diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 806aecf9..d8ccb20d 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -721,7 +721,7 @@ typedef struct afl_state { struct queue_entry **top_rated; /* Top entries for bitmap bytes */ - u32 **top_rated_candidates; /* Candidate IDs per bitmap index */ + u32 **top_rated_candidates; /* Candidate IDs per bitmap index */ struct extra_data *extras; /* Extra tokens to fuzz with */ u32 extras_cnt; /* Total number of tokens read */ @@ -864,7 +864,7 @@ typedef struct afl_state { struct skipdet_global *skipdet_g; - s64 last_scored_idx; /* Index of the last queue entry re-scored */ + s64 last_scored_idx; /* Index of the last queue entry re-scored */ #ifdef INTROSPECTION char mutation[8072]; diff --git a/include/android-ashmem.h b/include/android-ashmem.h index ce1558f8..8155d35c 100644 --- a/include/android-ashmem.h +++ b/include/android-ashmem.h @@ -30,8 +30,8 @@ int shmctl(int __shmid, int __cmd, struct shmid_ds *__buf) { int ret = 0; if (__cmd == IPC_RMID) { - int length = ioctl(__shmid, ASHMEM_GET_SIZE, NULL); - unsigned int safe_length = length >= 0 ? length : 0; + int length = ioctl(__shmid, ASHMEM_GET_SIZE, NULL); + unsigned int safe_length = length >= 0 ? length : 0; struct ashmem_pin pin = {0, safe_length}; ret = ioctl(__shmid, ASHMEM_UNPIN, &pin); close(__shmid); diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c index 74d35fe5..48c7c454 100644 --- a/src/afl-fuzz-queue.c +++ b/src/afl-fuzz-queue.c @@ -1015,32 +1015,37 @@ void recalculate_all_scores(afl_state_t *afl) { for (j = 0; j < afl->fsrv.map_size; ++j) { - if (afl->fsrv.trace_bits[j]) { + if (afl->fsrv.trace_bits[j]) { u32 *candidate_ids = afl->top_rated_candidates[j]; - u32 id = afl->queue_buf[i]->id; - + u32 id = afl->queue_buf[i]->id; + if (!candidate_ids) { + // first candidate: [count][id] candidate_ids = ck_alloc(sizeof(u32) * 2); - candidate_ids[0] = 1; // count = 1 - candidate_ids[1] = id; // first ID + candidate_ids[0] = 1; // count = 1 + candidate_ids[1] = id; // first ID + } else { + u32 count = candidate_ids[0]; - - candidate_ids = ck_realloc(candidate_ids, sizeof(u32) * (count + 2)); - candidate_ids[0] = count + 1; // increment the count - candidate_ids[count + 1] = id; // append the new ID to the end - - //fprintf(stderr, "enroll candidate[%u][%u] %u\n", i, j, id); + + candidate_ids = + ck_realloc(candidate_ids, sizeof(u32) * (count + 2)); + candidate_ids[0] = count + 1; // increment the count + candidate_ids[count + 1] = id; // append the new ID to the end + + // fprintf(stderr, "enroll candidate[%u][%u] %u\n", i, j, id); + } - + afl->top_rated_candidates[j] = candidate_ids; } + } - - + } afl->last_scored_idx = i; @@ -1050,17 +1055,20 @@ void recalculate_all_scores(afl_state_t *afl) { for (i = 0; i < afl->fsrv.map_size; ++i) { u32 *candidate_ids = afl->top_rated_candidates[i]; - if(candidate_ids) { + if (candidate_ids) { + u32 count = candidate_ids[0]; - for(u32 k = 0; k < count; k++) { - u32 id = candidate_ids[k + 1]; + for (u32 k = 0; k < count; k++) { + + u32 id = candidate_ids[k + 1]; struct queue_entry *entry = afl->queue_buf[id]; update_bitmap_rescore(afl, entry, i); + } - + } - + } } diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c index 83d92080..2415b0b4 100644 --- a/src/afl-fuzz-state.c +++ b/src/afl-fuzz-state.c @@ -107,7 +107,7 @@ void afl_state_init(afl_state_t *afl, uint32_t map_size) { afl->q_testcase_max_cache_size = TESTCASE_CACHE_SIZE * 1048576UL; afl->q_testcase_max_cache_entries = 64 * 1024; afl->last_scored_idx = -1; - + #ifdef HAVE_AFFINITY afl->cpu_aff = -1; /* Selected CPU core */ #endif /* HAVE_AFFINITY */ @@ -744,7 +744,9 @@ void afl_state_deinit(afl_state_t *afl) { for (u32 i = 0; i < afl->fsrv.map_size; i++) { if (afl->top_rated_candidates[i]) { + ck_free(afl->top_rated_candidates[i]); + } } diff --git a/utils/qbdi_mode/template.cpp b/utils/qbdi_mode/template.cpp index 2f66b3df..903a1ea1 100755 --- a/utils/qbdi_mode/template.cpp +++ b/utils/qbdi_mode/template.cpp @@ -80,7 +80,7 @@ static void afl_forkserver() { while (1) { - int status; + int status; unsigned int was_killed; // wait for afl-fuzz if (read(FORKSRV_FD, &was_killed, 4) != 4) exit(2);