diff options
| author | van Hauser <vh@thc.org> | 2023-12-05 17:56:06 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-12-05 17:56:06 +0100 |
| commit | 12505861564c5a3b91220adbb944032a261d6fa4 (patch) | |
| tree | 6e66ac8cbdd8237009c24b6f6b51d5f48913ce54 /src/afl-fuzz-redqueen.c | |
| parent | 61e27c6b54f7641a168b6acc6ecffb1754c10918 (diff) | |
| parent | 638273e4f80ba89ada8a4428a6211ee6b59d964a (diff) | |
| download | afl++-12505861564c5a3b91220adbb944032a261d6fa4.tar.gz | |
Merge pull request #1923 from AFLplusplus/dev
push to stable
Diffstat (limited to 'src/afl-fuzz-redqueen.c')
| -rw-r--r-- | src/afl-fuzz-redqueen.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c index 86e7f1cf..9e9b3822 100644 --- a/src/afl-fuzz-redqueen.c +++ b/src/afl-fuzz-redqueen.c @@ -1321,7 +1321,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h, } else { #ifndef WORD_SIZE_64 - if (repl <= 0x00ffffffffffffff { + if (repl <= 0x00ffffffffffffff) { new_val = repl << 8; u8 scale_len = 0; @@ -1379,7 +1379,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h, new_vall += (scale_len << 2) + 3; ilen = scale_len + 5; - if (ilen <= its_len) { + if (ilen <= its_len && ilen > 1) { u8 tmpbuf[32]; memcpy(tmpbuf, buf + idx, ilen); @@ -1403,7 +1403,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h, if (do_call) { - if (ilen <= its_len) { + if (ilen <= its_len && ilen > 1) { u8 tmpbuf[32]; memcpy(tmpbuf, buf + idx, ilen); @@ -1421,7 +1421,7 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h, } - // here we add and subract 1 from the value, but only if it is not an + // here we add and subtract 1 from the value, but only if it is not an // == or != comparison // Bits: 1 = Equal, 2 = Greater, 4 = Lesser, 8 = Float // 16 = modified float, 32 = modified integer (modified = wont match @@ -1906,6 +1906,8 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf, #endif + if (hshape < 2) { return 0; } + for (i = 0; i < loggeds; ++i) { struct cmp_operands *o = &afl->shm.cmp_map->log[key][i]; @@ -2698,6 +2700,8 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u8 *cbuf, hshape = SHAPE_BYTES(h->shape); + if (hshape < 2) { return 0; } + if (h->hits > CMP_MAP_RTN_H) { loggeds = CMP_MAP_RTN_H; |