shmem map size in config.h
MODIFY
include/config.h
include/config.h
* *
******************************************************/
+/* Default shared memory map size. Most targets just need a coverage map
+ between 20-250kb. Plus there is an auto-detection feature in afl-fuzz.
+ However if a target has problematic constructors and init arrays then
+ this can fail. Hence afl-fuzz deploys a larger default map. The largest
+ map seen so far is the xlsx fuzzer for libreoffice which is 5MB.
+ At runtime this value can be overriden via AFL_MAP_SIZE.
+ Default: 8MB (defined in bytes) */
+#define DEFAULT_SHMEM_SIZE (8 * 1024 * 1024)
+
/* CMPLOG/REDQUEEN TUNING
*
* Here you can modify tuning and solving options for CMPLOG.

MODIFY
src/afl-common.c
src/afl-common.c
@@ -1072,7 +1072,7 @@ u8 *u_stringify_time_diff(u8 *buf, u64 cur_ms, u64 event_ms) {
/* Reads the map size from ENV */
u32 get_map_size(void) {
- uint32_t map_size = 8000000; // a very large default map
+ uint32_t map_size = DEFAULT_SHMEM_SIZE;
char * ptr;
if ((ptr = getenv("AFL_MAP_SIZE")) || (ptr = getenv("AFL_MAPSIZE"))) {

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -1527,11 +1527,13 @@ int main(int argc, char **argv_orig, char **envp) {
if (!afl->non_instrumented_mode && !afl->fsrv.qemu_mode &&
!afl->unicorn_mode) {
- if (map_size <= 8000000 && !afl->non_instrumented_mode &&
+ if (map_size <= DEFAULT_SHMEM_SIZE && !afl->non_instrumented_mode &&
!afl->fsrv.qemu_mode && !afl->unicorn_mode) {
- afl->fsrv.map_size = 8000000; // dummy temporary value
- setenv("AFL_MAP_SIZE", "8000000", 1);
+ afl->fsrv.map_size = DEFAULT_SHMEM_SIZE; // dummy temporary value
+ char vbuf[16];
+ snprintf(vbuf, sizeof(vbuf), "%u", DEFAULT_SHMEM_SIZE);
+ setenv("AFL_MAP_SIZE", vbuf, 1);
}
@@ -1582,11 +1584,13 @@ int main(int argc, char **argv_orig, char **envp) {
afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
- if (map_size <= 8000000 && !afl->non_instrumented_mode &&
+ if (map_size <= DEFAULT_SHMEM_SIZE && !afl->non_instrumented_mode &&
!afl->fsrv.qemu_mode && !afl->unicorn_mode) {
- afl->cmplog_fsrv.map_size = 8000000; // dummy temporary value
- setenv("AFL_MAP_SIZE", "8000000", 1);
+ afl->fsrv.map_size = DEFAULT_SHMEM_SIZE; // dummy temporary value
+ char vbuf[16];
+ snprintf(vbuf, sizeof(vbuf), "%u", DEFAULT_SHMEM_SIZE);
+ setenv("AFL_MAP_SIZE", vbuf, 1);
}
@@ -1634,8 +1638,12 @@ int main(int argc, char **argv_orig, char **envp) {
}
if (afl->debug) {
- printf("NORMAL %u, CMPLOG %u\n", afl->fsrv.map_size, afl->cmplog_fsrv.map_size);
- fprintf(stderr, "NORMAL %u, CMPLOG %u\n", afl->fsrv.map_size, afl->cmplog_fsrv.map_size);
+
+ printf("NORMAL %u, CMPLOG %u\n", afl->fsrv.map_size,
+ afl->cmplog_fsrv.map_size);
+ fprintf(stderr, "NORMAL %u, CMPLOG %u\n", afl->fsrv.map_size,
+ afl->cmplog_fsrv.map_size);
+
}
load_auto(afl);

shmem map size in config.h