From 01d266f2b4870fbdfd8daba7498ec422fed84c91 Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Sun, 31 Oct 2021 12:40:32 +0100 Subject: wipe overflow data --- instrumentation/afl-compiler-rt.o.c | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) (limited to 'instrumentation/afl-compiler-rt.o.c') diff --git a/instrumentation/afl-compiler-rt.o.c b/instrumentation/afl-compiler-rt.o.c index 6ee86add..ff3998e6 100644 --- a/instrumentation/afl-compiler-rt.o.c +++ b/instrumentation/afl-compiler-rt.o.c @@ -1935,9 +1935,12 @@ void __cmplog_rtn_hook_n(u8 *ptr1, u8 *ptr2, u64 len) { struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k]; hits &= CMP_MAP_RTN_H - 1; - if (unlikely(reset && !hits)) { - __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands)); + if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; } + + if (unlikely(__afl_cmp_map->headers[k].overflow)) { + + __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands)); } @@ -1988,9 +1991,12 @@ void __cmplog_rtn_hook_strn(u8 *ptr1, u8 *ptr2, u64 len) { struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k]; hits &= CMP_MAP_RTN_H - 1; - if (unlikely(reset && !hits)) { - __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands)); + if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; } + + if (unlikely(__afl_cmp_map->headers[k].overflow)) { + + __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands)); } @@ -2043,9 +2049,12 @@ void __cmplog_rtn_hook_str(u8 *ptr1, u8 *ptr2) { struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k]; hits &= CMP_MAP_RTN_H - 1; - if (unlikely(reset && !hits)) { - __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands)); + if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; } + + if (unlikely(__afl_cmp_map->headers[k].overflow)) { + + __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands)); } @@ -2106,9 +2115,12 @@ void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) { struct cmpfn_operands *cmpfn = (struct cmpfn_operands *)__afl_cmp_map->log[k]; hits &= CMP_MAP_RTN_H - 1; - if (unlikely(reset && !hits)) { - __builtin_memset(cmpfn, 0, sizeof(struct cmpfn_operands)); + if (unlikely(reset && !hits)) { __afl_cmp_map->headers[k].overflow = 1; } + + if (unlikely(__afl_cmp_map->headers[k].overflow)) { + + __builtin_memset((char *)&cmpfn[hits], 0, sizeof(struct cmpfn_operands)); } -- cgit 1.4.1