search

AFLplusplus / AFLplusplus

The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!
https://aflplus.plus
Apache License 2.0
5.15k stars 1.03k forks source link

AFL_EXIT_WHEN_DONE not working when compiling with NO_SPLICING #2225

Open martinus opened 1 week ago

martinus commented 1 week ago

After reading An Empirical Examination of Fuzzer Mutator Performance I decided to disable splicing, but after doing so ~AFL_EXIT_ON_TIME~ AFL_EXIT_WHEN_DONE logic doesn't work.

I looked through the code, and saw that the that logic depends on the cycles_wo_finds counter being > 100. But that counter is never increased when splicing is disabled, the only place where it's increased is here inside the if (afl->use_splicing): https://github.com/AFLplusplus/AFLplusplus/blob/stable/src/afl-fuzz.c#L2940-L2942

To Reproduce Steps to reproduce the behavior:

  1. Build afl++ with NO_SPLICING=1
  2. Have a look at the cycles_wo_finds value in fuzzer_stats, it's always 0.

Expected behavior cycles_wo_finds should count up after each cycle so that ~AFL_EXIT_ON_TIME~ AFL_EXIT_WHEN_DONE works

vanhauser-thc commented 1 week ago

you are correct this is a bug, I pushed a fix to dev. put honestly how AFL_EXIT_ON_TIME works is horrible. It is from back of vanilla afl times ... I should switch it to when the calculation for being finished is reached (the "state: in progress ..." entry in the UI when it shows "finnished"). I think I will just push another commit for this.

vanhauser-thc commented 1 week ago

actually AFL_EXIT_ON_TIME was fine besides the wrong cycle_wo_finds requirement but AFL_EXIT_WHEN_DONE needed an update. also changed how the colors look like in the UI for cycles done. can you please test and give me feedback?

martinus commented 1 week ago

Works well for me, thanks!