[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-harness-writing":3,"mdc--7h1snr-key":35,"related-org-trail-of-bits-harness-writing":4444,"related-repo-trail-of-bits-harness-writing":4595},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":30,"sourceUrl":33,"mdContent":34},"harness-writing","write effective fuzzing harnesses","Techniques for writing effective fuzzing harnesses across languages. Use when creating new fuzz targets or improving existing harness code.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Engineering","engineering",{"name":21,"slug":22,"type":16},"Testing","testing",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-17T06:05:22.473302",null,541,[29],"agent-skills",{"repoUrl":24,"stars":23,"forks":27,"topics":31,"description":32},[29],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Ftesting-handbook-skills\u002Fskills\u002Fharness-writing","---\nname: harness-writing\ntype: technique\ndescription: >\n Techniques for writing effective fuzzing harnesses across languages.\n Use when creating new fuzz targets or improving existing harness code.\n---\n\n# Writing Fuzzing Harnesses\n\nA fuzzing harness is the entrypoint function that receives random data from the fuzzer and routes it to your system under test (SUT). The quality of your harness directly determines which code paths get exercised and whether critical bugs are found. A poorly written harness can miss entire subsystems or produce non-reproducible crashes.\n\n## Overview\n\nThe harness is the bridge between the fuzzer's random byte generation and your application's API. It must parse raw bytes into meaningful inputs, call target functions, and handle edge cases gracefully. The most important part of any fuzzing setup is the harness—if written poorly, critical parts of your application may not be covered.\n\n### Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Harness** | Function that receives fuzzer input and calls target code under test |\n| **SUT** | System Under Test—the code being fuzzed |\n| **Entry point** | Function signature required by the fuzzer (e.g., `LLVMFuzzerTestOneInput`) |\n| **FuzzedDataProvider** | Helper class for structured extraction of typed data from raw bytes |\n| **Determinism** | Property that ensures same input always produces same behavior |\n| **Interleaved fuzzing** | Single harness that exercises multiple operations based on input |\n\n## When to Apply\n\n**Apply this technique when:**\n- Creating a new fuzz target for the first time\n- Fuzz campaign has low code coverage or isn't finding bugs\n- Crashes found during fuzzing are not reproducible\n- Target API requires complex or structured inputs\n- Multiple related functions should be tested together\n\n**Skip this technique when:**\n- Using existing well-tested harnesses from your project\n- Tool provides automatic harness generation that meets your needs\n- Target already has comprehensive fuzzing infrastructure\n\n## Quick Reference\n\n| Task | Pattern |\n|------|---------|\n| Minimal C++ harness | `extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)` |\n| Minimal Rust harness | `fuzz_target!(|data: &[u8]| { ... })` |\n| Size validation | `if (size \u003C MIN_SIZE) return 0;` |\n| Cast to integers | `uint32_t val = *(uint32_t*)(data);` |\n| Use FuzzedDataProvider | `FuzzedDataProvider fuzzed_data(data, size);` |\n| Extract typed data (C++) | `auto val = fuzzed_data.ConsumeIntegral\u003Cuint32_t>();` |\n| Extract string (C++) | `auto str = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);` |\n\n## Step-by-Step\n\n### Step 1: Identify Entry Points\n\nFind functions in your codebase that:\n- Accept external input (parsers, validators, protocol handlers)\n- Parse complex data formats (JSON, XML, binary protocols)\n- Perform security-critical operations (authentication, cryptography)\n- Have high cyclomatic complexity or many branches\n\nGood targets are typically:\n- Protocol parsers\n- File format parsers\n- Serialization\u002Fdeserialization functions\n- Input validation routines\n\n### Step 2: Write Minimal Harness\n\nStart with the simplest possible harness that calls your target function:\n\n**C\u002FC++:**\n```cpp\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n target_function(data, size);\n return 0;\n}\n```\n\n**Rust:**\n```rust\n#![no_main]\nuse libfuzzer_sys::fuzz_target;\n\nfuzz_target!(|data: &[u8]| {\n target_function(data);\n});\n```\n\n### Step 3: Add Input Validation\n\nReject inputs that are too small or too large to be meaningful:\n\n```cpp\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n \u002F\u002F Ensure minimum size for meaningful input\n if (size \u003C MIN_INPUT_SIZE || size > MAX_INPUT_SIZE) {\n return 0;\n }\n target_function(data, size);\n return 0;\n}\n```\n\n**Rationale:** The fuzzer generates random inputs of all sizes. Your harness must handle empty, tiny, huge, or malformed inputs without causing unexpected issues in the harness itself (crashes in the SUT are fine—that's what we're looking for).\n\n### Step 4: Structure the Input\n\nFor APIs that require typed data (integers, strings, etc.), use casting or helpers like `FuzzedDataProvider`:\n\n**Simple casting:**\n```cpp\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n if (size != 2 * sizeof(uint32_t)) {\n return 0;\n }\n\n uint32_t numerator = *(uint32_t*)(data);\n uint32_t denominator = *(uint32_t*)(data + sizeof(uint32_t));\n\n divide(numerator, denominator);\n return 0;\n}\n```\n\n**Using FuzzedDataProvider:**\n```cpp\n#include \"FuzzedDataProvider.h\"\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n FuzzedDataProvider fuzzed_data(data, size);\n\n size_t allocation_size = fuzzed_data.ConsumeIntegral\u003Csize_t>();\n std::vector\u003Cchar> str1 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n std::vector\u003Cchar> str2 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n\n concat(&str1[0], str1.size(), &str2[0], str2.size(), allocation_size);\n return 0;\n}\n```\n\n### Step 5: Test and Iterate\n\nRun the fuzzer and monitor:\n- Code coverage (are all interesting paths reached?)\n- Executions per second (is it fast enough?)\n- Crash reproducibility (can you reproduce crashes with saved inputs?)\n\nIterate on the harness to improve these metrics.\n\n## Common Patterns\n\n### Pattern: Beyond Byte Arrays—Casting to Integers\n\n**Use Case:** When target expects primitive types like integers or floats\n\n**Implementation:**\n```cpp\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n \u002F\u002F Ensure exactly 2 4-byte numbers\n if (size != 2 * sizeof(uint32_t)) {\n return 0;\n }\n\n \u002F\u002F Split input into two integers\n uint32_t numerator = *(uint32_t*)(data);\n uint32_t denominator = *(uint32_t*)(data + sizeof(uint32_t));\n\n divide(numerator, denominator);\n return 0;\n}\n```\n\n**Rust equivalent:**\n```rust\nfuzz_target!(|data: &[u8]| {\n if data.len() != 2 * std::mem::size_of::\u003Ci32>() {\n return;\n }\n\n let numerator = i32::from_ne_bytes([data[0], data[1], data[2], data[3]]);\n let denominator = i32::from_ne_bytes([data[4], data[5], data[6], data[7]]);\n\n divide(numerator, denominator);\n});\n```\n\n**Why it works:** Any 8-byte input is valid. The fuzzer learns that inputs must be exactly 8 bytes, and every bit flip produces a new, potentially interesting input.\n\n### Pattern: FuzzedDataProvider for Complex Inputs\n\n**Use Case:** When target requires multiple strings, integers, or variable-length data\n\n**Implementation:**\n```cpp\n#include \"FuzzedDataProvider.h\"\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n FuzzedDataProvider fuzzed_data(data, size);\n\n \u002F\u002F Extract different types of data\n size_t allocation_size = fuzzed_data.ConsumeIntegral\u003Csize_t>();\n\n \u002F\u002F Consume variable-length strings with terminator\n std::vector\u003Cchar> str1 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n std::vector\u003Cchar> str2 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n\n char* result = concat(&str1[0], str1.size(), &str2[0], str2.size(), allocation_size);\n if (result != NULL) {\n free(result);\n }\n\n return 0;\n}\n```\n\n**Why it helps:** `FuzzedDataProvider` handles the complexity of extracting structured data from a byte stream. It's particularly useful for APIs that need multiple parameters of different types.\n\n### Pattern: Interleaved Fuzzing\n\n**Use Case:** When multiple related operations should be tested in a single harness\n\n**Implementation:**\n```cpp\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n if (size \u003C 1 + 2 * sizeof(int32_t)) {\n return 0;\n }\n\n \u002F\u002F First byte selects operation\n uint8_t mode = data[0];\n\n \u002F\u002F Next bytes are operands\n int32_t numbers[2];\n memcpy(numbers, data + 1, 2 * sizeof(int32_t));\n\n int32_t result = 0;\n switch (mode % 4) {\n case 0:\n result = add(numbers[0], numbers[1]);\n break;\n case 1:\n result = subtract(numbers[0], numbers[1]);\n break;\n case 2:\n result = multiply(numbers[0], numbers[1]);\n break;\n case 3:\n result = divide(numbers[0], numbers[1]);\n break;\n }\n\n \u002F\u002F Prevent compiler from optimizing away the calls\n printf(\"%d\", result);\n return 0;\n}\n```\n\n**Advantages:**\n- Faster to write one harness than multiple individual harnesses\n- Single shared corpus means interesting inputs for one operation may be interesting for others\n- Can discover bugs in interactions between operations\n\n**When to use:**\n- Operations share similar input types\n- Operations are logically related (e.g., arithmetic operations, CRUD operations)\n- Single corpus makes sense across all operations\n\n### Pattern: Structure-Aware Fuzzing with Arbitrary (Rust)\n\n**Use Case:** When fuzzing Rust code that uses custom structs\n\n**Implementation:**\n```rust\nuse arbitrary::Arbitrary;\n\n#[derive(Debug, Arbitrary)]\npub struct Name {\n data: String\n}\n\nimpl Name {\n pub fn check_buf(&self) {\n let data = self.data.as_bytes();\n if data.len() > 0 && data[0] == b'a' {\n if data.len() > 1 && data[1] == b'b' {\n if data.len() > 2 && data[2] == b'c' {\n process::abort();\n }\n }\n }\n }\n}\n```\n\n**Harness with arbitrary:**\n```rust\n#![no_main]\nuse libfuzzer_sys::fuzz_target;\n\nfuzz_target!(|data: your_project::Name| {\n data.check_buf();\n});\n```\n\n**Add to Cargo.toml:**\n```toml\n[dependencies]\narbitrary = { version = \"1\", features = [\"derive\"] }\n```\n\n**Why it helps:** The `arbitrary` crate automatically handles deserialization of raw bytes into your Rust structs, reducing boilerplate and ensuring valid struct construction.\n\n**Limitation:** The arbitrary crate doesn't offer reverse serialization, so you can't manually construct byte arrays that map to specific structs. This works best when starting from an empty corpus (fine for libFuzzer, problematic for AFL++).\n\n## Advanced Usage\n\n### Tips and Tricks\n\n| Tip | Why It Helps |\n|-----|--------------|\n| **Start with parsers** | High bug density, clear entry points, easy to harness |\n| **Mock I\u002FO operations** | Prevents hangs from blocking I\u002FO, enables determinism |\n| **Use FuzzedDataProvider** | Simplifies extraction of structured data from raw bytes |\n| **Reset global state** | Ensures each iteration is independent and reproducible |\n| **Free resources in harness** | Prevents memory exhaustion during long campaigns |\n| **Avoid logging in harness** | Logging is slow—fuzzing needs 100s-1000s exec\u002Fsec |\n| **Test harness manually first** | Run harness with known inputs before starting campaign |\n| **Check coverage early** | Ensure harness reaches expected code paths |\n\n### Structure-Aware Fuzzing with Protocol Buffers\n\nFor highly structured input formats, consider using Protocol Buffers as an intermediate format with custom mutators:\n\n```cpp\n\u002F\u002F Define your input format in .proto file\n\u002F\u002F Use libprotobuf-mutator to generate valid mutations\n\u002F\u002F This ensures fuzzer mutates message contents, not the protobuf encoding itself\n```\n\nThis approach is more setup but prevents the fuzzer from wasting time on unparseable inputs. See [structure-aware fuzzing documentation](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Fdocs\u002Fstructure-aware-fuzzing.md) for details.\n\n### Handling Non-Determinism\n\n**Problem:** Random values or timing dependencies cause non-reproducible crashes.\n\n**Solutions:**\n- Replace `rand()` with deterministic PRNG seeded from fuzzer input:\n ```cpp\n uint32_t seed = fuzzed_data.ConsumeIntegral\u003Cuint32_t>();\n srand(seed);\n ```\n- Mock system calls that return time, PIDs, or random data\n- Avoid reading from `\u002Fdev\u002Frandom` or `\u002Fdev\u002Furandom`\n\n### Resetting Global State\n\nIf your SUT uses global state (singletons, static variables), reset it between iterations:\n\n```cpp\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n \u002F\u002F Reset global state before each iteration\n global_reset();\n\n target_function(data, size);\n\n \u002F\u002F Clean up resources\n global_cleanup();\n return 0;\n}\n```\n\n**Rationale:** Global state can cause crashes after N iterations rather than on a specific input, making bugs non-reproducible.\n\n## Practical Harness Rules\n\nFollow these rules to ensure effective fuzzing harnesses:\n\n| Rule | Rationale |\n|------|-----------|\n| **Handle all input sizes** | Fuzzer generates empty, tiny, huge inputs—harness must handle gracefully |\n| **Never call `exit()`** | Calling `exit()` stops the fuzzer process. Use `abort()` in SUT if needed |\n| **Join all threads** | Each iteration must run to completion before next iteration starts |\n| **Be fast** | Aim for 100s-1000s executions\u002Fsec. Avoid logging, high complexity, excess memory |\n| **Maintain determinism** | Same input must always produce same behavior for reproducibility |\n| **Avoid global state** | Global state reduces reproducibility—reset between iterations if unavoidable |\n| **Use narrow targets** | Don't fuzz PNG and TCP in same harness—different formats need separate targets |\n| **Free resources** | Prevent memory leaks that cause resource exhaustion during long campaigns |\n\n**Note:** These guidelines apply not just to harness code, but to the entire SUT. If the SUT violates these rules, consider patching it (see the fuzzing obstacles technique).\n\n## Anti-Patterns\n\n| Anti-Pattern | Problem | Correct Approach |\n|--------------|---------|------------------|\n| **Global state without reset** | Non-deterministic crashes | Reset all globals at start of harness |\n| **Blocking I\u002FO or network calls** | Hangs fuzzer, wastes time | Mock I\u002FO, use in-memory buffers |\n| **Memory leaks in harness** | Resource exhaustion kills campaign | Free all allocations before returning |\n| **Calling `exit()` in SUT** | Stops entire fuzzing process | Use `abort()` or return error codes |\n| **Heavy logging in harness** | Reduces exec\u002Fsec by orders of magnitude | Disable logging during fuzzing |\n| **Too many operations per iteration** | Slows down fuzzer | Keep iterations fast and focused |\n| **Mixing unrelated input formats** | Corpus entries not useful across formats | Separate harnesses for different formats |\n| **Not validating input size** | Harness crashes on edge cases | Check `size` before accessing `data` |\n\n## Tool-Specific Guidance\n\n### libFuzzer\n\n**Harness signature:**\n```cpp\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n \u002F\u002F Your code here\n return 0; \u002F\u002F Non-zero return is reserved for future use\n}\n```\n\n**Compilation:**\n```bash\nclang++ -fsanitize=fuzzer,address -g harness.cc -o fuzz_target\n```\n\n**Integration tips:**\n- Use `FuzzedDataProvider.h` for structured input extraction\n- Compile with `-fsanitize=fuzzer` to link the fuzzing runtime\n- Add sanitizers (`-fsanitize=address,undefined`) to detect more bugs\n- Use `-g` for better stack traces when crashes occur\n- libFuzzer can start with empty corpus—no seed inputs required\n\n**Running:**\n```bash\n.\u002Ffuzz_target corpus_dir\u002F\n```\n\n**Resources:**\n- [FuzzedDataProvider header](https:\u002F\u002Fgithub.com\u002Fllvm\u002Fllvm-project\u002Fblob\u002Fmain\u002Fcompiler-rt\u002Finclude\u002Ffuzzer\u002FFuzzedDataProvider.h)\n- [libFuzzer documentation](https:\u002F\u002Fllvm.org\u002Fdocs\u002FLibFuzzer.html)\n\n### AFL++\n\nAFL++ supports multiple harness styles. For best performance, use persistent mode:\n\n**Persistent mode harness:**\n```cpp\n#include \u003Cunistd.h>\n\nint main(int argc, char **argv) {\n #ifdef __AFL_HAVE_MANUAL_CONTROL\n __AFL_INIT();\n #endif\n\n unsigned char buf[MAX_SIZE];\n\n while (__AFL_LOOP(10000)) {\n \u002F\u002F Read input from stdin\n ssize_t len = read(0, buf, sizeof(buf));\n if (len \u003C= 0) break;\n\n \u002F\u002F Call target function\n target_function(buf, len);\n }\n\n return 0;\n}\n```\n\n**Compilation:**\n```bash\nafl-clang-fast++ -g harness.cc -o fuzz_target\n```\n\n**Integration tips:**\n- Use persistent mode (`__AFL_LOOP`) for 10-100x speedup\n- Consider deferred initialization (`__AFL_INIT()`) to skip setup overhead\n- AFL++ requires at least one seed input in the corpus directory\n- Use `AFL_USE_ASAN=1` or `AFL_USE_UBSAN=1` for sanitizer builds\n\n**Running:**\n```bash\nafl-fuzz -i seeds\u002F -o findings\u002F -- .\u002Ffuzz_target\n```\n\n### cargo-fuzz (Rust)\n\n**Harness signature:**\n```rust\n#![no_main]\nuse libfuzzer_sys::fuzz_target;\n\nfuzz_target!(|data: &[u8]| {\n \u002F\u002F Your code here\n});\n```\n\n**With structured input (arbitrary crate):**\n```rust\n#![no_main]\nuse libfuzzer_sys::fuzz_target;\n\nfuzz_target!(|data: YourStruct| {\n data.check();\n});\n```\n\n**Creating harness:**\n```bash\ncargo fuzz init\ncargo fuzz add my_target\n```\n\n**Integration tips:**\n- Use `arbitrary` crate for automatic struct deserialization\n- cargo-fuzz wraps libFuzzer, so all libFuzzer features work\n- Compile with sanitizers automatically via cargo-fuzz\n- Harnesses go in `fuzz\u002Ffuzz_targets\u002F` directory\n\n**Running:**\n```bash\ncargo +nightly fuzz run my_target\n```\n\n**Resources:**\n- [cargo-fuzz documentation](https:\u002F\u002Frust-fuzz.github.io\u002Fbook\u002Fcargo-fuzz.html)\n- [arbitrary crate](https:\u002F\u002Fgithub.com\u002Frust-fuzz\u002Farbitrary)\n\n### go-fuzz\n\n**Harness signature:**\n```go\n\u002F\u002F +build gofuzz\n\npackage mypackage\n\nfunc Fuzz(data []byte) int {\n \u002F\u002F Call target function\n target(data)\n\n \u002F\u002F Return codes:\n \u002F\u002F -1 if input is invalid\n \u002F\u002F 0 if input is valid but not interesting\n \u002F\u002F 1 if input is interesting (e.g., added new coverage)\n return 0\n}\n```\n\n**Building:**\n```bash\ngo-fuzz-build\n```\n\n**Integration tips:**\n- Return 1 for inputs that add coverage (optional—fuzzer can detect automatically)\n- Return -1 for invalid inputs to deprioritize similar mutations\n- go-fuzz handles persistence automatically\n\n**Running:**\n```bash\ngo-fuzz -bin=.\u002Fmypackage-fuzz.zip -workdir=fuzz\n```\n\n## Troubleshooting\n\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| **Low executions\u002Fsec** | Harness is too slow (logging, I\u002FO, complexity) | Profile harness, remove bottlenecks, mock I\u002FO |\n| **No crashes found** | Coverage not reaching buggy code | Check coverage, improve harness to reach more paths |\n| **Non-reproducible crashes** | Non-determinism or global state | Remove randomness, reset globals between iterations |\n| **Fuzzer exits immediately** | Harness calls `exit()` | Replace `exit()` with `abort()` or return error |\n| **Out of memory errors** | Memory leaks in harness or SUT | Free allocations, use leak sanitizer to find leaks |\n| **Crashes on empty input** | Harness doesn't validate size | Add `if (size \u003C MIN_SIZE) return 0;` |\n| **Corpus not growing** | Inputs too constrained or format too strict | Use FuzzedDataProvider or structure-aware fuzzing |\n\n## Related Skills\n\n### Tools That Use This Technique\n\n| Skill | How It Applies |\n|-------|----------------|\n| **libfuzzer** | Uses `LLVMFuzzerTestOneInput` harness signature with FuzzedDataProvider |\n| **aflpp** | Supports persistent mode harnesses with `__AFL_LOOP` for performance |\n| **cargo-fuzz** | Uses Rust-specific `fuzz_target!` macro with arbitrary crate integration |\n| **atheris** | Python harness takes bytes, calls Python functions |\n| **ossfuzz** | Requires harnesses in specific directory structure for cloud fuzzing |\n\n### Related Techniques\n\n| Skill | Relationship |\n|-------|--------------|\n| **coverage-analysis** | Measure harness effectiveness—are you reaching target code? |\n| **address-sanitizer** | Detects bugs found by harness (buffer overflows, use-after-free) |\n| **fuzzing-dictionary** | Provide tokens to help fuzzer pass format checks in harness |\n| **fuzzing-obstacles** | Patch SUT when it violates harness rules (exit, non-determinism) |\n\n## Resources\n\n### Key External Resources\n\n**[Split Inputs in libFuzzer - Google Fuzzing Docs](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Fdocs\u002Fsplit-inputs.md)**\nExplains techniques for handling multiple input parameters in a single fuzzing harness, including use of magic separators and FuzzedDataProvider.\n\n**[Structure-Aware Fuzzing with Protocol Buffers](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Fdocs\u002Fstructure-aware-fuzzing.md)**\nAdvanced technique using protobuf as intermediate format with custom mutators to ensure fuzzer mutates message contents rather than format encoding.\n\n**[libFuzzer Documentation](https:\u002F\u002Fllvm.org\u002Fdocs\u002FLibFuzzer.html)**\nOfficial LLVM documentation covering harness requirements, best practices, and advanced features.\n\n**[cargo-fuzz Book](https:\u002F\u002Frust-fuzz.github.io\u002Fbook\u002Fcargo-fuzz.html)**\nComprehensive guide to writing Rust fuzzing harnesses with cargo-fuzz and the arbitrary crate.\n\n### Video Resources\n\n- [Effective File Format Fuzzing](https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=qTTwqFRD1H8) - Conference talk on writing harnesses for file format parsers\n- [Modern Fuzzing of C\u002FC++ Projects](https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=x0FQkAPokfE) - Tutorial covering harness design patterns\n",{"data":36,"body":38},{"name":4,"type":37,"description":6},"technique",{"type":39,"children":40},"root",[41,50,56,63,68,75,209,215,223,253,261,279,285,422,428,434,439,462,467,490,496,501,509,558,566,626,632,637,706,716,722,734,742,833,841,939,945,950,968,973,979,985,995,1003,1104,1112,1193,1203,1209,1218,1225,1376,1393,1399,1408,1415,1678,1686,1704,1712,1730,1736,1745,1752,1906,1914,1965,1973,1998,2015,2025,2031,2037,2186,2192,2197,2228,2244,2250,2260,2268,2331,2337,2342,2423,2432,2438,2443,2614,2624,2630,2852,2858,2864,2872,2909,2917,2961,2969,3027,3035,3055,3063,3086,3092,3097,3105,3264,3271,3302,3309,3362,3369,3413,3419,3426,3475,3483,3534,3542,3588,3595,3632,3639,3671,3678,3701,3706,3713,3830,3838,3852,3859,3877,3884,3908,3914,4111,4117,4123,4246,4252,4337,4343,4349,4364,4377,4391,4405,4411,4438],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"writing-fuzzing-harnesses",[47],{"type":48,"value":49},"text","Writing Fuzzing Harnesses",{"type":42,"tag":51,"props":52,"children":53},"p",{},[54],{"type":48,"value":55},"A fuzzing harness is the entrypoint function that receives random data from the fuzzer and routes it to your system under test (SUT). The quality of your harness directly determines which code paths get exercised and whether critical bugs are found. A poorly written harness can miss entire subsystems or produce non-reproducible crashes.",{"type":42,"tag":57,"props":58,"children":60},"h2",{"id":59},"overview",[61],{"type":48,"value":62},"Overview",{"type":42,"tag":51,"props":64,"children":65},{},[66],{"type":48,"value":67},"The harness is the bridge between the fuzzer's random byte generation and your application's API. It must parse raw bytes into meaningful inputs, call target functions, and handle edge cases gracefully. The most important part of any fuzzing setup is the harness—if written poorly, critical parts of your application may not be covered.",{"type":42,"tag":69,"props":70,"children":72},"h3",{"id":71},"key-concepts",[73],{"type":48,"value":74},"Key Concepts",{"type":42,"tag":76,"props":77,"children":78},"table",{},[79,98],{"type":42,"tag":80,"props":81,"children":82},"thead",{},[83],{"type":42,"tag":84,"props":85,"children":86},"tr",{},[87,93],{"type":42,"tag":88,"props":89,"children":90},"th",{},[91],{"type":48,"value":92},"Concept",{"type":42,"tag":88,"props":94,"children":95},{},[96],{"type":48,"value":97},"Description",{"type":42,"tag":99,"props":100,"children":101},"tbody",{},[102,120,136,161,177,193],{"type":42,"tag":84,"props":103,"children":104},{},[105,115],{"type":42,"tag":106,"props":107,"children":108},"td",{},[109],{"type":42,"tag":110,"props":111,"children":112},"strong",{},[113],{"type":48,"value":114},"Harness",{"type":42,"tag":106,"props":116,"children":117},{},[118],{"type":48,"value":119},"Function that receives fuzzer input and calls target code under test",{"type":42,"tag":84,"props":121,"children":122},{},[123,131],{"type":42,"tag":106,"props":124,"children":125},{},[126],{"type":42,"tag":110,"props":127,"children":128},{},[129],{"type":48,"value":130},"SUT",{"type":42,"tag":106,"props":132,"children":133},{},[134],{"type":48,"value":135},"System Under Test—the code being fuzzed",{"type":42,"tag":84,"props":137,"children":138},{},[139,147],{"type":42,"tag":106,"props":140,"children":141},{},[142],{"type":42,"tag":110,"props":143,"children":144},{},[145],{"type":48,"value":146},"Entry point",{"type":42,"tag":106,"props":148,"children":149},{},[150,152,159],{"type":48,"value":151},"Function signature required by the fuzzer (e.g., ",{"type":42,"tag":153,"props":154,"children":156},"code",{"className":155},[],[157],{"type":48,"value":158},"LLVMFuzzerTestOneInput",{"type":48,"value":160},")",{"type":42,"tag":84,"props":162,"children":163},{},[164,172],{"type":42,"tag":106,"props":165,"children":166},{},[167],{"type":42,"tag":110,"props":168,"children":169},{},[170],{"type":48,"value":171},"FuzzedDataProvider",{"type":42,"tag":106,"props":173,"children":174},{},[175],{"type":48,"value":176},"Helper class for structured extraction of typed data from raw bytes",{"type":42,"tag":84,"props":178,"children":179},{},[180,188],{"type":42,"tag":106,"props":181,"children":182},{},[183],{"type":42,"tag":110,"props":184,"children":185},{},[186],{"type":48,"value":187},"Determinism",{"type":42,"tag":106,"props":189,"children":190},{},[191],{"type":48,"value":192},"Property that ensures same input always produces same behavior",{"type":42,"tag":84,"props":194,"children":195},{},[196,204],{"type":42,"tag":106,"props":197,"children":198},{},[199],{"type":42,"tag":110,"props":200,"children":201},{},[202],{"type":48,"value":203},"Interleaved fuzzing",{"type":42,"tag":106,"props":205,"children":206},{},[207],{"type":48,"value":208},"Single harness that exercises multiple operations based on input",{"type":42,"tag":57,"props":210,"children":212},{"id":211},"when-to-apply",[213],{"type":48,"value":214},"When to Apply",{"type":42,"tag":51,"props":216,"children":217},{},[218],{"type":42,"tag":110,"props":219,"children":220},{},[221],{"type":48,"value":222},"Apply this technique when:",{"type":42,"tag":224,"props":225,"children":226},"ul",{},[227,233,238,243,248],{"type":42,"tag":228,"props":229,"children":230},"li",{},[231],{"type":48,"value":232},"Creating a new fuzz target for the first time",{"type":42,"tag":228,"props":234,"children":235},{},[236],{"type":48,"value":237},"Fuzz campaign has low code coverage or isn't finding bugs",{"type":42,"tag":228,"props":239,"children":240},{},[241],{"type":48,"value":242},"Crashes found during fuzzing are not reproducible",{"type":42,"tag":228,"props":244,"children":245},{},[246],{"type":48,"value":247},"Target API requires complex or structured inputs",{"type":42,"tag":228,"props":249,"children":250},{},[251],{"type":48,"value":252},"Multiple related functions should be tested together",{"type":42,"tag":51,"props":254,"children":255},{},[256],{"type":42,"tag":110,"props":257,"children":258},{},[259],{"type":48,"value":260},"Skip this technique when:",{"type":42,"tag":224,"props":262,"children":263},{},[264,269,274],{"type":42,"tag":228,"props":265,"children":266},{},[267],{"type":48,"value":268},"Using existing well-tested harnesses from your project",{"type":42,"tag":228,"props":270,"children":271},{},[272],{"type":48,"value":273},"Tool provides automatic harness generation that meets your needs",{"type":42,"tag":228,"props":275,"children":276},{},[277],{"type":48,"value":278},"Target already has comprehensive fuzzing infrastructure",{"type":42,"tag":57,"props":280,"children":282},{"id":281},"quick-reference",[283],{"type":48,"value":284},"Quick Reference",{"type":42,"tag":76,"props":286,"children":287},{},[288,304],{"type":42,"tag":80,"props":289,"children":290},{},[291],{"type":42,"tag":84,"props":292,"children":293},{},[294,299],{"type":42,"tag":88,"props":295,"children":296},{},[297],{"type":48,"value":298},"Task",{"type":42,"tag":88,"props":300,"children":301},{},[302],{"type":48,"value":303},"Pattern",{"type":42,"tag":99,"props":305,"children":306},{},[307,324,337,354,371,388,405],{"type":42,"tag":84,"props":308,"children":309},{},[310,315],{"type":42,"tag":106,"props":311,"children":312},{},[313],{"type":48,"value":314},"Minimal C++ harness",{"type":42,"tag":106,"props":316,"children":317},{},[318],{"type":42,"tag":153,"props":319,"children":321},{"className":320},[],[322],{"type":48,"value":323},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)",{"type":42,"tag":84,"props":325,"children":326},{},[327,332],{"type":42,"tag":106,"props":328,"children":329},{},[330],{"type":48,"value":331},"Minimal Rust harness",{"type":42,"tag":106,"props":333,"children":334},{},[335],{"type":48,"value":336},"`fuzz_target!(",{"type":42,"tag":84,"props":338,"children":339},{},[340,345],{"type":42,"tag":106,"props":341,"children":342},{},[343],{"type":48,"value":344},"Size validation",{"type":42,"tag":106,"props":346,"children":347},{},[348],{"type":42,"tag":153,"props":349,"children":351},{"className":350},[],[352],{"type":48,"value":353},"if (size \u003C MIN_SIZE) return 0;",{"type":42,"tag":84,"props":355,"children":356},{},[357,362],{"type":42,"tag":106,"props":358,"children":359},{},[360],{"type":48,"value":361},"Cast to integers",{"type":42,"tag":106,"props":363,"children":364},{},[365],{"type":42,"tag":153,"props":366,"children":368},{"className":367},[],[369],{"type":48,"value":370},"uint32_t val = *(uint32_t*)(data);",{"type":42,"tag":84,"props":372,"children":373},{},[374,379],{"type":42,"tag":106,"props":375,"children":376},{},[377],{"type":48,"value":378},"Use FuzzedDataProvider",{"type":42,"tag":106,"props":380,"children":381},{},[382],{"type":42,"tag":153,"props":383,"children":385},{"className":384},[],[386],{"type":48,"value":387},"FuzzedDataProvider fuzzed_data(data, size);",{"type":42,"tag":84,"props":389,"children":390},{},[391,396],{"type":42,"tag":106,"props":392,"children":393},{},[394],{"type":48,"value":395},"Extract typed data (C++)",{"type":42,"tag":106,"props":397,"children":398},{},[399],{"type":42,"tag":153,"props":400,"children":402},{"className":401},[],[403],{"type":48,"value":404},"auto val = fuzzed_data.ConsumeIntegral\u003Cuint32_t>();",{"type":42,"tag":84,"props":406,"children":407},{},[408,413],{"type":42,"tag":106,"props":409,"children":410},{},[411],{"type":48,"value":412},"Extract string (C++)",{"type":42,"tag":106,"props":414,"children":415},{},[416],{"type":42,"tag":153,"props":417,"children":419},{"className":418},[],[420],{"type":48,"value":421},"auto str = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);",{"type":42,"tag":57,"props":423,"children":425},{"id":424},"step-by-step",[426],{"type":48,"value":427},"Step-by-Step",{"type":42,"tag":69,"props":429,"children":431},{"id":430},"step-1-identify-entry-points",[432],{"type":48,"value":433},"Step 1: Identify Entry Points",{"type":42,"tag":51,"props":435,"children":436},{},[437],{"type":48,"value":438},"Find functions in your codebase that:",{"type":42,"tag":224,"props":440,"children":441},{},[442,447,452,457],{"type":42,"tag":228,"props":443,"children":444},{},[445],{"type":48,"value":446},"Accept external input (parsers, validators, protocol handlers)",{"type":42,"tag":228,"props":448,"children":449},{},[450],{"type":48,"value":451},"Parse complex data formats (JSON, XML, binary protocols)",{"type":42,"tag":228,"props":453,"children":454},{},[455],{"type":48,"value":456},"Perform security-critical operations (authentication, cryptography)",{"type":42,"tag":228,"props":458,"children":459},{},[460],{"type":48,"value":461},"Have high cyclomatic complexity or many branches",{"type":42,"tag":51,"props":463,"children":464},{},[465],{"type":48,"value":466},"Good targets are typically:",{"type":42,"tag":224,"props":468,"children":469},{},[470,475,480,485],{"type":42,"tag":228,"props":471,"children":472},{},[473],{"type":48,"value":474},"Protocol parsers",{"type":42,"tag":228,"props":476,"children":477},{},[478],{"type":48,"value":479},"File format parsers",{"type":42,"tag":228,"props":481,"children":482},{},[483],{"type":48,"value":484},"Serialization\u002Fdeserialization functions",{"type":42,"tag":228,"props":486,"children":487},{},[488],{"type":48,"value":489},"Input validation routines",{"type":42,"tag":69,"props":491,"children":493},{"id":492},"step-2-write-minimal-harness",[494],{"type":48,"value":495},"Step 2: Write Minimal Harness",{"type":42,"tag":51,"props":497,"children":498},{},[499],{"type":48,"value":500},"Start with the simplest possible harness that calls your target function:",{"type":42,"tag":51,"props":502,"children":503},{},[504],{"type":42,"tag":110,"props":505,"children":506},{},[507],{"type":48,"value":508},"C\u002FC++:",{"type":42,"tag":510,"props":511,"children":516},"pre",{"className":512,"code":513,"language":514,"meta":515,"style":515},"language-cpp shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n target_function(data, size);\n return 0;\n}\n","cpp","",[517],{"type":42,"tag":153,"props":518,"children":519},{"__ignoreMap":515},[520,531,540,549],{"type":42,"tag":521,"props":522,"children":525},"span",{"class":523,"line":524},"line",1,[526],{"type":42,"tag":521,"props":527,"children":528},{},[529],{"type":48,"value":530},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n",{"type":42,"tag":521,"props":532,"children":534},{"class":523,"line":533},2,[535],{"type":42,"tag":521,"props":536,"children":537},{},[538],{"type":48,"value":539}," target_function(data, size);\n",{"type":42,"tag":521,"props":541,"children":543},{"class":523,"line":542},3,[544],{"type":42,"tag":521,"props":545,"children":546},{},[547],{"type":48,"value":548}," return 0;\n",{"type":42,"tag":521,"props":550,"children":552},{"class":523,"line":551},4,[553],{"type":42,"tag":521,"props":554,"children":555},{},[556],{"type":48,"value":557},"}\n",{"type":42,"tag":51,"props":559,"children":560},{},[561],{"type":42,"tag":110,"props":562,"children":563},{},[564],{"type":48,"value":565},"Rust:",{"type":42,"tag":510,"props":567,"children":571},{"className":568,"code":569,"language":570,"meta":515,"style":515},"language-rust shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","#![no_main]\nuse libfuzzer_sys::fuzz_target;\n\nfuzz_target!(|data: &[u8]| {\n target_function(data);\n});\n","rust",[572],{"type":42,"tag":153,"props":573,"children":574},{"__ignoreMap":515},[575,583,591,600,608,617],{"type":42,"tag":521,"props":576,"children":577},{"class":523,"line":524},[578],{"type":42,"tag":521,"props":579,"children":580},{},[581],{"type":48,"value":582},"#![no_main]\n",{"type":42,"tag":521,"props":584,"children":585},{"class":523,"line":533},[586],{"type":42,"tag":521,"props":587,"children":588},{},[589],{"type":48,"value":590},"use libfuzzer_sys::fuzz_target;\n",{"type":42,"tag":521,"props":592,"children":593},{"class":523,"line":542},[594],{"type":42,"tag":521,"props":595,"children":597},{"emptyLinePlaceholder":596},true,[598],{"type":48,"value":599},"\n",{"type":42,"tag":521,"props":601,"children":602},{"class":523,"line":551},[603],{"type":42,"tag":521,"props":604,"children":605},{},[606],{"type":48,"value":607},"fuzz_target!(|data: &[u8]| {\n",{"type":42,"tag":521,"props":609,"children":611},{"class":523,"line":610},5,[612],{"type":42,"tag":521,"props":613,"children":614},{},[615],{"type":48,"value":616}," target_function(data);\n",{"type":42,"tag":521,"props":618,"children":620},{"class":523,"line":619},6,[621],{"type":42,"tag":521,"props":622,"children":623},{},[624],{"type":48,"value":625},"});\n",{"type":42,"tag":69,"props":627,"children":629},{"id":628},"step-3-add-input-validation",[630],{"type":48,"value":631},"Step 3: Add Input Validation",{"type":42,"tag":51,"props":633,"children":634},{},[635],{"type":48,"value":636},"Reject inputs that are too small or too large to be meaningful:",{"type":42,"tag":510,"props":638,"children":640},{"className":512,"code":639,"language":514,"meta":515,"style":515},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n \u002F\u002F Ensure minimum size for meaningful input\n if (size \u003C MIN_INPUT_SIZE || size > MAX_INPUT_SIZE) {\n return 0;\n }\n target_function(data, size);\n return 0;\n}\n",[641],{"type":42,"tag":153,"props":642,"children":643},{"__ignoreMap":515},[644,651,659,667,675,683,690,698],{"type":42,"tag":521,"props":645,"children":646},{"class":523,"line":524},[647],{"type":42,"tag":521,"props":648,"children":649},{},[650],{"type":48,"value":530},{"type":42,"tag":521,"props":652,"children":653},{"class":523,"line":533},[654],{"type":42,"tag":521,"props":655,"children":656},{},[657],{"type":48,"value":658}," \u002F\u002F Ensure minimum size for meaningful input\n",{"type":42,"tag":521,"props":660,"children":661},{"class":523,"line":542},[662],{"type":42,"tag":521,"props":663,"children":664},{},[665],{"type":48,"value":666}," if (size \u003C MIN_INPUT_SIZE || size > MAX_INPUT_SIZE) {\n",{"type":42,"tag":521,"props":668,"children":669},{"class":523,"line":551},[670],{"type":42,"tag":521,"props":671,"children":672},{},[673],{"type":48,"value":674}," return 0;\n",{"type":42,"tag":521,"props":676,"children":677},{"class":523,"line":610},[678],{"type":42,"tag":521,"props":679,"children":680},{},[681],{"type":48,"value":682}," }\n",{"type":42,"tag":521,"props":684,"children":685},{"class":523,"line":619},[686],{"type":42,"tag":521,"props":687,"children":688},{},[689],{"type":48,"value":539},{"type":42,"tag":521,"props":691,"children":693},{"class":523,"line":692},7,[694],{"type":42,"tag":521,"props":695,"children":696},{},[697],{"type":48,"value":548},{"type":42,"tag":521,"props":699,"children":701},{"class":523,"line":700},8,[702],{"type":42,"tag":521,"props":703,"children":704},{},[705],{"type":48,"value":557},{"type":42,"tag":51,"props":707,"children":708},{},[709,714],{"type":42,"tag":110,"props":710,"children":711},{},[712],{"type":48,"value":713},"Rationale:",{"type":48,"value":715}," The fuzzer generates random inputs of all sizes. Your harness must handle empty, tiny, huge, or malformed inputs without causing unexpected issues in the harness itself (crashes in the SUT are fine—that's what we're looking for).",{"type":42,"tag":69,"props":717,"children":719},{"id":718},"step-4-structure-the-input",[720],{"type":48,"value":721},"Step 4: Structure the Input",{"type":42,"tag":51,"props":723,"children":724},{},[725,727,732],{"type":48,"value":726},"For APIs that require typed data (integers, strings, etc.), use casting or helpers like ",{"type":42,"tag":153,"props":728,"children":730},{"className":729},[],[731],{"type":48,"value":171},{"type":48,"value":733},":",{"type":42,"tag":51,"props":735,"children":736},{},[737],{"type":42,"tag":110,"props":738,"children":739},{},[740],{"type":48,"value":741},"Simple casting:",{"type":42,"tag":510,"props":743,"children":745},{"className":512,"code":744,"language":514,"meta":515,"style":515},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n if (size != 2 * sizeof(uint32_t)) {\n return 0;\n }\n\n uint32_t numerator = *(uint32_t*)(data);\n uint32_t denominator = *(uint32_t*)(data + sizeof(uint32_t));\n\n divide(numerator, denominator);\n return 0;\n}\n",[746],{"type":42,"tag":153,"props":747,"children":748},{"__ignoreMap":515},[749,756,764,771,778,785,793,801,808,817,825],{"type":42,"tag":521,"props":750,"children":751},{"class":523,"line":524},[752],{"type":42,"tag":521,"props":753,"children":754},{},[755],{"type":48,"value":530},{"type":42,"tag":521,"props":757,"children":758},{"class":523,"line":533},[759],{"type":42,"tag":521,"props":760,"children":761},{},[762],{"type":48,"value":763}," if (size != 2 * sizeof(uint32_t)) {\n",{"type":42,"tag":521,"props":765,"children":766},{"class":523,"line":542},[767],{"type":42,"tag":521,"props":768,"children":769},{},[770],{"type":48,"value":674},{"type":42,"tag":521,"props":772,"children":773},{"class":523,"line":551},[774],{"type":42,"tag":521,"props":775,"children":776},{},[777],{"type":48,"value":682},{"type":42,"tag":521,"props":779,"children":780},{"class":523,"line":610},[781],{"type":42,"tag":521,"props":782,"children":783},{"emptyLinePlaceholder":596},[784],{"type":48,"value":599},{"type":42,"tag":521,"props":786,"children":787},{"class":523,"line":619},[788],{"type":42,"tag":521,"props":789,"children":790},{},[791],{"type":48,"value":792}," uint32_t numerator = *(uint32_t*)(data);\n",{"type":42,"tag":521,"props":794,"children":795},{"class":523,"line":692},[796],{"type":42,"tag":521,"props":797,"children":798},{},[799],{"type":48,"value":800}," uint32_t denominator = *(uint32_t*)(data + sizeof(uint32_t));\n",{"type":42,"tag":521,"props":802,"children":803},{"class":523,"line":700},[804],{"type":42,"tag":521,"props":805,"children":806},{"emptyLinePlaceholder":596},[807],{"type":48,"value":599},{"type":42,"tag":521,"props":809,"children":811},{"class":523,"line":810},9,[812],{"type":42,"tag":521,"props":813,"children":814},{},[815],{"type":48,"value":816}," divide(numerator, denominator);\n",{"type":42,"tag":521,"props":818,"children":820},{"class":523,"line":819},10,[821],{"type":42,"tag":521,"props":822,"children":823},{},[824],{"type":48,"value":548},{"type":42,"tag":521,"props":826,"children":828},{"class":523,"line":827},11,[829],{"type":42,"tag":521,"props":830,"children":831},{},[832],{"type":48,"value":557},{"type":42,"tag":51,"props":834,"children":835},{},[836],{"type":42,"tag":110,"props":837,"children":838},{},[839],{"type":48,"value":840},"Using FuzzedDataProvider:",{"type":42,"tag":510,"props":842,"children":844},{"className":512,"code":843,"language":514,"meta":515,"style":515},"#include \"FuzzedDataProvider.h\"\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n FuzzedDataProvider fuzzed_data(data, size);\n\n size_t allocation_size = fuzzed_data.ConsumeIntegral\u003Csize_t>();\n std::vector\u003Cchar> str1 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n std::vector\u003Cchar> str2 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n\n concat(&str1[0], str1.size(), &str2[0], str2.size(), allocation_size);\n return 0;\n}\n",[845],{"type":42,"tag":153,"props":846,"children":847},{"__ignoreMap":515},[848,856,863,870,878,885,893,901,909,916,924,931],{"type":42,"tag":521,"props":849,"children":850},{"class":523,"line":524},[851],{"type":42,"tag":521,"props":852,"children":853},{},[854],{"type":48,"value":855},"#include \"FuzzedDataProvider.h\"\n",{"type":42,"tag":521,"props":857,"children":858},{"class":523,"line":533},[859],{"type":42,"tag":521,"props":860,"children":861},{"emptyLinePlaceholder":596},[862],{"type":48,"value":599},{"type":42,"tag":521,"props":864,"children":865},{"class":523,"line":542},[866],{"type":42,"tag":521,"props":867,"children":868},{},[869],{"type":48,"value":530},{"type":42,"tag":521,"props":871,"children":872},{"class":523,"line":551},[873],{"type":42,"tag":521,"props":874,"children":875},{},[876],{"type":48,"value":877}," FuzzedDataProvider fuzzed_data(data, size);\n",{"type":42,"tag":521,"props":879,"children":880},{"class":523,"line":610},[881],{"type":42,"tag":521,"props":882,"children":883},{"emptyLinePlaceholder":596},[884],{"type":48,"value":599},{"type":42,"tag":521,"props":886,"children":887},{"class":523,"line":619},[888],{"type":42,"tag":521,"props":889,"children":890},{},[891],{"type":48,"value":892}," size_t allocation_size = fuzzed_data.ConsumeIntegral\u003Csize_t>();\n",{"type":42,"tag":521,"props":894,"children":895},{"class":523,"line":692},[896],{"type":42,"tag":521,"props":897,"children":898},{},[899],{"type":48,"value":900}," std::vector\u003Cchar> str1 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n",{"type":42,"tag":521,"props":902,"children":903},{"class":523,"line":700},[904],{"type":42,"tag":521,"props":905,"children":906},{},[907],{"type":48,"value":908}," std::vector\u003Cchar> str2 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n",{"type":42,"tag":521,"props":910,"children":911},{"class":523,"line":810},[912],{"type":42,"tag":521,"props":913,"children":914},{"emptyLinePlaceholder":596},[915],{"type":48,"value":599},{"type":42,"tag":521,"props":917,"children":918},{"class":523,"line":819},[919],{"type":42,"tag":521,"props":920,"children":921},{},[922],{"type":48,"value":923}," concat(&str1[0], str1.size(), &str2[0], str2.size(), allocation_size);\n",{"type":42,"tag":521,"props":925,"children":926},{"class":523,"line":827},[927],{"type":42,"tag":521,"props":928,"children":929},{},[930],{"type":48,"value":548},{"type":42,"tag":521,"props":932,"children":934},{"class":523,"line":933},12,[935],{"type":42,"tag":521,"props":936,"children":937},{},[938],{"type":48,"value":557},{"type":42,"tag":69,"props":940,"children":942},{"id":941},"step-5-test-and-iterate",[943],{"type":48,"value":944},"Step 5: Test and Iterate",{"type":42,"tag":51,"props":946,"children":947},{},[948],{"type":48,"value":949},"Run the fuzzer and monitor:",{"type":42,"tag":224,"props":951,"children":952},{},[953,958,963],{"type":42,"tag":228,"props":954,"children":955},{},[956],{"type":48,"value":957},"Code coverage (are all interesting paths reached?)",{"type":42,"tag":228,"props":959,"children":960},{},[961],{"type":48,"value":962},"Executions per second (is it fast enough?)",{"type":42,"tag":228,"props":964,"children":965},{},[966],{"type":48,"value":967},"Crash reproducibility (can you reproduce crashes with saved inputs?)",{"type":42,"tag":51,"props":969,"children":970},{},[971],{"type":48,"value":972},"Iterate on the harness to improve these metrics.",{"type":42,"tag":57,"props":974,"children":976},{"id":975},"common-patterns",[977],{"type":48,"value":978},"Common Patterns",{"type":42,"tag":69,"props":980,"children":982},{"id":981},"pattern-beyond-byte-arrayscasting-to-integers",[983],{"type":48,"value":984},"Pattern: Beyond Byte Arrays—Casting to Integers",{"type":42,"tag":51,"props":986,"children":987},{},[988,993],{"type":42,"tag":110,"props":989,"children":990},{},[991],{"type":48,"value":992},"Use Case:",{"type":48,"value":994}," When target expects primitive types like integers or floats",{"type":42,"tag":51,"props":996,"children":997},{},[998],{"type":42,"tag":110,"props":999,"children":1000},{},[1001],{"type":48,"value":1002},"Implementation:",{"type":42,"tag":510,"props":1004,"children":1006},{"className":512,"code":1005,"language":514,"meta":515,"style":515},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n \u002F\u002F Ensure exactly 2 4-byte numbers\n if (size != 2 * sizeof(uint32_t)) {\n return 0;\n }\n\n \u002F\u002F Split input into two integers\n uint32_t numerator = *(uint32_t*)(data);\n uint32_t denominator = *(uint32_t*)(data + sizeof(uint32_t));\n\n divide(numerator, denominator);\n return 0;\n}\n",[1007],{"type":42,"tag":153,"props":1008,"children":1009},{"__ignoreMap":515},[1010,1017,1025,1032,1039,1046,1053,1061,1068,1075,1082,1089,1096],{"type":42,"tag":521,"props":1011,"children":1012},{"class":523,"line":524},[1013],{"type":42,"tag":521,"props":1014,"children":1015},{},[1016],{"type":48,"value":530},{"type":42,"tag":521,"props":1018,"children":1019},{"class":523,"line":533},[1020],{"type":42,"tag":521,"props":1021,"children":1022},{},[1023],{"type":48,"value":1024}," \u002F\u002F Ensure exactly 2 4-byte numbers\n",{"type":42,"tag":521,"props":1026,"children":1027},{"class":523,"line":542},[1028],{"type":42,"tag":521,"props":1029,"children":1030},{},[1031],{"type":48,"value":763},{"type":42,"tag":521,"props":1033,"children":1034},{"class":523,"line":551},[1035],{"type":42,"tag":521,"props":1036,"children":1037},{},[1038],{"type":48,"value":674},{"type":42,"tag":521,"props":1040,"children":1041},{"class":523,"line":610},[1042],{"type":42,"tag":521,"props":1043,"children":1044},{},[1045],{"type":48,"value":682},{"type":42,"tag":521,"props":1047,"children":1048},{"class":523,"line":619},[1049],{"type":42,"tag":521,"props":1050,"children":1051},{"emptyLinePlaceholder":596},[1052],{"type":48,"value":599},{"type":42,"tag":521,"props":1054,"children":1055},{"class":523,"line":692},[1056],{"type":42,"tag":521,"props":1057,"children":1058},{},[1059],{"type":48,"value":1060}," \u002F\u002F Split input into two integers\n",{"type":42,"tag":521,"props":1062,"children":1063},{"class":523,"line":700},[1064],{"type":42,"tag":521,"props":1065,"children":1066},{},[1067],{"type":48,"value":792},{"type":42,"tag":521,"props":1069,"children":1070},{"class":523,"line":810},[1071],{"type":42,"tag":521,"props":1072,"children":1073},{},[1074],{"type":48,"value":800},{"type":42,"tag":521,"props":1076,"children":1077},{"class":523,"line":819},[1078],{"type":42,"tag":521,"props":1079,"children":1080},{"emptyLinePlaceholder":596},[1081],{"type":48,"value":599},{"type":42,"tag":521,"props":1083,"children":1084},{"class":523,"line":827},[1085],{"type":42,"tag":521,"props":1086,"children":1087},{},[1088],{"type":48,"value":816},{"type":42,"tag":521,"props":1090,"children":1091},{"class":523,"line":933},[1092],{"type":42,"tag":521,"props":1093,"children":1094},{},[1095],{"type":48,"value":548},{"type":42,"tag":521,"props":1097,"children":1099},{"class":523,"line":1098},13,[1100],{"type":42,"tag":521,"props":1101,"children":1102},{},[1103],{"type":48,"value":557},{"type":42,"tag":51,"props":1105,"children":1106},{},[1107],{"type":42,"tag":110,"props":1108,"children":1109},{},[1110],{"type":48,"value":1111},"Rust equivalent:",{"type":42,"tag":510,"props":1113,"children":1115},{"className":568,"code":1114,"language":570,"meta":515,"style":515},"fuzz_target!(|data: &[u8]| {\n if data.len() != 2 * std::mem::size_of::\u003Ci32>() {\n return;\n }\n\n let numerator = i32::from_ne_bytes([data[0], data[1], data[2], data[3]]);\n let denominator = i32::from_ne_bytes([data[4], data[5], data[6], data[7]]);\n\n divide(numerator, denominator);\n});\n",[1116],{"type":42,"tag":153,"props":1117,"children":1118},{"__ignoreMap":515},[1119,1126,1134,1142,1149,1156,1164,1172,1179,1186],{"type":42,"tag":521,"props":1120,"children":1121},{"class":523,"line":524},[1122],{"type":42,"tag":521,"props":1123,"children":1124},{},[1125],{"type":48,"value":607},{"type":42,"tag":521,"props":1127,"children":1128},{"class":523,"line":533},[1129],{"type":42,"tag":521,"props":1130,"children":1131},{},[1132],{"type":48,"value":1133}," if data.len() != 2 * std::mem::size_of::\u003Ci32>() {\n",{"type":42,"tag":521,"props":1135,"children":1136},{"class":523,"line":542},[1137],{"type":42,"tag":521,"props":1138,"children":1139},{},[1140],{"type":48,"value":1141}," return;\n",{"type":42,"tag":521,"props":1143,"children":1144},{"class":523,"line":551},[1145],{"type":42,"tag":521,"props":1146,"children":1147},{},[1148],{"type":48,"value":682},{"type":42,"tag":521,"props":1150,"children":1151},{"class":523,"line":610},[1152],{"type":42,"tag":521,"props":1153,"children":1154},{"emptyLinePlaceholder":596},[1155],{"type":48,"value":599},{"type":42,"tag":521,"props":1157,"children":1158},{"class":523,"line":619},[1159],{"type":42,"tag":521,"props":1160,"children":1161},{},[1162],{"type":48,"value":1163}," let numerator = i32::from_ne_bytes([data[0], data[1], data[2], data[3]]);\n",{"type":42,"tag":521,"props":1165,"children":1166},{"class":523,"line":692},[1167],{"type":42,"tag":521,"props":1168,"children":1169},{},[1170],{"type":48,"value":1171}," let denominator = i32::from_ne_bytes([data[4], data[5], data[6], data[7]]);\n",{"type":42,"tag":521,"props":1173,"children":1174},{"class":523,"line":700},[1175],{"type":42,"tag":521,"props":1176,"children":1177},{"emptyLinePlaceholder":596},[1178],{"type":48,"value":599},{"type":42,"tag":521,"props":1180,"children":1181},{"class":523,"line":810},[1182],{"type":42,"tag":521,"props":1183,"children":1184},{},[1185],{"type":48,"value":816},{"type":42,"tag":521,"props":1187,"children":1188},{"class":523,"line":819},[1189],{"type":42,"tag":521,"props":1190,"children":1191},{},[1192],{"type":48,"value":625},{"type":42,"tag":51,"props":1194,"children":1195},{},[1196,1201],{"type":42,"tag":110,"props":1197,"children":1198},{},[1199],{"type":48,"value":1200},"Why it works:",{"type":48,"value":1202}," Any 8-byte input is valid. The fuzzer learns that inputs must be exactly 8 bytes, and every bit flip produces a new, potentially interesting input.",{"type":42,"tag":69,"props":1204,"children":1206},{"id":1205},"pattern-fuzzeddataprovider-for-complex-inputs",[1207],{"type":48,"value":1208},"Pattern: FuzzedDataProvider for Complex Inputs",{"type":42,"tag":51,"props":1210,"children":1211},{},[1212,1216],{"type":42,"tag":110,"props":1213,"children":1214},{},[1215],{"type":48,"value":992},{"type":48,"value":1217}," When target requires multiple strings, integers, or variable-length data",{"type":42,"tag":51,"props":1219,"children":1220},{},[1221],{"type":42,"tag":110,"props":1222,"children":1223},{},[1224],{"type":48,"value":1002},{"type":42,"tag":510,"props":1226,"children":1228},{"className":512,"code":1227,"language":514,"meta":515,"style":515},"#include \"FuzzedDataProvider.h\"\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n FuzzedDataProvider fuzzed_data(data, size);\n\n \u002F\u002F Extract different types of data\n size_t allocation_size = fuzzed_data.ConsumeIntegral\u003Csize_t>();\n\n \u002F\u002F Consume variable-length strings with terminator\n std::vector\u003Cchar> str1 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n std::vector\u003Cchar> str2 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n\n char* result = concat(&str1[0], str1.size(), &str2[0], str2.size(), allocation_size);\n if (result != NULL) {\n free(result);\n }\n\n return 0;\n}\n",[1229],{"type":42,"tag":153,"props":1230,"children":1231},{"__ignoreMap":515},[1232,1239,1246,1253,1260,1267,1275,1282,1289,1297,1304,1311,1318,1326,1335,1344,1352,1360,1368],{"type":42,"tag":521,"props":1233,"children":1234},{"class":523,"line":524},[1235],{"type":42,"tag":521,"props":1236,"children":1237},{},[1238],{"type":48,"value":855},{"type":42,"tag":521,"props":1240,"children":1241},{"class":523,"line":533},[1242],{"type":42,"tag":521,"props":1243,"children":1244},{"emptyLinePlaceholder":596},[1245],{"type":48,"value":599},{"type":42,"tag":521,"props":1247,"children":1248},{"class":523,"line":542},[1249],{"type":42,"tag":521,"props":1250,"children":1251},{},[1252],{"type":48,"value":530},{"type":42,"tag":521,"props":1254,"children":1255},{"class":523,"line":551},[1256],{"type":42,"tag":521,"props":1257,"children":1258},{},[1259],{"type":48,"value":877},{"type":42,"tag":521,"props":1261,"children":1262},{"class":523,"line":610},[1263],{"type":42,"tag":521,"props":1264,"children":1265},{"emptyLinePlaceholder":596},[1266],{"type":48,"value":599},{"type":42,"tag":521,"props":1268,"children":1269},{"class":523,"line":619},[1270],{"type":42,"tag":521,"props":1271,"children":1272},{},[1273],{"type":48,"value":1274}," \u002F\u002F Extract different types of data\n",{"type":42,"tag":521,"props":1276,"children":1277},{"class":523,"line":692},[1278],{"type":42,"tag":521,"props":1279,"children":1280},{},[1281],{"type":48,"value":892},{"type":42,"tag":521,"props":1283,"children":1284},{"class":523,"line":700},[1285],{"type":42,"tag":521,"props":1286,"children":1287},{"emptyLinePlaceholder":596},[1288],{"type":48,"value":599},{"type":42,"tag":521,"props":1290,"children":1291},{"class":523,"line":810},[1292],{"type":42,"tag":521,"props":1293,"children":1294},{},[1295],{"type":48,"value":1296}," \u002F\u002F Consume variable-length strings with terminator\n",{"type":42,"tag":521,"props":1298,"children":1299},{"class":523,"line":819},[1300],{"type":42,"tag":521,"props":1301,"children":1302},{},[1303],{"type":48,"value":900},{"type":42,"tag":521,"props":1305,"children":1306},{"class":523,"line":827},[1307],{"type":42,"tag":521,"props":1308,"children":1309},{},[1310],{"type":48,"value":908},{"type":42,"tag":521,"props":1312,"children":1313},{"class":523,"line":933},[1314],{"type":42,"tag":521,"props":1315,"children":1316},{"emptyLinePlaceholder":596},[1317],{"type":48,"value":599},{"type":42,"tag":521,"props":1319,"children":1320},{"class":523,"line":1098},[1321],{"type":42,"tag":521,"props":1322,"children":1323},{},[1324],{"type":48,"value":1325}," char* result = concat(&str1[0], str1.size(), &str2[0], str2.size(), allocation_size);\n",{"type":42,"tag":521,"props":1327,"children":1329},{"class":523,"line":1328},14,[1330],{"type":42,"tag":521,"props":1331,"children":1332},{},[1333],{"type":48,"value":1334}," if (result != NULL) {\n",{"type":42,"tag":521,"props":1336,"children":1338},{"class":523,"line":1337},15,[1339],{"type":42,"tag":521,"props":1340,"children":1341},{},[1342],{"type":48,"value":1343}," free(result);\n",{"type":42,"tag":521,"props":1345,"children":1347},{"class":523,"line":1346},16,[1348],{"type":42,"tag":521,"props":1349,"children":1350},{},[1351],{"type":48,"value":682},{"type":42,"tag":521,"props":1353,"children":1355},{"class":523,"line":1354},17,[1356],{"type":42,"tag":521,"props":1357,"children":1358},{"emptyLinePlaceholder":596},[1359],{"type":48,"value":599},{"type":42,"tag":521,"props":1361,"children":1363},{"class":523,"line":1362},18,[1364],{"type":42,"tag":521,"props":1365,"children":1366},{},[1367],{"type":48,"value":548},{"type":42,"tag":521,"props":1369,"children":1371},{"class":523,"line":1370},19,[1372],{"type":42,"tag":521,"props":1373,"children":1374},{},[1375],{"type":48,"value":557},{"type":42,"tag":51,"props":1377,"children":1378},{},[1379,1384,1386,1391],{"type":42,"tag":110,"props":1380,"children":1381},{},[1382],{"type":48,"value":1383},"Why it helps:",{"type":48,"value":1385}," ",{"type":42,"tag":153,"props":1387,"children":1389},{"className":1388},[],[1390],{"type":48,"value":171},{"type":48,"value":1392}," handles the complexity of extracting structured data from a byte stream. It's particularly useful for APIs that need multiple parameters of different types.",{"type":42,"tag":69,"props":1394,"children":1396},{"id":1395},"pattern-interleaved-fuzzing",[1397],{"type":48,"value":1398},"Pattern: Interleaved Fuzzing",{"type":42,"tag":51,"props":1400,"children":1401},{},[1402,1406],{"type":42,"tag":110,"props":1403,"children":1404},{},[1405],{"type":48,"value":992},{"type":48,"value":1407}," When multiple related operations should be tested in a single harness",{"type":42,"tag":51,"props":1409,"children":1410},{},[1411],{"type":42,"tag":110,"props":1412,"children":1413},{},[1414],{"type":48,"value":1002},{"type":42,"tag":510,"props":1416,"children":1418},{"className":512,"code":1417,"language":514,"meta":515,"style":515},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n if (size \u003C 1 + 2 * sizeof(int32_t)) {\n return 0;\n }\n\n \u002F\u002F First byte selects operation\n uint8_t mode = data[0];\n\n \u002F\u002F Next bytes are operands\n int32_t numbers[2];\n memcpy(numbers, data + 1, 2 * sizeof(int32_t));\n\n int32_t result = 0;\n switch (mode % 4) {\n case 0:\n result = add(numbers[0], numbers[1]);\n break;\n case 1:\n result = subtract(numbers[0], numbers[1]);\n break;\n case 2:\n result = multiply(numbers[0], numbers[1]);\n break;\n case 3:\n result = divide(numbers[0], numbers[1]);\n break;\n }\n\n \u002F\u002F Prevent compiler from optimizing away the calls\n printf(\"%d\", result);\n return 0;\n}\n",[1419],{"type":42,"tag":153,"props":1420,"children":1421},{"__ignoreMap":515},[1422,1429,1437,1444,1451,1458,1466,1474,1481,1489,1497,1505,1512,1520,1528,1536,1544,1552,1560,1568,1576,1585,1594,1602,1611,1620,1628,1636,1644,1653,1662,1670],{"type":42,"tag":521,"props":1423,"children":1424},{"class":523,"line":524},[1425],{"type":42,"tag":521,"props":1426,"children":1427},{},[1428],{"type":48,"value":530},{"type":42,"tag":521,"props":1430,"children":1431},{"class":523,"line":533},[1432],{"type":42,"tag":521,"props":1433,"children":1434},{},[1435],{"type":48,"value":1436}," if (size \u003C 1 + 2 * sizeof(int32_t)) {\n",{"type":42,"tag":521,"props":1438,"children":1439},{"class":523,"line":542},[1440],{"type":42,"tag":521,"props":1441,"children":1442},{},[1443],{"type":48,"value":674},{"type":42,"tag":521,"props":1445,"children":1446},{"class":523,"line":551},[1447],{"type":42,"tag":521,"props":1448,"children":1449},{},[1450],{"type":48,"value":682},{"type":42,"tag":521,"props":1452,"children":1453},{"class":523,"line":610},[1454],{"type":42,"tag":521,"props":1455,"children":1456},{"emptyLinePlaceholder":596},[1457],{"type":48,"value":599},{"type":42,"tag":521,"props":1459,"children":1460},{"class":523,"line":619},[1461],{"type":42,"tag":521,"props":1462,"children":1463},{},[1464],{"type":48,"value":1465}," \u002F\u002F First byte selects operation\n",{"type":42,"tag":521,"props":1467,"children":1468},{"class":523,"line":692},[1469],{"type":42,"tag":521,"props":1470,"children":1471},{},[1472],{"type":48,"value":1473}," uint8_t mode = data[0];\n",{"type":42,"tag":521,"props":1475,"children":1476},{"class":523,"line":700},[1477],{"type":42,"tag":521,"props":1478,"children":1479},{"emptyLinePlaceholder":596},[1480],{"type":48,"value":599},{"type":42,"tag":521,"props":1482,"children":1483},{"class":523,"line":810},[1484],{"type":42,"tag":521,"props":1485,"children":1486},{},[1487],{"type":48,"value":1488}," \u002F\u002F Next bytes are operands\n",{"type":42,"tag":521,"props":1490,"children":1491},{"class":523,"line":819},[1492],{"type":42,"tag":521,"props":1493,"children":1494},{},[1495],{"type":48,"value":1496}," int32_t numbers[2];\n",{"type":42,"tag":521,"props":1498,"children":1499},{"class":523,"line":827},[1500],{"type":42,"tag":521,"props":1501,"children":1502},{},[1503],{"type":48,"value":1504}," memcpy(numbers, data + 1, 2 * sizeof(int32_t));\n",{"type":42,"tag":521,"props":1506,"children":1507},{"class":523,"line":933},[1508],{"type":42,"tag":521,"props":1509,"children":1510},{"emptyLinePlaceholder":596},[1511],{"type":48,"value":599},{"type":42,"tag":521,"props":1513,"children":1514},{"class":523,"line":1098},[1515],{"type":42,"tag":521,"props":1516,"children":1517},{},[1518],{"type":48,"value":1519}," int32_t result = 0;\n",{"type":42,"tag":521,"props":1521,"children":1522},{"class":523,"line":1328},[1523],{"type":42,"tag":521,"props":1524,"children":1525},{},[1526],{"type":48,"value":1527}," switch (mode % 4) {\n",{"type":42,"tag":521,"props":1529,"children":1530},{"class":523,"line":1337},[1531],{"type":42,"tag":521,"props":1532,"children":1533},{},[1534],{"type":48,"value":1535}," case 0:\n",{"type":42,"tag":521,"props":1537,"children":1538},{"class":523,"line":1346},[1539],{"type":42,"tag":521,"props":1540,"children":1541},{},[1542],{"type":48,"value":1543}," result = add(numbers[0], numbers[1]);\n",{"type":42,"tag":521,"props":1545,"children":1546},{"class":523,"line":1354},[1547],{"type":42,"tag":521,"props":1548,"children":1549},{},[1550],{"type":48,"value":1551}," break;\n",{"type":42,"tag":521,"props":1553,"children":1554},{"class":523,"line":1362},[1555],{"type":42,"tag":521,"props":1556,"children":1557},{},[1558],{"type":48,"value":1559}," case 1:\n",{"type":42,"tag":521,"props":1561,"children":1562},{"class":523,"line":1370},[1563],{"type":42,"tag":521,"props":1564,"children":1565},{},[1566],{"type":48,"value":1567}," result = subtract(numbers[0], numbers[1]);\n",{"type":42,"tag":521,"props":1569,"children":1571},{"class":523,"line":1570},20,[1572],{"type":42,"tag":521,"props":1573,"children":1574},{},[1575],{"type":48,"value":1551},{"type":42,"tag":521,"props":1577,"children":1579},{"class":523,"line":1578},21,[1580],{"type":42,"tag":521,"props":1581,"children":1582},{},[1583],{"type":48,"value":1584}," case 2:\n",{"type":42,"tag":521,"props":1586,"children":1588},{"class":523,"line":1587},22,[1589],{"type":42,"tag":521,"props":1590,"children":1591},{},[1592],{"type":48,"value":1593}," result = multiply(numbers[0], numbers[1]);\n",{"type":42,"tag":521,"props":1595,"children":1597},{"class":523,"line":1596},23,[1598],{"type":42,"tag":521,"props":1599,"children":1600},{},[1601],{"type":48,"value":1551},{"type":42,"tag":521,"props":1603,"children":1605},{"class":523,"line":1604},24,[1606],{"type":42,"tag":521,"props":1607,"children":1608},{},[1609],{"type":48,"value":1610}," case 3:\n",{"type":42,"tag":521,"props":1612,"children":1614},{"class":523,"line":1613},25,[1615],{"type":42,"tag":521,"props":1616,"children":1617},{},[1618],{"type":48,"value":1619}," result = divide(numbers[0], numbers[1]);\n",{"type":42,"tag":521,"props":1621,"children":1623},{"class":523,"line":1622},26,[1624],{"type":42,"tag":521,"props":1625,"children":1626},{},[1627],{"type":48,"value":1551},{"type":42,"tag":521,"props":1629,"children":1631},{"class":523,"line":1630},27,[1632],{"type":42,"tag":521,"props":1633,"children":1634},{},[1635],{"type":48,"value":682},{"type":42,"tag":521,"props":1637,"children":1639},{"class":523,"line":1638},28,[1640],{"type":42,"tag":521,"props":1641,"children":1642},{"emptyLinePlaceholder":596},[1643],{"type":48,"value":599},{"type":42,"tag":521,"props":1645,"children":1647},{"class":523,"line":1646},29,[1648],{"type":42,"tag":521,"props":1649,"children":1650},{},[1651],{"type":48,"value":1652}," \u002F\u002F Prevent compiler from optimizing away the calls\n",{"type":42,"tag":521,"props":1654,"children":1656},{"class":523,"line":1655},30,[1657],{"type":42,"tag":521,"props":1658,"children":1659},{},[1660],{"type":48,"value":1661}," printf(\"%d\", result);\n",{"type":42,"tag":521,"props":1663,"children":1665},{"class":523,"line":1664},31,[1666],{"type":42,"tag":521,"props":1667,"children":1668},{},[1669],{"type":48,"value":548},{"type":42,"tag":521,"props":1671,"children":1673},{"class":523,"line":1672},32,[1674],{"type":42,"tag":521,"props":1675,"children":1676},{},[1677],{"type":48,"value":557},{"type":42,"tag":51,"props":1679,"children":1680},{},[1681],{"type":42,"tag":110,"props":1682,"children":1683},{},[1684],{"type":48,"value":1685},"Advantages:",{"type":42,"tag":224,"props":1687,"children":1688},{},[1689,1694,1699],{"type":42,"tag":228,"props":1690,"children":1691},{},[1692],{"type":48,"value":1693},"Faster to write one harness than multiple individual harnesses",{"type":42,"tag":228,"props":1695,"children":1696},{},[1697],{"type":48,"value":1698},"Single shared corpus means interesting inputs for one operation may be interesting for others",{"type":42,"tag":228,"props":1700,"children":1701},{},[1702],{"type":48,"value":1703},"Can discover bugs in interactions between operations",{"type":42,"tag":51,"props":1705,"children":1706},{},[1707],{"type":42,"tag":110,"props":1708,"children":1709},{},[1710],{"type":48,"value":1711},"When to use:",{"type":42,"tag":224,"props":1713,"children":1714},{},[1715,1720,1725],{"type":42,"tag":228,"props":1716,"children":1717},{},[1718],{"type":48,"value":1719},"Operations share similar input types",{"type":42,"tag":228,"props":1721,"children":1722},{},[1723],{"type":48,"value":1724},"Operations are logically related (e.g., arithmetic operations, CRUD operations)",{"type":42,"tag":228,"props":1726,"children":1727},{},[1728],{"type":48,"value":1729},"Single corpus makes sense across all operations",{"type":42,"tag":69,"props":1731,"children":1733},{"id":1732},"pattern-structure-aware-fuzzing-with-arbitrary-rust",[1734],{"type":48,"value":1735},"Pattern: Structure-Aware Fuzzing with Arbitrary (Rust)",{"type":42,"tag":51,"props":1737,"children":1738},{},[1739,1743],{"type":42,"tag":110,"props":1740,"children":1741},{},[1742],{"type":48,"value":992},{"type":48,"value":1744}," When fuzzing Rust code that uses custom structs",{"type":42,"tag":51,"props":1746,"children":1747},{},[1748],{"type":42,"tag":110,"props":1749,"children":1750},{},[1751],{"type":48,"value":1002},{"type":42,"tag":510,"props":1753,"children":1755},{"className":568,"code":1754,"language":570,"meta":515,"style":515},"use arbitrary::Arbitrary;\n\n#[derive(Debug, Arbitrary)]\npub struct Name {\n data: String\n}\n\nimpl Name {\n pub fn check_buf(&self) {\n let data = self.data.as_bytes();\n if data.len() > 0 && data[0] == b'a' {\n if data.len() > 1 && data[1] == b'b' {\n if data.len() > 2 && data[2] == b'c' {\n process::abort();\n }\n }\n }\n }\n}\n",[1756],{"type":42,"tag":153,"props":1757,"children":1758},{"__ignoreMap":515},[1759,1767,1774,1782,1790,1798,1805,1812,1820,1828,1836,1844,1852,1860,1868,1876,1884,1892,1899],{"type":42,"tag":521,"props":1760,"children":1761},{"class":523,"line":524},[1762],{"type":42,"tag":521,"props":1763,"children":1764},{},[1765],{"type":48,"value":1766},"use arbitrary::Arbitrary;\n",{"type":42,"tag":521,"props":1768,"children":1769},{"class":523,"line":533},[1770],{"type":42,"tag":521,"props":1771,"children":1772},{"emptyLinePlaceholder":596},[1773],{"type":48,"value":599},{"type":42,"tag":521,"props":1775,"children":1776},{"class":523,"line":542},[1777],{"type":42,"tag":521,"props":1778,"children":1779},{},[1780],{"type":48,"value":1781},"#[derive(Debug, Arbitrary)]\n",{"type":42,"tag":521,"props":1783,"children":1784},{"class":523,"line":551},[1785],{"type":42,"tag":521,"props":1786,"children":1787},{},[1788],{"type":48,"value":1789},"pub struct Name {\n",{"type":42,"tag":521,"props":1791,"children":1792},{"class":523,"line":610},[1793],{"type":42,"tag":521,"props":1794,"children":1795},{},[1796],{"type":48,"value":1797}," data: String\n",{"type":42,"tag":521,"props":1799,"children":1800},{"class":523,"line":619},[1801],{"type":42,"tag":521,"props":1802,"children":1803},{},[1804],{"type":48,"value":557},{"type":42,"tag":521,"props":1806,"children":1807},{"class":523,"line":692},[1808],{"type":42,"tag":521,"props":1809,"children":1810},{"emptyLinePlaceholder":596},[1811],{"type":48,"value":599},{"type":42,"tag":521,"props":1813,"children":1814},{"class":523,"line":700},[1815],{"type":42,"tag":521,"props":1816,"children":1817},{},[1818],{"type":48,"value":1819},"impl Name {\n",{"type":42,"tag":521,"props":1821,"children":1822},{"class":523,"line":810},[1823],{"type":42,"tag":521,"props":1824,"children":1825},{},[1826],{"type":48,"value":1827}," pub fn check_buf(&self) {\n",{"type":42,"tag":521,"props":1829,"children":1830},{"class":523,"line":819},[1831],{"type":42,"tag":521,"props":1832,"children":1833},{},[1834],{"type":48,"value":1835}," let data = self.data.as_bytes();\n",{"type":42,"tag":521,"props":1837,"children":1838},{"class":523,"line":827},[1839],{"type":42,"tag":521,"props":1840,"children":1841},{},[1842],{"type":48,"value":1843}," if data.len() > 0 && data[0] == b'a' {\n",{"type":42,"tag":521,"props":1845,"children":1846},{"class":523,"line":933},[1847],{"type":42,"tag":521,"props":1848,"children":1849},{},[1850],{"type":48,"value":1851}," if data.len() > 1 && data[1] == b'b' {\n",{"type":42,"tag":521,"props":1853,"children":1854},{"class":523,"line":1098},[1855],{"type":42,"tag":521,"props":1856,"children":1857},{},[1858],{"type":48,"value":1859}," if data.len() > 2 && data[2] == b'c' {\n",{"type":42,"tag":521,"props":1861,"children":1862},{"class":523,"line":1328},[1863],{"type":42,"tag":521,"props":1864,"children":1865},{},[1866],{"type":48,"value":1867}," process::abort();\n",{"type":42,"tag":521,"props":1869,"children":1870},{"class":523,"line":1337},[1871],{"type":42,"tag":521,"props":1872,"children":1873},{},[1874],{"type":48,"value":1875}," }\n",{"type":42,"tag":521,"props":1877,"children":1878},{"class":523,"line":1346},[1879],{"type":42,"tag":521,"props":1880,"children":1881},{},[1882],{"type":48,"value":1883}," }\n",{"type":42,"tag":521,"props":1885,"children":1886},{"class":523,"line":1354},[1887],{"type":42,"tag":521,"props":1888,"children":1889},{},[1890],{"type":48,"value":1891}," }\n",{"type":42,"tag":521,"props":1893,"children":1894},{"class":523,"line":1362},[1895],{"type":42,"tag":521,"props":1896,"children":1897},{},[1898],{"type":48,"value":682},{"type":42,"tag":521,"props":1900,"children":1901},{"class":523,"line":1370},[1902],{"type":42,"tag":521,"props":1903,"children":1904},{},[1905],{"type":48,"value":557},{"type":42,"tag":51,"props":1907,"children":1908},{},[1909],{"type":42,"tag":110,"props":1910,"children":1911},{},[1912],{"type":48,"value":1913},"Harness with arbitrary:",{"type":42,"tag":510,"props":1915,"children":1917},{"className":568,"code":1916,"language":570,"meta":515,"style":515},"#![no_main]\nuse libfuzzer_sys::fuzz_target;\n\nfuzz_target!(|data: your_project::Name| {\n data.check_buf();\n});\n",[1918],{"type":42,"tag":153,"props":1919,"children":1920},{"__ignoreMap":515},[1921,1928,1935,1942,1950,1958],{"type":42,"tag":521,"props":1922,"children":1923},{"class":523,"line":524},[1924],{"type":42,"tag":521,"props":1925,"children":1926},{},[1927],{"type":48,"value":582},{"type":42,"tag":521,"props":1929,"children":1930},{"class":523,"line":533},[1931],{"type":42,"tag":521,"props":1932,"children":1933},{},[1934],{"type":48,"value":590},{"type":42,"tag":521,"props":1936,"children":1937},{"class":523,"line":542},[1938],{"type":42,"tag":521,"props":1939,"children":1940},{"emptyLinePlaceholder":596},[1941],{"type":48,"value":599},{"type":42,"tag":521,"props":1943,"children":1944},{"class":523,"line":551},[1945],{"type":42,"tag":521,"props":1946,"children":1947},{},[1948],{"type":48,"value":1949},"fuzz_target!(|data: your_project::Name| {\n",{"type":42,"tag":521,"props":1951,"children":1952},{"class":523,"line":610},[1953],{"type":42,"tag":521,"props":1954,"children":1955},{},[1956],{"type":48,"value":1957}," data.check_buf();\n",{"type":42,"tag":521,"props":1959,"children":1960},{"class":523,"line":619},[1961],{"type":42,"tag":521,"props":1962,"children":1963},{},[1964],{"type":48,"value":625},{"type":42,"tag":51,"props":1966,"children":1967},{},[1968],{"type":42,"tag":110,"props":1969,"children":1970},{},[1971],{"type":48,"value":1972},"Add to Cargo.toml:",{"type":42,"tag":510,"props":1974,"children":1978},{"className":1975,"code":1976,"language":1977,"meta":515,"style":515},"language-toml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","[dependencies]\narbitrary = { version = \"1\", features = [\"derive\"] }\n","toml",[1979],{"type":42,"tag":153,"props":1980,"children":1981},{"__ignoreMap":515},[1982,1990],{"type":42,"tag":521,"props":1983,"children":1984},{"class":523,"line":524},[1985],{"type":42,"tag":521,"props":1986,"children":1987},{},[1988],{"type":48,"value":1989},"[dependencies]\n",{"type":42,"tag":521,"props":1991,"children":1992},{"class":523,"line":533},[1993],{"type":42,"tag":521,"props":1994,"children":1995},{},[1996],{"type":48,"value":1997},"arbitrary = { version = \"1\", features = [\"derive\"] }\n",{"type":42,"tag":51,"props":1999,"children":2000},{},[2001,2005,2007,2013],{"type":42,"tag":110,"props":2002,"children":2003},{},[2004],{"type":48,"value":1383},{"type":48,"value":2006}," The ",{"type":42,"tag":153,"props":2008,"children":2010},{"className":2009},[],[2011],{"type":48,"value":2012},"arbitrary",{"type":48,"value":2014}," crate automatically handles deserialization of raw bytes into your Rust structs, reducing boilerplate and ensuring valid struct construction.",{"type":42,"tag":51,"props":2016,"children":2017},{},[2018,2023],{"type":42,"tag":110,"props":2019,"children":2020},{},[2021],{"type":48,"value":2022},"Limitation:",{"type":48,"value":2024}," The arbitrary crate doesn't offer reverse serialization, so you can't manually construct byte arrays that map to specific structs. This works best when starting from an empty corpus (fine for libFuzzer, problematic for AFL++).",{"type":42,"tag":57,"props":2026,"children":2028},{"id":2027},"advanced-usage",[2029],{"type":48,"value":2030},"Advanced Usage",{"type":42,"tag":69,"props":2032,"children":2034},{"id":2033},"tips-and-tricks",[2035],{"type":48,"value":2036},"Tips and Tricks",{"type":42,"tag":76,"props":2038,"children":2039},{},[2040,2056],{"type":42,"tag":80,"props":2041,"children":2042},{},[2043],{"type":42,"tag":84,"props":2044,"children":2045},{},[2046,2051],{"type":42,"tag":88,"props":2047,"children":2048},{},[2049],{"type":48,"value":2050},"Tip",{"type":42,"tag":88,"props":2052,"children":2053},{},[2054],{"type":48,"value":2055},"Why It Helps",{"type":42,"tag":99,"props":2057,"children":2058},{},[2059,2075,2091,2106,2122,2138,2154,2170],{"type":42,"tag":84,"props":2060,"children":2061},{},[2062,2070],{"type":42,"tag":106,"props":2063,"children":2064},{},[2065],{"type":42,"tag":110,"props":2066,"children":2067},{},[2068],{"type":48,"value":2069},"Start with parsers",{"type":42,"tag":106,"props":2071,"children":2072},{},[2073],{"type":48,"value":2074},"High bug density, clear entry points, easy to harness",{"type":42,"tag":84,"props":2076,"children":2077},{},[2078,2086],{"type":42,"tag":106,"props":2079,"children":2080},{},[2081],{"type":42,"tag":110,"props":2082,"children":2083},{},[2084],{"type":48,"value":2085},"Mock I\u002FO operations",{"type":42,"tag":106,"props":2087,"children":2088},{},[2089],{"type":48,"value":2090},"Prevents hangs from blocking I\u002FO, enables determinism",{"type":42,"tag":84,"props":2092,"children":2093},{},[2094,2101],{"type":42,"tag":106,"props":2095,"children":2096},{},[2097],{"type":42,"tag":110,"props":2098,"children":2099},{},[2100],{"type":48,"value":378},{"type":42,"tag":106,"props":2102,"children":2103},{},[2104],{"type":48,"value":2105},"Simplifies extraction of structured data from raw bytes",{"type":42,"tag":84,"props":2107,"children":2108},{},[2109,2117],{"type":42,"tag":106,"props":2110,"children":2111},{},[2112],{"type":42,"tag":110,"props":2113,"children":2114},{},[2115],{"type":48,"value":2116},"Reset global state",{"type":42,"tag":106,"props":2118,"children":2119},{},[2120],{"type":48,"value":2121},"Ensures each iteration is independent and reproducible",{"type":42,"tag":84,"props":2123,"children":2124},{},[2125,2133],{"type":42,"tag":106,"props":2126,"children":2127},{},[2128],{"type":42,"tag":110,"props":2129,"children":2130},{},[2131],{"type":48,"value":2132},"Free resources in harness",{"type":42,"tag":106,"props":2134,"children":2135},{},[2136],{"type":48,"value":2137},"Prevents memory exhaustion during long campaigns",{"type":42,"tag":84,"props":2139,"children":2140},{},[2141,2149],{"type":42,"tag":106,"props":2142,"children":2143},{},[2144],{"type":42,"tag":110,"props":2145,"children":2146},{},[2147],{"type":48,"value":2148},"Avoid logging in harness",{"type":42,"tag":106,"props":2150,"children":2151},{},[2152],{"type":48,"value":2153},"Logging is slow—fuzzing needs 100s-1000s exec\u002Fsec",{"type":42,"tag":84,"props":2155,"children":2156},{},[2157,2165],{"type":42,"tag":106,"props":2158,"children":2159},{},[2160],{"type":42,"tag":110,"props":2161,"children":2162},{},[2163],{"type":48,"value":2164},"Test harness manually first",{"type":42,"tag":106,"props":2166,"children":2167},{},[2168],{"type":48,"value":2169},"Run harness with known inputs before starting campaign",{"type":42,"tag":84,"props":2171,"children":2172},{},[2173,2181],{"type":42,"tag":106,"props":2174,"children":2175},{},[2176],{"type":42,"tag":110,"props":2177,"children":2178},{},[2179],{"type":48,"value":2180},"Check coverage early",{"type":42,"tag":106,"props":2182,"children":2183},{},[2184],{"type":48,"value":2185},"Ensure harness reaches expected code paths",{"type":42,"tag":69,"props":2187,"children":2189},{"id":2188},"structure-aware-fuzzing-with-protocol-buffers",[2190],{"type":48,"value":2191},"Structure-Aware Fuzzing with Protocol Buffers",{"type":42,"tag":51,"props":2193,"children":2194},{},[2195],{"type":48,"value":2196},"For highly structured input formats, consider using Protocol Buffers as an intermediate format with custom mutators:",{"type":42,"tag":510,"props":2198,"children":2200},{"className":512,"code":2199,"language":514,"meta":515,"style":515},"\u002F\u002F Define your input format in .proto file\n\u002F\u002F Use libprotobuf-mutator to generate valid mutations\n\u002F\u002F This ensures fuzzer mutates message contents, not the protobuf encoding itself\n",[2201],{"type":42,"tag":153,"props":2202,"children":2203},{"__ignoreMap":515},[2204,2212,2220],{"type":42,"tag":521,"props":2205,"children":2206},{"class":523,"line":524},[2207],{"type":42,"tag":521,"props":2208,"children":2209},{},[2210],{"type":48,"value":2211},"\u002F\u002F Define your input format in .proto file\n",{"type":42,"tag":521,"props":2213,"children":2214},{"class":523,"line":533},[2215],{"type":42,"tag":521,"props":2216,"children":2217},{},[2218],{"type":48,"value":2219},"\u002F\u002F Use libprotobuf-mutator to generate valid mutations\n",{"type":42,"tag":521,"props":2221,"children":2222},{"class":523,"line":542},[2223],{"type":42,"tag":521,"props":2224,"children":2225},{},[2226],{"type":48,"value":2227},"\u002F\u002F This ensures fuzzer mutates message contents, not the protobuf encoding itself\n",{"type":42,"tag":51,"props":2229,"children":2230},{},[2231,2233,2242],{"type":48,"value":2232},"This approach is more setup but prevents the fuzzer from wasting time on unparseable inputs. See ",{"type":42,"tag":2234,"props":2235,"children":2239},"a",{"href":2236,"rel":2237},"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Fdocs\u002Fstructure-aware-fuzzing.md",[2238],"nofollow",[2240],{"type":48,"value":2241},"structure-aware fuzzing documentation",{"type":48,"value":2243}," for details.",{"type":42,"tag":69,"props":2245,"children":2247},{"id":2246},"handling-non-determinism",[2248],{"type":48,"value":2249},"Handling Non-Determinism",{"type":42,"tag":51,"props":2251,"children":2252},{},[2253,2258],{"type":42,"tag":110,"props":2254,"children":2255},{},[2256],{"type":48,"value":2257},"Problem:",{"type":48,"value":2259}," Random values or timing dependencies cause non-reproducible crashes.",{"type":42,"tag":51,"props":2261,"children":2262},{},[2263],{"type":42,"tag":110,"props":2264,"children":2265},{},[2266],{"type":48,"value":2267},"Solutions:",{"type":42,"tag":224,"props":2269,"children":2270},{},[2271,2307,2312],{"type":42,"tag":228,"props":2272,"children":2273},{},[2274,2276,2282,2284],{"type":48,"value":2275},"Replace ",{"type":42,"tag":153,"props":2277,"children":2279},{"className":2278},[],[2280],{"type":48,"value":2281},"rand()",{"type":48,"value":2283}," with deterministic PRNG seeded from fuzzer input:\n",{"type":42,"tag":510,"props":2285,"children":2287},{"className":512,"code":2286,"language":514,"meta":515,"style":515},"uint32_t seed = fuzzed_data.ConsumeIntegral\u003Cuint32_t>();\nsrand(seed);\n",[2288],{"type":42,"tag":153,"props":2289,"children":2290},{"__ignoreMap":515},[2291,2299],{"type":42,"tag":521,"props":2292,"children":2293},{"class":523,"line":524},[2294],{"type":42,"tag":521,"props":2295,"children":2296},{},[2297],{"type":48,"value":2298},"uint32_t seed = fuzzed_data.ConsumeIntegral\u003Cuint32_t>();\n",{"type":42,"tag":521,"props":2300,"children":2301},{"class":523,"line":533},[2302],{"type":42,"tag":521,"props":2303,"children":2304},{},[2305],{"type":48,"value":2306},"srand(seed);\n",{"type":42,"tag":228,"props":2308,"children":2309},{},[2310],{"type":48,"value":2311},"Mock system calls that return time, PIDs, or random data",{"type":42,"tag":228,"props":2313,"children":2314},{},[2315,2317,2323,2325],{"type":48,"value":2316},"Avoid reading from ",{"type":42,"tag":153,"props":2318,"children":2320},{"className":2319},[],[2321],{"type":48,"value":2322},"\u002Fdev\u002Frandom",{"type":48,"value":2324}," or ",{"type":42,"tag":153,"props":2326,"children":2328},{"className":2327},[],[2329],{"type":48,"value":2330},"\u002Fdev\u002Furandom",{"type":42,"tag":69,"props":2332,"children":2334},{"id":2333},"resetting-global-state",[2335],{"type":48,"value":2336},"Resetting Global State",{"type":42,"tag":51,"props":2338,"children":2339},{},[2340],{"type":48,"value":2341},"If your SUT uses global state (singletons, static variables), reset it between iterations:",{"type":42,"tag":510,"props":2343,"children":2345},{"className":512,"code":2344,"language":514,"meta":515,"style":515},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n \u002F\u002F Reset global state before each iteration\n global_reset();\n\n target_function(data, size);\n\n \u002F\u002F Clean up resources\n global_cleanup();\n return 0;\n}\n",[2346],{"type":42,"tag":153,"props":2347,"children":2348},{"__ignoreMap":515},[2349,2356,2364,2372,2379,2386,2393,2401,2409,2416],{"type":42,"tag":521,"props":2350,"children":2351},{"class":523,"line":524},[2352],{"type":42,"tag":521,"props":2353,"children":2354},{},[2355],{"type":48,"value":530},{"type":42,"tag":521,"props":2357,"children":2358},{"class":523,"line":533},[2359],{"type":42,"tag":521,"props":2360,"children":2361},{},[2362],{"type":48,"value":2363}," \u002F\u002F Reset global state before each iteration\n",{"type":42,"tag":521,"props":2365,"children":2366},{"class":523,"line":542},[2367],{"type":42,"tag":521,"props":2368,"children":2369},{},[2370],{"type":48,"value":2371}," global_reset();\n",{"type":42,"tag":521,"props":2373,"children":2374},{"class":523,"line":551},[2375],{"type":42,"tag":521,"props":2376,"children":2377},{"emptyLinePlaceholder":596},[2378],{"type":48,"value":599},{"type":42,"tag":521,"props":2380,"children":2381},{"class":523,"line":610},[2382],{"type":42,"tag":521,"props":2383,"children":2384},{},[2385],{"type":48,"value":539},{"type":42,"tag":521,"props":2387,"children":2388},{"class":523,"line":619},[2389],{"type":42,"tag":521,"props":2390,"children":2391},{"emptyLinePlaceholder":596},[2392],{"type":48,"value":599},{"type":42,"tag":521,"props":2394,"children":2395},{"class":523,"line":692},[2396],{"type":42,"tag":521,"props":2397,"children":2398},{},[2399],{"type":48,"value":2400}," \u002F\u002F Clean up resources\n",{"type":42,"tag":521,"props":2402,"children":2403},{"class":523,"line":700},[2404],{"type":42,"tag":521,"props":2405,"children":2406},{},[2407],{"type":48,"value":2408}," global_cleanup();\n",{"type":42,"tag":521,"props":2410,"children":2411},{"class":523,"line":810},[2412],{"type":42,"tag":521,"props":2413,"children":2414},{},[2415],{"type":48,"value":548},{"type":42,"tag":521,"props":2417,"children":2418},{"class":523,"line":819},[2419],{"type":42,"tag":521,"props":2420,"children":2421},{},[2422],{"type":48,"value":557},{"type":42,"tag":51,"props":2424,"children":2425},{},[2426,2430],{"type":42,"tag":110,"props":2427,"children":2428},{},[2429],{"type":48,"value":713},{"type":48,"value":2431}," Global state can cause crashes after N iterations rather than on a specific input, making bugs non-reproducible.",{"type":42,"tag":57,"props":2433,"children":2435},{"id":2434},"practical-harness-rules",[2436],{"type":48,"value":2437},"Practical Harness Rules",{"type":42,"tag":51,"props":2439,"children":2440},{},[2441],{"type":48,"value":2442},"Follow these rules to ensure effective fuzzing harnesses:",{"type":42,"tag":76,"props":2444,"children":2445},{},[2446,2462],{"type":42,"tag":80,"props":2447,"children":2448},{},[2449],{"type":42,"tag":84,"props":2450,"children":2451},{},[2452,2457],{"type":42,"tag":88,"props":2453,"children":2454},{},[2455],{"type":48,"value":2456},"Rule",{"type":42,"tag":88,"props":2458,"children":2459},{},[2460],{"type":48,"value":2461},"Rationale",{"type":42,"tag":99,"props":2463,"children":2464},{},[2465,2481,2518,2534,2550,2566,2582,2598],{"type":42,"tag":84,"props":2466,"children":2467},{},[2468,2476],{"type":42,"tag":106,"props":2469,"children":2470},{},[2471],{"type":42,"tag":110,"props":2472,"children":2473},{},[2474],{"type":48,"value":2475},"Handle all input sizes",{"type":42,"tag":106,"props":2477,"children":2478},{},[2479],{"type":48,"value":2480},"Fuzzer generates empty, tiny, huge inputs—harness must handle gracefully",{"type":42,"tag":84,"props":2482,"children":2483},{},[2484,2498],{"type":42,"tag":106,"props":2485,"children":2486},{},[2487],{"type":42,"tag":110,"props":2488,"children":2489},{},[2490,2492],{"type":48,"value":2491},"Never call ",{"type":42,"tag":153,"props":2493,"children":2495},{"className":2494},[],[2496],{"type":48,"value":2497},"exit()",{"type":42,"tag":106,"props":2499,"children":2500},{},[2501,2503,2508,2510,2516],{"type":48,"value":2502},"Calling ",{"type":42,"tag":153,"props":2504,"children":2506},{"className":2505},[],[2507],{"type":48,"value":2497},{"type":48,"value":2509}," stops the fuzzer process. Use ",{"type":42,"tag":153,"props":2511,"children":2513},{"className":2512},[],[2514],{"type":48,"value":2515},"abort()",{"type":48,"value":2517}," in SUT if needed",{"type":42,"tag":84,"props":2519,"children":2520},{},[2521,2529],{"type":42,"tag":106,"props":2522,"children":2523},{},[2524],{"type":42,"tag":110,"props":2525,"children":2526},{},[2527],{"type":48,"value":2528},"Join all threads",{"type":42,"tag":106,"props":2530,"children":2531},{},[2532],{"type":48,"value":2533},"Each iteration must run to completion before next iteration starts",{"type":42,"tag":84,"props":2535,"children":2536},{},[2537,2545],{"type":42,"tag":106,"props":2538,"children":2539},{},[2540],{"type":42,"tag":110,"props":2541,"children":2542},{},[2543],{"type":48,"value":2544},"Be fast",{"type":42,"tag":106,"props":2546,"children":2547},{},[2548],{"type":48,"value":2549},"Aim for 100s-1000s executions\u002Fsec. Avoid logging, high complexity, excess memory",{"type":42,"tag":84,"props":2551,"children":2552},{},[2553,2561],{"type":42,"tag":106,"props":2554,"children":2555},{},[2556],{"type":42,"tag":110,"props":2557,"children":2558},{},[2559],{"type":48,"value":2560},"Maintain determinism",{"type":42,"tag":106,"props":2562,"children":2563},{},[2564],{"type":48,"value":2565},"Same input must always produce same behavior for reproducibility",{"type":42,"tag":84,"props":2567,"children":2568},{},[2569,2577],{"type":42,"tag":106,"props":2570,"children":2571},{},[2572],{"type":42,"tag":110,"props":2573,"children":2574},{},[2575],{"type":48,"value":2576},"Avoid global state",{"type":42,"tag":106,"props":2578,"children":2579},{},[2580],{"type":48,"value":2581},"Global state reduces reproducibility—reset between iterations if unavoidable",{"type":42,"tag":84,"props":2583,"children":2584},{},[2585,2593],{"type":42,"tag":106,"props":2586,"children":2587},{},[2588],{"type":42,"tag":110,"props":2589,"children":2590},{},[2591],{"type":48,"value":2592},"Use narrow targets",{"type":42,"tag":106,"props":2594,"children":2595},{},[2596],{"type":48,"value":2597},"Don't fuzz PNG and TCP in same harness—different formats need separate targets",{"type":42,"tag":84,"props":2599,"children":2600},{},[2601,2609],{"type":42,"tag":106,"props":2602,"children":2603},{},[2604],{"type":42,"tag":110,"props":2605,"children":2606},{},[2607],{"type":48,"value":2608},"Free resources",{"type":42,"tag":106,"props":2610,"children":2611},{},[2612],{"type":48,"value":2613},"Prevent memory leaks that cause resource exhaustion during long campaigns",{"type":42,"tag":51,"props":2615,"children":2616},{},[2617,2622],{"type":42,"tag":110,"props":2618,"children":2619},{},[2620],{"type":48,"value":2621},"Note:",{"type":48,"value":2623}," These guidelines apply not just to harness code, but to the entire SUT. If the SUT violates these rules, consider patching it (see the fuzzing obstacles technique).",{"type":42,"tag":57,"props":2625,"children":2627},{"id":2626},"anti-patterns",[2628],{"type":48,"value":2629},"Anti-Patterns",{"type":42,"tag":76,"props":2631,"children":2632},{},[2633,2654],{"type":42,"tag":80,"props":2634,"children":2635},{},[2636],{"type":42,"tag":84,"props":2637,"children":2638},{},[2639,2644,2649],{"type":42,"tag":88,"props":2640,"children":2641},{},[2642],{"type":48,"value":2643},"Anti-Pattern",{"type":42,"tag":88,"props":2645,"children":2646},{},[2647],{"type":48,"value":2648},"Problem",{"type":42,"tag":88,"props":2650,"children":2651},{},[2652],{"type":48,"value":2653},"Correct Approach",{"type":42,"tag":99,"props":2655,"children":2656},{},[2657,2678,2699,2720,2754,2775,2796,2817],{"type":42,"tag":84,"props":2658,"children":2659},{},[2660,2668,2673],{"type":42,"tag":106,"props":2661,"children":2662},{},[2663],{"type":42,"tag":110,"props":2664,"children":2665},{},[2666],{"type":48,"value":2667},"Global state without reset",{"type":42,"tag":106,"props":2669,"children":2670},{},[2671],{"type":48,"value":2672},"Non-deterministic crashes",{"type":42,"tag":106,"props":2674,"children":2675},{},[2676],{"type":48,"value":2677},"Reset all globals at start of harness",{"type":42,"tag":84,"props":2679,"children":2680},{},[2681,2689,2694],{"type":42,"tag":106,"props":2682,"children":2683},{},[2684],{"type":42,"tag":110,"props":2685,"children":2686},{},[2687],{"type":48,"value":2688},"Blocking I\u002FO or network calls",{"type":42,"tag":106,"props":2690,"children":2691},{},[2692],{"type":48,"value":2693},"Hangs fuzzer, wastes time",{"type":42,"tag":106,"props":2695,"children":2696},{},[2697],{"type":48,"value":2698},"Mock I\u002FO, use in-memory buffers",{"type":42,"tag":84,"props":2700,"children":2701},{},[2702,2710,2715],{"type":42,"tag":106,"props":2703,"children":2704},{},[2705],{"type":42,"tag":110,"props":2706,"children":2707},{},[2708],{"type":48,"value":2709},"Memory leaks in harness",{"type":42,"tag":106,"props":2711,"children":2712},{},[2713],{"type":48,"value":2714},"Resource exhaustion kills campaign",{"type":42,"tag":106,"props":2716,"children":2717},{},[2718],{"type":48,"value":2719},"Free all allocations before returning",{"type":42,"tag":84,"props":2721,"children":2722},{},[2723,2737,2742],{"type":42,"tag":106,"props":2724,"children":2725},{},[2726],{"type":42,"tag":110,"props":2727,"children":2728},{},[2729,2730,2735],{"type":48,"value":2502},{"type":42,"tag":153,"props":2731,"children":2733},{"className":2732},[],[2734],{"type":48,"value":2497},{"type":48,"value":2736}," in SUT",{"type":42,"tag":106,"props":2738,"children":2739},{},[2740],{"type":48,"value":2741},"Stops entire fuzzing process",{"type":42,"tag":106,"props":2743,"children":2744},{},[2745,2747,2752],{"type":48,"value":2746},"Use ",{"type":42,"tag":153,"props":2748,"children":2750},{"className":2749},[],[2751],{"type":48,"value":2515},{"type":48,"value":2753}," or return error codes",{"type":42,"tag":84,"props":2755,"children":2756},{},[2757,2765,2770],{"type":42,"tag":106,"props":2758,"children":2759},{},[2760],{"type":42,"tag":110,"props":2761,"children":2762},{},[2763],{"type":48,"value":2764},"Heavy logging in harness",{"type":42,"tag":106,"props":2766,"children":2767},{},[2768],{"type":48,"value":2769},"Reduces exec\u002Fsec by orders of magnitude",{"type":42,"tag":106,"props":2771,"children":2772},{},[2773],{"type":48,"value":2774},"Disable logging during fuzzing",{"type":42,"tag":84,"props":2776,"children":2777},{},[2778,2786,2791],{"type":42,"tag":106,"props":2779,"children":2780},{},[2781],{"type":42,"tag":110,"props":2782,"children":2783},{},[2784],{"type":48,"value":2785},"Too many operations per iteration",{"type":42,"tag":106,"props":2787,"children":2788},{},[2789],{"type":48,"value":2790},"Slows down fuzzer",{"type":42,"tag":106,"props":2792,"children":2793},{},[2794],{"type":48,"value":2795},"Keep iterations fast and focused",{"type":42,"tag":84,"props":2797,"children":2798},{},[2799,2807,2812],{"type":42,"tag":106,"props":2800,"children":2801},{},[2802],{"type":42,"tag":110,"props":2803,"children":2804},{},[2805],{"type":48,"value":2806},"Mixing unrelated input formats",{"type":42,"tag":106,"props":2808,"children":2809},{},[2810],{"type":48,"value":2811},"Corpus entries not useful across formats",{"type":42,"tag":106,"props":2813,"children":2814},{},[2815],{"type":48,"value":2816},"Separate harnesses for different formats",{"type":42,"tag":84,"props":2818,"children":2819},{},[2820,2828,2833],{"type":42,"tag":106,"props":2821,"children":2822},{},[2823],{"type":42,"tag":110,"props":2824,"children":2825},{},[2826],{"type":48,"value":2827},"Not validating input size",{"type":42,"tag":106,"props":2829,"children":2830},{},[2831],{"type":48,"value":2832},"Harness crashes on edge cases",{"type":42,"tag":106,"props":2834,"children":2835},{},[2836,2838,2844,2846],{"type":48,"value":2837},"Check ",{"type":42,"tag":153,"props":2839,"children":2841},{"className":2840},[],[2842],{"type":48,"value":2843},"size",{"type":48,"value":2845}," before accessing ",{"type":42,"tag":153,"props":2847,"children":2849},{"className":2848},[],[2850],{"type":48,"value":2851},"data",{"type":42,"tag":57,"props":2853,"children":2855},{"id":2854},"tool-specific-guidance",[2856],{"type":48,"value":2857},"Tool-Specific Guidance",{"type":42,"tag":69,"props":2859,"children":2861},{"id":2860},"libfuzzer",[2862],{"type":48,"value":2863},"libFuzzer",{"type":42,"tag":51,"props":2865,"children":2866},{},[2867],{"type":42,"tag":110,"props":2868,"children":2869},{},[2870],{"type":48,"value":2871},"Harness signature:",{"type":42,"tag":510,"props":2873,"children":2875},{"className":512,"code":2874,"language":514,"meta":515,"style":515},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n \u002F\u002F Your code here\n return 0; \u002F\u002F Non-zero return is reserved for future use\n}\n",[2876],{"type":42,"tag":153,"props":2877,"children":2878},{"__ignoreMap":515},[2879,2886,2894,2902],{"type":42,"tag":521,"props":2880,"children":2881},{"class":523,"line":524},[2882],{"type":42,"tag":521,"props":2883,"children":2884},{},[2885],{"type":48,"value":530},{"type":42,"tag":521,"props":2887,"children":2888},{"class":523,"line":533},[2889],{"type":42,"tag":521,"props":2890,"children":2891},{},[2892],{"type":48,"value":2893}," \u002F\u002F Your code here\n",{"type":42,"tag":521,"props":2895,"children":2896},{"class":523,"line":542},[2897],{"type":42,"tag":521,"props":2898,"children":2899},{},[2900],{"type":48,"value":2901}," return 0; \u002F\u002F Non-zero return is reserved for future use\n",{"type":42,"tag":521,"props":2903,"children":2904},{"class":523,"line":551},[2905],{"type":42,"tag":521,"props":2906,"children":2907},{},[2908],{"type":48,"value":557},{"type":42,"tag":51,"props":2910,"children":2911},{},[2912],{"type":42,"tag":110,"props":2913,"children":2914},{},[2915],{"type":48,"value":2916},"Compilation:",{"type":42,"tag":510,"props":2918,"children":2922},{"className":2919,"code":2920,"language":2921,"meta":515,"style":515},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","clang++ -fsanitize=fuzzer,address -g harness.cc -o fuzz_target\n","bash",[2923],{"type":42,"tag":153,"props":2924,"children":2925},{"__ignoreMap":515},[2926],{"type":42,"tag":521,"props":2927,"children":2928},{"class":523,"line":524},[2929,2935,2941,2946,2951,2956],{"type":42,"tag":521,"props":2930,"children":2932},{"style":2931},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[2933],{"type":48,"value":2934},"clang++",{"type":42,"tag":521,"props":2936,"children":2938},{"style":2937},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[2939],{"type":48,"value":2940}," -fsanitize=fuzzer,address",{"type":42,"tag":521,"props":2942,"children":2943},{"style":2937},[2944],{"type":48,"value":2945}," -g",{"type":42,"tag":521,"props":2947,"children":2948},{"style":2937},[2949],{"type":48,"value":2950}," harness.cc",{"type":42,"tag":521,"props":2952,"children":2953},{"style":2937},[2954],{"type":48,"value":2955}," -o",{"type":42,"tag":521,"props":2957,"children":2958},{"style":2937},[2959],{"type":48,"value":2960}," fuzz_target\n",{"type":42,"tag":51,"props":2962,"children":2963},{},[2964],{"type":42,"tag":110,"props":2965,"children":2966},{},[2967],{"type":48,"value":2968},"Integration tips:",{"type":42,"tag":224,"props":2970,"children":2971},{},[2972,2984,2997,3010,3022],{"type":42,"tag":228,"props":2973,"children":2974},{},[2975,2976,2982],{"type":48,"value":2746},{"type":42,"tag":153,"props":2977,"children":2979},{"className":2978},[],[2980],{"type":48,"value":2981},"FuzzedDataProvider.h",{"type":48,"value":2983}," for structured input extraction",{"type":42,"tag":228,"props":2985,"children":2986},{},[2987,2989,2995],{"type":48,"value":2988},"Compile with ",{"type":42,"tag":153,"props":2990,"children":2992},{"className":2991},[],[2993],{"type":48,"value":2994},"-fsanitize=fuzzer",{"type":48,"value":2996}," to link the fuzzing runtime",{"type":42,"tag":228,"props":2998,"children":2999},{},[3000,3002,3008],{"type":48,"value":3001},"Add sanitizers (",{"type":42,"tag":153,"props":3003,"children":3005},{"className":3004},[],[3006],{"type":48,"value":3007},"-fsanitize=address,undefined",{"type":48,"value":3009},") to detect more bugs",{"type":42,"tag":228,"props":3011,"children":3012},{},[3013,3014,3020],{"type":48,"value":2746},{"type":42,"tag":153,"props":3015,"children":3017},{"className":3016},[],[3018],{"type":48,"value":3019},"-g",{"type":48,"value":3021}," for better stack traces when crashes occur",{"type":42,"tag":228,"props":3023,"children":3024},{},[3025],{"type":48,"value":3026},"libFuzzer can start with empty corpus—no seed inputs required",{"type":42,"tag":51,"props":3028,"children":3029},{},[3030],{"type":42,"tag":110,"props":3031,"children":3032},{},[3033],{"type":48,"value":3034},"Running:",{"type":42,"tag":510,"props":3036,"children":3038},{"className":2919,"code":3037,"language":2921,"meta":515,"style":515},".\u002Ffuzz_target corpus_dir\u002F\n",[3039],{"type":42,"tag":153,"props":3040,"children":3041},{"__ignoreMap":515},[3042],{"type":42,"tag":521,"props":3043,"children":3044},{"class":523,"line":524},[3045,3050],{"type":42,"tag":521,"props":3046,"children":3047},{"style":2931},[3048],{"type":48,"value":3049},".\u002Ffuzz_target",{"type":42,"tag":521,"props":3051,"children":3052},{"style":2937},[3053],{"type":48,"value":3054}," corpus_dir\u002F\n",{"type":42,"tag":51,"props":3056,"children":3057},{},[3058],{"type":42,"tag":110,"props":3059,"children":3060},{},[3061],{"type":48,"value":3062},"Resources:",{"type":42,"tag":224,"props":3064,"children":3065},{},[3066,3076],{"type":42,"tag":228,"props":3067,"children":3068},{},[3069],{"type":42,"tag":2234,"props":3070,"children":3073},{"href":3071,"rel":3072},"https:\u002F\u002Fgithub.com\u002Fllvm\u002Fllvm-project\u002Fblob\u002Fmain\u002Fcompiler-rt\u002Finclude\u002Ffuzzer\u002FFuzzedDataProvider.h",[2238],[3074],{"type":48,"value":3075},"FuzzedDataProvider header",{"type":42,"tag":228,"props":3077,"children":3078},{},[3079],{"type":42,"tag":2234,"props":3080,"children":3083},{"href":3081,"rel":3082},"https:\u002F\u002Fllvm.org\u002Fdocs\u002FLibFuzzer.html",[2238],[3084],{"type":48,"value":3085},"libFuzzer documentation",{"type":42,"tag":69,"props":3087,"children":3089},{"id":3088},"afl",[3090],{"type":48,"value":3091},"AFL++",{"type":42,"tag":51,"props":3093,"children":3094},{},[3095],{"type":48,"value":3096},"AFL++ supports multiple harness styles. For best performance, use persistent mode:",{"type":42,"tag":51,"props":3098,"children":3099},{},[3100],{"type":42,"tag":110,"props":3101,"children":3102},{},[3103],{"type":48,"value":3104},"Persistent mode harness:",{"type":42,"tag":510,"props":3106,"children":3108},{"className":512,"code":3107,"language":514,"meta":515,"style":515},"#include \u003Cunistd.h>\n\nint main(int argc, char **argv) {\n #ifdef __AFL_HAVE_MANUAL_CONTROL\n __AFL_INIT();\n #endif\n\n unsigned char buf[MAX_SIZE];\n\n while (__AFL_LOOP(10000)) {\n \u002F\u002F Read input from stdin\n ssize_t len = read(0, buf, sizeof(buf));\n if (len \u003C= 0) break;\n\n \u002F\u002F Call target function\n target_function(buf, len);\n }\n\n return 0;\n}\n",[3109],{"type":42,"tag":153,"props":3110,"children":3111},{"__ignoreMap":515},[3112,3120,3127,3135,3143,3151,3159,3166,3174,3181,3189,3197,3205,3213,3220,3228,3236,3243,3250,3257],{"type":42,"tag":521,"props":3113,"children":3114},{"class":523,"line":524},[3115],{"type":42,"tag":521,"props":3116,"children":3117},{},[3118],{"type":48,"value":3119},"#include \u003Cunistd.h>\n",{"type":42,"tag":521,"props":3121,"children":3122},{"class":523,"line":533},[3123],{"type":42,"tag":521,"props":3124,"children":3125},{"emptyLinePlaceholder":596},[3126],{"type":48,"value":599},{"type":42,"tag":521,"props":3128,"children":3129},{"class":523,"line":542},[3130],{"type":42,"tag":521,"props":3131,"children":3132},{},[3133],{"type":48,"value":3134},"int main(int argc, char **argv) {\n",{"type":42,"tag":521,"props":3136,"children":3137},{"class":523,"line":551},[3138],{"type":42,"tag":521,"props":3139,"children":3140},{},[3141],{"type":48,"value":3142}," #ifdef __AFL_HAVE_MANUAL_CONTROL\n",{"type":42,"tag":521,"props":3144,"children":3145},{"class":523,"line":610},[3146],{"type":42,"tag":521,"props":3147,"children":3148},{},[3149],{"type":48,"value":3150}," __AFL_INIT();\n",{"type":42,"tag":521,"props":3152,"children":3153},{"class":523,"line":619},[3154],{"type":42,"tag":521,"props":3155,"children":3156},{},[3157],{"type":48,"value":3158}," #endif\n",{"type":42,"tag":521,"props":3160,"children":3161},{"class":523,"line":692},[3162],{"type":42,"tag":521,"props":3163,"children":3164},{"emptyLinePlaceholder":596},[3165],{"type":48,"value":599},{"type":42,"tag":521,"props":3167,"children":3168},{"class":523,"line":700},[3169],{"type":42,"tag":521,"props":3170,"children":3171},{},[3172],{"type":48,"value":3173}," unsigned char buf[MAX_SIZE];\n",{"type":42,"tag":521,"props":3175,"children":3176},{"class":523,"line":810},[3177],{"type":42,"tag":521,"props":3178,"children":3179},{"emptyLinePlaceholder":596},[3180],{"type":48,"value":599},{"type":42,"tag":521,"props":3182,"children":3183},{"class":523,"line":819},[3184],{"type":42,"tag":521,"props":3185,"children":3186},{},[3187],{"type":48,"value":3188}," while (__AFL_LOOP(10000)) {\n",{"type":42,"tag":521,"props":3190,"children":3191},{"class":523,"line":827},[3192],{"type":42,"tag":521,"props":3193,"children":3194},{},[3195],{"type":48,"value":3196}," \u002F\u002F Read input from stdin\n",{"type":42,"tag":521,"props":3198,"children":3199},{"class":523,"line":933},[3200],{"type":42,"tag":521,"props":3201,"children":3202},{},[3203],{"type":48,"value":3204}," ssize_t len = read(0, buf, sizeof(buf));\n",{"type":42,"tag":521,"props":3206,"children":3207},{"class":523,"line":1098},[3208],{"type":42,"tag":521,"props":3209,"children":3210},{},[3211],{"type":48,"value":3212}," if (len \u003C= 0) break;\n",{"type":42,"tag":521,"props":3214,"children":3215},{"class":523,"line":1328},[3216],{"type":42,"tag":521,"props":3217,"children":3218},{"emptyLinePlaceholder":596},[3219],{"type":48,"value":599},{"type":42,"tag":521,"props":3221,"children":3222},{"class":523,"line":1337},[3223],{"type":42,"tag":521,"props":3224,"children":3225},{},[3226],{"type":48,"value":3227}," \u002F\u002F Call target function\n",{"type":42,"tag":521,"props":3229,"children":3230},{"class":523,"line":1346},[3231],{"type":42,"tag":521,"props":3232,"children":3233},{},[3234],{"type":48,"value":3235}," target_function(buf, len);\n",{"type":42,"tag":521,"props":3237,"children":3238},{"class":523,"line":1354},[3239],{"type":42,"tag":521,"props":3240,"children":3241},{},[3242],{"type":48,"value":682},{"type":42,"tag":521,"props":3244,"children":3245},{"class":523,"line":1362},[3246],{"type":42,"tag":521,"props":3247,"children":3248},{"emptyLinePlaceholder":596},[3249],{"type":48,"value":599},{"type":42,"tag":521,"props":3251,"children":3252},{"class":523,"line":1370},[3253],{"type":42,"tag":521,"props":3254,"children":3255},{},[3256],{"type":48,"value":548},{"type":42,"tag":521,"props":3258,"children":3259},{"class":523,"line":1570},[3260],{"type":42,"tag":521,"props":3261,"children":3262},{},[3263],{"type":48,"value":557},{"type":42,"tag":51,"props":3265,"children":3266},{},[3267],{"type":42,"tag":110,"props":3268,"children":3269},{},[3270],{"type":48,"value":2916},{"type":42,"tag":510,"props":3272,"children":3274},{"className":2919,"code":3273,"language":2921,"meta":515,"style":515},"afl-clang-fast++ -g harness.cc -o fuzz_target\n",[3275],{"type":42,"tag":153,"props":3276,"children":3277},{"__ignoreMap":515},[3278],{"type":42,"tag":521,"props":3279,"children":3280},{"class":523,"line":524},[3281,3286,3290,3294,3298],{"type":42,"tag":521,"props":3282,"children":3283},{"style":2931},[3284],{"type":48,"value":3285},"afl-clang-fast++",{"type":42,"tag":521,"props":3287,"children":3288},{"style":2937},[3289],{"type":48,"value":2945},{"type":42,"tag":521,"props":3291,"children":3292},{"style":2937},[3293],{"type":48,"value":2950},{"type":42,"tag":521,"props":3295,"children":3296},{"style":2937},[3297],{"type":48,"value":2955},{"type":42,"tag":521,"props":3299,"children":3300},{"style":2937},[3301],{"type":48,"value":2960},{"type":42,"tag":51,"props":3303,"children":3304},{},[3305],{"type":42,"tag":110,"props":3306,"children":3307},{},[3308],{"type":48,"value":2968},{"type":42,"tag":224,"props":3310,"children":3311},{},[3312,3325,3338,3343],{"type":42,"tag":228,"props":3313,"children":3314},{},[3315,3317,3323],{"type":48,"value":3316},"Use persistent mode (",{"type":42,"tag":153,"props":3318,"children":3320},{"className":3319},[],[3321],{"type":48,"value":3322},"__AFL_LOOP",{"type":48,"value":3324},") for 10-100x speedup",{"type":42,"tag":228,"props":3326,"children":3327},{},[3328,3330,3336],{"type":48,"value":3329},"Consider deferred initialization (",{"type":42,"tag":153,"props":3331,"children":3333},{"className":3332},[],[3334],{"type":48,"value":3335},"__AFL_INIT()",{"type":48,"value":3337},") to skip setup overhead",{"type":42,"tag":228,"props":3339,"children":3340},{},[3341],{"type":48,"value":3342},"AFL++ requires at least one seed input in the corpus directory",{"type":42,"tag":228,"props":3344,"children":3345},{},[3346,3347,3353,3354,3360],{"type":48,"value":2746},{"type":42,"tag":153,"props":3348,"children":3350},{"className":3349},[],[3351],{"type":48,"value":3352},"AFL_USE_ASAN=1",{"type":48,"value":2324},{"type":42,"tag":153,"props":3355,"children":3357},{"className":3356},[],[3358],{"type":48,"value":3359},"AFL_USE_UBSAN=1",{"type":48,"value":3361}," for sanitizer builds",{"type":42,"tag":51,"props":3363,"children":3364},{},[3365],{"type":42,"tag":110,"props":3366,"children":3367},{},[3368],{"type":48,"value":3034},{"type":42,"tag":510,"props":3370,"children":3372},{"className":2919,"code":3371,"language":2921,"meta":515,"style":515},"afl-fuzz -i seeds\u002F -o findings\u002F -- .\u002Ffuzz_target\n",[3373],{"type":42,"tag":153,"props":3374,"children":3375},{"__ignoreMap":515},[3376],{"type":42,"tag":521,"props":3377,"children":3378},{"class":523,"line":524},[3379,3384,3389,3394,3398,3403,3408],{"type":42,"tag":521,"props":3380,"children":3381},{"style":2931},[3382],{"type":48,"value":3383},"afl-fuzz",{"type":42,"tag":521,"props":3385,"children":3386},{"style":2937},[3387],{"type":48,"value":3388}," -i",{"type":42,"tag":521,"props":3390,"children":3391},{"style":2937},[3392],{"type":48,"value":3393}," seeds\u002F",{"type":42,"tag":521,"props":3395,"children":3396},{"style":2937},[3397],{"type":48,"value":2955},{"type":42,"tag":521,"props":3399,"children":3400},{"style":2937},[3401],{"type":48,"value":3402}," findings\u002F",{"type":42,"tag":521,"props":3404,"children":3405},{"style":2937},[3406],{"type":48,"value":3407}," --",{"type":42,"tag":521,"props":3409,"children":3410},{"style":2937},[3411],{"type":48,"value":3412}," .\u002Ffuzz_target\n",{"type":42,"tag":69,"props":3414,"children":3416},{"id":3415},"cargo-fuzz-rust",[3417],{"type":48,"value":3418},"cargo-fuzz (Rust)",{"type":42,"tag":51,"props":3420,"children":3421},{},[3422],{"type":42,"tag":110,"props":3423,"children":3424},{},[3425],{"type":48,"value":2871},{"type":42,"tag":510,"props":3427,"children":3429},{"className":568,"code":3428,"language":570,"meta":515,"style":515},"#![no_main]\nuse libfuzzer_sys::fuzz_target;\n\nfuzz_target!(|data: &[u8]| {\n \u002F\u002F Your code here\n});\n",[3430],{"type":42,"tag":153,"props":3431,"children":3432},{"__ignoreMap":515},[3433,3440,3447,3454,3461,3468],{"type":42,"tag":521,"props":3434,"children":3435},{"class":523,"line":524},[3436],{"type":42,"tag":521,"props":3437,"children":3438},{},[3439],{"type":48,"value":582},{"type":42,"tag":521,"props":3441,"children":3442},{"class":523,"line":533},[3443],{"type":42,"tag":521,"props":3444,"children":3445},{},[3446],{"type":48,"value":590},{"type":42,"tag":521,"props":3448,"children":3449},{"class":523,"line":542},[3450],{"type":42,"tag":521,"props":3451,"children":3452},{"emptyLinePlaceholder":596},[3453],{"type":48,"value":599},{"type":42,"tag":521,"props":3455,"children":3456},{"class":523,"line":551},[3457],{"type":42,"tag":521,"props":3458,"children":3459},{},[3460],{"type":48,"value":607},{"type":42,"tag":521,"props":3462,"children":3463},{"class":523,"line":610},[3464],{"type":42,"tag":521,"props":3465,"children":3466},{},[3467],{"type":48,"value":2893},{"type":42,"tag":521,"props":3469,"children":3470},{"class":523,"line":619},[3471],{"type":42,"tag":521,"props":3472,"children":3473},{},[3474],{"type":48,"value":625},{"type":42,"tag":51,"props":3476,"children":3477},{},[3478],{"type":42,"tag":110,"props":3479,"children":3480},{},[3481],{"type":48,"value":3482},"With structured input (arbitrary crate):",{"type":42,"tag":510,"props":3484,"children":3486},{"className":568,"code":3485,"language":570,"meta":515,"style":515},"#![no_main]\nuse libfuzzer_sys::fuzz_target;\n\nfuzz_target!(|data: YourStruct| {\n data.check();\n});\n",[3487],{"type":42,"tag":153,"props":3488,"children":3489},{"__ignoreMap":515},[3490,3497,3504,3511,3519,3527],{"type":42,"tag":521,"props":3491,"children":3492},{"class":523,"line":524},[3493],{"type":42,"tag":521,"props":3494,"children":3495},{},[3496],{"type":48,"value":582},{"type":42,"tag":521,"props":3498,"children":3499},{"class":523,"line":533},[3500],{"type":42,"tag":521,"props":3501,"children":3502},{},[3503],{"type":48,"value":590},{"type":42,"tag":521,"props":3505,"children":3506},{"class":523,"line":542},[3507],{"type":42,"tag":521,"props":3508,"children":3509},{"emptyLinePlaceholder":596},[3510],{"type":48,"value":599},{"type":42,"tag":521,"props":3512,"children":3513},{"class":523,"line":551},[3514],{"type":42,"tag":521,"props":3515,"children":3516},{},[3517],{"type":48,"value":3518},"fuzz_target!(|data: YourStruct| {\n",{"type":42,"tag":521,"props":3520,"children":3521},{"class":523,"line":610},[3522],{"type":42,"tag":521,"props":3523,"children":3524},{},[3525],{"type":48,"value":3526}," data.check();\n",{"type":42,"tag":521,"props":3528,"children":3529},{"class":523,"line":619},[3530],{"type":42,"tag":521,"props":3531,"children":3532},{},[3533],{"type":48,"value":625},{"type":42,"tag":51,"props":3535,"children":3536},{},[3537],{"type":42,"tag":110,"props":3538,"children":3539},{},[3540],{"type":48,"value":3541},"Creating harness:",{"type":42,"tag":510,"props":3543,"children":3545},{"className":2919,"code":3544,"language":2921,"meta":515,"style":515},"cargo fuzz init\ncargo fuzz add my_target\n",[3546],{"type":42,"tag":153,"props":3547,"children":3548},{"__ignoreMap":515},[3549,3567],{"type":42,"tag":521,"props":3550,"children":3551},{"class":523,"line":524},[3552,3557,3562],{"type":42,"tag":521,"props":3553,"children":3554},{"style":2931},[3555],{"type":48,"value":3556},"cargo",{"type":42,"tag":521,"props":3558,"children":3559},{"style":2937},[3560],{"type":48,"value":3561}," fuzz",{"type":42,"tag":521,"props":3563,"children":3564},{"style":2937},[3565],{"type":48,"value":3566}," init\n",{"type":42,"tag":521,"props":3568,"children":3569},{"class":523,"line":533},[3570,3574,3578,3583],{"type":42,"tag":521,"props":3571,"children":3572},{"style":2931},[3573],{"type":48,"value":3556},{"type":42,"tag":521,"props":3575,"children":3576},{"style":2937},[3577],{"type":48,"value":3561},{"type":42,"tag":521,"props":3579,"children":3580},{"style":2937},[3581],{"type":48,"value":3582}," add",{"type":42,"tag":521,"props":3584,"children":3585},{"style":2937},[3586],{"type":48,"value":3587}," my_target\n",{"type":42,"tag":51,"props":3589,"children":3590},{},[3591],{"type":42,"tag":110,"props":3592,"children":3593},{},[3594],{"type":48,"value":2968},{"type":42,"tag":224,"props":3596,"children":3597},{},[3598,3609,3614,3619],{"type":42,"tag":228,"props":3599,"children":3600},{},[3601,3602,3607],{"type":48,"value":2746},{"type":42,"tag":153,"props":3603,"children":3605},{"className":3604},[],[3606],{"type":48,"value":2012},{"type":48,"value":3608}," crate for automatic struct deserialization",{"type":42,"tag":228,"props":3610,"children":3611},{},[3612],{"type":48,"value":3613},"cargo-fuzz wraps libFuzzer, so all libFuzzer features work",{"type":42,"tag":228,"props":3615,"children":3616},{},[3617],{"type":48,"value":3618},"Compile with sanitizers automatically via cargo-fuzz",{"type":42,"tag":228,"props":3620,"children":3621},{},[3622,3624,3630],{"type":48,"value":3623},"Harnesses go in ",{"type":42,"tag":153,"props":3625,"children":3627},{"className":3626},[],[3628],{"type":48,"value":3629},"fuzz\u002Ffuzz_targets\u002F",{"type":48,"value":3631}," directory",{"type":42,"tag":51,"props":3633,"children":3634},{},[3635],{"type":42,"tag":110,"props":3636,"children":3637},{},[3638],{"type":48,"value":3034},{"type":42,"tag":510,"props":3640,"children":3642},{"className":2919,"code":3641,"language":2921,"meta":515,"style":515},"cargo +nightly fuzz run my_target\n",[3643],{"type":42,"tag":153,"props":3644,"children":3645},{"__ignoreMap":515},[3646],{"type":42,"tag":521,"props":3647,"children":3648},{"class":523,"line":524},[3649,3653,3658,3662,3667],{"type":42,"tag":521,"props":3650,"children":3651},{"style":2931},[3652],{"type":48,"value":3556},{"type":42,"tag":521,"props":3654,"children":3655},{"style":2937},[3656],{"type":48,"value":3657}," +nightly",{"type":42,"tag":521,"props":3659,"children":3660},{"style":2937},[3661],{"type":48,"value":3561},{"type":42,"tag":521,"props":3663,"children":3664},{"style":2937},[3665],{"type":48,"value":3666}," run",{"type":42,"tag":521,"props":3668,"children":3669},{"style":2937},[3670],{"type":48,"value":3587},{"type":42,"tag":51,"props":3672,"children":3673},{},[3674],{"type":42,"tag":110,"props":3675,"children":3676},{},[3677],{"type":48,"value":3062},{"type":42,"tag":224,"props":3679,"children":3680},{},[3681,3691],{"type":42,"tag":228,"props":3682,"children":3683},{},[3684],{"type":42,"tag":2234,"props":3685,"children":3688},{"href":3686,"rel":3687},"https:\u002F\u002Frust-fuzz.github.io\u002Fbook\u002Fcargo-fuzz.html",[2238],[3689],{"type":48,"value":3690},"cargo-fuzz documentation",{"type":42,"tag":228,"props":3692,"children":3693},{},[3694],{"type":42,"tag":2234,"props":3695,"children":3698},{"href":3696,"rel":3697},"https:\u002F\u002Fgithub.com\u002Frust-fuzz\u002Farbitrary",[2238],[3699],{"type":48,"value":3700},"arbitrary crate",{"type":42,"tag":69,"props":3702,"children":3704},{"id":3703},"go-fuzz",[3705],{"type":48,"value":3703},{"type":42,"tag":51,"props":3707,"children":3708},{},[3709],{"type":42,"tag":110,"props":3710,"children":3711},{},[3712],{"type":48,"value":2871},{"type":42,"tag":510,"props":3714,"children":3718},{"className":3715,"code":3716,"language":3717,"meta":515,"style":515},"language-go shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u002F\u002F +build gofuzz\n\npackage mypackage\n\nfunc Fuzz(data []byte) int {\n \u002F\u002F Call target function\n target(data)\n\n \u002F\u002F Return codes:\n \u002F\u002F -1 if input is invalid\n \u002F\u002F 0 if input is valid but not interesting\n \u002F\u002F 1 if input is interesting (e.g., added new coverage)\n return 0\n}\n","go",[3719],{"type":42,"tag":153,"props":3720,"children":3721},{"__ignoreMap":515},[3722,3730,3737,3745,3752,3760,3768,3776,3783,3791,3799,3807,3815,3823],{"type":42,"tag":521,"props":3723,"children":3724},{"class":523,"line":524},[3725],{"type":42,"tag":521,"props":3726,"children":3727},{},[3728],{"type":48,"value":3729},"\u002F\u002F +build gofuzz\n",{"type":42,"tag":521,"props":3731,"children":3732},{"class":523,"line":533},[3733],{"type":42,"tag":521,"props":3734,"children":3735},{"emptyLinePlaceholder":596},[3736],{"type":48,"value":599},{"type":42,"tag":521,"props":3738,"children":3739},{"class":523,"line":542},[3740],{"type":42,"tag":521,"props":3741,"children":3742},{},[3743],{"type":48,"value":3744},"package mypackage\n",{"type":42,"tag":521,"props":3746,"children":3747},{"class":523,"line":551},[3748],{"type":42,"tag":521,"props":3749,"children":3750},{"emptyLinePlaceholder":596},[3751],{"type":48,"value":599},{"type":42,"tag":521,"props":3753,"children":3754},{"class":523,"line":610},[3755],{"type":42,"tag":521,"props":3756,"children":3757},{},[3758],{"type":48,"value":3759},"func Fuzz(data []byte) int {\n",{"type":42,"tag":521,"props":3761,"children":3762},{"class":523,"line":619},[3763],{"type":42,"tag":521,"props":3764,"children":3765},{},[3766],{"type":48,"value":3767}," \u002F\u002F Call target function\n",{"type":42,"tag":521,"props":3769,"children":3770},{"class":523,"line":692},[3771],{"type":42,"tag":521,"props":3772,"children":3773},{},[3774],{"type":48,"value":3775}," target(data)\n",{"type":42,"tag":521,"props":3777,"children":3778},{"class":523,"line":700},[3779],{"type":42,"tag":521,"props":3780,"children":3781},{"emptyLinePlaceholder":596},[3782],{"type":48,"value":599},{"type":42,"tag":521,"props":3784,"children":3785},{"class":523,"line":810},[3786],{"type":42,"tag":521,"props":3787,"children":3788},{},[3789],{"type":48,"value":3790}," \u002F\u002F Return codes:\n",{"type":42,"tag":521,"props":3792,"children":3793},{"class":523,"line":819},[3794],{"type":42,"tag":521,"props":3795,"children":3796},{},[3797],{"type":48,"value":3798}," \u002F\u002F -1 if input is invalid\n",{"type":42,"tag":521,"props":3800,"children":3801},{"class":523,"line":827},[3802],{"type":42,"tag":521,"props":3803,"children":3804},{},[3805],{"type":48,"value":3806}," \u002F\u002F 0 if input is valid but not interesting\n",{"type":42,"tag":521,"props":3808,"children":3809},{"class":523,"line":933},[3810],{"type":42,"tag":521,"props":3811,"children":3812},{},[3813],{"type":48,"value":3814}," \u002F\u002F 1 if input is interesting (e.g., added new coverage)\n",{"type":42,"tag":521,"props":3816,"children":3817},{"class":523,"line":1098},[3818],{"type":42,"tag":521,"props":3819,"children":3820},{},[3821],{"type":48,"value":3822}," return 0\n",{"type":42,"tag":521,"props":3824,"children":3825},{"class":523,"line":1328},[3826],{"type":42,"tag":521,"props":3827,"children":3828},{},[3829],{"type":48,"value":557},{"type":42,"tag":51,"props":3831,"children":3832},{},[3833],{"type":42,"tag":110,"props":3834,"children":3835},{},[3836],{"type":48,"value":3837},"Building:",{"type":42,"tag":510,"props":3839,"children":3841},{"className":2919,"code":3840,"language":2921,"meta":515,"style":515},"go-fuzz-build\n",[3842],{"type":42,"tag":153,"props":3843,"children":3844},{"__ignoreMap":515},[3845],{"type":42,"tag":521,"props":3846,"children":3847},{"class":523,"line":524},[3848],{"type":42,"tag":521,"props":3849,"children":3850},{"style":2931},[3851],{"type":48,"value":3840},{"type":42,"tag":51,"props":3853,"children":3854},{},[3855],{"type":42,"tag":110,"props":3856,"children":3857},{},[3858],{"type":48,"value":2968},{"type":42,"tag":224,"props":3860,"children":3861},{},[3862,3867,3872],{"type":42,"tag":228,"props":3863,"children":3864},{},[3865],{"type":48,"value":3866},"Return 1 for inputs that add coverage (optional—fuzzer can detect automatically)",{"type":42,"tag":228,"props":3868,"children":3869},{},[3870],{"type":48,"value":3871},"Return -1 for invalid inputs to deprioritize similar mutations",{"type":42,"tag":228,"props":3873,"children":3874},{},[3875],{"type":48,"value":3876},"go-fuzz handles persistence automatically",{"type":42,"tag":51,"props":3878,"children":3879},{},[3880],{"type":42,"tag":110,"props":3881,"children":3882},{},[3883],{"type":48,"value":3034},{"type":42,"tag":510,"props":3885,"children":3887},{"className":2919,"code":3886,"language":2921,"meta":515,"style":515},"go-fuzz -bin=.\u002Fmypackage-fuzz.zip -workdir=fuzz\n",[3888],{"type":42,"tag":153,"props":3889,"children":3890},{"__ignoreMap":515},[3891],{"type":42,"tag":521,"props":3892,"children":3893},{"class":523,"line":524},[3894,3898,3903],{"type":42,"tag":521,"props":3895,"children":3896},{"style":2931},[3897],{"type":48,"value":3703},{"type":42,"tag":521,"props":3899,"children":3900},{"style":2937},[3901],{"type":48,"value":3902}," -bin=.\u002Fmypackage-fuzz.zip",{"type":42,"tag":521,"props":3904,"children":3905},{"style":2937},[3906],{"type":48,"value":3907}," -workdir=fuzz\n",{"type":42,"tag":57,"props":3909,"children":3911},{"id":3910},"troubleshooting",[3912],{"type":48,"value":3913},"Troubleshooting",{"type":42,"tag":76,"props":3915,"children":3916},{},[3917,3938],{"type":42,"tag":80,"props":3918,"children":3919},{},[3920],{"type":42,"tag":84,"props":3921,"children":3922},{},[3923,3928,3933],{"type":42,"tag":88,"props":3924,"children":3925},{},[3926],{"type":48,"value":3927},"Issue",{"type":42,"tag":88,"props":3929,"children":3930},{},[3931],{"type":48,"value":3932},"Cause",{"type":42,"tag":88,"props":3934,"children":3935},{},[3936],{"type":48,"value":3937},"Solution",{"type":42,"tag":99,"props":3939,"children":3940},{},[3941,3962,3983,4004,4043,4064,4090],{"type":42,"tag":84,"props":3942,"children":3943},{},[3944,3952,3957],{"type":42,"tag":106,"props":3945,"children":3946},{},[3947],{"type":42,"tag":110,"props":3948,"children":3949},{},[3950],{"type":48,"value":3951},"Low executions\u002Fsec",{"type":42,"tag":106,"props":3953,"children":3954},{},[3955],{"type":48,"value":3956},"Harness is too slow (logging, I\u002FO, complexity)",{"type":42,"tag":106,"props":3958,"children":3959},{},[3960],{"type":48,"value":3961},"Profile harness, remove bottlenecks, mock I\u002FO",{"type":42,"tag":84,"props":3963,"children":3964},{},[3965,3973,3978],{"type":42,"tag":106,"props":3966,"children":3967},{},[3968],{"type":42,"tag":110,"props":3969,"children":3970},{},[3971],{"type":48,"value":3972},"No crashes found",{"type":42,"tag":106,"props":3974,"children":3975},{},[3976],{"type":48,"value":3977},"Coverage not reaching buggy code",{"type":42,"tag":106,"props":3979,"children":3980},{},[3981],{"type":48,"value":3982},"Check coverage, improve harness to reach more paths",{"type":42,"tag":84,"props":3984,"children":3985},{},[3986,3994,3999],{"type":42,"tag":106,"props":3987,"children":3988},{},[3989],{"type":42,"tag":110,"props":3990,"children":3991},{},[3992],{"type":48,"value":3993},"Non-reproducible crashes",{"type":42,"tag":106,"props":3995,"children":3996},{},[3997],{"type":48,"value":3998},"Non-determinism or global state",{"type":42,"tag":106,"props":4000,"children":4001},{},[4002],{"type":48,"value":4003},"Remove randomness, reset globals between iterations",{"type":42,"tag":84,"props":4005,"children":4006},{},[4007,4015,4025],{"type":42,"tag":106,"props":4008,"children":4009},{},[4010],{"type":42,"tag":110,"props":4011,"children":4012},{},[4013],{"type":48,"value":4014},"Fuzzer exits immediately",{"type":42,"tag":106,"props":4016,"children":4017},{},[4018,4020],{"type":48,"value":4019},"Harness calls ",{"type":42,"tag":153,"props":4021,"children":4023},{"className":4022},[],[4024],{"type":48,"value":2497},{"type":42,"tag":106,"props":4026,"children":4027},{},[4028,4029,4034,4036,4041],{"type":48,"value":2275},{"type":42,"tag":153,"props":4030,"children":4032},{"className":4031},[],[4033],{"type":48,"value":2497},{"type":48,"value":4035}," with ",{"type":42,"tag":153,"props":4037,"children":4039},{"className":4038},[],[4040],{"type":48,"value":2515},{"type":48,"value":4042}," or return error",{"type":42,"tag":84,"props":4044,"children":4045},{},[4046,4054,4059],{"type":42,"tag":106,"props":4047,"children":4048},{},[4049],{"type":42,"tag":110,"props":4050,"children":4051},{},[4052],{"type":48,"value":4053},"Out of memory errors",{"type":42,"tag":106,"props":4055,"children":4056},{},[4057],{"type":48,"value":4058},"Memory leaks in harness or SUT",{"type":42,"tag":106,"props":4060,"children":4061},{},[4062],{"type":48,"value":4063},"Free allocations, use leak sanitizer to find leaks",{"type":42,"tag":84,"props":4065,"children":4066},{},[4067,4075,4080],{"type":42,"tag":106,"props":4068,"children":4069},{},[4070],{"type":42,"tag":110,"props":4071,"children":4072},{},[4073],{"type":48,"value":4074},"Crashes on empty input",{"type":42,"tag":106,"props":4076,"children":4077},{},[4078],{"type":48,"value":4079},"Harness doesn't validate size",{"type":42,"tag":106,"props":4081,"children":4082},{},[4083,4085],{"type":48,"value":4084},"Add ",{"type":42,"tag":153,"props":4086,"children":4088},{"className":4087},[],[4089],{"type":48,"value":353},{"type":42,"tag":84,"props":4091,"children":4092},{},[4093,4101,4106],{"type":42,"tag":106,"props":4094,"children":4095},{},[4096],{"type":42,"tag":110,"props":4097,"children":4098},{},[4099],{"type":48,"value":4100},"Corpus not growing",{"type":42,"tag":106,"props":4102,"children":4103},{},[4104],{"type":48,"value":4105},"Inputs too constrained or format too strict",{"type":42,"tag":106,"props":4107,"children":4108},{},[4109],{"type":48,"value":4110},"Use FuzzedDataProvider or structure-aware fuzzing",{"type":42,"tag":57,"props":4112,"children":4114},{"id":4113},"related-skills",[4115],{"type":48,"value":4116},"Related Skills",{"type":42,"tag":69,"props":4118,"children":4120},{"id":4119},"tools-that-use-this-technique",[4121],{"type":48,"value":4122},"Tools That Use This Technique",{"type":42,"tag":76,"props":4124,"children":4125},{},[4126,4142],{"type":42,"tag":80,"props":4127,"children":4128},{},[4129],{"type":42,"tag":84,"props":4130,"children":4131},{},[4132,4137],{"type":42,"tag":88,"props":4133,"children":4134},{},[4135],{"type":48,"value":4136},"Skill",{"type":42,"tag":88,"props":4138,"children":4139},{},[4140],{"type":48,"value":4141},"How It Applies",{"type":42,"tag":99,"props":4143,"children":4144},{},[4145,4167,4190,4214,4230],{"type":42,"tag":84,"props":4146,"children":4147},{},[4148,4155],{"type":42,"tag":106,"props":4149,"children":4150},{},[4151],{"type":42,"tag":110,"props":4152,"children":4153},{},[4154],{"type":48,"value":2860},{"type":42,"tag":106,"props":4156,"children":4157},{},[4158,4160,4165],{"type":48,"value":4159},"Uses ",{"type":42,"tag":153,"props":4161,"children":4163},{"className":4162},[],[4164],{"type":48,"value":158},{"type":48,"value":4166}," harness signature with FuzzedDataProvider",{"type":42,"tag":84,"props":4168,"children":4169},{},[4170,4178],{"type":42,"tag":106,"props":4171,"children":4172},{},[4173],{"type":42,"tag":110,"props":4174,"children":4175},{},[4176],{"type":48,"value":4177},"aflpp",{"type":42,"tag":106,"props":4179,"children":4180},{},[4181,4183,4188],{"type":48,"value":4182},"Supports persistent mode harnesses with ",{"type":42,"tag":153,"props":4184,"children":4186},{"className":4185},[],[4187],{"type":48,"value":3322},{"type":48,"value":4189}," for performance",{"type":42,"tag":84,"props":4191,"children":4192},{},[4193,4201],{"type":42,"tag":106,"props":4194,"children":4195},{},[4196],{"type":42,"tag":110,"props":4197,"children":4198},{},[4199],{"type":48,"value":4200},"cargo-fuzz",{"type":42,"tag":106,"props":4202,"children":4203},{},[4204,4206,4212],{"type":48,"value":4205},"Uses Rust-specific ",{"type":42,"tag":153,"props":4207,"children":4209},{"className":4208},[],[4210],{"type":48,"value":4211},"fuzz_target!",{"type":48,"value":4213}," macro with arbitrary crate integration",{"type":42,"tag":84,"props":4215,"children":4216},{},[4217,4225],{"type":42,"tag":106,"props":4218,"children":4219},{},[4220],{"type":42,"tag":110,"props":4221,"children":4222},{},[4223],{"type":48,"value":4224},"atheris",{"type":42,"tag":106,"props":4226,"children":4227},{},[4228],{"type":48,"value":4229},"Python harness takes bytes, calls Python functions",{"type":42,"tag":84,"props":4231,"children":4232},{},[4233,4241],{"type":42,"tag":106,"props":4234,"children":4235},{},[4236],{"type":42,"tag":110,"props":4237,"children":4238},{},[4239],{"type":48,"value":4240},"ossfuzz",{"type":42,"tag":106,"props":4242,"children":4243},{},[4244],{"type":48,"value":4245},"Requires harnesses in specific directory structure for cloud fuzzing",{"type":42,"tag":69,"props":4247,"children":4249},{"id":4248},"related-techniques",[4250],{"type":48,"value":4251},"Related Techniques",{"type":42,"tag":76,"props":4253,"children":4254},{},[4255,4270],{"type":42,"tag":80,"props":4256,"children":4257},{},[4258],{"type":42,"tag":84,"props":4259,"children":4260},{},[4261,4265],{"type":42,"tag":88,"props":4262,"children":4263},{},[4264],{"type":48,"value":4136},{"type":42,"tag":88,"props":4266,"children":4267},{},[4268],{"type":48,"value":4269},"Relationship",{"type":42,"tag":99,"props":4271,"children":4272},{},[4273,4289,4305,4321],{"type":42,"tag":84,"props":4274,"children":4275},{},[4276,4284],{"type":42,"tag":106,"props":4277,"children":4278},{},[4279],{"type":42,"tag":110,"props":4280,"children":4281},{},[4282],{"type":48,"value":4283},"coverage-analysis",{"type":42,"tag":106,"props":4285,"children":4286},{},[4287],{"type":48,"value":4288},"Measure harness effectiveness—are you reaching target code?",{"type":42,"tag":84,"props":4290,"children":4291},{},[4292,4300],{"type":42,"tag":106,"props":4293,"children":4294},{},[4295],{"type":42,"tag":110,"props":4296,"children":4297},{},[4298],{"type":48,"value":4299},"address-sanitizer",{"type":42,"tag":106,"props":4301,"children":4302},{},[4303],{"type":48,"value":4304},"Detects bugs found by harness (buffer overflows, use-after-free)",{"type":42,"tag":84,"props":4306,"children":4307},{},[4308,4316],{"type":42,"tag":106,"props":4309,"children":4310},{},[4311],{"type":42,"tag":110,"props":4312,"children":4313},{},[4314],{"type":48,"value":4315},"fuzzing-dictionary",{"type":42,"tag":106,"props":4317,"children":4318},{},[4319],{"type":48,"value":4320},"Provide tokens to help fuzzer pass format checks in harness",{"type":42,"tag":84,"props":4322,"children":4323},{},[4324,4332],{"type":42,"tag":106,"props":4325,"children":4326},{},[4327],{"type":42,"tag":110,"props":4328,"children":4329},{},[4330],{"type":48,"value":4331},"fuzzing-obstacles",{"type":42,"tag":106,"props":4333,"children":4334},{},[4335],{"type":48,"value":4336},"Patch SUT when it violates harness rules (exit, non-determinism)",{"type":42,"tag":57,"props":4338,"children":4340},{"id":4339},"resources",[4341],{"type":48,"value":4342},"Resources",{"type":42,"tag":69,"props":4344,"children":4346},{"id":4345},"key-external-resources",[4347],{"type":48,"value":4348},"Key External Resources",{"type":42,"tag":51,"props":4350,"children":4351},{},[4352,4362],{"type":42,"tag":110,"props":4353,"children":4354},{},[4355],{"type":42,"tag":2234,"props":4356,"children":4359},{"href":4357,"rel":4358},"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Fdocs\u002Fsplit-inputs.md",[2238],[4360],{"type":48,"value":4361},"Split Inputs in libFuzzer - Google Fuzzing Docs",{"type":48,"value":4363},"\nExplains techniques for handling multiple input parameters in a single fuzzing harness, including use of magic separators and FuzzedDataProvider.",{"type":42,"tag":51,"props":4365,"children":4366},{},[4367,4375],{"type":42,"tag":110,"props":4368,"children":4369},{},[4370],{"type":42,"tag":2234,"props":4371,"children":4373},{"href":2236,"rel":4372},[2238],[4374],{"type":48,"value":2191},{"type":48,"value":4376},"\nAdvanced technique using protobuf as intermediate format with custom mutators to ensure fuzzer mutates message contents rather than format encoding.",{"type":42,"tag":51,"props":4378,"children":4379},{},[4380,4389],{"type":42,"tag":110,"props":4381,"children":4382},{},[4383],{"type":42,"tag":2234,"props":4384,"children":4386},{"href":3081,"rel":4385},[2238],[4387],{"type":48,"value":4388},"libFuzzer Documentation",{"type":48,"value":4390},"\nOfficial LLVM documentation covering harness requirements, best practices, and advanced features.",{"type":42,"tag":51,"props":4392,"children":4393},{},[4394,4403],{"type":42,"tag":110,"props":4395,"children":4396},{},[4397],{"type":42,"tag":2234,"props":4398,"children":4400},{"href":3686,"rel":4399},[2238],[4401],{"type":48,"value":4402},"cargo-fuzz Book",{"type":48,"value":4404},"\nComprehensive guide to writing Rust fuzzing harnesses with cargo-fuzz and the arbitrary crate.",{"type":42,"tag":69,"props":4406,"children":4408},{"id":4407},"video-resources",[4409],{"type":48,"value":4410},"Video Resources",{"type":42,"tag":224,"props":4412,"children":4413},{},[4414,4426],{"type":42,"tag":228,"props":4415,"children":4416},{},[4417,4424],{"type":42,"tag":2234,"props":4418,"children":4421},{"href":4419,"rel":4420},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=qTTwqFRD1H8",[2238],[4422],{"type":48,"value":4423},"Effective File Format Fuzzing",{"type":48,"value":4425}," - Conference talk on writing harnesses for file format parsers",{"type":42,"tag":228,"props":4427,"children":4428},{},[4429,4436],{"type":42,"tag":2234,"props":4430,"children":4433},{"href":4431,"rel":4432},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=x0FQkAPokfE",[2238],[4434],{"type":48,"value":4435},"Modern Fuzzing of C\u002FC++ Projects",{"type":48,"value":4437}," - Tutorial covering harness design patterns",{"type":42,"tag":4439,"props":4440,"children":4441},"style",{},[4442],{"type":48,"value":4443},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":4445,"total":4594},[4446,4460,4469,4489,4504,4515,4526,4536,4549,4560,4572,4583],{"slug":4299,"name":4299,"fn":4447,"description":4448,"org":4449,"tags":4450,"stars":23,"repoUrl":24,"updatedAt":4459},"detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4451,4454,4457,4458],{"name":4452,"slug":4453,"type":16},"C#","c",{"name":4455,"slug":4456,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:14.925095",{"slug":4177,"name":4177,"fn":4461,"description":4462,"org":4463,"tags":4464,"stars":23,"repoUrl":24,"updatedAt":4468},"perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4465,4466,4467],{"name":4452,"slug":4453,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:12.433192",{"slug":4470,"name":4470,"fn":4471,"description":4472,"org":4473,"tags":4474,"stars":23,"repoUrl":24,"updatedAt":4488},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4475,4478,4481,4484,4487],{"name":4476,"slug":4477,"type":16},"Agents","agents",{"name":4479,"slug":4480,"type":16},"CI\u002FCD","ci-cd",{"name":4482,"slug":4483,"type":16},"Code Analysis","code-analysis",{"name":4485,"slug":4486,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":4490,"name":4490,"fn":4491,"description":4492,"org":4493,"tags":4494,"stars":23,"repoUrl":24,"updatedAt":4503},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4495,4498,4499,4500],{"name":4496,"slug":4497,"type":16},"Audit","audit",{"name":4482,"slug":4483,"type":16},{"name":14,"slug":15,"type":16},{"name":4501,"slug":4502,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":4505,"name":4505,"fn":4506,"description":4507,"org":4508,"tags":4509,"stars":23,"repoUrl":24,"updatedAt":4514},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4510,4511],{"name":18,"slug":19,"type":16},{"name":4512,"slug":4513,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":4224,"name":4224,"fn":4516,"description":4517,"org":4518,"tags":4519,"stars":23,"repoUrl":24,"updatedAt":4525},"fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4520,4523,4524],{"name":4521,"slug":4522,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:14.575191",{"slug":4527,"name":4527,"fn":4528,"description":4529,"org":4530,"tags":4531,"stars":23,"repoUrl":24,"updatedAt":4535},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4532,4533,4534],{"name":4496,"slug":4497,"type":16},{"name":4482,"slug":4483,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",{"slug":4537,"name":4537,"fn":4538,"description":4539,"org":4540,"tags":4541,"stars":23,"repoUrl":24,"updatedAt":4548},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4542,4545,4546,4547],{"name":4543,"slug":4544,"type":16},"Architecture","architecture",{"name":4496,"slug":4497,"type":16},{"name":4482,"slug":4483,"type":16},{"name":18,"slug":19,"type":16},"2026-07-18T05:47:40.122449",{"slug":4550,"name":4550,"fn":4551,"description":4552,"org":4553,"tags":4554,"stars":23,"repoUrl":24,"updatedAt":4559},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4555,4556,4557,4558],{"name":4496,"slug":4497,"type":16},{"name":4482,"slug":4483,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":4561,"name":4561,"fn":4562,"description":4563,"org":4564,"tags":4565,"stars":23,"repoUrl":24,"updatedAt":4571},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4566,4567,4570],{"name":4496,"slug":4497,"type":16},{"name":4568,"slug":4569,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":4573,"name":4573,"fn":4574,"description":4575,"org":4576,"tags":4577,"stars":23,"repoUrl":24,"updatedAt":4582},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4578,4579,4580,4581],{"name":4496,"slug":4497,"type":16},{"name":4452,"slug":4453,"type":16},{"name":4482,"slug":4483,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":4584,"name":4584,"fn":4585,"description":4586,"org":4587,"tags":4588,"stars":23,"repoUrl":24,"updatedAt":4593},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4589,4590,4591,4592],{"name":4496,"slug":4497,"type":16},{"name":4482,"slug":4483,"type":16},{"name":14,"slug":15,"type":16},{"name":4501,"slug":4502,"type":16},"2026-07-18T05:47:42.84568",111,{"items":4596,"total":4642},[4597,4604,4610,4618,4625,4630,4636],{"slug":4299,"name":4299,"fn":4447,"description":4448,"org":4598,"tags":4599,"stars":23,"repoUrl":24,"updatedAt":4459},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4600,4601,4602,4603],{"name":4452,"slug":4453,"type":16},{"name":4455,"slug":4456,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":4177,"name":4177,"fn":4461,"description":4462,"org":4605,"tags":4606,"stars":23,"repoUrl":24,"updatedAt":4468},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4607,4608,4609],{"name":4452,"slug":4453,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":4470,"name":4470,"fn":4471,"description":4472,"org":4611,"tags":4612,"stars":23,"repoUrl":24,"updatedAt":4488},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4613,4614,4615,4616,4617],{"name":4476,"slug":4477,"type":16},{"name":4479,"slug":4480,"type":16},{"name":4482,"slug":4483,"type":16},{"name":4485,"slug":4486,"type":16},{"name":14,"slug":15,"type":16},{"slug":4490,"name":4490,"fn":4491,"description":4492,"org":4619,"tags":4620,"stars":23,"repoUrl":24,"updatedAt":4503},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4621,4622,4623,4624],{"name":4496,"slug":4497,"type":16},{"name":4482,"slug":4483,"type":16},{"name":14,"slug":15,"type":16},{"name":4501,"slug":4502,"type":16},{"slug":4505,"name":4505,"fn":4506,"description":4507,"org":4626,"tags":4627,"stars":23,"repoUrl":24,"updatedAt":4514},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4628,4629],{"name":18,"slug":19,"type":16},{"name":4512,"slug":4513,"type":16},{"slug":4224,"name":4224,"fn":4516,"description":4517,"org":4631,"tags":4632,"stars":23,"repoUrl":24,"updatedAt":4525},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4633,4634,4635],{"name":4521,"slug":4522,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":4527,"name":4527,"fn":4528,"description":4529,"org":4637,"tags":4638,"stars":23,"repoUrl":24,"updatedAt":4535},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4639,4640,4641],{"name":4496,"slug":4497,"type":16},{"name":4482,"slug":4483,"type":16},{"name":14,"slug":15,"type":16},77]