fix MOPT implementation flaws in core fuzzing
MODIFY
src/afl-fuzz-one.c
src/afl-fuzz-one.c
@@ -4250,6 +4250,9 @@ pacemaker_fuzzing:
u64 temp_temp_puppet =
afl->queued_paths + afl->unique_crashes - temp_total_found;
afl->total_puppet_find = afl->total_puppet_find + temp_temp_puppet;
+
+ if (MOpt_globals.is_pilot_mode){
+
for (i = 0; i < operator_num; ++i) {
if (MOpt_globals.cycles_v2[i] > MOpt_globals.cycles_v3[i]) {
@@ -4260,6 +4263,18 @@ pacemaker_fuzzing:
}
+ } else {
+
+ for (i = 0; i < operator_num; i++) {
+
+ if (afl->core_operator_cycles_puppet_v2[i] > afl->core_operator_cycles_puppet_v3[i])
+
+ afl->core_operator_finds_puppet_v2[i] += temp_temp_puppet;
+
+ }
+
+ }
+
} /* if */
} /* for (afl->stage_cur = 0; afl->stage_cur < afl->stage_max;
@@ -4437,7 +4452,6 @@ pacemaker_fuzzing:
afl->total_pacemaker_time += *MOpt_globals.pTime;
*MOpt_globals.pTime = 0;
- afl->temp_puppet_find = afl->total_puppet_find;
new_hit_cnt = afl->queued_paths + afl->unique_crashes;
if (MOpt_globals.is_pilot_mode) {
@@ -4448,6 +4462,7 @@ pacemaker_fuzzing:
}
+ afl->temp_puppet_find = afl->total_puppet_find;
u64 temp_stage_finds_puppet = 0;
for (i = 0; i < operator_num; ++i) {
@@ -4530,6 +4545,15 @@ pacemaker_fuzzing:
} else {
+ for (i = 0; i < operator_num; i++)
+ {
+
+ afl->core_operator_finds_puppet[i] = afl->core_operator_finds_puppet_v2[i];
+ afl->core_operator_cycles_puppet[i] = afl->core_operator_cycles_puppet_v2[i];
+ temp_stage_finds_puppet += afl->core_operator_finds_puppet[i];
+
+ }
+
afl->key_module = 2;
afl->old_hit_count = new_hit_cnt;

fix MOPT implementation flaws in core fuzzing