hopefully better -z algorithm

1 files changed, 20 insertions, 6 deletions

diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 3335e869..6fc3c743 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -75,12 +75,6 @@ double compute_weight(afl_state_t *afl, struct queue_entry *q,
   weight *= (log(q->bitmap_size) / avg_bitmap_size);
   weight *= (1 + (q->tc_ref / avg_top_size));
 
-  if (unlikely(afl->prefer_new)) {
-
-    weight *= (2.0 * ((1 + q->id) / afl->queued_items));
-
-  }
-
   if (unlikely(weight < 0.1)) { weight = 0.1; }
   if (unlikely(q->favored)) { weight *= 5; }
   if (unlikely(!q->was_fuzzed)) { weight *= 2; }
@@ -155,6 +149,26 @@ void create_alias_table(afl_state_t *afl) {
 
     }
 
+    if (unlikely(afl->prefer_new) && afl->queued_discovered) {
+
+      double avg_weight = sum / active;
+
+      for (i = n - afl->queued_discovered; i < n; i++) {
+
+        struct queue_entry *q = afl->queue_buf[i];
+
+        if (likely(!q->disabled) && q->weight > avg_weight) {
+
+          double prev_weight = q->weight;
+          q->weight *= (2.0 * (i / n));
+          sum += (q->weight - prev_weight);
+
+        }
+
+      }
+
+    }
+
     for (i = 0; i < n; i++) {
 
       // weight is always 0 for disabled entries