silly rand_below_datalen fix
@@ -986,6 +986,8 @@ uint64_t rand_next(afl_state_t *afl);
static inline u32 rand_below(afl_state_t *afl, u32 limit) {
+ if (limit <= 1) return 0;
+
/* The boundary not being necessarily a power of 2,
we need to ensure the result uniformity. */
if (unlikely(!afl->rand_cnt--) && likely(!afl->fixed_seed)) {
@@ -1006,14 +1008,16 @@ static inline u32 rand_below(afl_state_t *afl, u32 limit) {
expand havoc mode */
static inline u32 rand_below_datalen(afl_state_t *afl, u32 limit) {
+ if (limit <= 1) return 0;
+
switch (rand_below(afl, 3)) {
case 2:
- return (rand_below(afl, limit) % rand_below(afl, limit)) %
- rand_below(afl, limit);
+ return (rand_below(afl, limit) % (1 + rand_below(afl, limit - 1))) %
+ (1 + rand_below(afl, limit - 1));
break;
case 1:
- return rand_below(afl, limit) % rand_below(afl, limit);
+ return rand_below(afl, limit) % (1 + rand_below(afl, limit - 1));
break;
case 0:
return rand_below(afl, limit);
