From 5b70d23211ddeddfb4d1dfce29a50234d08e9502 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Fri, 17 Apr 2020 09:10:49 +0200 Subject: added AFL_MAP_SIZE (wip) --- src/afl-fuzz-queue.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'src/afl-fuzz-queue.c') diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c index d05eee08..373f12d8 100644 --- a/src/afl-fuzz-queue.c +++ b/src/afl-fuzz-queue.c @@ -249,7 +249,6 @@ void update_bitmap_score(afl_state_t *afl, struct queue_entry *q) { if (!q->trace_mini) { u32 len = (afl->fsrv.map_size >> 3); - if (len == 0) len = 1; q->trace_mini = ck_alloc(len); minimize_bits(afl, q->trace_mini, afl->fsrv.trace_bits); @@ -272,12 +271,12 @@ void cull_queue(afl_state_t *afl) { struct queue_entry *q; u32 len = (afl->fsrv.map_size >> 3); u32 i; - u8 temp_v[MAP_SIZE >> 3]; - - if (len == 0) len = 1; + u8 * temp_v; if (afl->dumb_mode || !afl->score_changed) return; + temp_v = ck_alloc(afl->fsrv.map_size >> 3); + afl->score_changed = 0; memset(temp_v, 255, len); @@ -325,6 +324,8 @@ void cull_queue(afl_state_t *afl) { } + ck_free(temp_v); + } /* Calculate case desirability score to adjust the length of havoc fuzzing. -- cgit 1.4.1 From 8ecfbcdf3457ca4337dc6a0f45def33582f51a7f Mon Sep 17 00:00:00 2001 From: Dominik Maier Date: Fri, 17 Apr 2020 13:15:24 +0200 Subject: removed tmp alloc in queue --- include/afl-fuzz.h | 3 +++ src/afl-fuzz-queue.c | 4 +--- 2 files changed, 4 insertions(+), 3 deletions(-) (limited to 'src/afl-fuzz-queue.c') diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index f6912aea..fbf3aa2d 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -608,6 +608,9 @@ typedef struct afl_state { u8 * ex_buf; size_t ex_size; + u8 * map_tmp_buf; + size_t map_tmp_size; + } afl_state_t; /* A global pointer to all instances is needed (for now) for signals to arrive diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c index 373f12d8..96711cbc 100644 --- a/src/afl-fuzz-queue.c +++ b/src/afl-fuzz-queue.c @@ -275,7 +275,7 @@ void cull_queue(afl_state_t *afl) { if (afl->dumb_mode || !afl->score_changed) return; - temp_v = ck_alloc(afl->fsrv.map_size >> 3); + temp_v = ck_maybe_grow((void **)&afl->map_tmp_buf, &afl->map_tmp_size, afl->fsrv.map_size >> 3); afl->score_changed = 0; @@ -324,8 +324,6 @@ void cull_queue(afl_state_t *afl) { } - ck_free(temp_v); - } /* Calculate case desirability score to adjust the length of havoc fuzzing. -- cgit 1.4.1