From 57bc3c07018463ad6d069850be9f2bce5c450dd6 Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Mon, 13 Dec 2021 15:45:41 +0100 Subject: fix qemu/unicorn oob --- docs/Changelog.md | 2 ++ src/afl-sharedmem.c | 3 +++ 2 files changed, 5 insertions(+) diff --git a/docs/Changelog.md b/docs/Changelog.md index e9b62dc0..00502efe 100644 --- a/docs/Changelog.md +++ b/docs/Changelog.md @@ -34,6 +34,8 @@ sending a mail to . - better banner - more effective cmplog mode - more often update the UI when in input2stage mode + - qemu_mode/unicorn_mode: fixed OOB write when using libcompcov, + thanks to kotee4ko for reporting! - frida_mode: - better performance, bug fixes - David Carlier added Android support :) diff --git a/src/afl-sharedmem.c b/src/afl-sharedmem.c index 7fb8f821..09941d61 100644 --- a/src/afl-sharedmem.c +++ b/src/afl-sharedmem.c @@ -242,6 +242,9 @@ u8 *afl_shm_init(sharedmem_t *shm, size_t map_size, #else u8 *shm_str; + // handle qemu/unicorn compcov map overwrite + if (map_size == MAP_SIZE) { map_size += 8; } + shm->shm_id = shmget(IPC_PRIVATE, map_size, IPC_CREAT | IPC_EXCL | DEFAULT_PERMISSION); if (shm->shm_id < 0) { -- cgit 1.4.1