diff options
| -rw-r--r-- | include/cmplog.h | 3 | ||||
| -rw-r--r-- | instrumentation/afl-compiler-rt.o.c | 28 |
2 files changed, 22 insertions, 9 deletions
diff --git a/include/cmplog.h b/include/cmplog.h index b95a8e43..76082121 100644 --- a/include/cmplog.h +++ b/include/cmplog.h @@ -48,7 +48,8 @@ struct cmp_header { unsigned shape : 5; unsigned type : 2; unsigned attribute : 4; - unsigned reserved : 5; + unsigned overflow : 1; + unsigned reserved : 4; } __attribute__((packed)); diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c index 6ee86add..ff3998e6 100644 --- a/instrumentation/afl-compiler-rt.o.c +++ b/instrumentation/afl-compiler-rt.o.c @@ -1935,9 +1935,12 @@ void __cmplog_rtn_hook_n(u8 *ptr1, u8 *ptr2, u64 len) { struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k]; hits &= CMP_MAP_RTN_H - 1; - if (unlikely(reset && !hits)) { - __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands)); + if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; } + + if (unlikely(__afl_cmp_map->headers[k].overflow)) { + + __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands)); } @@ -1988,9 +1991,12 @@ void __cmplog_rtn_hook_strn(u8 *ptr1, u8 *ptr2, u64 len) { struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k]; hits &= CMP_MAP_RTN_H - 1; - if (unlikely(reset && !hits)) { - __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands)); + if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; } + + if (unlikely(__afl_cmp_map->headers[k].overflow)) { + + __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands)); } @@ -2043,9 +2049,12 @@ void __cmplog_rtn_hook_str(u8 *ptr1, u8 *ptr2) { struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k]; hits &= CMP_MAP_RTN_H - 1; - if (unlikely(reset && !hits)) { - __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands)); + if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; } + + if (unlikely(__afl_cmp_map->headers[k].overflow)) { + + __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands)); } @@ -2106,9 +2115,12 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) { struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k]; hits &= CMP_MAP_RTN_H - 1; - if (unlikely(reset && !hits)) { - __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands)); + if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; } + + if (unlikely(__afl_cmp_map->headers[k].overflow)) { + + __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands)); } |