[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-coverage-analysis":3,"mdc--d5dixc-key":35,"related-repo-trail-of-bits-coverage-analysis":5098,"related-org-trail-of-bits-coverage-analysis":5193},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":30,"sourceUrl":33,"mdContent":34},"coverage-analysis","measure code coverage during fuzzing","Coverage analysis measures code exercised during fuzzing. Use when assessing harness effectiveness or identifying fuzzing blockers.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Code Analysis","code-analysis",{"name":21,"slug":22,"type":16},"Testing","testing",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-17T06:05:22.817033",null,541,[29],"agent-skills",{"repoUrl":24,"stars":23,"forks":27,"topics":31,"description":32},[29],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Ftesting-handbook-skills\u002Fskills\u002Fcoverage-analysis","---\nname: coverage-analysis\ntype: technique\ndescription: >\n  Coverage analysis measures code exercised during fuzzing.\n  Use when assessing harness effectiveness or identifying fuzzing blockers.\n---\n\n# Coverage Analysis\n\nCoverage analysis is essential for understanding which parts of your code are exercised during fuzzing. It helps identify fuzzing blockers like magic value checks and tracks the effectiveness of harness improvements over time.\n\n## Overview\n\nCode coverage during fuzzing serves two critical purposes:\n\n1. **Assessing harness effectiveness**: Understand which parts of your application are actually executed by your fuzzing harnesses\n2. **Tracking fuzzing progress**: Monitor how coverage changes when updating harnesses, fuzzers, or the system under test (SUT)\n\nCoverage is a proxy for fuzzer capability and performance. While coverage [is not ideal for measuring fuzzer performance](https:\u002F\u002Farxiv.org\u002Fabs\u002F1808.09700) in absolute terms, it reliably indicates whether your harness works effectively in a given setup.\n\n### Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Coverage instrumentation** | Compiler flags that track which code paths are executed |\n| **Corpus coverage** | Coverage achieved by running all test cases in a fuzzing corpus |\n| **Magic value checks** | Hard-to-discover conditional checks that block fuzzer progress |\n| **Coverage-guided fuzzing** | Fuzzing strategy that prioritizes inputs that discover new code paths |\n| **Coverage report** | Visual or textual representation of executed vs. unexecuted code |\n\n## When to Apply\n\n**Apply this technique when:**\n- Starting a new fuzzing campaign to establish a baseline\n- Fuzzer appears to plateau without finding new paths\n- After harness modifications to verify improvements\n- When migrating between different fuzzers\n- Identifying areas requiring dictionary entries or seed inputs\n- Debugging why certain code paths aren't reached\n\n**Skip this technique when:**\n- Fuzzing campaign is actively finding crashes\n- Coverage infrastructure isn't set up yet\n- Working with extremely large codebases where full coverage reports are impractical\n- Fuzzer's internal coverage metrics are sufficient for your needs\n\n## Quick Reference\n\n| Task | Command\u002FPattern |\n|------|-----------------|\n| LLVM coverage instrumentation (C\u002FC++) | `-fprofile-instr-generate -fcoverage-mapping` |\n| GCC coverage instrumentation | `-ftest-coverage -fprofile-arcs` |\n| cargo-fuzz coverage (Rust) | `cargo +nightly fuzz coverage \u003Ctarget>` |\n| Generate LLVM profile data | `llvm-profdata merge -sparse file.profraw -o file.profdata` |\n| LLVM coverage report | `llvm-cov report .\u002Fbinary -instr-profile=file.profdata` |\n| LLVM HTML report | `llvm-cov show .\u002Fbinary -instr-profile=file.profdata -format=html -output-dir html\u002F` |\n| gcovr HTML report | `gcovr --html-details -o coverage.html` |\n\n## Ideal Coverage Workflow\n\nThe following workflow represents best practices for integrating coverage analysis into your fuzzing campaigns:\n\n```\n[Fuzzing Campaign]\n       |\n       v\n[Generate Corpus]\n       |\n       v\n[Coverage Analysis]\n       |\n       +---> Coverage Increased? --> Continue fuzzing with larger corpus\n       |\n       +---> Coverage Decreased? --> Fix harness or investigate SUT changes\n       |\n       +---> Coverage Plateaued? --> Add dictionary entries or seed inputs\n```\n\n**Key principle**: Use the corpus generated *after* each fuzzing campaign to calculate coverage, rather than real-time fuzzer statistics. This approach provides reproducible, comparable measurements across different fuzzing tools.\n\n## Step-by-Step\n\n### Step 1: Build with Coverage Instrumentation\n\nChoose your instrumentation method based on toolchain:\n\n**LLVM\u002FClang (C\u002FC++):**\n```bash\nclang++ -fprofile-instr-generate -fcoverage-mapping \\\n  -O2 -DNO_MAIN \\\n  main.cc harness.cc execute-rt.cc -o fuzz_exec\n```\n\n**GCC (C\u002FC++):**\n```bash\ng++ -ftest-coverage -fprofile-arcs \\\n  -O2 -DNO_MAIN \\\n  main.cc harness.cc execute-rt.cc -o fuzz_exec_gcov\n```\n\n**Rust:**\n```bash\nrustup toolchain install nightly --component llvm-tools-preview\ncargo +nightly fuzz coverage fuzz_target_1\n```\n\n### Step 2: Create Execution Runtime (C\u002FC++ only)\n\nFor C\u002FC++ projects, create a runtime that executes your corpus:\n\n```cpp\n\u002F\u002F execute-rt.cc\n#include \u003Cstdio.h>\n#include \u003Cstdlib.h>\n#include \u003Cdirent.h>\n#include \u003Cstdint.h>\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);\n\nvoid load_file_and_test(const char *filename) {\n    FILE *file = fopen(filename, \"rb\");\n    if (file == NULL) {\n        printf(\"Failed to open file: %s\\n\", filename);\n        return;\n    }\n\n    fseek(file, 0, SEEK_END);\n    long filesize = ftell(file);\n    rewind(file);\n\n    uint8_t *buffer = (uint8_t*) malloc(filesize);\n    if (buffer == NULL) {\n        printf(\"Failed to allocate memory for file: %s\\n\", filename);\n        fclose(file);\n        return;\n    }\n\n    long read_size = (long) fread(buffer, 1, filesize, file);\n    if (read_size != filesize) {\n        printf(\"Failed to read file: %s\\n\", filename);\n        free(buffer);\n        fclose(file);\n        return;\n    }\n\n    LLVMFuzzerTestOneInput(buffer, filesize);\n\n    free(buffer);\n    fclose(file);\n}\n\nint main(int argc, char **argv) {\n    if (argc != 2) {\n        printf(\"Usage: %s \u003Cdirectory>\\n\", argv[0]);\n        return 1;\n    }\n\n    DIR *dir = opendir(argv[1]);\n    if (dir == NULL) {\n        printf(\"Failed to open directory: %s\\n\", argv[1]);\n        return 1;\n    }\n\n    struct dirent *entry;\n    while ((entry = readdir(dir)) != NULL) {\n        if (entry->d_type == DT_REG) {\n            char filepath[1024];\n            snprintf(filepath, sizeof(filepath), \"%s\u002F%s\", argv[1], entry->d_name);\n            load_file_and_test(filepath);\n        }\n    }\n\n    closedir(dir);\n    return 0;\n}\n```\n\n### Step 3: Execute on Corpus\n\n**LLVM (C\u002FC++):**\n```bash\nLLVM_PROFILE_FILE=fuzz.profraw .\u002Ffuzz_exec corpus\u002F\n```\n\n**GCC (C\u002FC++):**\n```bash\n.\u002Ffuzz_exec_gcov corpus\u002F\n```\n\n**Rust:**\nCoverage data is automatically generated when running `cargo fuzz coverage`.\n\n### Step 4: Process Coverage Data\n\n**LLVM:**\n```bash\n# Merge raw profile data\nllvm-profdata merge -sparse fuzz.profraw -o fuzz.profdata\n\n# Generate text report\nllvm-cov report .\u002Ffuzz_exec \\\n  -instr-profile=fuzz.profdata \\\n  -ignore-filename-regex='harness.cc|execute-rt.cc'\n\n# Generate HTML report\nllvm-cov show .\u002Ffuzz_exec \\\n  -instr-profile=fuzz.profdata \\\n  -ignore-filename-regex='harness.cc|execute-rt.cc' \\\n  -format=html -output-dir fuzz_html\u002F\n```\n\n**GCC with gcovr:**\n```bash\n# Install gcovr (via pip for latest version)\npython3 -m venv venv\nsource venv\u002Fbin\u002Factivate\npip3 install gcovr\n\n# Generate report\ngcovr --gcov-executable \"llvm-cov gcov\" \\\n  --exclude harness.cc --exclude execute-rt.cc \\\n  --root . --html-details -o coverage.html\n```\n\n**Rust:**\n```bash\n# Install required tools\ncargo install cargo-binutils rustfilt\n\n# Create HTML generation script\ncat \u003C\u003C'EOF' > .\u002Fgenerate_html\n#!\u002Fbin\u002Fsh\nif [ $# -lt 1 ]; then\n    echo \"Error: Name of fuzz target is required.\"\n    echo \"Usage: $0 fuzz_target [sources...]\"\n    exit 1\nfi\nFUZZ_TARGET=\"$1\"\nshift\nSRC_FILTER=\"$@\"\nTARGET=$(rustc -vV | sed -n 's|host: ||p')\ncargo +nightly cov -- show -Xdemangler=rustfilt \\\n  \"target\u002F$TARGET\u002Fcoverage\u002F$TARGET\u002Frelease\u002F$FUZZ_TARGET\" \\\n  -instr-profile=\"fuzz\u002Fcoverage\u002F$FUZZ_TARGET\u002Fcoverage.profdata\" \\\n  -show-line-counts-or-regions -show-instantiations \\\n  -format=html -o fuzz_html\u002F $SRC_FILTER\nEOF\nchmod +x .\u002Fgenerate_html\n\n# Generate HTML report\n.\u002Fgenerate_html fuzz_target_1 src\u002Flib.rs\n```\n\n### Step 5: Analyze Results\n\nReview the coverage report to identify:\n\n- **Uncovered code blocks**: Areas that may need better seed inputs or dictionary entries\n- **Magic value checks**: Conditional statements with hardcoded values that block progress\n- **Dead code**: Functions that may not be reachable through your harness\n- **Coverage changes**: Compare against baseline to track improvements or regressions\n\n## Common Patterns\n\n### Pattern: Identifying Magic Values\n\n**Problem**: Fuzzer cannot discover paths guarded by magic value checks.\n\n**Coverage reveals:**\n```cpp\n\u002F\u002F Coverage shows this block is never executed\nif (buf == 0x7F454C46) {  \u002F\u002F ELF magic number\n    \u002F\u002F start parsing buf\n}\n```\n\n**Solution**: Add magic values to dictionary file:\n```\n# magic.dict\n\"\\x7F\\x45\\x4C\\x46\"\n```\n\n### Pattern: Handling Crashing Inputs\n\n**Problem**: Coverage generation fails when corpus contains crashing inputs.\n\n**Before:**\n```bash\n.\u002Ffuzz_exec corpus\u002F  # Crashes on bad input, no coverage generated\n```\n\n**After:**\n```cpp\n\u002F\u002F Fork before executing to isolate crashes\nint main(int argc, char **argv) {\n    \u002F\u002F ... directory opening code ...\n\n    while ((entry = readdir(dir)) != NULL) {\n        if (entry->d_type == DT_REG) {\n            pid_t pid = fork();\n            if (pid == 0) {\n                \u002F\u002F Child process - crash won't affect parent\n                char filepath[1024];\n                snprintf(filepath, sizeof(filepath), \"%s\u002F%s\", argv[1], entry->d_name);\n                load_file_and_test(filepath);\n                exit(0);\n            } else {\n                \u002F\u002F Parent waits for child\n                waitpid(pid, NULL, 0);\n            }\n        }\n    }\n}\n```\n\n### Pattern: CMake Integration\n\n**Use Case**: Adding coverage builds to CMake projects.\n\n```cmake\nproject(FuzzingProject)\ncmake_minimum_required(VERSION 3.0)\n\n# Main binary\nadd_executable(program main.cc)\n\n# Fuzzing binary\nadd_executable(fuzz main.cc harness.cc)\ntarget_compile_definitions(fuzz PRIVATE NO_MAIN=1)\ntarget_compile_options(fuzz PRIVATE -g -O2 -fsanitize=fuzzer)\ntarget_link_libraries(fuzz -fsanitize=fuzzer)\n\n# Coverage execution binary\nadd_executable(fuzz_exec main.cc harness.cc execute-rt.cc)\ntarget_compile_definitions(fuzz_exec PRIVATE NO_MAIN)\ntarget_compile_options(fuzz_exec PRIVATE -O2 -fprofile-instr-generate -fcoverage-mapping)\ntarget_link_libraries(fuzz_exec -fprofile-instr-generate)\n```\n\nBuild:\n```bash\ncmake -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ .\ncmake --build . --target fuzz_exec\n```\n\n## Advanced Usage\n\n### Tips and Tricks\n\n| Tip | Why It Helps |\n|-----|--------------|\n| Use LLVM 18+ with `-show-directory-coverage` | Organizes large reports by directory structure instead of flat file list |\n| Export to lcov format for better HTML | `llvm-cov export -format=lcov` + `genhtml` provides cleaner per-file reports |\n| Compare coverage across campaigns | Store `.profdata` files with timestamps to track progress over time |\n| Filter harness code from reports | Use `-ignore-filename-regex` to focus on SUT coverage only |\n| Automate coverage in CI\u002FCD | Generate coverage reports automatically after scheduled fuzzing runs |\n| Use gcovr 5.1+ for Clang 14+ | Older gcovr versions have compatibility issues with recent LLVM |\n\n### Incremental Coverage Updates\n\nGCC's gcov instrumentation incrementally updates `.gcda` files across multiple runs. This is useful for tracking coverage as you add test cases:\n\n```bash\n# First run\n.\u002Ffuzz_exec_gcov corpus_batch_1\u002F\ngcovr --html coverage_v1.html\n\n# Second run (adds to existing coverage)\n.\u002Ffuzz_exec_gcov corpus_batch_2\u002F\ngcovr --html coverage_v2.html\n\n# Start fresh\ngcovr --delete  # Remove .gcda files\n.\u002Ffuzz_exec_gcov corpus\u002F\n```\n\n### Handling Large Codebases\n\nFor projects with hundreds of source files:\n\n1. **Filter by prefix**: Only generate reports for relevant directories\n   ```bash\n   llvm-cov show .\u002Ffuzz_exec -instr-profile=fuzz.profdata \u002Fpath\u002Fto\u002Fsrc\u002F\n   ```\n\n2. **Use directory coverage**: Group by directory to reduce clutter (LLVM 18+)\n   ```bash\n   llvm-cov show -show-directory-coverage -format=html -output-dir html\u002F\n   ```\n\n3. **Generate JSON for programmatic analysis**:\n   ```bash\n   llvm-cov export -format=lcov > coverage.json\n   ```\n\n### Differential Coverage\n\nCompare coverage between two fuzzing campaigns:\n\n```bash\n# Campaign 1\nLLVM_PROFILE_FILE=campaign1.profraw .\u002Ffuzz_exec corpus1\u002F\nllvm-profdata merge -sparse campaign1.profraw -o campaign1.profdata\n\n# Campaign 2\nLLVM_PROFILE_FILE=campaign2.profraw .\u002Ffuzz_exec corpus2\u002F\nllvm-profdata merge -sparse campaign2.profraw -o campaign2.profdata\n\n# Compare\nllvm-cov show .\u002Ffuzz_exec \\\n  -instr-profile=campaign2.profdata \\\n  -instr-profile=campaign1.profdata \\\n  -show-line-counts-or-regions\n```\n\n## Anti-Patterns\n\n| Anti-Pattern | Problem | Correct Approach |\n|--------------|---------|------------------|\n| Using fuzzer-reported coverage for comparisons | Different fuzzers calculate coverage differently, making cross-tool comparison meaningless | Use dedicated coverage tools (llvm-cov, gcovr) for reproducible measurements |\n| Generating coverage with optimizations | `-O3` optimizations can eliminate code, making coverage misleading | Use `-O2` or `-O0` for coverage builds |\n| Not filtering harness code | Harness coverage inflates numbers and obscures SUT coverage | Use `-ignore-filename-regex` or `--exclude` to filter harness files |\n| Mixing LLVM and GCC instrumentation | Incompatible formats cause parsing failures | Stick to one toolchain for coverage builds |\n| Ignoring crashing inputs | Crashes prevent coverage generation, hiding real coverage data | Fix crashes first, or use process forking to isolate them |\n| Not tracking coverage over time | One-time coverage checks miss regressions and improvements | Store coverage data with timestamps and track trends |\n\n## Tool-Specific Guidance\n\n### libFuzzer\n\nlibFuzzer uses LLVM's SanitizerCoverage by default for guiding fuzzing, but you need separate instrumentation for generating reports.\n\n**Build for coverage:**\n```bash\nclang++ -fprofile-instr-generate -fcoverage-mapping \\\n  -O2 -DNO_MAIN \\\n  main.cc harness.cc execute-rt.cc -o fuzz_exec\n```\n\n**Execute corpus and generate report:**\n```bash\nLLVM_PROFILE_FILE=fuzz.profraw .\u002Ffuzz_exec corpus\u002F\nllvm-profdata merge -sparse fuzz.profraw -o fuzz.profdata\nllvm-cov show .\u002Ffuzz_exec -instr-profile=fuzz.profdata -format=html -output-dir html\u002F\n```\n\n**Integration tips:**\n- Don't use `-fsanitize=fuzzer` for coverage builds (it conflicts with profile instrumentation)\n- Reuse the same harness function (`LLVMFuzzerTestOneInput`) with a different main function\n- Use the `-ignore-filename-regex` flag to exclude harness code from coverage reports\n- Consider using llvm-cov's `-show-instantiation` flag for template-heavy C++ code\n\n### AFL++\n\nAFL++ provides its own coverage feedback mechanism, but for detailed reports use standard LLVM\u002FGCC tools.\n\n**Build for coverage with LLVM:**\n```bash\nclang++ -fprofile-instr-generate -fcoverage-mapping \\\n  -O2 main.cc harness.cc execute-rt.cc -o fuzz_exec\n```\n\n**Build for coverage with GCC:**\n```bash\nAFL_USE_ASAN=0 afl-gcc -ftest-coverage -fprofile-arcs \\\n  main.cc harness.cc execute-rt.cc -o fuzz_exec_gcov\n```\n\n**Execute and generate report:**\n```bash\n# LLVM approach\nLLVM_PROFILE_FILE=fuzz.profraw .\u002Ffuzz_exec afl_output\u002Fqueue\u002F\nllvm-profdata merge -sparse fuzz.profraw -o fuzz.profdata\nllvm-cov report .\u002Ffuzz_exec -instr-profile=fuzz.profdata\n\n# GCC approach\n.\u002Ffuzz_exec_gcov afl_output\u002Fqueue\u002F\ngcovr --html-details -o coverage.html\n```\n\n**Integration tips:**\n- Don't use AFL++'s instrumentation (`afl-clang-fast`) for coverage builds\n- Use standard compilers with coverage flags instead\n- AFL++'s `queue\u002F` directory contains your corpus\n- AFL++'s built-in coverage statistics are useful for real-time monitoring but not for detailed analysis\n\n### cargo-fuzz (Rust)\n\ncargo-fuzz provides built-in coverage generation using LLVM tools.\n\n**Install prerequisites:**\n```bash\nrustup toolchain install nightly --component llvm-tools-preview\ncargo install cargo-binutils rustfilt\n```\n\n**Generate coverage data:**\n```bash\ncargo +nightly fuzz coverage fuzz_target_1\n```\n\n**Create HTML report script:**\n```bash\ncat \u003C\u003C'EOF' > .\u002Fgenerate_html\n#!\u002Fbin\u002Fsh\nFUZZ_TARGET=\"$1\"\nshift\nSRC_FILTER=\"$@\"\nTARGET=$(rustc -vV | sed -n 's|host: ||p')\ncargo +nightly cov -- show -Xdemangler=rustfilt \\\n  \"target\u002F$TARGET\u002Fcoverage\u002F$TARGET\u002Frelease\u002F$FUZZ_TARGET\" \\\n  -instr-profile=\"fuzz\u002Fcoverage\u002F$FUZZ_TARGET\u002Fcoverage.profdata\" \\\n  -show-line-counts-or-regions -show-instantiations \\\n  -format=html -o fuzz_html\u002F $SRC_FILTER\nEOF\nchmod +x .\u002Fgenerate_html\n```\n\n**Generate report:**\n```bash\n.\u002Fgenerate_html fuzz_target_1 src\u002Flib.rs\n```\n\n**Integration tips:**\n- Always use the nightly toolchain for coverage\n- The `-Xdemangler=rustfilt` flag makes function names readable\n- Filter by source files (e.g., `src\u002Flib.rs`) to focus on crate code\n- Use `-show-line-counts-or-regions` and `-show-instantiations` for better Rust-specific output\n- Corpus is located in `fuzz\u002Fcorpus\u002F\u003Ctarget>\u002F`\n\n### honggfuzz\n\nhonggfuzz works with standard LLVM\u002FGCC coverage instrumentation.\n\n**Build for coverage:**\n```bash\n# Use standard compiler, not honggfuzz compiler\nclang -fprofile-instr-generate -fcoverage-mapping \\\n  -O2 harness.c execute-rt.c -o fuzz_exec\n```\n\n**Execute corpus:**\n```bash\nLLVM_PROFILE_FILE=fuzz.profraw .\u002Ffuzz_exec honggfuzz_workspace\u002F\n```\n\n**Integration tips:**\n- Don't use `hfuzz-clang` for coverage builds\n- honggfuzz corpus is typically in a workspace directory\n- Use the same LLVM workflow as libFuzzer\n\n## Troubleshooting\n\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| `error: no profile data available` | Profile wasn't generated or wrong path | Verify `LLVM_PROFILE_FILE` was set and `.profraw` file exists |\n| `Failed to load coverage` | Mismatch between binary and profile data | Rebuild binary with same flags used during execution |\n| Coverage reports show 0% | Wrong binary used for report generation | Use the instrumented binary, not the fuzzing binary |\n| `no_working_dir_found` error (gcovr) | `.gcda` files in unexpected location | Add `--gcov-ignore-errors=no_working_dir_found` flag |\n| Crashes prevent coverage generation | Corpus contains crashing inputs | Filter crashes or use forking approach to isolate failures |\n| Coverage decreases after harness change | Harness now skips certain code paths | Review harness logic; may need to support more input formats |\n| HTML report is flat file list | Using older LLVM version | Upgrade to LLVM 18+ and use `-show-directory-coverage` |\n| `incompatible instrumentation` | Mixing LLVM and GCC coverage | Rebuild everything with same toolchain |\n\n## Related Skills\n\n### Tools That Use This Technique\n\n| Skill | How It Applies |\n|-------|----------------|\n| **libfuzzer** | Uses SanitizerCoverage for feedback; coverage analysis evaluates harness effectiveness |\n| **aflpp** | Uses edge coverage for feedback; detailed analysis requires separate instrumentation |\n| **cargo-fuzz** | Built-in `cargo fuzz coverage` command for Rust projects |\n| **honggfuzz** | Uses edge coverage; analyze with standard LLVM\u002FGCC tools |\n\n### Related Techniques\n\n| Skill | Relationship |\n|-------|--------------|\n| **fuzz-harness-writing** | Coverage reveals which code paths harness reaches; guides harness improvements |\n| **fuzzing-dictionaries** | Coverage identifies magic value checks that need dictionary entries |\n| **corpus-management** | Coverage analysis helps curate corpora by identifying redundant test cases |\n| **sanitizers** | Coverage helps verify sanitizer-instrumented code is actually executed |\n\n## Resources\n\n### Key External Resources\n\n**[LLVM Source-Based Code Coverage](https:\u002F\u002Fclang.llvm.org\u002Fdocs\u002FSourceBasedCodeCoverage.html)**\nComprehensive guide to LLVM's profile instrumentation, including advanced features like branch coverage, region coverage, and integration with existing build systems. Covers compiler flags, runtime behavior, and profile data formats.\n\n**[llvm-cov Command Guide](https:\u002F\u002Fllvm.org\u002Fdocs\u002FCommandGuide\u002Fllvm-cov.html)**\nDetailed CLI reference for llvm-cov commands including `show`, `report`, and `export`. Documents all filtering options, output formats, and integration with llvm-profdata.\n\n**[gcovr Documentation](https:\u002F\u002Fgcovr.com\u002F)**\nComplete guide to gcovr tool for generating coverage reports from gcov data. Covers HTML themes, filtering options, multi-directory projects, and CI\u002FCD integration patterns.\n\n**[SanitizerCoverage Documentation](https:\u002F\u002Fclang.llvm.org\u002Fdocs\u002FSanitizerCoverage.html)**\nLow-level documentation for LLVM's SanitizerCoverage instrumentation. Explains inline 8-bit counters, PC tables, and how fuzzers use coverage feedback for guidance.\n\n**[On the Evaluation of Fuzzer Performance](https:\u002F\u002Farxiv.org\u002Fabs\u002F1808.09700)**\nResearch paper examining limitations of coverage as a fuzzing performance metric. Argues for more nuanced evaluation methods beyond simple code coverage percentages.\n\n### Video Resources\n\nNot applicable - coverage analysis is primarily a tooling and workflow topic best learned through documentation and hands-on practice.\n",{"data":36,"body":38},{"name":4,"type":37,"description":6},"technique",{"type":39,"children":40},"root",[41,49,55,62,67,93,109,116,224,230,238,272,280,303,309,451,457,462,474,492,498,504,509,517,602,610,678,686,754,760,765,1328,1334,1342,1378,1385,1404,1421,1427,1435,1641,1649,1817,1824,2080,2086,2091,2133,2139,2145,2155,2163,2201,2211,2220,2226,2235,2243,2268,2276,2436,2442,2452,2594,2599,2653,2659,2665,2801,2807,2820,2950,2956,2961,3096,3102,3107,3311,3317,3485,3491,3497,3502,3510,3573,3581,3669,3677,3731,3737,3742,3750,3804,3812,3876,3884,4015,4022,4061,4067,4072,4080,4133,4141,4171,4179,4301,4309,4331,4338,4403,4408,4413,4420,4480,4488,4519,4526,4550,4556,4777,4783,4789,4880,4886,4971,4977,4983,4998,5037,5052,5067,5081,5087,5092],{"type":42,"tag":43,"props":44,"children":45},"element","h1",{"id":4},[46],{"type":47,"value":48},"text","Coverage Analysis",{"type":42,"tag":50,"props":51,"children":52},"p",{},[53],{"type":47,"value":54},"Coverage analysis is essential for understanding which parts of your code are exercised during fuzzing. It helps identify fuzzing blockers like magic value checks and tracks the effectiveness of harness improvements over time.",{"type":42,"tag":56,"props":57,"children":59},"h2",{"id":58},"overview",[60],{"type":47,"value":61},"Overview",{"type":42,"tag":50,"props":63,"children":64},{},[65],{"type":47,"value":66},"Code coverage during fuzzing serves two critical purposes:",{"type":42,"tag":68,"props":69,"children":70},"ol",{},[71,83],{"type":42,"tag":72,"props":73,"children":74},"li",{},[75,81],{"type":42,"tag":76,"props":77,"children":78},"strong",{},[79],{"type":47,"value":80},"Assessing harness effectiveness",{"type":47,"value":82},": Understand which parts of your application are actually executed by your fuzzing harnesses",{"type":42,"tag":72,"props":84,"children":85},{},[86,91],{"type":42,"tag":76,"props":87,"children":88},{},[89],{"type":47,"value":90},"Tracking fuzzing progress",{"type":47,"value":92},": Monitor how coverage changes when updating harnesses, fuzzers, or the system under test (SUT)",{"type":42,"tag":50,"props":94,"children":95},{},[96,98,107],{"type":47,"value":97},"Coverage is a proxy for fuzzer capability and performance. While coverage ",{"type":42,"tag":99,"props":100,"children":104},"a",{"href":101,"rel":102},"https:\u002F\u002Farxiv.org\u002Fabs\u002F1808.09700",[103],"nofollow",[105],{"type":47,"value":106},"is not ideal for measuring fuzzer performance",{"type":47,"value":108}," in absolute terms, it reliably indicates whether your harness works effectively in a given setup.",{"type":42,"tag":110,"props":111,"children":113},"h3",{"id":112},"key-concepts",[114],{"type":47,"value":115},"Key Concepts",{"type":42,"tag":117,"props":118,"children":119},"table",{},[120,139],{"type":42,"tag":121,"props":122,"children":123},"thead",{},[124],{"type":42,"tag":125,"props":126,"children":127},"tr",{},[128,134],{"type":42,"tag":129,"props":130,"children":131},"th",{},[132],{"type":47,"value":133},"Concept",{"type":42,"tag":129,"props":135,"children":136},{},[137],{"type":47,"value":138},"Description",{"type":42,"tag":140,"props":141,"children":142},"tbody",{},[143,160,176,192,208],{"type":42,"tag":125,"props":144,"children":145},{},[146,155],{"type":42,"tag":147,"props":148,"children":149},"td",{},[150],{"type":42,"tag":76,"props":151,"children":152},{},[153],{"type":47,"value":154},"Coverage instrumentation",{"type":42,"tag":147,"props":156,"children":157},{},[158],{"type":47,"value":159},"Compiler flags that track which code paths are executed",{"type":42,"tag":125,"props":161,"children":162},{},[163,171],{"type":42,"tag":147,"props":164,"children":165},{},[166],{"type":42,"tag":76,"props":167,"children":168},{},[169],{"type":47,"value":170},"Corpus coverage",{"type":42,"tag":147,"props":172,"children":173},{},[174],{"type":47,"value":175},"Coverage achieved by running all test cases in a fuzzing corpus",{"type":42,"tag":125,"props":177,"children":178},{},[179,187],{"type":42,"tag":147,"props":180,"children":181},{},[182],{"type":42,"tag":76,"props":183,"children":184},{},[185],{"type":47,"value":186},"Magic value checks",{"type":42,"tag":147,"props":188,"children":189},{},[190],{"type":47,"value":191},"Hard-to-discover conditional checks that block fuzzer progress",{"type":42,"tag":125,"props":193,"children":194},{},[195,203],{"type":42,"tag":147,"props":196,"children":197},{},[198],{"type":42,"tag":76,"props":199,"children":200},{},[201],{"type":47,"value":202},"Coverage-guided fuzzing",{"type":42,"tag":147,"props":204,"children":205},{},[206],{"type":47,"value":207},"Fuzzing strategy that prioritizes inputs that discover new code paths",{"type":42,"tag":125,"props":209,"children":210},{},[211,219],{"type":42,"tag":147,"props":212,"children":213},{},[214],{"type":42,"tag":76,"props":215,"children":216},{},[217],{"type":47,"value":218},"Coverage report",{"type":42,"tag":147,"props":220,"children":221},{},[222],{"type":47,"value":223},"Visual or textual representation of executed vs. unexecuted code",{"type":42,"tag":56,"props":225,"children":227},{"id":226},"when-to-apply",[228],{"type":47,"value":229},"When to Apply",{"type":42,"tag":50,"props":231,"children":232},{},[233],{"type":42,"tag":76,"props":234,"children":235},{},[236],{"type":47,"value":237},"Apply this technique when:",{"type":42,"tag":239,"props":240,"children":241},"ul",{},[242,247,252,257,262,267],{"type":42,"tag":72,"props":243,"children":244},{},[245],{"type":47,"value":246},"Starting a new fuzzing campaign to establish a baseline",{"type":42,"tag":72,"props":248,"children":249},{},[250],{"type":47,"value":251},"Fuzzer appears to plateau without finding new paths",{"type":42,"tag":72,"props":253,"children":254},{},[255],{"type":47,"value":256},"After harness modifications to verify improvements",{"type":42,"tag":72,"props":258,"children":259},{},[260],{"type":47,"value":261},"When migrating between different fuzzers",{"type":42,"tag":72,"props":263,"children":264},{},[265],{"type":47,"value":266},"Identifying areas requiring dictionary entries or seed inputs",{"type":42,"tag":72,"props":268,"children":269},{},[270],{"type":47,"value":271},"Debugging why certain code paths aren't reached",{"type":42,"tag":50,"props":273,"children":274},{},[275],{"type":42,"tag":76,"props":276,"children":277},{},[278],{"type":47,"value":279},"Skip this technique when:",{"type":42,"tag":239,"props":281,"children":282},{},[283,288,293,298],{"type":42,"tag":72,"props":284,"children":285},{},[286],{"type":47,"value":287},"Fuzzing campaign is actively finding crashes",{"type":42,"tag":72,"props":289,"children":290},{},[291],{"type":47,"value":292},"Coverage infrastructure isn't set up yet",{"type":42,"tag":72,"props":294,"children":295},{},[296],{"type":47,"value":297},"Working with extremely large codebases where full coverage reports are impractical",{"type":42,"tag":72,"props":299,"children":300},{},[301],{"type":47,"value":302},"Fuzzer's internal coverage metrics are sufficient for your needs",{"type":42,"tag":56,"props":304,"children":306},{"id":305},"quick-reference",[307],{"type":47,"value":308},"Quick Reference",{"type":42,"tag":117,"props":310,"children":311},{},[312,328],{"type":42,"tag":121,"props":313,"children":314},{},[315],{"type":42,"tag":125,"props":316,"children":317},{},[318,323],{"type":42,"tag":129,"props":319,"children":320},{},[321],{"type":47,"value":322},"Task",{"type":42,"tag":129,"props":324,"children":325},{},[326],{"type":47,"value":327},"Command\u002FPattern",{"type":42,"tag":140,"props":329,"children":330},{},[331,349,366,383,400,417,434],{"type":42,"tag":125,"props":332,"children":333},{},[334,339],{"type":42,"tag":147,"props":335,"children":336},{},[337],{"type":47,"value":338},"LLVM coverage instrumentation (C\u002FC++)",{"type":42,"tag":147,"props":340,"children":341},{},[342],{"type":42,"tag":343,"props":344,"children":346},"code",{"className":345},[],[347],{"type":47,"value":348},"-fprofile-instr-generate -fcoverage-mapping",{"type":42,"tag":125,"props":350,"children":351},{},[352,357],{"type":42,"tag":147,"props":353,"children":354},{},[355],{"type":47,"value":356},"GCC coverage instrumentation",{"type":42,"tag":147,"props":358,"children":359},{},[360],{"type":42,"tag":343,"props":361,"children":363},{"className":362},[],[364],{"type":47,"value":365},"-ftest-coverage -fprofile-arcs",{"type":42,"tag":125,"props":367,"children":368},{},[369,374],{"type":42,"tag":147,"props":370,"children":371},{},[372],{"type":47,"value":373},"cargo-fuzz coverage (Rust)",{"type":42,"tag":147,"props":375,"children":376},{},[377],{"type":42,"tag":343,"props":378,"children":380},{"className":379},[],[381],{"type":47,"value":382},"cargo +nightly fuzz coverage \u003Ctarget>",{"type":42,"tag":125,"props":384,"children":385},{},[386,391],{"type":42,"tag":147,"props":387,"children":388},{},[389],{"type":47,"value":390},"Generate LLVM profile data",{"type":42,"tag":147,"props":392,"children":393},{},[394],{"type":42,"tag":343,"props":395,"children":397},{"className":396},[],[398],{"type":47,"value":399},"llvm-profdata merge -sparse file.profraw -o file.profdata",{"type":42,"tag":125,"props":401,"children":402},{},[403,408],{"type":42,"tag":147,"props":404,"children":405},{},[406],{"type":47,"value":407},"LLVM coverage report",{"type":42,"tag":147,"props":409,"children":410},{},[411],{"type":42,"tag":343,"props":412,"children":414},{"className":413},[],[415],{"type":47,"value":416},"llvm-cov report .\u002Fbinary -instr-profile=file.profdata",{"type":42,"tag":125,"props":418,"children":419},{},[420,425],{"type":42,"tag":147,"props":421,"children":422},{},[423],{"type":47,"value":424},"LLVM HTML report",{"type":42,"tag":147,"props":426,"children":427},{},[428],{"type":42,"tag":343,"props":429,"children":431},{"className":430},[],[432],{"type":47,"value":433},"llvm-cov show .\u002Fbinary -instr-profile=file.profdata -format=html -output-dir html\u002F",{"type":42,"tag":125,"props":435,"children":436},{},[437,442],{"type":42,"tag":147,"props":438,"children":439},{},[440],{"type":47,"value":441},"gcovr HTML report",{"type":42,"tag":147,"props":443,"children":444},{},[445],{"type":42,"tag":343,"props":446,"children":448},{"className":447},[],[449],{"type":47,"value":450},"gcovr --html-details -o coverage.html",{"type":42,"tag":56,"props":452,"children":454},{"id":453},"ideal-coverage-workflow",[455],{"type":47,"value":456},"Ideal Coverage Workflow",{"type":42,"tag":50,"props":458,"children":459},{},[460],{"type":47,"value":461},"The following workflow represents best practices for integrating coverage analysis into your fuzzing campaigns:",{"type":42,"tag":463,"props":464,"children":468},"pre",{"className":465,"code":467,"language":47},[466],"language-text","[Fuzzing Campaign]\n       |\n       v\n[Generate Corpus]\n       |\n       v\n[Coverage Analysis]\n       |\n       +---> Coverage Increased? --> Continue fuzzing with larger corpus\n       |\n       +---> Coverage Decreased? --> Fix harness or investigate SUT changes\n       |\n       +---> Coverage Plateaued? --> Add dictionary entries or seed inputs\n",[469],{"type":42,"tag":343,"props":470,"children":472},{"__ignoreMap":471},"",[473],{"type":47,"value":467},{"type":42,"tag":50,"props":475,"children":476},{},[477,482,484,490],{"type":42,"tag":76,"props":478,"children":479},{},[480],{"type":47,"value":481},"Key principle",{"type":47,"value":483},": Use the corpus generated ",{"type":42,"tag":485,"props":486,"children":487},"em",{},[488],{"type":47,"value":489},"after",{"type":47,"value":491}," each fuzzing campaign to calculate coverage, rather than real-time fuzzer statistics. This approach provides reproducible, comparable measurements across different fuzzing tools.",{"type":42,"tag":56,"props":493,"children":495},{"id":494},"step-by-step",[496],{"type":47,"value":497},"Step-by-Step",{"type":42,"tag":110,"props":499,"children":501},{"id":500},"step-1-build-with-coverage-instrumentation",[502],{"type":47,"value":503},"Step 1: Build with Coverage Instrumentation",{"type":42,"tag":50,"props":505,"children":506},{},[507],{"type":47,"value":508},"Choose your instrumentation method based on toolchain:",{"type":42,"tag":50,"props":510,"children":511},{},[512],{"type":42,"tag":76,"props":513,"children":514},{},[515],{"type":47,"value":516},"LLVM\u002FClang (C\u002FC++):",{"type":42,"tag":463,"props":518,"children":522},{"className":519,"code":520,"language":521,"meta":471,"style":471},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","clang++ -fprofile-instr-generate -fcoverage-mapping \\\n  -O2 -DNO_MAIN \\\n  main.cc harness.cc execute-rt.cc -o fuzz_exec\n","bash",[523],{"type":42,"tag":343,"props":524,"children":525},{"__ignoreMap":471},[526,555,573],{"type":42,"tag":527,"props":528,"children":531},"span",{"class":529,"line":530},"line",1,[532,538,544,549],{"type":42,"tag":527,"props":533,"children":535},{"style":534},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[536],{"type":47,"value":537},"clang++",{"type":42,"tag":527,"props":539,"children":541},{"style":540},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[542],{"type":47,"value":543}," -fprofile-instr-generate",{"type":42,"tag":527,"props":545,"children":546},{"style":540},[547],{"type":47,"value":548}," -fcoverage-mapping",{"type":42,"tag":527,"props":550,"children":552},{"style":551},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[553],{"type":47,"value":554}," \\\n",{"type":42,"tag":527,"props":556,"children":558},{"class":529,"line":557},2,[559,564,569],{"type":42,"tag":527,"props":560,"children":561},{"style":540},[562],{"type":47,"value":563},"  -O2",{"type":42,"tag":527,"props":565,"children":566},{"style":540},[567],{"type":47,"value":568}," -DNO_MAIN",{"type":42,"tag":527,"props":570,"children":571},{"style":551},[572],{"type":47,"value":554},{"type":42,"tag":527,"props":574,"children":576},{"class":529,"line":575},3,[577,582,587,592,597],{"type":42,"tag":527,"props":578,"children":579},{"style":540},[580],{"type":47,"value":581},"  main.cc",{"type":42,"tag":527,"props":583,"children":584},{"style":540},[585],{"type":47,"value":586}," harness.cc",{"type":42,"tag":527,"props":588,"children":589},{"style":540},[590],{"type":47,"value":591}," execute-rt.cc",{"type":42,"tag":527,"props":593,"children":594},{"style":540},[595],{"type":47,"value":596}," -o",{"type":42,"tag":527,"props":598,"children":599},{"style":540},[600],{"type":47,"value":601}," fuzz_exec\n",{"type":42,"tag":50,"props":603,"children":604},{},[605],{"type":42,"tag":76,"props":606,"children":607},{},[608],{"type":47,"value":609},"GCC (C\u002FC++):",{"type":42,"tag":463,"props":611,"children":613},{"className":519,"code":612,"language":521,"meta":471,"style":471},"g++ -ftest-coverage -fprofile-arcs \\\n  -O2 -DNO_MAIN \\\n  main.cc harness.cc execute-rt.cc -o fuzz_exec_gcov\n",[614],{"type":42,"tag":343,"props":615,"children":616},{"__ignoreMap":471},[617,639,654],{"type":42,"tag":527,"props":618,"children":619},{"class":529,"line":530},[620,625,630,635],{"type":42,"tag":527,"props":621,"children":622},{"style":534},[623],{"type":47,"value":624},"g++",{"type":42,"tag":527,"props":626,"children":627},{"style":540},[628],{"type":47,"value":629}," -ftest-coverage",{"type":42,"tag":527,"props":631,"children":632},{"style":540},[633],{"type":47,"value":634}," -fprofile-arcs",{"type":42,"tag":527,"props":636,"children":637},{"style":551},[638],{"type":47,"value":554},{"type":42,"tag":527,"props":640,"children":641},{"class":529,"line":557},[642,646,650],{"type":42,"tag":527,"props":643,"children":644},{"style":540},[645],{"type":47,"value":563},{"type":42,"tag":527,"props":647,"children":648},{"style":540},[649],{"type":47,"value":568},{"type":42,"tag":527,"props":651,"children":652},{"style":551},[653],{"type":47,"value":554},{"type":42,"tag":527,"props":655,"children":656},{"class":529,"line":575},[657,661,665,669,673],{"type":42,"tag":527,"props":658,"children":659},{"style":540},[660],{"type":47,"value":581},{"type":42,"tag":527,"props":662,"children":663},{"style":540},[664],{"type":47,"value":586},{"type":42,"tag":527,"props":666,"children":667},{"style":540},[668],{"type":47,"value":591},{"type":42,"tag":527,"props":670,"children":671},{"style":540},[672],{"type":47,"value":596},{"type":42,"tag":527,"props":674,"children":675},{"style":540},[676],{"type":47,"value":677}," fuzz_exec_gcov\n",{"type":42,"tag":50,"props":679,"children":680},{},[681],{"type":42,"tag":76,"props":682,"children":683},{},[684],{"type":47,"value":685},"Rust:",{"type":42,"tag":463,"props":687,"children":689},{"className":519,"code":688,"language":521,"meta":471,"style":471},"rustup toolchain install nightly --component llvm-tools-preview\ncargo +nightly fuzz coverage fuzz_target_1\n",[690],{"type":42,"tag":343,"props":691,"children":692},{"__ignoreMap":471},[693,726],{"type":42,"tag":527,"props":694,"children":695},{"class":529,"line":530},[696,701,706,711,716,721],{"type":42,"tag":527,"props":697,"children":698},{"style":534},[699],{"type":47,"value":700},"rustup",{"type":42,"tag":527,"props":702,"children":703},{"style":540},[704],{"type":47,"value":705}," toolchain",{"type":42,"tag":527,"props":707,"children":708},{"style":540},[709],{"type":47,"value":710}," install",{"type":42,"tag":527,"props":712,"children":713},{"style":540},[714],{"type":47,"value":715}," nightly",{"type":42,"tag":527,"props":717,"children":718},{"style":540},[719],{"type":47,"value":720}," --component",{"type":42,"tag":527,"props":722,"children":723},{"style":540},[724],{"type":47,"value":725}," llvm-tools-preview\n",{"type":42,"tag":527,"props":727,"children":728},{"class":529,"line":557},[729,734,739,744,749],{"type":42,"tag":527,"props":730,"children":731},{"style":534},[732],{"type":47,"value":733},"cargo",{"type":42,"tag":527,"props":735,"children":736},{"style":540},[737],{"type":47,"value":738}," +nightly",{"type":42,"tag":527,"props":740,"children":741},{"style":540},[742],{"type":47,"value":743}," fuzz",{"type":42,"tag":527,"props":745,"children":746},{"style":540},[747],{"type":47,"value":748}," coverage",{"type":42,"tag":527,"props":750,"children":751},{"style":540},[752],{"type":47,"value":753}," fuzz_target_1\n",{"type":42,"tag":110,"props":755,"children":757},{"id":756},"step-2-create-execution-runtime-cc-only",[758],{"type":47,"value":759},"Step 2: Create Execution Runtime (C\u002FC++ only)",{"type":42,"tag":50,"props":761,"children":762},{},[763],{"type":47,"value":764},"For C\u002FC++ projects, create a runtime that executes your corpus:",{"type":42,"tag":463,"props":766,"children":770},{"className":767,"code":768,"language":769,"meta":471,"style":471},"language-cpp shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u002F\u002F execute-rt.cc\n#include \u003Cstdio.h>\n#include \u003Cstdlib.h>\n#include \u003Cdirent.h>\n#include \u003Cstdint.h>\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);\n\nvoid load_file_and_test(const char *filename) {\n    FILE *file = fopen(filename, \"rb\");\n    if (file == NULL) {\n        printf(\"Failed to open file: %s\\n\", filename);\n        return;\n    }\n\n    fseek(file, 0, SEEK_END);\n    long filesize = ftell(file);\n    rewind(file);\n\n    uint8_t *buffer = (uint8_t*) malloc(filesize);\n    if (buffer == NULL) {\n        printf(\"Failed to allocate memory for file: %s\\n\", filename);\n        fclose(file);\n        return;\n    }\n\n    long read_size = (long) fread(buffer, 1, filesize, file);\n    if (read_size != filesize) {\n        printf(\"Failed to read file: %s\\n\", filename);\n        free(buffer);\n        fclose(file);\n        return;\n    }\n\n    LLVMFuzzerTestOneInput(buffer, filesize);\n\n    free(buffer);\n    fclose(file);\n}\n\nint main(int argc, char **argv) {\n    if (argc != 2) {\n        printf(\"Usage: %s \u003Cdirectory>\\n\", argv[0]);\n        return 1;\n    }\n\n    DIR *dir = opendir(argv[1]);\n    if (dir == NULL) {\n        printf(\"Failed to open directory: %s\\n\", argv[1]);\n        return 1;\n    }\n\n    struct dirent *entry;\n    while ((entry = readdir(dir)) != NULL) {\n        if (entry->d_type == DT_REG) {\n            char filepath[1024];\n            snprintf(filepath, sizeof(filepath), \"%s\u002F%s\", argv[1], entry->d_name);\n            load_file_and_test(filepath);\n        }\n    }\n\n    closedir(dir);\n    return 0;\n}\n","cpp",[771],{"type":42,"tag":343,"props":772,"children":773},{"__ignoreMap":471},[774,782,790,798,807,816,826,835,843,852,861,870,879,888,897,905,914,923,932,940,949,958,967,976,984,992,1000,1009,1018,1027,1036,1044,1052,1060,1068,1077,1085,1094,1103,1112,1120,1129,1138,1147,1156,1164,1172,1181,1190,1199,1207,1215,1223,1232,1241,1250,1259,1268,1277,1286,1294,1302,1311,1320],{"type":42,"tag":527,"props":775,"children":776},{"class":529,"line":530},[777],{"type":42,"tag":527,"props":778,"children":779},{},[780],{"type":47,"value":781},"\u002F\u002F execute-rt.cc\n",{"type":42,"tag":527,"props":783,"children":784},{"class":529,"line":557},[785],{"type":42,"tag":527,"props":786,"children":787},{},[788],{"type":47,"value":789},"#include \u003Cstdio.h>\n",{"type":42,"tag":527,"props":791,"children":792},{"class":529,"line":575},[793],{"type":42,"tag":527,"props":794,"children":795},{},[796],{"type":47,"value":797},"#include \u003Cstdlib.h>\n",{"type":42,"tag":527,"props":799,"children":801},{"class":529,"line":800},4,[802],{"type":42,"tag":527,"props":803,"children":804},{},[805],{"type":47,"value":806},"#include \u003Cdirent.h>\n",{"type":42,"tag":527,"props":808,"children":810},{"class":529,"line":809},5,[811],{"type":42,"tag":527,"props":812,"children":813},{},[814],{"type":47,"value":815},"#include \u003Cstdint.h>\n",{"type":42,"tag":527,"props":817,"children":819},{"class":529,"line":818},6,[820],{"type":42,"tag":527,"props":821,"children":823},{"emptyLinePlaceholder":822},true,[824],{"type":47,"value":825},"\n",{"type":42,"tag":527,"props":827,"children":829},{"class":529,"line":828},7,[830],{"type":42,"tag":527,"props":831,"children":832},{},[833],{"type":47,"value":834},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);\n",{"type":42,"tag":527,"props":836,"children":838},{"class":529,"line":837},8,[839],{"type":42,"tag":527,"props":840,"children":841},{"emptyLinePlaceholder":822},[842],{"type":47,"value":825},{"type":42,"tag":527,"props":844,"children":846},{"class":529,"line":845},9,[847],{"type":42,"tag":527,"props":848,"children":849},{},[850],{"type":47,"value":851},"void load_file_and_test(const char *filename) {\n",{"type":42,"tag":527,"props":853,"children":855},{"class":529,"line":854},10,[856],{"type":42,"tag":527,"props":857,"children":858},{},[859],{"type":47,"value":860},"    FILE *file = fopen(filename, \"rb\");\n",{"type":42,"tag":527,"props":862,"children":864},{"class":529,"line":863},11,[865],{"type":42,"tag":527,"props":866,"children":867},{},[868],{"type":47,"value":869},"    if (file == NULL) {\n",{"type":42,"tag":527,"props":871,"children":873},{"class":529,"line":872},12,[874],{"type":42,"tag":527,"props":875,"children":876},{},[877],{"type":47,"value":878},"        printf(\"Failed to open file: %s\\n\", filename);\n",{"type":42,"tag":527,"props":880,"children":882},{"class":529,"line":881},13,[883],{"type":42,"tag":527,"props":884,"children":885},{},[886],{"type":47,"value":887},"        return;\n",{"type":42,"tag":527,"props":889,"children":891},{"class":529,"line":890},14,[892],{"type":42,"tag":527,"props":893,"children":894},{},[895],{"type":47,"value":896},"    }\n",{"type":42,"tag":527,"props":898,"children":900},{"class":529,"line":899},15,[901],{"type":42,"tag":527,"props":902,"children":903},{"emptyLinePlaceholder":822},[904],{"type":47,"value":825},{"type":42,"tag":527,"props":906,"children":908},{"class":529,"line":907},16,[909],{"type":42,"tag":527,"props":910,"children":911},{},[912],{"type":47,"value":913},"    fseek(file, 0, SEEK_END);\n",{"type":42,"tag":527,"props":915,"children":917},{"class":529,"line":916},17,[918],{"type":42,"tag":527,"props":919,"children":920},{},[921],{"type":47,"value":922},"    long filesize = ftell(file);\n",{"type":42,"tag":527,"props":924,"children":926},{"class":529,"line":925},18,[927],{"type":42,"tag":527,"props":928,"children":929},{},[930],{"type":47,"value":931},"    rewind(file);\n",{"type":42,"tag":527,"props":933,"children":935},{"class":529,"line":934},19,[936],{"type":42,"tag":527,"props":937,"children":938},{"emptyLinePlaceholder":822},[939],{"type":47,"value":825},{"type":42,"tag":527,"props":941,"children":943},{"class":529,"line":942},20,[944],{"type":42,"tag":527,"props":945,"children":946},{},[947],{"type":47,"value":948},"    uint8_t *buffer = (uint8_t*) malloc(filesize);\n",{"type":42,"tag":527,"props":950,"children":952},{"class":529,"line":951},21,[953],{"type":42,"tag":527,"props":954,"children":955},{},[956],{"type":47,"value":957},"    if (buffer == NULL) {\n",{"type":42,"tag":527,"props":959,"children":961},{"class":529,"line":960},22,[962],{"type":42,"tag":527,"props":963,"children":964},{},[965],{"type":47,"value":966},"        printf(\"Failed to allocate memory for file: %s\\n\", filename);\n",{"type":42,"tag":527,"props":968,"children":970},{"class":529,"line":969},23,[971],{"type":42,"tag":527,"props":972,"children":973},{},[974],{"type":47,"value":975},"        fclose(file);\n",{"type":42,"tag":527,"props":977,"children":979},{"class":529,"line":978},24,[980],{"type":42,"tag":527,"props":981,"children":982},{},[983],{"type":47,"value":887},{"type":42,"tag":527,"props":985,"children":987},{"class":529,"line":986},25,[988],{"type":42,"tag":527,"props":989,"children":990},{},[991],{"type":47,"value":896},{"type":42,"tag":527,"props":993,"children":995},{"class":529,"line":994},26,[996],{"type":42,"tag":527,"props":997,"children":998},{"emptyLinePlaceholder":822},[999],{"type":47,"value":825},{"type":42,"tag":527,"props":1001,"children":1003},{"class":529,"line":1002},27,[1004],{"type":42,"tag":527,"props":1005,"children":1006},{},[1007],{"type":47,"value":1008},"    long read_size = (long) fread(buffer, 1, filesize, file);\n",{"type":42,"tag":527,"props":1010,"children":1012},{"class":529,"line":1011},28,[1013],{"type":42,"tag":527,"props":1014,"children":1015},{},[1016],{"type":47,"value":1017},"    if (read_size != filesize) {\n",{"type":42,"tag":527,"props":1019,"children":1021},{"class":529,"line":1020},29,[1022],{"type":42,"tag":527,"props":1023,"children":1024},{},[1025],{"type":47,"value":1026},"        printf(\"Failed to read file: %s\\n\", filename);\n",{"type":42,"tag":527,"props":1028,"children":1030},{"class":529,"line":1029},30,[1031],{"type":42,"tag":527,"props":1032,"children":1033},{},[1034],{"type":47,"value":1035},"        free(buffer);\n",{"type":42,"tag":527,"props":1037,"children":1039},{"class":529,"line":1038},31,[1040],{"type":42,"tag":527,"props":1041,"children":1042},{},[1043],{"type":47,"value":975},{"type":42,"tag":527,"props":1045,"children":1047},{"class":529,"line":1046},32,[1048],{"type":42,"tag":527,"props":1049,"children":1050},{},[1051],{"type":47,"value":887},{"type":42,"tag":527,"props":1053,"children":1055},{"class":529,"line":1054},33,[1056],{"type":42,"tag":527,"props":1057,"children":1058},{},[1059],{"type":47,"value":896},{"type":42,"tag":527,"props":1061,"children":1063},{"class":529,"line":1062},34,[1064],{"type":42,"tag":527,"props":1065,"children":1066},{"emptyLinePlaceholder":822},[1067],{"type":47,"value":825},{"type":42,"tag":527,"props":1069,"children":1071},{"class":529,"line":1070},35,[1072],{"type":42,"tag":527,"props":1073,"children":1074},{},[1075],{"type":47,"value":1076},"    LLVMFuzzerTestOneInput(buffer, filesize);\n",{"type":42,"tag":527,"props":1078,"children":1080},{"class":529,"line":1079},36,[1081],{"type":42,"tag":527,"props":1082,"children":1083},{"emptyLinePlaceholder":822},[1084],{"type":47,"value":825},{"type":42,"tag":527,"props":1086,"children":1088},{"class":529,"line":1087},37,[1089],{"type":42,"tag":527,"props":1090,"children":1091},{},[1092],{"type":47,"value":1093},"    free(buffer);\n",{"type":42,"tag":527,"props":1095,"children":1097},{"class":529,"line":1096},38,[1098],{"type":42,"tag":527,"props":1099,"children":1100},{},[1101],{"type":47,"value":1102},"    fclose(file);\n",{"type":42,"tag":527,"props":1104,"children":1106},{"class":529,"line":1105},39,[1107],{"type":42,"tag":527,"props":1108,"children":1109},{},[1110],{"type":47,"value":1111},"}\n",{"type":42,"tag":527,"props":1113,"children":1115},{"class":529,"line":1114},40,[1116],{"type":42,"tag":527,"props":1117,"children":1118},{"emptyLinePlaceholder":822},[1119],{"type":47,"value":825},{"type":42,"tag":527,"props":1121,"children":1123},{"class":529,"line":1122},41,[1124],{"type":42,"tag":527,"props":1125,"children":1126},{},[1127],{"type":47,"value":1128},"int main(int argc, char **argv) {\n",{"type":42,"tag":527,"props":1130,"children":1132},{"class":529,"line":1131},42,[1133],{"type":42,"tag":527,"props":1134,"children":1135},{},[1136],{"type":47,"value":1137},"    if (argc != 2) {\n",{"type":42,"tag":527,"props":1139,"children":1141},{"class":529,"line":1140},43,[1142],{"type":42,"tag":527,"props":1143,"children":1144},{},[1145],{"type":47,"value":1146},"        printf(\"Usage: %s \u003Cdirectory>\\n\", argv[0]);\n",{"type":42,"tag":527,"props":1148,"children":1150},{"class":529,"line":1149},44,[1151],{"type":42,"tag":527,"props":1152,"children":1153},{},[1154],{"type":47,"value":1155},"        return 1;\n",{"type":42,"tag":527,"props":1157,"children":1159},{"class":529,"line":1158},45,[1160],{"type":42,"tag":527,"props":1161,"children":1162},{},[1163],{"type":47,"value":896},{"type":42,"tag":527,"props":1165,"children":1167},{"class":529,"line":1166},46,[1168],{"type":42,"tag":527,"props":1169,"children":1170},{"emptyLinePlaceholder":822},[1171],{"type":47,"value":825},{"type":42,"tag":527,"props":1173,"children":1175},{"class":529,"line":1174},47,[1176],{"type":42,"tag":527,"props":1177,"children":1178},{},[1179],{"type":47,"value":1180},"    DIR *dir = opendir(argv[1]);\n",{"type":42,"tag":527,"props":1182,"children":1184},{"class":529,"line":1183},48,[1185],{"type":42,"tag":527,"props":1186,"children":1187},{},[1188],{"type":47,"value":1189},"    if (dir == NULL) {\n",{"type":42,"tag":527,"props":1191,"children":1193},{"class":529,"line":1192},49,[1194],{"type":42,"tag":527,"props":1195,"children":1196},{},[1197],{"type":47,"value":1198},"        printf(\"Failed to open directory: %s\\n\", argv[1]);\n",{"type":42,"tag":527,"props":1200,"children":1202},{"class":529,"line":1201},50,[1203],{"type":42,"tag":527,"props":1204,"children":1205},{},[1206],{"type":47,"value":1155},{"type":42,"tag":527,"props":1208,"children":1210},{"class":529,"line":1209},51,[1211],{"type":42,"tag":527,"props":1212,"children":1213},{},[1214],{"type":47,"value":896},{"type":42,"tag":527,"props":1216,"children":1218},{"class":529,"line":1217},52,[1219],{"type":42,"tag":527,"props":1220,"children":1221},{"emptyLinePlaceholder":822},[1222],{"type":47,"value":825},{"type":42,"tag":527,"props":1224,"children":1226},{"class":529,"line":1225},53,[1227],{"type":42,"tag":527,"props":1228,"children":1229},{},[1230],{"type":47,"value":1231},"    struct dirent *entry;\n",{"type":42,"tag":527,"props":1233,"children":1235},{"class":529,"line":1234},54,[1236],{"type":42,"tag":527,"props":1237,"children":1238},{},[1239],{"type":47,"value":1240},"    while ((entry = readdir(dir)) != NULL) {\n",{"type":42,"tag":527,"props":1242,"children":1244},{"class":529,"line":1243},55,[1245],{"type":42,"tag":527,"props":1246,"children":1247},{},[1248],{"type":47,"value":1249},"        if (entry->d_type == DT_REG) {\n",{"type":42,"tag":527,"props":1251,"children":1253},{"class":529,"line":1252},56,[1254],{"type":42,"tag":527,"props":1255,"children":1256},{},[1257],{"type":47,"value":1258},"            char filepath[1024];\n",{"type":42,"tag":527,"props":1260,"children":1262},{"class":529,"line":1261},57,[1263],{"type":42,"tag":527,"props":1264,"children":1265},{},[1266],{"type":47,"value":1267},"            snprintf(filepath, sizeof(filepath), \"%s\u002F%s\", argv[1], entry->d_name);\n",{"type":42,"tag":527,"props":1269,"children":1271},{"class":529,"line":1270},58,[1272],{"type":42,"tag":527,"props":1273,"children":1274},{},[1275],{"type":47,"value":1276},"            load_file_and_test(filepath);\n",{"type":42,"tag":527,"props":1278,"children":1280},{"class":529,"line":1279},59,[1281],{"type":42,"tag":527,"props":1282,"children":1283},{},[1284],{"type":47,"value":1285},"        }\n",{"type":42,"tag":527,"props":1287,"children":1289},{"class":529,"line":1288},60,[1290],{"type":42,"tag":527,"props":1291,"children":1292},{},[1293],{"type":47,"value":896},{"type":42,"tag":527,"props":1295,"children":1297},{"class":529,"line":1296},61,[1298],{"type":42,"tag":527,"props":1299,"children":1300},{"emptyLinePlaceholder":822},[1301],{"type":47,"value":825},{"type":42,"tag":527,"props":1303,"children":1305},{"class":529,"line":1304},62,[1306],{"type":42,"tag":527,"props":1307,"children":1308},{},[1309],{"type":47,"value":1310},"    closedir(dir);\n",{"type":42,"tag":527,"props":1312,"children":1314},{"class":529,"line":1313},63,[1315],{"type":42,"tag":527,"props":1316,"children":1317},{},[1318],{"type":47,"value":1319},"    return 0;\n",{"type":42,"tag":527,"props":1321,"children":1323},{"class":529,"line":1322},64,[1324],{"type":42,"tag":527,"props":1325,"children":1326},{},[1327],{"type":47,"value":1111},{"type":42,"tag":110,"props":1329,"children":1331},{"id":1330},"step-3-execute-on-corpus",[1332],{"type":47,"value":1333},"Step 3: Execute on Corpus",{"type":42,"tag":50,"props":1335,"children":1336},{},[1337],{"type":42,"tag":76,"props":1338,"children":1339},{},[1340],{"type":47,"value":1341},"LLVM (C\u002FC++):",{"type":42,"tag":463,"props":1343,"children":1345},{"className":519,"code":1344,"language":521,"meta":471,"style":471},"LLVM_PROFILE_FILE=fuzz.profraw .\u002Ffuzz_exec corpus\u002F\n",[1346],{"type":42,"tag":343,"props":1347,"children":1348},{"__ignoreMap":471},[1349],{"type":42,"tag":527,"props":1350,"children":1351},{"class":529,"line":530},[1352,1357,1363,1368,1373],{"type":42,"tag":527,"props":1353,"children":1354},{"style":551},[1355],{"type":47,"value":1356},"LLVM_PROFILE_FILE",{"type":42,"tag":527,"props":1358,"children":1360},{"style":1359},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1361],{"type":47,"value":1362},"=",{"type":42,"tag":527,"props":1364,"children":1365},{"style":540},[1366],{"type":47,"value":1367},"fuzz.profraw",{"type":42,"tag":527,"props":1369,"children":1370},{"style":534},[1371],{"type":47,"value":1372}," .\u002Ffuzz_exec",{"type":42,"tag":527,"props":1374,"children":1375},{"style":540},[1376],{"type":47,"value":1377}," corpus\u002F\n",{"type":42,"tag":50,"props":1379,"children":1380},{},[1381],{"type":42,"tag":76,"props":1382,"children":1383},{},[1384],{"type":47,"value":609},{"type":42,"tag":463,"props":1386,"children":1388},{"className":519,"code":1387,"language":521,"meta":471,"style":471},".\u002Ffuzz_exec_gcov corpus\u002F\n",[1389],{"type":42,"tag":343,"props":1390,"children":1391},{"__ignoreMap":471},[1392],{"type":42,"tag":527,"props":1393,"children":1394},{"class":529,"line":530},[1395,1400],{"type":42,"tag":527,"props":1396,"children":1397},{"style":534},[1398],{"type":47,"value":1399},".\u002Ffuzz_exec_gcov",{"type":42,"tag":527,"props":1401,"children":1402},{"style":540},[1403],{"type":47,"value":1377},{"type":42,"tag":50,"props":1405,"children":1406},{},[1407,1411,1413,1419],{"type":42,"tag":76,"props":1408,"children":1409},{},[1410],{"type":47,"value":685},{"type":47,"value":1412},"\nCoverage data is automatically generated when running ",{"type":42,"tag":343,"props":1414,"children":1416},{"className":1415},[],[1417],{"type":47,"value":1418},"cargo fuzz coverage",{"type":47,"value":1420},".",{"type":42,"tag":110,"props":1422,"children":1424},{"id":1423},"step-4-process-coverage-data",[1425],{"type":47,"value":1426},"Step 4: Process Coverage Data",{"type":42,"tag":50,"props":1428,"children":1429},{},[1430],{"type":42,"tag":76,"props":1431,"children":1432},{},[1433],{"type":47,"value":1434},"LLVM:",{"type":42,"tag":463,"props":1436,"children":1438},{"className":519,"code":1437,"language":521,"meta":471,"style":471},"# Merge raw profile data\nllvm-profdata merge -sparse fuzz.profraw -o fuzz.profdata\n\n# Generate text report\nllvm-cov report .\u002Ffuzz_exec \\\n  -instr-profile=fuzz.profdata \\\n  -ignore-filename-regex='harness.cc|execute-rt.cc'\n\n# Generate HTML report\nllvm-cov show .\u002Ffuzz_exec \\\n  -instr-profile=fuzz.profdata \\\n  -ignore-filename-regex='harness.cc|execute-rt.cc' \\\n  -format=html -output-dir fuzz_html\u002F\n",[1439],{"type":42,"tag":343,"props":1440,"children":1441},{"__ignoreMap":471},[1442,1451,1483,1490,1498,1519,1531,1554,1561,1569,1589,1600,1623],{"type":42,"tag":527,"props":1443,"children":1444},{"class":529,"line":530},[1445],{"type":42,"tag":527,"props":1446,"children":1448},{"style":1447},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1449],{"type":47,"value":1450},"# Merge raw profile data\n",{"type":42,"tag":527,"props":1452,"children":1453},{"class":529,"line":557},[1454,1459,1464,1469,1474,1478],{"type":42,"tag":527,"props":1455,"children":1456},{"style":534},[1457],{"type":47,"value":1458},"llvm-profdata",{"type":42,"tag":527,"props":1460,"children":1461},{"style":540},[1462],{"type":47,"value":1463}," merge",{"type":42,"tag":527,"props":1465,"children":1466},{"style":540},[1467],{"type":47,"value":1468}," -sparse",{"type":42,"tag":527,"props":1470,"children":1471},{"style":540},[1472],{"type":47,"value":1473}," fuzz.profraw",{"type":42,"tag":527,"props":1475,"children":1476},{"style":540},[1477],{"type":47,"value":596},{"type":42,"tag":527,"props":1479,"children":1480},{"style":540},[1481],{"type":47,"value":1482}," fuzz.profdata\n",{"type":42,"tag":527,"props":1484,"children":1485},{"class":529,"line":575},[1486],{"type":42,"tag":527,"props":1487,"children":1488},{"emptyLinePlaceholder":822},[1489],{"type":47,"value":825},{"type":42,"tag":527,"props":1491,"children":1492},{"class":529,"line":800},[1493],{"type":42,"tag":527,"props":1494,"children":1495},{"style":1447},[1496],{"type":47,"value":1497},"# Generate text report\n",{"type":42,"tag":527,"props":1499,"children":1500},{"class":529,"line":809},[1501,1506,1511,1515],{"type":42,"tag":527,"props":1502,"children":1503},{"style":534},[1504],{"type":47,"value":1505},"llvm-cov",{"type":42,"tag":527,"props":1507,"children":1508},{"style":540},[1509],{"type":47,"value":1510}," report",{"type":42,"tag":527,"props":1512,"children":1513},{"style":540},[1514],{"type":47,"value":1372},{"type":42,"tag":527,"props":1516,"children":1517},{"style":551},[1518],{"type":47,"value":554},{"type":42,"tag":527,"props":1520,"children":1521},{"class":529,"line":818},[1522,1527],{"type":42,"tag":527,"props":1523,"children":1524},{"style":540},[1525],{"type":47,"value":1526},"  -instr-profile=fuzz.profdata",{"type":42,"tag":527,"props":1528,"children":1529},{"style":551},[1530],{"type":47,"value":554},{"type":42,"tag":527,"props":1532,"children":1533},{"class":529,"line":828},[1534,1539,1544,1549],{"type":42,"tag":527,"props":1535,"children":1536},{"style":540},[1537],{"type":47,"value":1538},"  -ignore-filename-regex=",{"type":42,"tag":527,"props":1540,"children":1541},{"style":1359},[1542],{"type":47,"value":1543},"'",{"type":42,"tag":527,"props":1545,"children":1546},{"style":540},[1547],{"type":47,"value":1548},"harness.cc|execute-rt.cc",{"type":42,"tag":527,"props":1550,"children":1551},{"style":1359},[1552],{"type":47,"value":1553},"'\n",{"type":42,"tag":527,"props":1555,"children":1556},{"class":529,"line":837},[1557],{"type":42,"tag":527,"props":1558,"children":1559},{"emptyLinePlaceholder":822},[1560],{"type":47,"value":825},{"type":42,"tag":527,"props":1562,"children":1563},{"class":529,"line":845},[1564],{"type":42,"tag":527,"props":1565,"children":1566},{"style":1447},[1567],{"type":47,"value":1568},"# Generate HTML report\n",{"type":42,"tag":527,"props":1570,"children":1571},{"class":529,"line":854},[1572,1576,1581,1585],{"type":42,"tag":527,"props":1573,"children":1574},{"style":534},[1575],{"type":47,"value":1505},{"type":42,"tag":527,"props":1577,"children":1578},{"style":540},[1579],{"type":47,"value":1580}," show",{"type":42,"tag":527,"props":1582,"children":1583},{"style":540},[1584],{"type":47,"value":1372},{"type":42,"tag":527,"props":1586,"children":1587},{"style":551},[1588],{"type":47,"value":554},{"type":42,"tag":527,"props":1590,"children":1591},{"class":529,"line":863},[1592,1596],{"type":42,"tag":527,"props":1593,"children":1594},{"style":540},[1595],{"type":47,"value":1526},{"type":42,"tag":527,"props":1597,"children":1598},{"style":551},[1599],{"type":47,"value":554},{"type":42,"tag":527,"props":1601,"children":1602},{"class":529,"line":872},[1603,1607,1611,1615,1619],{"type":42,"tag":527,"props":1604,"children":1605},{"style":540},[1606],{"type":47,"value":1538},{"type":42,"tag":527,"props":1608,"children":1609},{"style":1359},[1610],{"type":47,"value":1543},{"type":42,"tag":527,"props":1612,"children":1613},{"style":540},[1614],{"type":47,"value":1548},{"type":42,"tag":527,"props":1616,"children":1617},{"style":1359},[1618],{"type":47,"value":1543},{"type":42,"tag":527,"props":1620,"children":1621},{"style":551},[1622],{"type":47,"value":554},{"type":42,"tag":527,"props":1624,"children":1625},{"class":529,"line":881},[1626,1631,1636],{"type":42,"tag":527,"props":1627,"children":1628},{"style":540},[1629],{"type":47,"value":1630},"  -format=html",{"type":42,"tag":527,"props":1632,"children":1633},{"style":540},[1634],{"type":47,"value":1635}," -output-dir",{"type":42,"tag":527,"props":1637,"children":1638},{"style":540},[1639],{"type":47,"value":1640}," fuzz_html\u002F\n",{"type":42,"tag":50,"props":1642,"children":1643},{},[1644],{"type":42,"tag":76,"props":1645,"children":1646},{},[1647],{"type":47,"value":1648},"GCC with gcovr:",{"type":42,"tag":463,"props":1650,"children":1652},{"className":519,"code":1651,"language":521,"meta":471,"style":471},"# Install gcovr (via pip for latest version)\npython3 -m venv venv\nsource venv\u002Fbin\u002Factivate\npip3 install gcovr\n\n# Generate report\ngcovr --gcov-executable \"llvm-cov gcov\" \\\n  --exclude harness.cc --exclude execute-rt.cc \\\n  --root . --html-details -o coverage.html\n",[1653],{"type":42,"tag":343,"props":1654,"children":1655},{"__ignoreMap":471},[1656,1664,1687,1701,1718,1725,1733,1765,1790],{"type":42,"tag":527,"props":1657,"children":1658},{"class":529,"line":530},[1659],{"type":42,"tag":527,"props":1660,"children":1661},{"style":1447},[1662],{"type":47,"value":1663},"# Install gcovr (via pip for latest version)\n",{"type":42,"tag":527,"props":1665,"children":1666},{"class":529,"line":557},[1667,1672,1677,1682],{"type":42,"tag":527,"props":1668,"children":1669},{"style":534},[1670],{"type":47,"value":1671},"python3",{"type":42,"tag":527,"props":1673,"children":1674},{"style":540},[1675],{"type":47,"value":1676}," -m",{"type":42,"tag":527,"props":1678,"children":1679},{"style":540},[1680],{"type":47,"value":1681}," venv",{"type":42,"tag":527,"props":1683,"children":1684},{"style":540},[1685],{"type":47,"value":1686}," venv\n",{"type":42,"tag":527,"props":1688,"children":1689},{"class":529,"line":575},[1690,1696],{"type":42,"tag":527,"props":1691,"children":1693},{"style":1692},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[1694],{"type":47,"value":1695},"source",{"type":42,"tag":527,"props":1697,"children":1698},{"style":540},[1699],{"type":47,"value":1700}," venv\u002Fbin\u002Factivate\n",{"type":42,"tag":527,"props":1702,"children":1703},{"class":529,"line":800},[1704,1709,1713],{"type":42,"tag":527,"props":1705,"children":1706},{"style":534},[1707],{"type":47,"value":1708},"pip3",{"type":42,"tag":527,"props":1710,"children":1711},{"style":540},[1712],{"type":47,"value":710},{"type":42,"tag":527,"props":1714,"children":1715},{"style":540},[1716],{"type":47,"value":1717}," gcovr\n",{"type":42,"tag":527,"props":1719,"children":1720},{"class":529,"line":809},[1721],{"type":42,"tag":527,"props":1722,"children":1723},{"emptyLinePlaceholder":822},[1724],{"type":47,"value":825},{"type":42,"tag":527,"props":1726,"children":1727},{"class":529,"line":818},[1728],{"type":42,"tag":527,"props":1729,"children":1730},{"style":1447},[1731],{"type":47,"value":1732},"# Generate report\n",{"type":42,"tag":527,"props":1734,"children":1735},{"class":529,"line":828},[1736,1741,1746,1751,1756,1761],{"type":42,"tag":527,"props":1737,"children":1738},{"style":534},[1739],{"type":47,"value":1740},"gcovr",{"type":42,"tag":527,"props":1742,"children":1743},{"style":540},[1744],{"type":47,"value":1745}," --gcov-executable",{"type":42,"tag":527,"props":1747,"children":1748},{"style":1359},[1749],{"type":47,"value":1750}," \"",{"type":42,"tag":527,"props":1752,"children":1753},{"style":540},[1754],{"type":47,"value":1755},"llvm-cov gcov",{"type":42,"tag":527,"props":1757,"children":1758},{"style":1359},[1759],{"type":47,"value":1760},"\"",{"type":42,"tag":527,"props":1762,"children":1763},{"style":551},[1764],{"type":47,"value":554},{"type":42,"tag":527,"props":1766,"children":1767},{"class":529,"line":837},[1768,1773,1777,1782,1786],{"type":42,"tag":527,"props":1769,"children":1770},{"style":540},[1771],{"type":47,"value":1772},"  --exclude",{"type":42,"tag":527,"props":1774,"children":1775},{"style":540},[1776],{"type":47,"value":586},{"type":42,"tag":527,"props":1778,"children":1779},{"style":540},[1780],{"type":47,"value":1781}," --exclude",{"type":42,"tag":527,"props":1783,"children":1784},{"style":540},[1785],{"type":47,"value":591},{"type":42,"tag":527,"props":1787,"children":1788},{"style":551},[1789],{"type":47,"value":554},{"type":42,"tag":527,"props":1791,"children":1792},{"class":529,"line":845},[1793,1798,1803,1808,1812],{"type":42,"tag":527,"props":1794,"children":1795},{"style":540},[1796],{"type":47,"value":1797},"  --root",{"type":42,"tag":527,"props":1799,"children":1800},{"style":540},[1801],{"type":47,"value":1802}," .",{"type":42,"tag":527,"props":1804,"children":1805},{"style":540},[1806],{"type":47,"value":1807}," --html-details",{"type":42,"tag":527,"props":1809,"children":1810},{"style":540},[1811],{"type":47,"value":596},{"type":42,"tag":527,"props":1813,"children":1814},{"style":540},[1815],{"type":47,"value":1816}," coverage.html\n",{"type":42,"tag":50,"props":1818,"children":1819},{},[1820],{"type":42,"tag":76,"props":1821,"children":1822},{},[1823],{"type":47,"value":685},{"type":42,"tag":463,"props":1825,"children":1827},{"className":519,"code":1826,"language":521,"meta":471,"style":471},"# Install required tools\ncargo install cargo-binutils rustfilt\n\n# Create HTML generation script\ncat \u003C\u003C'EOF' > .\u002Fgenerate_html\n#!\u002Fbin\u002Fsh\nif [ $# -lt 1 ]; then\n    echo \"Error: Name of fuzz target is required.\"\n    echo \"Usage: $0 fuzz_target [sources...]\"\n    exit 1\nfi\nFUZZ_TARGET=\"$1\"\nshift\nSRC_FILTER=\"$@\"\nTARGET=$(rustc -vV | sed -n 's|host: ||p')\ncargo +nightly cov -- show -Xdemangler=rustfilt \\\n  \"target\u002F$TARGET\u002Fcoverage\u002F$TARGET\u002Frelease\u002F$FUZZ_TARGET\" \\\n  -instr-profile=\"fuzz\u002Fcoverage\u002F$FUZZ_TARGET\u002Fcoverage.profdata\" \\\n  -show-line-counts-or-regions -show-instantiations \\\n  -format=html -o fuzz_html\u002F $SRC_FILTER\nEOF\nchmod +x .\u002Fgenerate_html\n\n# Generate HTML report\n.\u002Fgenerate_html fuzz_target_1 src\u002Flib.rs\n",[1828],{"type":42,"tag":343,"props":1829,"children":1830},{"__ignoreMap":471},[1831,1839,1860,1867,1875,1903,1911,1919,1927,1935,1943,1951,1959,1967,1975,1983,1991,1999,2007,2015,2023,2031,2048,2055,2062],{"type":42,"tag":527,"props":1832,"children":1833},{"class":529,"line":530},[1834],{"type":42,"tag":527,"props":1835,"children":1836},{"style":1447},[1837],{"type":47,"value":1838},"# Install required tools\n",{"type":42,"tag":527,"props":1840,"children":1841},{"class":529,"line":557},[1842,1846,1850,1855],{"type":42,"tag":527,"props":1843,"children":1844},{"style":534},[1845],{"type":47,"value":733},{"type":42,"tag":527,"props":1847,"children":1848},{"style":540},[1849],{"type":47,"value":710},{"type":42,"tag":527,"props":1851,"children":1852},{"style":540},[1853],{"type":47,"value":1854}," cargo-binutils",{"type":42,"tag":527,"props":1856,"children":1857},{"style":540},[1858],{"type":47,"value":1859}," rustfilt\n",{"type":42,"tag":527,"props":1861,"children":1862},{"class":529,"line":575},[1863],{"type":42,"tag":527,"props":1864,"children":1865},{"emptyLinePlaceholder":822},[1866],{"type":47,"value":825},{"type":42,"tag":527,"props":1868,"children":1869},{"class":529,"line":800},[1870],{"type":42,"tag":527,"props":1871,"children":1872},{"style":1447},[1873],{"type":47,"value":1874},"# Create HTML generation script\n",{"type":42,"tag":527,"props":1876,"children":1877},{"class":529,"line":809},[1878,1883,1888,1893,1898],{"type":42,"tag":527,"props":1879,"children":1880},{"style":534},[1881],{"type":47,"value":1882},"cat",{"type":42,"tag":527,"props":1884,"children":1885},{"style":1359},[1886],{"type":47,"value":1887}," \u003C\u003C",{"type":42,"tag":527,"props":1889,"children":1890},{"style":1359},[1891],{"type":47,"value":1892},"'EOF'",{"type":42,"tag":527,"props":1894,"children":1895},{"style":1359},[1896],{"type":47,"value":1897}," >",{"type":42,"tag":527,"props":1899,"children":1900},{"style":540},[1901],{"type":47,"value":1902}," .\u002Fgenerate_html\n",{"type":42,"tag":527,"props":1904,"children":1905},{"class":529,"line":818},[1906],{"type":42,"tag":527,"props":1907,"children":1908},{"style":540},[1909],{"type":47,"value":1910},"#!\u002Fbin\u002Fsh\n",{"type":42,"tag":527,"props":1912,"children":1913},{"class":529,"line":828},[1914],{"type":42,"tag":527,"props":1915,"children":1916},{"style":540},[1917],{"type":47,"value":1918},"if [ $# -lt 1 ]; then\n",{"type":42,"tag":527,"props":1920,"children":1921},{"class":529,"line":837},[1922],{"type":42,"tag":527,"props":1923,"children":1924},{"style":540},[1925],{"type":47,"value":1926},"    echo \"Error: Name of fuzz target is required.\"\n",{"type":42,"tag":527,"props":1928,"children":1929},{"class":529,"line":845},[1930],{"type":42,"tag":527,"props":1931,"children":1932},{"style":540},[1933],{"type":47,"value":1934},"    echo \"Usage: $0 fuzz_target [sources...]\"\n",{"type":42,"tag":527,"props":1936,"children":1937},{"class":529,"line":854},[1938],{"type":42,"tag":527,"props":1939,"children":1940},{"style":540},[1941],{"type":47,"value":1942},"    exit 1\n",{"type":42,"tag":527,"props":1944,"children":1945},{"class":529,"line":863},[1946],{"type":42,"tag":527,"props":1947,"children":1948},{"style":540},[1949],{"type":47,"value":1950},"fi\n",{"type":42,"tag":527,"props":1952,"children":1953},{"class":529,"line":872},[1954],{"type":42,"tag":527,"props":1955,"children":1956},{"style":540},[1957],{"type":47,"value":1958},"FUZZ_TARGET=\"$1\"\n",{"type":42,"tag":527,"props":1960,"children":1961},{"class":529,"line":881},[1962],{"type":42,"tag":527,"props":1963,"children":1964},{"style":540},[1965],{"type":47,"value":1966},"shift\n",{"type":42,"tag":527,"props":1968,"children":1969},{"class":529,"line":890},[1970],{"type":42,"tag":527,"props":1971,"children":1972},{"style":540},[1973],{"type":47,"value":1974},"SRC_FILTER=\"$@\"\n",{"type":42,"tag":527,"props":1976,"children":1977},{"class":529,"line":899},[1978],{"type":42,"tag":527,"props":1979,"children":1980},{"style":540},[1981],{"type":47,"value":1982},"TARGET=$(rustc -vV | sed -n 's|host: ||p')\n",{"type":42,"tag":527,"props":1984,"children":1985},{"class":529,"line":907},[1986],{"type":42,"tag":527,"props":1987,"children":1988},{"style":540},[1989],{"type":47,"value":1990},"cargo +nightly cov -- show -Xdemangler=rustfilt \\\n",{"type":42,"tag":527,"props":1992,"children":1993},{"class":529,"line":916},[1994],{"type":42,"tag":527,"props":1995,"children":1996},{"style":540},[1997],{"type":47,"value":1998},"  \"target\u002F$TARGET\u002Fcoverage\u002F$TARGET\u002Frelease\u002F$FUZZ_TARGET\" \\\n",{"type":42,"tag":527,"props":2000,"children":2001},{"class":529,"line":925},[2002],{"type":42,"tag":527,"props":2003,"children":2004},{"style":540},[2005],{"type":47,"value":2006},"  -instr-profile=\"fuzz\u002Fcoverage\u002F$FUZZ_TARGET\u002Fcoverage.profdata\" \\\n",{"type":42,"tag":527,"props":2008,"children":2009},{"class":529,"line":934},[2010],{"type":42,"tag":527,"props":2011,"children":2012},{"style":540},[2013],{"type":47,"value":2014},"  -show-line-counts-or-regions -show-instantiations \\\n",{"type":42,"tag":527,"props":2016,"children":2017},{"class":529,"line":942},[2018],{"type":42,"tag":527,"props":2019,"children":2020},{"style":540},[2021],{"type":47,"value":2022},"  -format=html -o fuzz_html\u002F $SRC_FILTER\n",{"type":42,"tag":527,"props":2024,"children":2025},{"class":529,"line":951},[2026],{"type":42,"tag":527,"props":2027,"children":2028},{"style":1359},[2029],{"type":47,"value":2030},"EOF\n",{"type":42,"tag":527,"props":2032,"children":2033},{"class":529,"line":960},[2034,2039,2044],{"type":42,"tag":527,"props":2035,"children":2036},{"style":534},[2037],{"type":47,"value":2038},"chmod",{"type":42,"tag":527,"props":2040,"children":2041},{"style":540},[2042],{"type":47,"value":2043}," +x",{"type":42,"tag":527,"props":2045,"children":2046},{"style":540},[2047],{"type":47,"value":1902},{"type":42,"tag":527,"props":2049,"children":2050},{"class":529,"line":969},[2051],{"type":42,"tag":527,"props":2052,"children":2053},{"emptyLinePlaceholder":822},[2054],{"type":47,"value":825},{"type":42,"tag":527,"props":2056,"children":2057},{"class":529,"line":978},[2058],{"type":42,"tag":527,"props":2059,"children":2060},{"style":1447},[2061],{"type":47,"value":1568},{"type":42,"tag":527,"props":2063,"children":2064},{"class":529,"line":986},[2065,2070,2075],{"type":42,"tag":527,"props":2066,"children":2067},{"style":534},[2068],{"type":47,"value":2069},".\u002Fgenerate_html",{"type":42,"tag":527,"props":2071,"children":2072},{"style":540},[2073],{"type":47,"value":2074}," fuzz_target_1",{"type":42,"tag":527,"props":2076,"children":2077},{"style":540},[2078],{"type":47,"value":2079}," src\u002Flib.rs\n",{"type":42,"tag":110,"props":2081,"children":2083},{"id":2082},"step-5-analyze-results",[2084],{"type":47,"value":2085},"Step 5: Analyze Results",{"type":42,"tag":50,"props":2087,"children":2088},{},[2089],{"type":47,"value":2090},"Review the coverage report to identify:",{"type":42,"tag":239,"props":2092,"children":2093},{},[2094,2104,2113,2123],{"type":42,"tag":72,"props":2095,"children":2096},{},[2097,2102],{"type":42,"tag":76,"props":2098,"children":2099},{},[2100],{"type":47,"value":2101},"Uncovered code blocks",{"type":47,"value":2103},": Areas that may need better seed inputs or dictionary entries",{"type":42,"tag":72,"props":2105,"children":2106},{},[2107,2111],{"type":42,"tag":76,"props":2108,"children":2109},{},[2110],{"type":47,"value":186},{"type":47,"value":2112},": Conditional statements with hardcoded values that block progress",{"type":42,"tag":72,"props":2114,"children":2115},{},[2116,2121],{"type":42,"tag":76,"props":2117,"children":2118},{},[2119],{"type":47,"value":2120},"Dead code",{"type":47,"value":2122},": Functions that may not be reachable through your harness",{"type":42,"tag":72,"props":2124,"children":2125},{},[2126,2131],{"type":42,"tag":76,"props":2127,"children":2128},{},[2129],{"type":47,"value":2130},"Coverage changes",{"type":47,"value":2132},": Compare against baseline to track improvements or regressions",{"type":42,"tag":56,"props":2134,"children":2136},{"id":2135},"common-patterns",[2137],{"type":47,"value":2138},"Common Patterns",{"type":42,"tag":110,"props":2140,"children":2142},{"id":2141},"pattern-identifying-magic-values",[2143],{"type":47,"value":2144},"Pattern: Identifying Magic Values",{"type":42,"tag":50,"props":2146,"children":2147},{},[2148,2153],{"type":42,"tag":76,"props":2149,"children":2150},{},[2151],{"type":47,"value":2152},"Problem",{"type":47,"value":2154},": Fuzzer cannot discover paths guarded by magic value checks.",{"type":42,"tag":50,"props":2156,"children":2157},{},[2158],{"type":42,"tag":76,"props":2159,"children":2160},{},[2161],{"type":47,"value":2162},"Coverage reveals:",{"type":42,"tag":463,"props":2164,"children":2166},{"className":767,"code":2165,"language":769,"meta":471,"style":471},"\u002F\u002F Coverage shows this block is never executed\nif (buf == 0x7F454C46) {  \u002F\u002F ELF magic number\n    \u002F\u002F start parsing buf\n}\n",[2167],{"type":42,"tag":343,"props":2168,"children":2169},{"__ignoreMap":471},[2170,2178,2186,2194],{"type":42,"tag":527,"props":2171,"children":2172},{"class":529,"line":530},[2173],{"type":42,"tag":527,"props":2174,"children":2175},{},[2176],{"type":47,"value":2177},"\u002F\u002F Coverage shows this block is never executed\n",{"type":42,"tag":527,"props":2179,"children":2180},{"class":529,"line":557},[2181],{"type":42,"tag":527,"props":2182,"children":2183},{},[2184],{"type":47,"value":2185},"if (buf == 0x7F454C46) {  \u002F\u002F ELF magic number\n",{"type":42,"tag":527,"props":2187,"children":2188},{"class":529,"line":575},[2189],{"type":42,"tag":527,"props":2190,"children":2191},{},[2192],{"type":47,"value":2193},"    \u002F\u002F start parsing buf\n",{"type":42,"tag":527,"props":2195,"children":2196},{"class":529,"line":800},[2197],{"type":42,"tag":527,"props":2198,"children":2199},{},[2200],{"type":47,"value":1111},{"type":42,"tag":50,"props":2202,"children":2203},{},[2204,2209],{"type":42,"tag":76,"props":2205,"children":2206},{},[2207],{"type":47,"value":2208},"Solution",{"type":47,"value":2210},": Add magic values to dictionary file:",{"type":42,"tag":463,"props":2212,"children":2215},{"className":2213,"code":2214,"language":47},[466],"# magic.dict\n\"\\x7F\\x45\\x4C\\x46\"\n",[2216],{"type":42,"tag":343,"props":2217,"children":2218},{"__ignoreMap":471},[2219],{"type":47,"value":2214},{"type":42,"tag":110,"props":2221,"children":2223},{"id":2222},"pattern-handling-crashing-inputs",[2224],{"type":47,"value":2225},"Pattern: Handling Crashing Inputs",{"type":42,"tag":50,"props":2227,"children":2228},{},[2229,2233],{"type":42,"tag":76,"props":2230,"children":2231},{},[2232],{"type":47,"value":2152},{"type":47,"value":2234},": Coverage generation fails when corpus contains crashing inputs.",{"type":42,"tag":50,"props":2236,"children":2237},{},[2238],{"type":42,"tag":76,"props":2239,"children":2240},{},[2241],{"type":47,"value":2242},"Before:",{"type":42,"tag":463,"props":2244,"children":2246},{"className":519,"code":2245,"language":521,"meta":471,"style":471},".\u002Ffuzz_exec corpus\u002F  # Crashes on bad input, no coverage generated\n",[2247],{"type":42,"tag":343,"props":2248,"children":2249},{"__ignoreMap":471},[2250],{"type":42,"tag":527,"props":2251,"children":2252},{"class":529,"line":530},[2253,2258,2263],{"type":42,"tag":527,"props":2254,"children":2255},{"style":534},[2256],{"type":47,"value":2257},".\u002Ffuzz_exec",{"type":42,"tag":527,"props":2259,"children":2260},{"style":540},[2261],{"type":47,"value":2262}," corpus\u002F",{"type":42,"tag":527,"props":2264,"children":2265},{"style":1447},[2266],{"type":47,"value":2267},"  # Crashes on bad input, no coverage generated\n",{"type":42,"tag":50,"props":2269,"children":2270},{},[2271],{"type":42,"tag":76,"props":2272,"children":2273},{},[2274],{"type":47,"value":2275},"After:",{"type":42,"tag":463,"props":2277,"children":2279},{"className":767,"code":2278,"language":769,"meta":471,"style":471},"\u002F\u002F Fork before executing to isolate crashes\nint main(int argc, char **argv) {\n    \u002F\u002F ... directory opening code ...\n\n    while ((entry = readdir(dir)) != NULL) {\n        if (entry->d_type == DT_REG) {\n            pid_t pid = fork();\n            if (pid == 0) {\n                \u002F\u002F Child process - crash won't affect parent\n                char filepath[1024];\n                snprintf(filepath, sizeof(filepath), \"%s\u002F%s\", argv[1], entry->d_name);\n                load_file_and_test(filepath);\n                exit(0);\n            } else {\n                \u002F\u002F Parent waits for child\n                waitpid(pid, NULL, 0);\n            }\n        }\n    }\n}\n",[2280],{"type":42,"tag":343,"props":2281,"children":2282},{"__ignoreMap":471},[2283,2291,2298,2306,2313,2320,2327,2335,2343,2351,2359,2367,2375,2383,2391,2399,2407,2415,2422,2429],{"type":42,"tag":527,"props":2284,"children":2285},{"class":529,"line":530},[2286],{"type":42,"tag":527,"props":2287,"children":2288},{},[2289],{"type":47,"value":2290},"\u002F\u002F Fork before executing to isolate crashes\n",{"type":42,"tag":527,"props":2292,"children":2293},{"class":529,"line":557},[2294],{"type":42,"tag":527,"props":2295,"children":2296},{},[2297],{"type":47,"value":1128},{"type":42,"tag":527,"props":2299,"children":2300},{"class":529,"line":575},[2301],{"type":42,"tag":527,"props":2302,"children":2303},{},[2304],{"type":47,"value":2305},"    \u002F\u002F ... directory opening code ...\n",{"type":42,"tag":527,"props":2307,"children":2308},{"class":529,"line":800},[2309],{"type":42,"tag":527,"props":2310,"children":2311},{"emptyLinePlaceholder":822},[2312],{"type":47,"value":825},{"type":42,"tag":527,"props":2314,"children":2315},{"class":529,"line":809},[2316],{"type":42,"tag":527,"props":2317,"children":2318},{},[2319],{"type":47,"value":1240},{"type":42,"tag":527,"props":2321,"children":2322},{"class":529,"line":818},[2323],{"type":42,"tag":527,"props":2324,"children":2325},{},[2326],{"type":47,"value":1249},{"type":42,"tag":527,"props":2328,"children":2329},{"class":529,"line":828},[2330],{"type":42,"tag":527,"props":2331,"children":2332},{},[2333],{"type":47,"value":2334},"            pid_t pid = fork();\n",{"type":42,"tag":527,"props":2336,"children":2337},{"class":529,"line":837},[2338],{"type":42,"tag":527,"props":2339,"children":2340},{},[2341],{"type":47,"value":2342},"            if (pid == 0) {\n",{"type":42,"tag":527,"props":2344,"children":2345},{"class":529,"line":845},[2346],{"type":42,"tag":527,"props":2347,"children":2348},{},[2349],{"type":47,"value":2350},"                \u002F\u002F Child process - crash won't affect parent\n",{"type":42,"tag":527,"props":2352,"children":2353},{"class":529,"line":854},[2354],{"type":42,"tag":527,"props":2355,"children":2356},{},[2357],{"type":47,"value":2358},"                char filepath[1024];\n",{"type":42,"tag":527,"props":2360,"children":2361},{"class":529,"line":863},[2362],{"type":42,"tag":527,"props":2363,"children":2364},{},[2365],{"type":47,"value":2366},"                snprintf(filepath, sizeof(filepath), \"%s\u002F%s\", argv[1], entry->d_name);\n",{"type":42,"tag":527,"props":2368,"children":2369},{"class":529,"line":872},[2370],{"type":42,"tag":527,"props":2371,"children":2372},{},[2373],{"type":47,"value":2374},"                load_file_and_test(filepath);\n",{"type":42,"tag":527,"props":2376,"children":2377},{"class":529,"line":881},[2378],{"type":42,"tag":527,"props":2379,"children":2380},{},[2381],{"type":47,"value":2382},"                exit(0);\n",{"type":42,"tag":527,"props":2384,"children":2385},{"class":529,"line":890},[2386],{"type":42,"tag":527,"props":2387,"children":2388},{},[2389],{"type":47,"value":2390},"            } else {\n",{"type":42,"tag":527,"props":2392,"children":2393},{"class":529,"line":899},[2394],{"type":42,"tag":527,"props":2395,"children":2396},{},[2397],{"type":47,"value":2398},"                \u002F\u002F Parent waits for child\n",{"type":42,"tag":527,"props":2400,"children":2401},{"class":529,"line":907},[2402],{"type":42,"tag":527,"props":2403,"children":2404},{},[2405],{"type":47,"value":2406},"                waitpid(pid, NULL, 0);\n",{"type":42,"tag":527,"props":2408,"children":2409},{"class":529,"line":916},[2410],{"type":42,"tag":527,"props":2411,"children":2412},{},[2413],{"type":47,"value":2414},"            }\n",{"type":42,"tag":527,"props":2416,"children":2417},{"class":529,"line":925},[2418],{"type":42,"tag":527,"props":2419,"children":2420},{},[2421],{"type":47,"value":1285},{"type":42,"tag":527,"props":2423,"children":2424},{"class":529,"line":934},[2425],{"type":42,"tag":527,"props":2426,"children":2427},{},[2428],{"type":47,"value":896},{"type":42,"tag":527,"props":2430,"children":2431},{"class":529,"line":942},[2432],{"type":42,"tag":527,"props":2433,"children":2434},{},[2435],{"type":47,"value":1111},{"type":42,"tag":110,"props":2437,"children":2439},{"id":2438},"pattern-cmake-integration",[2440],{"type":47,"value":2441},"Pattern: CMake Integration",{"type":42,"tag":50,"props":2443,"children":2444},{},[2445,2450],{"type":42,"tag":76,"props":2446,"children":2447},{},[2448],{"type":47,"value":2449},"Use Case",{"type":47,"value":2451},": Adding coverage builds to CMake projects.",{"type":42,"tag":463,"props":2453,"children":2457},{"className":2454,"code":2455,"language":2456,"meta":471,"style":471},"language-cmake shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","project(FuzzingProject)\ncmake_minimum_required(VERSION 3.0)\n\n# Main binary\nadd_executable(program main.cc)\n\n# Fuzzing binary\nadd_executable(fuzz main.cc harness.cc)\ntarget_compile_definitions(fuzz PRIVATE NO_MAIN=1)\ntarget_compile_options(fuzz PRIVATE -g -O2 -fsanitize=fuzzer)\ntarget_link_libraries(fuzz -fsanitize=fuzzer)\n\n# Coverage execution binary\nadd_executable(fuzz_exec main.cc harness.cc execute-rt.cc)\ntarget_compile_definitions(fuzz_exec PRIVATE NO_MAIN)\ntarget_compile_options(fuzz_exec PRIVATE -O2 -fprofile-instr-generate -fcoverage-mapping)\ntarget_link_libraries(fuzz_exec -fprofile-instr-generate)\n","cmake",[2458],{"type":42,"tag":343,"props":2459,"children":2460},{"__ignoreMap":471},[2461,2469,2477,2484,2492,2500,2507,2515,2523,2531,2539,2547,2554,2562,2570,2578,2586],{"type":42,"tag":527,"props":2462,"children":2463},{"class":529,"line":530},[2464],{"type":42,"tag":527,"props":2465,"children":2466},{},[2467],{"type":47,"value":2468},"project(FuzzingProject)\n",{"type":42,"tag":527,"props":2470,"children":2471},{"class":529,"line":557},[2472],{"type":42,"tag":527,"props":2473,"children":2474},{},[2475],{"type":47,"value":2476},"cmake_minimum_required(VERSION 3.0)\n",{"type":42,"tag":527,"props":2478,"children":2479},{"class":529,"line":575},[2480],{"type":42,"tag":527,"props":2481,"children":2482},{"emptyLinePlaceholder":822},[2483],{"type":47,"value":825},{"type":42,"tag":527,"props":2485,"children":2486},{"class":529,"line":800},[2487],{"type":42,"tag":527,"props":2488,"children":2489},{},[2490],{"type":47,"value":2491},"# Main binary\n",{"type":42,"tag":527,"props":2493,"children":2494},{"class":529,"line":809},[2495],{"type":42,"tag":527,"props":2496,"children":2497},{},[2498],{"type":47,"value":2499},"add_executable(program main.cc)\n",{"type":42,"tag":527,"props":2501,"children":2502},{"class":529,"line":818},[2503],{"type":42,"tag":527,"props":2504,"children":2505},{"emptyLinePlaceholder":822},[2506],{"type":47,"value":825},{"type":42,"tag":527,"props":2508,"children":2509},{"class":529,"line":828},[2510],{"type":42,"tag":527,"props":2511,"children":2512},{},[2513],{"type":47,"value":2514},"# Fuzzing binary\n",{"type":42,"tag":527,"props":2516,"children":2517},{"class":529,"line":837},[2518],{"type":42,"tag":527,"props":2519,"children":2520},{},[2521],{"type":47,"value":2522},"add_executable(fuzz main.cc harness.cc)\n",{"type":42,"tag":527,"props":2524,"children":2525},{"class":529,"line":845},[2526],{"type":42,"tag":527,"props":2527,"children":2528},{},[2529],{"type":47,"value":2530},"target_compile_definitions(fuzz PRIVATE NO_MAIN=1)\n",{"type":42,"tag":527,"props":2532,"children":2533},{"class":529,"line":854},[2534],{"type":42,"tag":527,"props":2535,"children":2536},{},[2537],{"type":47,"value":2538},"target_compile_options(fuzz PRIVATE -g -O2 -fsanitize=fuzzer)\n",{"type":42,"tag":527,"props":2540,"children":2541},{"class":529,"line":863},[2542],{"type":42,"tag":527,"props":2543,"children":2544},{},[2545],{"type":47,"value":2546},"target_link_libraries(fuzz -fsanitize=fuzzer)\n",{"type":42,"tag":527,"props":2548,"children":2549},{"class":529,"line":872},[2550],{"type":42,"tag":527,"props":2551,"children":2552},{"emptyLinePlaceholder":822},[2553],{"type":47,"value":825},{"type":42,"tag":527,"props":2555,"children":2556},{"class":529,"line":881},[2557],{"type":42,"tag":527,"props":2558,"children":2559},{},[2560],{"type":47,"value":2561},"# Coverage execution binary\n",{"type":42,"tag":527,"props":2563,"children":2564},{"class":529,"line":890},[2565],{"type":42,"tag":527,"props":2566,"children":2567},{},[2568],{"type":47,"value":2569},"add_executable(fuzz_exec main.cc harness.cc execute-rt.cc)\n",{"type":42,"tag":527,"props":2571,"children":2572},{"class":529,"line":899},[2573],{"type":42,"tag":527,"props":2574,"children":2575},{},[2576],{"type":47,"value":2577},"target_compile_definitions(fuzz_exec PRIVATE NO_MAIN)\n",{"type":42,"tag":527,"props":2579,"children":2580},{"class":529,"line":907},[2581],{"type":42,"tag":527,"props":2582,"children":2583},{},[2584],{"type":47,"value":2585},"target_compile_options(fuzz_exec PRIVATE -O2 -fprofile-instr-generate -fcoverage-mapping)\n",{"type":42,"tag":527,"props":2587,"children":2588},{"class":529,"line":916},[2589],{"type":42,"tag":527,"props":2590,"children":2591},{},[2592],{"type":47,"value":2593},"target_link_libraries(fuzz_exec -fprofile-instr-generate)\n",{"type":42,"tag":50,"props":2595,"children":2596},{},[2597],{"type":47,"value":2598},"Build:",{"type":42,"tag":463,"props":2600,"children":2602},{"className":519,"code":2601,"language":521,"meta":471,"style":471},"cmake -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ .\ncmake --build . --target fuzz_exec\n",[2603],{"type":42,"tag":343,"props":2604,"children":2605},{"__ignoreMap":471},[2606,2628],{"type":42,"tag":527,"props":2607,"children":2608},{"class":529,"line":530},[2609,2613,2618,2623],{"type":42,"tag":527,"props":2610,"children":2611},{"style":534},[2612],{"type":47,"value":2456},{"type":42,"tag":527,"props":2614,"children":2615},{"style":540},[2616],{"type":47,"value":2617}," -DCMAKE_C_COMPILER=clang",{"type":42,"tag":527,"props":2619,"children":2620},{"style":540},[2621],{"type":47,"value":2622}," -DCMAKE_CXX_COMPILER=clang++",{"type":42,"tag":527,"props":2624,"children":2625},{"style":540},[2626],{"type":47,"value":2627}," .\n",{"type":42,"tag":527,"props":2629,"children":2630},{"class":529,"line":557},[2631,2635,2640,2644,2649],{"type":42,"tag":527,"props":2632,"children":2633},{"style":534},[2634],{"type":47,"value":2456},{"type":42,"tag":527,"props":2636,"children":2637},{"style":540},[2638],{"type":47,"value":2639}," --build",{"type":42,"tag":527,"props":2641,"children":2642},{"style":540},[2643],{"type":47,"value":1802},{"type":42,"tag":527,"props":2645,"children":2646},{"style":540},[2647],{"type":47,"value":2648}," --target",{"type":42,"tag":527,"props":2650,"children":2651},{"style":540},[2652],{"type":47,"value":601},{"type":42,"tag":56,"props":2654,"children":2656},{"id":2655},"advanced-usage",[2657],{"type":47,"value":2658},"Advanced Usage",{"type":42,"tag":110,"props":2660,"children":2662},{"id":2661},"tips-and-tricks",[2663],{"type":47,"value":2664},"Tips and Tricks",{"type":42,"tag":117,"props":2666,"children":2667},{},[2668,2684],{"type":42,"tag":121,"props":2669,"children":2670},{},[2671],{"type":42,"tag":125,"props":2672,"children":2673},{},[2674,2679],{"type":42,"tag":129,"props":2675,"children":2676},{},[2677],{"type":47,"value":2678},"Tip",{"type":42,"tag":129,"props":2680,"children":2681},{},[2682],{"type":47,"value":2683},"Why It Helps",{"type":42,"tag":140,"props":2685,"children":2686},{},[2687,2706,2733,2754,2775,2788],{"type":42,"tag":125,"props":2688,"children":2689},{},[2690,2701],{"type":42,"tag":147,"props":2691,"children":2692},{},[2693,2695],{"type":47,"value":2694},"Use LLVM 18+ with ",{"type":42,"tag":343,"props":2696,"children":2698},{"className":2697},[],[2699],{"type":47,"value":2700},"-show-directory-coverage",{"type":42,"tag":147,"props":2702,"children":2703},{},[2704],{"type":47,"value":2705},"Organizes large reports by directory structure instead of flat file list",{"type":42,"tag":125,"props":2707,"children":2708},{},[2709,2714],{"type":42,"tag":147,"props":2710,"children":2711},{},[2712],{"type":47,"value":2713},"Export to lcov format for better HTML",{"type":42,"tag":147,"props":2715,"children":2716},{},[2717,2723,2725,2731],{"type":42,"tag":343,"props":2718,"children":2720},{"className":2719},[],[2721],{"type":47,"value":2722},"llvm-cov export -format=lcov",{"type":47,"value":2724}," + ",{"type":42,"tag":343,"props":2726,"children":2728},{"className":2727},[],[2729],{"type":47,"value":2730},"genhtml",{"type":47,"value":2732}," provides cleaner per-file reports",{"type":42,"tag":125,"props":2734,"children":2735},{},[2736,2741],{"type":42,"tag":147,"props":2737,"children":2738},{},[2739],{"type":47,"value":2740},"Compare coverage across campaigns",{"type":42,"tag":147,"props":2742,"children":2743},{},[2744,2746,2752],{"type":47,"value":2745},"Store ",{"type":42,"tag":343,"props":2747,"children":2749},{"className":2748},[],[2750],{"type":47,"value":2751},".profdata",{"type":47,"value":2753}," files with timestamps to track progress over time",{"type":42,"tag":125,"props":2755,"children":2756},{},[2757,2762],{"type":42,"tag":147,"props":2758,"children":2759},{},[2760],{"type":47,"value":2761},"Filter harness code from reports",{"type":42,"tag":147,"props":2763,"children":2764},{},[2765,2767,2773],{"type":47,"value":2766},"Use ",{"type":42,"tag":343,"props":2768,"children":2770},{"className":2769},[],[2771],{"type":47,"value":2772},"-ignore-filename-regex",{"type":47,"value":2774}," to focus on SUT coverage only",{"type":42,"tag":125,"props":2776,"children":2777},{},[2778,2783],{"type":42,"tag":147,"props":2779,"children":2780},{},[2781],{"type":47,"value":2782},"Automate coverage in CI\u002FCD",{"type":42,"tag":147,"props":2784,"children":2785},{},[2786],{"type":47,"value":2787},"Generate coverage reports automatically after scheduled fuzzing runs",{"type":42,"tag":125,"props":2789,"children":2790},{},[2791,2796],{"type":42,"tag":147,"props":2792,"children":2793},{},[2794],{"type":47,"value":2795},"Use gcovr 5.1+ for Clang 14+",{"type":42,"tag":147,"props":2797,"children":2798},{},[2799],{"type":47,"value":2800},"Older gcovr versions have compatibility issues with recent LLVM",{"type":42,"tag":110,"props":2802,"children":2804},{"id":2803},"incremental-coverage-updates",[2805],{"type":47,"value":2806},"Incremental Coverage Updates",{"type":42,"tag":50,"props":2808,"children":2809},{},[2810,2812,2818],{"type":47,"value":2811},"GCC's gcov instrumentation incrementally updates ",{"type":42,"tag":343,"props":2813,"children":2815},{"className":2814},[],[2816],{"type":47,"value":2817},".gcda",{"type":47,"value":2819}," files across multiple runs. This is useful for tracking coverage as you add test cases:",{"type":42,"tag":463,"props":2821,"children":2823},{"className":519,"code":2822,"language":521,"meta":471,"style":471},"# First run\n.\u002Ffuzz_exec_gcov corpus_batch_1\u002F\ngcovr --html coverage_v1.html\n\n# Second run (adds to existing coverage)\n.\u002Ffuzz_exec_gcov corpus_batch_2\u002F\ngcovr --html coverage_v2.html\n\n# Start fresh\ngcovr --delete  # Remove .gcda files\n.\u002Ffuzz_exec_gcov corpus\u002F\n",[2824],{"type":42,"tag":343,"props":2825,"children":2826},{"__ignoreMap":471},[2827,2835,2847,2864,2871,2879,2891,2907,2914,2922,2939],{"type":42,"tag":527,"props":2828,"children":2829},{"class":529,"line":530},[2830],{"type":42,"tag":527,"props":2831,"children":2832},{"style":1447},[2833],{"type":47,"value":2834},"# First run\n",{"type":42,"tag":527,"props":2836,"children":2837},{"class":529,"line":557},[2838,2842],{"type":42,"tag":527,"props":2839,"children":2840},{"style":534},[2841],{"type":47,"value":1399},{"type":42,"tag":527,"props":2843,"children":2844},{"style":540},[2845],{"type":47,"value":2846}," corpus_batch_1\u002F\n",{"type":42,"tag":527,"props":2848,"children":2849},{"class":529,"line":575},[2850,2854,2859],{"type":42,"tag":527,"props":2851,"children":2852},{"style":534},[2853],{"type":47,"value":1740},{"type":42,"tag":527,"props":2855,"children":2856},{"style":540},[2857],{"type":47,"value":2858}," --html",{"type":42,"tag":527,"props":2860,"children":2861},{"style":540},[2862],{"type":47,"value":2863}," coverage_v1.html\n",{"type":42,"tag":527,"props":2865,"children":2866},{"class":529,"line":800},[2867],{"type":42,"tag":527,"props":2868,"children":2869},{"emptyLinePlaceholder":822},[2870],{"type":47,"value":825},{"type":42,"tag":527,"props":2872,"children":2873},{"class":529,"line":809},[2874],{"type":42,"tag":527,"props":2875,"children":2876},{"style":1447},[2877],{"type":47,"value":2878},"# Second run (adds to existing coverage)\n",{"type":42,"tag":527,"props":2880,"children":2881},{"class":529,"line":818},[2882,2886],{"type":42,"tag":527,"props":2883,"children":2884},{"style":534},[2885],{"type":47,"value":1399},{"type":42,"tag":527,"props":2887,"children":2888},{"style":540},[2889],{"type":47,"value":2890}," corpus_batch_2\u002F\n",{"type":42,"tag":527,"props":2892,"children":2893},{"class":529,"line":828},[2894,2898,2902],{"type":42,"tag":527,"props":2895,"children":2896},{"style":534},[2897],{"type":47,"value":1740},{"type":42,"tag":527,"props":2899,"children":2900},{"style":540},[2901],{"type":47,"value":2858},{"type":42,"tag":527,"props":2903,"children":2904},{"style":540},[2905],{"type":47,"value":2906}," coverage_v2.html\n",{"type":42,"tag":527,"props":2908,"children":2909},{"class":529,"line":837},[2910],{"type":42,"tag":527,"props":2911,"children":2912},{"emptyLinePlaceholder":822},[2913],{"type":47,"value":825},{"type":42,"tag":527,"props":2915,"children":2916},{"class":529,"line":845},[2917],{"type":42,"tag":527,"props":2918,"children":2919},{"style":1447},[2920],{"type":47,"value":2921},"# Start fresh\n",{"type":42,"tag":527,"props":2923,"children":2924},{"class":529,"line":854},[2925,2929,2934],{"type":42,"tag":527,"props":2926,"children":2927},{"style":534},[2928],{"type":47,"value":1740},{"type":42,"tag":527,"props":2930,"children":2931},{"style":540},[2932],{"type":47,"value":2933}," --delete",{"type":42,"tag":527,"props":2935,"children":2936},{"style":1447},[2937],{"type":47,"value":2938},"  # Remove .gcda files\n",{"type":42,"tag":527,"props":2940,"children":2941},{"class":529,"line":863},[2942,2946],{"type":42,"tag":527,"props":2943,"children":2944},{"style":534},[2945],{"type":47,"value":1399},{"type":42,"tag":527,"props":2947,"children":2948},{"style":540},[2949],{"type":47,"value":1377},{"type":42,"tag":110,"props":2951,"children":2953},{"id":2952},"handling-large-codebases",[2954],{"type":47,"value":2955},"Handling Large Codebases",{"type":42,"tag":50,"props":2957,"children":2958},{},[2959],{"type":47,"value":2960},"For projects with hundreds of source files:",{"type":42,"tag":68,"props":2962,"children":2963},{},[2964,3006,3053],{"type":42,"tag":72,"props":2965,"children":2966},{},[2967,2972,2974],{"type":42,"tag":76,"props":2968,"children":2969},{},[2970],{"type":47,"value":2971},"Filter by prefix",{"type":47,"value":2973},": Only generate reports for relevant directories",{"type":42,"tag":463,"props":2975,"children":2977},{"className":519,"code":2976,"language":521,"meta":471,"style":471},"llvm-cov show .\u002Ffuzz_exec -instr-profile=fuzz.profdata \u002Fpath\u002Fto\u002Fsrc\u002F\n",[2978],{"type":42,"tag":343,"props":2979,"children":2980},{"__ignoreMap":471},[2981],{"type":42,"tag":527,"props":2982,"children":2983},{"class":529,"line":530},[2984,2988,2992,2996,3001],{"type":42,"tag":527,"props":2985,"children":2986},{"style":534},[2987],{"type":47,"value":1505},{"type":42,"tag":527,"props":2989,"children":2990},{"style":540},[2991],{"type":47,"value":1580},{"type":42,"tag":527,"props":2993,"children":2994},{"style":540},[2995],{"type":47,"value":1372},{"type":42,"tag":527,"props":2997,"children":2998},{"style":540},[2999],{"type":47,"value":3000}," -instr-profile=fuzz.profdata",{"type":42,"tag":527,"props":3002,"children":3003},{"style":540},[3004],{"type":47,"value":3005}," \u002Fpath\u002Fto\u002Fsrc\u002F\n",{"type":42,"tag":72,"props":3007,"children":3008},{},[3009,3014,3016],{"type":42,"tag":76,"props":3010,"children":3011},{},[3012],{"type":47,"value":3013},"Use directory coverage",{"type":47,"value":3015},": Group by directory to reduce clutter (LLVM 18+)",{"type":42,"tag":463,"props":3017,"children":3019},{"className":519,"code":3018,"language":521,"meta":471,"style":471},"llvm-cov show -show-directory-coverage -format=html -output-dir html\u002F\n",[3020],{"type":42,"tag":343,"props":3021,"children":3022},{"__ignoreMap":471},[3023],{"type":42,"tag":527,"props":3024,"children":3025},{"class":529,"line":530},[3026,3030,3034,3039,3044,3048],{"type":42,"tag":527,"props":3027,"children":3028},{"style":534},[3029],{"type":47,"value":1505},{"type":42,"tag":527,"props":3031,"children":3032},{"style":540},[3033],{"type":47,"value":1580},{"type":42,"tag":527,"props":3035,"children":3036},{"style":540},[3037],{"type":47,"value":3038}," -show-directory-coverage",{"type":42,"tag":527,"props":3040,"children":3041},{"style":540},[3042],{"type":47,"value":3043}," -format=html",{"type":42,"tag":527,"props":3045,"children":3046},{"style":540},[3047],{"type":47,"value":1635},{"type":42,"tag":527,"props":3049,"children":3050},{"style":540},[3051],{"type":47,"value":3052}," html\u002F\n",{"type":42,"tag":72,"props":3054,"children":3055},{},[3056,3061,3063],{"type":42,"tag":76,"props":3057,"children":3058},{},[3059],{"type":47,"value":3060},"Generate JSON for programmatic analysis",{"type":47,"value":3062},":",{"type":42,"tag":463,"props":3064,"children":3066},{"className":519,"code":3065,"language":521,"meta":471,"style":471},"llvm-cov export -format=lcov > coverage.json\n",[3067],{"type":42,"tag":343,"props":3068,"children":3069},{"__ignoreMap":471},[3070],{"type":42,"tag":527,"props":3071,"children":3072},{"class":529,"line":530},[3073,3077,3082,3087,3091],{"type":42,"tag":527,"props":3074,"children":3075},{"style":534},[3076],{"type":47,"value":1505},{"type":42,"tag":527,"props":3078,"children":3079},{"style":540},[3080],{"type":47,"value":3081}," export",{"type":42,"tag":527,"props":3083,"children":3084},{"style":540},[3085],{"type":47,"value":3086}," -format=lcov",{"type":42,"tag":527,"props":3088,"children":3089},{"style":1359},[3090],{"type":47,"value":1897},{"type":42,"tag":527,"props":3092,"children":3093},{"style":540},[3094],{"type":47,"value":3095}," coverage.json\n",{"type":42,"tag":110,"props":3097,"children":3099},{"id":3098},"differential-coverage",[3100],{"type":47,"value":3101},"Differential Coverage",{"type":42,"tag":50,"props":3103,"children":3104},{},[3105],{"type":47,"value":3106},"Compare coverage between two fuzzing campaigns:",{"type":42,"tag":463,"props":3108,"children":3110},{"className":519,"code":3109,"language":521,"meta":471,"style":471},"# Campaign 1\nLLVM_PROFILE_FILE=campaign1.profraw .\u002Ffuzz_exec corpus1\u002F\nllvm-profdata merge -sparse campaign1.profraw -o campaign1.profdata\n\n# Campaign 2\nLLVM_PROFILE_FILE=campaign2.profraw .\u002Ffuzz_exec corpus2\u002F\nllvm-profdata merge -sparse campaign2.profraw -o campaign2.profdata\n\n# Compare\nllvm-cov show .\u002Ffuzz_exec \\\n  -instr-profile=campaign2.profdata \\\n  -instr-profile=campaign1.profdata \\\n  -show-line-counts-or-regions\n",[3111],{"type":42,"tag":343,"props":3112,"children":3113},{"__ignoreMap":471},[3114,3122,3147,3176,3183,3191,3216,3245,3252,3260,3279,3291,3303],{"type":42,"tag":527,"props":3115,"children":3116},{"class":529,"line":530},[3117],{"type":42,"tag":527,"props":3118,"children":3119},{"style":1447},[3120],{"type":47,"value":3121},"# Campaign 1\n",{"type":42,"tag":527,"props":3123,"children":3124},{"class":529,"line":557},[3125,3129,3133,3138,3142],{"type":42,"tag":527,"props":3126,"children":3127},{"style":551},[3128],{"type":47,"value":1356},{"type":42,"tag":527,"props":3130,"children":3131},{"style":1359},[3132],{"type":47,"value":1362},{"type":42,"tag":527,"props":3134,"children":3135},{"style":540},[3136],{"type":47,"value":3137},"campaign1.profraw",{"type":42,"tag":527,"props":3139,"children":3140},{"style":534},[3141],{"type":47,"value":1372},{"type":42,"tag":527,"props":3143,"children":3144},{"style":540},[3145],{"type":47,"value":3146}," corpus1\u002F\n",{"type":42,"tag":527,"props":3148,"children":3149},{"class":529,"line":575},[3150,3154,3158,3162,3167,3171],{"type":42,"tag":527,"props":3151,"children":3152},{"style":534},[3153],{"type":47,"value":1458},{"type":42,"tag":527,"props":3155,"children":3156},{"style":540},[3157],{"type":47,"value":1463},{"type":42,"tag":527,"props":3159,"children":3160},{"style":540},[3161],{"type":47,"value":1468},{"type":42,"tag":527,"props":3163,"children":3164},{"style":540},[3165],{"type":47,"value":3166}," campaign1.profraw",{"type":42,"tag":527,"props":3168,"children":3169},{"style":540},[3170],{"type":47,"value":596},{"type":42,"tag":527,"props":3172,"children":3173},{"style":540},[3174],{"type":47,"value":3175}," campaign1.profdata\n",{"type":42,"tag":527,"props":3177,"children":3178},{"class":529,"line":800},[3179],{"type":42,"tag":527,"props":3180,"children":3181},{"emptyLinePlaceholder":822},[3182],{"type":47,"value":825},{"type":42,"tag":527,"props":3184,"children":3185},{"class":529,"line":809},[3186],{"type":42,"tag":527,"props":3187,"children":3188},{"style":1447},[3189],{"type":47,"value":3190},"# Campaign 2\n",{"type":42,"tag":527,"props":3192,"children":3193},{"class":529,"line":818},[3194,3198,3202,3207,3211],{"type":42,"tag":527,"props":3195,"children":3196},{"style":551},[3197],{"type":47,"value":1356},{"type":42,"tag":527,"props":3199,"children":3200},{"style":1359},[3201],{"type":47,"value":1362},{"type":42,"tag":527,"props":3203,"children":3204},{"style":540},[3205],{"type":47,"value":3206},"campaign2.profraw",{"type":42,"tag":527,"props":3208,"children":3209},{"style":534},[3210],{"type":47,"value":1372},{"type":42,"tag":527,"props":3212,"children":3213},{"style":540},[3214],{"type":47,"value":3215}," corpus2\u002F\n",{"type":42,"tag":527,"props":3217,"children":3218},{"class":529,"line":828},[3219,3223,3227,3231,3236,3240],{"type":42,"tag":527,"props":3220,"children":3221},{"style":534},[3222],{"type":47,"value":1458},{"type":42,"tag":527,"props":3224,"children":3225},{"style":540},[3226],{"type":47,"value":1463},{"type":42,"tag":527,"props":3228,"children":3229},{"style":540},[3230],{"type":47,"value":1468},{"type":42,"tag":527,"props":3232,"children":3233},{"style":540},[3234],{"type":47,"value":3235}," campaign2.profraw",{"type":42,"tag":527,"props":3237,"children":3238},{"style":540},[3239],{"type":47,"value":596},{"type":42,"tag":527,"props":3241,"children":3242},{"style":540},[3243],{"type":47,"value":3244}," campaign2.profdata\n",{"type":42,"tag":527,"props":3246,"children":3247},{"class":529,"line":837},[3248],{"type":42,"tag":527,"props":3249,"children":3250},{"emptyLinePlaceholder":822},[3251],{"type":47,"value":825},{"type":42,"tag":527,"props":3253,"children":3254},{"class":529,"line":845},[3255],{"type":42,"tag":527,"props":3256,"children":3257},{"style":1447},[3258],{"type":47,"value":3259},"# Compare\n",{"type":42,"tag":527,"props":3261,"children":3262},{"class":529,"line":854},[3263,3267,3271,3275],{"type":42,"tag":527,"props":3264,"children":3265},{"style":534},[3266],{"type":47,"value":1505},{"type":42,"tag":527,"props":3268,"children":3269},{"style":540},[3270],{"type":47,"value":1580},{"type":42,"tag":527,"props":3272,"children":3273},{"style":540},[3274],{"type":47,"value":1372},{"type":42,"tag":527,"props":3276,"children":3277},{"style":551},[3278],{"type":47,"value":554},{"type":42,"tag":527,"props":3280,"children":3281},{"class":529,"line":863},[3282,3287],{"type":42,"tag":527,"props":3283,"children":3284},{"style":540},[3285],{"type":47,"value":3286},"  -instr-profile=campaign2.profdata",{"type":42,"tag":527,"props":3288,"children":3289},{"style":551},[3290],{"type":47,"value":554},{"type":42,"tag":527,"props":3292,"children":3293},{"class":529,"line":872},[3294,3299],{"type":42,"tag":527,"props":3295,"children":3296},{"style":540},[3297],{"type":47,"value":3298},"  -instr-profile=campaign1.profdata",{"type":42,"tag":527,"props":3300,"children":3301},{"style":551},[3302],{"type":47,"value":554},{"type":42,"tag":527,"props":3304,"children":3305},{"class":529,"line":881},[3306],{"type":42,"tag":527,"props":3307,"children":3308},{"style":540},[3309],{"type":47,"value":3310},"  -show-line-counts-or-regions\n",{"type":42,"tag":56,"props":3312,"children":3314},{"id":3313},"anti-patterns",[3315],{"type":47,"value":3316},"Anti-Patterns",{"type":42,"tag":117,"props":3318,"children":3319},{},[3320,3340],{"type":42,"tag":121,"props":3321,"children":3322},{},[3323],{"type":42,"tag":125,"props":3324,"children":3325},{},[3326,3331,3335],{"type":42,"tag":129,"props":3327,"children":3328},{},[3329],{"type":47,"value":3330},"Anti-Pattern",{"type":42,"tag":129,"props":3332,"children":3333},{},[3334],{"type":47,"value":2152},{"type":42,"tag":129,"props":3336,"children":3337},{},[3338],{"type":47,"value":3339},"Correct Approach",{"type":42,"tag":140,"props":3341,"children":3342},{},[3343,3361,3400,3431,3449,3467],{"type":42,"tag":125,"props":3344,"children":3345},{},[3346,3351,3356],{"type":42,"tag":147,"props":3347,"children":3348},{},[3349],{"type":47,"value":3350},"Using fuzzer-reported coverage for comparisons",{"type":42,"tag":147,"props":3352,"children":3353},{},[3354],{"type":47,"value":3355},"Different fuzzers calculate coverage differently, making cross-tool comparison meaningless",{"type":42,"tag":147,"props":3357,"children":3358},{},[3359],{"type":47,"value":3360},"Use dedicated coverage tools (llvm-cov, gcovr) for reproducible measurements",{"type":42,"tag":125,"props":3362,"children":3363},{},[3364,3369,3380],{"type":42,"tag":147,"props":3365,"children":3366},{},[3367],{"type":47,"value":3368},"Generating coverage with optimizations",{"type":42,"tag":147,"props":3370,"children":3371},{},[3372,3378],{"type":42,"tag":343,"props":3373,"children":3375},{"className":3374},[],[3376],{"type":47,"value":3377},"-O3",{"type":47,"value":3379}," optimizations can eliminate code, making coverage misleading",{"type":42,"tag":147,"props":3381,"children":3382},{},[3383,3384,3390,3392,3398],{"type":47,"value":2766},{"type":42,"tag":343,"props":3385,"children":3387},{"className":3386},[],[3388],{"type":47,"value":3389},"-O2",{"type":47,"value":3391}," or ",{"type":42,"tag":343,"props":3393,"children":3395},{"className":3394},[],[3396],{"type":47,"value":3397},"-O0",{"type":47,"value":3399}," for coverage builds",{"type":42,"tag":125,"props":3401,"children":3402},{},[3403,3408,3413],{"type":42,"tag":147,"props":3404,"children":3405},{},[3406],{"type":47,"value":3407},"Not filtering harness code",{"type":42,"tag":147,"props":3409,"children":3410},{},[3411],{"type":47,"value":3412},"Harness coverage inflates numbers and obscures SUT coverage",{"type":42,"tag":147,"props":3414,"children":3415},{},[3416,3417,3422,3423,3429],{"type":47,"value":2766},{"type":42,"tag":343,"props":3418,"children":3420},{"className":3419},[],[3421],{"type":47,"value":2772},{"type":47,"value":3391},{"type":42,"tag":343,"props":3424,"children":3426},{"className":3425},[],[3427],{"type":47,"value":3428},"--exclude",{"type":47,"value":3430}," to filter harness files",{"type":42,"tag":125,"props":3432,"children":3433},{},[3434,3439,3444],{"type":42,"tag":147,"props":3435,"children":3436},{},[3437],{"type":47,"value":3438},"Mixing LLVM and GCC instrumentation",{"type":42,"tag":147,"props":3440,"children":3441},{},[3442],{"type":47,"value":3443},"Incompatible formats cause parsing failures",{"type":42,"tag":147,"props":3445,"children":3446},{},[3447],{"type":47,"value":3448},"Stick to one toolchain for coverage builds",{"type":42,"tag":125,"props":3450,"children":3451},{},[3452,3457,3462],{"type":42,"tag":147,"props":3453,"children":3454},{},[3455],{"type":47,"value":3456},"Ignoring crashing inputs",{"type":42,"tag":147,"props":3458,"children":3459},{},[3460],{"type":47,"value":3461},"Crashes prevent coverage generation, hiding real coverage data",{"type":42,"tag":147,"props":3463,"children":3464},{},[3465],{"type":47,"value":3466},"Fix crashes first, or use process forking to isolate them",{"type":42,"tag":125,"props":3468,"children":3469},{},[3470,3475,3480],{"type":42,"tag":147,"props":3471,"children":3472},{},[3473],{"type":47,"value":3474},"Not tracking coverage over time",{"type":42,"tag":147,"props":3476,"children":3477},{},[3478],{"type":47,"value":3479},"One-time coverage checks miss regressions and improvements",{"type":42,"tag":147,"props":3481,"children":3482},{},[3483],{"type":47,"value":3484},"Store coverage data with timestamps and track trends",{"type":42,"tag":56,"props":3486,"children":3488},{"id":3487},"tool-specific-guidance",[3489],{"type":47,"value":3490},"Tool-Specific Guidance",{"type":42,"tag":110,"props":3492,"children":3494},{"id":3493},"libfuzzer",[3495],{"type":47,"value":3496},"libFuzzer",{"type":42,"tag":50,"props":3498,"children":3499},{},[3500],{"type":47,"value":3501},"libFuzzer uses LLVM's SanitizerCoverage by default for guiding fuzzing, but you need separate instrumentation for generating reports.",{"type":42,"tag":50,"props":3503,"children":3504},{},[3505],{"type":42,"tag":76,"props":3506,"children":3507},{},[3508],{"type":47,"value":3509},"Build for coverage:",{"type":42,"tag":463,"props":3511,"children":3512},{"className":519,"code":520,"language":521,"meta":471,"style":471},[3513],{"type":42,"tag":343,"props":3514,"children":3515},{"__ignoreMap":471},[3516,3535,3550],{"type":42,"tag":527,"props":3517,"children":3518},{"class":529,"line":530},[3519,3523,3527,3531],{"type":42,"tag":527,"props":3520,"children":3521},{"style":534},[3522],{"type":47,"value":537},{"type":42,"tag":527,"props":3524,"children":3525},{"style":540},[3526],{"type":47,"value":543},{"type":42,"tag":527,"props":3528,"children":3529},{"style":540},[3530],{"type":47,"value":548},{"type":42,"tag":527,"props":3532,"children":3533},{"style":551},[3534],{"type":47,"value":554},{"type":42,"tag":527,"props":3536,"children":3537},{"class":529,"line":557},[3538,3542,3546],{"type":42,"tag":527,"props":3539,"children":3540},{"style":540},[3541],{"type":47,"value":563},{"type":42,"tag":527,"props":3543,"children":3544},{"style":540},[3545],{"type":47,"value":568},{"type":42,"tag":527,"props":3547,"children":3548},{"style":551},[3549],{"type":47,"value":554},{"type":42,"tag":527,"props":3551,"children":3552},{"class":529,"line":575},[3553,3557,3561,3565,3569],{"type":42,"tag":527,"props":3554,"children":3555},{"style":540},[3556],{"type":47,"value":581},{"type":42,"tag":527,"props":3558,"children":3559},{"style":540},[3560],{"type":47,"value":586},{"type":42,"tag":527,"props":3562,"children":3563},{"style":540},[3564],{"type":47,"value":591},{"type":42,"tag":527,"props":3566,"children":3567},{"style":540},[3568],{"type":47,"value":596},{"type":42,"tag":527,"props":3570,"children":3571},{"style":540},[3572],{"type":47,"value":601},{"type":42,"tag":50,"props":3574,"children":3575},{},[3576],{"type":42,"tag":76,"props":3577,"children":3578},{},[3579],{"type":47,"value":3580},"Execute corpus and generate report:",{"type":42,"tag":463,"props":3582,"children":3584},{"className":519,"code":3583,"language":521,"meta":471,"style":471},"LLVM_PROFILE_FILE=fuzz.profraw .\u002Ffuzz_exec corpus\u002F\nllvm-profdata merge -sparse fuzz.profraw -o fuzz.profdata\nllvm-cov show .\u002Ffuzz_exec -instr-profile=fuzz.profdata -format=html -output-dir html\u002F\n",[3585],{"type":42,"tag":343,"props":3586,"children":3587},{"__ignoreMap":471},[3588,3611,3638],{"type":42,"tag":527,"props":3589,"children":3590},{"class":529,"line":530},[3591,3595,3599,3603,3607],{"type":42,"tag":527,"props":3592,"children":3593},{"style":551},[3594],{"type":47,"value":1356},{"type":42,"tag":527,"props":3596,"children":3597},{"style":1359},[3598],{"type":47,"value":1362},{"type":42,"tag":527,"props":3600,"children":3601},{"style":540},[3602],{"type":47,"value":1367},{"type":42,"tag":527,"props":3604,"children":3605},{"style":534},[3606],{"type":47,"value":1372},{"type":42,"tag":527,"props":3608,"children":3609},{"style":540},[3610],{"type":47,"value":1377},{"type":42,"tag":527,"props":3612,"children":3613},{"class":529,"line":557},[3614,3618,3622,3626,3630,3634],{"type":42,"tag":527,"props":3615,"children":3616},{"style":534},[3617],{"type":47,"value":1458},{"type":42,"tag":527,"props":3619,"children":3620},{"style":540},[3621],{"type":47,"value":1463},{"type":42,"tag":527,"props":3623,"children":3624},{"style":540},[3625],{"type":47,"value":1468},{"type":42,"tag":527,"props":3627,"children":3628},{"style":540},[3629],{"type":47,"value":1473},{"type":42,"tag":527,"props":3631,"children":3632},{"style":540},[3633],{"type":47,"value":596},{"type":42,"tag":527,"props":3635,"children":3636},{"style":540},[3637],{"type":47,"value":1482},{"type":42,"tag":527,"props":3639,"children":3640},{"class":529,"line":575},[3641,3645,3649,3653,3657,3661,3665],{"type":42,"tag":527,"props":3642,"children":3643},{"style":534},[3644],{"type":47,"value":1505},{"type":42,"tag":527,"props":3646,"children":3647},{"style":540},[3648],{"type":47,"value":1580},{"type":42,"tag":527,"props":3650,"children":3651},{"style":540},[3652],{"type":47,"value":1372},{"type":42,"tag":527,"props":3654,"children":3655},{"style":540},[3656],{"type":47,"value":3000},{"type":42,"tag":527,"props":3658,"children":3659},{"style":540},[3660],{"type":47,"value":3043},{"type":42,"tag":527,"props":3662,"children":3663},{"style":540},[3664],{"type":47,"value":1635},{"type":42,"tag":527,"props":3666,"children":3667},{"style":540},[3668],{"type":47,"value":3052},{"type":42,"tag":50,"props":3670,"children":3671},{},[3672],{"type":42,"tag":76,"props":3673,"children":3674},{},[3675],{"type":47,"value":3676},"Integration tips:",{"type":42,"tag":239,"props":3678,"children":3679},{},[3680,3693,3706,3718],{"type":42,"tag":72,"props":3681,"children":3682},{},[3683,3685,3691],{"type":47,"value":3684},"Don't use ",{"type":42,"tag":343,"props":3686,"children":3688},{"className":3687},[],[3689],{"type":47,"value":3690},"-fsanitize=fuzzer",{"type":47,"value":3692}," for coverage builds (it conflicts with profile instrumentation)",{"type":42,"tag":72,"props":3694,"children":3695},{},[3696,3698,3704],{"type":47,"value":3697},"Reuse the same harness function (",{"type":42,"tag":343,"props":3699,"children":3701},{"className":3700},[],[3702],{"type":47,"value":3703},"LLVMFuzzerTestOneInput",{"type":47,"value":3705},") with a different main function",{"type":42,"tag":72,"props":3707,"children":3708},{},[3709,3711,3716],{"type":47,"value":3710},"Use the ",{"type":42,"tag":343,"props":3712,"children":3714},{"className":3713},[],[3715],{"type":47,"value":2772},{"type":47,"value":3717}," flag to exclude harness code from coverage reports",{"type":42,"tag":72,"props":3719,"children":3720},{},[3721,3723,3729],{"type":47,"value":3722},"Consider using llvm-cov's ",{"type":42,"tag":343,"props":3724,"children":3726},{"className":3725},[],[3727],{"type":47,"value":3728},"-show-instantiation",{"type":47,"value":3730}," flag for template-heavy C++ code",{"type":42,"tag":110,"props":3732,"children":3734},{"id":3733},"afl",[3735],{"type":47,"value":3736},"AFL++",{"type":42,"tag":50,"props":3738,"children":3739},{},[3740],{"type":47,"value":3741},"AFL++ provides its own coverage feedback mechanism, but for detailed reports use standard LLVM\u002FGCC tools.",{"type":42,"tag":50,"props":3743,"children":3744},{},[3745],{"type":42,"tag":76,"props":3746,"children":3747},{},[3748],{"type":47,"value":3749},"Build for coverage with LLVM:",{"type":42,"tag":463,"props":3751,"children":3753},{"className":519,"code":3752,"language":521,"meta":471,"style":471},"clang++ -fprofile-instr-generate -fcoverage-mapping \\\n  -O2 main.cc harness.cc execute-rt.cc -o fuzz_exec\n",[3754],{"type":42,"tag":343,"props":3755,"children":3756},{"__ignoreMap":471},[3757,3776],{"type":42,"tag":527,"props":3758,"children":3759},{"class":529,"line":530},[3760,3764,3768,3772],{"type":42,"tag":527,"props":3761,"children":3762},{"style":534},[3763],{"type":47,"value":537},{"type":42,"tag":527,"props":3765,"children":3766},{"style":540},[3767],{"type":47,"value":543},{"type":42,"tag":527,"props":3769,"children":3770},{"style":540},[3771],{"type":47,"value":548},{"type":42,"tag":527,"props":3773,"children":3774},{"style":551},[3775],{"type":47,"value":554},{"type":42,"tag":527,"props":3777,"children":3778},{"class":529,"line":557},[3779,3783,3788,3792,3796,3800],{"type":42,"tag":527,"props":3780,"children":3781},{"style":540},[3782],{"type":47,"value":563},{"type":42,"tag":527,"props":3784,"children":3785},{"style":540},[3786],{"type":47,"value":3787}," main.cc",{"type":42,"tag":527,"props":3789,"children":3790},{"style":540},[3791],{"type":47,"value":586},{"type":42,"tag":527,"props":3793,"children":3794},{"style":540},[3795],{"type":47,"value":591},{"type":42,"tag":527,"props":3797,"children":3798},{"style":540},[3799],{"type":47,"value":596},{"type":42,"tag":527,"props":3801,"children":3802},{"style":540},[3803],{"type":47,"value":601},{"type":42,"tag":50,"props":3805,"children":3806},{},[3807],{"type":42,"tag":76,"props":3808,"children":3809},{},[3810],{"type":47,"value":3811},"Build for coverage with GCC:",{"type":42,"tag":463,"props":3813,"children":3815},{"className":519,"code":3814,"language":521,"meta":471,"style":471},"AFL_USE_ASAN=0 afl-gcc -ftest-coverage -fprofile-arcs \\\n  main.cc harness.cc execute-rt.cc -o fuzz_exec_gcov\n",[3816],{"type":42,"tag":343,"props":3817,"children":3818},{"__ignoreMap":471},[3819,3853],{"type":42,"tag":527,"props":3820,"children":3821},{"class":529,"line":530},[3822,3827,3831,3836,3841,3845,3849],{"type":42,"tag":527,"props":3823,"children":3824},{"style":551},[3825],{"type":47,"value":3826},"AFL_USE_ASAN",{"type":42,"tag":527,"props":3828,"children":3829},{"style":1359},[3830],{"type":47,"value":1362},{"type":42,"tag":527,"props":3832,"children":3833},{"style":540},[3834],{"type":47,"value":3835},"0",{"type":42,"tag":527,"props":3837,"children":3838},{"style":534},[3839],{"type":47,"value":3840}," afl-gcc",{"type":42,"tag":527,"props":3842,"children":3843},{"style":540},[3844],{"type":47,"value":629},{"type":42,"tag":527,"props":3846,"children":3847},{"style":540},[3848],{"type":47,"value":634},{"type":42,"tag":527,"props":3850,"children":3851},{"style":551},[3852],{"type":47,"value":554},{"type":42,"tag":527,"props":3854,"children":3855},{"class":529,"line":557},[3856,3860,3864,3868,3872],{"type":42,"tag":527,"props":3857,"children":3858},{"style":540},[3859],{"type":47,"value":581},{"type":42,"tag":527,"props":3861,"children":3862},{"style":540},[3863],{"type":47,"value":586},{"type":42,"tag":527,"props":3865,"children":3866},{"style":540},[3867],{"type":47,"value":591},{"type":42,"tag":527,"props":3869,"children":3870},{"style":540},[3871],{"type":47,"value":596},{"type":42,"tag":527,"props":3873,"children":3874},{"style":540},[3875],{"type":47,"value":677},{"type":42,"tag":50,"props":3877,"children":3878},{},[3879],{"type":42,"tag":76,"props":3880,"children":3881},{},[3882],{"type":47,"value":3883},"Execute and generate report:",{"type":42,"tag":463,"props":3885,"children":3887},{"className":519,"code":3886,"language":521,"meta":471,"style":471},"# LLVM approach\nLLVM_PROFILE_FILE=fuzz.profraw .\u002Ffuzz_exec afl_output\u002Fqueue\u002F\nllvm-profdata merge -sparse fuzz.profraw -o fuzz.profdata\nllvm-cov report .\u002Ffuzz_exec -instr-profile=fuzz.profdata\n\n# GCC approach\n.\u002Ffuzz_exec_gcov afl_output\u002Fqueue\u002F\ngcovr --html-details -o coverage.html\n",[3888],{"type":42,"tag":343,"props":3889,"children":3890},{"__ignoreMap":471},[3891,3899,3923,3950,3970,3977,3985,3996],{"type":42,"tag":527,"props":3892,"children":3893},{"class":529,"line":530},[3894],{"type":42,"tag":527,"props":3895,"children":3896},{"style":1447},[3897],{"type":47,"value":3898},"# LLVM approach\n",{"type":42,"tag":527,"props":3900,"children":3901},{"class":529,"line":557},[3902,3906,3910,3914,3918],{"type":42,"tag":527,"props":3903,"children":3904},{"style":551},[3905],{"type":47,"value":1356},{"type":42,"tag":527,"props":3907,"children":3908},{"style":1359},[3909],{"type":47,"value":1362},{"type":42,"tag":527,"props":3911,"children":3912},{"style":540},[3913],{"type":47,"value":1367},{"type":42,"tag":527,"props":3915,"children":3916},{"style":534},[3917],{"type":47,"value":1372},{"type":42,"tag":527,"props":3919,"children":3920},{"style":540},[3921],{"type":47,"value":3922}," afl_output\u002Fqueue\u002F\n",{"type":42,"tag":527,"props":3924,"children":3925},{"class":529,"line":575},[3926,3930,3934,3938,3942,3946],{"type":42,"tag":527,"props":3927,"children":3928},{"style":534},[3929],{"type":47,"value":1458},{"type":42,"tag":527,"props":3931,"children":3932},{"style":540},[3933],{"type":47,"value":1463},{"type":42,"tag":527,"props":3935,"children":3936},{"style":540},[3937],{"type":47,"value":1468},{"type":42,"tag":527,"props":3939,"children":3940},{"style":540},[3941],{"type":47,"value":1473},{"type":42,"tag":527,"props":3943,"children":3944},{"style":540},[3945],{"type":47,"value":596},{"type":42,"tag":527,"props":3947,"children":3948},{"style":540},[3949],{"type":47,"value":1482},{"type":42,"tag":527,"props":3951,"children":3952},{"class":529,"line":800},[3953,3957,3961,3965],{"type":42,"tag":527,"props":3954,"children":3955},{"style":534},[3956],{"type":47,"value":1505},{"type":42,"tag":527,"props":3958,"children":3959},{"style":540},[3960],{"type":47,"value":1510},{"type":42,"tag":527,"props":3962,"children":3963},{"style":540},[3964],{"type":47,"value":1372},{"type":42,"tag":527,"props":3966,"children":3967},{"style":540},[3968],{"type":47,"value":3969}," -instr-profile=fuzz.profdata\n",{"type":42,"tag":527,"props":3971,"children":3972},{"class":529,"line":809},[3973],{"type":42,"tag":527,"props":3974,"children":3975},{"emptyLinePlaceholder":822},[3976],{"type":47,"value":825},{"type":42,"tag":527,"props":3978,"children":3979},{"class":529,"line":818},[3980],{"type":42,"tag":527,"props":3981,"children":3982},{"style":1447},[3983],{"type":47,"value":3984},"# GCC approach\n",{"type":42,"tag":527,"props":3986,"children":3987},{"class":529,"line":828},[3988,3992],{"type":42,"tag":527,"props":3989,"children":3990},{"style":534},[3991],{"type":47,"value":1399},{"type":42,"tag":527,"props":3993,"children":3994},{"style":540},[3995],{"type":47,"value":3922},{"type":42,"tag":527,"props":3997,"children":3998},{"class":529,"line":837},[3999,4003,4007,4011],{"type":42,"tag":527,"props":4000,"children":4001},{"style":534},[4002],{"type":47,"value":1740},{"type":42,"tag":527,"props":4004,"children":4005},{"style":540},[4006],{"type":47,"value":1807},{"type":42,"tag":527,"props":4008,"children":4009},{"style":540},[4010],{"type":47,"value":596},{"type":42,"tag":527,"props":4012,"children":4013},{"style":540},[4014],{"type":47,"value":1816},{"type":42,"tag":50,"props":4016,"children":4017},{},[4018],{"type":42,"tag":76,"props":4019,"children":4020},{},[4021],{"type":47,"value":3676},{"type":42,"tag":239,"props":4023,"children":4024},{},[4025,4038,4043,4056],{"type":42,"tag":72,"props":4026,"children":4027},{},[4028,4030,4036],{"type":47,"value":4029},"Don't use AFL++'s instrumentation (",{"type":42,"tag":343,"props":4031,"children":4033},{"className":4032},[],[4034],{"type":47,"value":4035},"afl-clang-fast",{"type":47,"value":4037},") for coverage builds",{"type":42,"tag":72,"props":4039,"children":4040},{},[4041],{"type":47,"value":4042},"Use standard compilers with coverage flags instead",{"type":42,"tag":72,"props":4044,"children":4045},{},[4046,4048,4054],{"type":47,"value":4047},"AFL++'s ",{"type":42,"tag":343,"props":4049,"children":4051},{"className":4050},[],[4052],{"type":47,"value":4053},"queue\u002F",{"type":47,"value":4055}," directory contains your corpus",{"type":42,"tag":72,"props":4057,"children":4058},{},[4059],{"type":47,"value":4060},"AFL++'s built-in coverage statistics are useful for real-time monitoring but not for detailed analysis",{"type":42,"tag":110,"props":4062,"children":4064},{"id":4063},"cargo-fuzz-rust",[4065],{"type":47,"value":4066},"cargo-fuzz (Rust)",{"type":42,"tag":50,"props":4068,"children":4069},{},[4070],{"type":47,"value":4071},"cargo-fuzz provides built-in coverage generation using LLVM tools.",{"type":42,"tag":50,"props":4073,"children":4074},{},[4075],{"type":42,"tag":76,"props":4076,"children":4077},{},[4078],{"type":47,"value":4079},"Install prerequisites:",{"type":42,"tag":463,"props":4081,"children":4083},{"className":519,"code":4082,"language":521,"meta":471,"style":471},"rustup toolchain install nightly --component llvm-tools-preview\ncargo install cargo-binutils rustfilt\n",[4084],{"type":42,"tag":343,"props":4085,"children":4086},{"__ignoreMap":471},[4087,4114],{"type":42,"tag":527,"props":4088,"children":4089},{"class":529,"line":530},[4090,4094,4098,4102,4106,4110],{"type":42,"tag":527,"props":4091,"children":4092},{"style":534},[4093],{"type":47,"value":700},{"type":42,"tag":527,"props":4095,"children":4096},{"style":540},[4097],{"type":47,"value":705},{"type":42,"tag":527,"props":4099,"children":4100},{"style":540},[4101],{"type":47,"value":710},{"type":42,"tag":527,"props":4103,"children":4104},{"style":540},[4105],{"type":47,"value":715},{"type":42,"tag":527,"props":4107,"children":4108},{"style":540},[4109],{"type":47,"value":720},{"type":42,"tag":527,"props":4111,"children":4112},{"style":540},[4113],{"type":47,"value":725},{"type":42,"tag":527,"props":4115,"children":4116},{"class":529,"line":557},[4117,4121,4125,4129],{"type":42,"tag":527,"props":4118,"children":4119},{"style":534},[4120],{"type":47,"value":733},{"type":42,"tag":527,"props":4122,"children":4123},{"style":540},[4124],{"type":47,"value":710},{"type":42,"tag":527,"props":4126,"children":4127},{"style":540},[4128],{"type":47,"value":1854},{"type":42,"tag":527,"props":4130,"children":4131},{"style":540},[4132],{"type":47,"value":1859},{"type":42,"tag":50,"props":4134,"children":4135},{},[4136],{"type":42,"tag":76,"props":4137,"children":4138},{},[4139],{"type":47,"value":4140},"Generate coverage data:",{"type":42,"tag":463,"props":4142,"children":4144},{"className":519,"code":4143,"language":521,"meta":471,"style":471},"cargo +nightly fuzz coverage fuzz_target_1\n",[4145],{"type":42,"tag":343,"props":4146,"children":4147},{"__ignoreMap":471},[4148],{"type":42,"tag":527,"props":4149,"children":4150},{"class":529,"line":530},[4151,4155,4159,4163,4167],{"type":42,"tag":527,"props":4152,"children":4153},{"style":534},[4154],{"type":47,"value":733},{"type":42,"tag":527,"props":4156,"children":4157},{"style":540},[4158],{"type":47,"value":738},{"type":42,"tag":527,"props":4160,"children":4161},{"style":540},[4162],{"type":47,"value":743},{"type":42,"tag":527,"props":4164,"children":4165},{"style":540},[4166],{"type":47,"value":748},{"type":42,"tag":527,"props":4168,"children":4169},{"style":540},[4170],{"type":47,"value":753},{"type":42,"tag":50,"props":4172,"children":4173},{},[4174],{"type":42,"tag":76,"props":4175,"children":4176},{},[4177],{"type":47,"value":4178},"Create HTML report script:",{"type":42,"tag":463,"props":4180,"children":4182},{"className":519,"code":4181,"language":521,"meta":471,"style":471},"cat \u003C\u003C'EOF' > .\u002Fgenerate_html\n#!\u002Fbin\u002Fsh\nFUZZ_TARGET=\"$1\"\nshift\nSRC_FILTER=\"$@\"\nTARGET=$(rustc -vV | sed -n 's|host: ||p')\ncargo +nightly cov -- show -Xdemangler=rustfilt \\\n  \"target\u002F$TARGET\u002Fcoverage\u002F$TARGET\u002Frelease\u002F$FUZZ_TARGET\" \\\n  -instr-profile=\"fuzz\u002Fcoverage\u002F$FUZZ_TARGET\u002Fcoverage.profdata\" \\\n  -show-line-counts-or-regions -show-instantiations \\\n  -format=html -o fuzz_html\u002F $SRC_FILTER\nEOF\nchmod +x .\u002Fgenerate_html\n",[4183],{"type":42,"tag":343,"props":4184,"children":4185},{"__ignoreMap":471},[4186,4209,4216,4223,4230,4237,4244,4251,4258,4265,4272,4279,4286],{"type":42,"tag":527,"props":4187,"children":4188},{"class":529,"line":530},[4189,4193,4197,4201,4205],{"type":42,"tag":527,"props":4190,"children":4191},{"style":534},[4192],{"type":47,"value":1882},{"type":42,"tag":527,"props":4194,"children":4195},{"style":1359},[4196],{"type":47,"value":1887},{"type":42,"tag":527,"props":4198,"children":4199},{"style":1359},[4200],{"type":47,"value":1892},{"type":42,"tag":527,"props":4202,"children":4203},{"style":1359},[4204],{"type":47,"value":1897},{"type":42,"tag":527,"props":4206,"children":4207},{"style":540},[4208],{"type":47,"value":1902},{"type":42,"tag":527,"props":4210,"children":4211},{"class":529,"line":557},[4212],{"type":42,"tag":527,"props":4213,"children":4214},{"style":540},[4215],{"type":47,"value":1910},{"type":42,"tag":527,"props":4217,"children":4218},{"class":529,"line":575},[4219],{"type":42,"tag":527,"props":4220,"children":4221},{"style":540},[4222],{"type":47,"value":1958},{"type":42,"tag":527,"props":4224,"children":4225},{"class":529,"line":800},[4226],{"type":42,"tag":527,"props":4227,"children":4228},{"style":540},[4229],{"type":47,"value":1966},{"type":42,"tag":527,"props":4231,"children":4232},{"class":529,"line":809},[4233],{"type":42,"tag":527,"props":4234,"children":4235},{"style":540},[4236],{"type":47,"value":1974},{"type":42,"tag":527,"props":4238,"children":4239},{"class":529,"line":818},[4240],{"type":42,"tag":527,"props":4241,"children":4242},{"style":540},[4243],{"type":47,"value":1982},{"type":42,"tag":527,"props":4245,"children":4246},{"class":529,"line":828},[4247],{"type":42,"tag":527,"props":4248,"children":4249},{"style":540},[4250],{"type":47,"value":1990},{"type":42,"tag":527,"props":4252,"children":4253},{"class":529,"line":837},[4254],{"type":42,"tag":527,"props":4255,"children":4256},{"style":540},[4257],{"type":47,"value":1998},{"type":42,"tag":527,"props":4259,"children":4260},{"class":529,"line":845},[4261],{"type":42,"tag":527,"props":4262,"children":4263},{"style":540},[4264],{"type":47,"value":2006},{"type":42,"tag":527,"props":4266,"children":4267},{"class":529,"line":854},[4268],{"type":42,"tag":527,"props":4269,"children":4270},{"style":540},[4271],{"type":47,"value":2014},{"type":42,"tag":527,"props":4273,"children":4274},{"class":529,"line":863},[4275],{"type":42,"tag":527,"props":4276,"children":4277},{"style":540},[4278],{"type":47,"value":2022},{"type":42,"tag":527,"props":4280,"children":4281},{"class":529,"line":872},[4282],{"type":42,"tag":527,"props":4283,"children":4284},{"style":1359},[4285],{"type":47,"value":2030},{"type":42,"tag":527,"props":4287,"children":4288},{"class":529,"line":881},[4289,4293,4297],{"type":42,"tag":527,"props":4290,"children":4291},{"style":534},[4292],{"type":47,"value":2038},{"type":42,"tag":527,"props":4294,"children":4295},{"style":540},[4296],{"type":47,"value":2043},{"type":42,"tag":527,"props":4298,"children":4299},{"style":540},[4300],{"type":47,"value":1902},{"type":42,"tag":50,"props":4302,"children":4303},{},[4304],{"type":42,"tag":76,"props":4305,"children":4306},{},[4307],{"type":47,"value":4308},"Generate report:",{"type":42,"tag":463,"props":4310,"children":4312},{"className":519,"code":4311,"language":521,"meta":471,"style":471},".\u002Fgenerate_html fuzz_target_1 src\u002Flib.rs\n",[4313],{"type":42,"tag":343,"props":4314,"children":4315},{"__ignoreMap":471},[4316],{"type":42,"tag":527,"props":4317,"children":4318},{"class":529,"line":530},[4319,4323,4327],{"type":42,"tag":527,"props":4320,"children":4321},{"style":534},[4322],{"type":47,"value":2069},{"type":42,"tag":527,"props":4324,"children":4325},{"style":540},[4326],{"type":47,"value":2074},{"type":42,"tag":527,"props":4328,"children":4329},{"style":540},[4330],{"type":47,"value":2079},{"type":42,"tag":50,"props":4332,"children":4333},{},[4334],{"type":42,"tag":76,"props":4335,"children":4336},{},[4337],{"type":47,"value":3676},{"type":42,"tag":239,"props":4339,"children":4340},{},[4341,4346,4359,4372,4392],{"type":42,"tag":72,"props":4342,"children":4343},{},[4344],{"type":47,"value":4345},"Always use the nightly toolchain for coverage",{"type":42,"tag":72,"props":4347,"children":4348},{},[4349,4351,4357],{"type":47,"value":4350},"The ",{"type":42,"tag":343,"props":4352,"children":4354},{"className":4353},[],[4355],{"type":47,"value":4356},"-Xdemangler=rustfilt",{"type":47,"value":4358}," flag makes function names readable",{"type":42,"tag":72,"props":4360,"children":4361},{},[4362,4364,4370],{"type":47,"value":4363},"Filter by source files (e.g., ",{"type":42,"tag":343,"props":4365,"children":4367},{"className":4366},[],[4368],{"type":47,"value":4369},"src\u002Flib.rs",{"type":47,"value":4371},") to focus on crate code",{"type":42,"tag":72,"props":4373,"children":4374},{},[4375,4376,4382,4384,4390],{"type":47,"value":2766},{"type":42,"tag":343,"props":4377,"children":4379},{"className":4378},[],[4380],{"type":47,"value":4381},"-show-line-counts-or-regions",{"type":47,"value":4383}," and ",{"type":42,"tag":343,"props":4385,"children":4387},{"className":4386},[],[4388],{"type":47,"value":4389},"-show-instantiations",{"type":47,"value":4391}," for better Rust-specific output",{"type":42,"tag":72,"props":4393,"children":4394},{},[4395,4397],{"type":47,"value":4396},"Corpus is located in ",{"type":42,"tag":343,"props":4398,"children":4400},{"className":4399},[],[4401],{"type":47,"value":4402},"fuzz\u002Fcorpus\u002F\u003Ctarget>\u002F",{"type":42,"tag":110,"props":4404,"children":4406},{"id":4405},"honggfuzz",[4407],{"type":47,"value":4405},{"type":42,"tag":50,"props":4409,"children":4410},{},[4411],{"type":47,"value":4412},"honggfuzz works with standard LLVM\u002FGCC coverage instrumentation.",{"type":42,"tag":50,"props":4414,"children":4415},{},[4416],{"type":42,"tag":76,"props":4417,"children":4418},{},[4419],{"type":47,"value":3509},{"type":42,"tag":463,"props":4421,"children":4423},{"className":519,"code":4422,"language":521,"meta":471,"style":471},"# Use standard compiler, not honggfuzz compiler\nclang -fprofile-instr-generate -fcoverage-mapping \\\n  -O2 harness.c execute-rt.c -o fuzz_exec\n",[4424],{"type":42,"tag":343,"props":4425,"children":4426},{"__ignoreMap":471},[4427,4435,4455],{"type":42,"tag":527,"props":4428,"children":4429},{"class":529,"line":530},[4430],{"type":42,"tag":527,"props":4431,"children":4432},{"style":1447},[4433],{"type":47,"value":4434},"# Use standard compiler, not honggfuzz compiler\n",{"type":42,"tag":527,"props":4436,"children":4437},{"class":529,"line":557},[4438,4443,4447,4451],{"type":42,"tag":527,"props":4439,"children":4440},{"style":534},[4441],{"type":47,"value":4442},"clang",{"type":42,"tag":527,"props":4444,"children":4445},{"style":540},[4446],{"type":47,"value":543},{"type":42,"tag":527,"props":4448,"children":4449},{"style":540},[4450],{"type":47,"value":548},{"type":42,"tag":527,"props":4452,"children":4453},{"style":551},[4454],{"type":47,"value":554},{"type":42,"tag":527,"props":4456,"children":4457},{"class":529,"line":575},[4458,4462,4467,4472,4476],{"type":42,"tag":527,"props":4459,"children":4460},{"style":540},[4461],{"type":47,"value":563},{"type":42,"tag":527,"props":4463,"children":4464},{"style":540},[4465],{"type":47,"value":4466}," harness.c",{"type":42,"tag":527,"props":4468,"children":4469},{"style":540},[4470],{"type":47,"value":4471}," execute-rt.c",{"type":42,"tag":527,"props":4473,"children":4474},{"style":540},[4475],{"type":47,"value":596},{"type":42,"tag":527,"props":4477,"children":4478},{"style":540},[4479],{"type":47,"value":601},{"type":42,"tag":50,"props":4481,"children":4482},{},[4483],{"type":42,"tag":76,"props":4484,"children":4485},{},[4486],{"type":47,"value":4487},"Execute corpus:",{"type":42,"tag":463,"props":4489,"children":4491},{"className":519,"code":4490,"language":521,"meta":471,"style":471},"LLVM_PROFILE_FILE=fuzz.profraw .\u002Ffuzz_exec honggfuzz_workspace\u002F\n",[4492],{"type":42,"tag":343,"props":4493,"children":4494},{"__ignoreMap":471},[4495],{"type":42,"tag":527,"props":4496,"children":4497},{"class":529,"line":530},[4498,4502,4506,4510,4514],{"type":42,"tag":527,"props":4499,"children":4500},{"style":551},[4501],{"type":47,"value":1356},{"type":42,"tag":527,"props":4503,"children":4504},{"style":1359},[4505],{"type":47,"value":1362},{"type":42,"tag":527,"props":4507,"children":4508},{"style":540},[4509],{"type":47,"value":1367},{"type":42,"tag":527,"props":4511,"children":4512},{"style":534},[4513],{"type":47,"value":1372},{"type":42,"tag":527,"props":4515,"children":4516},{"style":540},[4517],{"type":47,"value":4518}," honggfuzz_workspace\u002F\n",{"type":42,"tag":50,"props":4520,"children":4521},{},[4522],{"type":42,"tag":76,"props":4523,"children":4524},{},[4525],{"type":47,"value":3676},{"type":42,"tag":239,"props":4527,"children":4528},{},[4529,4540,4545],{"type":42,"tag":72,"props":4530,"children":4531},{},[4532,4533,4539],{"type":47,"value":3684},{"type":42,"tag":343,"props":4534,"children":4536},{"className":4535},[],[4537],{"type":47,"value":4538},"hfuzz-clang",{"type":47,"value":3399},{"type":42,"tag":72,"props":4541,"children":4542},{},[4543],{"type":47,"value":4544},"honggfuzz corpus is typically in a workspace directory",{"type":42,"tag":72,"props":4546,"children":4547},{},[4548],{"type":47,"value":4549},"Use the same LLVM workflow as libFuzzer",{"type":42,"tag":56,"props":4551,"children":4553},{"id":4552},"troubleshooting",[4554],{"type":47,"value":4555},"Troubleshooting",{"type":42,"tag":117,"props":4557,"children":4558},{},[4559,4579],{"type":42,"tag":121,"props":4560,"children":4561},{},[4562],{"type":42,"tag":125,"props":4563,"children":4564},{},[4565,4570,4575],{"type":42,"tag":129,"props":4566,"children":4567},{},[4568],{"type":47,"value":4569},"Issue",{"type":42,"tag":129,"props":4571,"children":4572},{},[4573],{"type":47,"value":4574},"Cause",{"type":42,"tag":129,"props":4576,"children":4577},{},[4578],{"type":47,"value":2208},{"type":42,"tag":140,"props":4580,"children":4581},{},[4582,4619,4641,4659,4696,4714,4732,4755],{"type":42,"tag":125,"props":4583,"children":4584},{},[4585,4594,4599],{"type":42,"tag":147,"props":4586,"children":4587},{},[4588],{"type":42,"tag":343,"props":4589,"children":4591},{"className":4590},[],[4592],{"type":47,"value":4593},"error: no profile data available",{"type":42,"tag":147,"props":4595,"children":4596},{},[4597],{"type":47,"value":4598},"Profile wasn't generated or wrong path",{"type":42,"tag":147,"props":4600,"children":4601},{},[4602,4604,4609,4611,4617],{"type":47,"value":4603},"Verify ",{"type":42,"tag":343,"props":4605,"children":4607},{"className":4606},[],[4608],{"type":47,"value":1356},{"type":47,"value":4610}," was set and ",{"type":42,"tag":343,"props":4612,"children":4614},{"className":4613},[],[4615],{"type":47,"value":4616},".profraw",{"type":47,"value":4618}," file exists",{"type":42,"tag":125,"props":4620,"children":4621},{},[4622,4631,4636],{"type":42,"tag":147,"props":4623,"children":4624},{},[4625],{"type":42,"tag":343,"props":4626,"children":4628},{"className":4627},[],[4629],{"type":47,"value":4630},"Failed to load coverage",{"type":42,"tag":147,"props":4632,"children":4633},{},[4634],{"type":47,"value":4635},"Mismatch between binary and profile data",{"type":42,"tag":147,"props":4637,"children":4638},{},[4639],{"type":47,"value":4640},"Rebuild binary with same flags used during execution",{"type":42,"tag":125,"props":4642,"children":4643},{},[4644,4649,4654],{"type":42,"tag":147,"props":4645,"children":4646},{},[4647],{"type":47,"value":4648},"Coverage reports show 0%",{"type":42,"tag":147,"props":4650,"children":4651},{},[4652],{"type":47,"value":4653},"Wrong binary used for report generation",{"type":42,"tag":147,"props":4655,"children":4656},{},[4657],{"type":47,"value":4658},"Use the instrumented binary, not the fuzzing binary",{"type":42,"tag":125,"props":4660,"children":4661},{},[4662,4673,4683],{"type":42,"tag":147,"props":4663,"children":4664},{},[4665,4671],{"type":42,"tag":343,"props":4666,"children":4668},{"className":4667},[],[4669],{"type":47,"value":4670},"no_working_dir_found",{"type":47,"value":4672}," error (gcovr)",{"type":42,"tag":147,"props":4674,"children":4675},{},[4676,4681],{"type":42,"tag":343,"props":4677,"children":4679},{"className":4678},[],[4680],{"type":47,"value":2817},{"type":47,"value":4682}," files in unexpected location",{"type":42,"tag":147,"props":4684,"children":4685},{},[4686,4688,4694],{"type":47,"value":4687},"Add ",{"type":42,"tag":343,"props":4689,"children":4691},{"className":4690},[],[4692],{"type":47,"value":4693},"--gcov-ignore-errors=no_working_dir_found",{"type":47,"value":4695}," flag",{"type":42,"tag":125,"props":4697,"children":4698},{},[4699,4704,4709],{"type":42,"tag":147,"props":4700,"children":4701},{},[4702],{"type":47,"value":4703},"Crashes prevent coverage generation",{"type":42,"tag":147,"props":4705,"children":4706},{},[4707],{"type":47,"value":4708},"Corpus contains crashing inputs",{"type":42,"tag":147,"props":4710,"children":4711},{},[4712],{"type":47,"value":4713},"Filter crashes or use forking approach to isolate failures",{"type":42,"tag":125,"props":4715,"children":4716},{},[4717,4722,4727],{"type":42,"tag":147,"props":4718,"children":4719},{},[4720],{"type":47,"value":4721},"Coverage decreases after harness change",{"type":42,"tag":147,"props":4723,"children":4724},{},[4725],{"type":47,"value":4726},"Harness now skips certain code paths",{"type":42,"tag":147,"props":4728,"children":4729},{},[4730],{"type":47,"value":4731},"Review harness logic; may need to support more input formats",{"type":42,"tag":125,"props":4733,"children":4734},{},[4735,4740,4745],{"type":42,"tag":147,"props":4736,"children":4737},{},[4738],{"type":47,"value":4739},"HTML report is flat file list",{"type":42,"tag":147,"props":4741,"children":4742},{},[4743],{"type":47,"value":4744},"Using older LLVM version",{"type":42,"tag":147,"props":4746,"children":4747},{},[4748,4750],{"type":47,"value":4749},"Upgrade to LLVM 18+ and use ",{"type":42,"tag":343,"props":4751,"children":4753},{"className":4752},[],[4754],{"type":47,"value":2700},{"type":42,"tag":125,"props":4756,"children":4757},{},[4758,4767,4772],{"type":42,"tag":147,"props":4759,"children":4760},{},[4761],{"type":42,"tag":343,"props":4762,"children":4764},{"className":4763},[],[4765],{"type":47,"value":4766},"incompatible instrumentation",{"type":42,"tag":147,"props":4768,"children":4769},{},[4770],{"type":47,"value":4771},"Mixing LLVM and GCC coverage",{"type":42,"tag":147,"props":4773,"children":4774},{},[4775],{"type":47,"value":4776},"Rebuild everything with same toolchain",{"type":42,"tag":56,"props":4778,"children":4780},{"id":4779},"related-skills",[4781],{"type":47,"value":4782},"Related Skills",{"type":42,"tag":110,"props":4784,"children":4786},{"id":4785},"tools-that-use-this-technique",[4787],{"type":47,"value":4788},"Tools That Use This Technique",{"type":42,"tag":117,"props":4790,"children":4791},{},[4792,4808],{"type":42,"tag":121,"props":4793,"children":4794},{},[4795],{"type":42,"tag":125,"props":4796,"children":4797},{},[4798,4803],{"type":42,"tag":129,"props":4799,"children":4800},{},[4801],{"type":47,"value":4802},"Skill",{"type":42,"tag":129,"props":4804,"children":4805},{},[4806],{"type":47,"value":4807},"How It Applies",{"type":42,"tag":140,"props":4809,"children":4810},{},[4811,4826,4842,4865],{"type":42,"tag":125,"props":4812,"children":4813},{},[4814,4821],{"type":42,"tag":147,"props":4815,"children":4816},{},[4817],{"type":42,"tag":76,"props":4818,"children":4819},{},[4820],{"type":47,"value":3493},{"type":42,"tag":147,"props":4822,"children":4823},{},[4824],{"type":47,"value":4825},"Uses SanitizerCoverage for feedback; coverage analysis evaluates harness effectiveness",{"type":42,"tag":125,"props":4827,"children":4828},{},[4829,4837],{"type":42,"tag":147,"props":4830,"children":4831},{},[4832],{"type":42,"tag":76,"props":4833,"children":4834},{},[4835],{"type":47,"value":4836},"aflpp",{"type":42,"tag":147,"props":4838,"children":4839},{},[4840],{"type":47,"value":4841},"Uses edge coverage for feedback; detailed analysis requires separate instrumentation",{"type":42,"tag":125,"props":4843,"children":4844},{},[4845,4853],{"type":42,"tag":147,"props":4846,"children":4847},{},[4848],{"type":42,"tag":76,"props":4849,"children":4850},{},[4851],{"type":47,"value":4852},"cargo-fuzz",{"type":42,"tag":147,"props":4854,"children":4855},{},[4856,4858,4863],{"type":47,"value":4857},"Built-in ",{"type":42,"tag":343,"props":4859,"children":4861},{"className":4860},[],[4862],{"type":47,"value":1418},{"type":47,"value":4864}," command for Rust projects",{"type":42,"tag":125,"props":4866,"children":4867},{},[4868,4875],{"type":42,"tag":147,"props":4869,"children":4870},{},[4871],{"type":42,"tag":76,"props":4872,"children":4873},{},[4874],{"type":47,"value":4405},{"type":42,"tag":147,"props":4876,"children":4877},{},[4878],{"type":47,"value":4879},"Uses edge coverage; analyze with standard LLVM\u002FGCC tools",{"type":42,"tag":110,"props":4881,"children":4883},{"id":4882},"related-techniques",[4884],{"type":47,"value":4885},"Related Techniques",{"type":42,"tag":117,"props":4887,"children":4888},{},[4889,4904],{"type":42,"tag":121,"props":4890,"children":4891},{},[4892],{"type":42,"tag":125,"props":4893,"children":4894},{},[4895,4899],{"type":42,"tag":129,"props":4896,"children":4897},{},[4898],{"type":47,"value":4802},{"type":42,"tag":129,"props":4900,"children":4901},{},[4902],{"type":47,"value":4903},"Relationship",{"type":42,"tag":140,"props":4905,"children":4906},{},[4907,4923,4939,4955],{"type":42,"tag":125,"props":4908,"children":4909},{},[4910,4918],{"type":42,"tag":147,"props":4911,"children":4912},{},[4913],{"type":42,"tag":76,"props":4914,"children":4915},{},[4916],{"type":47,"value":4917},"fuzz-harness-writing",{"type":42,"tag":147,"props":4919,"children":4920},{},[4921],{"type":47,"value":4922},"Coverage reveals which code paths harness reaches; guides harness improvements",{"type":42,"tag":125,"props":4924,"children":4925},{},[4926,4934],{"type":42,"tag":147,"props":4927,"children":4928},{},[4929],{"type":42,"tag":76,"props":4930,"children":4931},{},[4932],{"type":47,"value":4933},"fuzzing-dictionaries",{"type":42,"tag":147,"props":4935,"children":4936},{},[4937],{"type":47,"value":4938},"Coverage identifies magic value checks that need dictionary entries",{"type":42,"tag":125,"props":4940,"children":4941},{},[4942,4950],{"type":42,"tag":147,"props":4943,"children":4944},{},[4945],{"type":42,"tag":76,"props":4946,"children":4947},{},[4948],{"type":47,"value":4949},"corpus-management",{"type":42,"tag":147,"props":4951,"children":4952},{},[4953],{"type":47,"value":4954},"Coverage analysis helps curate corpora by identifying redundant test cases",{"type":42,"tag":125,"props":4956,"children":4957},{},[4958,4966],{"type":42,"tag":147,"props":4959,"children":4960},{},[4961],{"type":42,"tag":76,"props":4962,"children":4963},{},[4964],{"type":47,"value":4965},"sanitizers",{"type":42,"tag":147,"props":4967,"children":4968},{},[4969],{"type":47,"value":4970},"Coverage helps verify sanitizer-instrumented code is actually executed",{"type":42,"tag":56,"props":4972,"children":4974},{"id":4973},"resources",[4975],{"type":47,"value":4976},"Resources",{"type":42,"tag":110,"props":4978,"children":4980},{"id":4979},"key-external-resources",[4981],{"type":47,"value":4982},"Key External Resources",{"type":42,"tag":50,"props":4984,"children":4985},{},[4986,4996],{"type":42,"tag":76,"props":4987,"children":4988},{},[4989],{"type":42,"tag":99,"props":4990,"children":4993},{"href":4991,"rel":4992},"https:\u002F\u002Fclang.llvm.org\u002Fdocs\u002FSourceBasedCodeCoverage.html",[103],[4994],{"type":47,"value":4995},"LLVM Source-Based Code Coverage",{"type":47,"value":4997},"\nComprehensive guide to LLVM's profile instrumentation, including advanced features like branch coverage, region coverage, and integration with existing build systems. Covers compiler flags, runtime behavior, and profile data formats.",{"type":42,"tag":50,"props":4999,"children":5000},{},[5001,5011,5013,5019,5021,5027,5029,5035],{"type":42,"tag":76,"props":5002,"children":5003},{},[5004],{"type":42,"tag":99,"props":5005,"children":5008},{"href":5006,"rel":5007},"https:\u002F\u002Fllvm.org\u002Fdocs\u002FCommandGuide\u002Fllvm-cov.html",[103],[5009],{"type":47,"value":5010},"llvm-cov Command Guide",{"type":47,"value":5012},"\nDetailed CLI reference for llvm-cov commands including ",{"type":42,"tag":343,"props":5014,"children":5016},{"className":5015},[],[5017],{"type":47,"value":5018},"show",{"type":47,"value":5020},", ",{"type":42,"tag":343,"props":5022,"children":5024},{"className":5023},[],[5025],{"type":47,"value":5026},"report",{"type":47,"value":5028},", and ",{"type":42,"tag":343,"props":5030,"children":5032},{"className":5031},[],[5033],{"type":47,"value":5034},"export",{"type":47,"value":5036},". Documents all filtering options, output formats, and integration with llvm-profdata.",{"type":42,"tag":50,"props":5038,"children":5039},{},[5040,5050],{"type":42,"tag":76,"props":5041,"children":5042},{},[5043],{"type":42,"tag":99,"props":5044,"children":5047},{"href":5045,"rel":5046},"https:\u002F\u002Fgcovr.com\u002F",[103],[5048],{"type":47,"value":5049},"gcovr Documentation",{"type":47,"value":5051},"\nComplete guide to gcovr tool for generating coverage reports from gcov data. Covers HTML themes, filtering options, multi-directory projects, and CI\u002FCD integration patterns.",{"type":42,"tag":50,"props":5053,"children":5054},{},[5055,5065],{"type":42,"tag":76,"props":5056,"children":5057},{},[5058],{"type":42,"tag":99,"props":5059,"children":5062},{"href":5060,"rel":5061},"https:\u002F\u002Fclang.llvm.org\u002Fdocs\u002FSanitizerCoverage.html",[103],[5063],{"type":47,"value":5064},"SanitizerCoverage Documentation",{"type":47,"value":5066},"\nLow-level documentation for LLVM's SanitizerCoverage instrumentation. Explains inline 8-bit counters, PC tables, and how fuzzers use coverage feedback for guidance.",{"type":42,"tag":50,"props":5068,"children":5069},{},[5070,5079],{"type":42,"tag":76,"props":5071,"children":5072},{},[5073],{"type":42,"tag":99,"props":5074,"children":5076},{"href":101,"rel":5075},[103],[5077],{"type":47,"value":5078},"On the Evaluation of Fuzzer Performance",{"type":47,"value":5080},"\nResearch paper examining limitations of coverage as a fuzzing performance metric. Argues for more nuanced evaluation methods beyond simple code coverage percentages.",{"type":42,"tag":110,"props":5082,"children":5084},{"id":5083},"video-resources",[5085],{"type":47,"value":5086},"Video Resources",{"type":42,"tag":50,"props":5088,"children":5089},{},[5090],{"type":47,"value":5091},"Not applicable - coverage analysis is primarily a tooling and workflow topic best learned through documentation and hands-on practice.",{"type":42,"tag":5093,"props":5094,"children":5095},"style",{},[5096],{"type":47,"value":5097},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":5099,"total":5192},[5100,5115,5124,5142,5157,5170,5182],{"slug":5101,"name":5101,"fn":5102,"description":5103,"org":5104,"tags":5105,"stars":23,"repoUrl":24,"updatedAt":5114},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5106,5109,5112,5113],{"name":5107,"slug":5108,"type":16},"C#","c",{"name":5110,"slug":5111,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:14.925095",{"slug":4836,"name":4836,"fn":5116,"description":5117,"org":5118,"tags":5119,"stars":23,"repoUrl":24,"updatedAt":5123},"perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5120,5121,5122],{"name":5107,"slug":5108,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:12.433192",{"slug":5125,"name":5125,"fn":5126,"description":5127,"org":5128,"tags":5129,"stars":23,"repoUrl":24,"updatedAt":5141},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5130,5133,5136,5137,5140],{"name":5131,"slug":5132,"type":16},"Agents","agents",{"name":5134,"slug":5135,"type":16},"CI\u002FCD","ci-cd",{"name":18,"slug":19,"type":16},{"name":5138,"slug":5139,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":5143,"name":5143,"fn":5144,"description":5145,"org":5146,"tags":5147,"stars":23,"repoUrl":24,"updatedAt":5156},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5148,5151,5152,5153],{"name":5149,"slug":5150,"type":16},"Audit","audit",{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":5154,"slug":5155,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":5158,"name":5158,"fn":5159,"description":5160,"org":5161,"tags":5162,"stars":23,"repoUrl":24,"updatedAt":5169},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5163,5166],{"name":5164,"slug":5165,"type":16},"Engineering","engineering",{"name":5167,"slug":5168,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":5171,"name":5171,"fn":5172,"description":5173,"org":5174,"tags":5175,"stars":23,"repoUrl":24,"updatedAt":5181},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5176,5179,5180],{"name":5177,"slug":5178,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:14.575191",{"slug":5183,"name":5183,"fn":5184,"description":5185,"org":5186,"tags":5187,"stars":23,"repoUrl":24,"updatedAt":5191},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5188,5189,5190],{"name":5149,"slug":5150,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",77,{"items":5194,"total":5298},[5195,5202,5208,5216,5223,5228,5234,5240,5253,5264,5276,5287],{"slug":5101,"name":5101,"fn":5102,"description":5103,"org":5196,"tags":5197,"stars":23,"repoUrl":24,"updatedAt":5114},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5198,5199,5200,5201],{"name":5107,"slug":5108,"type":16},{"name":5110,"slug":5111,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":4836,"name":4836,"fn":5116,"description":5117,"org":5203,"tags":5204,"stars":23,"repoUrl":24,"updatedAt":5123},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5205,5206,5207],{"name":5107,"slug":5108,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":5125,"name":5125,"fn":5126,"description":5127,"org":5209,"tags":5210,"stars":23,"repoUrl":24,"updatedAt":5141},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5211,5212,5213,5214,5215],{"name":5131,"slug":5132,"type":16},{"name":5134,"slug":5135,"type":16},{"name":18,"slug":19,"type":16},{"name":5138,"slug":5139,"type":16},{"name":14,"slug":15,"type":16},{"slug":5143,"name":5143,"fn":5144,"description":5145,"org":5217,"tags":5218,"stars":23,"repoUrl":24,"updatedAt":5156},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5219,5220,5221,5222],{"name":5149,"slug":5150,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":5154,"slug":5155,"type":16},{"slug":5158,"name":5158,"fn":5159,"description":5160,"org":5224,"tags":5225,"stars":23,"repoUrl":24,"updatedAt":5169},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5226,5227],{"name":5164,"slug":5165,"type":16},{"name":5167,"slug":5168,"type":16},{"slug":5171,"name":5171,"fn":5172,"description":5173,"org":5229,"tags":5230,"stars":23,"repoUrl":24,"updatedAt":5181},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5231,5232,5233],{"name":5177,"slug":5178,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":5183,"name":5183,"fn":5184,"description":5185,"org":5235,"tags":5236,"stars":23,"repoUrl":24,"updatedAt":5191},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5237,5238,5239],{"name":5149,"slug":5150,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"slug":5241,"name":5241,"fn":5242,"description":5243,"org":5244,"tags":5245,"stars":23,"repoUrl":24,"updatedAt":5252},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5246,5249,5250,5251],{"name":5247,"slug":5248,"type":16},"Architecture","architecture",{"name":5149,"slug":5150,"type":16},{"name":18,"slug":19,"type":16},{"name":5164,"slug":5165,"type":16},"2026-07-18T05:47:40.122449",{"slug":5254,"name":5254,"fn":5255,"description":5256,"org":5257,"tags":5258,"stars":23,"repoUrl":24,"updatedAt":5263},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5259,5260,5261,5262],{"name":5149,"slug":5150,"type":16},{"name":18,"slug":19,"type":16},{"name":5164,"slug":5165,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":5265,"name":5265,"fn":5266,"description":5267,"org":5268,"tags":5269,"stars":23,"repoUrl":24,"updatedAt":5275},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5270,5271,5274],{"name":5149,"slug":5150,"type":16},{"name":5272,"slug":5273,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":5277,"name":5277,"fn":5278,"description":5279,"org":5280,"tags":5281,"stars":23,"repoUrl":24,"updatedAt":5286},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5282,5283,5284,5285],{"name":5149,"slug":5150,"type":16},{"name":5107,"slug":5108,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":5288,"name":5288,"fn":5289,"description":5290,"org":5291,"tags":5292,"stars":23,"repoUrl":24,"updatedAt":5297},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5293,5294,5295,5296],{"name":5149,"slug":5150,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":5154,"slug":5155,"type":16},"2026-07-18T05:47:42.84568",111]