diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/afl-fuzz-redqueen.c | 77 |
1 files changed, 48 insertions, 29 deletions
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c index f070c196..b09a977f 100644 --- a/src/afl-fuzz-redqueen.c +++ b/src/afl-fuzz-redqueen.c @@ -207,7 +207,7 @@ checksum_fail: ///// Input to State replacement -u8 its_fuzz(u32 idx, u32 size, u8* buf, u32 len, u8* status) { +u8 its_fuzz(u8* buf, u32 len, u8* status) { u64 orig_hit_cnt, new_hit_cnt; @@ -217,18 +217,11 @@ u8 its_fuzz(u32 idx, u32 size, u8* buf, u32 len, u8* status) { new_hit_cnt = queued_paths + unique_crashes; - if (unlikely(new_hit_cnt != orig_hit_cnt)) { - + if (unlikely(new_hit_cnt != orig_hit_cnt)) *status = 1; - - } else { - - if (size >= MIN_AUTO_EXTRA && size <= MAX_AUTO_EXTRA) - maybe_add_auto(&buf[idx], size); + else *status = 2; - } - return 0; } @@ -254,7 +247,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx, if (its_len >= 8 && *buf_64 == pattern && *o_buf_64 == pattern) { *buf_64 = repl; - if (unlikely(its_fuzz(idx, 8, buf, len, status))) return 1; + if (unlikely(its_fuzz(buf, len, status))) return 1; *buf_64 = pattern; } @@ -272,7 +265,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx, if (its_len >= 4 && *buf_32 == (u32)pattern && *o_buf_32 == (u32)pattern) { *buf_32 = (u32)repl; - if (unlikely(its_fuzz(idx, 4, buf, len, status))) return 1; + if (unlikely(its_fuzz(buf, len, status))) return 1; *buf_32 = pattern; } @@ -290,7 +283,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx, if (its_len >= 2 && *buf_16 == (u16)pattern && *o_buf_16 == (u16)pattern) { *buf_16 = (u16)repl; - if (unlikely(its_fuzz(idx, 2, buf, len, status))) return 1; + if (unlikely(its_fuzz(buf, len, status))) return 1; *buf_16 = (u16)pattern; } @@ -308,7 +301,7 @@ u8 cmp_extend_encoding(struct cmp_header* h, u64 pattern, u64 repl, u32 idx, if (its_len >= 2 && *buf_8 == (u8)pattern && *o_buf_8 == (u8)pattern) { *buf_8 = (u8)repl; - if (unlikely(its_fuzz(idx, 1, buf, len, status))) + if (unlikely(its_fuzz(buf, len, status))) return 1; *buf_16 = (u16)pattern; @@ -423,7 +416,26 @@ u8 cmp_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { u8 rtn_extend_encoding(struct cmp_header* h, u8* pattern, u8* repl, u32 idx, u8* orig_buf, u8* buf, u32 len, u8* status) { - *status = 2; + u32 i; + u32 its_len = MIN(32, len - idx); + + u8 save[32]; + memcpy(save, &buf[idx], its_len); + + *status = 0; + + for (i = 0; i < its_len; ++i) { + + if (pattern[idx + i] != orig_buf[idx + i] || *status == 1) + break; + + buf[idx +i] = repl[idx + i]; + if (unlikely(its_fuzz(buf, len, status))) return 1; + + } + + memcpy(&buf[idx], save, i); + return 0; } @@ -444,9 +456,9 @@ u8 rtn_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { struct cmpfn_operands* o = &((struct cmpfn_operands*)cmp_map->log[key])[i]; // opt not in the paper - //for (j = 0; j < i; ++j) - // if (cmp_map->log[key][j].v0 == o->v0 && cmp_map->log[key][i].v1 == o->v1) - // goto cmp_fuzz_next_iter; + for (j = 0; j < i; ++j) + if (!memcmp(&((struct cmpfn_operands*)cmp_map->log[key])[j], o, sizeof(struct cmpfn_operands))) + goto rtn_fuzz_next_iter; for (idx = 0; idx < len && fails < 8; ++idx) { @@ -476,7 +488,7 @@ u8 rtn_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { } - cmp_fuzz_next_iter: + rtn_fuzz_next_iter: stage_cur++; } @@ -491,6 +503,7 @@ u8 rtn_fuzz(u32 key, u8* orig_buf, u8* buf, u32 len) { u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len, u32 exec_cksum) { + u8 r = 1; its_argv = argv; if (unlikely(colorization(buf, len, exec_cksum))) return 1; @@ -513,31 +526,37 @@ u8 input_to_state_stage(char** argv, u8* orig_buf, u8* buf, u32 len, for (k = 0; k < CMP_MAP_W; ++k) { if (!cmp_map->headers[k].hits) continue; - if (cmp_map->headers[k].hits > CMP_MAP_H) - stage_max += CMP_MAP_H; + if (cmp_map->headers[k].type == CMP_TYPE_INS) + stage_max += MIN(cmp_map->headers[k].hits, CMP_MAP_H); else - stage_max += cmp_map->headers[k].hits; + stage_max += MIN(cmp_map->headers[k].hits, CMP_MAP_RTN_H); } - + for (k = 0; k < CMP_MAP_W; ++k) { if (!cmp_map->headers[k].hits) continue; - if (cmp_map->headers[k].type == CMP_TYPE_INS) - cmp_fuzz(k, orig_buf, buf, len); - else - rtn_fuzz(k, orig_buf, buf, len); + if (cmp_map->headers[k].type == CMP_TYPE_INS) { + if (unlikely(cmp_fuzz(k, orig_buf, buf, len))) + goto exit_its; + } else { + if (unlikely(rtn_fuzz(k, orig_buf, buf, len))) + goto exit_its; + } } - memcpy(orig_buf, buf, len); + r = 0; +exit_its: + memcpy(orig_buf, buf, len); + new_hit_cnt = queued_paths + unique_crashes; stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt; stage_cycles[STAGE_ITS] += total_execs - orig_execs; - return 0; + return r; } |