change map_size tests

2 files changed, 29 insertions, 9 deletions

diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 82ec3069..68995388 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -821,7 +821,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
            "    - The target binary requires a large map and crashes before "
            "reporting.\n"
-           "      Set a high value (e.g. AFL_MAP_SIZE=1024000) or use "
+           "      Set a high value (e.g. AFL_MAP_SIZE=8000000) or use "
            "AFL_DEBUG=1 to see the\n"
            "      message from the target binary\n\n"
 
@@ -848,7 +848,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
            "    - The target binary requires a large map and crashes before "
            "reporting.\n"
-           "      Set a high value (e.g. AFL_MAP_SIZE=1024000) or use "
+           "      Set a high value (e.g. AFL_MAP_SIZE=8000000) or use "
            "AFL_DEBUG=1 to see the\n"
            "      message from the target binary\n\n"
 
@@ -914,7 +914,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
          "handshake with the injected code.\n"
          "Most likely the target has a huge coverage map, retry with setting"
          " the\n"
-         "environment variable AFL_MAP_SIZE=4194304\n"
+         "environment variable AFL_MAP_SIZE=8000000\n"
          "Otherwise there is a horrible bug in the fuzzer.\n"
          "Poke <afl-users@googlegroups.com> for troubleshooting tips.\n");
 
@@ -933,7 +933,7 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
         "    - Most likely the target has a huge coverage map, retry with "
         "setting the\n"
-        "      environment variable AFL_MAP_SIZE=4194304\n\n"
+        "      environment variable AFL_MAP_SIZE=8000000\n\n"
 
         "    - The current memory limit (%s) is too restrictive, causing an "
         "OOM\n"
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 065010fa..8364c1c2 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1569,13 +1569,21 @@ int main(int argc, char **argv_orig, char **envp) {
   if (!afl->non_instrumented_mode && !afl->fsrv.qemu_mode &&
       !afl->unicorn_mode) {
 
-    afl->fsrv.map_size = 4194304;  // dummy temporary value
-    setenv("AFL_MAP_SIZE", "4194304", 1);
+    u32 set_env = 0;
+    if (!getenv("AFL_MAP_SIZE")) {
+
+      afl->fsrv.map_size = 8000000;  // dummy temporary value
+      setenv("AFL_MAP_SIZE", "8000000", 1);
+      set_env = 1;
+
+    }
+
+    u32 prev_map_size = afl->fsrv.map_size;
 
     u32 new_map_size = afl_fsrv_get_mapsize(
         &afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
 
-    if (new_map_size && new_map_size != 4194304) {
+    if (new_map_size && new_map_size != prev_map_size) {
 
       // only reinitialize when it makes sense
       if (map_size < new_map_size ||
@@ -1607,6 +1615,7 @@ int main(int argc, char **argv_orig, char **envp) {
       }
 
       map_size = new_map_size;
+      if (set_env) { unsetenv("AFL_MAP_SIZE"); }
 
     }
 
@@ -1624,13 +1633,22 @@ int main(int argc, char **argv_orig, char **envp) {
     afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
     afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
 
-    afl->cmplog_fsrv.map_size = 4194304;
+    u32 set_env = 0;
+    if (!getenv("AFL_MAP_SIZE")) {
+
+      afl->fsrv.map_size = 8000000;  // dummy temporary value
+      setenv("AFL_MAP_SIZE", "8000000", 1);
+      set_env = 1;
+
+    }
+
+    u32 prev_map_size = afl->fsrv.map_size;
 
     u32 new_map_size =
         afl_fsrv_get_mapsize(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
                              afl->afl_env.afl_debug_child);
 
-    if (new_map_size && new_map_size != 4194304) {
+    if (new_map_size && new_map_size != prev_map_size) {
 
       // only reinitialize when it needs to be larger
       if (map_size < new_map_size) {
@@ -1667,6 +1685,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
       }
 
+      if (set_env) { unsetenv("AFL_MAP_SIZE"); }
+
     }
 
     afl->cmplog_fsrv.map_size = map_size;