fix expand havoc for ..._only modes
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -19,6 +19,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
- eliminated CPU affinity race condition for -S/-M runs
- expanded havoc mode added, on no cycle finds add extra splicing and
MOpt into the mix
+ - fixed a bug in redqueen for strings
- llvm_mode:
- now supports llvm 12!
- fixes for laf-intel float splitting (thanks to mark-griffin for

MODIFY
llvm_mode/afl-llvm-rt.o.c
llvm_mode/afl-llvm-rt.o.c
@@ -869,15 +869,23 @@ void __sanitizer_cov_trace_pc_guard(uint32_t *guard) {
uint32_t idx;
char bt[1024];
for (idx = 0; i < sizeof(unstable)/sizeof(uint32_t); i++) {
+
if (unstable[idx] == __afl_area_ptr[*guard]) {
+
int bt_size = backtrace(bt, 256);
if (bt_size > 0) {
+
char **bt_syms = backtrace_symbols(bt, bt_size);
if (bt_syms)
- fprintf(stderr, "DEBUG: edge=%u caller=%s\n", unstable[idx], bt_syms[0]);
+ fprintf(stderr, "DEBUG: edge=%u caller=%s\n", unstable[idx],
+ bt_syms[0]);
+
}
+
}
+
}
+
*/
__afl_area_ptr[*guard]++;

MODIFY
src/afl-fuzz-redqueen.c
src/afl-fuzz-redqueen.c
@@ -673,8 +673,8 @@ static u8 rtn_extend_encoding(afl_state_t *afl, struct cmp_header *h,
for (i = 0; i < its_len; ++i) {
- if (pattern[i] != buf[idx + i] ||
- o_pattern[i] != orig_buf[idx + i] || *status == 1) {
+ if (pattern[i] != buf[idx + i] || o_pattern[i] != orig_buf[idx + i] ||
+ *status == 1) {
break;

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -1304,7 +1304,8 @@ int main(int argc, char **argv_orig, char **envp) {
afl->expand_havoc = 1;
break;
case 1:
- if (afl->limit_time_sig == 0) {
+ if (afl->limit_time_sig == 0 && !afl->custom_only &&
+ !afl->python_only) {
afl->limit_time_sig = -1;
afl->limit_time_puppet = 0;

MODIFY
test/test-cmplog.c
test/test-cmplog.c
#include <stdint.h>
#include <unistd.h>
int main(int argc, char *argv[]) {
+
char buf[1024];
ssize_t i;
- if ((i = read(0, buf, sizeof(buf) - 1)) < 24)
- return 0;
+ if ((i = read(0, buf, sizeof(buf) - 1)) < 24) return 0;
buf[i] = 0;
- if (buf[0] != 'A')
- return 0;
- if (buf[1] != 'B')
- return 0;
- if (buf[2] != 'C')
- return 0;
- if (buf[3] != 'D')
- return 0;
- if (memcmp(buf + 4, "1234", 4) || memcmp(buf + 8, "EFGH", 4))
- return 0;
+ if (buf[0] != 'A') return 0;
+ if (buf[1] != 'B') return 0;
+ if (buf[2] != 'C') return 0;
+ if (buf[3] != 'D') return 0;
+ if (memcmp(buf + 4, "1234", 4) || memcmp(buf + 8, "EFGH", 4)) return 0;
if (strncmp(buf + 12, "IJKL", 4) == 0 && strcmp(buf + 16, "DEADBEEF") == 0)
abort();
return 0;
+
}

fix expand havoc for ..._only modes