larger map, stats reload fix, code format
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -26,6 +26,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
`-i` or resumes (as these have most likely already been done)
- fix crash for very, very fast targets+systems (thanks to mhlakhani
for reporting)
+ - on restarts (-i)/autoresume (AFL_AUTORESUME) the stats are now
+ reloaded and used, thanks to Vimal Joseph for this PR!
- if determinstic mode is active (-D, or -M without -d) then we sync
after every queue entry as this can take very long time otherwise
- better detection if a target needs a large shared map

MODIFY
instrumentation/afl-compiler-rt.o.c
instrumentation/afl-compiler-rt.o.c
run. It will end up as .comm, so it shouldn't be too wasteful. */
#if MAP_SIZE <= 65536
- #define MAP_INITIAL_SIZE 1048576
+ #define MAP_INITIAL_SIZE 2097152
#else
#define MAP_INITIAL_SIZE MAP_SIZE
#endif

MODIFY
instrumentation/afl-llvm-lto-instrumentation.so.cc
instrumentation/afl-llvm-lto-instrumentation.so.cc
@@ -69,7 +69,8 @@ class AFLLTOPass : public ModulePass {
if (getenv("AFL_DEBUG")) debug = 1;
if ((ptr = getenv("AFL_LLVM_LTO_STARTID")) != NULL)
- if ((afl_global_id = (uint32_t)atoi(ptr)) < 0 || afl_global_id >= MAP_SIZE)
+ if ((afl_global_id = (uint32_t)atoi(ptr)) < 0 ||
+ afl_global_id >= MAP_SIZE)
FATAL("AFL_LLVM_LTO_STARTID value of \"%s\" is not between 0 and %u\n",
ptr, MAP_SIZE - 1);

MODIFY
qemu_mode/libqasan/dlmalloc.c
qemu_mode/libqasan/dlmalloc.c
@@ -3907,6 +3907,7 @@ static void internal_malloc_stats(mstate m) {
clear_smallmap(M, I); \
\
} else if (RTCHECK(B == smallbin_at(M, I) || \
+ \
(ok_address(M, B) && B->fd == P))) { \
\
F->bk = B; \
@@ -4117,6 +4118,7 @@ static void internal_malloc_stats(mstate m) {
XP->child[1] = R; \
\
} else \
+ \
CORRUPTION_ERROR_ACTION(M); \
if (R != 0) { \
\
@@ -4132,6 +4134,7 @@ static void internal_malloc_stats(mstate m) {
C0->parent = R; \
\
} else \
+ \
CORRUPTION_ERROR_ACTION(M); \
\
} \
@@ -4143,11 +4146,13 @@ static void internal_malloc_stats(mstate m) {
C1->parent = R; \
\
} else \
+ \
CORRUPTION_ERROR_ACTION(M); \
\
} \
\
} else \
+ \
CORRUPTION_ERROR_ACTION(M); \
\
} \

MODIFY
src/afl-fuzz-bitmap.c
src/afl-fuzz-bitmap.c
@@ -325,7 +325,8 @@ u8 *describe_op(afl_state_t *afl, u8 new_bits, size_t max_description_len) {
}
- sprintf(ret + strlen(ret), ",time:%llu", get_cur_time() - afl->start_time);
+ sprintf(ret + strlen(ret), ",time:%llu",
+ get_cur_time() + afl->prev_run_time - afl->start_time);
if (afl->current_custom_fuzz &&
afl->current_custom_fuzz->afl_custom_describe) {

MODIFY
src/afl-fuzz-statsd.c
src/afl-fuzz-statsd.c
+/*
+ * This implements rpc.statsd support, see docs/rpc_statsd.md
+ *
+ */
+
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
@@ -226,37 +231,39 @@ int statsd_format_metric(afl_state_t *afl, char *buff, size_t bufflen) {
*/
if (afl->statsd_metric_format_type == STATSD_TAGS_TYPE_SUFFIX) {
- snprintf(buff, bufflen, afl->statsd_metric_format,
+ snprintf(
+ buff, bufflen, afl->statsd_metric_format,
afl->queue_cycle ? (afl->queue_cycle - 1) : 0, tags,
afl->cycles_wo_finds, tags, afl->fsrv.total_execs, tags,
afl->fsrv.total_execs /
- ((double)(get_cur_time() - afl->start_time) / 1000),
+ ((double)(get_cur_time() + afl->prev_run_time - afl->start_time) /
+ 1000),
tags, afl->queued_paths, tags, afl->queued_favored, tags,
afl->queued_discovered, tags, afl->queued_imported, tags,
- afl->max_depth, tags, afl->current_entry, tags,
- afl->pending_favored, tags, afl->pending_not_fuzzed, tags,
- afl->queued_variable, tags, afl->unique_crashes, tags,
- afl->unique_hangs, tags, afl->total_crashes, tags,
- afl->slowest_exec_ms, tags,
- count_non_255_bytes(afl, afl->virgin_bits), tags,
- afl->var_byte_count, tags, afl->expand_havoc, tags);
+ afl->max_depth, tags, afl->current_entry, tags, afl->pending_favored,
+ tags, afl->pending_not_fuzzed, tags, afl->queued_variable, tags,
+ afl->unique_crashes, tags, afl->unique_hangs, tags, afl->total_crashes,
+ tags, afl->slowest_exec_ms, tags,
+ count_non_255_bytes(afl, afl->virgin_bits), tags, afl->var_byte_count,
+ tags, afl->expand_havoc, tags);
} else if (afl->statsd_metric_format_type == STATSD_TAGS_TYPE_MID) {
- snprintf(buff, bufflen, afl->statsd_metric_format, tags,
+ snprintf(
+ buff, bufflen, afl->statsd_metric_format, tags,
afl->queue_cycle ? (afl->queue_cycle - 1) : 0, tags,
afl->cycles_wo_finds, tags, afl->fsrv.total_execs, tags,
afl->fsrv.total_execs /
- ((double)(get_cur_time() - afl->start_time) / 1000),
+ ((double)(get_cur_time() + afl->prev_run_time - afl->start_time) /
+ 1000),
tags, afl->queued_paths, tags, afl->queued_favored, tags,
afl->queued_discovered, tags, afl->queued_imported, tags,
- afl->max_depth, tags, afl->current_entry, tags,
- afl->pending_favored, tags, afl->pending_not_fuzzed, tags,
- afl->queued_variable, tags, afl->unique_crashes, tags,
- afl->unique_hangs, tags, afl->total_crashes, tags,
- afl->slowest_exec_ms, tags,
- count_non_255_bytes(afl, afl->virgin_bits), tags,
- afl->var_byte_count, tags, afl->expand_havoc);
+ afl->max_depth, tags, afl->current_entry, tags, afl->pending_favored,
+ tags, afl->pending_not_fuzzed, tags, afl->queued_variable, tags,
+ afl->unique_crashes, tags, afl->unique_hangs, tags, afl->total_crashes,
+ tags, afl->slowest_exec_ms, tags,
+ count_non_255_bytes(afl, afl->virgin_bits), tags, afl->var_byte_count,
+ tags, afl->expand_havoc);
}

larger map, stats reload fix, code format