case 1:
	if (temp_len < 2) break;
	temp_len_puppet = UR(temp_len << 3);
	FLIP_BIT(out_buf, temp_len_puppet);
	FLIP_BIT(out_buf, temp_len_puppet + 1);
	stage_cycles_puppet_v2[swarm_now][STAGE_FLIP2] += 1;
	break;
case 2:
	if (temp_len < 2) break;
	temp_len_puppet = UR(temp_len << 3);
	FLIP_BIT(out_buf, temp_len_puppet);
	FLIP_BIT(out_buf, temp_len_puppet + 1);
	FLIP_BIT(out_buf, temp_len_puppet + 2);
	FLIP_BIT(out_buf, temp_len_puppet + 3);
	stage_cycles_puppet_v2[swarm_now][STAGE_FLIP4] += 1;
	break;

When the temp_len_puppet == (temp_len << 3) -1, FLIP_BIT will flip a bit out of out_buf.

And When ck_free(out_buf), It will cause an error.

Here is my test code

#define FLIP_BIT(_ar, _b)                                                      \
    do {                                                                       \
        u8 *_arf = (u8 *)(_ar);                                                \
        u32 _bf = (_b);                                                        \
        _arf[(_bf) >> 3] ^= (128 >> ((_bf)&7));                                \
    } while (0)

int main() {
    u8 *a = ck_alloc_nozero(10);
    memset(a, 0xff, 10);
    FLIP_BIT(a, 77);
    FLIP_BIT(a, 78);
    FLIP_BIT(a, 79);
    FLIP_BIT(a, 80);
    ck_free(a);
    return 0;
}

And the result is

[-] PROGRAM ABORT : Corrupted tail alloc canary.         
    Stop location : DFL_ck_free(), /home/xx/project/AFLTest/alloc-inl.h:150  

In deterministic stage, the stage_max = (len << 3) -3. So FLIP_BIT will not flip a bit out of out_buf.

stage_name = "bitflip 4/1";
stage_short = "flip4";
stage_max = (len << 3) - 3;

orig_hit_cnt = new_hit_cnt;

for (stage_cur = 0; stage_cur < stage_max; stage_cur++) {

   stage_cur_byte = stage_cur >> 3;

   FLIP_BIT(out_buf, stage_cur);
   FLIP_BIT(out_buf, stage_cur + 1);
   FLIP_BIT(out_buf, stage_cur + 2);
   FLIP_BIT(out_buf, stage_cur + 3);

    if (common_fuzz_stuff(argv, out_buf, len))
       goto abandon_entry;

    FLIP_BIT(out_buf, stage_cur);
    FLIP_BIT(out_buf, stage_cur + 1);
    FLIP_BIT(out_buf, stage_cur + 2);
    FLIP_BIT(out_buf, stage_cur + 3);
}

However, I have not seen such error when I use MOPT. But this may be a potential problem. Or maybe you did something else to avoid such problem?

When I fuzz w3m with MOpt and also AFL, it always timeout, do you meet the same problem? please help, thank you! the commond I use is shown above, and my os is Ubuntu 18.04

git clone https://github.com/tats/w3m.git
cd w3m
./configure
make
afl-fuzz -Q -i path/to/input/dir -o path/to/output/dir path/to/w3m @@

then the output is

[-] The program took more than 1000 ms to process one of the initial test cases.
    This is bad news; raising the limit with the -t option is possible, but
    will probably make the fuzzing process extremely slow.

    If this test case is just a fluke, the other option is to just avoid it
    altogether, and find one that is less of a CPU hog.

[-] PROGRAM ABORT : Test case 'id:000000,orig:0.txt' results in a timeout
         Location : perform_dry_run(), afl-fuzz.c:2823

In the paper "SmartSeed: Smart Seed Generation for EfficientFuzzing", it is stated that

We also make our system publicly available to facilitate the research in this area, which is available at: https://github.com/puppet-meteor/SmartSeed

However, this still has not been done. Do you still plan to do so?

Hello, I try to run the experiment in the paper and run MOpt-AFL in LAVA-M, and I run base64 in 5 hours, but I can not find any crash. Here is the instruction I ues: MOpt-AFL/MOpt/afl-fuzz -m none -i fuzzer_input/ -o output4 -Q coreutils-8.24-lava-safe/lava-install/bin/base64 -d @@ Here is the run result: Thanks for your help!!!

When compiling with LLVM 9, the post build tests contained in llvm_mode/Makefile are failing. It is a known problem that has been fixed in the AFL repository.

Comment explaining the problem: https://github.com/google/AFL/issues/30#issuecomment-530716446 Commit fixing the problem: https://github.com/google/AFL/commit/1f414d53535ea470bba3858bc1324081baf22c75

I hope this helps, I can make a pull request if needed.

Hi guys, you have done a very cool work congratulations. I'm here to ask if you want to contribute to https://github.com/vanhauser-thc/AFLplusplus and submit a pull request including your changes to AFL. AFL++ is a the son of AFL (the lastest change to AFL is at least 2 years ago) which merges all the best features independently added to AFL in recent years in a single implementation. The results in the paper are awesome and I'd like to see this technique merged so that all the best of the AFL family can live in a single repo and avoid fragmentation.

Thanks, Andrea

Hi, I looked into the code and noticed that MOpt changes no codes in the deterministic mutation stage. Is it true that we should run MOpt with "-d" that skip the deterministic stage? Thanks

https://github.com/puppet-meteor/MOpt-AFL/blob/a9a5dc5c0c291c1cdb09b2b7b27d7cbf1db7ce7b/MOpt/afl-fuzz.c#L8689

I formatted the code a bit, and it reads:

...
if (unlikely(
        queued_paths + unique_crashes >
      ((queued_paths + unique_crashes) * 1.1 + orig_hit_cnt_puppet))) {
key_puppet = 0;
...

If I understand correctly, key_puppet never goes back to 0 (due to the factor of 1.1 and the addition of u64 orig_hit_cnt_puppet). Could you please explain the design behind? Thanks in advance!