fix crash in AFL_LLVM_LAF_TRANSFORM_COMPARES
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -21,6 +21,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
fuzzing speed
- fixes to LTO mode if instrumented edges > MAP_SIZE
- CTX and NGRAM can now be used together
+ - AFL_LLVM_LAF_TRANSFORM_COMPARES would sometimes crash, fixed
- added AFL_LLVM_SKIP_NEVERZERO to skip the never zero coverage counter
implmentation. For targets with little or no loops or heavy called
functions. Gives a small performance boost.

MODIFY
llvm_mode/afl-llvm-rt.o.c
llvm_mode/afl-llvm-rt.o.c
@@ -67,22 +67,19 @@ u8 __afl_area_initial[MAP_SIZE];
u8 *__afl_area_ptr = __afl_area_initial;
u8 *__afl_dictionary;
+u32 __afl_final_loc;
+u32 __afl_map_size = MAP_SIZE;
+u32 __afl_dictionary_len;
+u64 __afl_map_addr;
+
#ifdef __ANDROID__
PREV_LOC_T __afl_prev_loc[NGRAM_SIZE_MAX];
-u32 __afl_final_loc;
u32 __afl_prev_ctx;
u32 __afl_cmp_counter;
-u32 __afl_dictionary_len;
-u32 __afl_map_size = MAP_SIZE;
-u64 __afl_map_addr;
#else
__thread PREV_LOC_T __afl_prev_loc[NGRAM_SIZE_MAX];
-__thread u32 __afl_final_loc;
__thread u32 __afl_prev_ctx;
__thread u32 __afl_cmp_counter;
-__thread u32 __afl_dictionary_len;
-__thread u32 __afl_map_size = MAP_SIZE;
-__thread u64 __afl_map_addr;
#endif
struct cmp_map *__afl_cmp_map;
@@ -152,7 +149,7 @@ static void __afl_map_shm(void) {
if (getenv("AFL_DEBUG"))
fprintf(stderr,
- "DEBUG: id_str %s, __afl_map_addr 0x%lx, MAP_SIZE %u, "
+ "DEBUG: id_str %s, __afl_map_addr 0x%llx, MAP_SIZE %u, "
"__afl_final_loc %u, max_size_forkserver %u/0x%x\n",
id_str == NULL ? "<null>" : id_str, __afl_map_addr, MAP_SIZE,
__afl_final_loc, FS_OPT_MAX_MAPSIZE, FS_OPT_MAX_MAPSIZE);

MODIFY
llvm_mode/compare-transform-pass.so.cc
llvm_mode/compare-transform-pass.so.cc
@@ -386,13 +386,13 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
TmpConstStr = Str1.str();
VarStr = Str2P;
- constLen = isMemcmp ? sizedLen : GetStringLength(Str1P);
+ constLen = isMemcmp ? sizedLen : TmpConstStr.length();
} else {
TmpConstStr = Str2.str();
VarStr = Str1P;
- constLen = isMemcmp ? sizedLen : GetStringLength(Str2P);
+ constLen = isMemcmp ? sizedLen : TmpConstStr.length();
}
@@ -401,8 +401,12 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
* runtime bounds checking, which makes debugging easier) */
TmpConstStr.append("\0", 1);
ConstStr = StringRef(TmpConstStr);
-
- if (isSizedcmp && constLen > sizedLen) { constLen = sizedLen; }
+ // fprintf(stderr, "issized: %d, const > sized ? %u > %u\n", isSizedcmp,
+ // constLen, sizedLen);
+ if (isSizedcmp && constLen > sizedLen && sizedLen) constLen = sizedLen;
+ if (constLen > TmpConstStr.length()) constLen = TmpConstStr.length();
+ if (!constLen) constLen = TmpConstStr.length();
+ if (!constLen) continue;
if (!be_quiet)
errs() << callInst->getCalledFunction()->getName() << ": len " << constLen

MODIFY
test/test.sh
test/test.sh
@@ -81,7 +81,7 @@ test `uname -s` = 'Darwin' -o `uname -s` = 'FreeBSD' && {
} || {
AFL_GCC=afl-gcc
}
-command -v gcc || AFL_GCC=afl-clang
+command -v gcc >/dev/null 2>&1 || AFL_GCC=afl-clang
SYS=`uname -m`

fix crash in AFL_LLVM_LAF_TRANSFORM_COMPARES