fix the auto map fix
MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -1581,7 +1581,11 @@ int main(int argc, char **argv_orig, char **envp) {
afl->fsrv.trace_bits =
afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
- if (afl->fsrv.map_size <= 8000000) {
+ if (!afl->non_instrumented_mode && !afl->fsrv.qemu_mode &&
+ !afl->unicorn_mode) {
+
+ if (map_size <= 8000000&& !afl->non_instrumented_mode &&
+ !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
afl->fsrv.map_size = 8000000; // dummy temporary value
setenv("AFL_MAP_SIZE", "8000000", 1);
@@ -1591,10 +1595,11 @@ int main(int argc, char **argv_orig, char **envp) {
u32 new_map_size = afl_fsrv_get_mapsize(
&afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
+ if (new_map_size && new_map_size != map_size) {
+
// only reinitialize when it makes sense
if (map_size < new_map_size ||
- (new_map_size > map_size && new_map_size - map_size > MAP_SIZE &&
- (!afl->cmplog_binary || new_map_size == MAP_SIZE))) {
+ (new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
OKF("Re-initializing maps to %u bytes", new_map_size);
@@ -1602,9 +1607,11 @@ int main(int argc, char **argv_orig, char **envp) {
afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
- afl->top_rated = ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
+ afl->top_rated =
+ ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
- afl->clean_trace_custom = ck_realloc(afl->clean_trace_custom, new_map_size);
+ afl->clean_trace_custom =
+ ck_realloc(afl->clean_trace_custom, new_map_size);
afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
@@ -1616,6 +1623,9 @@ int main(int argc, char **argv_orig, char **envp) {
setenv("AFL_NO_AUTODICT", "1", 1); // loaded already
afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child);
+
+ }
+
map_size = new_map_size;
} else {
@@ -1624,6 +1634,8 @@ int main(int argc, char **argv_orig, char **envp) {
}
+ }
+
if (afl->cmplog_binary) {
ACTF("Spawning cmplog forkserver");
@@ -1634,13 +1646,22 @@ int main(int argc, char **argv_orig, char **envp) {
afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
+ if (map_size <= 8000000 && !afl->non_instrumented_mode &&
+ !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
+
+ afl->fsrv.map_size = 8000000; // dummy temporary value
+ setenv("AFL_MAP_SIZE", "8000000", 1);
+
+ }
+
u32 new_map_size =
afl_fsrv_get_mapsize(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child);
- // only reinitialize when necessary
- if (map_size < new_map_size ||
- (new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
+ if (new_map_size && new_map_size != map_size) {
+
+ // only reinitialize when it needs to be larger
+ if (map_size < new_map_size) {
OKF("Re-initializing maps to %u bytes due cmplog", new_map_size);
@@ -1670,14 +1691,14 @@ int main(int argc, char **argv_orig, char **envp) {
afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
afl->afl_env.afl_debug_child);
+ }
+
map_size = new_map_size;
- } else {
+ }
afl->cmplog_fsrv.map_size = map_size;
- }
-
OKF("Cmplog forkserver successfully started");
}

MODIFY
test/test-llvm.sh
test/test-llvm.sh
@@ -162,9 +162,9 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && {
test -e test-floatingpoint && {
mkdir -p in
echo ZZZZ > in/in
- $ECHO "$GREY[*] running afl-fuzz with floating point splitting, this will take max. 45 seconds"
+ $ECHO "$GREY[*] running afl-fuzz with floating point splitting, this will take max. 30 seconds"
{
- AFL_BENCH_UNTIL_CRASH=1 AFL_NO_UI=1 ../afl-fuzz -Z -s 1 -V45 -m ${MEM_LIMIT} -i in -o out -D -- ./test-floatingpoint >>errors 2>&1
+ AFL_BENCH_UNTIL_CRASH=1 AFL_NO_UI=1 ../afl-fuzz -Z -s 1 -V30 -m ${MEM_LIMIT} -i in -o out -D -- ./test-floatingpoint >>errors 2>&1
} >>errors 2>&1
test -n "$( ls out/default/crashes/id:* 2>/dev/null )" && {
$ECHO "$GREEN[+] llvm_mode laf-intel floatingpoint splitting feature works correctly"

fix the auto map fix