Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package afl for openSUSE:Factory checked in at 2026-09-04 12:38:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/afl (Old) and /work/SRC/openSUSE:Factory/.afl.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "afl" Fri Sep 4 12:38:21 2026 rev:98 rq:1375439 version:5.03c Changes: -------- --- /work/SRC/openSUSE:Factory/afl/afl.changes 2026-06-10 16:17:11.448485337 +0200 +++ /work/SRC/openSUSE:Factory/.afl.new.1265/afl.changes 2026-09-04 12:38:54.152407488 +0200 @@ -1,0 +2,214 @@ +Wed Sep 2 14:35:15 UTC 2026 - Marcus Meissner <[email protected]> + +- Version ++5.03c (release) + ! Value Profile implementation for AFL++ by Khaled Yakdan (@kyakdan) that + is much more efficient and intelligent than the libfuzzer implementation. + Enable in the fuzz target with `AFL_LLVM_VALUE_PROFILE=1` and enable for + afl-fuzz with `-r <seconds>` when to activate (default off) + ! macOS now uses POSIX shared memory instead of SysV, which lifts the + `kern.sysv.shmseg` / `kern.sysv.shmmax` ceilings (CmpLog alone needs a + 145 MB segment, far past the 4 MB macOS default). !!! You need to + recompile your targets on macOS - a target built by an older afl-cc still + expects a SysV id in `__AFL_SHM_ID` !!! + afl-fuzz + - big change: limits before switching modes is not time based but exec based now. + - fix: shmem leakage on target timeouts and crashes - this has been the case + since vanilla AFL. Now fixed for Linux, MacOS and mmap targets. + - for more variability, a "starved" mode is implemented now. If for a longer + time no finds are found, then more seed and mutation variability is + introduced incl. splicing phase enabled. This is visible in the UI. + - env `AFL_STARVED_MINIMIZE_QUEUE`: if starve mode does not help either, + minimize the the queue like afl-cmin does and make the coverage of the + removed entries rediscoverable. Inspired by `Novelty Not Found: Adaptive + Fuzzer Restarts to Improve Input Space Coverage` + - sending `SIGUSR2` forces a sync (AFL internal sync and foreign `-F` ) as + soon as the current queue entry has been fuzzed + - the trimming stage no longer throws away what it produces: crashes, + hangs and new coverage found while shortening a queue entry are now + saved (visible as `op:trim`/`op:ptrim` in the file names) + - `-s fixed_seed` now only sets a fixed seed and does not ignore timings + anymore (required for proper benchmarking in containers without urandom) + - `-t xxx+` fix so dummy seeds do not kill a start-up. rechecks now over + time + - a queue entry that fails its calibration is never fuzzed, so the + coverage it claimed is now handed back to `virgin_bits` and can be + rediscovered by an input that does calibrate. + - the variable behavior flag of a queue entry is cleared now on slow + resumes, another afl vanilla legacy bug + - fixed SAND and FrameShift issues + - symlinked test cases and symlinked subdirectories in the `-i` input + directory are now followed + - foreign sync directories (`-F`) now import symlinked test cases too + - enhancements and fixes for cmplog and ijon + - due to a bug first introduced in v4.30c the cmplog target was used for + fuzzing if present - fixed + - an unreadable foreign sync (`-F`) directory is reported now, once per + directory, and the directories are listed at startup - a mistyped path + was silently ignored for the whole run before + - the queue driver always returns to the main loop now, even when every + entry it looks at is skipped + - a custom mutator that fails to load because it was built with an + instrumenting compiler is named as such instead of just showing the + missing `__afl_*` symbol + - afl-cc + - remove classic AFL instrumentation (colliding coverage), as `AFL_LLVM_PATH` + and `AFL_LLVM_CALLER` replace these mostly and are overall much better + - more invisible decisions can be instrumented now, all optional + - new env var `AFL_LLVM_DENSE=1` to disable PCGUARD basic block pruning + - new env var `AFL_LLVM_MINMAX=1` scores min/max/abs intrinsics, i.e. + clamps that the optimizer made branchless. Default off: it adds 10% map + entries but costs 20% throughput + - new env var `AFL_LLVM_FUSED=1` scores both halves of a fused condition, + i.e. `if (a && b)` speculated into a single `and i1` + - new env var `AFL_LLVM_VECTORS=1` instruments vector selects and vector + min/max one guard pair per lane (default off, they are rarely worth it) + - removed the obsolete afl-as assembler wrapper and its remaining references + - headers shipped in a source checkout are found in `include/` now, an + in-tree build silently preferred an older installed copy before + - fix: `CODE_COVERAGE=1` builds + - IJON: the map expansion is re-applied after a guard-init reset, so a + target whose coverage is split over several instrumented modules gets + the full map; the IJON channels also stay live under a tool that + attached a map without being a forkserver parent (`afl-showmap` on a + single input, `afl-cmin.bash`); `AFL_DUMP_MAP_SIZE` prints the + coverage/IJON breakdown to stderr + - afl-cmin: + - (all variants: C, python, bash, awk): empty (0 byte) input files are now + skipped, plus various other fixes and corner case handling + - afl-merge (symlink) - merge new files into an existing corpus (that is + not minimized) + - afl-cmin.c is now the default afl-cmin, but it needed a larger rewrite + - `-T all` (C and python variants) now counts the CPUs the process is + actually allowed to run on (like `nproc` does) + - fix: afl-cmin.c asked afl_shm_init() to chown the shared maps to gid 0, + which aborted with `fchown() failed` on POSIX shared memory. No tool + wants a chown here, so it now passes -1 like all the others do. + - afl-showmap: + - `-i` now follows symlinked test cases and symlinked subdirectories + - a child killed by a signal no longer reports a garbage exit code in + streaming mode (`-S`) + - the target's instrumentation is checked in `-I` and `-S` mode too, not + only with `-i` + - afl-showmap, afl-cmin, afl-tmin, afl-analyze: + - the IJON max-value slots and a bug-pass map are no longer counted as + coverage: they hold wide values, not hit counts, and were reported as + tuples, minimised against and bucket-classified in place + - fix: releaseshared memory when aborted + - afl-health + - more speed, more info, a few fixes + missing `__afl_*` symbol + - afl-cc + - remove classic AFL instrumentation (colliding coverage), as `AFL_LLVM_PATH` + and `AFL_LLVM_CALLER` replace these mostly and are overall much better + - more invisible decisions can be instrumented now, all optional + - new env var `AFL_LLVM_DENSE=1` to disable PCGUARD basic block pruning + - new env var `AFL_LLVM_MINMAX=1` scores min/max/abs intrinsics, i.e. + clamps that the optimizer made branchless. Default off: it adds 10% map + entries but costs 20% throughput + - new env var `AFL_LLVM_FUSED=1` scores both halves of a fused condition, + i.e. `if (a && b)` speculated into a single `and i1` + - new env var `AFL_LLVM_VECTORS=1` instruments vector selects and vector + min/max one guard pair per lane (default off, they are rarely worth it) + - removed the obsolete afl-as assembler wrapper and its remaining references + - headers shipped in a source checkout are found in `include/` now, an + in-tree build silently preferred an older installed copy before + - fix: `CODE_COVERAGE=1` builds + - IJON: the map expansion is re-applied after a guard-init reset, so a + target whose coverage is split over several instrumented modules gets + the full map; the IJON channels also stay live under a tool that + attached a map without being a forkserver parent (`afl-showmap` on a + single input, `afl-cmin.bash`); `AFL_DUMP_MAP_SIZE` prints the + coverage/IJON breakdown to stderr + - afl-cmin: + - (all variants: C, python, bash, awk): empty (0 byte) input files are now + skipped, plus various other fixes and corner case handling + - afl-merge (symlink) - merge new files into an existing corpus (that is + not minimized) + - afl-cmin.c is now the default afl-cmin, but it needed a larger rewrite + - `-T all` (C and python variants) now counts the CPUs the process is + actually allowed to run on (like `nproc` does) + - fix: afl-cmin.c asked afl_shm_init() to chown the shared maps to gid 0, + which aborted with `fchown() failed` on POSIX shared memory. No tool + wants a chown here, so it now passes -1 like all the others do. + - afl-showmap: + - `-i` now follows symlinked test cases and symlinked subdirectories + - a child killed by a signal no longer reports a garbage exit code in + streaming mode (`-S`) + - the target's instrumentation is checked in `-I` and `-S` mode too, not + only with `-i` + - afl-showmap, afl-cmin, afl-tmin, afl-analyze: + - the IJON max-value slots and a bug-pass map are no longer counted as + coverage: they hold wide values, not hit counts, and were reported as + tuples, minimised against and bucket-classified in place + - fix: releaseshared memory when aborted + - afl-health + - more speed, more info, a few fixes + - custom_mutators: + - removed outdated and pointless radamsa + - frida_mode: + - fix arm64 inline coverage ADRP fixups when instrumentation suppression is + disabled + +------------------------------------------------------------------- +Mon Jun 29 14:34:00 UTC 2026 - Marcus Meissner <[email protected]> + +- Version ++5.02c (release) + !!! You need to recompile persistent mode/LLVMFuzzerTestOneInput target !!! + - afl-health: + - new tool: AFL++ campaign health tool checker, much more advanced than + afl-whatsup, with tips, analysis and ssh support + - afl-fuzz: + - Futex implementation missed the clean-up of the shmem + - Futex shmem now lives in general shared memory map as by default only + 32 such regions are supported in MacOS + - afl-cc: + - new C11 mode (`AFL_LLVM_C11` at compile time): afl-cc records each + function's local variable count and afl-fuzz uses it as an extra queue + scheduling signal to favor more complex code paths. Noticably improvement, + based on the paper https://mlsec.org/docs/2026-icse.pdf + - if `-fsanitize-coverage-allowlist=`/`-fsanitize-coverage-ignorelist=` is + passed without `AFL_LLVM_ALLOWLIST`/`AFL_LLVM_DENYLIST` being set, the + supplied list is reused as `AFL_LLVM_ALLOWLIST`/`AFL_LLVM_DENYLIST` (with + a warning) so the optimized PCGUARD honors it + - instrument allow/deny lists (`AFL_LLVM_ALLOWLIST`/`AFL_LLVM_DENYLIST` and + the GCC equivalents): function (`fun:`) entries are now matched verbatim + with `fnmatch()` instead of having a `*` prepended automatically - add a + leading `*` yourself for a suffix match. Function entries are matched + against both the mangled and the demangled (LLVM) / unqualified (GCC) + name, and an explicit `fun:` prefix now permits `:` so demangled C++/Rust + names can be listed. File (`src:`) entries are unchanged and still match + as a suffix (an implicit leading `*`) + - AFL_LLVM_CRASHLIST - crash on any function that is marked not to be + instrumented but is entered by fuzzing input + - bugfix for __AFL_LOOP() that lingered since vanilla afl, first run + coverage map would look different to following runs, impacting lots of + functionality (minimizing, stability, etc.) + - afl-* script tools: + - prefer AFL_PATH to find afl-showmap + - man pages: fixed the SYNOPSIS and OPTIONS sections for several tools +- Version ++5.01c (release) + - MacOS persistent mode now uses futex mode now too which increases speed + and reduces system call overhead (opt out with AFL_FAST_CHILD_SYNC) - this + requires a MacOS from 2024 onwards. + - afl-fuzz + - new adaptive MOpt! Much better than the outdated one we still had. + How good it is still needs to be seen but initially it seems to be + better than standard havoc + - enforce halt on UBSAN errors + - afl-cc: + - enforce halt on UBSAN errors (AFL_USE_USBAN=1) + - better cmplog on MacOS + - removed unsupported LLVM version code paths from afl-cc and llvm passes + - compcov: fixes for float splittings (thanks to @ngg) + - nyx_mode: + - fix nyx_mode issues (thanks to @morehouse) + - qemu_mode: + - non-colliding coverage! + - faster persistent fuzzing + - minor bug fixes + - qemu_bridge: + - new mode with current QEMU version, so plugins possible, new processors + - sightly slower than qemu_mode + - WIP! + +------------------------------------------------------------------- Old: ---- v5.00c.tar.gz New: ---- v5.03c.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ afl.spec ++++++ --- /var/tmp/diff_new_pack.YBDsXe/_old 2026-09-04 12:38:55.348449504 +0200 +++ /var/tmp/diff_new_pack.YBDsXe/_new 2026-09-04 12:38:55.350449574 +0200 @@ -29,7 +29,7 @@ %endif Name: afl -Version: 5.00c +Version: 5.03c Release: 0 Summary: American fuzzy lop is a security-oriented fuzzer #URL: https://lcamtuf.coredump.cx/afl/ @@ -100,6 +100,7 @@ %endif export CFLAGS_FLTO="" make %{?_smp_mflags} PREFIX=%{_prefix} CFLAGS_FLTO=$CFLAGS_FLTO LIBEXEC_DIR=%{_libexecdir} DOC_DIR=%{_docdir} MAN_PATH=%{_mandir}/man8 DESTDIR=%{buildroot} install + chmod -x %{buildroot}/%{_libexecdir}/%{name}/*.o %files ++++++ v5.00c.tar.gz -> v5.03c.tar.gz ++++++ ++++ 125219 lines of diff (skipped)
