Persistent Mode error in C++

[abhisen7]

Dear community, I am trying to compile a fuzz target in Persistent mode. The program is supposed to read from a file, then pass the string as an arg to the function being fuzzed, and exit once it reaches EOF. When compiling in default fork mode, the program compiles and afl-fuzz works neatly with a stability of around 99%.

Now, I want to speed things up a bit, but when I use the __AFL_LOOP macro, I get the following error. I found a related discussion on the google group- https://groups.google.com/g/afl-users/c/vcwvkDCyI4o/m/dIN8ApqXCQAJ , but it was not really clear how the issue got fixed.

Any leads would be appreciated, TIA!

/home/abhishek/fuzzing/src/fuzzer/parser_afl++/fuzz_test.cpp:106:15: error: use of GNU statement expression extension [-Werror,-Wgnu-statement-expression]
       while (__AFL_LOOP(N)) 
              ^
<built-in>:485:25: note: expanded from here
#define __AFL_LOOP(_A) ({ static volatile const char *_B __attribute__((used,unused));  _B = (const char*)"##SIG_AFL_PERSISTENT##"; extern int __afl_connected;__attribute__((visibility("default"))) int _L(unsigned int) __asm__("__afl_persistent_loop"); _L(__afl_connected ? _A : 1); })
                        ^
/home/abhishek/fuzzing/src/fuzzer/parser_afl++/fuzz_test.cpp:106:15: error: '_B' was marked unused but was used [-Werror,-Wused-but-marked-unused]
<built-in>:485:89: note: expanded from here
#define __AFL_LOOP(_A) ({ static volatile const char *_B __attribute__((used,unused));  _B = (const char*)"##SIG_AFL_PERSISTENT##"; extern int __afl_connected;__attribute__((visibility("default"))) int _L(unsigned int) __asm__("__afl_persistent_loop"); _L(__afl_connected ? _A : 1); })
                                                                                        ^
/home/abhishek/fuzzing/src/fuzzer/parser_afl++/fuzz_test.cpp:106:15: error: use of old-style cast [-Werror,-Wold-style-cast]
       while (__AFL_LOOP(N)) 
              ^~~~~~~~~~~~~
<built-in>:485:94: note: expanded from here
#define __AFL_LOOP(_A) ({ static volatile const char *_B __attribute__((used,unused));  _B = (const char*)"##SIG_AFL_PERSISTENT##"; extern int __afl_connected;__attribute__((visibility("default"))) int _L(unsigned int) __asm__("__afl_persistent_loop"); _L(__afl_connected ? _A : 1); })

[vanhauser-thc]

remove -Werror,-Wgnu-statement-expression

[abhisen7]

Thanks a ton for the hint, persistent mode now works after suppressing a bunch of warnings including -Wgnu-statement-expression. If you don't mind, I would like to seek some more clarifications (BTW, I modified the fuzz target to read over stdin instead of a file)

1. While fuzzing in non-persistent-mode, the stability score is around 99.48% , but AFL++ starts with a warning: WARNING: instability detected during calibration. Not sure what to make of this!

2. When I switch to persistent-mode, the stability falls to ridiculous levels (< 1%). For the record, I am fuzzing a database, so I tried clearing all the internal state right after every call to the function that is being fuzzed, before the next input is generated by afl-fuzz and passed to the function over stdin (but within the same process, because persistent-mode). Stability still remains low!

Code roughly looks like this-

while(__AFL_LOOP(10000)){
      std::getline(std::cin, line); //reads data over stdin
      fzt.fuzz(line); //calls the function to be fuzzed
      fzt.clear(); //clears internal state
}

I was reading up on stability improvement and I came across this- where it recommends against persistent mode if stability value is low, as contrary to non-persistent mode. WDYT?