ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-15 11:28:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

improve redqueen not looking in orig buf

Browse Source
This commit is contained in:
Andrea Fioraldi
2020-02-21 20:05:43 +01:00
parent 00c1c26bf8
commit de4f88b4cb
3 changed files with 13 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/afl-fuzz-one.c
View File

@ -531,7 +531,7 @@ u8 fuzz_one_original(char** argv) {
} }
if (cmplog_mode && !queue_cur->fully_colorized) { if (cmplog_mode) {
if (input_to_state_stage(argv, in_buf, out_buf, len, queue_cur->exec_cksum)) if (input_to_state_stage(argv, in_buf, out_buf, len, queue_cur->exec_cksum))
goto abandon_entry; goto abandon_entry;

16
src/afl-fuzz-redqueen.c
View File

@ -233,9 +233,9 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
u32* buf_32 = (u32*)&buf[idx]; u32* buf_32 = (u32*)&buf[idx];
u16* buf_16 = (u16*)&buf[idx]; u16* buf_16 = (u16*)&buf[idx];
// u8* buf_8 = &buf[idx]; // u8* buf_8 = &buf[idx];
u64* o_buf_64 = (u64*)&orig_buf[idx]; // u64* o_buf_64 = (u64*)&orig_buf[idx];
u32* o_buf_32 = (u32*)&orig_buf[idx]; // u32* o_buf_32 = (u32*)&orig_buf[idx];
u16* o_buf_16 = (u16*)&orig_buf[idx]; // u16* o_buf_16 = (u16*)&orig_buf[idx];
// u8* o_buf_8 = &orig_buf[idx]; // u8* o_buf_8 = &orig_buf[idx];
u32 its_len = len - idx; u32 its_len = len - idx;
@ -243,7 +243,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
if (SHAPE_BYTES(h->shape) == 8) { if (SHAPE_BYTES(h->shape) == 8) {
if (its_len >= 8 && *buf_64 == pattern && *o_buf_64 == pattern) { if (its_len >= 8 && *buf_64 == pattern) {// && *o_buf_64 == pattern) {
*buf_64 = repl; *buf_64 = repl;
if (unlikely(its_fuzz(buf, len, status))) return 1; if (unlikely(its_fuzz(buf, len, status))) return 1;
@ -261,7 +261,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
if (SHAPE_BYTES(h->shape) == 4 || *status == 2) { if (SHAPE_BYTES(h->shape) == 4 || *status == 2) {
if (its_len >= 4 && *buf_32 == (u32)pattern && *o_buf_32 == (u32)pattern) { if (its_len >= 4 && *buf_32 == (u32)pattern) {// && *o_buf_32 == (u32)pattern) {
*buf_32 = (u32)repl; *buf_32 = (u32)repl;
if (unlikely(its_fuzz(buf, len, status))) return 1; if (unlikely(its_fuzz(buf, len, status))) return 1;
@ -279,7 +279,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
if (SHAPE_BYTES(h->shape) == 2 || *status == 2) { if (SHAPE_BYTES(h->shape) == 2 || *status == 2) {
if (its_len >= 2 && *buf_16 == (u16)pattern && *o_buf_16 == (u16)pattern) { if (its_len >= 2 && *buf_16 == (u16)pattern) {// && *o_buf_16 == (u16)pattern) {
*buf_16 = (u16)repl; *buf_16 = (u16)repl;
if (unlikely(its_fuzz(buf, len, status))) return 1; if (unlikely(its_fuzz(buf, len, status))) return 1;
@ -297,7 +297,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx,
/*if (SHAPE_BYTES(h->shape) == 1 || *status == 2) { /*if (SHAPE_BYTES(h->shape) == 1 || *status == 2) {
if (its_len >= 2 && *buf_8 == (u8)pattern && *o_buf_8 == (u8)pattern) { if (its_len >= 2 && *buf_8 == (u8)pattern) {// && *o_buf_8 == (u8)pattern) {
*buf_8 = (u8)repl; *buf_8 = (u8)repl;
if (unlikely(its_fuzz(buf, len, status))) if (unlikely(its_fuzz(buf, len, status)))
@ -425,7 +425,7 @@ u8 rtn_extend_encoding(struct cmp_header* h, u8* pattern, u8* repl, u32 idx,
for (i = 0; i < its_len; ++i) { for (i = 0; i < its_len; ++i) {
if (pattern[idx + i] != orig_buf[idx + i] || *status == 1) break; if (pattern[idx + i] != buf[idx + i] || *status == 1) break;
buf[idx + i] = repl[idx + i]; buf[idx + i] = repl[idx + i];
if (unlikely(its_fuzz(buf, len, status))) return 1; if (unlikely(its_fuzz(buf, len, status))) return 1;

4
test/test-compcov.c
View File

@ -22,7 +22,9 @@ int main(int argc, char** argv) {
strcat(buf, input); strcat(buf, input);
printf("This will only crash with libdislocator: %s\n", buf); printf("This will only crash with libdislocator: %s\n", buf);
return 0; return 0;
} else } else if (*(unsigned int*)input == 0xabadcafe)
printf("GG you eat cmp tokens for breakfast!\n");
else
printf("I do not know your string\n"); printf("I do not know your string\n");
return 0; return 0;