ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-11 01:31:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix empty range bug in colorization

Browse Source
This commit is contained in:
Andrea Fioraldi 2020-02-07 17:00:11 +01:00
parent ea37d8cef9
commit 1e10e452aa
3 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -57,7 +57,7 @@ ifneq "$(shell uname -m)" "x86_64"
endif endif
CFLAGS ?= -O3 -funroll-loops $(CFLAGS_OPT) CFLAGS ?= -O3 -funroll-loops $(CFLAGS_OPT)
CFLAGS += -Wall -g -Wno-pointer-sign -I include/ \ override CFLAGS += -Wall -g -Wno-pointer-sign -I include/ \
-DAFL_PATH=\"$(HELPER_PATH)\" -DBIN_PATH=\"$(BIN_PATH)\" \ -DAFL_PATH=\"$(HELPER_PATH)\" -DBIN_PATH=\"$(BIN_PATH)\" \
-DDOC_PATH=\"$(DOC_PATH)\" -Wno-unused-function -DDOC_PATH=\"$(DOC_PATH)\" -Wno-unused-function

4
qemu_mode/patches/afl-qemu-cpu-inl.h
View File

@ -368,8 +368,10 @@ static void afl_forkserver(CPUState *cpu) {
if (WIFSTOPPED(status)) if (WIFSTOPPED(status))
child_stopped = 1; child_stopped = 1;
else if (unlikely(first_run && is_persistent)) else if (unlikely(first_run && is_persistent)) {
fprintf(stderr, "[AFL] ERROR: no persistent iteration executed\n");
exit(12); // Persistent is wrong exit(12); // Persistent is wrong
}
first_run = 0; first_run = 0;
if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7); if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(7);

4
src/afl-fuzz-redqueen.c
View File

@ -122,6 +122,9 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) {
while ((rng = pop_biggest_range(&ranges)) != NULL && stage_cur) { while ((rng = pop_biggest_range(&ranges)) != NULL && stage_cur) {
u32 s = rng->end - rng->start; u32 s = rng->end - rng->start;
if (s == 0)
goto empty_range;
memcpy(backup, buf + rng->start, s); memcpy(backup, buf + rng->start, s);
rand_replace(buf + rng->start, s); rand_replace(buf + rng->start, s);
@ -136,6 +139,7 @@ u8 colorization(u8* buf, u32 len, u32 exec_cksum) {
} else needs_write = 1; } else needs_write = 1;
empty_range:
ck_free(rng); ck_free(rng);
--stage_cur; --stage_cur;