COMPCOV off-by-one (or more!), index overflowing map

[AlLongley]

I have managed to trigger a buffer overflow in my Qiling target if _uc_hook_sub_impl_64 is called with a cur_loc close to, but less than the total MAP_SIZE. I believe the per-byte comparison "+" offsets push it over, incrementing an index beyond the map's buffer itself.

Take for example the following values:

MAP_SIZE = afl_inst_rms_ = 0x10000
cur_loc = 0xffff
afl_prev_loc_ = 0x3777

https://github.com/AFLplusplus/unicornafl/blob/2abdcd3c796042eaf62ed03e57bcd4199d12b935/unicornafl.cpp#L367-L370

The resulting incremented afl_area_ptr_ index is: 0x13772, overflowing the MAP_SIZE by a lot, losing a coverage point and potentially crashing the target.

I can see there's a check to attempt to avoid this before the individual byte checks are called, should the comparison instead be >= (ucafl->afl_inst_rms_-6)) or similar ?

https://github.com/AFLplusplus/unicornafl/blob/2abdcd3c796042eaf62ed03e57bcd4199d12b935/unicornafl.cpp#L418

[vanhauser-thc]

thanks for the bug report! I just pushed a simple fix.

[wtdcode]

Nice catch and thanks @vanhauser-thc for the quick fix.