ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-18 04:38:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

nits

Browse Source
This commit is contained in:
vanhauser-thc
2023-01-16 10:18:08 +01:00
parent 10b82c7277
commit 8cc1c6c54e
2 changed files with 42 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
src/afl-fuzz-one.c
View File

@ -584,7 +584,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
if it has gone through deterministic testing in earlier, resumed runs if it has gone through deterministic testing in earlier, resumed runs
(passed_det). */ (passed_det). */
if (likely(afl->queue_cur->passed_det) || likely(afl->skip_deterministic) || if (likely(afl->skip_deterministic) || likely(afl->queue_cur->passed_det) ||
likely(perf_score < likely(perf_score <
(afl->queue_cur->depth * 30 <= afl->havoc_max_mult * 100 (afl->queue_cur->depth * 30 <= afl->havoc_max_mult * 100
? afl->queue_cur->depth * 30 ? afl->queue_cur->depth * 30
@ -1908,9 +1908,10 @@ custom_mutator_stage:
afl->stage_name = "custom mutator"; afl->stage_name = "custom mutator";
afl->stage_short = "custom"; afl->stage_short = "custom";
afl->stage_max = HAVOC_CYCLES * perf_score / afl->havoc_div / 100;
afl->stage_val_type = STAGE_VAL_NONE; afl->stage_val_type = STAGE_VAL_NONE;
bool has_custom_fuzz = false; bool has_custom_fuzz = false;
u32 shift = unlikely(afl->custom_only) ? 7 : 8;
afl->stage_max = (HAVOC_CYCLES * perf_score / afl->havoc_div) >> shift;
if (afl->stage_max < HAVOC_MIN) { afl->stage_max = HAVOC_MIN; } if (afl->stage_max < HAVOC_MIN) { afl->stage_max = HAVOC_MIN; }
@ -2063,8 +2064,9 @@ havoc_stage:
afl->stage_name = "havoc"; afl->stage_name = "havoc";
afl->stage_short = "havoc"; afl->stage_short = "havoc";
afl->stage_max = (doing_det ? HAVOC_CYCLES_INIT : HAVOC_CYCLES) * afl->stage_max = ((doing_det ? HAVOC_CYCLES_INIT : HAVOC_CYCLES) *
perf_score / afl->havoc_div / 100; perf_score / afl->havoc_div) >>
7;
} else { } else {
@ -2073,7 +2075,7 @@ havoc_stage:
snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "splice %u", splice_cycle); snprintf(afl->stage_name_buf, STAGE_BUF_SIZE, "splice %u", splice_cycle);
afl->stage_name = afl->stage_name_buf; afl->stage_name = afl->stage_name_buf;
afl->stage_short = "splice"; afl->stage_short = "splice";
afl->stage_max = SPLICE_HAVOC * perf_score / afl->havoc_div / 100; afl->stage_max = (SPLICE_HAVOC * perf_score / afl->havoc_div) >> 7;
} }
@ -4621,8 +4623,9 @@ pacemaker_fuzzing:
afl->stage_name = MOpt_globals.havoc_stagename; afl->stage_name = MOpt_globals.havoc_stagename;
afl->stage_short = MOpt_globals.havoc_stagenameshort; afl->stage_short = MOpt_globals.havoc_stagenameshort;
afl->stage_max = (doing_det ? HAVOC_CYCLES_INIT : HAVOC_CYCLES) * afl->stage_max = ((doing_det ? HAVOC_CYCLES_INIT : HAVOC_CYCLES) *
perf_score / afl->havoc_div / 100; perf_score / afl->havoc_div) >>
7;
} else { } else {
@ -4632,7 +4635,7 @@ pacemaker_fuzzing:
MOpt_globals.splice_stageformat, splice_cycle); MOpt_globals.splice_stageformat, splice_cycle);
afl->stage_name = afl->stage_name_buf; afl->stage_name = afl->stage_name_buf;
afl->stage_short = MOpt_globals.splice_stagenameshort; afl->stage_short = MOpt_globals.splice_stagenameshort;
afl->stage_max = SPLICE_HAVOC * perf_score / afl->havoc_div / 100; afl->stage_max = (SPLICE_HAVOC * perf_score / afl->havoc_div) >> 7;
} }
@ -5792,10 +5795,8 @@ void pso_updating(afl_state_t *afl) {
} }
/* larger change for MOpt implementation: the original fuzz_one was renamed /* The entry point for the mutator, choosing the default mutator, and/or MOpt
to fuzz_one_original. All documentation references to fuzz_one therefore depending on the configuration. */
mean fuzz_one_original */
u8 fuzz_one(afl_state_t *afl) { u8 fuzz_one(afl_state_t *afl) {
int key_val_lv_1 = 0, key_val_lv_2 = 0; int key_val_lv_1 = 0, key_val_lv_2 = 0;
@ -5818,7 +5819,12 @@ u8 fuzz_one(afl_state_t *afl) {
#endif #endif
// if limit_time_sig == -1 then both are run after each other /*
-L command line paramter => limit_time_sig value
limit_time_sig == 0 then run the default mutator
limit_time_sig > 0 then run MOpt
limit_time_sig < 0 both are run
*/
if (afl->limit_time_sig <= 0) { key_val_lv_1 = fuzz_one_original(afl); } if (afl->limit_time_sig <= 0) { key_val_lv_1 = fuzz_one_original(afl); }

23
src/afl-fuzz.c
View File

@ -1580,6 +1580,29 @@ int main(int argc, char **argv_orig, char **envp) {
} }
if (afl->limit_time_sig > 0 && afl->custom_mutators_count) {
if (afl->custom_only) {
FATAL("Custom mutators are incompatible with MOpt (-L)");
}
u32 custom_fuzz = 0;
LIST_FOREACH(&afl->custom_mutator_list, struct custom_mutator, {
if (el->afl_custom_fuzz) { custom_fuzz = 1; }
});
if (custom_fuzz) {
WARNF("afl_custom_fuzz is incompatible with MOpt (-L)");
}
}
if (afl->afl_env.afl_max_det_extras) { if (afl->afl_env.afl_max_det_extras) {
s32 max_det_extras = atoi(afl->afl_env.afl_max_det_extras); s32 max_det_extras = atoi(afl->afl_env.afl_max_det_extras);