Merge branch 'master-upstream' into custom_mutator_docs

# Conflicts:
#	afl-fuzz.c

1 files changed, 42 insertions, 15 deletions

diff --git a/TODO b/TODO
index 3d1e444d..26311713 100644
--- a/TODO
+++ b/TODO
@@ -1,34 +1,61 @@
 Roadmap 2.53d:
 ==============
- - indent all the code: clang-format -style=Google
-
- - update docs/sister_projects.txt
 
 afl-fuzz:
- - put mutator, scheduler, forkserver and input channels in individual files
- - reuse forkserver for showmap, afl-cmin, etc.
+ - custom mutator lib: example and readme
+
+man:
+ - man page for afl-clang-fast
+
+
+Roadmap 2.54d:
+==============
 
 gcc_plugin:
  - needs to be rewritten
- - fix crashes when compiling :(
  - whitelist support
  - skip over uninteresting blocks
  - laf-intel
  - neverZero
 
 qemu_mode:
- - deferred mode with AFL_DEFERRED_QEMU=0xaddress
+ - update to 4.x (probably this will be skipped :( )
 
 unit testing / or large testcase campaign
 
-
-Roadmap 2.54d:
-==============
- - expand MAP size to 256k (current L2 cache size on processors)
-   -> 18 bit map
- - llvm_mode: dynamic map size and collission free basic block IDs
-
+Problem: Average targets (tiff, jpeg, unrar) go through 1500 edges.
+         At afl's default map that means ~16 collisions and ~3 wrappings.
+  Solution #1: increase map size.
+    every +1 decreases fuzzing speed by ~10% and halfs the collisions
+    birthday paradox predicts collisions at this # of edges:
+     mapsize => collisions
+	2^16 = 302
+	2^17 = 427
+	2^18 = 603
+	2^19 = 853
+	2^20 = 1207
+	2^21 = 1706
+	2^22 = 2412
+	2^23 = 3411
+	2^24 = 4823
+    Increasing the map is an easy solution but also not a good one.
+  Solution #2: use dynamic map size and collision free basic block IDs
+    This only works in llvm_mode and llvm >= 9 though
+    A potential good future solution. Heiko/hexcoder follows this up
+  Solution #3: write instruction pointers to a big shared map
+    512kb/1MB shared map and the instrumented code writes the instruction
+    pointer into the map. Map must be big enough but could be command line
+    controlled.
+    Good: complete coverage information, nothing is lost. choice of analysis
+          impacts speed, but this can be decided by user options
+    Neutral: a little bit slower but no loss of coverage
+    Bad: completely changes how afl uses the map and the scheduling.
+    Overall another very good solution, Marc Heuse/vanHauser follows this up
+    
 qemu_mode:
  - persistent mode patching the return address (WinAFL style)
- - instrument only comparison with immediate values by default when using compcov
+ - deferred mode with AFL_DEFERRED_QEMU=0xaddress
+   (AFL_ENTRYPOINT let you to specify only a basic block address as starting
+    point. This will be implemented togheter with the logic for persistent
+    mode.)