afl-fuzz.c
static void cull_queue(void) {

  struct queue_entry* q;
  u8* temp_v = (u8*)calloc((afl_map_size >> 3), sizeof(u8));
  u32 i;

  if (dumb_mode || !score_changed) return;

  score_changed = 0;

  memset(temp_v, 255, afl_map_size >> 3);

  queued_favored  = 0;
  pending_favored = 0;

  u32 case_hash_location = 0;
  u32 tmp_hash_total = hash_total;
  while(case_hash_location < tmp_hash_total){
  //while(case_hash_location < hash_total){
	  struct hash_map * hash_index = cksum_hash_map[hash_cksum_now[case_hash_location]];
	  while(hash_index){
		  struct top_mem * top_cur = hash_index->score_queue;
		  while(top_cur){
			  q = top_cur->testcase;
			  q->favored = 0;
			  top_cur = top_cur->next;
		  }
		  hash_index = hash_index->next;
	  }
	  case_hash_location++;
  }

  /* Let's see if anything in the bitmap isn't captured in temp_v.
     If yes, and if it has a top_rated[] contender, let's use it. */

  for (i = 0; i < afl_map_size; i++){
  if (top_rated[i] && (temp_v[i >> 3] & (1 << (i & 7)))) {

      u32 j = afl_map_size >> 3;

      /* Remove all bits belonging to the current entry from temp_v. */

      while (j--)
        if (top_rated[i]->trace_mini[j])
          temp_v[j] &= ~top_rated[i]->trace_mini[j];

      top_rated[i]->favored = 1;
      queued_favored++;

      if (!top_rated[i]->was_fuzzed) pending_favored++;

    }
    }

  case_hash_location = 0;
  while(case_hash_location < tmp_hash_total){
  //while(case_hash_location < hash_total){
	  struct hash_map * hash_index = cksum_hash_map[hash_cksum_now[case_hash_location]];
	  while(hash_index){
		  struct top_mem * top_cur = hash_index->score_queue;
		  while(top_cur){
			  q = top_cur->testcase;
			  mark_as_redundant(q, !q->favored);
			  top_cur = top_cur->next;
		  }
		  hash_index = hash_index->next;
	  }
	  case_hash_location++;
  }

  free(temp_v);
}
/* The second part of the mechanism discussed above is a routine that
   goes over top_rated[] entries, and then sequentially grabs winners for
   previously-unseen bytes (temp_v) and marks them as favored, at least
   until the next run. The favored entries are given more air time during
   all fuzzing steps. */
The second part of the mechanism discussed above is a routine that
goes over top_rated[] entries, and then sequentially grabs winners for
previously-unseen bytes (temp_v) and marks them as favored, at least
until the next run. The favored entries are given more air time during
all fuzzing steps.
The second part of the mechanism discussed above is a routine that goes over top_rated [] entries and then sequentially grabs winners for previously - unseen bytes ( temp_v ) and marks them as favored at least until the next run . The favored entries are given more air time during all fuzzing steps .
static void cull_queue(void) {
  struct queue_entry* q;
  u8* temp_v = (u8*)calloc((afl_map_size >> 3), sizeof(u8));
  u32 i;
  if (dumb_mode || !score_changed) return;
  score_changed = 0;
  memset(temp_v, 255, afl_map_size >> 3);
  queued_favored  = 0;
  pending_favored = 0;
  u32 case_hash_location = 0;
  u32 tmp_hash_total = hash_total;
  while(case_hash_location < tmp_hash_total){
	  struct hash_map * hash_index = cksum_hash_map[hash_cksum_now[case_hash_location]];
	  while(hash_index){
		  struct top_mem * top_cur = hash_index->score_queue;
		  while(top_cur){
			  q = top_cur->testcase;
			  q->favored = 0;
			  top_cur = top_cur->next;
		  }
		  hash_index = hash_index->next;
	  }
	  case_hash_location++;
  }
  for (i = 0; i < afl_map_size; i++){
  if (top_rated[i] && (temp_v[i >> 3] & (1 << (i & 7)))) {
      u32 j = afl_map_size >> 3;
      while (j--)
        if (top_rated[i]->trace_mini[j])
          temp_v[j] &= ~top_rated[i]->trace_mini[j];
      top_rated[i]->favored = 1;
      queued_favored++;
      if (!top_rated[i]->was_fuzzed) pending_favored++;
    }
    }
  case_hash_location = 0;
  while(case_hash_location < tmp_hash_total){
	  struct hash_map * hash_index = cksum_hash_map[hash_cksum_now[case_hash_location]];
	  while(hash_index){
		  struct top_mem * top_cur = hash_index->score_queue;
		  while(top_cur){
			  q = top_cur->testcase;
			  mark_as_redundant(q, !q->favored);
			  top_cur = top_cur->next;
		  }
		  hash_index = hash_index->next;
	  }
	  case_hash_location++;
  }
  free(temp_v);
}
static void cull_queue ( void ) { struct queue_entry * q ; u8 * temp_v = ( u8 * ) calloc ( ( afl_map_size >> 3 ) , sizeof ( u8 ) ) ; u32 i ; if ( dumb_mode || ! score_changed ) return ; score_changed = 0 ; memset ( temp_v , 255 , afl_map_size >> 3 ) ; queued_favored = 0 ; pending_favored = 0 ; u32 case_hash_location = 0 ; u32 tmp_hash_total = hash_total ; while ( case_hash_location < tmp_hash_total ) { struct hash_map * hash_index = cksum_hash_map [ hash_cksum_now [ case_hash_location ] ] ; while ( hash_index ) { struct top_mem * top_cur = hash_index -> score_queue ; while ( top_cur ) { q = top_cur -> testcase ; q -> favored = 0 ; top_cur = top_cur -> next ; } hash_index = hash_index -> next ; } case_hash_location ++ ; } for ( i = 0 ; i < afl_map_size ; i ++ ) { if ( top_rated [ i ] && ( temp_v [ i >> 3 ] & ( 1 << ( i & 7 ) ) ) ) { u32 j = afl_map_size >> 3 ; while ( j -- ) if ( top_rated [ i ] -> trace_mini [ j ] ) temp_v [ j ] &= ~ top_rated [ i ] -> trace_mini [ j ] ; top_rated [ i ] -> favored = 1 ; queued_favored ++ ; if ( ! top_rated [ i ] -> was_fuzzed ) pending_favored ++ ; } } case_hash_location = 0 ; while ( case_hash_location < tmp_hash_total ) { struct hash_map * hash_index = cksum_hash_map [ hash_cksum_now [ case_hash_location ] ] ; while ( hash_index ) { struct top_mem * top_cur = hash_index -> score_queue ; while ( top_cur ) { q = top_cur -> testcase ; mark_as_redundant ( q , ! q -> favored ) ; top_cur = top_cur -> next ; } hash_index = hash_index -> next ; } case_hash_location ++ ; } free ( temp_v ) ; }
The second part of the mechanism discussed above is a routine that
goes over top_rated[] entries, and then sequentially grabs winners for
previously-unseen bytes (temp_v) and marks them as favored, at least
until the next run.
The second part of the mechanism discussed above is a routine that goes over top_rated [] entries and then sequentially grabs winners for previously - unseen bytes ( temp_v ) and marks them as favored at least until the next run .
//while(case_hash_location < hash_total){ /* Let's see if anything in the bitmap isn't captured in temp_v.
     If yes, and if it has a top_rated[] contender, let's use it. */ /* Remove all bits belonging to the current entry from temp_v. */ //while(case_hash_location < hash_total){