fixed bugs in custom_describe, reported by wizche
MODIFY
include/afl-fuzz.h
include/afl-fuzz.h
@@ -1023,7 +1023,7 @@ void classify_counts(afl_forkserver_t *);
void init_count_class16(void);
void minimize_bits(afl_state_t *, u8 *, u8 *);
#ifndef SIMPLE_FILES
-u8 *describe_op(afl_state_t *, u8);
+u8 *describe_op(afl_state_t *, u8, size_t);
#endif
u8 save_if_interesting(afl_state_t *, void *, u32, u8);
u8 has_new_bits(afl_state_t *, u8 *);

MODIFY
src/afl-fuzz-bitmap.c
src/afl-fuzz-bitmap.c
@@ -425,8 +425,10 @@ void minimize_bits(afl_state_t *afl, u8 *dst, u8 *src) {
/* Construct a file name for a new test case, capturing the operation
that led to its discovery. Returns a ptr to afl->describe_op_buf_256. */
-u8 *describe_op(afl_state_t *afl, u8 new_bits) {
+u8 *describe_op(afl_state_t *afl, u8 new_bits, size_t max_description_len) {
+ size_t real_max_len =
+ MIN(max_description_len, sizeof(afl->describe_op_buf_256));
u8 *ret = afl->describe_op_buf_256;
if (unlikely(afl->syncing_party)) {
@@ -453,10 +455,9 @@ u8 *describe_op(afl_state_t *afl, u8 new_bits) {
size_t len_current = strlen(ret);
ret[len_current++] = ',';
- ret[len_current++] = '\0';
+ ret[len_current] = '\0';
- size_t size_left =
- sizeof(afl->describe_op_buf_256) - len_current - strlen(",+cov") - 2;
+ size_t size_left = real_max_len - len_current - strlen(",+cov") - 2;
assert(size_left > 0);
const char *custom_description =
@@ -504,6 +505,8 @@ u8 *describe_op(afl_state_t *afl, u8 new_bits) {
if (new_bits == 2) { strcat(ret, ",+cov"); }
+ assert(strlen(ret) <= max_description_len);
+
return ret;
}
@@ -610,8 +613,9 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
#ifndef SIMPLE_FILES
- queue_fn = alloc_printf("%s/queue/id:%06u,%s", afl->out_dir,
- afl->queued_paths, describe_op(afl, new_bits));
+ queue_fn = alloc_printf(
+ "%s/queue/id:%06u,%s", afl->out_dir, afl->queued_paths,
+ describe_op(afl, new_bits, NAME_MAX - strlen("id:000000,")));
#else
@@ -777,7 +781,8 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
#ifndef SIMPLE_FILES
snprintf(fn, PATH_MAX, "%s/hangs/id:%06llu,%s", afl->out_dir,
- afl->unique_hangs, describe_op(afl, 0));
+ afl->unique_hangs,
+ describe_op(afl, 0, NAME_MAX - strlen("id:000000,")));
#else
@@ -822,7 +827,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
snprintf(fn, PATH_MAX, "%s/crashes/id:%06llu,sig:%02u,%s", afl->out_dir,
afl->unique_crashes, afl->fsrv.last_kill_signal,
- describe_op(afl, 0));
+ describe_op(afl, 0, NAME_MAX - strlen("id:000000,sig:00,")));
#else

MODIFY
src/afl-fuzz-run.c
src/afl-fuzz-run.c
@@ -79,7 +79,8 @@ write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
s32 doc_fd;
char fn[PATH_MAX];
snprintf(fn, PATH_MAX, "%s/mutations/%09u:%s", afl->out_dir,
- afl->document_counter++, describe_op(afl, 0));
+ afl->document_counter++,
+ describe_op(afl, 0, NAME_MAX - strlen("000000000:")));
if ((doc_fd = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600)) >= 0) {

fixed bugs in custom_describe, reported by wizche