wipe overflow data
MODIFY
include/cmplog.h
include/cmplog.h
@@ -48,7 +48,8 @@ struct cmp_header {
unsigned shape : 5;
unsigned type : 2;
unsigned attribute : 4;
- unsigned reserved : 5;
+ unsigned overflow : 1;
+ unsigned reserved : 4;
} __attribute__((packed));

MODIFY
instrumentation/afl-compiler-rt.o.c
instrumentation/afl-compiler-rt.o.c
@@ -1935,9 +1935,12 @@ void __cmplog_rtn_hook_n(u8 *ptr1, u8 *ptr2, u64 len) {
struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k];
hits &= CMP_MAP_RTN_H - 1;
- if (unlikely(reset && !hits)) {
- __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands));
+ if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; }
+
+ if (unlikely(__afl_cmp_map->headers[k].overflow)) {
+
+ __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands));
}
@@ -1988,9 +1991,12 @@ void __cmplog_rtn_hook_strn(u8 *ptr1, u8 *ptr2, u64 len) {
struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k];
hits &= CMP_MAP_RTN_H - 1;
- if (unlikely(reset && !hits)) {
- __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands));
+ if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; }
+
+ if (unlikely(__afl_cmp_map->headers[k].overflow)) {
+
+ __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands));
}
@@ -2043,9 +2049,12 @@ void __cmplog_rtn_hook_str(u8 *ptr1, u8 *ptr2) {
struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k];
hits &= CMP_MAP_RTN_H - 1;
- if (unlikely(reset && !hits)) {
- __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands));
+ if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; }
+
+ if (unlikely(__afl_cmp_map->headers[k].overflow)) {
+
+ __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands));
}
@@ -2106,9 +2115,12 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k];
hits &= CMP_MAP_RTN_H - 1;
- if (unlikely(reset && !hits)) {
- __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands));
+ if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; }
+
+ if (unlikely(__afl_cmp_map->headers[k].overflow)) {
+
+ __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands));
}

wipe overflow data