Roll AFL 2.31b:2.38b and switch coverage to use trace-pc-guard.

third_party/afl/src/libdislocator/libdislocator.so.c

 /*
 
    american fuzzy lop - dislocator, an abusive allocator
    -----------------------------------------------------
 
    Written and maintained by Michal Zalewski <lcamtuf@google.com>
 
    Copyright 2016 Google Inc. All rights reserved.
 
    Licensed under the Apache License, Version 2.0 (the "License");
@@ skipping 46 matching lines @@
     call_depth--; \
   } while (0)
 
 /* Macro to count the number of pages needed to store a buffer: */
 
 #define PG_COUNT(_l) (((_l) + (PAGE_SIZE - 1)) / PAGE_SIZE)
 
 /* Canary & clobber bytes: */
 
 #define ALLOC_CANARY  0xAACCAACC
-#define ALLOC_CLOBBER 0x41
+#define ALLOC_CLOBBER 0xCC
 
 #define PTR_C(_p) (((u32*)(_p))[-1])
 #define PTR_L(_p) (((u32*)(_p))[-2])
 
 /* Configurable stuff (use AFL_LD_* to set): */
 
 static u32 max_mem = MAX_ALLOC;         /* Max heap usage to permit         */
 static u8  alloc_verbose,               /* Additional debug messages        */
            hard_fail;                   /* abort() when max_mem exceeded?   */
 
 static __thread size_t total_mem;       /* Currently allocated mem          */
 
 static __thread u32 call_depth;         /* To avoid recursion via fprintf() */
 
 
 /* This is the main alloc function. It allocates one page more than necessary,
    sets that tailing page to PROT_NONE, and then increments the return address
    so that it is right-aligned to that boundary. Since it always uses mmap(),
    the returned memory will be zeroed. */
 
 static void* __dislocator_alloc(size_t len) {
 
   void* ret;
 
-  if (total_mem + len > max_mem) {
+
+  if (total_mem + len > max_mem || total_mem + len < total_mem) {
 
     if (hard_fail)
       FATAL("total allocs exceed %u MB", max_mem / 1024 / 1024);
 
     DEBUGF("total allocs exceed %u MB, returning NULL",
            max_mem / 1024 / 1024);
 
     return NULL;
 
   }
@@ skipping 145 matching lines @@
 
     max_mem = atoi(tmp) * 1024 * 1024;
     if (!max_mem) FATAL("Bad value for AFL_LD_LIMIT_MB");
 
   }
 
   alloc_verbose = !!getenv("AFL_LD_VERBOSE");
   hard_fail = !!getenv("AFL_LD_HARD_FAIL");
 
 }