ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-11 09:41:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix the auto map fix

Browse Source
This commit is contained in:
vanhauser-thc 2021-03-11 08:59:26 +01:00
parent 16e3e2a7f7
commit adeb0d18b1
2 changed files with 84 additions and 63 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

143
src/afl-fuzz.c
View File

@ -1581,46 +1581,58 @@ int main(int argc, char **argv_orig, char **envp) {
afl->fsrv.trace_bits = afl->fsrv.trace_bits =
afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode); afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
if (afl->fsrv.map_size <= 8000000) { if (!afl->non_instrumented_mode && !afl->fsrv.qemu_mode &&
!afl->unicorn_mode) {
afl->fsrv.map_size = 8000000; // dummy temporary value if (map_size <= 8000000&& !afl->non_instrumented_mode &&
setenv("AFL_MAP_SIZE", "8000000", 1); !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
} afl->fsrv.map_size = 8000000; // dummy temporary value
setenv("AFL_MAP_SIZE", "8000000", 1);
u32 new_map_size = afl_fsrv_get_mapsize( }
&afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
// only reinitialize when it makes sense u32 new_map_size = afl_fsrv_get_mapsize(
if (map_size < new_map_size || &afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
(new_map_size > map_size && new_map_size - map_size > MAP_SIZE &&
(!afl->cmplog_binary || new_map_size == MAP_SIZE))) {
OKF("Re-initializing maps to %u bytes", new_map_size); if (new_map_size && new_map_size != map_size) {
afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size); // only reinitialize when it makes sense
afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size); if (map_size < new_map_size ||
afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size); (new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
afl->top_rated = ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
afl->clean_trace_custom = ck_realloc(afl->clean_trace_custom, new_map_size);
afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
afl_fsrv_kill(&afl->fsrv); OKF("Re-initializing maps to %u bytes", new_map_size);
afl_shm_deinit(&afl->shm);
afl->fsrv.map_size = new_map_size;
afl->fsrv.trace_bits =
afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
setenv("AFL_NO_AUTODICT", "1", 1); // loaded already
afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child);
map_size = new_map_size;
} else { afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
afl->top_rated =
ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
afl->clean_trace_custom =
ck_realloc(afl->clean_trace_custom, new_map_size);
afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
afl->fsrv.map_size = map_size; afl_fsrv_kill(&afl->fsrv);
afl_shm_deinit(&afl->shm);
afl->fsrv.map_size = new_map_size;
afl->fsrv.trace_bits =
afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
setenv("AFL_NO_AUTODICT", "1", 1); // loaded already
afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child);
}
map_size = new_map_size;
} else {
afl->fsrv.map_size = map_size;
}
} }
@ -1634,50 +1646,59 @@ int main(int argc, char **argv_orig, char **envp) {
afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary; afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
afl->cmplog_fsrv.init_child_func = cmplog_exec_child; afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
if (map_size <= 8000000 && !afl->non_instrumented_mode &&
!afl->fsrv.qemu_mode && !afl->unicorn_mode) {
afl->fsrv.map_size = 8000000; // dummy temporary value
setenv("AFL_MAP_SIZE", "8000000", 1);
}
u32 new_map_size = u32 new_map_size =
afl_fsrv_get_mapsize(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon, afl_fsrv_get_mapsize(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child); afl->afl_env.afl_debug_child);
// only reinitialize when necessary if (new_map_size && new_map_size != map_size) {
if (map_size < new_map_size ||
(new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
OKF("Re-initializing maps to %u bytes due cmplog", new_map_size); // only reinitialize when it needs to be larger
if (map_size < new_map_size) {
afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size); OKF("Re-initializing maps to %u bytes due cmplog", new_map_size);
afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
afl->top_rated =
ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
afl->clean_trace_custom =
ck_realloc(afl->clean_trace_custom, new_map_size);
afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
afl_fsrv_kill(&afl->fsrv); afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
afl_fsrv_kill(&afl->cmplog_fsrv); afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
afl_shm_deinit(&afl->shm); afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
afl->cmplog_fsrv.map_size = new_map_size; // non-cmplog stays the same afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
afl->top_rated =
ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
afl->clean_trace_custom =
ck_realloc(afl->clean_trace_custom, new_map_size);
afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
afl->fsrv.trace_bits = afl_fsrv_kill(&afl->fsrv);
afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode); afl_fsrv_kill(&afl->cmplog_fsrv);
setenv("AFL_NO_AUTODICT", "1", 1); // loaded already afl_shm_deinit(&afl->shm);
afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon, afl->cmplog_fsrv.map_size = new_map_size; // non-cmplog stays the same
afl->afl_env.afl_debug_child);
afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon, afl->fsrv.trace_bits =
afl->afl_env.afl_debug_child); afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
setenv("AFL_NO_AUTODICT", "1", 1); // loaded already
afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child);
afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child);
}
map_size = new_map_size; map_size = new_map_size;
} else {
afl->cmplog_fsrv.map_size = map_size;
} }
afl->cmplog_fsrv.map_size = map_size;
OKF("Cmplog forkserver successfully started"); OKF("Cmplog forkserver successfully started");
} }

4
test/test-llvm.sh
View File

@ -162,9 +162,9 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && {
test -e test-floatingpoint && { test -e test-floatingpoint && {
mkdir -p in mkdir -p in
echo ZZZZ > in/in echo ZZZZ > in/in
$ECHO "$GREY[*] running afl-fuzz with floating point splitting, this will take max. 45 seconds" $ECHO "$GREY[*] running afl-fuzz with floating point splitting, this will take max. 30 seconds"
{ {
AFL_BENCH_UNTIL_CRASH=1 AFL_NO_UI=1 ../afl-fuzz -Z -s 1 -V45 -m ${MEM_LIMIT} -i in -o out -D -- ./test-floatingpoint >>errors 2>&1 AFL_BENCH_UNTIL_CRASH=1 AFL_NO_UI=1 ../afl-fuzz -Z -s 1 -V30 -m ${MEM_LIMIT} -i in -o out -D -- ./test-floatingpoint >>errors 2>&1
} >>errors 2>&1 } >>errors 2>&1
test -n "$( ls out/default/crashes/id:* 2>/dev/null )" && { test -n "$( ls out/default/crashes/id:* 2>/dev/null )" && {
$ECHO "$GREEN[+] llvm_mode laf-intel floatingpoint splitting feature works correctly" $ECHO "$GREEN[+] llvm_mode laf-intel floatingpoint splitting feature works correctly"