wipe overflow data

2 files changed, 22 insertions, 9 deletions

diff --git a/include/cmplog.h b/include/cmplog.h
index b95a8e43..76082121 100644
--- a/include/cmplog.h
+++ b/include/cmplog.h
@@ -48,7 +48,8 @@ struct cmp_header {
   unsigned shape : 5;
   unsigned type : 2;
   unsigned attribute : 4;
-  unsigned reserved : 5;
+  unsigned overflow : 1;
+  unsigned reserved : 4;
 
 } __attribute__((packed));
 
diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c
index 6ee86add..ff3998e6 100644
--- a/instrumentation/afl-compiler-rt.o.c
+++ b/instrumentation/afl-compiler-rt.o.c
@@ -1935,9 +1935,12 @@ void __cmplog_rtn_hook_n(u8 *ptr1, u8 *ptr2, u64 len) {
 
   struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k];
   hits &= CMP_MAP_RTN_H - 1;
-  if (unlikely(reset && !hits)) {
 
-    __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands));
+  if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; }
+
+  if (unlikely(__afl_cmp_map->headers[k].overflow)) {
+
+    __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands));
 
   }
 
@@ -1988,9 +1991,12 @@ void __cmplog_rtn_hook_strn(u8 *ptr1, u8 *ptr2, u64 len) {
 
   struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k];
   hits &= CMP_MAP_RTN_H - 1;
-  if (unlikely(reset && !hits)) {
 
-    __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands));
+  if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; }
+
+  if (unlikely(__afl_cmp_map->headers[k].overflow)) {
+
+    __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands));
 
   }
 
@@ -2043,9 +2049,12 @@ void __cmplog_rtn_hook_str(u8 *ptr1, u8 *ptr2) {
 
   struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k];
   hits &= CMP_MAP_RTN_H - 1;
-  if (unlikely(reset && !hits)) {
 
-    __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands));
+  if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; }
+
+  if (unlikely(__afl_cmp_map->headers[k].overflow)) {
+
+    __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands));
 
   }
 
@@ -2106,9 +2115,12 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
 
   struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k];
   hits &= CMP_MAP_RTN_H - 1;
-  if (unlikely(reset && !hits)) {
 
-    __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands));
+  if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; }
+
+  if (unlikely(__afl_cmp_map->headers[k].overflow)) {
+
+    __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands));
 
   }