fix expand havoc for ..._only modes

docs/Changelog.md

@@ -19,6 +19,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
      - eliminated CPU affinity race condition for -S/-M runs
      - expanded havoc mode added, on no cycle finds add extra splicing and
        MOpt into the mix
+     - fixed a bug in redqueen for strings
   - llvm_mode:
      - now supports llvm 12!
      - fixes for laf-intel float splitting (thanks to mark-griffin for

llvm_mode/afl-llvm-rt.o.c

@@ -869,15 +869,23 @@ void __sanitizer_cov_trace_pc_guard(uint32_t *guard) {
   uint32_t idx;
   char bt[1024];
   for (idx = 0; i < sizeof(unstable)/sizeof(uint32_t); i++) {
+
     if (unstable[idx] == __afl_area_ptr[*guard]) {
+
       int bt_size = backtrace(bt, 256);
       if (bt_size > 0) {
+
         char **bt_syms = backtrace_symbols(bt, bt_size);
         if (bt_syms)
-         fprintf(stderr, "DEBUG: edge=%u caller=%s\n", unstable[idx], bt_syms[0]);
+          fprintf(stderr, "DEBUG: edge=%u caller=%s\n", unstable[idx],
+  bt_syms[0]);
+
       }
+
     }
+
   }
+
   */
 
   __afl_area_ptr[*guard]++;

src/afl-fuzz-redqueen.c

@@ -673,8 +673,8 @@ static u8 rtn_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
   for (i = 0; i < its_len; ++i) {
 
-    if (pattern[i] != buf[idx + i] ||
+    if (pattern[i] != buf[idx + i] || o_pattern[i] != orig_buf[idx + i] ||
-        o_pattern[i] != orig_buf[idx + i] || *status == 1) {
+        *status == 1) {
 
       break;
 

src/afl-fuzz.c

@@ -1304,7 +1304,8 @@ int main(int argc, char **argv_orig, char **envp) {
               afl->expand_havoc = 1;
               break;
             case 1:
-              if (afl->limit_time_sig == 0) {
+              if (afl->limit_time_sig == 0 && !afl->custom_only &&
+                  !afl->python_only) {
 
                 afl->limit_time_sig = -1;
                 afl->limit_time_puppet = 0;

test/test-cmplog.c

@@ -5,23 +5,19 @@
 #include <stdint.h>
 #include <unistd.h>
 int main(int argc, char *argv[]) {
+
   char    buf[1024];
   ssize_t i;
-  if ((i = read(0, buf, sizeof(buf) - 1)) < 24)
+  if ((i = read(0, buf, sizeof(buf) - 1)) < 24) return 0;
-    return 0;
   buf[i] = 0;
-  if (buf[0] != 'A')
+  if (buf[0] != 'A') return 0;
-    return 0;
+  if (buf[1] != 'B') return 0;
-  if (buf[1] != 'B')
+  if (buf[2] != 'C') return 0;
-    return 0;
+  if (buf[3] != 'D') return 0;
-  if (buf[2] != 'C')
+  if (memcmp(buf + 4, "1234", 4) || memcmp(buf + 8, "EFGH", 4)) return 0;
-    return 0;
-  if (buf[3] != 'D')
-    return 0;
-  if (memcmp(buf + 4, "1234", 4) || memcmp(buf + 8, "EFGH", 4))
-    return 0;
   if (strncmp(buf + 12, "IJKL", 4) == 0 && strcmp(buf + 16, "DEADBEEF") == 0)
     abort();
   return 0;
+
 }