Skip to content

fix(cmplog): handle non-power-of-2 comparison sizes from AFL++ GCC plugin#3740

Open
akshaytheflash wants to merge 1 commit intoAFLplusplus:mainfrom
akshaytheflash:fix/cmplog-non-power-of-2-sizes
Open

fix(cmplog): handle non-power-of-2 comparison sizes from AFL++ GCC plugin#3740
akshaytheflash wants to merge 1 commit intoAFLplusplus:mainfrom
akshaytheflash:fix/cmplog-non-power-of-2-sizes

Conversation

@akshaytheflash
Copy link

Problem

AFL++'s GCC cmplog plugin (afl-gcc-cmplog-pass.so.cc) can report integer
comparison sizes that are not powers of 2 via the hookN variant. For
example, a 24-bit comparison gets shape = 2, 40-bit gets shape = 4, etc.

The clang plugin rounds these up to the nearest power of 2 (so 24-bit becomes
32-bit), but the GCC plugin reports the actual byte size. When LibAFL encounters
these shapes, it panics with:

panicked at 'Invalid CmpLog shape 2'

Both CmpLogMap::values_of and AflppCmpLogMap::values_of only handled shapes
0, 1, 3, 7 (corresponding to 1, 2, 4, 8 bytes), and panicked on anything
else.

Fix

Round non-power-of-2 sizes up to the next supported power of 2, matching the
clang plugin's behavior:

  • Shape 2 (24-bit) → treated as U32 (32-bit)
  • Shape 4/5/6 (40/48/56-bit) → treated as U64 (64-bit)

For any remaining truly unknown shapes (beyond 64-bit, which is a separate
TODO), emit a log::warn! instead of panicking, making the fuzzer resilient
rather than crashing.

References

…ugin

AFL++'s GCC cmplog plugin (afl-gcc-cmplog-pass.so.cc) can report comparison
sizes that are not powers of 2, e.g. 24-bit (shape=2), 40-bit (shape=4),
48-bit (shape=5), 56-bit (shape=6), via the hookN variant. The clang plugin
rounds these up to the next power of 2, but the GCC plugin reports the actual
size, causing LibAFL to panic with 'Invalid CmpLog shape {shape}'.

Fix both CmpLogMap::values_of and AflppCmpLogMap::values_of to treat:
- shape 2 (24-bit) as U32 (same as clang plugin)
- shapes 4/5/6 (40/48/56-bit) as U64 (same as clang plugin)

For any remaining unknown shapes, emit a warning instead of panicking.

Fixes AFLplusplus#3729
@tokatoka
Copy link
Member

did you just feed other people's issue and PR into LLM and made another PR out of it?

@akshaytheflash
Copy link
Author

did you just feed other people's issue and PR into LLM and made another PR out of it?

It didn't even pass the test cases bro, leave me alone 🥀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Panic when using AFL++ with cmplog on some sizes

2 participants