diff options
| author | van Hauser <vh@thc.org> | 2022-03-07 09:52:34 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-03-07 09:52:34 +0100 |
| commit | ae9897ff7b31b9135b85f78a9a0e4c036d8a0abd (patch) | |
| tree | 5be81ef1feb7511467bab4e84553898335a0f9c9 | |
| parent | d29773825594e7249e8a3a80b344a69249e7ab9a (diff) | |
| parent | 2a00f32666a847b7babb160bb7c27db59cec9561 (diff) | |
| download | afl++-ae9897ff7b31b9135b85f78a9a0e4c036d8a0abd.tar.gz | |
Merge pull request #1346 from mchesser/patches
Fix Shm trim bug and OOB accesses during Redqueen mutations.
| -rw-r--r-- | src/afl-fuzz-redqueen.c | 4 | ||||
| -rw-r--r-- | src/afl-fuzz-run.c | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c index 1e4b1b3c..2f32ef1e 100644 --- a/src/afl-fuzz-redqueen.c +++ b/src/afl-fuzz-redqueen.c @@ -2136,7 +2136,7 @@ static u8 rtn_extend_encoding(afl_state_t *afl, u8 entry, if ((i % 2)) { - if (len > idx + i && is_hex(orig_buf + idx + i)) { + if (len > idx + i + 1 && is_hex(orig_buf + idx + i)) { fromhex += 2; @@ -2323,7 +2323,7 @@ static u8 rtn_extend_encoding(afl_state_t *afl, u8 entry, if (unlikely(its_fuzz(afl, buf, len, status))) { return 1; } // fprintf(stderr, "RTN ATTEMPT fromhex %u result %u\n", fromhex, // *status); - memcpy(buf + idx + i, save + i, i + 1 + off); + memcpy(buf + idx, save, i + 1 + off); } diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c index 5da0e583..2a9d186b 100644 --- a/src/afl-fuzz-run.c +++ b/src/afl-fuzz-run.c @@ -232,7 +232,7 @@ static void write_with_gap(afl_state_t *afl, u8 *mem, u32 len, u32 skip_at, memcpy(afl->fsrv.shmem_fuzz, mem, skip_at); - memcpy(afl->fsrv.shmem_fuzz, mem + skip_at + skip_len, tail_len); + memcpy(afl->fsrv.shmem_fuzz + skip_at, mem + skip_at + skip_len, tail_len); } |