afl-ld.c

/*
  american fuzzy lop++ - wrapper for GNU ld
  -----------------------------------------

  Written by Marc Heuse <mh@mh-sec.de> for afl++

  Maintained by Marc Heuse <mh@mh-sec.de>,
                Heiko Eißfeldt <heiko.eissfeldt@hexco.de>
                Andrea Fioraldi <andreafioraldi@gmail.com>
                Dominik Maier <domenukk@gmail.com>

  Copyright 2019-2020 AFLplusplus Project. All rights reserved.

  Licensed under the Apache License, Version 2.0 (the "License");
  you may not use this file except in compliance with the License.
  You may obtain a copy of the License at:

    http://www.apache.org/licenses/LICENSE-2.0

  The sole purpose of this wrapper is to preprocess clang LTO files before
  linking by ld and perform the instrumentation on the whole program.

*/

#define AFL_MAIN

#include "config.h"
#include "types.h"
#include "debug.h"
#include "alloc-inl.h"

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <ctype.h>
#include <fcntl.h>

#include <sys/stat.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/time.h>

#include <dirent.h>

#define MAX_PARAM_COUNT 4096

static u8 **ld_params,              /* Parameters passed to the real 'ld'   */
    **link_params,                  /* Parameters passed to 'llvm-link'     */
    **opt_params,                   /* Parameters passed to 'opt' opt       */
    **inst_params;                  /* Parameters passed to 'opt' inst      */

static u8 *input_file;              /* Originally specified input file      */
static u8 *final_file,              /* Instrumented file for the real 'ld'  */
    *linked_file,                   /* file where we link all files         */
    *modified_file;                 /* file that was optimized before instr */
static u8 *afl_path = AFL_PATH;
static u8 *real_ld = AFL_REAL_LD;
static u8  cwd[4096];
static u8 *tmp_dir;
static u8 *ar_dir;
static u8  ar_dir_cnt;
static u8 *libdirs[254];
static u8  libdir_cnt;

static u8 be_quiet,                 /* Quiet mode (no stderr output)        */
    debug,                          /* AFL_DEBUG                            */
    passthrough,                    /* AFL_LD_PASSTHROUGH - no link+optimize*/
    we_link,                        /* we have bc/ll -> link + optimize     */
    just_version;                   /* Just show version?                   */

static u32 ld_param_cnt = 1,        /* Number of params to 'ld'             */
    link_param_cnt = 1,             /* Number of params to 'llvm-link'      */
    opt_param_cnt = 1,              /* Number of params to 'opt' opt        */
    inst_param_cnt = 1;             /* Number of params to 'opt' instr      */

/* This function wipes a directory - our AR unpack directory in this case */
static u8 wipe_directory(u8 *path) {

  DIR *          d;
  struct dirent *d_ent;

  d = opendir(path);

  if (!d) return 0;

  while ((d_ent = readdir(d))) {

    if (strcmp(d_ent->d_name, ".") != 0 && strcmp(d_ent->d_name, "..") != 0) {

      u8 *fname = alloc_printf("%s/%s", path, d_ent->d_name);
      if (unlink(fname)) PFATAL("Unable to delete '%s'", fname);
      ck_free(fname);

    }

  }

  closedir(d);

  return !!rmdir(path);

}

/* remove temporary files on fatal errors */
static void at_exit_handler(void) {

  if (!getenv("AFL_KEEP_ASSEMBLY")) {

    if (linked_file) {

      unlink(linked_file);
      linked_file = NULL;

    }

    if (modified_file) {

      unlink(modified_file);
      modified_file = NULL;

    }

    if (final_file) {

      unlink(final_file);
      final_file = NULL;

    }

    if (ar_dir != NULL) {

      wipe_directory(ar_dir);
      ar_dir = NULL;

    }

  }

}

/* This function checks if the parameter is a) an existing file and b)
   if it is a BC or LL file, if both are true it returns 1 and 0 otherwise */
int is_llvm_file(const char *file) {

  int fd;
  u8  buf[5];

  if ((fd = open(file, O_RDONLY)) < 0) {

    if (debug) SAYF(cMGN "[D] " cRST "File %s not found", file);
    return 0;

  }

  if (read(fd, buf, 4) != 4) return 0;
  buf[sizeof(buf) - 1] = 0;

  close(fd);

  if (strncmp(buf, "; Mo", 4) == 0) return 1;

  if (buf[0] == 'B' && buf[1] == 'C' && buf[2] == 0xc0 && buf[3] == 0xde)
    return 1;

  return 0;

}

/* Return the current working directory, not thread safe ;-) */
u8 *getthecwd() {

  static u8 fail[] = "";
  if (getcwd(cwd, sizeof(cwd)) == NULL) return fail;
  return cwd;

}

/* Check if an ar extracted file is already in the parameter list */
int is_duplicate(u8 **params, u32 ld_param_cnt, u8 *ar_file) {

  for (uint32_t i = 0; i < ld_param_cnt; i++)
    if (params[i] != NULL)
      if (strcmp(params[i], ar_file) == 0) return 1;

  return 0;

}

/* Examine and modify parameters to pass to 'ld', 'llvm-link' and 'llmv-ar'.
   Note that the file name is always the last parameter passed by GCC,
   so we exploit this property to keep the code "simple". */
static void edit_params(int argc, char **argv) {

  u32 i, have_lto = 0, libdir_index;
  u8  libdir_file[4096];

  if (tmp_dir == NULL) {

    tmp_dir = getenv("TMPDIR");
    if (!tmp_dir) tmp_dir = getenv("TEMP");
    if (!tmp_dir) tmp_dir = getenv("TMP");
    if (!tmp_dir) tmp_dir = "/tmp";

  }

  linked_file =
      alloc_printf("%s/.afl-%u-%u-1.ll", tmp_dir, getpid(), (u32)time(NULL));
  modified_file =
      alloc_printf("%s/.afl-%u-%u-2.bc", tmp_dir, getpid(), (u32)time(NULL));
  final_file =
      alloc_printf("%s/.afl-%u-%u-3.bc", tmp_dir, getpid(), (u32)time(NULL));

  ld_params = ck_alloc(4096 * sizeof(u8 *));
  link_params = ck_alloc(4096 * sizeof(u8 *));
  inst_params = ck_alloc(12 * sizeof(u8 *));
  opt_params = ck_alloc(12 * sizeof(u8 *));

  ld_params[0] = (u8 *)real_ld;
  ld_params[ld_param_cnt++] = "--allow-multiple-definition";

  link_params[0] = alloc_printf("%s/%s", LLVM_BINDIR, "llvm-link");
  link_params[link_param_cnt++] = "-S";  // we create the linked file as .ll
  link_params[link_param_cnt++] = "-o";
  link_params[link_param_cnt++] = linked_file;

  opt_params[0] = alloc_printf("%s/%s", LLVM_BINDIR, "opt");
  if (getenv("AFL_DONT_OPTIMIZE") == NULL)
    opt_params[opt_param_cnt++] = "-O3";
  else
    opt_params[opt_param_cnt++] = "-O0";

  // opt_params[opt_param_cnt++] = "-S"; // only when debugging
  opt_params[opt_param_cnt++] = linked_file;  // input: .ll file
  opt_params[opt_param_cnt++] = "-o";
  opt_params[opt_param_cnt++] = modified_file;  // output: .bc file

  inst_params[0] = alloc_printf("%s/%s", LLVM_BINDIR, "opt");
  inst_params[inst_param_cnt++] =
      alloc_printf("--load=%s/afl-llvm-lto-instrumentation.so", afl_path);
  // inst_params[inst_param_cnt++] = "-S"; // only when debugging
  inst_params[inst_param_cnt++] = "--disable-opt";
  inst_params[inst_param_cnt++] = "--afl-lto";
  inst_params[inst_param_cnt++] = modified_file;  // input: .bc file
  inst_params[inst_param_cnt++] = "-o";
  inst_params[inst_param_cnt++] = final_file;  // output: .bc file

  // first we must collect all library search paths
  for (i = 1; i < argc; i++)
    if (strlen(argv[i]) > 2 && argv[i][0] == '-' && argv[i][1] == 'L')
      libdirs[libdir_cnt++] = argv[i] + 2;

  // then we inspect all options to the target linker
  for (i = 1; i < argc; i++) {

    if (ld_param_cnt >= MAX_PARAM_COUNT || link_param_cnt >= MAX_PARAM_COUNT)
      FATAL(
          "Too many command line parameters because of unpacking .a archives, "
          "this would need to be done by hand ... sorry! :-(");

    if (strncmp(argv[i], "-flto", 5) == 0) have_lto = 1;

    if (!strcmp(argv[i], "-version")) {

      just_version = 1;
      ld_params[1] = argv[i];
      ld_params[2] = NULL;
      final_file = input_file;
      return;

    }

    if (strcmp(argv[i], "--afl") == 0) {

      if (!be_quiet) OKF("afl++ test command line flag detected, exiting.");
      exit(0);

    }

    // if a -l library is linked and no .so is found but an .a archive is there
    // then the archive will be used. So we have to emulate this and check
    // if an archive will be used and if yes we will instrument it too
    libdir_file[0] = 0;
    libdir_index = libdir_cnt;
    if (strncmp(argv[i], "-l", 2) == 0 && libdir_cnt > 0 &&
        strncmp(argv[i], "-lgcc", 5) != 0) {

      u8 found = 0;

      for (uint32_t j = 0; j < libdir_cnt && !found; j++) {

        snprintf(libdir_file, sizeof(libdir_file), "%s/lib%s%s", libdirs[j],
                 argv[i] + 2, ".so");
        if (access(libdir_file, R_OK) != 0) {  // no .so found?

          snprintf(libdir_file, sizeof(libdir_file), "%s/lib%s%s", libdirs[j],
                   argv[i] + 2, ".a");
          if (access(libdir_file, R_OK) == 0) {  // but .a found?

            libdir_index = j;
            found = 1;
            if (debug) SAYF(cMGN "[D] " cRST "Found %s\n", libdir_file);

          }

        } else {

          found = 1;
          if (debug) SAYF(cMGN "[D] " cRST "Found %s\n", libdir_file);

        }

      }

    }

    // is the parameter an .a AR archive? If so, unpack and check its files
    if (libdir_index < libdir_cnt ||
        (argv[i][0] != '-' && strlen(argv[i]) > 2 &&
         argv[i][strlen(argv[i]) - 1] == 'a' &&
         argv[i][strlen(argv[i]) - 2] == '.')) {

      // This gets a bit odd. I encountered several .a files being linked and
      // where the same "foo.o" was in both .a archives. llvm-link does not
      // like this so we have to work around that ...

      u8             this_wd[4096], *this_ar;
      u8             ar_params_cnt = 4;
      u8 *           ar_params[ar_params_cnt];
      u8 *           file = argv[i];
      s32            pid, status;
      DIR *          arx;
      struct dirent *dir_ent;

      if (libdir_index < libdir_cnt) file = libdir_file;

      if (ar_dir_cnt == 0) {  // first archive, we setup up the basics

        ar_dir = alloc_printf("%s/.afl-%u-%u.dir", tmp_dir, getpid(),
                              (u32)time(NULL));
        if (mkdir(ar_dir, 0700) != 0)
          FATAL("can not create temporary directory %s", ar_dir);

      }

      if (getcwd(this_wd, sizeof(this_wd)) == NULL)
        FATAL("can not get the current working directory");
      if (chdir(ar_dir) != 0)
        FATAL("can not chdir to temporary directory %s", ar_dir);
      if (file[0] == '/')
        this_ar = file;
      else
        this_ar = alloc_printf("%s/%s", this_wd, file);
      ar_params[0] = alloc_printf("%s/%s", LLVM_BINDIR, "llvm-ar");
      ar_params[1] = "x";
      ar_params[2] = this_ar;
      ar_params[3] = NULL;

      if (!be_quiet) OKF("Running ar unpacker on %s into %s", this_ar, ar_dir);

      if (debug) {

        SAYF(cMGN "[D]" cRST " cd \"%s\";", getthecwd());
        for (uint32_t j = 0; j < ar_params_cnt; j++)
          SAYF(" \"%s\"", ar_params[j]);
        SAYF("\n");

      }

      if (!(pid = fork())) {

        execvp(ar_params[0], (char **)ar_params);
        FATAL("Oops, failed to execute '%s'", ar_params[0]);

      }

      if (pid < 0) FATAL("fork() failed");
      if (waitpid(pid, &status, 0) <= 0) FATAL("waitpid() failed");
      if (WEXITSTATUS(status) != 0) exit(WEXITSTATUS(status));

      if (chdir(this_wd) != 0)
        FATAL("can not chdir back to our working directory %s", this_wd);

      if (!(arx = opendir(ar_dir))) FATAL("can not open directory %s", ar_dir);

      while ((dir_ent = readdir(arx)) != NULL) {

        u8 *ar_file = alloc_printf("%s/%s", ar_dir, dir_ent->d_name);

        if (dir_ent->d_name[strlen(dir_ent->d_name) - 1] == 'o' &&
            dir_ent->d_name[strlen(dir_ent->d_name) - 2] == '.') {

          if (passthrough || is_llvm_file(ar_file) == 0) {

            if (is_duplicate(ld_params, ld_param_cnt, ar_file) == 0) {

              ld_params[ld_param_cnt++] = ar_file;
              if (debug)
                SAYF(cMGN "[D] " cRST "not a LTO link file: %s\n", ar_file);

            }

          } else {

            if (is_duplicate(link_params, link_param_cnt, ar_file) == 0) {

              if (we_link == 0) {  // we have to honor order ...

                ld_params[ld_param_cnt++] = final_file;
                we_link = 1;

              }

              link_params[link_param_cnt++] = ar_file;
              if (debug) SAYF(cMGN "[D] " cRST "is a link file: %s\n", ar_file);

            }

          }

        } else

            if (dir_ent->d_name[0] != '.' && !be_quiet)
          WARNF("Unusual file found in ar archive %s: %s", argv[i], ar_file);

      }

      closedir(arx);
      ar_dir_cnt++;

      continue;

    }

    if (passthrough || argv[i][0] == '-' || is_llvm_file(argv[i]) == 0) {

      // -O3 fucks up the CFG and instrumentation, so we downgrade to O2
      // which is as we want things. Lets hope this is not too different
      // in the various llvm versions!
      if (strncmp(argv[i], "-plugin-opt=O", 13) == 0 &&
          !getenv("AFL_DONT_OPTIMIZE"))
        ld_params[ld_param_cnt++] = "-plugin-opt=O2";
      else
        ld_params[ld_param_cnt++] = argv[i];

    } else {

      if (we_link == 0) {  // we have to honor order ...
        ld_params[ld_param_cnt++] = final_file;
        we_link = 1;

      }

      link_params[link_param_cnt++] = argv[i];

    }

  }

  // if (have_lto == 0) ld_params[ld_param_cnt++] = AFL_CLANG_FLTO; // maybe we
  // should not ...
  ld_params[ld_param_cnt] = NULL;
  link_params[link_param_cnt] = NULL;
  opt_params[opt_param_cnt] = NULL;
  inst_params[inst_param_cnt] = NULL;

}

/* clean AFL_PATH from PATH */

void clean_path() {

  char *tmp, *newpath = NULL, *path = getenv("PATH");
  u8    done = 0;

  if (debug)
    SAYF(cMGN "[D]" cRST " old PATH=%s, AFL_PATH=%s\n", path, AFL_PATH);

  // wipe AFL paths from PATH that we set
  // we added two paths so we remove the two paths
  while (!done) {

    if (*path == 0)
      done = 1;
    else if (*path++ == ':')
      done = 1;

  }

  while (*path == ':')
    path++;

  // AFL_PATH could be additionally in PATH so check and remove to not call our
  // 'ld'
  const size_t pathlen = strlen(path);
  const size_t afl_pathlen = strlen(AFL_PATH);
  newpath = malloc(pathlen + 1);
  if (strcmp(AFL_PATH, "/bin") != 0 && strcmp(AFL_PATH, "/usr/bin") != 0 &&
      afl_pathlen > 1 && (tmp = strstr(path, AFL_PATH)) != NULL &&  // it exists
      (tmp == path ||
       (tmp > path &&
        tmp[-1] == ':')) &&  // either starts with it or has a colon before
      (tmp + afl_pathlen == path + pathlen ||
       (tmp + afl_pathlen <
        path + (pathlen && tmp[afl_pathlen] ==
                               ':'))  // end with it or has a colon at the end
       )) {

    int one_colon = 1;

    if (tmp > path) {

      memcpy(newpath, path, tmp - path);
      newpath[tmp - path - 1] = 0;  // remove ':'
      one_colon = 0;

    }

    if (tmp + afl_pathlen < path + pathlen) tmp += afl_pathlen + one_colon;

    setenv("PATH", newpath, 1);

  } else

    setenv("PATH", path, 1);

  if (debug) SAYF(cMGN "[D]" cRST " new PATH=%s\n", getenv("PATH"));
  free(newpath);

}

/* Main entry point */

int main(int argc, char **argv) {

  s32 pid, i;
  int status;
  u8 *ptr, exe[4096], exe2[4096], proc[32], val[2] = " ";
  int have_afl_ld_caller = 0;

  if (isatty(2) && !getenv("AFL_QUIET") && !getenv("AFL_DEBUG")) {

    if (getenv("AFL_LD") != NULL)
      SAYF(cCYA "afl-ld" VERSION cRST
                " by Marc \"vanHauser\" Heuse <mh@mh-sec.de> (level %d)\n",
           have_afl_ld_caller);

  } else

    be_quiet = 1;

  if (getenv("AFL_DEBUG") != NULL) debug = 1;
  if (getenv("AFL_PATH") != NULL) afl_path = getenv("AFL_PATH");
  if (getenv("AFL_LD_PASSTHROUGH") != NULL) passthrough = 1;
  if (getenv("AFL_REAL_LD") != NULL) real_ld = getenv("AFL_REAL_LD");
  if (real_ld == NULL || strlen(real_ld) < 2) real_ld = "/bin/ld";
  if (real_ld != NULL && real_ld[0] != '/')
    real_ld = alloc_printf("/bin/%s", real_ld);

  if ((ptr = getenv("AFL_LD_CALLER")) != NULL) have_afl_ld_caller = atoi(ptr);
  val[0] = 0x31 + have_afl_ld_caller;
  setenv("AFL_LD_CALLER", val, 1);

  if (debug) {

    SAYF(cMGN "[D] " cRST
              "AFL_LD=%s, set AFL_LD_CALLER=%s, have_afl_ld_caller=%d, "
              "real_ld=%s\n",
         getenv("AFL_LD"), val, have_afl_ld_caller, real_ld);
    SAYF(cMGN "[D]" cRST " cd \"%s\";", getthecwd());
    for (i = 0; i < argc; i++)
      SAYF(" \"%s\"", argv[i]);
    SAYF("\n");

  }

  sprintf(proc, "/proc/%d/exe", getpid());
  if (readlink(proc, exe, sizeof(exe) - 1) > 0) {

    if (readlink(real_ld, exe2, sizeof(exe2) - 1) < 1) exe2[0] = 0;
    exe[sizeof(exe) - 1] = 0;
    exe[sizeof(exe2) - 1] = 0;
    if (strcmp(exe, real_ld) == 0 || strcmp(exe, exe2) == 0)
      PFATAL(cLRD "[!] " cRST
                  "Error: real 'ld' path points to afl-ld, set AFL_REAL_LD to "
                  "the real 'ld' program!");

  }

  if (have_afl_ld_caller > 1)
    PFATAL(cLRD "[!] " cRST
                "Error: afl-ld calls itself in a loop, set AFL_REAL_LD to the "
                "real 'ld' program!");

  if (argc < 2) {

    SAYF(
        "\n"
        "This is a helper application for afl-fuzz. It is a wrapper around GNU "
        "'ld',\n"
        "executed by the toolchain whenever using "
        "afl-clang-lto/afl-clang-lto++.\n"
        "You probably don't want to run this program directly.\n\n"

        "Environment variables:\n"
        "  AFL_LD_PASSTHROUGH   do not link+optimize == no instrumentation\n"
        "  AFL_REAL_LD          point to the real ld if necessary\n"

        "\nafl-ld was compiled with the fixed real 'ld' path of %s and the "
        "clang "
        "bin path of %s\n\n",
        real_ld, LLVM_BINDIR);

    exit(1);

  }

  if (getenv("AFL_LD") == NULL) {

    /* if someone install clang/ld into the same directory as afl++ then
       they are out of luck ... */

    if (have_afl_ld_caller == 1) { clean_path(); }

    if (real_ld != NULL && strlen(real_ld) > 1) execvp(real_ld, argv);
    execvp("ld", argv);  // fallback
    PFATAL("Oops, failed to execute 'ld' - check your PATH");

  }

  atexit(at_exit_handler);  // ensure to wipe temp files if things fail

  edit_params(argc, argv);  // here most of the magic happens :-)

  if (debug)
    SAYF(cMGN "[D] " cRST
              "param counts: ar:%u lib:%u ld:%u link:%u opt:%u instr:%u\n",
         ar_dir_cnt, libdir_cnt, ld_param_cnt, link_param_cnt, opt_param_cnt,
         inst_param_cnt);

  if (!just_version) {

    if (we_link == 0) {

      if (!getenv("AFL_QUIET"))
        WARNF("No LTO input file found, cannot instrument!");

    } else {

      /* first we link all files */
      if (!be_quiet) OKF("Running bitcode linker, creating %s", linked_file);

      if (debug) {

        SAYF(cMGN "[D]" cRST " cd \"%s\";", getthecwd());
        for (i = 0; i < link_param_cnt; i++)
          SAYF(" \"%s\"", link_params[i]);
        SAYF("\n");

      }

      if (!(pid = fork())) {

        execvp(link_params[0], (char **)link_params);
        FATAL("Oops, failed to execute '%s'", link_params[0]);

      }

      if (pid < 0) PFATAL("fork() failed");
      if (waitpid(pid, &status, 0) <= 0) PFATAL("waitpid() failed");
      if (WEXITSTATUS(status) != 0) {

        SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD
             "\n[-] PROGRAM ABORT : " cRST);
        SAYF(
            "llvm-link failed! Probable causes:\n\n"
            " #1  If the error is \"linking globals named '...': symbol "
            "multiply defined\"\n"
            "     then there is nothing we can do - llvm-link is missing an "
            "important feature\n\n"
            " #2  If the error is \"expected top-level entity\" and then "
            "binary output, this\n"
            "     is because the same file is present in different .a archives "
            "in different\n"
            "     formats. This can be fixed by manual doing the steps afl-ld "
            "is doing but\n"
            "     programmatically - sorry!\n\n");
        exit(WEXITSTATUS(status));

      }

      /* then we perform an optimization on the collected objects files */
      if (!be_quiet)
        OKF("Performing optimization via opt, creating %s", modified_file);
      if (debug) {

        SAYF(cMGN "[D]" cRST " cd \"%s\";", getthecwd());
        for (i = 0; i < opt_param_cnt; i++)
          SAYF(" \"%s\"", opt_params[i]);
        SAYF("\n");

      }

      if (!(pid = fork())) {

        execvp(opt_params[0], (char **)opt_params);
        FATAL("Oops, failed to execute '%s'", opt_params[0]);

      }

      if (pid < 0) PFATAL("fork() failed");
      if (waitpid(pid, &status, 0) <= 0) PFATAL("waitpid() failed");
      if (WEXITSTATUS(status) != 0) exit(WEXITSTATUS(status));

      /* then we run the instrumentation through the optimizer */
      if (!be_quiet)
        OKF("Performing instrumentation via opt, creating %s", final_file);
      if (debug) {

        SAYF(cMGN "[D]" cRST " cd \"%s\";", getthecwd());
        for (i = 0; i < inst_param_cnt; i++)
          SAYF(" \"%s\"", inst_params[i]);
        SAYF("\n");

      }

      if (!(pid = fork())) {

        execvp(inst_params[0], (char **)inst_params);
        FATAL("Oops, failed to execute '%s'", inst_params[0]);

      }

      if (pid < 0) PFATAL("fork() failed");
      if (waitpid(pid, &status, 0) <= 0) PFATAL("waitpid() failed");
      if (WEXITSTATUS(status) != 0) exit(WEXITSTATUS(status));

    }

    /* next step - run the linker! :-) */

  }

  if (!be_quiet) OKF("Running real linker %s", real_ld);
  if (debug) {

    SAYF(cMGN "[D]" cRST " cd \"%s\";", getthecwd());
    for (i = 0; i < ld_param_cnt; i++)
      SAYF(" \"%s\"", ld_params[i]);
    SAYF("\n");

  }

  if (!(pid = fork())) {

    clean_path();

    unsetenv("AFL_LD");

    if (strlen(real_ld) > 1) execvp(real_ld, (char **)ld_params);
    execvp("ld", (char **)ld_params);  // fallback
    FATAL("Oops, failed to execute 'ld' - check your PATH");

  }

  if (pid < 0) PFATAL("fork() failed");

  if (waitpid(pid, &status, 0) <= 0) PFATAL("waitpid() failed");
  if (debug) SAYF(cMGN "[D] " cRST "linker result: %d\n", status);

  if (!just_version) {

    if (!getenv("AFL_KEEP_ASSEMBLY")) {

      if (linked_file) {

        unlink(linked_file);
        linked_file = NULL;

      }

      if (modified_file) {

        unlink(modified_file);
        modified_file = NULL;

      }

      if (final_file) {

        unlink(final_file);
        final_file = NULL;

      }

      if (ar_dir != NULL) {

        wipe_directory(ar_dir);
        ar_dir = NULL;

      }

    } else {

      if (!be_quiet) {

        SAYF(
            "[!] afl-ld: keeping link file %s, optimized bitcode %s and "
            "instrumented bitcode %s",
            linked_file, modified_file, final_file);
        if (ar_dir_cnt > 0 && ar_dir)
          SAYF(" and ar archive unpack directory %s", ar_dir);
        SAYF("\n");

      }

    }

    if (status == 0) {

      if (!be_quiet) OKF("Linker was successful");

    } else {

      SAYF(cLRD "[-] " cRST
                "Linker failed, please investigate and send a bug report. Most "
                "likely an 'ld' option is incompatible with %s. Try "
                "AFL_KEEP_ASSEMBLY=1 and AFL_DEBUG=1 for replaying.\n",
           AFL_CLANG_FLTO);

    }

  }

  exit(WEXITSTATUS(status));

}