afl-fuzz.c
static void update_bitmap_score(struct queue_entry* q) {

  u32 i;
  u64 fav_factor = q->exec_us * q->len;

  /* For every byte set in trace_bits[], see if there is a previous winner,
     and how it compares to us. */

  for (i = 0; i < afl_map_size; i++) {

    if (trace_bits[i]) {

       if (top_rated[i]) {

         /* Faster-executing or smaller test cases are favored. */

         if (fav_factor > top_rated[i]->exec_us * top_rated[i]->len) continue;

         /* Looks like we're going to win. Decrease ref count for the
            previous winner, discard its trace_bits[] if necessary. */
         --top_rated[i]->tc_ref;
         if (!top_rated[i]->tc_ref) {
           if(top_rated[i]->trace_mini) ck_free(top_rated[i]->trace_mini);
           top_rated[i]->trace_mini = 0;
           //ck_free(top_rated[i]->tr_list);
           struct tr_record * tr_cur = top_rated[i]->tr_list;
           while(tr_cur){
             top_rated[i]->tr_list = top_rated[i]->tr_list->next;
             ck_free(tr_cur);
             tr_cur = top_rated[i]->tr_list;
           }
           top_rated[i]->tr_list = NULL;
         }else{
           struct tr_record * tr_index = top_rated[i]->tr_list;
           struct tr_record * tr_before = top_rated[i]->tr_list;
           while(tr_index){
             if(tr_index->top_rated_index == i){
               if(tr_index == tr_before){
                 top_rated[i]->tr_list = tr_index->next;
                 ck_free(tr_index);
                 break;
               }else{
                 tr_before->next = tr_index->next;
                 ck_free(tr_index); 
                 break;
               }
             }
             tr_before = tr_index;
             tr_index = tr_index->next;
           }
         }

       }

       /* Insert ourselves as the new winner. */
       struct tr_record *tr_now = ck_alloc(sizeof(struct tr_record));
       tr_now->top_rated_index = i;
       tr_now->next = NULL;
       if(!q->tc_ref){
         q->tr_list = tr_now;
       }else{
         tr_now->next = q->tr_list;
         q->tr_list = tr_now;
       }
       top_rated[i] = q;
       q->tc_ref++;
       if (!q->trace_mini) {
         q->trace_mini = ck_alloc(afl_map_size >> 3);
         minimize_bits(q->trace_mini, trace_bits);
       }

       score_changed = 1;

     }
  }
}
/* When we bump into a new path, we call this to see if the path appears
   more "favorable" than any of the existing ones. The purpose of the
   "favorables" is to have a minimal set of paths that trigger all the bits
   seen in the bitmap so far, and focus on fuzzing them at the expense of
   the rest.

   The first step of the process is to maintain a list of top_rated[] entries
   for every byte in the bitmap. We win that slot if there is no previous
   contender, or if the contender has a more favorable speed x size factor. */
When we bump into a new path, we call this to see if the path appears
more "favorable" than any of the existing ones. The purpose of the
"favorables" is to have a minimal set of paths that trigger all the bits
seen in the bitmap so far, and focus on fuzzing them at the expense of
the rest.

The first step of the process is to maintain a list of top_rated[] entries
for every byte in the bitmap. We win that slot if there is no previous
contender, or if the contender has a more favorable speed x size factor.
When we bump into a new path we call this to see if the path appears more " favorable " than any of the existing ones . The purpose of the " favorables " is to have a minimal set of paths that trigger all the bits seen in the bitmap so far and focus on fuzzing them at the expense of the rest . The first step of the process is to maintain a list of top_rated [] entries for every byte in the bitmap . We win that slot if there is no previous contender or if the contender has a more favorable speed x size factor .
static void update_bitmap_score(struct queue_entry* q) {
  u32 i;
  u64 fav_factor = q->exec_us * q->len;
  for (i = 0; i < afl_map_size; i++) {
    if (trace_bits[i]) {
       if (top_rated[i]) {
         if (fav_factor > top_rated[i]->exec_us * top_rated[i]->len) continue;
         --top_rated[i]->tc_ref;
         if (!top_rated[i]->tc_ref) {
           if(top_rated[i]->trace_mini) ck_free(top_rated[i]->trace_mini);
           top_rated[i]->trace_mini = 0;
           struct tr_record * tr_cur = top_rated[i]->tr_list;
           while(tr_cur){
             top_rated[i]->tr_list = top_rated[i]->tr_list->next;
             ck_free(tr_cur);
             tr_cur = top_rated[i]->tr_list;
           }
           top_rated[i]->tr_list = NULL;
         }else{
           struct tr_record * tr_index = top_rated[i]->tr_list;
           struct tr_record * tr_before = top_rated[i]->tr_list;
           while(tr_index){
             if(tr_index->top_rated_index == i){
               if(tr_index == tr_before){
                 top_rated[i]->tr_list = tr_index->next;
                 ck_free(tr_index);
                 break;
               }else{
                 tr_before->next = tr_index->next;
                 ck_free(tr_index); 
                 break;
               }
             }
             tr_before = tr_index;
             tr_index = tr_index->next;
           }
         }
       }
       struct tr_record *tr_now = ck_alloc(sizeof(struct tr_record));
       tr_now->top_rated_index = i;
       tr_now->next = NULL;
       if(!q->tc_ref){
         q->tr_list = tr_now;
       }else{
         tr_now->next = q->tr_list;
         q->tr_list = tr_now;
       }
       top_rated[i] = q;
       q->tc_ref++;
       if (!q->trace_mini) {
         q->trace_mini = ck_alloc(afl_map_size >> 3);
         minimize_bits(q->trace_mini, trace_bits);
       }
       score_changed = 1;
     }
  }
}
static void update_bitmap_score ( struct queue_entry * q ) { u32 i ; u64 fav_factor = q -> exec_us * q -> len ; for ( i = 0 ; i < afl_map_size ; i ++ ) { if ( trace_bits [ i ] ) { if ( top_rated [ i ] ) { if ( fav_factor > top_rated [ i ] -> exec_us * top_rated [ i ] -> len ) continue ; -- top_rated [ i ] -> tc_ref ; if ( ! top_rated [ i ] -> tc_ref ) { if ( top_rated [ i ] -> trace_mini ) ck_free ( top_rated [ i ] -> trace_mini ) ; top_rated [ i ] -> trace_mini = 0 ; struct tr_record * tr_cur = top_rated [ i ] -> tr_list ; while ( tr_cur ) { top_rated [ i ] -> tr_list = top_rated [ i ] -> tr_list -> next ; ck_free ( tr_cur ) ; tr_cur = top_rated [ i ] -> tr_list ; } top_rated [ i ] -> tr_list = NULL ; } else { struct tr_record * tr_index = top_rated [ i ] -> tr_list ; struct tr_record * tr_before = top_rated [ i ] -> tr_list ; while ( tr_index ) { if ( tr_index -> top_rated_index == i ) { if ( tr_index == tr_before ) { top_rated [ i ] -> tr_list = tr_index -> next ; ck_free ( tr_index ) ; break ; } else { tr_before -> next = tr_index -> next ; ck_free ( tr_index ) ; break ; } } tr_before = tr_index ; tr_index = tr_index -> next ; } } } struct tr_record * tr_now = ck_alloc ( sizeof ( struct tr_record ) ) ; tr_now -> top_rated_index = i ; tr_now -> next = NULL ; if ( ! q -> tc_ref ) { q -> tr_list = tr_now ; } else { tr_now -> next = q -> tr_list ; q -> tr_list = tr_now ; } top_rated [ i ] = q ; q -> tc_ref ++ ; if ( ! q -> trace_mini ) { q -> trace_mini = ck_alloc ( afl_map_size >> 3 ) ; minimize_bits ( q -> trace_mini , trace_bits ) ; } score_changed = 1 ; } } }
When we bump into a new path, we call this to see if the path appears
more "favorable" than any of the existing ones.
When we bump into a new path we call this to see if the path appears more " favorable " than any of the existing ones .
/* For every byte set in trace_bits[], see if there is a previous winner,
     and how it compares to us. */ /* Faster-executing or smaller test cases are favored. */ /* Looks like we're going to win. Decrease ref count for the
            previous winner, discard its trace_bits[] if necessary. */ //ck_free(top_rated[i]->tr_list); /* Insert ourselves as the new winner. */