@@ -400,11 +400,18 @@ class UCAFL {
400
400
401
401
void _uc_hook_sub_impl (uint64_t cur_loc, uint64_t arg1, uint64_t arg2,
402
402
uint32_t size) {
403
+
403
404
if (size >= 64 ) {
405
+ if (unlikely (MAP_SIZE - cur_loc < 8 ))
406
+ cur_loc -= 8 ;
404
407
this ->_uc_hook_sub_impl_64 (cur_loc, arg1, arg2);
405
408
} else if (size >= 32 ) {
409
+ if (unlikely (MAP_SIZE - cur_loc < 4 ))
410
+ cur_loc -= 4 ;
406
411
this ->_uc_hook_sub_impl_32 (cur_loc, arg1, arg2);
407
412
} else {
413
+ if (unlikely (MAP_SIZE - cur_loc < 2 ))
414
+ cur_loc -= 2 ;
408
415
this ->_uc_hook_sub_impl_16 (cur_loc, arg1, arg2);
409
416
}
410
417
}
@@ -537,14 +544,13 @@ class UCAFL {
537
544
/* Parent supports testcases via shared map - and the user wants to
538
545
* use it. Tell AFL. */
539
546
status = (FS_OPT_ENABLED | FS_OPT_SHDMEM_FUZZ);
540
- /* Phone home and tell the parent that we're OK. If parent isn't there,
541
- assume we're not running in forkserver mode and just execute
542
- program. */
547
+ /* Phone home and tell the parent that we're OK. If parent isn't
548
+ there, assume we're not running in forkserver mode and just
549
+ execute program. */
543
550
if (write (FORKSRV_FD + 1 , &status, 4 ) != 4 )
544
551
return UC_AFL_RET_NO_AFL;
545
552
}
546
553
547
-
548
554
/* afl tells us in an extra message if it accepted this option or not */
549
555
if (this ->afl_testcase_ptr_ && getenv (SHM_FUZZ_ENV_VAR)) {
550
556
if (read (FORKSRV_FD, &status, 4 ) != 4 ) {
0 commit comments