Skip to content

Conversation

@sykweon
Copy link
Contributor

@sykweon sykweon commented Jun 16, 2023

instrument/SanitizerCoveragePCGUARD has a bug in local_select counter in function InjectCoverage.
bug: ConstantInt::get(IntptrTy, (cnt_cov + ++local_selects + AllBlocks.size()) * 4)), Int32PtrTy);
fixed: ConstantInt::get(IntptrTy, (cnt_cov + local_selects++ + AllBlocks.size()) * 4)), Int32PtrTy);

IR of toy prog with the bug:

  %21 = select i1 %20, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @str, i64 0, i64 0), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @str.4, i64 0, i64 0), !dbg !25
  %22 = select i1 %20, i32* inttoptr (i64 add (i64 ptrtoint ([4 x i32]* @__sancov_gen_ to i64), i64 8) to i32*), i32* inttoptr (i64 add (i64 ptrtoint ([4 x i32]* @__sancov_gen_ to i64), i64 12) to i32*), !dbg !26

IR of toy prog with the bug fixed:

  %21 = select i1 %20, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @str, i64 0, i64 0), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @str.4, i64 0, i64 0), !dbg !25
  %22 = select i1 %20, i32* inttoptr (i64 add (i64 ptrtoint ([4 x i32]* @__sancov_gen_ to i64), i64 4) to i32*), i32* inttoptr (i64 add (i64 ptrtoint ([4 x i32]* @__sancov_gen_ to i64), i64 8) to i32*), !dbg !26

In the first IR, the pointer of the second select starts from 8 while it is the index is at 1.

@domenukk domenukk changed the title fix bug fix bug in SanitizerCoveragePCGUARD Jun 17, 2023
@vanhauser-thc
Copy link
Member

ah I see, good catch!
can you please check also SantitizeCoverageLTO? It could have the same bug.

@vanhauser-thc vanhauser-thc merged commit 68aacc4 into AFLplusplus:dev Jun 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants