4 files changed, 10 insertions, 1 deletions
diff --git a/src/afl-common.c b/src/afl-common.c
index 5ac50595..bfb05a67 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -149,6 +149,13 @@ void argv_cpy_free(char **argv) {
 
 char **get_qemu_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
 
+  if (unlikely(getenv("AFL_QEMU_CUSTOM_BIN"))) {
+    WARNF(
+      "AFL_QEMU_CUSTOM_BIN is enabled. "
+      "You must run your target under afl-qemu-trace on your own!");
+    return argv;
+  }
+
   if (!unlikely(own_loc)) { FATAL("BUG: param own_loc is NULL"); }
 
   u8 *tmp, *cp = NULL, *rsl, *own_copy;
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index ca2f75f1..82c1799e 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -2592,6 +2592,7 @@ void check_binary(afl_state_t *afl, u8 *fname) {
   }
 
   if (afl->afl_env.afl_skip_bin_check || afl->use_wine || afl->unicorn_mode ||
+      (afl->fsrv.qemu_mode && getenv("AFL_QEMU_CUSTOM_BIN")) ||
       afl->non_instrumented_mode) {
 
     return;
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 835aba40..b2f88205 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -325,7 +325,7 @@ static u8 check_if_text(afl_state_t *afl, struct queue_entry *q) {
 
   if (len >= MAX_FILE) len = MAX_FILE - 1;
   if ((fd = open(q->fname, O_RDONLY)) < 0) return 0;
-  buf = afl_realloc(AFL_BUF_PARAM(in_scratch), len);
+  buf = afl_realloc(AFL_BUF_PARAM(in_scratch), len + 1);
   comp = read(fd, buf, len);
   close(fd);
   if (comp != (ssize_t)len) return 0;
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 3ca377f6..cfb507a7 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1623,6 +1623,7 @@ int main(int argc, char **argv_orig, char **envp) {
       setenv("AFL_NO_AUTODICT", "1", 1);  // loaded already
       afl->fsrv.trace_bits =
           afl_shm_init(&afl->shm, new_map_size, afl->non_instrumented_mode);
+      afl->cmplog_fsrv.trace_bits = afl->fsrv.trace_bits;
       afl_fsrv_start(&afl->fsrv, afl->argv, &afl->stop_soon,
                      afl->afl_env.afl_debug_child);
       afl_fsrv_start(&afl->cmplog_fsrv, afl->argv, &afl->stop_soon,