fix the auto map fix

2 files changed, 92 insertions, 71 deletions

diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index cd049fd5..096ee29d 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1581,46 +1581,58 @@ int main(int argc, char **argv_orig, char **envp) {
   afl->fsrv.trace_bits =
       afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
 
-  if (afl->fsrv.map_size <= 8000000) {
+  if (!afl->non_instrumented_mode && !afl->fsrv.qemu_mode &&
+      !afl->unicorn_mode) {
 
-    afl->fsrv.map_size = 8000000;  // dummy temporary value
-    setenv("AFL_MAP_SIZE", "8000000", 1);
+    if (map_size <= 8000000&& !afl->non_instrumented_mode &&
+        !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
 
-  }
+      afl->fsrv.map_size = 8000000;  // dummy temporary value
+      setenv("AFL_MAP_SIZE", "8000000", 1);
 
-  u32 new_map_size = afl_fsrv_get_mapsize(
-      &afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
-
-  // only reinitialize when it makes sense
-  if (map_size < new_map_size ||
-      (new_map_size > map_size && new_map_size - map_size > MAP_SIZE &&
-       (!afl->cmplog_binary || new_map_size == MAP_SIZE))) {
-
-    OKF("Re-initializing maps to %u bytes", new_map_size);
-
-    afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
-    afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
-    afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
-    afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
-    afl->top_rated = ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
-    afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
-    afl->clean_trace_custom = ck_realloc(afl->clean_trace_custom, new_map_size);
-    afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
-    afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
-
-    afl_fsrv_kill(&afl->fsrv);
-    afl_shm_deinit(&afl->shm);
-    afl->fsrv.map_size = new_map_size;
-    afl->fsrv.trace_bits =
-        afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
-    setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
-    afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
-                   afl->afl_env.afl_debug_child);
-    map_size = new_map_size;
+    }
 
-  } else {
+    u32 new_map_size = afl_fsrv_get_mapsize(
+        &afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
+
+    if (new_map_size && new_map_size != map_size) {
+
+      // only reinitialize when it makes sense
+      if (map_size < new_map_size ||
+          (new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
+
+        OKF("Re-initializing maps to %u bytes", new_map_size);
+
+        afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
+        afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
+        afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
+        afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
+        afl->top_rated =
+            ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
+        afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
+        afl->clean_trace_custom =
+            ck_realloc(afl->clean_trace_custom, new_map_size);
+        afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
+        afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
+
+        afl_fsrv_kill(&afl->fsrv);
+        afl_shm_deinit(&afl->shm);
+        afl->fsrv.map_size = new_map_size;
+        afl->fsrv.trace_bits =
+            afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
+        setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
+        afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
+                       afl->afl_env.afl_debug_child);
 
-    afl->fsrv.map_size = map_size;
+      }
+
+      map_size = new_map_size;
+
+    } else {
+
+      afl->fsrv.map_size = map_size;
+
+    }
 
   }
 
@@ -1634,50 +1646,59 @@ int main(int argc, char **argv_orig, char **envp) {
     afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
     afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
 
+    if (map_size <= 8000000 && !afl->non_instrumented_mode &&
+        !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
+
+      afl->fsrv.map_size = 8000000;  // dummy temporary value
+      setenv("AFL_MAP_SIZE", "8000000", 1);
+
+    }
+
     u32 new_map_size =
         afl_fsrv_get_mapsize(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
                              afl->afl_env.afl_debug_child);
 
-    // only reinitialize when necessary
-    if (map_size < new_map_size ||
-        (new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
-
-      OKF("Re-initializing maps to %u bytes due cmplog", new_map_size);
-
-      afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
-      afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
-      afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
-      afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
-      afl->top_rated =
-          ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
-      afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
-      afl->clean_trace_custom =
-          ck_realloc(afl->clean_trace_custom, new_map_size);
-      afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
-      afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
-
-      afl_fsrv_kill(&afl->fsrv);
-      afl_fsrv_kill(&afl->cmplog_fsrv);
-      afl_shm_deinit(&afl->shm);
-      afl->cmplog_fsrv.map_size = new_map_size;  // non-cmplog stays the same
-
-      afl->fsrv.trace_bits =
-          afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
-      setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
-      afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
-                     afl->afl_env.afl_debug_child);
-
-      afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
-                     afl->afl_env.afl_debug_child);
+    if (new_map_size && new_map_size != map_size) {
 
-      map_size = new_map_size;
+      // only reinitialize when it needs to be larger
+      if (map_size < new_map_size) {
 
-    } else {
+        OKF("Re-initializing maps to %u bytes due cmplog", new_map_size);
+
+        afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
+        afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
+        afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
+        afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
+        afl->top_rated =
+            ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
+        afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
+        afl->clean_trace_custom =
+            ck_realloc(afl->clean_trace_custom, new_map_size);
+        afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
+        afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
+
+        afl_fsrv_kill(&afl->fsrv);
+        afl_fsrv_kill(&afl->cmplog_fsrv);
+        afl_shm_deinit(&afl->shm);
+        afl->cmplog_fsrv.map_size = new_map_size;  // non-cmplog stays the same
 
-      afl->cmplog_fsrv.map_size = map_size;
+        afl->fsrv.trace_bits =
+            afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
+        setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
+        afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
+                       afl->afl_env.afl_debug_child);
+
+        afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
+                       afl->afl_env.afl_debug_child);
+
+      }
+
+      map_size = new_map_size;
 
     }
 
+    afl->cmplog_fsrv.map_size = map_size;
+
     OKF("Cmplog forkserver successfully started");
 
   }
diff --git a/test/test-llvm.sh b/test/test-llvm.sh
index 6503cd98..1bcf013a 100755
--- a/test/test-llvm.sh
+++ b/test/test-llvm.sh
@@ -162,9 +162,9 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && {
   test -e test-floatingpoint && {
     mkdir -p in
     echo ZZZZ > in/in
-    $ECHO "$GREY[*] running afl-fuzz with floating point splitting, this will take max. 45 seconds"
+    $ECHO "$GREY[*] running afl-fuzz with floating point splitting, this will take max. 30 seconds"
     {
-      AFL_BENCH_UNTIL_CRASH=1 AFL_NO_UI=1 ../afl-fuzz -Z -s 1 -V45 -m ${MEM_LIMIT} -i in -o out -D -- ./test-floatingpoint >>errors 2>&1
+      AFL_BENCH_UNTIL_CRASH=1 AFL_NO_UI=1 ../afl-fuzz -Z -s 1 -V30 -m ${MEM_LIMIT} -i in -o out -D -- ./test-floatingpoint >>errors 2>&1
     } >>errors 2>&1
     test -n "$( ls out/default/crashes/id:* 2>/dev/null )" && {
       $ECHO "$GREEN[+] llvm_mode laf-intel floatingpoint splitting feature works correctly"