ctx and ngram fix
MODIFY
llvm_mode/afl-llvm-pass.so.cc
llvm_mode/afl-llvm-pass.so.cc
@@ -294,18 +294,21 @@ bool AFLCoverage::runOnModule(Module &M) {
if (!isInWhitelist(&F)) continue;
- if (ctx_str && F.size() > 1) { // Context sensitive coverage
+ for (auto &BB : F) {
+
+ BasicBlock::iterator IP = BB.getFirstInsertionPt();
+ IRBuilder<> IRB(&(*IP));
+
+ // Context sensitive coverage
+ if (ctx_str && &BB == &F.getEntryBlock() && F.size() > 1) {
+
// load the context ID of the previous function and write to to a local
// variable on the stack
- auto bb = &F.getEntryBlock();
- BasicBlock::iterator IP = bb->getFirstInsertionPt();
- IRBuilder<> IRB(&(*IP));
PrevCtx = IRB.CreateLoad(AFLContext);
PrevCtx->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
// does the function have calls? and is any of the calls larger than one
// basic block?
- has_calls = 0;
for (auto &BB : F) {
if (has_calls) break;
@@ -342,27 +345,6 @@ bool AFLCoverage::runOnModule(Module &M) {
}
- for (auto &BB : F) {
-
- BasicBlock::iterator IP = BB.getFirstInsertionPt();
- IRBuilder<> IRB(&(*IP));
-
- // in CTX mode we have to restore the original context for the caller -
- // she might be calling other functions which need the correct CTX
- if (ctx_str && has_calls) {
-
- Instruction *Inst = BB.getTerminator();
- if (isa<ReturnInst>(Inst) || isa<ResumeInst>(Inst)) {
-
- IRBuilder<> Post_IRB(Inst);
- StoreInst * RestoreCtx = Post_IRB.CreateStore(PrevCtx, AFLContext);
- RestoreCtx->setMetadata(M.getMDKindID("nosanitize"),
- MDNode::get(C, None));
-
- }
-
- }
-
if (AFL_R(100) >= inst_ratio) continue;
/* Make up cur_loc */
@@ -407,7 +389,28 @@ bool AFLCoverage::runOnModule(Module &M) {
}
// fprintf(stderr, " == %d\n", more_than_one);
- if (more_than_one != 1) continue;
+ if (more_than_one != 1) {
+
+ // in CTX mode we have to restore the original context for the caller -
+ // she might be calling other functions which need the correct CTX
+ if (ctx_str && has_calls && F.size() > 1) {
+
+ Instruction *Inst = BB.getTerminator();
+ if (isa<ReturnInst>(Inst) || isa<ResumeInst>(Inst)) {
+
+ IRBuilder<> Post_IRB(Inst);
+ StoreInst * RestoreCtx = Post_IRB.CreateStore(PrevCtx, AFLContext);
+ RestoreCtx->setMetadata(M.getMDKindID("nosanitize"),
+ MDNode::get(C, None));
+
+ }
+
+ }
+
+ continue;
+
+ }
+
#endif
ConstantInt *CurLoc;
@@ -431,15 +434,17 @@ bool AFLCoverage::runOnModule(Module &M) {
prev_block_trans = (block_trans_1 ^ ... ^ block_trans_(n-1)" */
if (ngram_size)
- PrevLocTrans = IRB.CreateXorReduce(PrevLoc);
+ PrevLocTrans =
+ IRB.CreateZExt(IRB.CreateXorReduce(PrevLoc), IRB.getInt32Ty());
else
#endif
PrevLocTrans = PrevLoc;
+
if (ctx_str)
PrevLocTrans =
IRB.CreateZExt(IRB.CreateXor(PrevLocTrans, PrevCtx), Int32Ty);
else
- PrevLocTrans = IRB.CreateZExt(PrevLoc, IRB.getInt32Ty());
+ PrevLocTrans = IRB.CreateZExt(PrevLocTrans, IRB.getInt32Ty());
/* Load SHM pointer */
@@ -518,6 +523,23 @@ bool AFLCoverage::runOnModule(Module &M) {
}
+ // in CTX mode we have to restore the original context for the caller -
+ // she might be calling other functions which need the correct CTX.
+ // Currently this is only needed for the Ubuntu clang-6.0 bug
+ if (ctx_str && has_calls && F.size() > 1) {
+
+ Instruction *Inst = BB.getTerminator();
+ if (isa<ReturnInst>(Inst) || isa<ResumeInst>(Inst)) {
+
+ IRBuilder<> Post_IRB(Inst);
+ StoreInst * RestoreCtx = Post_IRB.CreateStore(PrevCtx, AFLContext);
+ RestoreCtx->setMetadata(M.getMDKindID("nosanitize"),
+ MDNode::get(C, None));
+
+ }
+
+ }
+
inst_blocks++;
}

ctx and ngram fix