cmplog_binary coverage feedback problem

[che30122]

I thought that if cmplog_binary also instrument with coverage feedback mechanism, that will mislead the coverage feedback.

Because of two binary(cmplog_binary & afl_binary) with actual same edge might get differnet hash value in instrumentation.

[vanhauser-thc]

cmplog binaries always also have coverage information (although its not really necessary).
it doesnt matter if the coverage the two binaries report are the same or different. has no impact on the fuzzing. only one normal is used for "real" coverage.

[che30122]

But afl->cmplog_fsrv & afl->fsrv use the same memory address of trace_bits.

For example there is a seed taken edge 1->2.
cmplog binary instrument edge 1->2 hash value with 0xab, but afl binary might instrument edge 1->2 hash value different with 0xbb.
Then even with the same edge taken the trace_bits[0xab] & trace_bits[0xbb] will also be set, this will cause has_new_bits happen and mislead fuzzer?(afl->cmplog_fsrv.trace_bits & afl->fsrv.trace_bits use the same memory address)

Sorry, I don't know if my understanding is correct or not.