ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-18 12:48:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixed potential double free in custom trim (#881)

Browse Source
This commit is contained in:
Dominik Maier
2021-04-30 13:35:24 +02:00
parent 758bc770a8
commit e9d2f72382
4 changed files with 29 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/afl-fuzz-mutators.c
View File

@ -305,9 +305,13 @@ struct custom_mutator *load_custom_mutator(afl_state_t *afl, const char *fn) {
}
u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
// Custom testcase trimming.
u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 **in_buf_p,
struct custom_mutator *mutator) {
// We need to pass pointers around, as growing testcases may need to realloc.
u8 *in_buf = *in_buf_p;
u8 needs_write = 0, fault = 0;
u32 trim_exec = 0;
u32 orig_len = q->len;
@ -397,15 +401,22 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
if (likely(retlen && cksum == q->exec_cksum)) {
if (afl_realloc((void **)&in_buf, retlen) == NULL) {
// Check if we got a new retbuf and to memcpy our buf.
if (in_buf != retbuf) {
FATAL("can not allocate memory for trim");
if (afl_realloc((void **)in_buf_p, retlen) == NULL) {
FATAL("can not allocate memory for trim");
}
in_buf = *in_buf_p;
memcpy(in_buf, retbuf, retlen);
q->len = retlen;
}
memcpy(in_buf, retbuf, retlen);
q->len = retlen;
/* Let's save a clean trace, which will be needed by
update_bitmap_score once we're done with the trimming stuff. */