Age | Commit message (Collapse) | Author |
|
In src/afl-fuzz.c `prev_queued_items` is used to decide whether the alias table should be recreated through the comparison with `afl->queued_items`.
https://github.com/AFLplusplus/AFLplusplus/blob/43f462c91b3699b66e4aa1c5703b30f5189b5618/src/afl-fuzz.c#L3103-L3117
However, this variable is also updated to `afl->queued_items` when INTROSPECTION is enabled and the `fuzz_one` appends seeds.
https://github.com/AFLplusplus/AFLplusplus/blob/43f462c91b3699b66e4aa1c5703b30f5189b5618/src/afl-fuzz.c#L3135-L3140
Due to the update of `prev_queued_items` when INTROSPECTION is on, alias table may not be recreated when it actually should be.
This can lead to potential heap buffer-overflow in `select_next_queue_entry` due to the lack of `afl_realloc` called in `create_alias_table`.
This patch fixes this bug by utilizing another variable for the INTROSPECTION part like other variables such as `prev_saved_tmouts`.
|
|
IJON SET
|
|
|
|
|
|
Incorrect shell syntax
|
|
Replaced a Chinese comma "," with an English comma "," to ensure the code runs correctly.
|
|
Make fallthroughs explicit in afl-fuzz-extras.c
|
|
Using `__attribute__((fallthrough))` makes fallthroughs explicit in a way the compiler can understand. This allows the enablement of `-Wimplicit-fallthrough`.
|
|
Update README.md to reflect latest changes
|
|
1. fixed hook name length to 16
2. no native debug logging at this time -- will bridge with AFL++ macros latter
|
|
push to stable
|
|
|
|
Adding of QEMU hooking bridge
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Enhance Nyx mode instructions
|
|
|
|
|
|
|
|
Optimize bit counting using __builtin_popcount
|
|
Use the __builtin_popcount intrinsic to optimize the bit counting
function if the compiler supports it. This change replaces the manual
bit counting algorithm with the more efficient built-in function, which
leverages hardware support on compatible processors.
This modification ensures that the code remains backward-compatible by
falling back to the original implementation when __builtin_popcount is
not available.
|
|
|
|
|
|
Fix typo in unicorn_mode
|
|
in `unicorn_mode/samples`, python example floder's name is `python_simple`, there is a typo in README file.
|
|
|
|
|
|
Auto disable memory limits for FASAN
|
|
|
|
Collect persistent coverage data and dump it at the end of the run
|
|
With CODE_COVERAGE builds, we need to collect the coverage data of each
iteration in a persistant buffer that has the same size as the regular
trace buffer used for fuzzing. We dump this information at the end of
the run and when combined with pointer data and module info, this can be
used to calculate code coverage.
|
|
|
|
Fastrestart
|
|
|
|
|
|
|
|
Fix signed integer overflow in radamsa
|
|
When UBSan was enabled and 'make test' was executed, the following
runtime error was observed:
libradamsa.c:26055:29: runtime error: left shift of 16777215 by 8 places cannot be represented in type 'int'
This issue was caused by a left shift operation on a signed integer.
The fix involved changing the integer literal to an unsigned integer by
adding a 'U' suffix, ensuring the left shift operation produces the
correct value without overflow.
Fixes: 8178f4df ("remove radamsa, add radamsa custom mutator")
|
|
push to stable
|