Skip to content

Commit c8354d7

Browse files
vanhauser-thcvanhauser-thc
committed
new rand mode for data offsets that prefer low offset values
1 parent 79f873a commit c8354d7

File tree

2 files changed

+63
-34
lines changed

2 files changed

+63
-34
lines changed

‎include/afl-fuzz.h

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1001,6 +1001,30 @@ static inline u32 rand_below(afl_state_t *afl, u32 limit) {
10011001

10021002
}
10031003

1004+
/* we prefer lower range values here */
1005+
/* this is only called with normal havoc, not MOpt, to have an equalizer for
1006+
expand havoc mode */
1007+
static inline u32 rand_below_datalen(afl_state_t *afl, u32 limit) {
1008+
1009+
switch (rand_below(afl, 3)) {
1010+
1011+
case 2:
1012+
return (rand_below(afl, limit) % rand_below(afl, limit)) %
1013+
rand_below(afl, limit);
1014+
break;
1015+
case 1:
1016+
return rand_below(afl, limit) % rand_below(afl, limit);
1017+
break;
1018+
case 0:
1019+
return rand_below(afl, limit);
1020+
break;
1021+
1022+
}
1023+
1024+
return 1; // cannot be reached
1025+
1026+
}
1027+
10041028
static inline s64 rand_get_seed(afl_state_t *afl) {
10051029

10061030
if (unlikely(afl->fixed_seed)) { return afl->init_seed; }

‎src/afl-fuzz-one.c

Lines changed: 39 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1921,14 +1921,14 @@ u8 fuzz_one_original(afl_state_t *afl) {
19211921

19221922
/* Flip a single bit somewhere. Spooky! */
19231923

1924-
FLIP_BIT(out_buf, rand_below(afl, temp_len << 3));
1924+
FLIP_BIT(out_buf, rand_below_datalen(afl, temp_len << 3));
19251925
break;
19261926

19271927
case 1:
19281928

19291929
/* Set byte to interesting value. */
19301930

1931-
out_buf[rand_below(afl, temp_len)] =
1931+
out_buf[rand_below_datalen(afl, temp_len)] =
19321932
interesting_8[rand_below(afl, sizeof(interesting_8))];
19331933
break;
19341934

@@ -1940,12 +1940,12 @@ u8 fuzz_one_original(afl_state_t *afl) {
19401940

19411941
if (rand_below(afl, 2)) {
19421942

1943-
*(u16 *)(out_buf + rand_below(afl, temp_len - 1)) =
1943+
*(u16 *)(out_buf + rand_below_datalen(afl, temp_len - 1)) =
19441944
interesting_16[rand_below(afl, sizeof(interesting_16) >> 1)];
19451945

19461946
} else {
19471947

1948-
*(u16 *)(out_buf + rand_below(afl, temp_len - 1)) = SWAP16(
1948+
*(u16 *)(out_buf + rand_below_datalen(afl, temp_len - 1)) = SWAP16(
19491949
interesting_16[rand_below(afl, sizeof(interesting_16) >> 1)]);
19501950

19511951
}
@@ -1960,12 +1960,12 @@ u8 fuzz_one_original(afl_state_t *afl) {
19601960

19611961
if (rand_below(afl, 2)) {
19621962

1963-
*(u32 *)(out_buf + rand_below(afl, temp_len - 3)) =
1963+
*(u32 *)(out_buf + rand_below_datalen(afl, temp_len - 3)) =
19641964
interesting_32[rand_below(afl, sizeof(interesting_32) >> 2)];
19651965

19661966
} else {
19671967

1968-
*(u32 *)(out_buf + rand_below(afl, temp_len - 3)) = SWAP32(
1968+
*(u32 *)(out_buf + rand_below_datalen(afl, temp_len - 3)) = SWAP32(
19691969
interesting_32[rand_below(afl, sizeof(interesting_32) >> 2)]);
19701970

19711971
}
@@ -1976,14 +1976,16 @@ u8 fuzz_one_original(afl_state_t *afl) {
19761976

19771977
/* Randomly subtract from byte. */
19781978

1979-
out_buf[rand_below(afl, temp_len)] -= 1 + rand_below(afl, ARITH_MAX);
1979+
out_buf[rand_below_datalen(afl, temp_len)] -=
1980+
1 + rand_below(afl, ARITH_MAX);
19801981
break;
19811982

19821983
case 5:
19831984

19841985
/* Randomly add to byte. */
19851986

1986-
out_buf[rand_below(afl, temp_len)] += 1 + rand_below(afl, ARITH_MAX);
1987+
out_buf[rand_below_datalen(afl, temp_len)] +=
1988+
1 + rand_below(afl, ARITH_MAX);
19871989
break;
19881990

19891991
case 6:
@@ -1994,13 +1996,13 @@ u8 fuzz_one_original(afl_state_t *afl) {
19941996

19951997
if (rand_below(afl, 2)) {
19961998

1997-
u32 pos = rand_below(afl, temp_len - 1);
1999+
u32 pos = rand_below_datalen(afl, temp_len - 1);
19982000

19992001
*(u16 *)(out_buf + pos) -= 1 + rand_below(afl, ARITH_MAX);
20002002

20012003
} else {
20022004

2003-
u32 pos = rand_below(afl, temp_len - 1);
2005+
u32 pos = rand_below_datalen(afl, temp_len - 1);
20042006
u16 num = 1 + rand_below(afl, ARITH_MAX);
20052007

20062008
*(u16 *)(out_buf + pos) =
@@ -2018,13 +2020,13 @@ u8 fuzz_one_original(afl_state_t *afl) {
20182020

20192021
if (rand_below(afl, 2)) {
20202022

2021-
u32 pos = rand_below(afl, temp_len - 1);
2023+
u32 pos = rand_below_datalen(afl, temp_len - 1);
20222024

20232025
*(u16 *)(out_buf + pos) += 1 + rand_below(afl, ARITH_MAX);
20242026

20252027
} else {
20262028

2027-
u32 pos = rand_below(afl, temp_len - 1);
2029+
u32 pos = rand_below_datalen(afl, temp_len - 1);
20282030
u16 num = 1 + rand_below(afl, ARITH_MAX);
20292031

20302032
*(u16 *)(out_buf + pos) =
@@ -2042,13 +2044,13 @@ u8 fuzz_one_original(afl_state_t *afl) {
20422044

20432045
if (rand_below(afl, 2)) {
20442046

2045-
u32 pos = rand_below(afl, temp_len - 3);
2047+
u32 pos = rand_below_datalen(afl, temp_len - 3);
20462048

20472049
*(u32 *)(out_buf + pos) -= 1 + rand_below(afl, ARITH_MAX);
20482050

20492051
} else {
20502052

2051-
u32 pos = rand_below(afl, temp_len - 3);
2053+
u32 pos = rand_below_datalen(afl, temp_len - 3);
20522054
u32 num = 1 + rand_below(afl, ARITH_MAX);
20532055

20542056
*(u32 *)(out_buf + pos) =
@@ -2066,13 +2068,13 @@ u8 fuzz_one_original(afl_state_t *afl) {
20662068

20672069
if (rand_below(afl, 2)) {
20682070

2069-
u32 pos = rand_below(afl, temp_len - 3);
2071+
u32 pos = rand_below_datalen(afl, temp_len - 3);
20702072

20712073
*(u32 *)(out_buf + pos) += 1 + rand_below(afl, ARITH_MAX);
20722074

20732075
} else {
20742076

2075-
u32 pos = rand_below(afl, temp_len - 3);
2077+
u32 pos = rand_below_datalen(afl, temp_len - 3);
20762078
u32 num = 1 + rand_below(afl, ARITH_MAX);
20772079

20782080
*(u32 *)(out_buf + pos) =
@@ -2088,7 +2090,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
20882090
why not. We use XOR with 1-255 to eliminate the
20892091
possibility of a no-op. */
20902092

2091-
out_buf[rand_below(afl, temp_len)] ^= 1 + rand_below(afl, 255);
2093+
out_buf[rand_below_datalen(afl, temp_len)] ^=
2094+
1 + rand_below(afl, 255);
20922095
break;
20932096

20942097
case 11 ... 12: {
@@ -2105,7 +2108,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
21052108

21062109
del_len = choose_block_len(afl, temp_len - 1);
21072110

2108-
del_from = rand_below(afl, temp_len - del_len + 1);
2111+
del_from = rand_below_datalen(afl, temp_len - del_len + 1);
21092112

21102113
memmove(out_buf + del_from, out_buf + del_from + del_len,
21112114
temp_len - del_from - del_len);
@@ -2129,7 +2132,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
21292132
if (actually_clone) {
21302133

21312134
clone_len = choose_block_len(afl, temp_len);
2132-
clone_from = rand_below(afl, temp_len - clone_len + 1);
2135+
clone_from = rand_below_datalen(afl, temp_len - clone_len + 1);
21332136

21342137
} else {
21352138

@@ -2138,7 +2141,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
21382141

21392142
}
21402143

2141-
clone_to = rand_below(afl, temp_len);
2144+
clone_to = rand_below_datalen(afl, temp_len);
21422145

21432146
new_buf =
21442147
ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + clone_len);
@@ -2156,8 +2159,9 @@ u8 fuzz_one_original(afl_state_t *afl) {
21562159
} else {
21572160

21582161
memset(new_buf + clone_to,
2159-
rand_below(afl, 2) ? rand_below(afl, 256)
2160-
: out_buf[rand_below(afl, temp_len)],
2162+
rand_below(afl, 2)
2163+
? rand_below(afl, 256)
2164+
: out_buf[rand_below_datalen(afl, temp_len)],
21612165
clone_len);
21622166

21632167
}
@@ -2186,8 +2190,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
21862190

21872191
copy_len = choose_block_len(afl, temp_len - 1);
21882192

2189-
copy_from = rand_below(afl, temp_len - copy_len + 1);
2190-
copy_to = rand_below(afl, temp_len - copy_len + 1);
2193+
copy_from = rand_below_datalen(afl, temp_len - copy_len + 1);
2194+
copy_to = rand_below_datalen(afl, temp_len - copy_len + 1);
21912195

21922196
if (rand_below(afl, 4)) {
21932197

@@ -2200,8 +2204,9 @@ u8 fuzz_one_original(afl_state_t *afl) {
22002204
} else {
22012205

22022206
memset(out_buf + copy_to,
2203-
rand_below(afl, 2) ? rand_below(afl, 256)
2204-
: out_buf[rand_below(afl, temp_len)],
2207+
rand_below(afl, 2)
2208+
? rand_below(afl, 256)
2209+
: out_buf[rand_below_datalen(afl, temp_len)],
22052210
copy_len);
22062211

22072212
}
@@ -2233,7 +2238,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
22332238

22342239
if (extra_len > temp_len) { break; }
22352240

2236-
insert_at = rand_below(afl, temp_len - extra_len + 1);
2241+
insert_at = rand_below_datalen(afl, temp_len - extra_len + 1);
22372242
memcpy(out_buf + insert_at, afl->a_extras[use_extra].data,
22382243
extra_len);
22392244

@@ -2247,7 +2252,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
22472252

22482253
if (extra_len > temp_len) { break; }
22492254

2250-
insert_at = rand_below(afl, temp_len - extra_len + 1);
2255+
insert_at = rand_below_datalen(afl, temp_len - extra_len + 1);
22512256
memcpy(out_buf + insert_at, afl->extras[use_extra].data,
22522257
extra_len);
22532258

@@ -2258,7 +2263,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
22582263
} else { // case 16
22592264

22602265
u32 use_extra, extra_len,
2261-
insert_at = rand_below(afl, temp_len + 1);
2266+
insert_at = rand_below_datalen(afl, temp_len + 1);
22622267
u8 *ptr;
22632268

22642269
/* Insert an extra. Do the same dice-rolling stuff as for the
@@ -2362,8 +2367,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
23622367
copy_len = choose_block_len(afl, new_len - 1);
23632368
if (copy_len > temp_len) copy_len = temp_len;
23642369

2365-
copy_from = rand_below(afl, new_len - copy_len + 1);
2366-
copy_to = rand_below(afl, temp_len - copy_len + 1);
2370+
copy_from = rand_below_datalen(afl, new_len - copy_len + 1);
2371+
copy_to = rand_below_datalen(afl, temp_len - copy_len + 1);
23672372

23682373
memmove(out_buf + copy_to, new_buf + copy_from, copy_len);
23692374

@@ -2372,9 +2377,9 @@ u8 fuzz_one_original(afl_state_t *afl) {
23722377
u32 clone_from, clone_to, clone_len;
23732378

23742379
clone_len = choose_block_len(afl, new_len);
2375-
clone_from = rand_below(afl, new_len - clone_len + 1);
2380+
clone_from = rand_below_datalen(afl, new_len - clone_len + 1);
23762381

2377-
clone_to = rand_below(afl, temp_len);
2382+
clone_to = rand_below_datalen(afl, temp_len);
23782383

23792384
u8 *temp_buf =
23802385
ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + clone_len);
@@ -2523,7 +2528,7 @@ u8 fuzz_one_original(afl_state_t *afl) {
25232528

25242529
/* Split somewhere between the first and last differing byte. */
25252530

2526-
split_at = f_diff + rand_below(afl, l_diff - f_diff);
2531+
split_at = f_diff + rand_below_datalen(afl, l_diff - f_diff);
25272532

25282533
/* Do the thing. */
25292534

0 commit comments

Comments
 (0)