[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-fuzzing-obstacles":3,"mdc-3cqhbg-key":35,"related-repo-trail-of-bits-fuzzing-obstacles":3012,"related-org-trail-of-bits-fuzzing-obstacles":3107},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":30,"sourceUrl":33,"mdContent":34},"fuzzing-obstacles","patch code to overcome fuzzing obstacles","Techniques for patching code to overcome fuzzing obstacles. Use when checksums, global state, or other barriers block fuzzer progress.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Engineering","engineering",{"name":21,"slug":22,"type":16},"Testing","testing",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-17T06:05:23.180169",null,541,[29],"agent-skills",{"repoUrl":24,"stars":23,"forks":27,"topics":31,"description":32},[29],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Ftesting-handbook-skills\u002Fskills\u002Ffuzzing-obstacles","---\nname: fuzzing-obstacles\ntype: technique\ndescription: >\n  Techniques for patching code to overcome fuzzing obstacles.\n  Use when checksums, global state, or other barriers block fuzzer progress.\n---\n\n# Overcoming Fuzzing Obstacles\n\nCodebases often contain anti-fuzzing patterns that prevent effective coverage. Checksums, global state (like time-seeded PRNGs), and validation checks can block the fuzzer from exploring deeper code paths. This technique shows how to patch your System Under Test (SUT) to bypass these obstacles during fuzzing while preserving production behavior.\n\n## Overview\n\nMany real-world programs were not designed with fuzzing in mind. They may:\n- Verify checksums or cryptographic hashes before processing input\n- Rely on global state (e.g., system time, environment variables)\n- Use non-deterministic random number generators\n- Perform complex validation that makes it difficult for the fuzzer to generate valid inputs\n\nThese patterns make fuzzing difficult because:\n1. **Checksums:** The fuzzer must guess correct hash values (astronomically unlikely)\n2. **Global state:** Same input produces different behavior across runs (breaks determinism)\n3. **Complex validation:** The fuzzer spends effort hitting validation failures instead of exploring deeper code\n\nThe solution is conditional compilation: modify code behavior during fuzzing builds while keeping production code unchanged.\n\n### Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| SUT Patching | Modifying System Under Test to be fuzzing-friendly |\n| Conditional Compilation | Code that behaves differently based on compile-time flags |\n| Fuzzing Build Mode | Special build configuration that enables fuzzing-specific patches |\n| False Positives | Crashes found during fuzzing that cannot occur in production |\n| Determinism | Same input always produces same behavior (critical for fuzzing) |\n\n## When to Apply\n\n**Apply this technique when:**\n- The fuzzer gets stuck at checksum or hash verification\n- Coverage reports show large blocks of unreachable code behind validation\n- Code uses time-based seeds or other non-deterministic global state\n- Complex validation makes it nearly impossible to generate valid inputs\n- You see the fuzzer repeatedly hitting the same validation failures\n\n**Skip this technique when:**\n- The obstacle can be overcome with a good seed corpus or dictionary\n- The validation is simple enough for the fuzzer to learn (e.g., magic bytes)\n- You're doing grammar-based or structure-aware fuzzing that handles validation\n- Skipping the check would introduce too many false positives\n- The code is already fuzzing-friendly\n\n## Quick Reference\n\n| Task | C\u002FC++ | Rust |\n|------|-------|------|\n| Check if fuzzing build | `#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` | `cfg!(fuzzing)` |\n| Skip check during fuzzing | `#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION return -1; #endif` | `if !cfg!(fuzzing) { return Err(...) }` |\n| Common obstacles | Checksums, PRNGs, time-based logic | Checksums, PRNGs, time-based logic |\n| Supported fuzzers | libFuzzer, AFL++, LibAFL, honggfuzz | cargo-fuzz, libFuzzer |\n\n## Step-by-Step\n\n### Step 1: Identify the Obstacle\n\nRun the fuzzer and analyze coverage to find code that's unreachable. Common patterns:\n\n1. Look for checksum\u002Fhash verification before deeper processing\n2. Check for calls to `rand()`, `time()`, or `srand()` with system seeds\n3. Find validation functions that reject most inputs\n4. Identify global state initialization that differs across runs\n\n**Tools to help:**\n- Coverage reports (see coverage-analysis technique)\n- Profiling with `-fprofile-instr-generate`\n- Manual code inspection of entry points\n\n### Step 2: Add Conditional Compilation\n\nModify the obstacle to bypass it during fuzzing builds.\n\n**C\u002FC++ Example:**\n\n```c++\n\u002F\u002F Before: Hard obstacle\nif (checksum != expected_hash) {\n    return -1;  \u002F\u002F Fuzzer never gets past here\n}\n\n\u002F\u002F After: Conditional bypass\nif (checksum != expected_hash) {\n#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION\n    return -1;  \u002F\u002F Only enforced in production\n#endif\n}\n\u002F\u002F Fuzzer can now explore code beyond this check\n```\n\n**Rust Example:**\n\n```rust\n\u002F\u002F Before: Hard obstacle\nif checksum != expected_hash {\n    return Err(MyError::Hash);  \u002F\u002F Fuzzer never gets past here\n}\n\n\u002F\u002F After: Conditional bypass\nif checksum != expected_hash {\n    if !cfg!(fuzzing) {\n        return Err(MyError::Hash);  \u002F\u002F Only enforced in production\n    }\n}\n\u002F\u002F Fuzzer can now explore code beyond this check\n```\n\n### Step 3: Verify Coverage Improvement\n\nAfter patching:\n\n1. Rebuild with fuzzing instrumentation\n2. Run the fuzzer for a short time\n3. Compare coverage to the unpatched version\n4. Confirm new code paths are being explored\n\n### Step 4: Assess False Positive Risk\n\nConsider whether skipping the check introduces impossible program states:\n\n- Does code after the check assume validated properties?\n- Could skipping validation cause crashes that cannot occur in production?\n- Is there implicit state dependency?\n\nIf false positives are likely, consider a more targeted patch (see Common Patterns below).\n\n## Common Patterns\n\n### Pattern: Bypass Checksum Validation\n\n**Use Case:** Hash\u002Fchecksum blocks all fuzzer progress\n\n**Before:**\n```c++\nuint32_t computed = hash_function(data, size);\nif (computed != expected_checksum) {\n    return ERROR_INVALID_HASH;\n}\nprocess_data(data, size);\n```\n\n**After:**\n```c++\nuint32_t computed = hash_function(data, size);\nif (computed != expected_checksum) {\n#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION\n    return ERROR_INVALID_HASH;\n#endif\n}\nprocess_data(data, size);\n```\n\n**False positive risk:** LOW - If data processing doesn't depend on checksum correctness\n\n### Pattern: Deterministic PRNG Seeding\n\n**Use Case:** Non-deterministic random state prevents reproducibility\n\n**Before:**\n```c++\nvoid initialize() {\n    srand(time(NULL));  \u002F\u002F Different seed each run\n}\n```\n\n**After:**\n```c++\nvoid initialize() {\n#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION\n    srand(12345);  \u002F\u002F Fixed seed for fuzzing\n#else\n    srand(time(NULL));\n#endif\n}\n```\n\n**False positive risk:** LOW - Fuzzer can explore all code paths with fixed seed\n\n### Pattern: Careful Validation Skip\n\n**Use Case:** Validation must be skipped but downstream code has assumptions\n\n**Before (Dangerous):**\n```c++\n#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION\nif (!validate_config(&config)) {\n    return -1;  \u002F\u002F Ensures config.x != 0\n}\n#endif\n\nint32_t result = 100 \u002F config.x;  \u002F\u002F CRASH: Division by zero in fuzzing!\n```\n\n**After (Safe):**\n```c++\n#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION\nif (!validate_config(&config)) {\n    return -1;\n}\n#else\n\u002F\u002F During fuzzing, use safe defaults for failed validation\nif (!validate_config(&config)) {\n    config.x = 1;  \u002F\u002F Prevent division by zero\n    config.y = 1;\n}\n#endif\n\nint32_t result = 100 \u002F config.x;  \u002F\u002F Safe in both builds\n```\n\n**False positive risk:** MITIGATED - Provides safe defaults instead of skipping\n\n### Pattern: Bypass Complex Format Validation\n\n**Use Case:** Multi-step validation makes valid input generation nearly impossible\n\n**Rust Example:**\n\n```rust\n\u002F\u002F Before: Multiple validation stages\npub fn parse_message(data: &[u8]) -> Result\u003CMessage, Error> {\n    validate_magic_bytes(data)?;\n    validate_structure(data)?;\n    validate_checksums(data)?;\n    validate_crypto_signature(data)?;\n\n    deserialize_message(data)\n}\n\n\u002F\u002F After: Skip expensive validation during fuzzing\npub fn parse_message(data: &[u8]) -> Result\u003CMessage, Error> {\n    validate_magic_bytes(data)?;  \u002F\u002F Keep cheap checks\n\n    if !cfg!(fuzzing) {\n        validate_structure(data)?;\n        validate_checksums(data)?;\n        validate_crypto_signature(data)?;\n    }\n\n    deserialize_message(data)\n}\n```\n\n**False positive risk:** MEDIUM - Deserialization must handle malformed data gracefully\n\n## Advanced Usage\n\n### Tips and Tricks\n\n| Tip | Why It Helps |\n|-----|--------------|\n| Keep cheap validation | Magic bytes and size checks guide fuzzer without much cost |\n| Use fixed seeds for PRNGs | Makes behavior deterministic while exploring all code paths |\n| Patch incrementally | Skip one obstacle at a time and measure coverage impact |\n| Add defensive defaults | When skipping validation, provide safe fallback values |\n| Document all patches | Future maintainers need to understand fuzzing vs. production differences |\n\n### Real-World Examples\n\n**OpenSSL:** Uses `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` to modify cryptographic algorithm behavior. For example, in [crypto\u002Fcmp\u002Fcmp_vfy.c](https:\u002F\u002Fgithub.com\u002Fopenssl\u002Fopenssl\u002Fblob\u002Fafb19f07aecc84998eeea56c4d65f5e0499abb5a\u002Fcrypto\u002Fcmp\u002Fcmp_vfy.c#L665-L678), certain signature checks are relaxed during fuzzing to allow deeper exploration of certificate validation logic.\n\n**ogg crate (Rust):** Uses `cfg!(fuzzing)` to [skip checksum verification](https:\u002F\u002Fgithub.com\u002FRustAudio\u002Fogg\u002Fblob\u002F5ee8316e6e907c24f6d7ec4b3a0ed6a6ce854cc1\u002Fsrc\u002Freading.rs#L298-L300) during fuzzing. This allows the fuzzer to explore audio processing code without spending effort guessing correct checksums.\n\n### Measuring Patch Effectiveness\n\nAfter applying patches, quantify the improvement:\n\n1. **Line coverage:** Use `llvm-cov` or `cargo-cov` to see new reachable lines\n2. **Basic block coverage:** More fine-grained than line coverage\n3. **Function coverage:** How many more functions are now reachable?\n4. **Corpus size:** Does the fuzzer generate more diverse inputs?\n\nEffective patches typically increase coverage by 10-50% or more.\n\n### Combining with Other Techniques\n\nObstacle patching works well with:\n- **Corpus seeding:** Provide valid inputs that get past initial parsing\n- **Dictionaries:** Help fuzzer learn magic bytes and common values\n- **Structure-aware fuzzing:** Use protobuf or grammar definitions for complex formats\n- **Harness improvements:** Better harness can sometimes avoid obstacles entirely\n\n## Anti-Patterns\n\n| Anti-Pattern | Problem | Correct Approach |\n|--------------|---------|------------------|\n| Skip all validation wholesale | Creates false positives and unstable fuzzing | Skip only specific obstacles that block coverage |\n| No risk assessment | False positives waste time and hide real bugs | Analyze downstream code for assumptions |\n| Forget to document patches | Future maintainers don't understand the differences | Add comments explaining why patch is safe |\n| Patch without measuring | Don't know if it helped | Compare coverage before and after |\n| Over-patching | Makes fuzzing build diverge too much from production | Minimize differences between builds |\n\n## Tool-Specific Guidance\n\n### libFuzzer\n\nlibFuzzer automatically defines `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` during compilation.\n\n```bash\n# C++ compilation\nclang++ -g -fsanitize=fuzzer,address -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \\\n    harness.cc target.cc -o fuzzer\n\n# The macro is usually defined automatically by -fsanitize=fuzzer\nclang++ -g -fsanitize=fuzzer,address harness.cc target.cc -o fuzzer\n```\n\n**Integration tips:**\n- The macro is defined automatically; manual definition is usually unnecessary\n- Use `#ifdef` to check for the macro\n- Combine with sanitizers to detect bugs in newly reachable code\n\n### AFL++\n\nAFL++ also defines `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` when using its compiler wrappers.\n\n```bash\n# Compilation with AFL++ wrappers\nafl-clang-fast++ -g -fsanitize=address target.cc harness.cc -o fuzzer\n\n# The macro is defined automatically by afl-clang-fast\n```\n\n**Integration tips:**\n- Use `afl-clang-fast` or `afl-clang-lto` for automatic macro definition\n- Persistent mode harnesses benefit most from obstacle patching\n- Consider using `AFL_LLVM_LAF_ALL` for additional input-to-state transformations\n\n### honggfuzz\n\nhonggfuzz also supports the macro when building targets.\n\n```bash\n# Compilation\nhfuzz-clang++ -g -fsanitize=address target.cc harness.cc -o fuzzer\n```\n\n**Integration tips:**\n- Use `hfuzz-clang` or `hfuzz-clang++` wrappers\n- The macro is available for conditional compilation\n- Combine with honggfuzz's feedback-driven fuzzing\n\n### cargo-fuzz (Rust)\n\ncargo-fuzz automatically sets the `fuzzing` cfg option during builds.\n\n```bash\n# Build fuzz target (cfg!(fuzzing) is automatically set)\ncargo fuzz build fuzz_target_name\n\n# Run fuzz target\ncargo fuzz run fuzz_target_name\n```\n\n**Integration tips:**\n- Use `cfg!(fuzzing)` for runtime checks in production builds\n- Use `#[cfg(fuzzing)]` for compile-time conditional compilation\n- The fuzzing cfg is only set during `cargo fuzz` builds, not regular `cargo build`\n- Can be manually enabled with `RUSTFLAGS=\"--cfg fuzzing\"` for testing\n\n### LibAFL\n\nLibAFL supports the C\u002FC++ macro for targets written in C\u002FC++.\n\n```bash\n# Compilation\nclang++ -g -fsanitize=address -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \\\n    target.cc -c -o target.o\n```\n\n**Integration tips:**\n- Define the macro manually or use compiler flags\n- Works the same as with libFuzzer\n- Useful when building custom LibAFL-based fuzzers\n\n## Troubleshooting\n\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| Coverage doesn't improve after patching | Wrong obstacle identified | Profile execution to find actual bottleneck |\n| Many false positive crashes | Downstream code has assumptions | Add defensive defaults or partial validation |\n| Code compiles differently | Macro not defined in all build configs | Verify macro in all source files and dependencies |\n| Fuzzer finds bugs in patched code | Patch introduced invalid states | Review patch for state invariants; consider safer approach |\n| Can't reproduce production bugs | Build differences too large | Minimize patches; keep validation for state-critical checks |\n\n## Related Skills\n\n### Tools That Use This Technique\n\n| Skill | How It Applies |\n|-------|----------------|\n| **libfuzzer** | Defines `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` automatically |\n| **aflpp** | Supports the macro via compiler wrappers |\n| **honggfuzz** | Uses the macro for conditional compilation |\n| **cargo-fuzz** | Sets `cfg!(fuzzing)` for Rust conditional compilation |\n\n### Related Techniques\n\n| Skill | Relationship |\n|-------|--------------|\n| **fuzz-harness-writing** | Better harnesses may avoid obstacles; patching enables deeper exploration |\n| **coverage-analysis** | Use coverage to identify obstacles and measure patch effectiveness |\n| **corpus-seeding** | Seed corpus can help overcome obstacles without patching |\n| **dictionary-generation** | Dictionaries help with magic bytes but not checksums or complex validation |\n\n## Resources\n\n### Key External Resources\n\n**[OpenSSL Fuzzing Documentation](https:\u002F\u002Fgithub.com\u002Fopenssl\u002Fopenssl\u002Ftree\u002Fmaster\u002Ffuzz)**\nOpenSSL's fuzzing infrastructure demonstrates large-scale use of `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION`. The project uses this macro to modify cryptographic validation, certificate parsing, and other security-critical code paths to enable deeper fuzzing while maintaining production correctness.\n\n**[LibFuzzer Documentation on Flags](https:\u002F\u002Fllvm.org\u002Fdocs\u002FLibFuzzer.html)**\nOfficial LLVM documentation for libFuzzer, including how the fuzzer defines compiler macros and how to use them effectively. Covers integration with sanitizers and coverage instrumentation.\n\n**[Rust cfg Attribute Reference](https:\u002F\u002Fdoc.rust-lang.org\u002Freference\u002Fconditional-compilation.html)**\nComplete reference for Rust conditional compilation, including `cfg!(fuzzing)` and `cfg!(test)`. Explains compile-time vs. runtime conditional compilation and best practices.\n",{"data":36,"body":38},{"name":4,"type":37,"description":6},"technique",{"type":39,"children":40},"root",[41,50,56,63,68,93,98,133,138,145,238,244,252,280,288,316,322,437,443,449,454,501,509,533,539,544,552,672,680,778,784,789,812,818,823,841,846,852,858,868,876,922,930,986,996,1002,1011,1018,1048,1055,1115,1124,1130,1139,1147,1206,1214,1318,1327,1333,1342,1349,1531,1540,1546,1552,1639,1645,1674,1699,1705,1710,1769,1774,1780,1785,1828,1834,1951,1957,1963,1975,2094,2102,2128,2134,2146,2209,2216,2256,2261,2266,2313,2320,2351,2357,2370,2443,2450,2508,2514,2519,2578,2585,2603,2609,2726,2732,2738,2836,2842,2927,2933,2939,2961,2976,3006],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"overcoming-fuzzing-obstacles",[47],{"type":48,"value":49},"text","Overcoming Fuzzing Obstacles",{"type":42,"tag":51,"props":52,"children":53},"p",{},[54],{"type":48,"value":55},"Codebases often contain anti-fuzzing patterns that prevent effective coverage. Checksums, global state (like time-seeded PRNGs), and validation checks can block the fuzzer from exploring deeper code paths. This technique shows how to patch your System Under Test (SUT) to bypass these obstacles during fuzzing while preserving production behavior.",{"type":42,"tag":57,"props":58,"children":60},"h2",{"id":59},"overview",[61],{"type":48,"value":62},"Overview",{"type":42,"tag":51,"props":64,"children":65},{},[66],{"type":48,"value":67},"Many real-world programs were not designed with fuzzing in mind. They may:",{"type":42,"tag":69,"props":70,"children":71},"ul",{},[72,78,83,88],{"type":42,"tag":73,"props":74,"children":75},"li",{},[76],{"type":48,"value":77},"Verify checksums or cryptographic hashes before processing input",{"type":42,"tag":73,"props":79,"children":80},{},[81],{"type":48,"value":82},"Rely on global state (e.g., system time, environment variables)",{"type":42,"tag":73,"props":84,"children":85},{},[86],{"type":48,"value":87},"Use non-deterministic random number generators",{"type":42,"tag":73,"props":89,"children":90},{},[91],{"type":48,"value":92},"Perform complex validation that makes it difficult for the fuzzer to generate valid inputs",{"type":42,"tag":51,"props":94,"children":95},{},[96],{"type":48,"value":97},"These patterns make fuzzing difficult because:",{"type":42,"tag":99,"props":100,"children":101},"ol",{},[102,113,123],{"type":42,"tag":73,"props":103,"children":104},{},[105,111],{"type":42,"tag":106,"props":107,"children":108},"strong",{},[109],{"type":48,"value":110},"Checksums:",{"type":48,"value":112}," The fuzzer must guess correct hash values (astronomically unlikely)",{"type":42,"tag":73,"props":114,"children":115},{},[116,121],{"type":42,"tag":106,"props":117,"children":118},{},[119],{"type":48,"value":120},"Global state:",{"type":48,"value":122}," Same input produces different behavior across runs (breaks determinism)",{"type":42,"tag":73,"props":124,"children":125},{},[126,131],{"type":42,"tag":106,"props":127,"children":128},{},[129],{"type":48,"value":130},"Complex validation:",{"type":48,"value":132}," The fuzzer spends effort hitting validation failures instead of exploring deeper code",{"type":42,"tag":51,"props":134,"children":135},{},[136],{"type":48,"value":137},"The solution is conditional compilation: modify code behavior during fuzzing builds while keeping production code unchanged.",{"type":42,"tag":139,"props":140,"children":142},"h3",{"id":141},"key-concepts",[143],{"type":48,"value":144},"Key Concepts",{"type":42,"tag":146,"props":147,"children":148},"table",{},[149,168],{"type":42,"tag":150,"props":151,"children":152},"thead",{},[153],{"type":42,"tag":154,"props":155,"children":156},"tr",{},[157,163],{"type":42,"tag":158,"props":159,"children":160},"th",{},[161],{"type":48,"value":162},"Concept",{"type":42,"tag":158,"props":164,"children":165},{},[166],{"type":48,"value":167},"Description",{"type":42,"tag":169,"props":170,"children":171},"tbody",{},[172,186,199,212,225],{"type":42,"tag":154,"props":173,"children":174},{},[175,181],{"type":42,"tag":176,"props":177,"children":178},"td",{},[179],{"type":48,"value":180},"SUT Patching",{"type":42,"tag":176,"props":182,"children":183},{},[184],{"type":48,"value":185},"Modifying System Under Test to be fuzzing-friendly",{"type":42,"tag":154,"props":187,"children":188},{},[189,194],{"type":42,"tag":176,"props":190,"children":191},{},[192],{"type":48,"value":193},"Conditional Compilation",{"type":42,"tag":176,"props":195,"children":196},{},[197],{"type":48,"value":198},"Code that behaves differently based on compile-time flags",{"type":42,"tag":154,"props":200,"children":201},{},[202,207],{"type":42,"tag":176,"props":203,"children":204},{},[205],{"type":48,"value":206},"Fuzzing Build Mode",{"type":42,"tag":176,"props":208,"children":209},{},[210],{"type":48,"value":211},"Special build configuration that enables fuzzing-specific patches",{"type":42,"tag":154,"props":213,"children":214},{},[215,220],{"type":42,"tag":176,"props":216,"children":217},{},[218],{"type":48,"value":219},"False Positives",{"type":42,"tag":176,"props":221,"children":222},{},[223],{"type":48,"value":224},"Crashes found during fuzzing that cannot occur in production",{"type":42,"tag":154,"props":226,"children":227},{},[228,233],{"type":42,"tag":176,"props":229,"children":230},{},[231],{"type":48,"value":232},"Determinism",{"type":42,"tag":176,"props":234,"children":235},{},[236],{"type":48,"value":237},"Same input always produces same behavior (critical for fuzzing)",{"type":42,"tag":57,"props":239,"children":241},{"id":240},"when-to-apply",[242],{"type":48,"value":243},"When to Apply",{"type":42,"tag":51,"props":245,"children":246},{},[247],{"type":42,"tag":106,"props":248,"children":249},{},[250],{"type":48,"value":251},"Apply this technique when:",{"type":42,"tag":69,"props":253,"children":254},{},[255,260,265,270,275],{"type":42,"tag":73,"props":256,"children":257},{},[258],{"type":48,"value":259},"The fuzzer gets stuck at checksum or hash verification",{"type":42,"tag":73,"props":261,"children":262},{},[263],{"type":48,"value":264},"Coverage reports show large blocks of unreachable code behind validation",{"type":42,"tag":73,"props":266,"children":267},{},[268],{"type":48,"value":269},"Code uses time-based seeds or other non-deterministic global state",{"type":42,"tag":73,"props":271,"children":272},{},[273],{"type":48,"value":274},"Complex validation makes it nearly impossible to generate valid inputs",{"type":42,"tag":73,"props":276,"children":277},{},[278],{"type":48,"value":279},"You see the fuzzer repeatedly hitting the same validation failures",{"type":42,"tag":51,"props":281,"children":282},{},[283],{"type":42,"tag":106,"props":284,"children":285},{},[286],{"type":48,"value":287},"Skip this technique when:",{"type":42,"tag":69,"props":289,"children":290},{},[291,296,301,306,311],{"type":42,"tag":73,"props":292,"children":293},{},[294],{"type":48,"value":295},"The obstacle can be overcome with a good seed corpus or dictionary",{"type":42,"tag":73,"props":297,"children":298},{},[299],{"type":48,"value":300},"The validation is simple enough for the fuzzer to learn (e.g., magic bytes)",{"type":42,"tag":73,"props":302,"children":303},{},[304],{"type":48,"value":305},"You're doing grammar-based or structure-aware fuzzing that handles validation",{"type":42,"tag":73,"props":307,"children":308},{},[309],{"type":48,"value":310},"Skipping the check would introduce too many false positives",{"type":42,"tag":73,"props":312,"children":313},{},[314],{"type":48,"value":315},"The code is already fuzzing-friendly",{"type":42,"tag":57,"props":317,"children":319},{"id":318},"quick-reference",[320],{"type":48,"value":321},"Quick Reference",{"type":42,"tag":146,"props":323,"children":324},{},[325,346],{"type":42,"tag":150,"props":326,"children":327},{},[328],{"type":42,"tag":154,"props":329,"children":330},{},[331,336,341],{"type":42,"tag":158,"props":332,"children":333},{},[334],{"type":48,"value":335},"Task",{"type":42,"tag":158,"props":337,"children":338},{},[339],{"type":48,"value":340},"C\u002FC++",{"type":42,"tag":158,"props":342,"children":343},{},[344],{"type":48,"value":345},"Rust",{"type":42,"tag":169,"props":347,"children":348},{},[349,376,402,419],{"type":42,"tag":154,"props":350,"children":351},{},[352,357,367],{"type":42,"tag":176,"props":353,"children":354},{},[355],{"type":48,"value":356},"Check if fuzzing build",{"type":42,"tag":176,"props":358,"children":359},{},[360],{"type":42,"tag":361,"props":362,"children":364},"code",{"className":363},[],[365],{"type":48,"value":366},"#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION",{"type":42,"tag":176,"props":368,"children":369},{},[370],{"type":42,"tag":361,"props":371,"children":373},{"className":372},[],[374],{"type":48,"value":375},"cfg!(fuzzing)",{"type":42,"tag":154,"props":377,"children":378},{},[379,384,393],{"type":42,"tag":176,"props":380,"children":381},{},[382],{"type":48,"value":383},"Skip check during fuzzing",{"type":42,"tag":176,"props":385,"children":386},{},[387],{"type":42,"tag":361,"props":388,"children":390},{"className":389},[],[391],{"type":48,"value":392},"#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION return -1; #endif",{"type":42,"tag":176,"props":394,"children":395},{},[396],{"type":42,"tag":361,"props":397,"children":399},{"className":398},[],[400],{"type":48,"value":401},"if !cfg!(fuzzing) { return Err(...) }",{"type":42,"tag":154,"props":403,"children":404},{},[405,410,415],{"type":42,"tag":176,"props":406,"children":407},{},[408],{"type":48,"value":409},"Common obstacles",{"type":42,"tag":176,"props":411,"children":412},{},[413],{"type":48,"value":414},"Checksums, PRNGs, time-based logic",{"type":42,"tag":176,"props":416,"children":417},{},[418],{"type":48,"value":414},{"type":42,"tag":154,"props":420,"children":421},{},[422,427,432],{"type":42,"tag":176,"props":423,"children":424},{},[425],{"type":48,"value":426},"Supported fuzzers",{"type":42,"tag":176,"props":428,"children":429},{},[430],{"type":48,"value":431},"libFuzzer, AFL++, LibAFL, honggfuzz",{"type":42,"tag":176,"props":433,"children":434},{},[435],{"type":48,"value":436},"cargo-fuzz, libFuzzer",{"type":42,"tag":57,"props":438,"children":440},{"id":439},"step-by-step",[441],{"type":48,"value":442},"Step-by-Step",{"type":42,"tag":139,"props":444,"children":446},{"id":445},"step-1-identify-the-obstacle",[447],{"type":48,"value":448},"Step 1: Identify the Obstacle",{"type":42,"tag":51,"props":450,"children":451},{},[452],{"type":48,"value":453},"Run the fuzzer and analyze coverage to find code that's unreachable. Common patterns:",{"type":42,"tag":99,"props":455,"children":456},{},[457,462,491,496],{"type":42,"tag":73,"props":458,"children":459},{},[460],{"type":48,"value":461},"Look for checksum\u002Fhash verification before deeper processing",{"type":42,"tag":73,"props":463,"children":464},{},[465,467,473,475,481,483,489],{"type":48,"value":466},"Check for calls to ",{"type":42,"tag":361,"props":468,"children":470},{"className":469},[],[471],{"type":48,"value":472},"rand()",{"type":48,"value":474},", ",{"type":42,"tag":361,"props":476,"children":478},{"className":477},[],[479],{"type":48,"value":480},"time()",{"type":48,"value":482},", or ",{"type":42,"tag":361,"props":484,"children":486},{"className":485},[],[487],{"type":48,"value":488},"srand()",{"type":48,"value":490}," with system seeds",{"type":42,"tag":73,"props":492,"children":493},{},[494],{"type":48,"value":495},"Find validation functions that reject most inputs",{"type":42,"tag":73,"props":497,"children":498},{},[499],{"type":48,"value":500},"Identify global state initialization that differs across runs",{"type":42,"tag":51,"props":502,"children":503},{},[504],{"type":42,"tag":106,"props":505,"children":506},{},[507],{"type":48,"value":508},"Tools to help:",{"type":42,"tag":69,"props":510,"children":511},{},[512,517,528],{"type":42,"tag":73,"props":513,"children":514},{},[515],{"type":48,"value":516},"Coverage reports (see coverage-analysis technique)",{"type":42,"tag":73,"props":518,"children":519},{},[520,522],{"type":48,"value":521},"Profiling with ",{"type":42,"tag":361,"props":523,"children":525},{"className":524},[],[526],{"type":48,"value":527},"-fprofile-instr-generate",{"type":42,"tag":73,"props":529,"children":530},{},[531],{"type":48,"value":532},"Manual code inspection of entry points",{"type":42,"tag":139,"props":534,"children":536},{"id":535},"step-2-add-conditional-compilation",[537],{"type":48,"value":538},"Step 2: Add Conditional Compilation",{"type":42,"tag":51,"props":540,"children":541},{},[542],{"type":48,"value":543},"Modify the obstacle to bypass it during fuzzing builds.",{"type":42,"tag":51,"props":545,"children":546},{},[547],{"type":42,"tag":106,"props":548,"children":549},{},[550],{"type":48,"value":551},"C\u002FC++ Example:",{"type":42,"tag":553,"props":554,"children":559},"pre",{"className":555,"code":556,"language":557,"meta":558,"style":558},"language-c++ shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u002F\u002F Before: Hard obstacle\nif (checksum != expected_hash) {\n    return -1;  \u002F\u002F Fuzzer never gets past here\n}\n\n\u002F\u002F After: Conditional bypass\nif (checksum != expected_hash) {\n#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION\n    return -1;  \u002F\u002F Only enforced in production\n#endif\n}\n\u002F\u002F Fuzzer can now explore code beyond this check\n","c++","",[560],{"type":42,"tag":361,"props":561,"children":562},{"__ignoreMap":558},[563,574,583,592,601,611,620,628,637,646,655,663],{"type":42,"tag":564,"props":565,"children":568},"span",{"class":566,"line":567},"line",1,[569],{"type":42,"tag":564,"props":570,"children":571},{},[572],{"type":48,"value":573},"\u002F\u002F Before: Hard obstacle\n",{"type":42,"tag":564,"props":575,"children":577},{"class":566,"line":576},2,[578],{"type":42,"tag":564,"props":579,"children":580},{},[581],{"type":48,"value":582},"if (checksum != expected_hash) {\n",{"type":42,"tag":564,"props":584,"children":586},{"class":566,"line":585},3,[587],{"type":42,"tag":564,"props":588,"children":589},{},[590],{"type":48,"value":591},"    return -1;  \u002F\u002F Fuzzer never gets past here\n",{"type":42,"tag":564,"props":593,"children":595},{"class":566,"line":594},4,[596],{"type":42,"tag":564,"props":597,"children":598},{},[599],{"type":48,"value":600},"}\n",{"type":42,"tag":564,"props":602,"children":604},{"class":566,"line":603},5,[605],{"type":42,"tag":564,"props":606,"children":608},{"emptyLinePlaceholder":607},true,[609],{"type":48,"value":610},"\n",{"type":42,"tag":564,"props":612,"children":614},{"class":566,"line":613},6,[615],{"type":42,"tag":564,"props":616,"children":617},{},[618],{"type":48,"value":619},"\u002F\u002F After: Conditional bypass\n",{"type":42,"tag":564,"props":621,"children":623},{"class":566,"line":622},7,[624],{"type":42,"tag":564,"props":625,"children":626},{},[627],{"type":48,"value":582},{"type":42,"tag":564,"props":629,"children":631},{"class":566,"line":630},8,[632],{"type":42,"tag":564,"props":633,"children":634},{},[635],{"type":48,"value":636},"#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION\n",{"type":42,"tag":564,"props":638,"children":640},{"class":566,"line":639},9,[641],{"type":42,"tag":564,"props":642,"children":643},{},[644],{"type":48,"value":645},"    return -1;  \u002F\u002F Only enforced in production\n",{"type":42,"tag":564,"props":647,"children":649},{"class":566,"line":648},10,[650],{"type":42,"tag":564,"props":651,"children":652},{},[653],{"type":48,"value":654},"#endif\n",{"type":42,"tag":564,"props":656,"children":658},{"class":566,"line":657},11,[659],{"type":42,"tag":564,"props":660,"children":661},{},[662],{"type":48,"value":600},{"type":42,"tag":564,"props":664,"children":666},{"class":566,"line":665},12,[667],{"type":42,"tag":564,"props":668,"children":669},{},[670],{"type":48,"value":671},"\u002F\u002F Fuzzer can now explore code beyond this check\n",{"type":42,"tag":51,"props":673,"children":674},{},[675],{"type":42,"tag":106,"props":676,"children":677},{},[678],{"type":48,"value":679},"Rust Example:",{"type":42,"tag":553,"props":681,"children":685},{"className":682,"code":683,"language":684,"meta":558,"style":558},"language-rust shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u002F\u002F Before: Hard obstacle\nif checksum != expected_hash {\n    return Err(MyError::Hash);  \u002F\u002F Fuzzer never gets past here\n}\n\n\u002F\u002F After: Conditional bypass\nif checksum != expected_hash {\n    if !cfg!(fuzzing) {\n        return Err(MyError::Hash);  \u002F\u002F Only enforced in production\n    }\n}\n\u002F\u002F Fuzzer can now explore code beyond this check\n","rust",[686],{"type":42,"tag":361,"props":687,"children":688},{"__ignoreMap":558},[689,696,704,712,719,726,733,740,748,756,764,771],{"type":42,"tag":564,"props":690,"children":691},{"class":566,"line":567},[692],{"type":42,"tag":564,"props":693,"children":694},{},[695],{"type":48,"value":573},{"type":42,"tag":564,"props":697,"children":698},{"class":566,"line":576},[699],{"type":42,"tag":564,"props":700,"children":701},{},[702],{"type":48,"value":703},"if checksum != expected_hash {\n",{"type":42,"tag":564,"props":705,"children":706},{"class":566,"line":585},[707],{"type":42,"tag":564,"props":708,"children":709},{},[710],{"type":48,"value":711},"    return Err(MyError::Hash);  \u002F\u002F Fuzzer never gets past here\n",{"type":42,"tag":564,"props":713,"children":714},{"class":566,"line":594},[715],{"type":42,"tag":564,"props":716,"children":717},{},[718],{"type":48,"value":600},{"type":42,"tag":564,"props":720,"children":721},{"class":566,"line":603},[722],{"type":42,"tag":564,"props":723,"children":724},{"emptyLinePlaceholder":607},[725],{"type":48,"value":610},{"type":42,"tag":564,"props":727,"children":728},{"class":566,"line":613},[729],{"type":42,"tag":564,"props":730,"children":731},{},[732],{"type":48,"value":619},{"type":42,"tag":564,"props":734,"children":735},{"class":566,"line":622},[736],{"type":42,"tag":564,"props":737,"children":738},{},[739],{"type":48,"value":703},{"type":42,"tag":564,"props":741,"children":742},{"class":566,"line":630},[743],{"type":42,"tag":564,"props":744,"children":745},{},[746],{"type":48,"value":747},"    if !cfg!(fuzzing) {\n",{"type":42,"tag":564,"props":749,"children":750},{"class":566,"line":639},[751],{"type":42,"tag":564,"props":752,"children":753},{},[754],{"type":48,"value":755},"        return Err(MyError::Hash);  \u002F\u002F Only enforced in production\n",{"type":42,"tag":564,"props":757,"children":758},{"class":566,"line":648},[759],{"type":42,"tag":564,"props":760,"children":761},{},[762],{"type":48,"value":763},"    }\n",{"type":42,"tag":564,"props":765,"children":766},{"class":566,"line":657},[767],{"type":42,"tag":564,"props":768,"children":769},{},[770],{"type":48,"value":600},{"type":42,"tag":564,"props":772,"children":773},{"class":566,"line":665},[774],{"type":42,"tag":564,"props":775,"children":776},{},[777],{"type":48,"value":671},{"type":42,"tag":139,"props":779,"children":781},{"id":780},"step-3-verify-coverage-improvement",[782],{"type":48,"value":783},"Step 3: Verify Coverage Improvement",{"type":42,"tag":51,"props":785,"children":786},{},[787],{"type":48,"value":788},"After patching:",{"type":42,"tag":99,"props":790,"children":791},{},[792,797,802,807],{"type":42,"tag":73,"props":793,"children":794},{},[795],{"type":48,"value":796},"Rebuild with fuzzing instrumentation",{"type":42,"tag":73,"props":798,"children":799},{},[800],{"type":48,"value":801},"Run the fuzzer for a short time",{"type":42,"tag":73,"props":803,"children":804},{},[805],{"type":48,"value":806},"Compare coverage to the unpatched version",{"type":42,"tag":73,"props":808,"children":809},{},[810],{"type":48,"value":811},"Confirm new code paths are being explored",{"type":42,"tag":139,"props":813,"children":815},{"id":814},"step-4-assess-false-positive-risk",[816],{"type":48,"value":817},"Step 4: Assess False Positive Risk",{"type":42,"tag":51,"props":819,"children":820},{},[821],{"type":48,"value":822},"Consider whether skipping the check introduces impossible program states:",{"type":42,"tag":69,"props":824,"children":825},{},[826,831,836],{"type":42,"tag":73,"props":827,"children":828},{},[829],{"type":48,"value":830},"Does code after the check assume validated properties?",{"type":42,"tag":73,"props":832,"children":833},{},[834],{"type":48,"value":835},"Could skipping validation cause crashes that cannot occur in production?",{"type":42,"tag":73,"props":837,"children":838},{},[839],{"type":48,"value":840},"Is there implicit state dependency?",{"type":42,"tag":51,"props":842,"children":843},{},[844],{"type":48,"value":845},"If false positives are likely, consider a more targeted patch (see Common Patterns below).",{"type":42,"tag":57,"props":847,"children":849},{"id":848},"common-patterns",[850],{"type":48,"value":851},"Common Patterns",{"type":42,"tag":139,"props":853,"children":855},{"id":854},"pattern-bypass-checksum-validation",[856],{"type":48,"value":857},"Pattern: Bypass Checksum Validation",{"type":42,"tag":51,"props":859,"children":860},{},[861,866],{"type":42,"tag":106,"props":862,"children":863},{},[864],{"type":48,"value":865},"Use Case:",{"type":48,"value":867}," Hash\u002Fchecksum blocks all fuzzer progress",{"type":42,"tag":51,"props":869,"children":870},{},[871],{"type":42,"tag":106,"props":872,"children":873},{},[874],{"type":48,"value":875},"Before:",{"type":42,"tag":553,"props":877,"children":879},{"className":555,"code":878,"language":557,"meta":558,"style":558},"uint32_t computed = hash_function(data, size);\nif (computed != expected_checksum) {\n    return ERROR_INVALID_HASH;\n}\nprocess_data(data, size);\n",[880],{"type":42,"tag":361,"props":881,"children":882},{"__ignoreMap":558},[883,891,899,907,914],{"type":42,"tag":564,"props":884,"children":885},{"class":566,"line":567},[886],{"type":42,"tag":564,"props":887,"children":888},{},[889],{"type":48,"value":890},"uint32_t computed = hash_function(data, size);\n",{"type":42,"tag":564,"props":892,"children":893},{"class":566,"line":576},[894],{"type":42,"tag":564,"props":895,"children":896},{},[897],{"type":48,"value":898},"if (computed != expected_checksum) {\n",{"type":42,"tag":564,"props":900,"children":901},{"class":566,"line":585},[902],{"type":42,"tag":564,"props":903,"children":904},{},[905],{"type":48,"value":906},"    return ERROR_INVALID_HASH;\n",{"type":42,"tag":564,"props":908,"children":909},{"class":566,"line":594},[910],{"type":42,"tag":564,"props":911,"children":912},{},[913],{"type":48,"value":600},{"type":42,"tag":564,"props":915,"children":916},{"class":566,"line":603},[917],{"type":42,"tag":564,"props":918,"children":919},{},[920],{"type":48,"value":921},"process_data(data, size);\n",{"type":42,"tag":51,"props":923,"children":924},{},[925],{"type":42,"tag":106,"props":926,"children":927},{},[928],{"type":48,"value":929},"After:",{"type":42,"tag":553,"props":931,"children":933},{"className":555,"code":932,"language":557,"meta":558,"style":558},"uint32_t computed = hash_function(data, size);\nif (computed != expected_checksum) {\n#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION\n    return ERROR_INVALID_HASH;\n#endif\n}\nprocess_data(data, size);\n",[934],{"type":42,"tag":361,"props":935,"children":936},{"__ignoreMap":558},[937,944,951,958,965,972,979],{"type":42,"tag":564,"props":938,"children":939},{"class":566,"line":567},[940],{"type":42,"tag":564,"props":941,"children":942},{},[943],{"type":48,"value":890},{"type":42,"tag":564,"props":945,"children":946},{"class":566,"line":576},[947],{"type":42,"tag":564,"props":948,"children":949},{},[950],{"type":48,"value":898},{"type":42,"tag":564,"props":952,"children":953},{"class":566,"line":585},[954],{"type":42,"tag":564,"props":955,"children":956},{},[957],{"type":48,"value":636},{"type":42,"tag":564,"props":959,"children":960},{"class":566,"line":594},[961],{"type":42,"tag":564,"props":962,"children":963},{},[964],{"type":48,"value":906},{"type":42,"tag":564,"props":966,"children":967},{"class":566,"line":603},[968],{"type":42,"tag":564,"props":969,"children":970},{},[971],{"type":48,"value":654},{"type":42,"tag":564,"props":973,"children":974},{"class":566,"line":613},[975],{"type":42,"tag":564,"props":976,"children":977},{},[978],{"type":48,"value":600},{"type":42,"tag":564,"props":980,"children":981},{"class":566,"line":622},[982],{"type":42,"tag":564,"props":983,"children":984},{},[985],{"type":48,"value":921},{"type":42,"tag":51,"props":987,"children":988},{},[989,994],{"type":42,"tag":106,"props":990,"children":991},{},[992],{"type":48,"value":993},"False positive risk:",{"type":48,"value":995}," LOW - If data processing doesn't depend on checksum correctness",{"type":42,"tag":139,"props":997,"children":999},{"id":998},"pattern-deterministic-prng-seeding",[1000],{"type":48,"value":1001},"Pattern: Deterministic PRNG Seeding",{"type":42,"tag":51,"props":1003,"children":1004},{},[1005,1009],{"type":42,"tag":106,"props":1006,"children":1007},{},[1008],{"type":48,"value":865},{"type":48,"value":1010}," Non-deterministic random state prevents reproducibility",{"type":42,"tag":51,"props":1012,"children":1013},{},[1014],{"type":42,"tag":106,"props":1015,"children":1016},{},[1017],{"type":48,"value":875},{"type":42,"tag":553,"props":1019,"children":1021},{"className":555,"code":1020,"language":557,"meta":558,"style":558},"void initialize() {\n    srand(time(NULL));  \u002F\u002F Different seed each run\n}\n",[1022],{"type":42,"tag":361,"props":1023,"children":1024},{"__ignoreMap":558},[1025,1033,1041],{"type":42,"tag":564,"props":1026,"children":1027},{"class":566,"line":567},[1028],{"type":42,"tag":564,"props":1029,"children":1030},{},[1031],{"type":48,"value":1032},"void initialize() {\n",{"type":42,"tag":564,"props":1034,"children":1035},{"class":566,"line":576},[1036],{"type":42,"tag":564,"props":1037,"children":1038},{},[1039],{"type":48,"value":1040},"    srand(time(NULL));  \u002F\u002F Different seed each run\n",{"type":42,"tag":564,"props":1042,"children":1043},{"class":566,"line":585},[1044],{"type":42,"tag":564,"props":1045,"children":1046},{},[1047],{"type":48,"value":600},{"type":42,"tag":51,"props":1049,"children":1050},{},[1051],{"type":42,"tag":106,"props":1052,"children":1053},{},[1054],{"type":48,"value":929},{"type":42,"tag":553,"props":1056,"children":1058},{"className":555,"code":1057,"language":557,"meta":558,"style":558},"void initialize() {\n#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION\n    srand(12345);  \u002F\u002F Fixed seed for fuzzing\n#else\n    srand(time(NULL));\n#endif\n}\n",[1059],{"type":42,"tag":361,"props":1060,"children":1061},{"__ignoreMap":558},[1062,1069,1077,1085,1093,1101,1108],{"type":42,"tag":564,"props":1063,"children":1064},{"class":566,"line":567},[1065],{"type":42,"tag":564,"props":1066,"children":1067},{},[1068],{"type":48,"value":1032},{"type":42,"tag":564,"props":1070,"children":1071},{"class":566,"line":576},[1072],{"type":42,"tag":564,"props":1073,"children":1074},{},[1075],{"type":48,"value":1076},"#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION\n",{"type":42,"tag":564,"props":1078,"children":1079},{"class":566,"line":585},[1080],{"type":42,"tag":564,"props":1081,"children":1082},{},[1083],{"type":48,"value":1084},"    srand(12345);  \u002F\u002F Fixed seed for fuzzing\n",{"type":42,"tag":564,"props":1086,"children":1087},{"class":566,"line":594},[1088],{"type":42,"tag":564,"props":1089,"children":1090},{},[1091],{"type":48,"value":1092},"#else\n",{"type":42,"tag":564,"props":1094,"children":1095},{"class":566,"line":603},[1096],{"type":42,"tag":564,"props":1097,"children":1098},{},[1099],{"type":48,"value":1100},"    srand(time(NULL));\n",{"type":42,"tag":564,"props":1102,"children":1103},{"class":566,"line":613},[1104],{"type":42,"tag":564,"props":1105,"children":1106},{},[1107],{"type":48,"value":654},{"type":42,"tag":564,"props":1109,"children":1110},{"class":566,"line":622},[1111],{"type":42,"tag":564,"props":1112,"children":1113},{},[1114],{"type":48,"value":600},{"type":42,"tag":51,"props":1116,"children":1117},{},[1118,1122],{"type":42,"tag":106,"props":1119,"children":1120},{},[1121],{"type":48,"value":993},{"type":48,"value":1123}," LOW - Fuzzer can explore all code paths with fixed seed",{"type":42,"tag":139,"props":1125,"children":1127},{"id":1126},"pattern-careful-validation-skip",[1128],{"type":48,"value":1129},"Pattern: Careful Validation Skip",{"type":42,"tag":51,"props":1131,"children":1132},{},[1133,1137],{"type":42,"tag":106,"props":1134,"children":1135},{},[1136],{"type":48,"value":865},{"type":48,"value":1138}," Validation must be skipped but downstream code has assumptions",{"type":42,"tag":51,"props":1140,"children":1141},{},[1142],{"type":42,"tag":106,"props":1143,"children":1144},{},[1145],{"type":48,"value":1146},"Before (Dangerous):",{"type":42,"tag":553,"props":1148,"children":1150},{"className":555,"code":1149,"language":557,"meta":558,"style":558},"#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION\nif (!validate_config(&config)) {\n    return -1;  \u002F\u002F Ensures config.x != 0\n}\n#endif\n\nint32_t result = 100 \u002F config.x;  \u002F\u002F CRASH: Division by zero in fuzzing!\n",[1151],{"type":42,"tag":361,"props":1152,"children":1153},{"__ignoreMap":558},[1154,1161,1169,1177,1184,1191,1198],{"type":42,"tag":564,"props":1155,"children":1156},{"class":566,"line":567},[1157],{"type":42,"tag":564,"props":1158,"children":1159},{},[1160],{"type":48,"value":636},{"type":42,"tag":564,"props":1162,"children":1163},{"class":566,"line":576},[1164],{"type":42,"tag":564,"props":1165,"children":1166},{},[1167],{"type":48,"value":1168},"if (!validate_config(&config)) {\n",{"type":42,"tag":564,"props":1170,"children":1171},{"class":566,"line":585},[1172],{"type":42,"tag":564,"props":1173,"children":1174},{},[1175],{"type":48,"value":1176},"    return -1;  \u002F\u002F Ensures config.x != 0\n",{"type":42,"tag":564,"props":1178,"children":1179},{"class":566,"line":594},[1180],{"type":42,"tag":564,"props":1181,"children":1182},{},[1183],{"type":48,"value":600},{"type":42,"tag":564,"props":1185,"children":1186},{"class":566,"line":603},[1187],{"type":42,"tag":564,"props":1188,"children":1189},{},[1190],{"type":48,"value":654},{"type":42,"tag":564,"props":1192,"children":1193},{"class":566,"line":613},[1194],{"type":42,"tag":564,"props":1195,"children":1196},{"emptyLinePlaceholder":607},[1197],{"type":48,"value":610},{"type":42,"tag":564,"props":1199,"children":1200},{"class":566,"line":622},[1201],{"type":42,"tag":564,"props":1202,"children":1203},{},[1204],{"type":48,"value":1205},"int32_t result = 100 \u002F config.x;  \u002F\u002F CRASH: Division by zero in fuzzing!\n",{"type":42,"tag":51,"props":1207,"children":1208},{},[1209],{"type":42,"tag":106,"props":1210,"children":1211},{},[1212],{"type":48,"value":1213},"After (Safe):",{"type":42,"tag":553,"props":1215,"children":1217},{"className":555,"code":1216,"language":557,"meta":558,"style":558},"#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION\nif (!validate_config(&config)) {\n    return -1;\n}\n#else\n\u002F\u002F During fuzzing, use safe defaults for failed validation\nif (!validate_config(&config)) {\n    config.x = 1;  \u002F\u002F Prevent division by zero\n    config.y = 1;\n}\n#endif\n\nint32_t result = 100 \u002F config.x;  \u002F\u002F Safe in both builds\n",[1218],{"type":42,"tag":361,"props":1219,"children":1220},{"__ignoreMap":558},[1221,1228,1235,1243,1250,1257,1265,1272,1280,1288,1295,1302,1309],{"type":42,"tag":564,"props":1222,"children":1223},{"class":566,"line":567},[1224],{"type":42,"tag":564,"props":1225,"children":1226},{},[1227],{"type":48,"value":636},{"type":42,"tag":564,"props":1229,"children":1230},{"class":566,"line":576},[1231],{"type":42,"tag":564,"props":1232,"children":1233},{},[1234],{"type":48,"value":1168},{"type":42,"tag":564,"props":1236,"children":1237},{"class":566,"line":585},[1238],{"type":42,"tag":564,"props":1239,"children":1240},{},[1241],{"type":48,"value":1242},"    return -1;\n",{"type":42,"tag":564,"props":1244,"children":1245},{"class":566,"line":594},[1246],{"type":42,"tag":564,"props":1247,"children":1248},{},[1249],{"type":48,"value":600},{"type":42,"tag":564,"props":1251,"children":1252},{"class":566,"line":603},[1253],{"type":42,"tag":564,"props":1254,"children":1255},{},[1256],{"type":48,"value":1092},{"type":42,"tag":564,"props":1258,"children":1259},{"class":566,"line":613},[1260],{"type":42,"tag":564,"props":1261,"children":1262},{},[1263],{"type":48,"value":1264},"\u002F\u002F During fuzzing, use safe defaults for failed validation\n",{"type":42,"tag":564,"props":1266,"children":1267},{"class":566,"line":622},[1268],{"type":42,"tag":564,"props":1269,"children":1270},{},[1271],{"type":48,"value":1168},{"type":42,"tag":564,"props":1273,"children":1274},{"class":566,"line":630},[1275],{"type":42,"tag":564,"props":1276,"children":1277},{},[1278],{"type":48,"value":1279},"    config.x = 1;  \u002F\u002F Prevent division by zero\n",{"type":42,"tag":564,"props":1281,"children":1282},{"class":566,"line":639},[1283],{"type":42,"tag":564,"props":1284,"children":1285},{},[1286],{"type":48,"value":1287},"    config.y = 1;\n",{"type":42,"tag":564,"props":1289,"children":1290},{"class":566,"line":648},[1291],{"type":42,"tag":564,"props":1292,"children":1293},{},[1294],{"type":48,"value":600},{"type":42,"tag":564,"props":1296,"children":1297},{"class":566,"line":657},[1298],{"type":42,"tag":564,"props":1299,"children":1300},{},[1301],{"type":48,"value":654},{"type":42,"tag":564,"props":1303,"children":1304},{"class":566,"line":665},[1305],{"type":42,"tag":564,"props":1306,"children":1307},{"emptyLinePlaceholder":607},[1308],{"type":48,"value":610},{"type":42,"tag":564,"props":1310,"children":1312},{"class":566,"line":1311},13,[1313],{"type":42,"tag":564,"props":1314,"children":1315},{},[1316],{"type":48,"value":1317},"int32_t result = 100 \u002F config.x;  \u002F\u002F Safe in both builds\n",{"type":42,"tag":51,"props":1319,"children":1320},{},[1321,1325],{"type":42,"tag":106,"props":1322,"children":1323},{},[1324],{"type":48,"value":993},{"type":48,"value":1326}," MITIGATED - Provides safe defaults instead of skipping",{"type":42,"tag":139,"props":1328,"children":1330},{"id":1329},"pattern-bypass-complex-format-validation",[1331],{"type":48,"value":1332},"Pattern: Bypass Complex Format Validation",{"type":42,"tag":51,"props":1334,"children":1335},{},[1336,1340],{"type":42,"tag":106,"props":1337,"children":1338},{},[1339],{"type":48,"value":865},{"type":48,"value":1341}," Multi-step validation makes valid input generation nearly impossible",{"type":42,"tag":51,"props":1343,"children":1344},{},[1345],{"type":42,"tag":106,"props":1346,"children":1347},{},[1348],{"type":48,"value":679},{"type":42,"tag":553,"props":1350,"children":1352},{"className":682,"code":1351,"language":684,"meta":558,"style":558},"\u002F\u002F Before: Multiple validation stages\npub fn parse_message(data: &[u8]) -> Result\u003CMessage, Error> {\n    validate_magic_bytes(data)?;\n    validate_structure(data)?;\n    validate_checksums(data)?;\n    validate_crypto_signature(data)?;\n\n    deserialize_message(data)\n}\n\n\u002F\u002F After: Skip expensive validation during fuzzing\npub fn parse_message(data: &[u8]) -> Result\u003CMessage, Error> {\n    validate_magic_bytes(data)?;  \u002F\u002F Keep cheap checks\n\n    if !cfg!(fuzzing) {\n        validate_structure(data)?;\n        validate_checksums(data)?;\n        validate_crypto_signature(data)?;\n    }\n\n    deserialize_message(data)\n}\n",[1353],{"type":42,"tag":361,"props":1354,"children":1355},{"__ignoreMap":558},[1356,1364,1372,1380,1388,1396,1404,1411,1419,1426,1433,1441,1448,1456,1464,1472,1481,1490,1499,1507,1515,1523],{"type":42,"tag":564,"props":1357,"children":1358},{"class":566,"line":567},[1359],{"type":42,"tag":564,"props":1360,"children":1361},{},[1362],{"type":48,"value":1363},"\u002F\u002F Before: Multiple validation stages\n",{"type":42,"tag":564,"props":1365,"children":1366},{"class":566,"line":576},[1367],{"type":42,"tag":564,"props":1368,"children":1369},{},[1370],{"type":48,"value":1371},"pub fn parse_message(data: &[u8]) -> Result\u003CMessage, Error> {\n",{"type":42,"tag":564,"props":1373,"children":1374},{"class":566,"line":585},[1375],{"type":42,"tag":564,"props":1376,"children":1377},{},[1378],{"type":48,"value":1379},"    validate_magic_bytes(data)?;\n",{"type":42,"tag":564,"props":1381,"children":1382},{"class":566,"line":594},[1383],{"type":42,"tag":564,"props":1384,"children":1385},{},[1386],{"type":48,"value":1387},"    validate_structure(data)?;\n",{"type":42,"tag":564,"props":1389,"children":1390},{"class":566,"line":603},[1391],{"type":42,"tag":564,"props":1392,"children":1393},{},[1394],{"type":48,"value":1395},"    validate_checksums(data)?;\n",{"type":42,"tag":564,"props":1397,"children":1398},{"class":566,"line":613},[1399],{"type":42,"tag":564,"props":1400,"children":1401},{},[1402],{"type":48,"value":1403},"    validate_crypto_signature(data)?;\n",{"type":42,"tag":564,"props":1405,"children":1406},{"class":566,"line":622},[1407],{"type":42,"tag":564,"props":1408,"children":1409},{"emptyLinePlaceholder":607},[1410],{"type":48,"value":610},{"type":42,"tag":564,"props":1412,"children":1413},{"class":566,"line":630},[1414],{"type":42,"tag":564,"props":1415,"children":1416},{},[1417],{"type":48,"value":1418},"    deserialize_message(data)\n",{"type":42,"tag":564,"props":1420,"children":1421},{"class":566,"line":639},[1422],{"type":42,"tag":564,"props":1423,"children":1424},{},[1425],{"type":48,"value":600},{"type":42,"tag":564,"props":1427,"children":1428},{"class":566,"line":648},[1429],{"type":42,"tag":564,"props":1430,"children":1431},{"emptyLinePlaceholder":607},[1432],{"type":48,"value":610},{"type":42,"tag":564,"props":1434,"children":1435},{"class":566,"line":657},[1436],{"type":42,"tag":564,"props":1437,"children":1438},{},[1439],{"type":48,"value":1440},"\u002F\u002F After: Skip expensive validation during fuzzing\n",{"type":42,"tag":564,"props":1442,"children":1443},{"class":566,"line":665},[1444],{"type":42,"tag":564,"props":1445,"children":1446},{},[1447],{"type":48,"value":1371},{"type":42,"tag":564,"props":1449,"children":1450},{"class":566,"line":1311},[1451],{"type":42,"tag":564,"props":1452,"children":1453},{},[1454],{"type":48,"value":1455},"    validate_magic_bytes(data)?;  \u002F\u002F Keep cheap checks\n",{"type":42,"tag":564,"props":1457,"children":1459},{"class":566,"line":1458},14,[1460],{"type":42,"tag":564,"props":1461,"children":1462},{"emptyLinePlaceholder":607},[1463],{"type":48,"value":610},{"type":42,"tag":564,"props":1465,"children":1467},{"class":566,"line":1466},15,[1468],{"type":42,"tag":564,"props":1469,"children":1470},{},[1471],{"type":48,"value":747},{"type":42,"tag":564,"props":1473,"children":1475},{"class":566,"line":1474},16,[1476],{"type":42,"tag":564,"props":1477,"children":1478},{},[1479],{"type":48,"value":1480},"        validate_structure(data)?;\n",{"type":42,"tag":564,"props":1482,"children":1484},{"class":566,"line":1483},17,[1485],{"type":42,"tag":564,"props":1486,"children":1487},{},[1488],{"type":48,"value":1489},"        validate_checksums(data)?;\n",{"type":42,"tag":564,"props":1491,"children":1493},{"class":566,"line":1492},18,[1494],{"type":42,"tag":564,"props":1495,"children":1496},{},[1497],{"type":48,"value":1498},"        validate_crypto_signature(data)?;\n",{"type":42,"tag":564,"props":1500,"children":1502},{"class":566,"line":1501},19,[1503],{"type":42,"tag":564,"props":1504,"children":1505},{},[1506],{"type":48,"value":763},{"type":42,"tag":564,"props":1508,"children":1510},{"class":566,"line":1509},20,[1511],{"type":42,"tag":564,"props":1512,"children":1513},{"emptyLinePlaceholder":607},[1514],{"type":48,"value":610},{"type":42,"tag":564,"props":1516,"children":1518},{"class":566,"line":1517},21,[1519],{"type":42,"tag":564,"props":1520,"children":1521},{},[1522],{"type":48,"value":1418},{"type":42,"tag":564,"props":1524,"children":1526},{"class":566,"line":1525},22,[1527],{"type":42,"tag":564,"props":1528,"children":1529},{},[1530],{"type":48,"value":600},{"type":42,"tag":51,"props":1532,"children":1533},{},[1534,1538],{"type":42,"tag":106,"props":1535,"children":1536},{},[1537],{"type":48,"value":993},{"type":48,"value":1539}," MEDIUM - Deserialization must handle malformed data gracefully",{"type":42,"tag":57,"props":1541,"children":1543},{"id":1542},"advanced-usage",[1544],{"type":48,"value":1545},"Advanced Usage",{"type":42,"tag":139,"props":1547,"children":1549},{"id":1548},"tips-and-tricks",[1550],{"type":48,"value":1551},"Tips and Tricks",{"type":42,"tag":146,"props":1553,"children":1554},{},[1555,1571],{"type":42,"tag":150,"props":1556,"children":1557},{},[1558],{"type":42,"tag":154,"props":1559,"children":1560},{},[1561,1566],{"type":42,"tag":158,"props":1562,"children":1563},{},[1564],{"type":48,"value":1565},"Tip",{"type":42,"tag":158,"props":1567,"children":1568},{},[1569],{"type":48,"value":1570},"Why It Helps",{"type":42,"tag":169,"props":1572,"children":1573},{},[1574,1587,1600,1613,1626],{"type":42,"tag":154,"props":1575,"children":1576},{},[1577,1582],{"type":42,"tag":176,"props":1578,"children":1579},{},[1580],{"type":48,"value":1581},"Keep cheap validation",{"type":42,"tag":176,"props":1583,"children":1584},{},[1585],{"type":48,"value":1586},"Magic bytes and size checks guide fuzzer without much cost",{"type":42,"tag":154,"props":1588,"children":1589},{},[1590,1595],{"type":42,"tag":176,"props":1591,"children":1592},{},[1593],{"type":48,"value":1594},"Use fixed seeds for PRNGs",{"type":42,"tag":176,"props":1596,"children":1597},{},[1598],{"type":48,"value":1599},"Makes behavior deterministic while exploring all code paths",{"type":42,"tag":154,"props":1601,"children":1602},{},[1603,1608],{"type":42,"tag":176,"props":1604,"children":1605},{},[1606],{"type":48,"value":1607},"Patch incrementally",{"type":42,"tag":176,"props":1609,"children":1610},{},[1611],{"type":48,"value":1612},"Skip one obstacle at a time and measure coverage impact",{"type":42,"tag":154,"props":1614,"children":1615},{},[1616,1621],{"type":42,"tag":176,"props":1617,"children":1618},{},[1619],{"type":48,"value":1620},"Add defensive defaults",{"type":42,"tag":176,"props":1622,"children":1623},{},[1624],{"type":48,"value":1625},"When skipping validation, provide safe fallback values",{"type":42,"tag":154,"props":1627,"children":1628},{},[1629,1634],{"type":42,"tag":176,"props":1630,"children":1631},{},[1632],{"type":48,"value":1633},"Document all patches",{"type":42,"tag":176,"props":1635,"children":1636},{},[1637],{"type":48,"value":1638},"Future maintainers need to understand fuzzing vs. production differences",{"type":42,"tag":139,"props":1640,"children":1642},{"id":1641},"real-world-examples",[1643],{"type":48,"value":1644},"Real-World Examples",{"type":42,"tag":51,"props":1646,"children":1647},{},[1648,1653,1655,1661,1663,1672],{"type":42,"tag":106,"props":1649,"children":1650},{},[1651],{"type":48,"value":1652},"OpenSSL:",{"type":48,"value":1654}," Uses ",{"type":42,"tag":361,"props":1656,"children":1658},{"className":1657},[],[1659],{"type":48,"value":1660},"FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION",{"type":48,"value":1662}," to modify cryptographic algorithm behavior. For example, in ",{"type":42,"tag":1664,"props":1665,"children":1669},"a",{"href":1666,"rel":1667},"https:\u002F\u002Fgithub.com\u002Fopenssl\u002Fopenssl\u002Fblob\u002Fafb19f07aecc84998eeea56c4d65f5e0499abb5a\u002Fcrypto\u002Fcmp\u002Fcmp_vfy.c#L665-L678",[1668],"nofollow",[1670],{"type":48,"value":1671},"crypto\u002Fcmp\u002Fcmp_vfy.c",{"type":48,"value":1673},", certain signature checks are relaxed during fuzzing to allow deeper exploration of certificate validation logic.",{"type":42,"tag":51,"props":1675,"children":1676},{},[1677,1682,1683,1688,1690,1697],{"type":42,"tag":106,"props":1678,"children":1679},{},[1680],{"type":48,"value":1681},"ogg crate (Rust):",{"type":48,"value":1654},{"type":42,"tag":361,"props":1684,"children":1686},{"className":1685},[],[1687],{"type":48,"value":375},{"type":48,"value":1689}," to ",{"type":42,"tag":1664,"props":1691,"children":1694},{"href":1692,"rel":1693},"https:\u002F\u002Fgithub.com\u002FRustAudio\u002Fogg\u002Fblob\u002F5ee8316e6e907c24f6d7ec4b3a0ed6a6ce854cc1\u002Fsrc\u002Freading.rs#L298-L300",[1668],[1695],{"type":48,"value":1696},"skip checksum verification",{"type":48,"value":1698}," during fuzzing. This allows the fuzzer to explore audio processing code without spending effort guessing correct checksums.",{"type":42,"tag":139,"props":1700,"children":1702},{"id":1701},"measuring-patch-effectiveness",[1703],{"type":48,"value":1704},"Measuring Patch Effectiveness",{"type":42,"tag":51,"props":1706,"children":1707},{},[1708],{"type":48,"value":1709},"After applying patches, quantify the improvement:",{"type":42,"tag":99,"props":1711,"children":1712},{},[1713,1739,1749,1759],{"type":42,"tag":73,"props":1714,"children":1715},{},[1716,1721,1723,1729,1731,1737],{"type":42,"tag":106,"props":1717,"children":1718},{},[1719],{"type":48,"value":1720},"Line coverage:",{"type":48,"value":1722}," Use ",{"type":42,"tag":361,"props":1724,"children":1726},{"className":1725},[],[1727],{"type":48,"value":1728},"llvm-cov",{"type":48,"value":1730}," or ",{"type":42,"tag":361,"props":1732,"children":1734},{"className":1733},[],[1735],{"type":48,"value":1736},"cargo-cov",{"type":48,"value":1738}," to see new reachable lines",{"type":42,"tag":73,"props":1740,"children":1741},{},[1742,1747],{"type":42,"tag":106,"props":1743,"children":1744},{},[1745],{"type":48,"value":1746},"Basic block coverage:",{"type":48,"value":1748}," More fine-grained than line coverage",{"type":42,"tag":73,"props":1750,"children":1751},{},[1752,1757],{"type":42,"tag":106,"props":1753,"children":1754},{},[1755],{"type":48,"value":1756},"Function coverage:",{"type":48,"value":1758}," How many more functions are now reachable?",{"type":42,"tag":73,"props":1760,"children":1761},{},[1762,1767],{"type":42,"tag":106,"props":1763,"children":1764},{},[1765],{"type":48,"value":1766},"Corpus size:",{"type":48,"value":1768}," Does the fuzzer generate more diverse inputs?",{"type":42,"tag":51,"props":1770,"children":1771},{},[1772],{"type":48,"value":1773},"Effective patches typically increase coverage by 10-50% or more.",{"type":42,"tag":139,"props":1775,"children":1777},{"id":1776},"combining-with-other-techniques",[1778],{"type":48,"value":1779},"Combining with Other Techniques",{"type":42,"tag":51,"props":1781,"children":1782},{},[1783],{"type":48,"value":1784},"Obstacle patching works well with:",{"type":42,"tag":69,"props":1786,"children":1787},{},[1788,1798,1808,1818],{"type":42,"tag":73,"props":1789,"children":1790},{},[1791,1796],{"type":42,"tag":106,"props":1792,"children":1793},{},[1794],{"type":48,"value":1795},"Corpus seeding:",{"type":48,"value":1797}," Provide valid inputs that get past initial parsing",{"type":42,"tag":73,"props":1799,"children":1800},{},[1801,1806],{"type":42,"tag":106,"props":1802,"children":1803},{},[1804],{"type":48,"value":1805},"Dictionaries:",{"type":48,"value":1807}," Help fuzzer learn magic bytes and common values",{"type":42,"tag":73,"props":1809,"children":1810},{},[1811,1816],{"type":42,"tag":106,"props":1812,"children":1813},{},[1814],{"type":48,"value":1815},"Structure-aware fuzzing:",{"type":48,"value":1817}," Use protobuf or grammar definitions for complex formats",{"type":42,"tag":73,"props":1819,"children":1820},{},[1821,1826],{"type":42,"tag":106,"props":1822,"children":1823},{},[1824],{"type":48,"value":1825},"Harness improvements:",{"type":48,"value":1827}," Better harness can sometimes avoid obstacles entirely",{"type":42,"tag":57,"props":1829,"children":1831},{"id":1830},"anti-patterns",[1832],{"type":48,"value":1833},"Anti-Patterns",{"type":42,"tag":146,"props":1835,"children":1836},{},[1837,1858],{"type":42,"tag":150,"props":1838,"children":1839},{},[1840],{"type":42,"tag":154,"props":1841,"children":1842},{},[1843,1848,1853],{"type":42,"tag":158,"props":1844,"children":1845},{},[1846],{"type":48,"value":1847},"Anti-Pattern",{"type":42,"tag":158,"props":1849,"children":1850},{},[1851],{"type":48,"value":1852},"Problem",{"type":42,"tag":158,"props":1854,"children":1855},{},[1856],{"type":48,"value":1857},"Correct Approach",{"type":42,"tag":169,"props":1859,"children":1860},{},[1861,1879,1897,1915,1933],{"type":42,"tag":154,"props":1862,"children":1863},{},[1864,1869,1874],{"type":42,"tag":176,"props":1865,"children":1866},{},[1867],{"type":48,"value":1868},"Skip all validation wholesale",{"type":42,"tag":176,"props":1870,"children":1871},{},[1872],{"type":48,"value":1873},"Creates false positives and unstable fuzzing",{"type":42,"tag":176,"props":1875,"children":1876},{},[1877],{"type":48,"value":1878},"Skip only specific obstacles that block coverage",{"type":42,"tag":154,"props":1880,"children":1881},{},[1882,1887,1892],{"type":42,"tag":176,"props":1883,"children":1884},{},[1885],{"type":48,"value":1886},"No risk assessment",{"type":42,"tag":176,"props":1888,"children":1889},{},[1890],{"type":48,"value":1891},"False positives waste time and hide real bugs",{"type":42,"tag":176,"props":1893,"children":1894},{},[1895],{"type":48,"value":1896},"Analyze downstream code for assumptions",{"type":42,"tag":154,"props":1898,"children":1899},{},[1900,1905,1910],{"type":42,"tag":176,"props":1901,"children":1902},{},[1903],{"type":48,"value":1904},"Forget to document patches",{"type":42,"tag":176,"props":1906,"children":1907},{},[1908],{"type":48,"value":1909},"Future maintainers don't understand the differences",{"type":42,"tag":176,"props":1911,"children":1912},{},[1913],{"type":48,"value":1914},"Add comments explaining why patch is safe",{"type":42,"tag":154,"props":1916,"children":1917},{},[1918,1923,1928],{"type":42,"tag":176,"props":1919,"children":1920},{},[1921],{"type":48,"value":1922},"Patch without measuring",{"type":42,"tag":176,"props":1924,"children":1925},{},[1926],{"type":48,"value":1927},"Don't know if it helped",{"type":42,"tag":176,"props":1929,"children":1930},{},[1931],{"type":48,"value":1932},"Compare coverage before and after",{"type":42,"tag":154,"props":1934,"children":1935},{},[1936,1941,1946],{"type":42,"tag":176,"props":1937,"children":1938},{},[1939],{"type":48,"value":1940},"Over-patching",{"type":42,"tag":176,"props":1942,"children":1943},{},[1944],{"type":48,"value":1945},"Makes fuzzing build diverge too much from production",{"type":42,"tag":176,"props":1947,"children":1948},{},[1949],{"type":48,"value":1950},"Minimize differences between builds",{"type":42,"tag":57,"props":1952,"children":1954},{"id":1953},"tool-specific-guidance",[1955],{"type":48,"value":1956},"Tool-Specific Guidance",{"type":42,"tag":139,"props":1958,"children":1960},{"id":1959},"libfuzzer",[1961],{"type":48,"value":1962},"libFuzzer",{"type":42,"tag":51,"props":1964,"children":1965},{},[1966,1968,1973],{"type":48,"value":1967},"libFuzzer automatically defines ",{"type":42,"tag":361,"props":1969,"children":1971},{"className":1970},[],[1972],{"type":48,"value":1660},{"type":48,"value":1974}," during compilation.",{"type":42,"tag":553,"props":1976,"children":1980},{"className":1977,"code":1978,"language":1979,"meta":558,"style":558},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# C++ compilation\nclang++ -g -fsanitize=fuzzer,address -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \\\n    harness.cc target.cc -o fuzzer\n\n# The macro is usually defined automatically by -fsanitize=fuzzer\nclang++ -g -fsanitize=fuzzer,address harness.cc target.cc -o fuzzer\n","bash",[1981],{"type":42,"tag":361,"props":1982,"children":1983},{"__ignoreMap":558},[1984,1993,2024,2047,2054,2062],{"type":42,"tag":564,"props":1985,"children":1986},{"class":566,"line":567},[1987],{"type":42,"tag":564,"props":1988,"children":1990},{"style":1989},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1991],{"type":48,"value":1992},"# C++ compilation\n",{"type":42,"tag":564,"props":1994,"children":1995},{"class":566,"line":576},[1996,2002,2008,2013,2018],{"type":42,"tag":564,"props":1997,"children":1999},{"style":1998},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[2000],{"type":48,"value":2001},"clang++",{"type":42,"tag":564,"props":2003,"children":2005},{"style":2004},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[2006],{"type":48,"value":2007}," -g",{"type":42,"tag":564,"props":2009,"children":2010},{"style":2004},[2011],{"type":48,"value":2012}," -fsanitize=fuzzer,address",{"type":42,"tag":564,"props":2014,"children":2015},{"style":2004},[2016],{"type":48,"value":2017}," -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION",{"type":42,"tag":564,"props":2019,"children":2021},{"style":2020},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[2022],{"type":48,"value":2023}," \\\n",{"type":42,"tag":564,"props":2025,"children":2026},{"class":566,"line":585},[2027,2032,2037,2042],{"type":42,"tag":564,"props":2028,"children":2029},{"style":2004},[2030],{"type":48,"value":2031},"    harness.cc",{"type":42,"tag":564,"props":2033,"children":2034},{"style":2004},[2035],{"type":48,"value":2036}," target.cc",{"type":42,"tag":564,"props":2038,"children":2039},{"style":2004},[2040],{"type":48,"value":2041}," -o",{"type":42,"tag":564,"props":2043,"children":2044},{"style":2004},[2045],{"type":48,"value":2046}," fuzzer\n",{"type":42,"tag":564,"props":2048,"children":2049},{"class":566,"line":594},[2050],{"type":42,"tag":564,"props":2051,"children":2052},{"emptyLinePlaceholder":607},[2053],{"type":48,"value":610},{"type":42,"tag":564,"props":2055,"children":2056},{"class":566,"line":603},[2057],{"type":42,"tag":564,"props":2058,"children":2059},{"style":1989},[2060],{"type":48,"value":2061},"# The macro is usually defined automatically by -fsanitize=fuzzer\n",{"type":42,"tag":564,"props":2063,"children":2064},{"class":566,"line":613},[2065,2069,2073,2077,2082,2086,2090],{"type":42,"tag":564,"props":2066,"children":2067},{"style":1998},[2068],{"type":48,"value":2001},{"type":42,"tag":564,"props":2070,"children":2071},{"style":2004},[2072],{"type":48,"value":2007},{"type":42,"tag":564,"props":2074,"children":2075},{"style":2004},[2076],{"type":48,"value":2012},{"type":42,"tag":564,"props":2078,"children":2079},{"style":2004},[2080],{"type":48,"value":2081}," harness.cc",{"type":42,"tag":564,"props":2083,"children":2084},{"style":2004},[2085],{"type":48,"value":2036},{"type":42,"tag":564,"props":2087,"children":2088},{"style":2004},[2089],{"type":48,"value":2041},{"type":42,"tag":564,"props":2091,"children":2092},{"style":2004},[2093],{"type":48,"value":2046},{"type":42,"tag":51,"props":2095,"children":2096},{},[2097],{"type":42,"tag":106,"props":2098,"children":2099},{},[2100],{"type":48,"value":2101},"Integration tips:",{"type":42,"tag":69,"props":2103,"children":2104},{},[2105,2110,2123],{"type":42,"tag":73,"props":2106,"children":2107},{},[2108],{"type":48,"value":2109},"The macro is defined automatically; manual definition is usually unnecessary",{"type":42,"tag":73,"props":2111,"children":2112},{},[2113,2115,2121],{"type":48,"value":2114},"Use ",{"type":42,"tag":361,"props":2116,"children":2118},{"className":2117},[],[2119],{"type":48,"value":2120},"#ifdef",{"type":48,"value":2122}," to check for the macro",{"type":42,"tag":73,"props":2124,"children":2125},{},[2126],{"type":48,"value":2127},"Combine with sanitizers to detect bugs in newly reachable code",{"type":42,"tag":139,"props":2129,"children":2131},{"id":2130},"afl",[2132],{"type":48,"value":2133},"AFL++",{"type":42,"tag":51,"props":2135,"children":2136},{},[2137,2139,2144],{"type":48,"value":2138},"AFL++ also defines ",{"type":42,"tag":361,"props":2140,"children":2142},{"className":2141},[],[2143],{"type":48,"value":1660},{"type":48,"value":2145}," when using its compiler wrappers.",{"type":42,"tag":553,"props":2147,"children":2149},{"className":1977,"code":2148,"language":1979,"meta":558,"style":558},"# Compilation with AFL++ wrappers\nafl-clang-fast++ -g -fsanitize=address target.cc harness.cc -o fuzzer\n\n# The macro is defined automatically by afl-clang-fast\n",[2150],{"type":42,"tag":361,"props":2151,"children":2152},{"__ignoreMap":558},[2153,2161,2194,2201],{"type":42,"tag":564,"props":2154,"children":2155},{"class":566,"line":567},[2156],{"type":42,"tag":564,"props":2157,"children":2158},{"style":1989},[2159],{"type":48,"value":2160},"# Compilation with AFL++ wrappers\n",{"type":42,"tag":564,"props":2162,"children":2163},{"class":566,"line":576},[2164,2169,2173,2178,2182,2186,2190],{"type":42,"tag":564,"props":2165,"children":2166},{"style":1998},[2167],{"type":48,"value":2168},"afl-clang-fast++",{"type":42,"tag":564,"props":2170,"children":2171},{"style":2004},[2172],{"type":48,"value":2007},{"type":42,"tag":564,"props":2174,"children":2175},{"style":2004},[2176],{"type":48,"value":2177}," -fsanitize=address",{"type":42,"tag":564,"props":2179,"children":2180},{"style":2004},[2181],{"type":48,"value":2036},{"type":42,"tag":564,"props":2183,"children":2184},{"style":2004},[2185],{"type":48,"value":2081},{"type":42,"tag":564,"props":2187,"children":2188},{"style":2004},[2189],{"type":48,"value":2041},{"type":42,"tag":564,"props":2191,"children":2192},{"style":2004},[2193],{"type":48,"value":2046},{"type":42,"tag":564,"props":2195,"children":2196},{"class":566,"line":585},[2197],{"type":42,"tag":564,"props":2198,"children":2199},{"emptyLinePlaceholder":607},[2200],{"type":48,"value":610},{"type":42,"tag":564,"props":2202,"children":2203},{"class":566,"line":594},[2204],{"type":42,"tag":564,"props":2205,"children":2206},{"style":1989},[2207],{"type":48,"value":2208},"# The macro is defined automatically by afl-clang-fast\n",{"type":42,"tag":51,"props":2210,"children":2211},{},[2212],{"type":42,"tag":106,"props":2213,"children":2214},{},[2215],{"type":48,"value":2101},{"type":42,"tag":69,"props":2217,"children":2218},{},[2219,2238,2243],{"type":42,"tag":73,"props":2220,"children":2221},{},[2222,2223,2229,2230,2236],{"type":48,"value":2114},{"type":42,"tag":361,"props":2224,"children":2226},{"className":2225},[],[2227],{"type":48,"value":2228},"afl-clang-fast",{"type":48,"value":1730},{"type":42,"tag":361,"props":2231,"children":2233},{"className":2232},[],[2234],{"type":48,"value":2235},"afl-clang-lto",{"type":48,"value":2237}," for automatic macro definition",{"type":42,"tag":73,"props":2239,"children":2240},{},[2241],{"type":48,"value":2242},"Persistent mode harnesses benefit most from obstacle patching",{"type":42,"tag":73,"props":2244,"children":2245},{},[2246,2248,2254],{"type":48,"value":2247},"Consider using ",{"type":42,"tag":361,"props":2249,"children":2251},{"className":2250},[],[2252],{"type":48,"value":2253},"AFL_LLVM_LAF_ALL",{"type":48,"value":2255}," for additional input-to-state transformations",{"type":42,"tag":139,"props":2257,"children":2259},{"id":2258},"honggfuzz",[2260],{"type":48,"value":2258},{"type":42,"tag":51,"props":2262,"children":2263},{},[2264],{"type":48,"value":2265},"honggfuzz also supports the macro when building targets.",{"type":42,"tag":553,"props":2267,"children":2269},{"className":1977,"code":2268,"language":1979,"meta":558,"style":558},"# Compilation\nhfuzz-clang++ -g -fsanitize=address target.cc harness.cc -o fuzzer\n",[2270],{"type":42,"tag":361,"props":2271,"children":2272},{"__ignoreMap":558},[2273,2281],{"type":42,"tag":564,"props":2274,"children":2275},{"class":566,"line":567},[2276],{"type":42,"tag":564,"props":2277,"children":2278},{"style":1989},[2279],{"type":48,"value":2280},"# Compilation\n",{"type":42,"tag":564,"props":2282,"children":2283},{"class":566,"line":576},[2284,2289,2293,2297,2301,2305,2309],{"type":42,"tag":564,"props":2285,"children":2286},{"style":1998},[2287],{"type":48,"value":2288},"hfuzz-clang++",{"type":42,"tag":564,"props":2290,"children":2291},{"style":2004},[2292],{"type":48,"value":2007},{"type":42,"tag":564,"props":2294,"children":2295},{"style":2004},[2296],{"type":48,"value":2177},{"type":42,"tag":564,"props":2298,"children":2299},{"style":2004},[2300],{"type":48,"value":2036},{"type":42,"tag":564,"props":2302,"children":2303},{"style":2004},[2304],{"type":48,"value":2081},{"type":42,"tag":564,"props":2306,"children":2307},{"style":2004},[2308],{"type":48,"value":2041},{"type":42,"tag":564,"props":2310,"children":2311},{"style":2004},[2312],{"type":48,"value":2046},{"type":42,"tag":51,"props":2314,"children":2315},{},[2316],{"type":42,"tag":106,"props":2317,"children":2318},{},[2319],{"type":48,"value":2101},{"type":42,"tag":69,"props":2321,"children":2322},{},[2323,2341,2346],{"type":42,"tag":73,"props":2324,"children":2325},{},[2326,2327,2333,2334,2339],{"type":48,"value":2114},{"type":42,"tag":361,"props":2328,"children":2330},{"className":2329},[],[2331],{"type":48,"value":2332},"hfuzz-clang",{"type":48,"value":1730},{"type":42,"tag":361,"props":2335,"children":2337},{"className":2336},[],[2338],{"type":48,"value":2288},{"type":48,"value":2340}," wrappers",{"type":42,"tag":73,"props":2342,"children":2343},{},[2344],{"type":48,"value":2345},"The macro is available for conditional compilation",{"type":42,"tag":73,"props":2347,"children":2348},{},[2349],{"type":48,"value":2350},"Combine with honggfuzz's feedback-driven fuzzing",{"type":42,"tag":139,"props":2352,"children":2354},{"id":2353},"cargo-fuzz-rust",[2355],{"type":48,"value":2356},"cargo-fuzz (Rust)",{"type":42,"tag":51,"props":2358,"children":2359},{},[2360,2362,2368],{"type":48,"value":2361},"cargo-fuzz automatically sets the ",{"type":42,"tag":361,"props":2363,"children":2365},{"className":2364},[],[2366],{"type":48,"value":2367},"fuzzing",{"type":48,"value":2369}," cfg option during builds.",{"type":42,"tag":553,"props":2371,"children":2373},{"className":1977,"code":2372,"language":1979,"meta":558,"style":558},"# Build fuzz target (cfg!(fuzzing) is automatically set)\ncargo fuzz build fuzz_target_name\n\n# Run fuzz target\ncargo fuzz run fuzz_target_name\n",[2374],{"type":42,"tag":361,"props":2375,"children":2376},{"__ignoreMap":558},[2377,2385,2408,2415,2423],{"type":42,"tag":564,"props":2378,"children":2379},{"class":566,"line":567},[2380],{"type":42,"tag":564,"props":2381,"children":2382},{"style":1989},[2383],{"type":48,"value":2384},"# Build fuzz target (cfg!(fuzzing) is automatically set)\n",{"type":42,"tag":564,"props":2386,"children":2387},{"class":566,"line":576},[2388,2393,2398,2403],{"type":42,"tag":564,"props":2389,"children":2390},{"style":1998},[2391],{"type":48,"value":2392},"cargo",{"type":42,"tag":564,"props":2394,"children":2395},{"style":2004},[2396],{"type":48,"value":2397}," fuzz",{"type":42,"tag":564,"props":2399,"children":2400},{"style":2004},[2401],{"type":48,"value":2402}," build",{"type":42,"tag":564,"props":2404,"children":2405},{"style":2004},[2406],{"type":48,"value":2407}," fuzz_target_name\n",{"type":42,"tag":564,"props":2409,"children":2410},{"class":566,"line":585},[2411],{"type":42,"tag":564,"props":2412,"children":2413},{"emptyLinePlaceholder":607},[2414],{"type":48,"value":610},{"type":42,"tag":564,"props":2416,"children":2417},{"class":566,"line":594},[2418],{"type":42,"tag":564,"props":2419,"children":2420},{"style":1989},[2421],{"type":48,"value":2422},"# Run fuzz target\n",{"type":42,"tag":564,"props":2424,"children":2425},{"class":566,"line":603},[2426,2430,2434,2439],{"type":42,"tag":564,"props":2427,"children":2428},{"style":1998},[2429],{"type":48,"value":2392},{"type":42,"tag":564,"props":2431,"children":2432},{"style":2004},[2433],{"type":48,"value":2397},{"type":42,"tag":564,"props":2435,"children":2436},{"style":2004},[2437],{"type":48,"value":2438}," run",{"type":42,"tag":564,"props":2440,"children":2441},{"style":2004},[2442],{"type":48,"value":2407},{"type":42,"tag":51,"props":2444,"children":2445},{},[2446],{"type":42,"tag":106,"props":2447,"children":2448},{},[2449],{"type":48,"value":2101},{"type":42,"tag":69,"props":2451,"children":2452},{},[2453,2464,2476,2495],{"type":42,"tag":73,"props":2454,"children":2455},{},[2456,2457,2462],{"type":48,"value":2114},{"type":42,"tag":361,"props":2458,"children":2460},{"className":2459},[],[2461],{"type":48,"value":375},{"type":48,"value":2463}," for runtime checks in production builds",{"type":42,"tag":73,"props":2465,"children":2466},{},[2467,2468,2474],{"type":48,"value":2114},{"type":42,"tag":361,"props":2469,"children":2471},{"className":2470},[],[2472],{"type":48,"value":2473},"#[cfg(fuzzing)]",{"type":48,"value":2475}," for compile-time conditional compilation",{"type":42,"tag":73,"props":2477,"children":2478},{},[2479,2481,2487,2489],{"type":48,"value":2480},"The fuzzing cfg is only set during ",{"type":42,"tag":361,"props":2482,"children":2484},{"className":2483},[],[2485],{"type":48,"value":2486},"cargo fuzz",{"type":48,"value":2488}," builds, not regular ",{"type":42,"tag":361,"props":2490,"children":2492},{"className":2491},[],[2493],{"type":48,"value":2494},"cargo build",{"type":42,"tag":73,"props":2496,"children":2497},{},[2498,2500,2506],{"type":48,"value":2499},"Can be manually enabled with ",{"type":42,"tag":361,"props":2501,"children":2503},{"className":2502},[],[2504],{"type":48,"value":2505},"RUSTFLAGS=\"--cfg fuzzing\"",{"type":48,"value":2507}," for testing",{"type":42,"tag":139,"props":2509,"children":2511},{"id":2510},"libafl",[2512],{"type":48,"value":2513},"LibAFL",{"type":42,"tag":51,"props":2515,"children":2516},{},[2517],{"type":48,"value":2518},"LibAFL supports the C\u002FC++ macro for targets written in C\u002FC++.",{"type":42,"tag":553,"props":2520,"children":2522},{"className":1977,"code":2521,"language":1979,"meta":558,"style":558},"# Compilation\nclang++ -g -fsanitize=address -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \\\n    target.cc -c -o target.o\n",[2523],{"type":42,"tag":361,"props":2524,"children":2525},{"__ignoreMap":558},[2526,2533,2556],{"type":42,"tag":564,"props":2527,"children":2528},{"class":566,"line":567},[2529],{"type":42,"tag":564,"props":2530,"children":2531},{"style":1989},[2532],{"type":48,"value":2280},{"type":42,"tag":564,"props":2534,"children":2535},{"class":566,"line":576},[2536,2540,2544,2548,2552],{"type":42,"tag":564,"props":2537,"children":2538},{"style":1998},[2539],{"type":48,"value":2001},{"type":42,"tag":564,"props":2541,"children":2542},{"style":2004},[2543],{"type":48,"value":2007},{"type":42,"tag":564,"props":2545,"children":2546},{"style":2004},[2547],{"type":48,"value":2177},{"type":42,"tag":564,"props":2549,"children":2550},{"style":2004},[2551],{"type":48,"value":2017},{"type":42,"tag":564,"props":2553,"children":2554},{"style":2020},[2555],{"type":48,"value":2023},{"type":42,"tag":564,"props":2557,"children":2558},{"class":566,"line":585},[2559,2564,2569,2573],{"type":42,"tag":564,"props":2560,"children":2561},{"style":2004},[2562],{"type":48,"value":2563},"    target.cc",{"type":42,"tag":564,"props":2565,"children":2566},{"style":2004},[2567],{"type":48,"value":2568}," -c",{"type":42,"tag":564,"props":2570,"children":2571},{"style":2004},[2572],{"type":48,"value":2041},{"type":42,"tag":564,"props":2574,"children":2575},{"style":2004},[2576],{"type":48,"value":2577}," target.o\n",{"type":42,"tag":51,"props":2579,"children":2580},{},[2581],{"type":42,"tag":106,"props":2582,"children":2583},{},[2584],{"type":48,"value":2101},{"type":42,"tag":69,"props":2586,"children":2587},{},[2588,2593,2598],{"type":42,"tag":73,"props":2589,"children":2590},{},[2591],{"type":48,"value":2592},"Define the macro manually or use compiler flags",{"type":42,"tag":73,"props":2594,"children":2595},{},[2596],{"type":48,"value":2597},"Works the same as with libFuzzer",{"type":42,"tag":73,"props":2599,"children":2600},{},[2601],{"type":48,"value":2602},"Useful when building custom LibAFL-based fuzzers",{"type":42,"tag":57,"props":2604,"children":2606},{"id":2605},"troubleshooting",[2607],{"type":48,"value":2608},"Troubleshooting",{"type":42,"tag":146,"props":2610,"children":2611},{},[2612,2633],{"type":42,"tag":150,"props":2613,"children":2614},{},[2615],{"type":42,"tag":154,"props":2616,"children":2617},{},[2618,2623,2628],{"type":42,"tag":158,"props":2619,"children":2620},{},[2621],{"type":48,"value":2622},"Issue",{"type":42,"tag":158,"props":2624,"children":2625},{},[2626],{"type":48,"value":2627},"Cause",{"type":42,"tag":158,"props":2629,"children":2630},{},[2631],{"type":48,"value":2632},"Solution",{"type":42,"tag":169,"props":2634,"children":2635},{},[2636,2654,2672,2690,2708],{"type":42,"tag":154,"props":2637,"children":2638},{},[2639,2644,2649],{"type":42,"tag":176,"props":2640,"children":2641},{},[2642],{"type":48,"value":2643},"Coverage doesn't improve after patching",{"type":42,"tag":176,"props":2645,"children":2646},{},[2647],{"type":48,"value":2648},"Wrong obstacle identified",{"type":42,"tag":176,"props":2650,"children":2651},{},[2652],{"type":48,"value":2653},"Profile execution to find actual bottleneck",{"type":42,"tag":154,"props":2655,"children":2656},{},[2657,2662,2667],{"type":42,"tag":176,"props":2658,"children":2659},{},[2660],{"type":48,"value":2661},"Many false positive crashes",{"type":42,"tag":176,"props":2663,"children":2664},{},[2665],{"type":48,"value":2666},"Downstream code has assumptions",{"type":42,"tag":176,"props":2668,"children":2669},{},[2670],{"type":48,"value":2671},"Add defensive defaults or partial validation",{"type":42,"tag":154,"props":2673,"children":2674},{},[2675,2680,2685],{"type":42,"tag":176,"props":2676,"children":2677},{},[2678],{"type":48,"value":2679},"Code compiles differently",{"type":42,"tag":176,"props":2681,"children":2682},{},[2683],{"type":48,"value":2684},"Macro not defined in all build configs",{"type":42,"tag":176,"props":2686,"children":2687},{},[2688],{"type":48,"value":2689},"Verify macro in all source files and dependencies",{"type":42,"tag":154,"props":2691,"children":2692},{},[2693,2698,2703],{"type":42,"tag":176,"props":2694,"children":2695},{},[2696],{"type":48,"value":2697},"Fuzzer finds bugs in patched code",{"type":42,"tag":176,"props":2699,"children":2700},{},[2701],{"type":48,"value":2702},"Patch introduced invalid states",{"type":42,"tag":176,"props":2704,"children":2705},{},[2706],{"type":48,"value":2707},"Review patch for state invariants; consider safer approach",{"type":42,"tag":154,"props":2709,"children":2710},{},[2711,2716,2721],{"type":42,"tag":176,"props":2712,"children":2713},{},[2714],{"type":48,"value":2715},"Can't reproduce production bugs",{"type":42,"tag":176,"props":2717,"children":2718},{},[2719],{"type":48,"value":2720},"Build differences too large",{"type":42,"tag":176,"props":2722,"children":2723},{},[2724],{"type":48,"value":2725},"Minimize patches; keep validation for state-critical checks",{"type":42,"tag":57,"props":2727,"children":2729},{"id":2728},"related-skills",[2730],{"type":48,"value":2731},"Related Skills",{"type":42,"tag":139,"props":2733,"children":2735},{"id":2734},"tools-that-use-this-technique",[2736],{"type":48,"value":2737},"Tools That Use This Technique",{"type":42,"tag":146,"props":2739,"children":2740},{},[2741,2757],{"type":42,"tag":150,"props":2742,"children":2743},{},[2744],{"type":42,"tag":154,"props":2745,"children":2746},{},[2747,2752],{"type":42,"tag":158,"props":2748,"children":2749},{},[2750],{"type":48,"value":2751},"Skill",{"type":42,"tag":158,"props":2753,"children":2754},{},[2755],{"type":48,"value":2756},"How It Applies",{"type":42,"tag":169,"props":2758,"children":2759},{},[2760,2782,2798,2813],{"type":42,"tag":154,"props":2761,"children":2762},{},[2763,2770],{"type":42,"tag":176,"props":2764,"children":2765},{},[2766],{"type":42,"tag":106,"props":2767,"children":2768},{},[2769],{"type":48,"value":1959},{"type":42,"tag":176,"props":2771,"children":2772},{},[2773,2775,2780],{"type":48,"value":2774},"Defines ",{"type":42,"tag":361,"props":2776,"children":2778},{"className":2777},[],[2779],{"type":48,"value":1660},{"type":48,"value":2781}," automatically",{"type":42,"tag":154,"props":2783,"children":2784},{},[2785,2793],{"type":42,"tag":176,"props":2786,"children":2787},{},[2788],{"type":42,"tag":106,"props":2789,"children":2790},{},[2791],{"type":48,"value":2792},"aflpp",{"type":42,"tag":176,"props":2794,"children":2795},{},[2796],{"type":48,"value":2797},"Supports the macro via compiler wrappers",{"type":42,"tag":154,"props":2799,"children":2800},{},[2801,2808],{"type":42,"tag":176,"props":2802,"children":2803},{},[2804],{"type":42,"tag":106,"props":2805,"children":2806},{},[2807],{"type":48,"value":2258},{"type":42,"tag":176,"props":2809,"children":2810},{},[2811],{"type":48,"value":2812},"Uses the macro for conditional compilation",{"type":42,"tag":154,"props":2814,"children":2815},{},[2816,2824],{"type":42,"tag":176,"props":2817,"children":2818},{},[2819],{"type":42,"tag":106,"props":2820,"children":2821},{},[2822],{"type":48,"value":2823},"cargo-fuzz",{"type":42,"tag":176,"props":2825,"children":2826},{},[2827,2829,2834],{"type":48,"value":2828},"Sets ",{"type":42,"tag":361,"props":2830,"children":2832},{"className":2831},[],[2833],{"type":48,"value":375},{"type":48,"value":2835}," for Rust conditional compilation",{"type":42,"tag":139,"props":2837,"children":2839},{"id":2838},"related-techniques",[2840],{"type":48,"value":2841},"Related Techniques",{"type":42,"tag":146,"props":2843,"children":2844},{},[2845,2860],{"type":42,"tag":150,"props":2846,"children":2847},{},[2848],{"type":42,"tag":154,"props":2849,"children":2850},{},[2851,2855],{"type":42,"tag":158,"props":2852,"children":2853},{},[2854],{"type":48,"value":2751},{"type":42,"tag":158,"props":2856,"children":2857},{},[2858],{"type":48,"value":2859},"Relationship",{"type":42,"tag":169,"props":2861,"children":2862},{},[2863,2879,2895,2911],{"type":42,"tag":154,"props":2864,"children":2865},{},[2866,2874],{"type":42,"tag":176,"props":2867,"children":2868},{},[2869],{"type":42,"tag":106,"props":2870,"children":2871},{},[2872],{"type":48,"value":2873},"fuzz-harness-writing",{"type":42,"tag":176,"props":2875,"children":2876},{},[2877],{"type":48,"value":2878},"Better harnesses may avoid obstacles; patching enables deeper exploration",{"type":42,"tag":154,"props":2880,"children":2881},{},[2882,2890],{"type":42,"tag":176,"props":2883,"children":2884},{},[2885],{"type":42,"tag":106,"props":2886,"children":2887},{},[2888],{"type":48,"value":2889},"coverage-analysis",{"type":42,"tag":176,"props":2891,"children":2892},{},[2893],{"type":48,"value":2894},"Use coverage to identify obstacles and measure patch effectiveness",{"type":42,"tag":154,"props":2896,"children":2897},{},[2898,2906],{"type":42,"tag":176,"props":2899,"children":2900},{},[2901],{"type":42,"tag":106,"props":2902,"children":2903},{},[2904],{"type":48,"value":2905},"corpus-seeding",{"type":42,"tag":176,"props":2907,"children":2908},{},[2909],{"type":48,"value":2910},"Seed corpus can help overcome obstacles without patching",{"type":42,"tag":154,"props":2912,"children":2913},{},[2914,2922],{"type":42,"tag":176,"props":2915,"children":2916},{},[2917],{"type":42,"tag":106,"props":2918,"children":2919},{},[2920],{"type":48,"value":2921},"dictionary-generation",{"type":42,"tag":176,"props":2923,"children":2924},{},[2925],{"type":48,"value":2926},"Dictionaries help with magic bytes but not checksums or complex validation",{"type":42,"tag":57,"props":2928,"children":2930},{"id":2929},"resources",[2931],{"type":48,"value":2932},"Resources",{"type":42,"tag":139,"props":2934,"children":2936},{"id":2935},"key-external-resources",[2937],{"type":48,"value":2938},"Key External Resources",{"type":42,"tag":51,"props":2940,"children":2941},{},[2942,2952,2954,2959],{"type":42,"tag":106,"props":2943,"children":2944},{},[2945],{"type":42,"tag":1664,"props":2946,"children":2949},{"href":2947,"rel":2948},"https:\u002F\u002Fgithub.com\u002Fopenssl\u002Fopenssl\u002Ftree\u002Fmaster\u002Ffuzz",[1668],[2950],{"type":48,"value":2951},"OpenSSL Fuzzing Documentation",{"type":48,"value":2953},"\nOpenSSL's fuzzing infrastructure demonstrates large-scale use of ",{"type":42,"tag":361,"props":2955,"children":2957},{"className":2956},[],[2958],{"type":48,"value":1660},{"type":48,"value":2960},". The project uses this macro to modify cryptographic validation, certificate parsing, and other security-critical code paths to enable deeper fuzzing while maintaining production correctness.",{"type":42,"tag":51,"props":2962,"children":2963},{},[2964,2974],{"type":42,"tag":106,"props":2965,"children":2966},{},[2967],{"type":42,"tag":1664,"props":2968,"children":2971},{"href":2969,"rel":2970},"https:\u002F\u002Fllvm.org\u002Fdocs\u002FLibFuzzer.html",[1668],[2972],{"type":48,"value":2973},"LibFuzzer Documentation on Flags",{"type":48,"value":2975},"\nOfficial LLVM documentation for libFuzzer, including how the fuzzer defines compiler macros and how to use them effectively. Covers integration with sanitizers and coverage instrumentation.",{"type":42,"tag":51,"props":2977,"children":2978},{},[2979,2989,2991,2996,2998,3004],{"type":42,"tag":106,"props":2980,"children":2981},{},[2982],{"type":42,"tag":1664,"props":2983,"children":2986},{"href":2984,"rel":2985},"https:\u002F\u002Fdoc.rust-lang.org\u002Freference\u002Fconditional-compilation.html",[1668],[2987],{"type":48,"value":2988},"Rust cfg Attribute Reference",{"type":48,"value":2990},"\nComplete reference for Rust conditional compilation, including ",{"type":42,"tag":361,"props":2992,"children":2994},{"className":2993},[],[2995],{"type":48,"value":375},{"type":48,"value":2997}," and ",{"type":42,"tag":361,"props":2999,"children":3001},{"className":3000},[],[3002],{"type":48,"value":3003},"cfg!(test)",{"type":48,"value":3005},". Explains compile-time vs. runtime conditional compilation and best practices.",{"type":42,"tag":3007,"props":3008,"children":3009},"style",{},[3010],{"type":48,"value":3011},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3013,"total":3106},[3014,3029,3038,3058,3073,3084,3096],{"slug":3015,"name":3015,"fn":3016,"description":3017,"org":3018,"tags":3019,"stars":23,"repoUrl":24,"updatedAt":3028},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3020,3023,3026,3027],{"name":3021,"slug":3022,"type":16},"C#","c",{"name":3024,"slug":3025,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:14.925095",{"slug":2792,"name":2792,"fn":3030,"description":3031,"org":3032,"tags":3033,"stars":23,"repoUrl":24,"updatedAt":3037},"perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3034,3035,3036],{"name":3021,"slug":3022,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:12.433192",{"slug":3039,"name":3039,"fn":3040,"description":3041,"org":3042,"tags":3043,"stars":23,"repoUrl":24,"updatedAt":3057},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3044,3047,3050,3053,3056],{"name":3045,"slug":3046,"type":16},"Agents","agents",{"name":3048,"slug":3049,"type":16},"CI\u002FCD","ci-cd",{"name":3051,"slug":3052,"type":16},"Code Analysis","code-analysis",{"name":3054,"slug":3055,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":3059,"name":3059,"fn":3060,"description":3061,"org":3062,"tags":3063,"stars":23,"repoUrl":24,"updatedAt":3072},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3064,3067,3068,3069],{"name":3065,"slug":3066,"type":16},"Audit","audit",{"name":3051,"slug":3052,"type":16},{"name":14,"slug":15,"type":16},{"name":3070,"slug":3071,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":3074,"name":3074,"fn":3075,"description":3076,"org":3077,"tags":3078,"stars":23,"repoUrl":24,"updatedAt":3083},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3079,3080],{"name":18,"slug":19,"type":16},{"name":3081,"slug":3082,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":3085,"name":3085,"fn":3086,"description":3087,"org":3088,"tags":3089,"stars":23,"repoUrl":24,"updatedAt":3095},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3090,3093,3094],{"name":3091,"slug":3092,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:14.575191",{"slug":3097,"name":3097,"fn":3098,"description":3099,"org":3100,"tags":3101,"stars":23,"repoUrl":24,"updatedAt":3105},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3102,3103,3104],{"name":3065,"slug":3066,"type":16},{"name":3051,"slug":3052,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",77,{"items":3108,"total":3212},[3109,3116,3122,3130,3137,3142,3148,3154,3167,3178,3190,3201],{"slug":3015,"name":3015,"fn":3016,"description":3017,"org":3110,"tags":3111,"stars":23,"repoUrl":24,"updatedAt":3028},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3112,3113,3114,3115],{"name":3021,"slug":3022,"type":16},{"name":3024,"slug":3025,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":2792,"name":2792,"fn":3030,"description":3031,"org":3117,"tags":3118,"stars":23,"repoUrl":24,"updatedAt":3037},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3119,3120,3121],{"name":3021,"slug":3022,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":3039,"name":3039,"fn":3040,"description":3041,"org":3123,"tags":3124,"stars":23,"repoUrl":24,"updatedAt":3057},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3125,3126,3127,3128,3129],{"name":3045,"slug":3046,"type":16},{"name":3048,"slug":3049,"type":16},{"name":3051,"slug":3052,"type":16},{"name":3054,"slug":3055,"type":16},{"name":14,"slug":15,"type":16},{"slug":3059,"name":3059,"fn":3060,"description":3061,"org":3131,"tags":3132,"stars":23,"repoUrl":24,"updatedAt":3072},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3133,3134,3135,3136],{"name":3065,"slug":3066,"type":16},{"name":3051,"slug":3052,"type":16},{"name":14,"slug":15,"type":16},{"name":3070,"slug":3071,"type":16},{"slug":3074,"name":3074,"fn":3075,"description":3076,"org":3138,"tags":3139,"stars":23,"repoUrl":24,"updatedAt":3083},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3140,3141],{"name":18,"slug":19,"type":16},{"name":3081,"slug":3082,"type":16},{"slug":3085,"name":3085,"fn":3086,"description":3087,"org":3143,"tags":3144,"stars":23,"repoUrl":24,"updatedAt":3095},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3145,3146,3147],{"name":3091,"slug":3092,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":3097,"name":3097,"fn":3098,"description":3099,"org":3149,"tags":3150,"stars":23,"repoUrl":24,"updatedAt":3105},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3151,3152,3153],{"name":3065,"slug":3066,"type":16},{"name":3051,"slug":3052,"type":16},{"name":14,"slug":15,"type":16},{"slug":3155,"name":3155,"fn":3156,"description":3157,"org":3158,"tags":3159,"stars":23,"repoUrl":24,"updatedAt":3166},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3160,3163,3164,3165],{"name":3161,"slug":3162,"type":16},"Architecture","architecture",{"name":3065,"slug":3066,"type":16},{"name":3051,"slug":3052,"type":16},{"name":18,"slug":19,"type":16},"2026-07-18T05:47:40.122449",{"slug":3168,"name":3168,"fn":3169,"description":3170,"org":3171,"tags":3172,"stars":23,"repoUrl":24,"updatedAt":3177},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3173,3174,3175,3176],{"name":3065,"slug":3066,"type":16},{"name":3051,"slug":3052,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":3179,"name":3179,"fn":3180,"description":3181,"org":3182,"tags":3183,"stars":23,"repoUrl":24,"updatedAt":3189},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3184,3185,3188],{"name":3065,"slug":3066,"type":16},{"name":3186,"slug":3187,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":3191,"name":3191,"fn":3192,"description":3193,"org":3194,"tags":3195,"stars":23,"repoUrl":24,"updatedAt":3200},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3196,3197,3198,3199],{"name":3065,"slug":3066,"type":16},{"name":3021,"slug":3022,"type":16},{"name":3051,"slug":3052,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":3202,"name":3202,"fn":3203,"description":3204,"org":3205,"tags":3206,"stars":23,"repoUrl":24,"updatedAt":3211},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3207,3208,3209,3210],{"name":3065,"slug":3066,"type":16},{"name":3051,"slug":3052,"type":16},{"name":14,"slug":15,"type":16},{"name":3070,"slug":3071,"type":16},"2026-07-18T05:47:42.84568",111]