fix lto autodict for long strings
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -37,6 +37,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
for a fixed map address (eg. 0x10000)
- LTO: improved stability for persistent mode, no other instrumentation
has that advantage
+ - LTO: fixed autodict for long strings
- LTO: laf-intel and redqueen/cmplog are now applied at link time
to prevent llvm optimizing away the splits
- LTO: autodictionary mode is a default

MODIFY
llvm_mode/afl-llvm-lto-instrumentation.so.cc
llvm_mode/afl-llvm-lto-instrumentation.so.cc
@@ -298,7 +298,7 @@ bool AFLLTOPass::runOnModule(Module &M) {
bool isStrncasecmp = true;
bool isIntMemcpy = true;
bool addedNull = false;
- uint8_t optLen = 0;
+ size_t optLen = 0;
Function *Callee = callInst->getCalledFunction();
if (!Callee) continue;
@@ -546,17 +546,26 @@ bool AFLLTOPass::runOnModule(Module &M) {
// add null byte if this is a string compare function and a null
// was not already added
- if (addedNull == false && !isMemcmp) {
+ if (!isMemcmp) {
+
+ if (addedNull == false) {
thestring.append("\0", 1); // add null byte
optLen++;
}
+ // ensure we do not have garbage
+ size_t offset = thestring.find('\0', 0);
+ if (offset + 1 < optLen) optLen = offset + 1;
+ thestring = thestring.substr(0, optLen);
+
+ }
+
if (!be_quiet) {
std::string outstring;
- fprintf(stderr, "%s: length %u/%u \"", FuncName.c_str(), optLen,
+ fprintf(stderr, "%s: length %zu/%zu \"", FuncName.c_str(), optLen,
(unsigned int)thestring.length());
for (uint8_t i = 0; i < thestring.length(); i++) {

MODIFY
llvm_mode/afl-llvm-rt.o.c
llvm_mode/afl-llvm-rt.o.c
@@ -329,8 +329,9 @@ static void __afl_map_shm(void) {
__afl_area_ptr[0] = 1;
- } else if (__afl_map_addr &&
- (!__afl_area_ptr || __afl_area_ptr == __afl_area_initial)) {
+ } else if ((!__afl_area_ptr || __afl_area_ptr == __afl_area_initial) &&
+
+ __afl_map_addr) {
__afl_area_ptr =
mmap((void *)__afl_map_addr, __afl_map_size, PROT_READ | PROT_WRITE,

fix lto autodict for long strings