about summary refs log tree commit diff
path: root/instrumentation/compare-transform-pass.so.cc
diff options
context:
space:
mode:
authorvanhauser-thc <vh@thc.org>2021-03-05 10:05:43 +0100
committervanhauser-thc <vh@thc.org>2021-03-05 10:05:43 +0100
commit3342aa751d8e9102449e1739b38a25c40ab18e81 (patch)
tree7afcfab5751461d5bc0bceec07c9b0d98155e118 /instrumentation/compare-transform-pass.so.cc
parenta2f40aa285faa75e78ac1ffffe8d79e2ac1a40da (diff)
downloadafl++-3342aa751d8e9102449e1739b38a25c40ab18e81.tar.gz
fix laf string transform crash
Diffstat (limited to 'instrumentation/compare-transform-pass.so.cc')
-rw-r--r--instrumentation/compare-transform-pass.so.cc11
1 files changed, 9 insertions, 2 deletions
diff --git a/instrumentation/compare-transform-pass.so.cc b/instrumentation/compare-transform-pass.so.cc
index a85522a2..3ecba4e6 100644
--- a/instrumentation/compare-transform-pass.so.cc
+++ b/instrumentation/compare-transform-pass.so.cc
@@ -316,7 +316,7 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
               uint64_t len = ilen->getZExtValue();
               // if len is zero this is a pointless call but allow real
               // implementation to worry about that
-              if (!len) continue;
+              if (len < 2) continue;
 
               if (isMemcmp) {
 
@@ -420,8 +420,15 @@ bool CompareTransform::transformCmps(Module &M, const bool processStrcmp,
 
     }
 
+    if (TmpConstStr.length() < 2 ||
+        (TmpConstStr.length() == 2 && !TmpConstStr[1])) {
+
+      continue;
+
+    }
+
     // add null termination character implicit in c strings
-    if (TmpConstStr[TmpConstStr.length() - 1] != 0) {
+    if (!isMemcmp && TmpConstStr[TmpConstStr.length() - 1]) {
 
       TmpConstStr.append("\0", 1);