Merge pull request #800 from AFLplusplus/dev

push to stable

4 files changed, 89 insertions, 102 deletions

diff --git a/GNUmakefile b/GNUmakefile
index 871ee10d..6c89bc6f 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -24,7 +24,7 @@ BIN_PATH    = $(PREFIX)/bin
 HELPER_PATH = $(PREFIX)/lib/afl
 DOC_PATH    = $(PREFIX)/share/doc/afl
 MISC_PATH   = $(PREFIX)/share/afl
-MAN_PATH    = $(PREFIX)/man/man8
+MAN_PATH    = $(PREFIX)/share/man/man8
 
 PROGNAME    = afl
 VERSION     = $(shell grep '^$(HASH)define VERSION ' ../config.h | cut -d '"' -f2)
diff --git a/include/config.h b/include/config.h
index a3aa9a4a..6ada0fbe 100644
--- a/include/config.h
+++ b/include/config.h
@@ -54,10 +54,10 @@
 
 /* Number of potential positions from which we decide if cmplog becomes
    useless, default 8096 */
-#define CMPLOG_POSITIONS_MAX 8096U
+#define CMPLOG_POSITIONS_MAX (12 * 1024)
 
 /* Maximum allowed fails per CMP value. Default: 128 */
-#define CMPLOG_FAIL_MAX 128
+#define CMPLOG_FAIL_MAX 96
 
 /* Now non-cmplog configuration options */
 
diff --git a/src/afl-common.c b/src/afl-common.c
index 68f82a5e..9f6eb564 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -1123,7 +1123,7 @@ u8 *u_stringify_time_diff(u8 *buf, u64 cur_ms, u64 event_ms) {
 /* Reads the map size from ENV */
 u32 get_map_size(void) {
 
-  uint32_t map_size = (MAP_SIZE << 2);  // needed for target ctors :(
+  uint32_t map_size = 8000000;  // a very large default map
   char *   ptr;
 
   if ((ptr = getenv("AFL_MAP_SIZE")) || (ptr = getenv("AFL_MAPSIZE"))) {
@@ -1131,7 +1131,7 @@ u32 get_map_size(void) {
     map_size = atoi(ptr);
     if (!map_size || map_size > (1 << 29)) {
 
-      FATAL("illegal AFL_MAP_SIZE %u, must be between %u and %u", map_size, 32U,
+      FATAL("illegal AFL_MAP_SIZE %u, must be between %u and %u", map_size, 64U,
             1U << 29);
 
     }
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 8364c1c2..cd049fd5 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -351,7 +351,7 @@ int main(int argc, char **argv_orig, char **envp) {
   exit_1 = !!afl->afl_env.afl_bench_just_one;
 
   SAYF(cCYA "afl-fuzz" VERSION cRST
-            " based on afl by Michal Zalewski and a big online community\n");
+            " based on afl by Michal Zalewski and a large online community\n");
 
   doc_path = access(DOC_PATH, F_OK) != 0 ? (u8 *)"docs" : (u8 *)DOC_PATH;
 
@@ -1562,62 +1562,63 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-  afl->argv = use_argv;
-  afl->fsrv.trace_bits =
-      afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
-
-  if (!afl->non_instrumented_mode && !afl->fsrv.qemu_mode &&
-      !afl->unicorn_mode) {
-
-    u32 set_env = 0;
-    if (!getenv("AFL_MAP_SIZE")) {
-
-      afl->fsrv.map_size = 8000000;  // dummy temporary value
-      setenv("AFL_MAP_SIZE", "8000000", 1);
-      set_env = 1;
-
-    }
-
-    u32 prev_map_size = afl->fsrv.map_size;
+  if (afl->non_instrumented_mode || afl->fsrv.qemu_mode || afl->unicorn_mode) {
 
-    u32 new_map_size = afl_fsrv_get_mapsize(
-        &afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
+    map_size = afl->fsrv.map_size = MAP_SIZE;
+    afl->virgin_bits = ck_realloc(afl->virgin_bits, map_size);
+    afl->virgin_tmout = ck_realloc(afl->virgin_tmout, map_size);
+    afl->virgin_crash = ck_realloc(afl->virgin_crash, map_size);
+    afl->var_bytes = ck_realloc(afl->var_bytes, map_size);
+    afl->top_rated = ck_realloc(afl->top_rated, map_size * sizeof(void *));
+    afl->clean_trace = ck_realloc(afl->clean_trace, map_size);
+    afl->clean_trace_custom = ck_realloc(afl->clean_trace_custom, map_size);
+    afl->first_trace = ck_realloc(afl->first_trace, map_size);
+    afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, map_size);
 
-    if (new_map_size && new_map_size != prev_map_size) {
-
-      // only reinitialize when it makes sense
-      if (map_size < new_map_size ||
-          (new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
+  }
 
-        OKF("Re-initializing maps to %u bytes", new_map_size);
+  afl->argv = use_argv;
+  afl->fsrv.trace_bits =
+      afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
 
-        afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
-        afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
-        afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
-        afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
-        afl->top_rated =
-            ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
-        afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
-        afl->clean_trace_custom =
-            ck_realloc(afl->clean_trace_custom, new_map_size);
-        afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
-        afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
+  if (afl->fsrv.map_size <= 8000000) {
 
-        afl_fsrv_kill(&afl->fsrv);
-        afl_shm_deinit(&afl->shm);
-        afl->fsrv.map_size = new_map_size;
-        afl->fsrv.trace_bits =
-            afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
-        setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
-        afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
-                       afl->afl_env.afl_debug_child);
+    afl->fsrv.map_size = 8000000;  // dummy temporary value
+    setenv("AFL_MAP_SIZE", "8000000", 1);
 
-      }
+  }
 
-      map_size = new_map_size;
-      if (set_env) { unsetenv("AFL_MAP_SIZE"); }
+  u32 new_map_size = afl_fsrv_get_mapsize(
+      &afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
+
+  // only reinitialize when it makes sense
+  if (map_size < new_map_size ||
+      (new_map_size > map_size && new_map_size - map_size > MAP_SIZE &&
+       (!afl->cmplog_binary || new_map_size == MAP_SIZE))) {
+
+    OKF("Re-initializing maps to %u bytes", new_map_size);
+
+    afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
+    afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
+    afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
+    afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
+    afl->top_rated = ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
+    afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
+    afl->clean_trace_custom = ck_realloc(afl->clean_trace_custom, new_map_size);
+    afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
+    afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
+
+    afl_fsrv_kill(&afl->fsrv);
+    afl_shm_deinit(&afl->shm);
+    afl->fsrv.map_size = new_map_size;
+    afl->fsrv.trace_bits =
+        afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
+    setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
+    afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
+                   afl->afl_env.afl_debug_child);
+    map_size = new_map_size;
 
-    }
+  } else {
 
     afl->fsrv.map_size = map_size;
 
@@ -1633,64 +1634,50 @@ int main(int argc, char **argv_orig, char **envp) {
     afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
     afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
 
-    u32 set_env = 0;
-    if (!getenv("AFL_MAP_SIZE")) {
-
-      afl->fsrv.map_size = 8000000;  // dummy temporary value
-      setenv("AFL_MAP_SIZE", "8000000", 1);
-      set_env = 1;
-
-    }
-
-    u32 prev_map_size = afl->fsrv.map_size;
-
     u32 new_map_size =
         afl_fsrv_get_mapsize(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
                              afl->afl_env.afl_debug_child);
 
-    if (new_map_size && new_map_size != prev_map_size) {
-
-      // only reinitialize when it needs to be larger
-      if (map_size < new_map_size) {
-
-        OKF("Re-initializing maps to %u bytes due cmplog", new_map_size);
+    // only reinitialize when necessary
+    if (map_size < new_map_size ||
+        (new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
+
+      OKF("Re-initializing maps to %u bytes due cmplog", new_map_size);
+
+      afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
+      afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
+      afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
+      afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
+      afl->top_rated =
+          ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
+      afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
+      afl->clean_trace_custom =
+          ck_realloc(afl->clean_trace_custom, new_map_size);
+      afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
+      afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
+
+      afl_fsrv_kill(&afl->fsrv);
+      afl_fsrv_kill(&afl->cmplog_fsrv);
+      afl_shm_deinit(&afl->shm);
+      afl->cmplog_fsrv.map_size = new_map_size;  // non-cmplog stays the same
+
+      afl->fsrv.trace_bits =
+          afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
+      setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
+      afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
+                     afl->afl_env.afl_debug_child);
+
+      afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
+                     afl->afl_env.afl_debug_child);
 
-        afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
-        afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
-        afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
-        afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
-        afl->top_rated =
-            ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
-        afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
-        afl->clean_trace_custom =
-            ck_realloc(afl->clean_trace_custom, new_map_size);
-        afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
-        afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
-
-        afl_fsrv_kill(&afl->fsrv);
-        afl_fsrv_kill(&afl->cmplog_fsrv);
-        afl_shm_deinit(&afl->shm);
-        afl->cmplog_fsrv.map_size = new_map_size;  // non-cmplog stays the same
-
-        afl->fsrv.trace_bits =
-            afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
-        setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
-        afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
-                       afl->afl_env.afl_debug_child);
-
-        afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
-                       afl->afl_env.afl_debug_child);
-
-        map_size = new_map_size;
+      map_size = new_map_size;
 
-      }
+    } else {
 
-      if (set_env) { unsetenv("AFL_MAP_SIZE"); }
+      afl->cmplog_fsrv.map_size = map_size;
 
     }
 
-    afl->cmplog_fsrv.map_size = map_size;
-
     OKF("Cmplog forkserver successfully started");
 
   }