ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-18 12:48:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

larger map, stats reload fix, code format

Browse Source
This commit is contained in:
vanhauser-thc
2021-02-07 05:33:02 +01:00
parent 01327ad301
commit 209c5ba465
7 changed files with 52 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/Changelog.md
View File

@ -26,6 +26,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
`-i` or resumes (as these have most likely already been done)
- fix crash for very, very fast targets+systems (thanks to mhlakhani
for reporting)
- on restarts (-i)/autoresume (AFL_AUTORESUME) the stats are now
reloaded and used, thanks to Vimal Joseph for this PR!
- if determinstic mode is active (-D, or -M without -d) then we sync
after every queue entry as this can take very long time otherwise
- better detection if a target needs a large shared map

2
instrumentation/afl-compiler-rt.o.c
View File

@ -70,7 +70,7 @@
run. It will end up as .comm, so it shouldn't be too wasteful. */
#if MAP_SIZE <= 65536
#define MAP_INITIAL_SIZE 1048576
#define MAP_INITIAL_SIZE 2097152
#else
#define MAP_INITIAL_SIZE MAP_SIZE
#endif

3
instrumentation/afl-llvm-lto-instrumentation.so.cc
View File

@ -69,7 +69,8 @@ class AFLLTOPass : public ModulePass {
if (getenv("AFL_DEBUG")) debug = 1;
if ((ptr = getenv("AFL_LLVM_LTO_STARTID")) != NULL)
if ((afl_global_id = (uint32_t)atoi(ptr)) < 0 || afl_global_id >= MAP_SIZE)
if ((afl_global_id = (uint32_t)atoi(ptr)) < 0 ||
afl_global_id >= MAP_SIZE)
FATAL("AFL_LLVM_LTO_STARTID value of \"%s\" is not between 0 and %u\n",
ptr, MAP_SIZE - 1);

5
qemu_mode/libqasan/dlmalloc.c
View File

@ -3907,6 +3907,7 @@ static void internal_malloc_stats(mstate m) {
clear_smallmap(M, I); \
\
} else if (RTCHECK(B == smallbin_at(M, I) || \
\
(ok_address(M, B) && B->fd == P))) { \
\
F->bk = B; \
@ -4117,6 +4118,7 @@ static void internal_malloc_stats(mstate m) {
XP->child[1] = R; \
\
} else \
\
CORRUPTION_ERROR_ACTION(M); \
if (R != 0) { \
\
@ -4132,6 +4134,7 @@ static void internal_malloc_stats(mstate m) {
C0->parent = R; \
\
} else \
\
CORRUPTION_ERROR_ACTION(M); \
\
} \
@ -4143,11 +4146,13 @@ static void internal_malloc_stats(mstate m) {
C1->parent = R; \
\
} else \
\
CORRUPTION_ERROR_ACTION(M); \
\
} \
\
} else \
\
CORRUPTION_ERROR_ACTION(M); \
\
} \

3
src/afl-fuzz-bitmap.c
View File

@ -325,7 +325,8 @@ u8 *describe_op(afl_state_t *afl, u8 new_bits, size_t max_description_len) {
}
sprintf(ret + strlen(ret), ",time:%llu", get_cur_time() - afl->start_time);
sprintf(ret + strlen(ret), ",time:%llu",
get_cur_time() + afl->prev_run_time - afl->start_time);
if (afl->current_custom_fuzz &&
afl->current_custom_fuzz->afl_custom_describe) {

43
src/afl-fuzz-statsd.c
View File

@ -1,3 +1,8 @@
/*
* This implements rpc.statsd support, see docs/rpc_statsd.md
*
*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
@ -226,37 +231,39 @@ int statsd_format_metric(afl_state_t *afl, char *buff, size_t bufflen) {
*/
if (afl->statsd_metric_format_type == STATSD_TAGS_TYPE_SUFFIX) {
snprintf(buff, bufflen, afl->statsd_metric_format,
snprintf(
buff, bufflen, afl->statsd_metric_format,
afl->queue_cycle ? (afl->queue_cycle - 1) : 0, tags,
afl->cycles_wo_finds, tags, afl->fsrv.total_execs, tags,
afl->fsrv.total_execs /
((double)(get_cur_time() - afl->start_time) / 1000),
((double)(get_cur_time() + afl->prev_run_time - afl->start_time) /
1000),
tags, afl->queued_paths, tags, afl->queued_favored, tags,
afl->queued_discovered, tags, afl->queued_imported, tags,
afl->max_depth, tags, afl->current_entry, tags,
afl->pending_favored, tags, afl->pending_not_fuzzed, tags,
afl->queued_variable, tags, afl->unique_crashes, tags,
afl->unique_hangs, tags, afl->total_crashes, tags,
afl->slowest_exec_ms, tags,
count_non_255_bytes(afl, afl->virgin_bits), tags,
afl->var_byte_count, tags, afl->expand_havoc, tags);
afl->max_depth, tags, afl->current_entry, tags, afl->pending_favored,
tags, afl->pending_not_fuzzed, tags, afl->queued_variable, tags,
afl->unique_crashes, tags, afl->unique_hangs, tags, afl->total_crashes,
tags, afl->slowest_exec_ms, tags,
count_non_255_bytes(afl, afl->virgin_bits), tags, afl->var_byte_count,
tags, afl->expand_havoc, tags);
} else if (afl->statsd_metric_format_type == STATSD_TAGS_TYPE_MID) {
snprintf(buff, bufflen, afl->statsd_metric_format, tags,
snprintf(
buff, bufflen, afl->statsd_metric_format, tags,
afl->queue_cycle ? (afl->queue_cycle - 1) : 0, tags,
afl->cycles_wo_finds, tags, afl->fsrv.total_execs, tags,
afl->fsrv.total_execs /
((double)(get_cur_time() - afl->start_time) / 1000),
((double)(get_cur_time() + afl->prev_run_time - afl->start_time) /
1000),
tags, afl->queued_paths, tags, afl->queued_favored, tags,
afl->queued_discovered, tags, afl->queued_imported, tags,
afl->max_depth, tags, afl->current_entry, tags,
afl->pending_favored, tags, afl->pending_not_fuzzed, tags,
afl->queued_variable, tags, afl->unique_crashes, tags,
afl->unique_hangs, tags, afl->total_crashes, tags,
afl->slowest_exec_ms, tags,
count_non_255_bytes(afl, afl->virgin_bits), tags,
afl->var_byte_count, tags, afl->expand_havoc);
afl->max_depth, tags, afl->current_entry, tags, afl->pending_favored,
tags, afl->pending_not_fuzzed, tags, afl->queued_variable, tags,
afl->unique_crashes, tags, afl->unique_hangs, tags, afl->total_crashes,
tags, afl->slowest_exec_ms, tags,
count_non_255_bytes(afl, afl->virgin_bits), tags, afl->var_byte_count,
tags, afl->expand_havoc);
}

10
utils/afl_untracer/afl-untracer.c
View File

@ -480,9 +480,9 @@ void setup_trap_instrumentation(void) {
// Index into the coverage bitmap for the current trap instruction.
#ifdef __aarch64__
uint64_t bitmap_index = 0;
#ifdef __APPLE__
#ifdef __APPLE__
pthread_jit_write_protect_np(0);
#endif
#endif
#else
uint32_t bitmap_index = 0;
#endif
@ -627,13 +627,13 @@ static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
// Must re-execute the instruction, so decrement PC by one instruction.
ucontext_t *ctx = (ucontext_t *)context;
#if defined(__APPLE__) && defined(__LP64__)
#if defined(__x86_64__)
#if defined(__x86_64__)
ctx->uc_mcontext->__ss.__rip -= 1;
addr = ctx->uc_mcontext->__ss.__rip;
#else
#else
ctx->uc_mcontext->__ss.__pc -= 4;
addr = ctx->uc_mcontext->__ss.__pc;
#endif
#endif
#elif defined(__linux__)
#if defined(__x86_64__) || defined(__i386__)
ctx->uc_mcontext.gregs[REG_RIP] -= 1;