SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix fuzzbench cmplog ForkServer builder and rtn_extend_encoding buffer copy overflow (#3270)

Browse Source
This commit is contained in:
Ch4r1l3 2025-05-25 00:02:43 +08:00 committed by GitHub
parent ce63b76558
commit 9a202acfed
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
fuzzers/forkserver/fuzzbench_forkserver/src/main.rs
View File

@ -365,6 +365,7 @@ fn fuzz(
.debug_child(debug_child)
.shmem_provider(&mut shmem_provider)
.parse_afl_cmdline(arguments)
.coverage_map_size(MAP_SIZE)
.is_persistent(true)
.timeout(timeout * 10)
.kill_signal(signal)

1
fuzzers/forkserver/fuzzbench_forkserver_cmplog/src/main.rs
View File

@ -369,6 +369,7 @@ fn fuzz(
.debug_child(debug_child)
.shmem_provider(&mut shmem_provider)
.parse_afl_cmdline(arguments)
.coverage_map_size(MAP_SIZE)
.is_persistent(true)
// increase timeouts for cmplog
.timeout(timeout * 10)

8
libafl/src/mutators/token_mutations.rs
View File

@ -1301,9 +1301,11 @@ impl AflppRedQueen {
if copy_len > 0 {
unsafe {
for l in 1..=copy_len {
let mut cloned = buf.to_vec();
buffer_copy(&mut cloned, repl, 0, buf_idx, l);
vec.push(cloned);
if l <= repl.len() {
let mut cloned = buf.to_vec();
buffer_copy(&mut cloned, repl, 0, buf_idx, l);
vec.push(cloned);
}
}
// vec.push(cloned);
}