diff --git a/afl-fuzz.c b/afl-fuzz.c index 802c8e97..562fd509 100644 --- a/afl-fuzz.c +++ b/afl-fuzz.c @@ -114,6 +114,7 @@ EXP_ST u8 skip_deterministic, /* Skip deterministic stages? */ in_place_resume, /* Attempt in-place resume? */ auto_changed, /* Auto-generated tokens changed? */ no_cpu_meter_red, /* Feng shui on the status screen */ + no_arith, /* Skip most arithmetic ops */ shuffle_queue, /* Shuffle input queue? */ bitmap_changed = 1, /* Time to update bitmap? */ qemu_mode, /* Running in QEMU mode? */ @@ -4546,8 +4547,6 @@ static u8 trim_case(char** argv, struct queue_entry* q, u8* in_buf) { } - - abort_trimming: bytes_trim_out += q->len; @@ -5395,6 +5394,8 @@ static u8 fuzz_one(char** argv) { skip_bitflip: + if (no_arith) goto skip_arith; + /********************** * ARITHMETIC INC/DEC * **********************/ @@ -5708,7 +5709,7 @@ static u8 fuzz_one(char** argv) { /* Setting 16-bit integers, both endians. */ - if (len < 2) goto skip_interest; + if (no_arith || len < 2) goto skip_interest; stage_name = "interest 16/8"; stage_short = "int16"; @@ -7882,6 +7883,7 @@ int main(int argc, char** argv) { if (getenv("AFL_NO_FORKSRV")) no_forkserver = 1; if (getenv("AFL_NO_CPU_RED")) no_cpu_meter_red = 1; + if (getenv("AFL_NO_ARITH")) no_arith = 1; if (getenv("AFL_SHUFFLE_QUEUE")) shuffle_queue = 1; if (getenv("AFL_HANG_TMOUT")) { diff --git a/config.h b/config.h index 8c4d7973..c51e0528 100644 --- a/config.h +++ b/config.h @@ -21,7 +21,7 @@ /* Version string: */ -#define VERSION "2.42b" +#define VERSION "2.43b" /****************************************************** * * diff --git a/docs/ChangeLog b/docs/ChangeLog index 41f1d843..0df03c35 100644 --- a/docs/ChangeLog +++ b/docs/ChangeLog @@ -16,6 +16,13 @@ Not sure if you should upgrade? The lowest currently recommended version is 2.41b. If you're stuck on an earlier release, it's strongly advisable to get on with the times. +-------------- +Version 2.43b: +-------------- + + - Added AFL_NO_ARITH to aid in the fuzzing of text-based formats. + Requested by Jakub Wilk. + -------------- Version 2.42b: -------------- diff --git a/docs/env_variables.txt b/docs/env_variables.txt index bae8fd8d..97d81694 100644 --- a/docs/env_variables.txt +++ b/docs/env_variables.txt @@ -123,6 +123,9 @@ checks or alter some of the more exotic semantics of the tool: don't want AFL to spend too much time classifying that stuff and just rapidly put all timeouts in that bin. + - AFL_NO_ARITH causes AFL to skip most of the deterministic arithmetics. + This can be useful to speed up the fuzzing of text-based file formats. + - AFL_SHUFFLE_QUEUE randomly reorders the input queue on startup. Requested by some users for unorthodox parallelized fuzzing setups, but not advisable otherwise.