search

google / AFL

american fuzzy lop - a security-oriented fuzzer
https://lcamtuf.coredump.cx/afl/
Apache License 2.0
3.68k stars 635 forks source link

The size of "cur_location ^ prev_location" dose not fit the index of SHM? #99

Closed zhanggenex closed 4 years ago

zhanggenex commented 4 years ago

Hi, guys. In LLVM instrumentation mode, I noticed that the result of cur_location ^ prev_location is stored in a 32 bit int type. However, the size of SHM is 64KB, whose is index is a 64K (64KB divided by 8) type, which is 16 bit type. And I did not see any codes in the pass to translate 32 bit to 16 bit. Will this be a problem?

vanhauser-thc commented 4 years ago

the cur_loc values are generated by rand() % MAP_SIZE and prev_loc by a right shift of cur_loc. Hence the calculated map location can not be larger than the MAP_SIZE.

zhanggenex commented 4 years ago

@vanhauser-thc The xor result is this: ConstantInt *CurLoc = ConstantInt::get(Int32Ty, cur_loc); Value *PrevLocCasted = IRB.CreateZExt(PrevLoc, IRB.getInt32Ty()); IRB.CreateXor(PrevLocCasted, CurLoc) It seems like they are all int 32 type. Could you please look into this? Thanks for the discussion.

vanhauser-thc commented 4 years ago

I know the code very well. try yourself ... select two values of your choice that are "rand() % MAP_SIZE", xor them and see if they can be larger than MAP_SIZE. they can't :) it is math. It needs to be an Int32 instead of Int16 because the MAP_SIZE is configurable in config.h

zhanggenex commented 4 years ago

@vanhauser-thc Thanks.