_size; |
| |
| } |
| |
| size_needed += AFL_ALLOC_SIZE_OFFSET; |
| |
| /* No need to realloc */ |
| if (unlikely(current_size == size_needed)) { return *buf; } |
| |
| /* alloc */ |
| struct afl_alloc_buf *newer_buf = |
| (struct afl_alloc_buf *)realloc(new_buf, size_needed); |
| if (unlikely(!newer_buf)) { |
| |
| free(new_buf); // avoid a leak |
| *buf = NULL; |
| return NULL; |
| |
| } else { |
| |
| new_buf = newer_buf; |
| |
| } |
| |
| new_buf->complete_size = size_needed; |
| *buf = (void *)(new_buf->buf); |
| return *buf; |
| |
| } |
| |
| static inline void afl_free(void *buf) { |
| |
| if (buf) { free(afl_alloc_bufptr(buf)); } |
| |
| } |
| |
| /* Swaps buf1 ptr and buf2 ptr, as well as their sizes */ |
| static inline void afl_swap_bufs(void **buf1, void **buf2) { |
| |
| void *scratch_buf = *buf1; |
| *buf1 = *buf2; |
| *buf2 = scratch_buf; |
| |
| } |
| |
| #undef INITIAL_GROWTH_SIZE |
| |
| #endif /* ! _HAVE_ALLOC_INL_H */ |
| |
