use enums, support cmplog map collisions
MODIFY
include/cmplog.h
include/cmplog.h
#define SHAPE_BYTES(x) (x + 1)
-#define CMP_TYPE_INS 0
-#define CMP_TYPE_RTN 1
+#define CMP_TYPE_INS 1
+#define CMP_TYPE_RTN 2
struct cmp_header {
unsigned hits : 24;
unsigned id : 24;
unsigned shape : 5;
- unsigned type : 1;
+ unsigned type : 2;
unsigned attribute : 4;
- unsigned reserved : 6;
+ unsigned reserved : 5;
} __attribute__((packed));

MODIFY
include/config.h
include/config.h
#ifndef _HAVE_CONFIG_H
#define _HAVE_CONFIG_H
-#include "types.h"
-
/* Version string: */
// c = release, d = volatile github dev, e = experimental branch

MODIFY
include/types.h
include/types.h
#include <stdint.h>
#include <stdlib.h>
+#include "config.h"
typedef uint8_t u8;
typedef uint16_t u16;
typedef uint32_t u32;
+#ifdef WORD_SIZE_64
typedef unsigned __int128 uint128_t;
typedef uint128_t u128;
+#endif
/* Extended forkserver option values */
@@ -63,8 +66,10 @@ typedef int8_t s8;
typedef int16_t s16;
typedef int32_t s32;
typedef int64_t s64;
+#ifdef WORD_SIZE_64
typedef __int128 int128_t;
typedef int128_t s128;
+#endif
#ifndef MIN
#define MIN(a, b) \
@@ -119,6 +124,7 @@ typedef int128_t s128;
})
// It is impossible to define 128 bit constants, so ...
+#ifdef WORD_SIZE_64
#define SWAPN(_x, _l) \
({ \
\
@@ -132,6 +138,7 @@ typedef int128_t s128;
(u128) _ret; \
\
})
+#endif
#define SWAPNN(_x, _y, _l) \
({ \

MODIFY
instrumentation/afl-compiler-rt.o.c
instrumentation/afl-compiler-rt.o.c
@@ -1218,16 +1218,23 @@ void __cmplog_ins_hook1(uint8_t arg1, uint8_t arg2, uint8_t attr) {
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
- __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
- __afl_cmp_map->headers[k].attribute = attr;
+ u32 hits;
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
- // if (!__afl_cmp_map->headers[k].cnt)
- // __afl_cmp_map->headers[k].cnt = __afl_cmp_counter++;
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+ __afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
__afl_cmp_map->headers[k].shape = 0;
+ } else {
+
+ hits = __afl_cmp_map->headers[k].hits++;
+
+ }
+
+ __afl_cmp_map->headers[k].attribute = attr;
+
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = arg1;
__afl_cmp_map->log[k][hits].v1 = arg2;
@@ -1242,14 +1249,29 @@ void __cmplog_ins_hook2(uint16_t arg1, uint16_t arg2, uint8_t attr) {
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
+ u32 hits;
+
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
- __afl_cmp_map->headers[k].attribute = attr;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = 1;
+
+ } else {
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
+ hits = __afl_cmp_map->headers[k].hits++;
+
+ if (!__afl_cmp_map->headers[k].shape) {
__afl_cmp_map->headers[k].shape = 1;
+ }
+
+ }
+
+ __afl_cmp_map->headers[k].attribute = attr;
+
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = arg1;
__afl_cmp_map->log[k][hits].v1 = arg2;
@@ -1266,14 +1288,29 @@ void __cmplog_ins_hook4(uint32_t arg1, uint32_t arg2, uint8_t attr) {
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
+ u32 hits;
+
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
- __afl_cmp_map->headers[k].attribute = attr;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = 3;
+
+ } else {
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
+ hits = __afl_cmp_map->headers[k].hits++;
+
+ if (__afl_cmp_map->headers[k].shape < 3) {
__afl_cmp_map->headers[k].shape = 3;
+ }
+
+ }
+
+ __afl_cmp_map->headers[k].attribute = attr;
+
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = arg1;
__afl_cmp_map->log[k][hits].v1 = arg2;
@@ -1282,7 +1319,7 @@ void __cmplog_ins_hook4(uint32_t arg1, uint32_t arg2, uint8_t attr) {
void __cmplog_ins_hook8(uint64_t arg1, uint64_t arg2, uint8_t attr) {
- fprintf(stderr, "hook8 arg0=%lx arg1=%lx attr=%u\n", arg1, arg2, attr);
+ // fprintf(stderr, "hook8 arg0=%lx arg1=%lx attr=%u\n", arg1, arg2, attr);
if (unlikely(!__afl_cmp_map || arg1 == arg2)) return;
@@ -1290,20 +1327,36 @@ void __cmplog_ins_hook8(uint64_t arg1, uint64_t arg2, uint8_t attr) {
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
+ u32 hits;
+
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
- __afl_cmp_map->headers[k].attribute = attr;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = 7;
+
+ } else {
+
+ hits = __afl_cmp_map->headers[k].hits++;
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
+ if (__afl_cmp_map->headers[k].shape < 7) {
__afl_cmp_map->headers[k].shape = 7;
+ }
+
+ }
+
+ __afl_cmp_map->headers[k].attribute = attr;
+
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = arg1;
__afl_cmp_map->log[k][hits].v1 = arg2;
}
+#ifdef WORD_SIZE_64
// support for u24 to u120 via llvm _ExitInt(). size is in bytes minus 1
void __cmplog_ins_hookN(uint128_t arg1, uint128_t arg2, uint8_t attr,
uint8_t size) {
@@ -1318,14 +1371,29 @@ void __cmplog_ins_hookN(uint128_t arg1, uint128_t arg2, uint8_t attr,
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
+ u32 hits;
+
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
- __afl_cmp_map->headers[k].attribute = attr;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = size;
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
+ } else {
+
+ hits = __afl_cmp_map->headers[k].hits++;
+
+ if (__afl_cmp_map->headers[k].shape < size) {
__afl_cmp_map->headers[k].shape = size;
+ }
+
+ }
+
+ __afl_cmp_map->headers[k].attribute = attr;
+
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = (u64)arg1;
__afl_cmp_map->log[k][hits].v1 = (u64)arg2;
@@ -1347,14 +1415,29 @@ void __cmplog_ins_hook16(uint128_t arg1, uint128_t arg2, uint8_t attr) {
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
+ u32 hits;
+
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
- __afl_cmp_map->headers[k].attribute = attr;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = 15;
+
+ } else {
+
+ hits = __afl_cmp_map->headers[k].hits++;
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
+ if (__afl_cmp_map->headers[k].shape < 15) {
__afl_cmp_map->headers[k].shape = 15;
+ }
+
+ }
+
+ __afl_cmp_map->headers[k].attribute = attr;
+
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = (u64)arg1;
__afl_cmp_map->log[k][hits].v1 = (u64)arg2;
@@ -1363,6 +1446,8 @@ void __cmplog_ins_hook16(uint128_t arg1, uint128_t arg2, uint8_t attr) {
}
+#endif
+
#if defined(__APPLE__)
#pragma weak __sanitizer_cov_trace_const_cmp1 = __cmplog_ins_hook1
#pragma weak __sanitizer_cov_trace_const_cmp2 = __cmplog_ins_hook2
@@ -1384,8 +1469,10 @@ void __sanitizer_cov_trace_const_cmp4(uint32_t arg1, uint32_t arg2)
__attribute__((alias("__cmplog_ins_hook4")));
void __sanitizer_cov_trace_const_cmp8(uint64_t arg1, uint64_t arg2)
__attribute__((alias("__cmplog_ins_hook8")));
+ #ifdef WORD_SIZE_64
void __sanitizer_cov_trace_const_cmp16(uint128_t arg1, uint128_t arg2)
__attribute__((alias("__cmplog_ins_hook16")));
+ #endif
void __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2)
__attribute__((alias("__cmplog_ins_hook1")));
@@ -1395,8 +1482,10 @@ void __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2)
__attribute__((alias("__cmplog_ins_hook4")));
void __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2)
__attribute__((alias("__cmplog_ins_hook8")));
+ #ifdef WORD_SIZE_64
void __sanitizer_cov_trace_cmp16(uint128_t arg1, uint128_t arg2)
__attribute__((alias("__cmplog_ins_hook16")));
+ #endif
#endif /* defined(__APPLE__) */
void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
@@ -1409,13 +1498,29 @@ void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
+ u32 hits;
+
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
__afl_cmp_map->headers[k].type = CMP_TYPE_INS;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = 7;
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
+ } else {
+
+ hits = __afl_cmp_map->headers[k].hits++;
+
+ if (__afl_cmp_map->headers[k].shape < 7) {
__afl_cmp_map->headers[k].shape = 7;
+ }
+
+ }
+
+ __afl_cmp_map->headers[k].attribute = 1;
+
hits &= CMP_MAP_H - 1;
__afl_cmp_map->log[k][hits].v0 = val;
__afl_cmp_map->log[k][hits].v1 = cases[i + 2];
@@ -1448,13 +1553,27 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
k = (k >> 4) ^ (k << 8);
k &= CMP_MAP_W - 1;
+ u32 hits;
+
+ if (__afl_cmp_map->headers[k].type != CMP_TYPE_INS) {
+
__afl_cmp_map->headers[k].type = CMP_TYPE_RTN;
+ hits = 0;
+ __afl_cmp_map->headers[k].hits = 1;
+ __afl_cmp_map->headers[k].shape = 31;
+
+ } else {
+
+ hits = __afl_cmp_map->headers[k].hits++;
- u32 hits = __afl_cmp_map->headers[k].hits;
- __afl_cmp_map->headers[k].hits = hits + 1;
+ if (__afl_cmp_map->headers[k].shape < 31) {
__afl_cmp_map->headers[k].shape = 31;
+ }
+
+ }
+
hits &= CMP_MAP_RTN_H - 1;
__builtin_memcpy(((struct cmpfn_operands *)__afl_cmp_map->log[k])[hits].v0,
ptr1, 32);

MODIFY
instrumentation/cmplog-instructions-pass.cc
instrumentation/cmplog-instructions-pass.cc
@@ -420,6 +420,7 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
IRB.CreateCall(cmplogHookIns8, args);
break;
case 128:
+#ifdef WORD_SIZE_64
if (max_size == 128) {
IRB.CreateCall(cmplogHookIns16, args);
@@ -430,6 +431,9 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
}
+#endif
+ break;
+ default:
break;
}

MODIFY
instrumentation/llvm-ngram-coverage.h
instrumentation/llvm-ngram-coverage.h
#ifndef AFL_NGRAM_CONFIG_H
#define AFL_NGRAM_CONFIG_H
-#include "../config.h"
+#include "types.h"
#if (MAP_SIZE_POW2 <= 16)
typedef u16 PREV_LOC_T;

MODIFY
src/afl-fuzz-redqueen.c
src/afl-fuzz-redqueen.c
#define CMPLOG_INTROSPECTION
//#define ARITHMETIC_LESSER_GREATER
-///// Colorization
+// CMP attribute enum
+enum {
+
+ IS_EQUAL = 1,
+ IS_GREATER = 2,
+ IS_LESSER = 4,
+ IS_FP = 8,
+ IS_FP_MOD = 16,
+ IS_INT_MOD = 32
+
+};
+
+// CMPLOG LVL
+enum {
+
+ LVL1 = 1,
+ LVL2 = 2,
+ LVL3 = 4
+
+};
struct range {
@@ -545,8 +564,8 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
unsigned long long unum;
long long num;
- // reverse atoi()/strnu?toll() is expensive, so we only to it in lvl == 3
- if (lvl & 4) {
+ // reverse atoi()/strnu?toll() is expensive, so we only to it in lvl 3
+ if (lvl & LVL3) {
if (afl->queue_cur->is_ascii) {
@@ -618,7 +637,8 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
// we only allow this for ascii2integer (above)
if (unlikely(pattern == o_pattern)) { return 0; }
- if ((lvl & 1) || ((lvl & 2) && (attr >= 8 && attr <= 15)) || attr >= 16) {
+ if ((lvl & LVL1) || ((lvl & LVL2) && (attr >= IS_FP && attr < IS_FP_MOD)) ||
+ attr >= IS_FP_MOD) {
if (SHAPE_BYTES(h->shape) >= 8 && *status != 1) {
@@ -632,8 +652,8 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
// if this is an fcmp (attr & 8 == 8) then do not compare the patterns -
// due to a bug in llvm dynamic float bitcasts do not work :(
// the value 16 means this is a +- 1.0 test case
- if (its_len >= 8 &&
- ((*buf_64 == pattern && *o_buf_64 == o_pattern) || attr >= 16)) {
+ if (its_len >= 8 && ((*buf_64 == pattern && *o_buf_64 == o_pattern) ||
+ attr >= IS_FP_MOD)) {
u64 tmp_64 = *buf_64;
*buf_64 = repl;
@@ -674,7 +694,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
if (its_len >= 4 &&
((*buf_32 == (u32)pattern && *o_buf_32 == (u32)o_pattern) ||
- attr >= 16)) {
+ attr >= IS_FP_MOD)) {
u32 tmp_32 = *buf_32;
*buf_32 = (u32)repl;
@@ -708,7 +728,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
if (its_len >= 2 &&
((*buf_16 == (u16)pattern && *o_buf_16 == (u16)o_pattern) ||
- attr >= 16)) {
+ attr >= IS_FP_MOD)) {
u16 tmp_16 = *buf_16;
*buf_16 = (u16)repl;
@@ -738,7 +758,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
if (*status != 1) { // u8
- // if (its_len >= 1 && (attr <= 1 || attr >= 8))
+ // if (its_len >= 1)
// fprintf(stderr,
// "TestU8: %u>=1 (idx=%u attr=%u) %x==%x %x==%x <= %x<-%x\n",
// its_len, idx, attr, *buf_8, (u8)pattern, *o_buf_8,
@@ -746,7 +766,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
if (its_len >= 1 &&
((*buf_8 == (u8)pattern && *o_buf_8 == (u8)o_pattern) ||
- attr >= 16)) {
+ attr >= IS_FP_MOD)) {
u8 tmp_8 = *buf_8;
*buf_8 = (u8)repl;
@@ -769,10 +789,11 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
// in original buffer)
#ifdef ARITHMETIC_LESSER_GREATER
- if (lvl < 4) { return 0; }
+ if (lvl < LVL3) { return 0; }
// lesser/greater FP comparison
- if ((attr & 6) && (attr >= 8 && attr < 16)) {
+ if ((attr & (IS_LESSER + IS_GREATER)) &&
+ (attr >= IS_FP && attr < IS_FP_MOD)) {
u64 repl_new;
if (SHAPE_BYTES(h->shape) == 4 && its_len >= 4) {
@@ -869,7 +890,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
}
- } else if ((attr & 6) && attr < 8) {
+ } else if ((attr & (IS_LESSER + IS_GREATER)) && attr < IS_FP) {
// lesser/greater integer comparison
@@ -903,6 +924,8 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
}
+#ifdef WORD_SIZE_64
+
static u8 cmp_extend_encodingN(afl_state_t *afl, struct cmp_header *h,
u128 pattern, u128 repl, u128 o_pattern,
u128 changed_val, u8 attr, u32 idx,
@@ -990,6 +1013,8 @@ static u8 cmp_extend_encodingN(afl_state_t *afl, struct cmp_header *h,
}
+#endif
+
static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
u8 *b = (u8 *)&v;
@@ -1040,6 +1065,7 @@ static void try_to_add_to_dict(afl_state_t *afl, u64 v, u8 shape) {
}
+#ifdef WORD_SIZE_64
static void try_to_add_to_dictN(afl_state_t *afl, u128 v, u8 size) {
u8 *b = (u8 *)&v;
@@ -1077,6 +1103,8 @@ static void try_to_add_to_dictN(afl_state_t *afl, u128 v, u8 size) {
}
+#endif
+
static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
u32 len, u32 lvl, struct tainted *taint) {
@@ -1091,7 +1119,9 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
u8 found_one = 0;
/* loop cmps are useless, detect and ignore them */
+#ifdef WORD_SIZE_64
u128 s128_v0 = 0, s128_v1 = 0, orig_s128_v0 = 0, orig_s128_v1 = 0;
+#endif
u64 s_v0, s_v1;
u8 s_v0_fixed = 1, s_v1_fixed = 1;
u8 s_v0_inc = 1, s_v1_inc = 1;
@@ -1110,7 +1140,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
}
// FP handling only from lvl 2 onwards
- if ((h->attribute & 8) && lvl < 2) return 0;
+ if ((h->attribute & IS_FP) && lvl < LVL2) return 0;
for (i = 0; i < loggeds; ++i) {
@@ -1162,6 +1192,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
}
+#ifdef WORD_SIZE_64
if (unlikely(is_n)) {
s128_v0 = ((u128)o->v0) + (((u128)o->v0_128) << 64);
@@ -1171,6 +1202,8 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
}
+#endif
+
for (idx = 0; idx < len; ++idx) {
if (have_taint) {
@@ -1195,6 +1228,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
status = 0;
+#ifdef WORD_SIZE_64
if (is_n) { // _ExtInt special case including u128
if (s128_v0 != orig_s128_v0 && orig_s128_v0 != orig_s128_v1) {
@@ -1239,11 +1273,13 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
}
+#endif
+
// even for u128 and _ExtInt we do cmp_extend_encoding() because
// if we got here their own special trials failed and it might just be
// a cast from e.g. u64 to u128 from the input data.
- if ((o->v0 != orig_o->v0 || lvl >= 4) && orig_o->v0 != orig_o->v1) {
+ if ((o->v0 != orig_o->v0 || lvl >= LVL3) && orig_o->v0 != orig_o->v1) {
if (unlikely(cmp_extend_encoding(
afl, h, o->v0, o->v1, orig_o->v0, orig_o->v1, h->attribute, idx,
@@ -1263,7 +1299,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
}
status = 0;
- if ((o->v1 != orig_o->v1 || lvl >= 4) && orig_o->v0 != orig_o->v1) {
+ if ((o->v1 != orig_o->v1 || lvl >= LVL3) && orig_o->v0 != orig_o->v1) {
if (unlikely(cmp_extend_encoding(
afl, h, o->v1, o->v0, orig_o->v1, orig_o->v0, h->attribute, idx,
@@ -1521,13 +1557,6 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
}
- // do it manually, forkserver clear only afl->fsrv.trace_bits
- memset(afl->shm.cmp_map->headers, 0, sizeof(afl->shm.cmp_map->headers));
-
- if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) { return 1; }
-
- memcpy(afl->orig_cmp_map, afl->shm.cmp_map, sizeof(struct cmp_map));
-
struct tainted *taint = NULL;
if (!afl->queue_cur->taint || !afl->queue_cur->cmplog_colorinput) {
@@ -1562,8 +1591,6 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
buf = afl->queue_cur->cmplog_colorinput;
taint = afl->queue_cur->taint;
- // reget the cmplog information
- if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) { return 1; }
}
@@ -1583,9 +1610,13 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
u32 cmp_locations = 0;
#endif
- // do it manually, forkserver clear only afl->fsrv.trace_bits
- memset(afl->shm.cmp_map->headers, 0, sizeof(afl->shm.cmp_map->headers));
-
+ // Generate the cmplog data
+ // manually clear the full cmp_map
+ memset(afl->shm.cmp_map, 0, sizeof(struct cmp_map));
+ if (unlikely(common_fuzz_cmplog_stuff(afl, orig_buf, len))) { return 1; }
+ memcpy(afl->orig_cmp_map, afl->shm.cmp_map, sizeof(struct cmp_map));
+ // manually clear just the headers
+ memset(afl->shm.cmp_map->headers, 0, sizeof(struct cmp_header));
if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) { return 1; }
u64 orig_hit_cnt, new_hit_cnt;
@@ -1602,7 +1633,7 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
u32 cmplog_lvl = afl->cmplog_lvl;
if (!cmplog_done) {
- lvl = 1;
+ lvl = LVL1;
} else {
@@ -1610,8 +1641,8 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
}
- if (cmplog_lvl >= 2 && cmplog_done < 2) { lvl += 2; }
- if (cmplog_lvl >= 3 && cmplog_done < 3) { lvl += 4; }
+ if (cmplog_lvl >= 2 && cmplog_done < 2) { lvl += LVL2; }
+ if (cmplog_lvl >= 3 && cmplog_done < 3) { lvl += LVL3; }
#ifdef COMBINE
u8 *cbuf = afl_realloc((void **)&afl->in_scratch_buf, len + 128);
@@ -1668,7 +1699,7 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len) {
}
- } else if (lvl & 1) {
+ } else if (lvl & LVL1) {
if (unlikely(rtn_fuzz(afl, k, orig_buf, buf, cbuf, len, taint))) {

use enums, support cmplog map collisions