increase havoc_stack_pow2 on no finds
MODIFY
include/afl-fuzz.h
include/afl-fuzz.h
@@ -443,6 +443,7 @@ typedef struct afl_state {
u8 cal_cycles, /* Calibration cycles defaults */
cal_cycles_long, /* Calibration cycles defaults */
+ havoc_stack_pow2, /* HAVOC_STACK_POW2 */
no_unlink, /* do not unlink cur_input */
debug, /* Debug mode */
custom_only, /* Custom mutator only mode */

MODIFY
src/afl-fuzz-one.c
src/afl-fuzz-one.c
@@ -1884,7 +1884,7 @@ havoc_stage:
for (afl->stage_cur = 0; afl->stage_cur < afl->stage_max; ++afl->stage_cur) {
- u32 use_stacking = 1 << (1 + rand_below(afl, HAVOC_STACK_POW2));
+ u32 use_stacking = 1 << (1 + rand_below(afl, afl->havoc_stack_pow2));
afl->stage_cur_val = use_stacking;
@@ -3970,7 +3970,7 @@ pacemaker_fuzzing:
for (afl->stage_cur = 0; afl->stage_cur < afl->stage_max;
++afl->stage_cur) {
- u32 use_stacking = 1 << (1 + rand_below(afl, HAVOC_STACK_POW2));
+ u32 use_stacking = 1 << (1 + rand_below(afl, afl->havoc_stack_pow2));
afl->stage_cur_val = use_stacking;

MODIFY
src/afl-fuzz-state.c
src/afl-fuzz-state.c
@@ -95,6 +95,7 @@ void afl_state_init(afl_state_t *afl, uint32_t map_size) {
afl->stage_name = "init"; /* Name of the current fuzz stage */
afl->splicing_with = -1; /* Splicing with which test case? */
afl->cpu_to_bind = -1;
+ afl->havoc_stack_pow2 = HAVOC_STACK_POW2;
afl->cal_cycles = CAL_CYCLES;
afl->cal_cycles_long = CAL_CYCLES_LONG;
afl->hang_tmout = EXEC_TIMEOUT;

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -1368,9 +1368,14 @@ int main(int argc, char **argv_orig, char **envp) {
break;
case 2:
// if (!have_p) afl->schedule = EXPLOIT;
+ afl->havoc_stack_pow2++;
afl->expand_havoc = 3;
break;
case 3:
+ afl->havoc_stack_pow2++;
+ afl->expand_havoc = 4;
+ break;
+ case 4:
// nothing else currently
break;

increase havoc_stack_pow2 on no finds