pcguard off-by-one fix
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -17,6 +17,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
- default calibration cycles set to 7 from 8, and only add 5 cycles
to variables queue items instead of 12.
- afl-cc:
+ - fixed off-by-one bug in our pcguard implemenation, thanks for
+ @toka for reporting
- better handling of -fsanitize=..,...,.. lists
- fix gcc_mode cmplog
- obtain the map size of a target with setting AFL_DUMP_MAP_SIZE=1

MODIFY
instrumentation/SanitizerCoveragePCGUARD.so.cc
instrumentation/SanitizerCoveragePCGUARD.so.cc
@@ -851,6 +851,7 @@ bool ModuleSanitizerCoverageAFL::InjectCoverage(
Function &F, ArrayRef<BasicBlock *> AllBlocks, bool IsLeafFunc) {
uint32_t cnt_cov = 0, cnt_sel = 0, cnt_sel_inc = 0;
+ static uint32_t first = 1;
for (auto &BB : F) {
@@ -876,12 +877,14 @@ bool ModuleSanitizerCoverageAFL::InjectCoverage(
}
- if (FuncName.compare(StringRef("__afl_coverage_interesting"))) continue;
+ if (!FuncName.compare(StringRef("__afl_coverage_interesting"))) {
cnt_cov++;
}
+ }
+
SelectInst *selectInst = nullptr;
if ((selectInst = dyn_cast<SelectInst>(&IN))) {
@@ -917,7 +920,8 @@ bool ModuleSanitizerCoverageAFL::InjectCoverage(
}
/* Create PCGUARD array */
- CreateFunctionLocalArrays(F, AllBlocks, cnt_cov + cnt_sel_inc);
+ CreateFunctionLocalArrays(F, AllBlocks, first + cnt_cov + cnt_sel_inc);
+ if (first) { first = 0; }
selects += cnt_sel;
uint32_t special = 0, local_selects = 0, skip_next = 0;

pcguard off-by-one fix