ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-09 08:41:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "fix classify counts"

Browse Source 
This reverts commit 4217a6606c92f6a88ab577ae8f91823dd731562d.
This commit is contained in:
vanhauser-thc 2022-01-19 22:17:36 +01:00
parent 409a6517c1
commit 4bcb177f62
9 changed files with 57 additions and 108 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/afl-fuzz.h
View File

@ -1046,7 +1046,6 @@ u32 count_bytes(afl_state_t *, u8 *);
u32 count_non_255_bytes(afl_state_t *, u8 *); u32 count_non_255_bytes(afl_state_t *, u8 *);
void simplify_trace(afl_state_t *, u8 *); void simplify_trace(afl_state_t *, u8 *);
void classify_counts(afl_forkserver_t *); void classify_counts(afl_forkserver_t *);
void classify_counts_off(afl_forkserver_t *, u32);
#ifdef WORD_SIZE_64 #ifdef WORD_SIZE_64
void discover_word(u8 *ret, u64 *current, u64 *virgin); void discover_word(u8 *ret, u64 *current, u64 *virgin);
#else #else

33
include/coverage-32.h
View File

@ -62,23 +62,6 @@ inline void classify_counts(afl_forkserver_t *fsrv) {
} }
inline void classify_counts_off(afl_forkserver_t *fsrv, u32 off) {
u32 *mem = (u32 *)(fsrv->trace_bits + off);
u32 i = ((fsrv->map_size - off) >> 2);
while (i--) {
/* Optimize for sparse bitmaps. */
if (unlikely(*mem)) { *mem = classify_word(*mem); }
mem++;
}
}
/* Updates the virgin bits, then reflects whether a new count or a new tuple is /* Updates the virgin bits, then reflects whether a new count or a new tuple is
* seen in ret. */ * seen in ret. */
inline void discover_word(u8 *ret, u32 *current, u32 *virgin) { inline void discover_word(u8 *ret, u32 *current, u32 *virgin) {
@ -87,7 +70,7 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) {
that have not been already cleared from the virgin map - since this will that have not been already cleared from the virgin map - since this will
almost always be the case. */ almost always be the case. */
if (unlikely(*current & *virgin)) { if (*current & *virgin) {
if (likely(*ret < 2)) { if (likely(*ret < 2)) {
@ -97,8 +80,8 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) {
/* Looks like we have not found any new bytes yet; see if any non-zero /* Looks like we have not found any new bytes yet; see if any non-zero
bytes in current[] are pristine in virgin[]. */ bytes in current[] are pristine in virgin[]. */
if (unlikely((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) || if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) ||
(cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff))) (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff))
*ret = 2; *ret = 2;
else else
*ret = 1; *ret = 1;
@ -114,14 +97,12 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) {
#define PACK_SIZE 16 #define PACK_SIZE 16
inline u32 skim(const u32 *virgin, const u32 *current, const u32 *current_end) { inline u32 skim(const u32 *virgin, const u32 *current, const u32 *current_end) {
u32 *save = (u32*) current;
for (; current < current_end; virgin += 4, current += 4) { for (; current < current_end; virgin += 4, current += 4) {
if (unlikely(current[0] && classify_word(current[0]) & virgin[0])) return (u32)(&current[1] - save); if (current[0] && classify_word(current[0]) & virgin[0]) return 1;
if (unlikely(current[1] && classify_word(current[1]) & virgin[1])) return (u32)(&current[2] - save); if (current[1] && classify_word(current[1]) & virgin[1]) return 1;
if (unlikely(current[2] && classify_word(current[2]) & virgin[2])) return (u32)(&current[3] - save); if (current[2] && classify_word(current[2]) & virgin[2]) return 1;
if (unlikely(current[3] && classify_word(current[3]) & virgin[3])) return (u32)(&current[4] - save); if (current[3] && classify_word(current[3]) & virgin[3]) return 1;
} }

49
include/coverage-64.h
View File

@ -72,23 +72,6 @@ inline void classify_counts(afl_forkserver_t *fsrv) {
} }
inline void classify_counts_off(afl_forkserver_t *fsrv, u32 off) {
u64 *mem = (u64 *)(fsrv->trace_bits + off);
u32 i = ((fsrv->map_size - off) >> 3);
while (i--) {
/* Optimize for sparse bitmaps. */
if (unlikely(*mem)) { *mem = classify_word(*mem); }
mem++;
}
}
/* Updates the virgin bits, then reflects whether a new count or a new tuple is /* Updates the virgin bits, then reflects whether a new count or a new tuple is
* seen in ret. */ * seen in ret. */
inline void discover_word(u8 *ret, u64 *current, u64 *virgin) { inline void discover_word(u8 *ret, u64 *current, u64 *virgin) {
@ -127,20 +110,17 @@ inline void discover_word(u8 *ret, u64 *current, u64 *virgin) {
#define PACK_SIZE 64 #define PACK_SIZE 64
inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
u64 *save = (u64*) current;
for (; current != current_end; virgin += 8, current += 8) { for (; current != current_end; virgin += 8, current += 8) {
__m512i value = *(__m512i *)current; __m512i value = *(__m512i *)current;
__mmask8 mask = _mm512_testn_epi64_mask(value, value); __mmask8 mask = _mm512_testn_epi64_mask(value, value);
/* All bytes are zero. */ /* All bytes are zero. */
if (likely(mask == 0xff)) continue; if (mask == 0xff) continue;
/* Look for nonzero bytes and check for new bits. */ /* Look for nonzero bytes and check for new bits. */
#define UNROLL(x) \ #define UNROLL(x) \
if (unlikely(!(mask & (1 << x)) && classify_word(current[x]) & virgin[x])) \ if (!(mask & (1 << x)) && classify_word(current[x]) & virgin[x]) return 1
return (u32)(&current[x + 1] - save)
UNROLL(0); UNROLL(0);
UNROLL(1); UNROLL(1);
UNROLL(2); UNROLL(2);
@ -163,7 +143,6 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
#define PACK_SIZE 32 #define PACK_SIZE 32
inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
u64 *save = (u64*) current;
__m256i zeroes = _mm256_setzero_si256(); __m256i zeroes = _mm256_setzero_si256();
for (; current < current_end; virgin += 4, current += 4) { for (; current < current_end; virgin += 4, current += 4) {
@ -173,17 +152,13 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
u32 mask = _mm256_movemask_epi8(cmp); u32 mask = _mm256_movemask_epi8(cmp);
/* All bytes are zero. */ /* All bytes are zero. */
if (likely(mask == (u32)-1)) continue; if (mask == (u32)-1) continue;
/* Look for nonzero bytes and check for new bits. */ /* Look for nonzero bytes and check for new bits. */
if (unlikely(!(mask & 0xff) && classify_word(current[0]) & virgin[0])) if (!(mask & 0xff) && classify_word(current[0]) & virgin[0]) return 1;
return (u32)(&current[1] - save); if (!(mask & 0xff00) && classify_word(current[1]) & virgin[1]) return 1;
if (unlikely(!(mask & 0xff00) && classify_word(current[1]) & virgin[1])) if (!(mask & 0xff0000) && classify_word(current[2]) & virgin[2]) return 1;
return (u32)(&current[2] - save); if (!(mask & 0xff000000) && classify_word(current[3]) & virgin[3]) return 1;
if (unlikely(!(mask & 0xff0000) && classify_word(current[2]) & virgin[2]))
return (u32)(&current[3] - save);
if (unlikely(!(mask & 0xff000000) && classify_word(current[3]) & virgin[3]))
return (u32)(&current[4] - save);
} }
@ -197,14 +172,12 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
#define PACK_SIZE 32 #define PACK_SIZE 32
inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) { inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
u64 *save = (u64*) current;
for (; current < current_end; virgin += 4, current += 4) { for (; current < current_end; virgin += 4, current += 4) {
if (unlikely(current[0] && classify_word(current[0]) & virgin[0])) return (u32)(&current[1] - save); if (current[0] && classify_word(current[0]) & virgin[0]) return 1;
if (unlikely(current[1] && classify_word(current[1]) & virgin[1])) return (u32)(&current[2] - save); if (current[1] && classify_word(current[1]) & virgin[1]) return 1;
if (unlikely(current[2] && classify_word(current[2]) & virgin[2])) return (u32)(&current[3] - save); if (current[2] && classify_word(current[2]) & virgin[2]) return 1;
if (unlikely(current[3] && classify_word(current[3]) & virgin[3])) return (u32)(&current[4] - save); if (current[3] && classify_word(current[3]) & virgin[3]) return 1;
} }

2
instrumentation/afl-llvm-common.h
View File

@ -40,7 +40,7 @@ typedef long double max_align_t;
#define FMNAME std::string("") #define FMNAME std::string("")
#endif #endif
char *getBBName(const llvm::BasicBlock *BB); char * getBBName(const llvm::BasicBlock *BB);
bool isIgnoreFunction(const llvm::Function *F); bool isIgnoreFunction(const llvm::Function *F);
void initInstrumentList(); void initInstrumentList();
bool isInInstrumentList(llvm::Function *F, std::string Filename); bool isInInstrumentList(llvm::Function *F, std::string Filename);

5
instrumentation/afl-llvm-pass.so.cc
View File

@ -631,23 +631,18 @@ bool AFLCoverage::runOnModule(Module &M) {
LoadInst *PrevLoc; LoadInst *PrevLoc;
if (ngram_size) { if (ngram_size) {
PrevLoc = IRB.CreateLoad( PrevLoc = IRB.CreateLoad(
#if LLVM_VERSION_MAJOR >= 14 #if LLVM_VERSION_MAJOR >= 14
PrevLocTy, PrevLocTy,
#endif #endif
AFLPrevLoc); AFLPrevLoc);
} else { } else {
PrevLoc = IRB.CreateLoad( PrevLoc = IRB.CreateLoad(
#if LLVM_VERSION_MAJOR >= 14 #if LLVM_VERSION_MAJOR >= 14
IRB.getInt32Ty(), IRB.getInt32Ty(),
#endif #endif
AFLPrevLoc); AFLPrevLoc);
} }
PrevLoc->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None)); PrevLoc->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
Value *PrevLocTrans; Value *PrevLocTrans;

5
instrumentation/cmplog-instructions-pass.cc
View File

@ -478,7 +478,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
*/ */
if (is_fp) { if (is_fp) {
/* /*
ConstantFP *i0 = dyn_cast<ConstantFP>(op0); ConstantFP *i0 = dyn_cast<ConstantFP>(op0);
ConstantFP *i1 = dyn_cast<ConstantFP>(op1); ConstantFP *i1 = dyn_cast<ConstantFP>(op1);
// BUG FIXME TODO: this is null ... but why? // BUG FIXME TODO: this is null ... but why?
@ -498,8 +498,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
last_val1 = cur_val; last_val1 = cur_val;
} }
*/
*/
} else { } else {

5
src/afl-cc.c
View File

@ -876,12 +876,11 @@ static void edit_params(u32 argc, char **argv, char **envp) {
cc_params[cc_par_cnt++] = "-fsanitize=leak"; cc_params[cc_par_cnt++] = "-fsanitize=leak";
cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h"; cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h";
cc_params[cc_par_cnt++] = cc_params[cc_par_cnt++] = "-D__AFL_LEAK_CHECK()={if(__lsan_do_recoverable_leak_check() > 0) _exit(23); }";
"-D__AFL_LEAK_CHECK()={if(__lsan_do_recoverable_leak_check() > 0) "
"_exit(23); }";
cc_params[cc_par_cnt++] = "-D__AFL_LSAN_OFF()=__lsan_disable();"; cc_params[cc_par_cnt++] = "-D__AFL_LSAN_OFF()=__lsan_disable();";
cc_params[cc_par_cnt++] = "-D__AFL_LSAN_ON()=__lsan_enable();"; cc_params[cc_par_cnt++] = "-D__AFL_LSAN_ON()=__lsan_enable();";
} }
if (getenv("AFL_USE_CFISAN")) { if (getenv("AFL_USE_CFISAN")) {

7
src/afl-fuzz-bitmap.c
View File

@ -250,21 +250,20 @@ inline u8 has_new_bits(afl_state_t *afl, u8 *virgin_map) {
inline u8 has_new_bits_unclassified(afl_state_t *afl, u8 *virgin_map) { inline u8 has_new_bits_unclassified(afl_state_t *afl, u8 *virgin_map) {
/* Handle the hot path first: no new coverage */ /* Handle the hot path first: no new coverage */
u32 off;
u8 *end = afl->fsrv.trace_bits + afl->fsrv.map_size; u8 *end = afl->fsrv.trace_bits + afl->fsrv.map_size;
#ifdef WORD_SIZE_64 #ifdef WORD_SIZE_64
if (!(off = skim((u64 *)virgin_map, (u64 *)afl->fsrv.trace_bits, (u64 *)end))) if (!skim((u64 *)virgin_map, (u64 *)afl->fsrv.trace_bits, (u64 *)end))
return 0; return 0;
#else #else
if (!(off = skim((u32 *)virgin_map, (u32 *)afl->fsrv.trace_bits, (u32 *)end))) if (!skim((u32 *)virgin_map, (u32 *)afl->fsrv.trace_bits, (u32 *)end))
return 0; return 0;
#endif /* ^WORD_SIZE_64 */ #endif /* ^WORD_SIZE_64 */
classify_counts_off(&afl->fsrv, off); classify_counts(&afl->fsrv);
return has_new_bits(afl, virgin_map); return has_new_bits(afl, virgin_map);
} }

6
src/afl-fuzz-queue.c
View File

@ -769,7 +769,11 @@ void cull_queue(afl_state_t *afl) {
afl->top_rated[i]->favored = 1; afl->top_rated[i]->favored = 1;
++afl->queued_favored; ++afl->queued_favored;
if (!afl->top_rated[i]->was_fuzzed) { ++afl->pending_favored; } if (!afl->top_rated[i]->was_fuzzed) {
++afl->pending_favored;
}
} }