dict enhancement
MODIFY
src/afl-fuzz-redqueen.c
src/afl-fuzz-redqueen.c
@@ -1853,9 +1853,14 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
// we only learn 16 bit +
if (hshape > 1) {
- u8 same0 = 0, same1 = 0, result = 1 + 2 + (found_one << 2);
+ u8 same0 = 0, same1 = 0, same2 = 0, same3 = 0,
+ result = 1 + 2 + (found_one << 2);
if (o->v0 != orig_o->v0) { same0 = 8; }
if (o->v1 != orig_o->v1) { same1 = 8; }
+ if (o->v0 != o->v1) { same2 = 8; }
+ if (orig_o->v0 != orig_o->v1) { same3 = 8; }
+
+ if (!(same0 && same1) && !same2 && !same3) {
#ifdef WORD_SIZE_64
if (unlikely(is_n)) {
@@ -1895,6 +1900,8 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
}
+ }
+
cmp_fuzz_next_iter:
afl->stage_cur++;
@@ -2551,10 +2558,15 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
}
- u8 same0 = 0, same1 = 0, result = 1 + (found_one << 2);
+ u8 same0 = 0, same1 = 0, same2 = 0, same3 = 0,
+ result = 1 + (found_one << 2);
if (!is_txt) result += 2;
if (l0 != ol0 || memcmp(o->v0, orig_o->v0, l0) != 0) { same0 = 8; }
if (l1 != ol1 || memcmp(o->v1, orig_o->v1, l1) != 0) { same1 = 8; }
+ if (l0 != l1 || memcmp(o->v0, o->v1, l0) != 0) { same2 = 8; }
+ if (ol0 != ol1 || memcmp(orig_o->v0, orig_o->v1, l0) != 0) { same3 = 8; }
+
+ if (!(same0 && same1) && !same2 && !same3) {
if (DICT_ADD_STRATEGY >= same0 + result) {
@@ -2572,6 +2584,8 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf,
}
+ }
+
rtn_fuzz_next_iter:
afl->stage_cur++;

dict enhancement