ensure one fuzzer sync per cycle, cycle introspection
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -18,6 +18,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
to allow replay of non-reproducable crashes, see
AFL_PERSISTENT_RECORD in config.h and docs/envs.h
- default cmplog level (-l) is now 2, better efficiency.
+ - ensure one fuzzer sync per cycle
- afl-cc:
- Removed InsTrim instrumentation as it is not as good as PCGUARD

MODIFY
include/afl-fuzz.h
include/afl-fuzz.h
@@ -572,6 +572,7 @@ typedef struct afl_state {
blocks_eff_select, /* Blocks selected as fuzzable */
start_time, /* Unix start time (ms) */
last_sync_time, /* Time of last sync */
+ last_sync_cycle, /* Cycle no. of the last sync */
last_path_time, /* Time for most recent path (ms) */
last_crash_time, /* Time for most recent crash (ms) */
last_hang_time; /* Time for most recent hang (ms) */

MODIFY
src/afl-fuzz-run.c
src/afl-fuzz-run.c
@@ -712,6 +712,7 @@ void sync_fuzzers(afl_state_t *afl) {
if (afl->foreign_sync_cnt) read_foreign_testcases(afl, 0);
afl->last_sync_time = get_cur_time();
+ afl->last_sync_cycle = afl->queue_cycle;
}

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -1867,6 +1867,14 @@ int main(int argc, char **argv_orig, char **envp) {
runs_in_current_cycle > afl->queued_paths) ||
(afl->old_seed_selection && !afl->queue_cur))) {
+ if (unlikely((afl->last_sync_cycle < afl->queue_cycle ||
+ (!afl->queue_cycle && afl->afl_env.afl_import_first)) &&
+ afl->sync_id)) {
+
+ sync_fuzzers(afl);
+
+ }
+
++afl->queue_cycle;
runs_in_current_cycle = (u32)-1;
afl->cur_skipped_paths = 0;
@@ -1980,6 +1988,13 @@ int main(int argc, char **argv_orig, char **envp) {
}
+ #ifdef INTROSPECTION
+ fprintf(afl->introspection_file,
+ "CYCLE cycle=%llu cycle_wo_finds=%llu expand_havoc=%u queue=%u\n",
+ afl->queue_cycle, afl->cycles_wo_finds, afl->expand_havoc,
+ afl->queued_paths);
+ #endif
+
if (afl->cycle_schedules) {
/* we cannot mix non-AFLfast schedules with others */
@@ -2031,13 +2046,6 @@ int main(int argc, char **argv_orig, char **envp) {
prev_queued = afl->queued_paths;
- if (afl->sync_id && afl->queue_cycle == 1 &&
- afl->afl_env.afl_import_first) {
-
- sync_fuzzers(afl);
-
- }
-
}
++runs_in_current_cycle;

ensure one fuzzer sync per cycle, cycle introspection