fix expand havoc for ..._only modes

docs/Changelog.md

@@ -19,6 +19,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
      - eliminated CPU affinity race condition for -S/-M runs
      - expanded havoc mode added, on no cycle finds add extra splicing and
        MOpt into the mix
+     - fixed a bug in redqueen for strings
   - llvm_mode:
      - now supports llvm 12!
      - fixes for laf-intel float splitting (thanks to mark-griffin for

examples/persistent_demo/persistent_demo_new.c

@@ -31,8 +31,8 @@
 /* this lets the source compile without afl-clang-fast/lto */
 #ifndef __AFL_FUZZ_TESTCASE_LEN
 
-  ssize_t       fuzz_len;
-  unsigned char fuzz_buf[1024000];
+ssize_t       fuzz_len;
+unsigned char fuzz_buf[1024000];
 
   #define __AFL_FUZZ_TESTCASE_LEN fuzz_len
   #define __AFL_FUZZ_TESTCASE_BUF fuzz_buf

llvm_mode/afl-llvm-rt.o.c

@@ -859,26 +859,34 @@ __attribute__((constructor(CONST_PRIO))) void __afl_auto_init(void) {
 
 void __sanitizer_cov_trace_pc_guard(uint32_t *guard) {
 
- // For stability analysis, if you want to know to which function unstable
- // edge IDs belong to - uncomment, recompile+install llvm_mode, recompile
- // the target. libunwind and libbacktrace are better solutions.
- // Set AFL_DEBUG_CHILD_OUTPUT=1 and run afl-fuzz with 2>file to capture
- // the backtrace output
- /*
- uint32_t unstable[] = { ... unstable edge IDs };
- uint32_t idx;
- char bt[1024];
- for (idx = 0; i < sizeof(unstable)/sizeof(uint32_t); i++) {
-   if (unstable[idx] == __afl_area_ptr[*guard]) {
-     int bt_size = backtrace(bt, 256);
-     if (bt_size > 0) {
-       char **bt_syms = backtrace_symbols(bt, bt_size);
-       if (bt_syms)
-         fprintf(stderr, "DEBUG: edge=%u caller=%s\n", unstable[idx], bt_syms[0]);
-     }
-   }
- }
- */
+  // For stability analysis, if you want to know to which function unstable
+  // edge IDs belong to - uncomment, recompile+install llvm_mode, recompile
+  // the target. libunwind and libbacktrace are better solutions.
+  // Set AFL_DEBUG_CHILD_OUTPUT=1 and run afl-fuzz with 2>file to capture
+  // the backtrace output
+  /*
+  uint32_t unstable[] = { ... unstable edge IDs };
+  uint32_t idx;
+  char bt[1024];
+  for (idx = 0; i < sizeof(unstable)/sizeof(uint32_t); i++) {
+
+    if (unstable[idx] == __afl_area_ptr[*guard]) {
+
+      int bt_size = backtrace(bt, 256);
+      if (bt_size > 0) {
+
+        char **bt_syms = backtrace_symbols(bt, bt_size);
+        if (bt_syms)
+          fprintf(stderr, "DEBUG: edge=%u caller=%s\n", unstable[idx],
+  bt_syms[0]);
+
+      }
+
+    }
+
+  }
+
+  */
 
   __afl_area_ptr[*guard]++;
 

src/afl-fuzz-redqueen.c

@@ -673,15 +673,15 @@ static u8 rtn_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
   for (i = 0; i < its_len; ++i) {
 
-    if (pattern[i] != buf[idx + i] ||
-        o_pattern[i] != orig_buf[idx + i] || *status == 1) {
+    if (pattern[i] != buf[idx + i] || o_pattern[i] != orig_buf[idx + i] ||
+        *status == 1) {
 
       break;
 
     }
 
     buf[idx + i] = repl[i];
-    
+
     if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; }
 
   }
@@ -727,7 +727,7 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
     }
 
     for (idx = 0; idx < len && fails < 8; ++idx) {
-    
+
       if (unlikely(rtn_extend_encoding(afl, h, o->v0, o->v1, orig_o->v0, idx,
                                        orig_buf, buf, len, &status))) {
 

src/afl-fuzz.c

@@ -1304,7 +1304,8 @@ int main(int argc, char **argv_orig, char **envp) {
               afl->expand_havoc = 1;
               break;
             case 1:
-              if (afl->limit_time_sig == 0) {
+              if (afl->limit_time_sig == 0 && !afl->custom_only &&
+                  !afl->python_only) {
 
                 afl->limit_time_sig = -1;
                 afl->limit_time_puppet = 0;

test/test-cmplog.c

@@ -5,23 +5,19 @@
 #include <stdint.h>
 #include <unistd.h>
 int main(int argc, char *argv[]) {
-  char buf[1024];
+
+  char    buf[1024];
   ssize_t i;
-  if ((i = read(0, buf, sizeof(buf) - 1)) < 24)
-    return 0;
+  if ((i = read(0, buf, sizeof(buf) - 1)) < 24) return 0;
   buf[i] = 0;
-  if (buf[0] != 'A')
-    return 0;
-  if (buf[1] != 'B')
-    return 0;
-  if (buf[2] != 'C')
-    return 0;
-  if (buf[3] != 'D')
-    return 0;
-  if (memcmp(buf + 4, "1234", 4) || memcmp(buf + 8, "EFGH", 4))
-    return 0;
+  if (buf[0] != 'A') return 0;
+  if (buf[1] != 'B') return 0;
+  if (buf[2] != 'C') return 0;
+  if (buf[3] != 'D') return 0;
+  if (memcmp(buf + 4, "1234", 4) || memcmp(buf + 8, "EFGH", 4)) return 0;
   if (strncmp(buf + 12, "IJKL", 4) == 0 && strcmp(buf + 16, "DEADBEEF") == 0)
     abort();
   return 0;
+
 }