diff options
author | h1994st <h1994st@gmail.com> | 2020-03-30 05:21:01 -0400 |
---|---|---|
committer | Dominik Maier <domenukk@gmail.com> | 2020-04-01 13:10:07 +0200 |
commit | 61ea39861271fd54a193a14d3adbb72c072df75f (patch) | |
tree | 3e4f864f95b0dced8a7c9500e63c0e499d739221 /examples | |
parent | 64e1d3a975b5d4f017fabdc921cb59128db1c18a (diff) | |
download | afl++-61ea39861271fd54a193a14d3adbb72c072df75f.tar.gz |
Fix heap allocation bug
- Reason: `afl->out_size` is not consistent with the actual allocation of `afl->out_buf`. The deleted line in `src/afl-fuzz-one.c` may change `afl->out_size`, but `afl->out_buf` is not changed
Diffstat (limited to 'examples')
-rw-r--r-- | examples/custom_mutators/example.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/examples/custom_mutators/example.c b/examples/custom_mutators/example.c index 7d827029..ec47104d 100644 --- a/examples/custom_mutators/example.c +++ b/examples/custom_mutators/example.c @@ -159,13 +159,13 @@ size_t afl_custom_pre_save(my_mutator_t *data, uint8_t *buf, size_t buf_size, uint8_t *pre_save_buf = data->pre_save_buf; - memcpy(pre_save_buf + 5, buf, buf_size); + memcpy(pre_save_buf, buf, buf_size); size_t out_buf_size = buf_size + 5; - pre_save_buf[0] = 'A'; - pre_save_buf[1] = 'F'; - pre_save_buf[2] = 'L'; - pre_save_buf[3] = '+'; - pre_save_buf[4] = '+'; + pre_save_buf[buf_size + 0] = 'A'; + pre_save_buf[buf_size + 1] = 'F'; + pre_save_buf[buf_size + 2] = 'L'; + pre_save_buf[buf_size + 3] = '+'; + pre_save_buf[buf_size + 4] = '+'; *out_buf = pre_save_buf; |