Merge pull request #806 from AFLplusplus/dev

Dev

2 files changed, 59 insertions, 41 deletions

diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index bd856088..2e7de7b3 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -823,7 +823,12 @@ void show_stats(afl_state_t *afl) {
     SAYF(bV bSTOP " total execs : " cRST "%-20s " bSTG bV bSTOP
                   " total crashes : %s%-22s" bSTG         bV "\n",
          u_stringify_int(IB(0), afl->fsrv.total_execs),
-         afl->unique_crashes ? cLRD : cRST, tmp);
+         // New crashes this round -> Red, restored crashes -> yellow, else
+         // white.
+         afl->total_crashes    ? cLRD
+         : afl->unique_crashes ? cYEL
+                               : cRST,
+         tmp);
 
   }
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index cd049fd5..dbf4df37 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1581,44 +1581,51 @@ int main(int argc, char **argv_orig, char **envp) {
   afl->fsrv.trace_bits =
       afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
 
-  if (afl->fsrv.map_size <= 8000000) {
+  if (!afl->non_instrumented_mode && !afl->fsrv.qemu_mode &&
+      !afl->unicorn_mode) {
 
-    afl->fsrv.map_size = 8000000;  // dummy temporary value
-    setenv("AFL_MAP_SIZE", "8000000", 1);
+    if (map_size <= 8000000 && !afl->non_instrumented_mode &&
+        !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
 
-  }
+      afl->fsrv.map_size = 8000000;  // dummy temporary value
+      setenv("AFL_MAP_SIZE", "8000000", 1);
 
-  u32 new_map_size = afl_fsrv_get_mapsize(
-      &afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
-
-  // only reinitialize when it makes sense
-  if (map_size < new_map_size ||
-      (new_map_size > map_size && new_map_size - map_size > MAP_SIZE &&
-       (!afl->cmplog_binary || new_map_size == MAP_SIZE))) {
-
-    OKF("Re-initializing maps to %u bytes", new_map_size);
-
-    afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
-    afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
-    afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
-    afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
-    afl->top_rated = ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
-    afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
-    afl->clean_trace_custom = ck_realloc(afl->clean_trace_custom, new_map_size);
-    afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
-    afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
-
-    afl_fsrv_kill(&afl->fsrv);
-    afl_shm_deinit(&afl->shm);
-    afl->fsrv.map_size = new_map_size;
-    afl->fsrv.trace_bits =
-        afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
-    setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
-    afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
-                   afl->afl_env.afl_debug_child);
-    map_size = new_map_size;
+    }
 
-  } else {
+    u32 new_map_size = afl_fsrv_get_mapsize(
+        &afl->fsrv, afl->argv, &afl->stop_soon, afl->afl_env.afl_debug_child);
+
+    // only reinitialize when it makes sense
+    if (map_size < new_map_size ||
+        (!afl->cmplog_binary && new_map_size < map_size &&
+         map_size - new_map_size > MAP_SIZE)) {
+
+      OKF("Re-initializing maps to %u bytes", new_map_size);
+
+      afl->virgin_bits = ck_realloc(afl->virgin_bits, new_map_size);
+      afl->virgin_tmout = ck_realloc(afl->virgin_tmout, new_map_size);
+      afl->virgin_crash = ck_realloc(afl->virgin_crash, new_map_size);
+      afl->var_bytes = ck_realloc(afl->var_bytes, new_map_size);
+      afl->top_rated =
+          ck_realloc(afl->top_rated, new_map_size * sizeof(void *));
+      afl->clean_trace = ck_realloc(afl->clean_trace, new_map_size);
+      afl->clean_trace_custom =
+          ck_realloc(afl->clean_trace_custom, new_map_size);
+      afl->first_trace = ck_realloc(afl->first_trace, new_map_size);
+      afl->map_tmp_buf = ck_realloc(afl->map_tmp_buf, new_map_size);
+
+      afl_fsrv_kill(&afl->fsrv);
+      afl_shm_deinit(&afl->shm);
+      afl->fsrv.map_size = new_map_size;
+      afl->fsrv.trace_bits =
+          afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
+      setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
+      afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
+                     afl->afl_env.afl_debug_child);
+
+      map_size = new_map_size;
+
+    }
 
     afl->fsrv.map_size = map_size;
 
@@ -1634,13 +1641,21 @@ int main(int argc, char **argv_orig, char **envp) {
     afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
     afl->cmplog_fsrv.init_child_func = cmplog_exec_child;
 
+    if (map_size <= 8000000 && !afl->non_instrumented_mode &&
+        !afl->fsrv.qemu_mode && !afl->unicorn_mode) {
+
+      afl->fsrv.map_size = 8000000;  // dummy temporary value
+      setenv("AFL_MAP_SIZE", "8000000", 1);
+
+    }
+
     u32 new_map_size =
         afl_fsrv_get_mapsize(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,
                              afl->afl_env.afl_debug_child);
 
-    // only reinitialize when necessary
+    // only reinitialize when it needs to be larger
     if (map_size < new_map_size ||
-        (new_map_size > map_size && new_map_size - map_size > MAP_SIZE)) {
+        (new_map_size < map_size && map_size - new_map_size > MAP_SIZE)) {
 
       OKF("Re-initializing maps to %u bytes due cmplog", new_map_size);
 
@@ -1672,12 +1687,10 @@ int main(int argc, char **argv_orig, char **envp) {
 
       map_size = new_map_size;
 
-    } else {
-
-      afl->cmplog_fsrv.map_size = map_size;
-
     }
 
+    afl->cmplog_fsrv.map_size = map_size;
+
     OKF("Cmplog forkserver successfully started");
 
   }