cmplog loop detection

3 files changed, 69 insertions, 35 deletions

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 3a81cc85..9da9452a 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -574,6 +574,7 @@ typedef struct afl_state {
   u32 cmplog_prev_timed_out;
 
   struct afl_pass_stat* pass_stats;
+  struct cmp_map *orig_cmp_map;
 
   u8 describe_op_buf_256[256]; /* describe_op will use this to return a string
                                   up to 256 */
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index 82753d0c..1ba36245 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -234,17 +234,15 @@ static u8 its_fuzz(afl_state_t *afl, u8 *buf, u32 len, u8 *status) {
 
 }
 
-static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
-                              u64 pattern, u64 repl, u32 idx, u8 *orig_buf,
-                              u8 *buf, u32 len, u8 do_reverse, u8 *status) {
+static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h, u64 pattern, u64 repl, u64 o_pattern, u32 idx, u8 *orig_buf, u8 *buf, u32 len, u8 do_reverse, u8 *status) {
 
   u64 *buf_64 = (u64 *)&buf[idx];
   u32 *buf_32 = (u32 *)&buf[idx];
   u16 *buf_16 = (u16 *)&buf[idx];
   // u8*  buf_8  = &buf[idx];
-  // u64* o_buf_64 = (u64*)&orig_buf[idx];
-  // u32* o_buf_32 = (u32*)&orig_buf[idx];
-  // u16* o_buf_16 = (u16*)&orig_buf[idx];
+  u64* o_buf_64 = (u64*)&orig_buf[idx];
+  u32* o_buf_32 = (u32*)&orig_buf[idx];
+  u16* o_buf_16 = (u16*)&orig_buf[idx];
   // u8*  o_buf_8  = &orig_buf[idx];
 
   u32 its_len = len - idx;
@@ -252,7 +250,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
   if (SHAPE_BYTES(h->shape) == 8) {
 
-    if (its_len >= 8 && *buf_64 == pattern) {  // && *o_buf_64 == pattern) {
+    if (its_len >= 8 && *buf_64 == pattern && *o_buf_64 == o_pattern) {
 
       *buf_64 = repl;
       if (unlikely(its_fuzz(afl, buf, len, status))) return 1;
@@ -262,8 +260,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
     // reverse encoding
     if (do_reverse)
-      if (unlikely(cmp_extend_encoding(afl, h, SWAP64(pattern), SWAP64(repl),
-                                       idx, orig_buf, buf, len, 0, status)))
+      if (unlikely(cmp_extend_encoding(afl, h, SWAP64(pattern), SWAP64(repl), SWAP64(o_pattern), idx, orig_buf, buf, len, 0, status)))
         return 1;
 
   }
@@ -271,7 +268,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
   if (SHAPE_BYTES(h->shape) == 4 || *status == 2) {
 
     if (its_len >= 4 &&
-        *buf_32 == (u32)pattern) {  // && *o_buf_32 == (u32)pattern) {
+        *buf_32 == (u32)pattern && *o_buf_32 == (u32)o_pattern) {
 
       *buf_32 = (u32)repl;
       if (unlikely(its_fuzz(afl, buf, len, status))) return 1;
@@ -281,8 +278,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
     // reverse encoding
     if (do_reverse)
-      if (unlikely(cmp_extend_encoding(afl, h, SWAP32(pattern), SWAP32(repl),
-                                       idx, orig_buf, buf, len, 0, status)))
+      if (unlikely(cmp_extend_encoding(afl, h, SWAP32(pattern), SWAP32(repl), SWAP32(o_pattern), idx, orig_buf, buf, len, 0, status)))
         return 1;
 
   }
@@ -290,7 +286,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
   if (SHAPE_BYTES(h->shape) == 2 || *status == 2) {
 
     if (its_len >= 2 &&
-        *buf_16 == (u16)pattern) {  // && *o_buf_16 == (u16)pattern) {
+        *buf_16 == (u16)pattern && *o_buf_16 == (u16)o_pattern) {
 
       *buf_16 = (u16)repl;
       if (unlikely(its_fuzz(afl, buf, len, status))) return 1;
@@ -300,15 +296,14 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
     // reverse encoding
     if (do_reverse)
-      if (unlikely(cmp_extend_encoding(afl, h, SWAP16(pattern), SWAP16(repl),
-                                       idx, orig_buf, buf, len, 0, status)))
+      if (unlikely(cmp_extend_encoding(afl, h, SWAP16(pattern), SWAP16(repl), SWAP16(o_pattern), idx, orig_buf, buf, len, 0, status)))
         return 1;
 
   }
 
   /*if (SHAPE_BYTES(h->shape) == 1 || *status == 2) {
 
-    if (its_len >= 2 && *buf_8 == (u8)pattern) {// && *o_buf_8 == (u8)pattern) {
+    if (its_len >= 2 && *buf_8 == (u8)pattern && *o_buf_8 == (u8)o_pattern) {
 
       *buf_8 = (u8)repl;
       if (unlikely(its_fuzz(afl, buf, len, status)))
@@ -377,12 +372,35 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
   // opt not in the paper
   u32 fails;
   u8 found_one = 0;
+  
+  /* loop cmps are useless, detect and blacklist them */
+  u64 s_v0, s_v1;
+  u8 s_v0_fixed = 1, s_v1_fixed = 1;
+  u8 s_v0_inc = 1, s_v1_inc = 1;
+  u8 s_v0_dec = 1, s_v1_dec = 1;
 
   for (i = 0; i < loggeds; ++i) {
   
     fails = 0;
 
     struct cmp_operands *o = &afl->shm.cmp_map->log[key][i];
+    
+    // loop detection code
+    if (i == 0) {
+      s_v0 = o->v0;
+      s_v1 = o->v1;
+    } else {
+      if (s_v0 != o->v0) s_v0_fixed = 0;
+      if (s_v1 != o->v1) s_v1_fixed = 0;
+      if (s_v0 +1 != o->v0) s_v0_inc = 0;
+      if (s_v1 +1 != o->v1) s_v1_inc = 0;
+      if (s_v0 -1 != o->v0) s_v0_dec = 0;
+      if (s_v1 -1 != o->v1) s_v1_dec = 0;
+      s_v0 = o->v0;
+      s_v1 = o->v1;
+    }
+    
+    struct cmp_operands *orig_o = &afl->orig_cmp_map->log[key][i];
 
     // opt not in the paper
     for (j = 0; j < i; ++j)
@@ -392,16 +410,14 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
 
     for (idx = 0; idx < len && fails < 8; ++idx) {
 
-      if (unlikely(cmp_extend_encoding(afl, h, o->v0, o->v1, idx, orig_buf, buf,
-                                       len, 1, &status)))
+      if (unlikely(cmp_extend_encoding(afl, h, o->v0, o->v1, orig_o->v0, idx, orig_buf, buf, len, 1, &status)))
         return 1;
       if (status == 2)
         ++fails;
       else if (status == 1)
         break;
 
-      if (unlikely(cmp_extend_encoding(afl, h, o->v1, o->v0, idx, orig_buf, buf,
-                                       len, 1, &status)))
+      if (unlikely(cmp_extend_encoding(afl, h, o->v1, o->v0, orig_o->v1, idx, orig_buf, buf, len, 1, &status)))
         return 1;
       if (status == 2)
         ++fails;
@@ -428,6 +444,11 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
 
   }
   
+  if (loggeds > 3 && ((s_v0_fixed && s_v1_inc) || (s_v1_fixed && s_v0_inc) ||
+                      (s_v0_fixed && s_v1_dec) || (s_v1_fixed && s_v0_dec))) {
+    afl->pass_stats[key].total = afl->pass_stats[key].faileds = 0xff;
+  }
+  
   if (!found_one && afl->pass_stats[key].faileds < 0xff) {
     afl->pass_stats[key].faileds++;
   }
@@ -437,9 +458,7 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
 
 }
 
-static u8 rtn_extend_encoding(afl_state_t *afl, struct cmp_header *h,
-                              u8 *pattern, u8 *repl, u32 idx, u8 *orig_buf,
-                              u8 *buf, u32 len, u8 *status) {
+static u8 rtn_extend_encoding(afl_state_t *afl, struct cmp_header *h, u8 *pattern, u8 *repl, u8* o_pattern, u32 idx, u8 *orig_buf, u8 *buf, u32 len, u8 *status) {
 
   u32 i;
   u32 its_len = MIN(32, len - idx);
@@ -451,7 +470,7 @@ static u8 rtn_extend_encoding(afl_state_t *afl, struct cmp_header *h,
 
   for (i = 0; i < its_len; ++i) {
 
-    if (pattern[idx + i] != buf[idx + i] || *status == 1) break;
+    if (pattern[idx + i] != buf[idx + i] || o_pattern[idx + i] != orig_buf[idx + i] || *status == 1) break;
 
     buf[idx + i] = repl[idx + i];
     if (unlikely(its_fuzz(afl, buf, len, status))) return 1;
@@ -482,6 +501,9 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
 
     struct cmpfn_operands *o =
         &((struct cmpfn_operands *)afl->shm.cmp_map->log[key])[i];
+    
+    struct cmpfn_operands *orig_o =
+        &((struct cmpfn_operands *)afl->orig_cmp_map->log[key])[i];
 
     // opt not in the paper
     for (j = 0; j < i; ++j)
@@ -491,16 +513,14 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
 
     for (idx = 0; idx < len && fails < 8; ++idx) {
 
-      if (unlikely(rtn_extend_encoding(afl, h, o->v0, o->v1, idx, orig_buf, buf,
-                                       len, &status)))
+      if (unlikely(rtn_extend_encoding(afl, h, o->v0, o->v1, orig_o->v0, idx, orig_buf, buf, len, &status)))
         return 1;
       if (status == 2)
         ++fails;
       else if (status == 1)
         break;
 
-      if (unlikely(rtn_extend_encoding(afl, h, o->v1, o->v0, idx, orig_buf, buf,
-                                       len, &status)))
+      if (unlikely(rtn_extend_encoding(afl, h, o->v1, o->v0, orig_o->v1, idx, orig_buf, buf, len, &status)))
         return 1;
       if (status == 2)
         ++fails;
@@ -543,9 +563,18 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
                         u32 exec_cksum) {
 
   u8 r = 1;
+  if (afl->orig_cmp_map == NULL)
+    afl->orig_cmp_map = ck_alloc_nozero(sizeof(struct cmp_map));
   
   if (afl->pass_stats == NULL)
     afl->pass_stats = ck_alloc(sizeof(struct afl_pass_stat) * CMP_MAP_W);
+  
+  // do it manually, forkserver clear only afl->fsrv.trace_bits
+  memset(afl->shm.cmp_map->headers, 0, sizeof(afl->shm.cmp_map->headers));
+  
+  if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) return 1;
+
+  memcpy(afl->orig_cmp_map, afl->shm.cmp_map, sizeof(struct cmp_map));
 
   if (unlikely(colorization(afl, buf, len, exec_cksum))) return 1;
 
@@ -569,9 +598,9 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
     if (!afl->shm.cmp_map->headers[k].hits) continue;
     
     if (afl->pass_stats[k].total &&
-        (rand_below(afl, afl->pass_stats[k].total) < afl->pass_stats[k].faileds
+        (rand_below(afl, afl->pass_stats[k].total) >= afl->pass_stats[k].faileds
          || afl->pass_stats[k].total == 0xff))
-      afl->shm.cmp_map->headers[k].hits = 0;
+      afl->shm.cmp_map->headers[k].hits = 0; // blacklist this cmp
     
     if (afl->shm.cmp_map->headers[k].type == CMP_TYPE_INS)
       afl->stage_max += MIN((u32)afl->shm.cmp_map->headers[k].hits, CMP_MAP_H);
@@ -587,11 +616,13 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
 
     if (afl->shm.cmp_map->headers[k].type == CMP_TYPE_INS) {
 
-      if (unlikely(cmp_fuzz(afl, k, orig_buf, buf, len))) goto exit_its;
+      if (unlikely(cmp_fuzz(afl, k, orig_buf, buf, len)))
+        goto exit_its;
 
     } else {
 
-      if (unlikely(rtn_fuzz(afl, k, orig_buf, buf, len))) goto exit_its;
+      if (unlikely(rtn_fuzz(afl, k, orig_buf, buf, len)))
+        goto exit_its;
 
     }
 
@@ -600,11 +631,11 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
   r = 0;
 
 exit_its:
-  memcpy(orig_buf, buf, len);
-
   new_hit_cnt = afl->queued_paths + afl->unique_crashes;
   afl->stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt;
   afl->stage_cycles[STAGE_ITS] += afl->total_execs - orig_execs;
+  
+  memcpy(orig_buf, buf, len);
 
   return r;
 
diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c
index f58345fb..87d74afa 100644
--- a/src/afl-fuzz-state.c
+++ b/src/afl-fuzz-state.c
@@ -361,6 +361,8 @@ void afl_state_deinit(afl_state_t *afl) {
   if (afl->post_deinit) afl->post_deinit(afl->post_data);
   if (afl->in_place_resume) ck_free(afl->in_dir);
   if (afl->sync_id) ck_free(afl->out_dir);
+  if (afl->pass_stats) ck_free(afl->pass_stats);
+  if (afl->orig_cmp_map) ck_free(afl->orig_cmp_map);
 
   free(afl->out_buf);
   free(afl->out_scratch_buf);
@@ -368,7 +370,7 @@ void afl_state_deinit(afl_state_t *afl) {
   free(afl->in_buf);
   free(afl->in_scratch_buf);
   free(afl->ex_buf);
-
+  
   list_remove(&afl_states, afl);
 
 }