less executions on variable paths
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -35,6 +35,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
afl++ ignores these and uses them for splicing instead.
- added AFL_EXIT_ON_TIME env that will make afl-fuzz exit fuzzing after
no new paths have been found for n seconds
+ - when AFL_FAST_CAL is set a variable path will no be calibrated 8 times
+ instead of 40
- afl-cc:
- We do not support llvm versions prior 6.0 anymore
- Fix for -pie compiled binaries with default afl-clang-fast PCGUARD

MODIFY
include/config.h
include/config.h
cases that show variable behavior): */
#define CAL_CYCLES 8U
-#define CAL_CYCLES_LONG 40U
+#define CAL_CYCLES_LONG 20U
/* Number of subsequent timeouts before abandoning an input file: */
/* Maximum number of unique hangs or crashes to record: */
#define KEEP_UNIQUE_HANG 500U
-#define KEEP_UNIQUE_CRASH 5000U
+#define KEEP_UNIQUE_CRASH 10000U
/* Baseline number of random tweaks during a single 'havoc' stage: */

MODIFY
src/afl-fuzz-run.c
src/afl-fuzz-run.c
@@ -410,7 +410,7 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
}
var_detected = 1;
- afl->stage_max = CAL_CYCLES_LONG;
+ afl->stage_max = afl->fast_cal ? CAL_CYCLES : CAL_CYCLES_LONG;
} else {

less executions on variable paths