using unbiased rand_below

1 files changed, 6 insertions, 1 deletions

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 24e8ca9b..5c391049 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -1027,7 +1027,12 @@ static inline u32 rand_below(afl_state_t *afl, u32 limit) {
 
   }
 
-  return rand_next(afl) % limit;
+  /* Modulo is biased - we don't want our fuzzing to be biased so let's do it right. */
+  u64 unbiased_rnd; 
+  do {
+    unbiased_rnd = rand_next(afl);
+  } while (unbiased_rnd >= (UINT64_MAX - (UINT64_MAX % limit)));
+  return unbiased_rnd % limit;
 
 }