hunting ref underflow
MODIFY
src/afl-fuzz-one.c
src/afl-fuzz-one.c
@@ -4695,9 +4695,6 @@ pacemaker_fuzzing:
} /* block */
- queue_testcase_release(afl, afl->queue_cur);
- orig_in = NULL;
-
return ret_val;
}

MODIFY
src/afl-fuzz-queue.c
src/afl-fuzz-queue.c
@@ -837,11 +837,18 @@ u8 *queue_testcase_take(afl_state_t *afl, struct queue_entry *q) {
}
q->testcase_refs++;
+ if (unlikely(!q->testcase_buf || !q->testcase_refs)) {
if (!q->testcase_buf) {
FATAL("Testcase buf is NULL, this should never happen");
}
+ if (!q->testcase_refs) {
+
+ FATAL("Testcase ref overflow. Missing a testcase release somwhere?");
+
+ }
+ }
return q->testcase_buf;

hunting ref underflow