final fix for map_size
MODIFY
src/afl-common.c
src/afl-common.c
@@ -404,9 +404,13 @@ u8 *find_binary(u8 *fname) {
env_path = delim;
if (cur_elem[0]) {
+
target_path = alloc_printf("%s/%s", cur_elem, fname);
+
} else {
+
target_path = ck_strdup(fname);
+
}
ck_free(cur_elem);

MODIFY
src/afl-fuzz-state.c
src/afl-fuzz-state.c
@@ -103,7 +103,7 @@ void afl_state_init(afl_state_t *afl, uint32_t map_size) {
afl->virgin_tmout = ck_alloc(map_size);
afl->virgin_crash = ck_alloc(map_size);
afl->var_bytes = ck_alloc(map_size);
- afl->top_rated = ck_alloc(map_size);
+ afl->top_rated = ck_alloc(map_size * sizeof(void *));
afl->clean_trace = ck_alloc(map_size);
afl->clean_trace_custom = ck_alloc(map_size);
afl->first_trace = ck_alloc(map_size);

final fix for map_size