@@ -400,11 +400,18 @@ class UCAFL {
400400
401401 void _uc_hook_sub_impl (uint64_t cur_loc, uint64_t arg1, uint64_t arg2,
402402 uint32_t size) {
403+
403404 if (size >= 64 ) {
405+ if (unlikely (MAP_SIZE - cur_loc < 8 ))
406+ cur_loc -= 8 ;
404407 this ->_uc_hook_sub_impl_64 (cur_loc, arg1, arg2);
405408 } else if (size >= 32 ) {
409+ if (unlikely (MAP_SIZE - cur_loc < 4 ))
410+ cur_loc -= 4 ;
406411 this ->_uc_hook_sub_impl_32 (cur_loc, arg1, arg2);
407412 } else {
413+ if (unlikely (MAP_SIZE - cur_loc < 2 ))
414+ cur_loc -= 2 ;
408415 this ->_uc_hook_sub_impl_16 (cur_loc, arg1, arg2);
409416 }
410417 }
@@ -537,14 +544,13 @@ class UCAFL {
537544 /* Parent supports testcases via shared map - and the user wants to
538545 * use it. Tell AFL. */
539546 status = (FS_OPT_ENABLED | FS_OPT_SHDMEM_FUZZ);
540- /* Phone home and tell the parent that we're OK. If parent isn't there,
541- assume we're not running in forkserver mode and just execute
542- program. */
547+ /* Phone home and tell the parent that we're OK. If parent isn't
548+ there, assume we're not running in forkserver mode and just
549+ execute program. */
543550 if (write (FORKSRV_FD + 1 , &status, 4 ) != 4 )
544551 return UC_AFL_RET_NO_AFL;
545552 }
546553
547-
548554 /* afl tells us in an extra message if it accepted this option or not */
549555 if (this ->afl_testcase_ptr_ && getenv (SHM_FUZZ_ENV_VAR)) {
550556 if (read (FORKSRV_FD, &status, 4 ) != 4 ) {
0 commit comments