ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-15 03:18:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix auto map discovery

Browse Source
This commit is contained in:
vanhauser-thc
2021-03-10 19:22:57 +01:00
parent 2777784f4f
commit a10a627622
2 changed files with 77 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/afl-common.c
View File

@ -1123,7 +1123,7 @@ u8 *u_stringify_time_diff(u8 *buf, u64 cur_ms, u64 event_ms) {
/* Reads the map size from ENV */ /* Reads the map size from ENV */
u32 get_map_size(void) { u32 get_map_size(void) {
uint32_t map_size = (MAP_SIZE << 2); // needed for target ctors :( uint32_t map_size = 8000000; // a very large default map
char * ptr; char * ptr;
if ((ptr = getenv("AFL_MAP_SIZE")) || (ptr = getenv("AFL_MAPSIZE"))) { if ((ptr = getenv("AFL_MAP_SIZE")) || (ptr = getenv("AFL_MAPSIZE"))) {
@ -1131,7 +1131,7 @@ u32 get_map_size(void) {
map_size = atoi(ptr); map_size = atoi(ptr);
if (!map_size || map_size > (1 << 29)) { if (!map_size || map_size > (1 << 29)) {
FATAL("illegal AFL_MAP_SIZE %u, must be between %u and %u", map_size, 32U, FATAL("illegal AFL_MAP_SIZE %u, must be between %u and %u", map_size, 64U,
1U << 29); 1U << 29);
} }

163
src/afl-fuzz.c
View File

@ -351,7 +351,7 @@ int main(int argc, char **argv_orig, char **envp) {
exit_1 = !!afl->afl_env.afl_bench_just_one; exit_1 = !!afl->afl_env.afl_bench_just_one;
SAYF(cCYA "afl-fuzz" VERSION cRST SAYF(cCYA "afl-fuzz" VERSION cRST
" based on afl by Michal Zalewski and a big online community\n"); " based on afl by Michal Zalewski and a large online community\n");
doc_path = access(DOC_PATH, F_OK) != 0 ? (u8 *)"docs" : (u8 *)DOC_PATH; doc_path = access(DOC_PATH, F_OK) != 0 ? (u8 *)"docs" : (u8 *)DOC_PATH;
@ -1562,62 +1562,63 @@ int main(int argc, char **argv_orig, char **envp) {
} }
if (afl->non_instrumented_mode || afl->fsrv.qemu_mode || afl->unicorn_mode) {
map_size = afl->fsrv.map_size = MAP_SIZE;
afl->virgin_bits = ck_realloc(afl->virgin_bits, map_size);
afl->virgin_tmout = ck_realloc(afl->virgin_tmout, map_size);
afl->virgin_crash = ck_realloc(afl->virgin_crash, map_size);
afl->var_bytes = ck_realloc(afl->var_bytes, map_size);
afl->top_rated = ck_realloc(afl->top_rated, map_size * sizeof(void *));
afl->clean_trace = ck_realloc(afl->clean_trace, map_size);
afl->clean_trace_custom = ck_realloc(afl->clean_trace_custom, map_size);
afl->first_trace = ck_realloc(afl->first_trace, map_size);
afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, map_size);
}
afl->argv = use_argv; afl->argv = use_argv;
afl->fsrv.trace_bits = afl->fsrv.trace_bits =
afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode); afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
if (!afl->non_instrumented_mode && !afl->fsrv.qemu_mode && if (afl->fsrv.map_size <= 8000000) {
!afl->unicorn_mode) {
u32 set_env = 0; afl->fsrv.map_size = 8000000; // dummy temporary value
if (!getenv("AFL_MAP_SIZE")) { setenv("AFL_MAP_SIZE", "8000000", 1);
afl->fsrv.map_size = 8000000; // dummy temporary value }
setenv("AFL_MAP_SIZE", "8000000", 1);
set_env = 1;
} u32 new_map_size = afl_fsrv_get_mapsize(
&afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
u32 prev_map_size = afl->fsrv.map_size; // only reinitialize when it makes sense
if (map_size < new_map_size ||
(new_map_size > map_size && new_map_size - map_size > MAP_SIZE &&
(!afl->cmplog_binary || new_map_size == MAP_SIZE))) {
u32 new_map_size = afl_fsrv_get_mapsize( OKF("Re-initializing maps to %u bytes", new_map_size);
&afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
if (new_map_size && new_map_size != prev_map_size) { afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
afl->top_rated = ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
afl->clean_trace_custom = ck_realloc(afl->clean_trace_custom, new_map_size);
afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
// only reinitialize when it makes sense afl_fsrv_kill(&afl->fsrv);
if (map_size < new_map_size || afl_shm_deinit(&afl->shm);
(new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) { afl->fsrv.map_size = new_map_size;
afl->fsrv.trace_bits =
afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
setenv("AFL_NO_AUTODICT", "1", 1); // loaded already
afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child);
map_size = new_map_size;
OKF("Re-initializing maps to %u bytes", new_map_size); } else {
afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
afl->top_rated =
ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
afl->clean_trace_custom =
ck_realloc(afl->clean_trace_custom, new_map_size);
afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
afl_fsrv_kill(&afl->fsrv);
afl_shm_deinit(&afl->shm);
afl->fsrv.map_size = new_map_size;
afl->fsrv.trace_bits =
afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
setenv("AFL_NO_AUTODICT", "1", 1); // loaded already
afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child);
}
map_size = new_map_size;
if (set_env) { unsetenv("AFL_MAP_SIZE"); }
}
afl->fsrv.map_size = map_size; afl->fsrv.map_size = map_size;
@ -1633,64 +1634,50 @@ int main(int argc, char **argv_orig, char **envp) {
afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary; afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
afl->cmplog_fsrv.init_child_func = cmplog_exec_child; afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
u32 set_env = 0;
if (!getenv("AFL_MAP_SIZE")) {
afl->fsrv.map_size = 8000000; // dummy temporary value
setenv("AFL_MAP_SIZE", "8000000", 1);
set_env = 1;
}
u32 prev_map_size = afl->fsrv.map_size;
u32 new_map_size = u32 new_map_size =
afl_fsrv_get_mapsize(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon, afl_fsrv_get_mapsize(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child); afl->afl_env.afl_debug_child);
if (new_map_size && new_map_size != prev_map_size) { // only reinitialize when necessary
if (map_size < new_map_size ||
(new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
// only reinitialize when it needs to be larger OKF("Re-initializing maps to %u bytes due cmplog", new_map_size);
if (map_size < new_map_size) {
OKF("Re-initializing maps to %u bytes due cmplog", new_map_size); afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
afl->top_rated =
ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
afl->clean_trace_custom =
ck_realloc(afl->clean_trace_custom, new_map_size);
afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size); afl_fsrv_kill(&afl->fsrv);
afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size); afl_fsrv_kill(&afl->cmplog_fsrv);
afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size); afl_shm_deinit(&afl->shm);
afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size); afl->cmplog_fsrv.map_size = new_map_size; // non-cmplog stays the same
afl->top_rated =
ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
afl->clean_trace_custom =
ck_realloc(afl->clean_trace_custom, new_map_size);
afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
afl_fsrv_kill(&afl->fsrv); afl->fsrv.trace_bits =
afl_fsrv_kill(&afl->cmplog_fsrv); afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
afl_shm_deinit(&afl->shm); setenv("AFL_NO_AUTODICT", "1", 1); // loaded already
afl->cmplog_fsrv.map_size = new_map_size; // non-cmplog stays the same afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child);
afl->fsrv.trace_bits = afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode); afl->afl_env.afl_debug_child);
setenv("AFL_NO_AUTODICT", "1", 1); // loaded already
afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child);
afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon, map_size = new_map_size;
afl->afl_env.afl_debug_child);
map_size = new_map_size; } else {
} afl->cmplog_fsrv.map_size = map_size;
if (set_env) { unsetenv("AFL_MAP_SIZE"); }
} }
afl->cmplog_fsrv.map_size = map_size;
OKF("Cmplog forkserver successfully started"); OKF("Cmplog forkserver successfully started");
} }