From 8428b18d2a48cf7e995797a8b2183920aaa14f7e Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 13:30:25 +0200
Subject: fix another segfault

---
 src/afl-fuzz-run.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 41de143c..7180d255 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -879,12 +879,13 @@ u8 common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
 
     s32 new_len = afl->queue_cur->len + len - afl->taint_len;
     if (new_len < 4) new_len = 4;
+    if (new_len > MAX_FILE) new_len = MAX_FILE;
     u8 *new_buf = ck_maybe_grow(BUF_PARAMS(in_scratch), new_len);
 
     u32 i, taint = 0;
     for (i = 0; i < new_len; i++) {
 
-      if (afl->taint_map[i] || i > afl->queue_cur->len)
+      if (i > afl->taint_len || afl->taint_map[i] || i > afl->queue_cur->len)
         new_buf[i] = out_buf[taint++];
       else
         new_buf[i] = afl->taint_src[i];
-- 
cgit 1.4.1