ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-09 16:51:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #121 from devnexen/libdislocator_little_upd

Browse Source 
libdislocator updates improvements proposal.
This commit is contained in:
van Hauser 2019-11-30 14:48:16 +01:00 committed by GitHub
commit d4da9b805a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
libdislocator/libdislocator.so.c
View File

@ -30,6 +30,13 @@
#include <mach/vm_statistics.h> #include <mach/vm_statistics.h>
#endif #endif
#ifdef __linux__
#define _GNU_SOURCE
#include <unistd.h>
#include <sys/syscall.h>
#define arc4random_buf(p, l) do { ssize_t rd = syscall(__NR_getrandom, p, l, 0); if (rd != l) DEBUGF("getrandom failed"); } while(0)
#endif
#include "config.h" #include "config.h"
#include "types.h" #include "types.h"
@ -102,6 +109,7 @@ static u8 alloc_verbose, /* Additional debug messages */
static __thread size_t total_mem; /* Currently allocated mem */ static __thread size_t total_mem; /* Currently allocated mem */
static __thread u32 call_depth; /* To avoid recursion via fprintf() */ static __thread u32 call_depth; /* To avoid recursion via fprintf() */
static __thread u32 alloc_canary;
/* This is the main alloc function. It allocates one page more than necessary, /* This is the main alloc function. It allocates one page more than necessary,
sets that tailing page to PROT_NONE, and then increments the return address sets that tailing page to PROT_NONE, and then increments the return address
@ -186,7 +194,7 @@ static void* __dislocator_alloc(size_t len) {
ret += 8; ret += 8;
PTR_L(ret) = len; PTR_L(ret) = len;
PTR_C(ret) = ALLOC_CANARY; PTR_C(ret) = alloc_canary;
total_mem += len; total_mem += len;
@ -262,7 +270,7 @@ void free(void* ptr) {
if (!ptr) return; if (!ptr) return;
if (PTR_C(ptr) != ALLOC_CANARY) FATAL("bad allocator canary on free()"); if (PTR_C(ptr) != alloc_canary) FATAL("bad allocator canary on free()");
len = PTR_L(ptr); len = PTR_L(ptr);
@ -358,11 +366,18 @@ __attribute__((constructor)) void __dislocator_init(void) {
if (tmp) { if (tmp) {
max_mem = atoi((char *)tmp) * 1024 * 1024; u8 *tok;
if (!max_mem) FATAL("Bad value for AFL_LD_LIMIT_MB"); s32 mmem = (s32)strtol((char *)tmp, (char **)&tok, 10);
if (*tok != '\0' || errno == ERANGE) FATAL("Bad value for AFL_LD_LIMIT_MB");
max_mem = mmem * 1024 * 1024;
} }
alloc_canary = ALLOC_CANARY;
tmp = (u8 *)getenv("AFL_RANDOM_ALLOC_CANARY");
if (tmp) arc4random_buf(&alloc_canary, sizeof(alloc_canary));
alloc_verbose = !!getenv("AFL_LD_VERBOSE"); alloc_verbose = !!getenv("AFL_LD_VERBOSE");
hard_fail = !!getenv("AFL_LD_HARD_FAIL"); hard_fail = !!getenv("AFL_LD_HARD_FAIL");
no_calloc_over = !!getenv("AFL_LD_NO_CALLOC_OVER"); no_calloc_over = !!getenv("AFL_LD_NO_CALLOC_OVER");