[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-libfuzzer":3,"mdc--1k0su8-key":35,"related-org-trail-of-bits-libfuzzer":6011,"related-repo-trail-of-bits-libfuzzer":6163},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":30,"sourceUrl":33,"mdContent":34},"libfuzzer","fuzz C\u002FC++ projects with libFuzzer","Coverage-guided fuzzer built into LLVM for C\u002FC++ projects. Use for fuzzing C\u002FC++ code that can be compiled with Clang.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"C#","c",{"name":21,"slug":22,"type":16},"Testing","testing",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-17T06:05:16.003104",null,541,[29],"agent-skills",{"repoUrl":24,"stars":23,"forks":27,"topics":31,"description":32},[29],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Ftesting-handbook-skills\u002Fskills\u002Flibfuzzer","---\nname: libfuzzer\ntype: fuzzer\ndescription: >\n  Coverage-guided fuzzer built into LLVM for C\u002FC++ projects. Use for fuzzing\n  C\u002FC++ code that can be compiled with Clang.\n---\n\n# libFuzzer\n\nlibFuzzer is an in-process, coverage-guided fuzzer that is part of the LLVM project. It's the recommended starting point for fuzzing C\u002FC++ projects due to its simplicity and integration with the LLVM toolchain. While libFuzzer has been in maintenance-only mode since late 2022, it is easier to install and use than its alternatives, has wide support, and will be maintained for the foreseeable future.\n\n## When to Use\n\n| Fuzzer | Best For | Complexity |\n|--------|----------|------------|\n| libFuzzer | Quick setup, single-project fuzzing | Low |\n| AFL++ | Multi-core fuzzing, diverse mutations | Medium |\n| LibAFL | Custom fuzzers, research projects | High |\n| Honggfuzz | Hardware-based coverage | Medium |\n\n**Choose libFuzzer when:**\n- You need a simple, quick setup for C\u002FC++ code\n- Project uses Clang for compilation\n- Single-core fuzzing is sufficient initially\n- Transitioning to AFL++ later is an option (harnesses are compatible)\n\n**Note:** Fuzzing harnesses written for libFuzzer are compatible with AFL++, making it easy to transition if you need more advanced features like better multi-core support.\n\n## Quick Start\n\n```c++\n#include \u003Cstdint.h>\n#include \u003Cstddef.h>\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    \u002F\u002F Validate input if needed\n    if (size \u003C 1) return 0;\n\n    \u002F\u002F Call your target function with fuzzer-provided data\n    my_target_function(data, size);\n\n    return 0;\n}\n```\n\nCompile and run:\n```bash\nclang++ -fsanitize=fuzzer,address -g -O2 harness.cc target.cc -o fuzz\nmkdir corpus\u002F\n.\u002Ffuzz corpus\u002F\n```\n\n## Installation\n\n### Prerequisites\n\n- LLVM\u002FClang compiler (includes libFuzzer)\n- LLVM tools for coverage analysis (optional)\n\n### Linux (Ubuntu\u002FDebian)\n\n```bash\napt install clang llvm\n```\n\nFor the latest LLVM version:\n```bash\n# Add LLVM repository from apt.llvm.org\n# Then install specific version, e.g.:\napt install clang-18 llvm-18\n```\n\n### macOS\n\n```bash\n# Using Homebrew\nbrew install llvm\n\n# Or using Nix\nnix-env -i clang\n```\n\n### Windows\n\nInstall Clang through Visual Studio. Refer to [Microsoft's documentation](https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fcpp\u002Fbuild\u002Fclang-support-msbuild?view=msvc-170) for setup instructions.\n\n**Recommendation:** If possible, fuzz on a local x86_64 VM or rent one on DigitalOcean, AWS, or Hetzner. Linux provides the best support for libFuzzer.\n\n### Verification\n\n```bash\nclang++ --version\n# Should show LLVM version information\n```\n\n## Writing a Harness\n\n### Harness Structure\n\nThe harness is the entry point for the fuzzer. libFuzzer calls the `LLVMFuzzerTestOneInput` function repeatedly with different inputs.\n\n```c++\n#include \u003Cstdint.h>\n#include \u003Cstddef.h>\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    \u002F\u002F 1. Optional: Validate input size\n    if (size \u003C MIN_REQUIRED_SIZE) {\n        return 0;  \u002F\u002F Reject inputs that are too small\n    }\n\n    \u002F\u002F 2. Optional: Convert raw bytes to structured data\n    \u002F\u002F Example: Parse two integers from byte array\n    if (size >= 2 * sizeof(uint32_t)) {\n        uint32_t a = *(uint32_t*)(data);\n        uint32_t b = *(uint32_t*)(data + sizeof(uint32_t));\n        my_function(a, b);\n    }\n\n    \u002F\u002F 3. Call target function\n    target_function(data, size);\n\n    \u002F\u002F 4. Always return 0 (non-zero reserved for future use)\n    return 0;\n}\n```\n\n### Harness Rules\n\n| Do | Don't |\n|----|-------|\n| Handle all input types (empty, huge, malformed) | Call `exit()` - stops fuzzing process |\n| Join all threads before returning | Leave threads running |\n| Keep harness fast and simple | Add excessive logging or complexity |\n| Maintain determinism | Use random number generators or read `\u002Fdev\u002Frandom` |\n| Reset global state between runs | Rely on state from previous executions |\n| Use narrow, focused targets | Mix unrelated data formats (PNG + TCP) in one harness |\n\n**Rationale:**\n- **Speed matters:** Aim for 100s-1000s executions per second per core\n- **Reproducibility:** Crashes must be reproducible after fuzzing completes\n- **Isolation:** Each execution should be independent\n\n### Using FuzzedDataProvider for Complex Inputs\n\nFor complex inputs (strings, multiple parameters), use the `FuzzedDataProvider` helper:\n\n```c++\n#include \u003Cstdint.h>\n#include \u003Cstddef.h>\n#include \"FuzzedDataProvider.h\"  \u002F\u002F From LLVM project\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    FuzzedDataProvider fuzzed_data(data, size);\n\n    \u002F\u002F Extract structured data\n    size_t allocation_size = fuzzed_data.ConsumeIntegral\u003Csize_t>();\n    std::vector\u003Cchar> str1 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n    std::vector\u003Cchar> str2 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n\n    \u002F\u002F Call target with extracted data\n    char* result = concat(&str1[0], str1.size(), &str2[0], str2.size(), allocation_size);\n    if (result != NULL) {\n        free(result);\n    }\n\n    return 0;\n}\n```\n\nDownload `FuzzedDataProvider.h` from the [LLVM repository](https:\u002F\u002Fgithub.com\u002Fllvm\u002Fllvm-project\u002Fblob\u002Fmain\u002Fcompiler-rt\u002Finclude\u002Ffuzzer\u002FFuzzedDataProvider.h).\n\n### Interleaved Fuzzing\n\nUse a single harness to test multiple related functions:\n\n```c++\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    if (size \u003C 1 + 2 * sizeof(int32_t)) {\n        return 0;\n    }\n\n    uint8_t mode = data[0];\n    int32_t numbers[2];\n    memcpy(numbers, data + 1, 2 * sizeof(int32_t));\n\n    \u002F\u002F Select function based on first byte\n    switch (mode % 4) {\n        case 0: add(numbers[0], numbers[1]); break;\n        case 1: subtract(numbers[0], numbers[1]); break;\n        case 2: multiply(numbers[0], numbers[1]); break;\n        case 3: divide(numbers[0], numbers[1]); break;\n    }\n\n    return 0;\n}\n```\n\n> **See Also:** For detailed harness writing techniques, patterns for handling complex inputs,\n> structure-aware fuzzing, and protobuf-based fuzzing, see the **fuzz-harness-writing** technique skill.\n\n## Compilation\n\n### Basic Compilation\n\nThe key flag is `-fsanitize=fuzzer`, which:\n- Links the libFuzzer runtime (provides `main` function)\n- Enables SanitizerCoverage instrumentation for coverage tracking\n- Disables built-in functions like `memcmp`\n\n```bash\nclang++ -fsanitize=fuzzer -g -O2 harness.cc target.cc -o fuzz\n```\n\n**Flags explained:**\n- `-fsanitize=fuzzer`: Enable libFuzzer\n- `-g`: Add debug symbols (helpful for crash analysis)\n- `-O2`: Production-level optimizations (recommended for fuzzing)\n- `-DNO_MAIN`: Define macro if your code has a `main` function\n\n### With Sanitizers\n\n**AddressSanitizer (recommended):**\n```bash\nclang++ -fsanitize=fuzzer,address -g -O2 -U_FORTIFY_SOURCE harness.cc target.cc -o fuzz\n```\n\n**Multiple sanitizers:**\n```bash\nclang++ -fsanitize=fuzzer,address,undefined -g -O2 harness.cc target.cc -o fuzz\n```\n\n> **See Also:** For detailed sanitizer configuration, common issues, ASAN_OPTIONS flags,\n> and advanced sanitizer usage, see the **address-sanitizer** and **undefined-behavior-sanitizer**\n> technique skills.\n\n### Build Flags\n\n| Flag | Purpose |\n|------|---------|\n| `-fsanitize=fuzzer` | Enable libFuzzer runtime and instrumentation |\n| `-fsanitize=address` | Enable AddressSanitizer (memory error detection) |\n| `-fsanitize=undefined` | Enable UndefinedBehaviorSanitizer |\n| `-fsanitize=fuzzer-no-link` | Instrument without linking fuzzer (for libraries) |\n| `-g` | Include debug symbols |\n| `-O2` | Production optimization level |\n| `-U_FORTIFY_SOURCE` | Disable fortification (can interfere with ASan) |\n\n### Building Static Libraries\n\nFor projects that produce static libraries:\n\n1. Build the library with fuzzing instrumentation:\n```bash\nexport CC=clang CFLAGS=\"-fsanitize=fuzzer-no-link -fsanitize=address\"\nexport CXX=clang++ CXXFLAGS=\"$CFLAGS\"\n.\u002Fconfigure --enable-shared=no\nmake\n```\n\n2. Link the static library with your harness:\n```bash\nclang++ -fsanitize=fuzzer -fsanitize=address harness.cc libmylib.a -o fuzz\n```\n\n### CMake Integration\n\n```cmake\nproject(FuzzTarget)\ncmake_minimum_required(VERSION 3.0)\n\nadd_executable(fuzz main.cc harness.cc)\ntarget_compile_definitions(fuzz PRIVATE NO_MAIN=1)\ntarget_compile_options(fuzz PRIVATE -g -O2 -fsanitize=fuzzer -fsanitize=address)\ntarget_link_libraries(fuzz -fsanitize=fuzzer -fsanitize=address)\n```\n\nBuild with:\n```bash\ncmake -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ .\ncmake --build .\n```\n\n## Corpus Management\n\n### Creating Initial Corpus\n\nCreate a directory for the corpus (can start empty):\n\n```bash\nmkdir corpus\u002F\n```\n\n**Optional but recommended:** Provide seed inputs (valid example files):\n\n```bash\n# For a PNG parser:\ncp examples\u002F*.png corpus\u002F\n\n# For a protocol parser:\ncp test_packets\u002F*.bin corpus\u002F\n```\n\n**Benefits of seed inputs:**\n- Fuzzer doesn't start from scratch\n- Reaches valid code paths faster\n- Significantly improves effectiveness\n\n### Corpus Structure\n\nThe corpus directory contains:\n- Input files that trigger unique code paths\n- Minimized versions (libFuzzer automatically minimizes)\n- Named by content hash (e.g., `a9993e364706816aba3e25717850c26c9cd0d89d`)\n\n### Corpus Minimization\n\nlibFuzzer automatically minimizes corpus entries during fuzzing. To explicitly minimize:\n\n```bash\nmkdir minimized_corpus\u002F\n.\u002Ffuzz -merge=1 minimized_corpus\u002F corpus\u002F\n```\n\nThis creates a deduplicated, minimized corpus in `minimized_corpus\u002F`.\n\n> **See Also:** For corpus creation strategies, seed selection, format-specific corpus building,\n> and corpus maintenance, see the **fuzzing-corpus** technique skill.\n\n## Running Campaigns\n\n### Basic Run\n\n```bash\n.\u002Ffuzz corpus\u002F\n```\n\nThis runs until a crash is found or you stop it (Ctrl+C).\n\n### Recommended: Continue After Crashes\n\n```bash\n.\u002Ffuzz -fork=1 -ignore_crashes=1 corpus\u002F\n```\n\nThe `-fork` and `-ignore_crashes` flags (experimental but widely used) allow fuzzing to continue after finding crashes.\n\n### Common Options\n\n**Control input size:**\n```bash\n.\u002Ffuzz -max_len=4000 corpus\u002F\n```\nRule of thumb: 2x the size of minimal realistic input.\n\n**Set timeout:**\n```bash\n.\u002Ffuzz -timeout=2 corpus\u002F\n```\nAbort test cases that run longer than 2 seconds.\n\n**Use a dictionary:**\n```bash\n.\u002Ffuzz -dict=.\u002Fformat.dict corpus\u002F\n```\n\n**Close stdout\u002Fstderr (speed up fuzzing):**\n```bash\n.\u002Ffuzz -close_fd_mask=3 corpus\u002F\n```\n\n**See all options:**\n```bash\n.\u002Ffuzz -help=1\n```\n\n### Multi-Core Fuzzing\n\n**Option 1: Jobs and workers (recommended):**\n```bash\n.\u002Ffuzz -jobs=4 -workers=4 -fork=1 -ignore_crashes=1 corpus\u002F\n```\n- `-jobs=4`: Run 4 sequential campaigns\n- `-workers=4`: Process jobs in parallel with 4 processes\n- Test cases are shared between jobs\n\n**Option 2: Fork mode:**\n```bash\n.\u002Ffuzz -fork=4 -ignore_crashes=1 corpus\u002F\n```\n\n**Note:** For serious multi-core fuzzing, consider switching to AFL++, Honggfuzz, or LibAFL.\n\n### Re-executing Test Cases\n\n**Re-run a single crash:**\n```bash\n.\u002Ffuzz .\u002Fcrash-a9993e364706816aba3e25717850c26c9cd0d89d\n```\n\n**Test all inputs in a directory without fuzzing:**\n```bash\n.\u002Ffuzz -runs=0 corpus\u002F\n```\n\n### Interpreting Output\n\nWhen fuzzing runs, you'll see statistics like:\n\n```\nINFO: Seed: 3517090860\nINFO: Loaded 1 modules (9 inline 8-bit counters)\n#2      INITED cov: 3 ft: 4 corp: 1\u002F1b exec\u002Fs: 0 rss: 26Mb\n#57     NEW    cov: 4 ft: 5 corp: 2\u002F4b lim: 4 exec\u002Fs: 0 rss: 26Mb\n```\n\n| Output | Meaning |\n|--------|---------|\n| `INITED` | Fuzzing initialized |\n| `NEW` | New coverage found, added to corpus |\n| `REDUCE` | Input minimized while keeping coverage |\n| `cov: N` | Number of coverage edges hit |\n| `corp: X\u002FYb` | Corpus size: X entries, Y total bytes |\n| `exec\u002Fs: N` | Executions per second |\n| `rss: NMb` | Resident memory usage |\n\n**On crash:**\n```\n==11672== ERROR: libFuzzer: deadly signal\nartifact_prefix='.\u002F'; Test unit written to .\u002Fcrash-a9993e364706816aba3e25717850c26c9cd0d89d\n0x61,0x62,0x63,\nabc\nBase64: YWJj\n```\n\nThe crash is saved to `.\u002Fcrash-\u003Chash>` with the input shown in hex, UTF-8, and Base64.\n\n**Reproducibility:** Use `-seed=\u003Cvalue>` to reproduce a fuzzing campaign (single-core only).\n\n## Fuzzing Dictionary\n\nDictionaries help the fuzzer discover interesting inputs faster by providing hints about the input format.\n\n### Dictionary Format\n\nCreate a text file with quoted strings (one per line):\n\n```conf\n# Lines starting with '#' are comments\n\n# Magic bytes\nmagic=\"\\x89PNG\"\nmagic2=\"IEND\"\n\n# Keywords\n\"GET\"\n\"POST\"\n\"Content-Type\"\n\n# Hex sequences\ndelimiter=\"\\xFF\\xD8\\xFF\"\n```\n\n### Using a Dictionary\n\n```bash\n.\u002Ffuzz -dict=.\u002Fformat.dict corpus\u002F\n```\n\n### Generating a Dictionary\n\n**From header files:**\n```bash\ngrep -o '\".*\"' header.h > header.dict\n```\n\n**From man pages:**\n```bash\nman curl | grep -oP '^\\s*(--|-)\\K\\S+' | sed 's\u002F[,.]$\u002F\u002F' | sed 's\u002F^\u002F\"&\u002F; s\u002F$\u002F&\"\u002F' | sort -u > man.dict\n```\n\n**From binary strings:**\n```bash\nstrings .\u002Fbinary | sed 's\u002F^\u002F\"&\u002F; s\u002F$\u002F&\"\u002F' > strings.dict\n```\n\n**Using LLMs:** Ask ChatGPT or similar to generate a dictionary for your format (e.g., \"Generate a libFuzzer dictionary for a JSON parser\").\n\n> **See Also:** For advanced dictionary generation, format-specific dictionaries, and\n> dictionary optimization strategies, see the **fuzzing-dictionaries** technique skill.\n\n## Coverage Analysis\n\nWhile libFuzzer shows basic coverage stats (`cov: N`), detailed coverage analysis requires additional tools.\n\n### Source-Based Coverage\n\n**1. Recompile with coverage instrumentation:**\n```bash\nclang++ -fsanitize=fuzzer -fprofile-instr-generate -fcoverage-mapping harness.cc target.cc -o fuzz\n```\n\n**2. Run fuzzer to collect coverage:**\n```bash\nLLVM_PROFILE_FILE=\"coverage-%p.profraw\" .\u002Ffuzz -runs=10000 corpus\u002F\n```\n\n**3. Merge coverage data:**\n```bash\nllvm-profdata merge -sparse coverage-*.profraw -o coverage.profdata\n```\n\n**4. Generate coverage report:**\n```bash\nllvm-cov show .\u002Ffuzz -instr-profile=coverage.profdata\n```\n\n**5. Generate HTML report:**\n```bash\nllvm-cov show .\u002Ffuzz -instr-profile=coverage.profdata -format=html > coverage.html\n```\n\n### Improving Coverage\n\n**Tips:**\n- Provide better seed inputs in corpus\n- Use dictionaries for format-aware fuzzing\n- Check if harness properly exercises target\n- Consider structure-aware fuzzing for complex formats\n- Run longer campaigns (days\u002Fweeks)\n\n> **See Also:** For detailed coverage analysis techniques, identifying coverage gaps,\n> systematic coverage improvement, and comparing coverage across fuzzers, see the\n> **coverage-analysis** technique skill.\n\n## Sanitizer Integration\n\n### AddressSanitizer (ASan)\n\nASan detects memory errors like buffer overflows and use-after-free bugs. **Highly recommended for fuzzing.**\n\n**Enable ASan:**\n```bash\nclang++ -fsanitize=fuzzer,address -g -O2 -U_FORTIFY_SOURCE harness.cc target.cc -o fuzz\n```\n\n**Example ASan output:**\n```\n==1276163==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000c4ab1\nWRITE of size 1 at 0x6020000c4ab1 thread T0\n    #0 0x55555568631a in check_buf(char*, unsigned long) main.cc:13:25\n    #1 0x5555556860bf in LLVMFuzzerTestOneInput harness.cc:7:3\n```\n\n**Configure ASan with environment variables:**\n```bash\nASAN_OPTIONS=verbosity=1:abort_on_error=1 .\u002Ffuzz corpus\u002F\n```\n\n**Important flags:**\n- `verbosity=1`: Show ASan is active\n- `detect_leaks=0`: Disable leak detection (leaks reported at end)\n- `abort_on_error=1`: Call `abort()` instead of `_exit()` on errors\n\n**Drawbacks:**\n- 2-4x slowdown\n- Requires ~20TB virtual memory (disable memory limits: `-rss_limit_mb=0`)\n- Best supported on Linux\n\n> **See Also:** For comprehensive ASan configuration, common pitfalls, symbolization,\n> and combining with other sanitizers, see the **address-sanitizer** technique skill.\n\n### UndefinedBehaviorSanitizer (UBSan)\n\nUBSan detects undefined behavior like integer overflow, null pointer dereference, etc.\n\n**Enable UBSan:**\n```bash\nclang++ -fsanitize=fuzzer,undefined -g -O2 harness.cc target.cc -o fuzz\n```\n\n**Combine with ASan:**\n```bash\nclang++ -fsanitize=fuzzer,address,undefined -g -O2 harness.cc target.cc -o fuzz\n```\n\n### MemorySanitizer (MSan)\n\nMSan detects uninitialized memory reads. More complex to use (requires rebuilding all dependencies).\n\n```bash\nclang++ -fsanitize=fuzzer,memory -g -O2 harness.cc target.cc -o fuzz\n```\n\n### Common Sanitizer Issues\n\n| Issue | Solution |\n|-------|----------|\n| ASan slows fuzzing too much | Use `-fsanitize-recover=address` for non-fatal errors |\n| Out of memory | Set `ASAN_OPTIONS=rss_limit_mb=0` or `-rss_limit_mb=0` |\n| Stack exhaustion | Increase stack size: `ASAN_OPTIONS=stack_size=8388608` |\n| False positives with `_FORTIFY_SOURCE` | Use `-U_FORTIFY_SOURCE` flag |\n| MSan reports in dependencies | Rebuild all dependencies with `-fsanitize=memory` |\n\n## Real-World Examples\n\n### Example 1: Fuzzing libpng\n\nlibpng is a widely-used library for reading\u002Fwriting PNG images. Bugs can lead to security issues.\n\n**1. Get source code:**\n```bash\ncurl -L -O https:\u002F\u002Fdownloads.sourceforge.net\u002Fproject\u002Flibpng\u002Flibpng16\u002F1.6.37\u002Flibpng-1.6.37.tar.xz\ntar xf libpng-1.6.37.tar.xz\ncd libpng-1.6.37\u002F\n```\n\n**2. Install dependencies:**\n```bash\napt install zlib1g-dev\n```\n\n**3. Compile with fuzzing instrumentation:**\n```bash\nexport CC=clang CFLAGS=\"-fsanitize=fuzzer-no-link -fsanitize=address\"\nexport CXX=clang++ CXXFLAGS=\"$CFLAGS\"\n.\u002Fconfigure --enable-shared=no\nmake\n```\n\n**4. Get a harness (or write your own):**\n```bash\ncurl -O https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002Ff8e5fa92b0e37ab597616f554bee254157998227\u002Fcontrib\u002Foss-fuzz\u002Flibpng_read_fuzzer.cc\n```\n\n**5. Prepare corpus and dictionary:**\n```bash\nmkdir corpus\u002F\ncurl -o corpus\u002Finput.png https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002Facfd50ae0ba3198ad734e5d4dec2b05341e50924\u002Fcontrib\u002Fpngsuite\u002Fiftp1n3p08.png\ncurl -O https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002F2fff013a6935967960a5ae626fc21432807933dd\u002Fcontrib\u002Foss-fuzz\u002Fpng.dict\n```\n\n**6. Link and compile fuzzer:**\n```bash\nclang++ -fsanitize=fuzzer -fsanitize=address libpng_read_fuzzer.cc .libs\u002Flibpng16.a -lz -o fuzz\n```\n\n**7. Run fuzzing campaign:**\n```bash\n.\u002Ffuzz -close_fd_mask=3 -dict=.\u002Fpng.dict corpus\u002F\n```\n\n### Example 2: Simple Division Bug\n\nHarness that finds a division-by-zero bug:\n\n```c++\n#include \u003Cstdint.h>\n#include \u003Cstddef.h>\n\ndouble divide(uint32_t numerator, uint32_t denominator) {\n    \u002F\u002F Bug: No check if denominator is zero\n    return numerator \u002F denominator;\n}\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    if(size != 2 * sizeof(uint32_t)) {\n        return 0;\n    }\n\n    uint32_t numerator = *(uint32_t*)(data);\n    uint32_t denominator = *(uint32_t*)(data + sizeof(uint32_t));\n\n    divide(numerator, denominator);\n\n    return 0;\n}\n```\n\nCompile and fuzz:\n```bash\nclang++ -fsanitize=fuzzer harness.cc -o fuzz\n.\u002Ffuzz\n```\n\nThe fuzzer will quickly find inputs causing a crash.\n\n## Advanced Usage\n\n### Tips and Tricks\n\n| Tip | Why It Helps |\n|-----|--------------|\n| Start with single-core, switch to AFL++ for multi-core | libFuzzer harnesses work with AFL++ |\n| Use dictionaries for structured formats | 10-100x faster bug discovery |\n| Close file descriptors with `-close_fd_mask=3` | Speed boost if SUT writes output |\n| Set reasonable `-max_len` | Prevents wasted time on huge inputs |\n| Run for days\u002Fweeks, not minutes | Coverage plateaus take time to break |\n| Use seed corpus from test suites | Starts fuzzing from valid inputs |\n\n### Structure-Aware Fuzzing\n\nFor highly structured inputs (e.g., complex protocols, file formats), use libprotobuf-mutator:\n\n- Define input structure using Protocol Buffers\n- libFuzzer mutates protobuf messages (structure-preserving mutations)\n- Harness converts protobuf to native format\n\nSee [structure-aware fuzzing documentation](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Fdocs\u002Fstructure-aware-fuzzing.md) for details.\n\n### Custom Mutators\n\nlibFuzzer allows custom mutators for specialized fuzzing:\n\n```c++\nextern \"C\" size_t LLVMFuzzerCustomMutator(uint8_t *Data, size_t Size,\n                                          size_t MaxSize, unsigned int Seed) {\n    \u002F\u002F Custom mutation logic\n    return new_size;\n}\n\nextern \"C\" size_t LLVMFuzzerCustomCrossOver(const uint8_t *Data1, size_t Size1,\n                                            const uint8_t *Data2, size_t Size2,\n                                            uint8_t *Out, size_t MaxOutSize,\n                                            unsigned int Seed) {\n    \u002F\u002F Custom crossover logic\n    return new_size;\n}\n```\n\n### Performance Tuning\n\n| Setting | Impact |\n|---------|--------|\n| `-close_fd_mask=3` | Closes stdout\u002Fstderr, speeds up fuzzing |\n| `-max_len=\u003Creasonable_size>` | Avoids wasting time on huge inputs |\n| `-timeout=\u003Cseconds>` | Detects hangs, prevents stuck executions |\n| Disable ASan for baseline | 2-4x speed boost (but misses memory bugs) |\n| Use `-jobs` and `-workers` | Limited multi-core support |\n| Run on Linux | Best platform support and performance |\n\n## Troubleshooting\n\n| Problem | Cause | Solution |\n|---------|-------|----------|\n| No crashes found after hours | Poor corpus, low coverage | Add seed inputs, use dictionary, check harness |\n| Very slow executions\u002Fsec (\u003C100) | Target too complex, excessive logging | Optimize target, use `-close_fd_mask=3`, reduce logging |\n| Out of memory | ASan's 20TB virtual memory | Set `-rss_limit_mb=0` to disable RSS limit |\n| Fuzzer stops after first crash | Default behavior | Use `-fork=1 -ignore_crashes=1` to continue |\n| Can't reproduce crash | Non-determinism in harness\u002Ftarget | Remove random number generation, global state |\n| Linking errors with `-fsanitize=fuzzer` | Missing libFuzzer runtime | Ensure using Clang, check LLVM installation |\n| GCC project won't compile with Clang | GCC-specific code | Switch to AFL++ with `gcc_plugin` instead |\n| Coverage not improving | Corpus plateau | Run longer, add dictionary, improve seeds, check coverage report |\n| Crashes but ASan doesn't trigger | Memory error not detected without ASan | Recompile with `-fsanitize=address` |\n\n## Related Skills\n\n### Technique Skills\n\n| Skill | Use Case |\n|-------|----------|\n| **fuzz-harness-writing** | Detailed guidance on writing effective harnesses, structure-aware fuzzing, and FuzzedDataProvider usage |\n| **address-sanitizer** | Memory error detection configuration, ASAN_OPTIONS, and troubleshooting |\n| **undefined-behavior-sanitizer** | Detecting undefined behavior during fuzzing |\n| **coverage-analysis** | Measuring fuzzing effectiveness and identifying untested code paths |\n| **fuzzing-corpus** | Building and managing seed corpora, corpus minimization strategies |\n| **fuzzing-dictionaries** | Creating format-specific dictionaries for faster bug discovery |\n\n### Related Fuzzers\n\n| Skill | When to Consider |\n|-------|------------------|\n| **aflpp** | When you need serious multi-core fuzzing, or when libFuzzer coverage plateaus |\n| **honggfuzz** | When you want hardware-based coverage feedback on Linux |\n| **libafl** | When building custom fuzzers or conducting fuzzing research |\n\n## Resources\n\n### Official Documentation\n\n- [LLVM libFuzzer Documentation](https:\u002F\u002Fllvm.org\u002Fdocs\u002FLibFuzzer.html) - Official reference\n- [libFuzzer Tutorial by Google](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Ftutorial\u002FlibFuzzerTutorial.md) - Step-by-step guide\n- [SanitizerCoverage](https:\u002F\u002Fclang.llvm.org\u002Fdocs\u002FSanitizerCoverage.html) - Coverage instrumentation details\n\n### Advanced Topics\n\n- [Structure-Aware Fuzzing with libprotobuf-mutator](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Fdocs\u002Fstructure-aware-fuzzing.md)\n- [Split Inputs in libFuzzer](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Fdocs\u002Fsplit-inputs.md)\n- [FuzzedDataProvider Header](https:\u002F\u002Fgithub.com\u002Fllvm\u002Fllvm-project\u002Fblob\u002Fmain\u002Fcompiler-rt\u002Finclude\u002Ffuzzer\u002FFuzzedDataProvider.h)\n\n### Example Projects\n\n- [OSS-Fuzz](https:\u002F\u002Fgithub.com\u002Fgoogle\u002Foss-fuzz) - Continuous fuzzing for open-source projects (many libFuzzer examples)\n- [AFL++ Dictionary Collection](https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus\u002Ftree\u002Fstable\u002Fdictionaries) - Reusable dictionaries\n",{"data":36,"body":38},{"name":4,"type":37,"description":6},"fuzzer",{"type":39,"children":40},"root",[41,49,55,62,165,174,199,209,215,336,341,420,426,433,446,452,482,487,532,538,602,608,624,634,640,667,673,679,692,884,890,1004,1012,1045,1051,1064,1226,1248,1254,1259,1410,1431,1437,1443,1456,1488,1531,1539,1592,1598,1606,1653,1661,1704,1730,1736,1874,1880,1885,1894,2005,2013,2053,2059,2123,2128,2173,2179,2185,2190,2208,2218,2300,2308,2326,2332,2337,2363,2369,2374,2414,2426,2444,2450,2456,2474,2479,2485,2513,2533,2539,2547,2570,2575,2583,2606,2611,2619,2642,2650,2673,2681,2700,2706,2714,2750,2780,2788,2815,2824,2830,2838,2857,2865,2888,2894,2899,2909,3050,3058,3067,3080,3097,3103,3108,3114,3119,3229,3235,3256,3262,3270,3319,3327,3441,3449,3498,3508,3526,3532,3544,3550,3558,3602,3610,3656,3664,3712,3720,3749,3757,3798,3804,3812,3840,3857,3863,3869,3879,3887,3932,3940,3949,3957,4012,4020,4072,4080,4105,4122,4128,4133,4141,4184,4192,4233,4239,4244,4287,4293,4425,4431,4437,4442,4450,4512,4520,4543,4551,4645,4653,4676,4684,4739,4747,4792,4800,4827,4833,4838,4992,4997,5035,5040,5046,5052,5164,5170,5175,5193,5207,5213,5218,5325,5331,5454,5460,5685,5691,5697,5809,5815,5884,5890,5896,5935,5941,5972,5978,6005],{"type":42,"tag":43,"props":44,"children":45},"element","h1",{"id":4},[46],{"type":47,"value":48},"text","libFuzzer",{"type":42,"tag":50,"props":51,"children":52},"p",{},[53],{"type":47,"value":54},"libFuzzer is an in-process, coverage-guided fuzzer that is part of the LLVM project. It's the recommended starting point for fuzzing C\u002FC++ projects due to its simplicity and integration with the LLVM toolchain. While libFuzzer has been in maintenance-only mode since late 2022, it is easier to install and use than its alternatives, has wide support, and will be maintained for the foreseeable future.",{"type":42,"tag":56,"props":57,"children":59},"h2",{"id":58},"when-to-use",[60],{"type":47,"value":61},"When to Use",{"type":42,"tag":63,"props":64,"children":65},"table",{},[66,90],{"type":42,"tag":67,"props":68,"children":69},"thead",{},[70],{"type":42,"tag":71,"props":72,"children":73},"tr",{},[74,80,85],{"type":42,"tag":75,"props":76,"children":77},"th",{},[78],{"type":47,"value":79},"Fuzzer",{"type":42,"tag":75,"props":81,"children":82},{},[83],{"type":47,"value":84},"Best For",{"type":42,"tag":75,"props":86,"children":87},{},[88],{"type":47,"value":89},"Complexity",{"type":42,"tag":91,"props":92,"children":93},"tbody",{},[94,112,130,148],{"type":42,"tag":71,"props":95,"children":96},{},[97,102,107],{"type":42,"tag":98,"props":99,"children":100},"td",{},[101],{"type":47,"value":48},{"type":42,"tag":98,"props":103,"children":104},{},[105],{"type":47,"value":106},"Quick setup, single-project fuzzing",{"type":42,"tag":98,"props":108,"children":109},{},[110],{"type":47,"value":111},"Low",{"type":42,"tag":71,"props":113,"children":114},{},[115,120,125],{"type":42,"tag":98,"props":116,"children":117},{},[118],{"type":47,"value":119},"AFL++",{"type":42,"tag":98,"props":121,"children":122},{},[123],{"type":47,"value":124},"Multi-core fuzzing, diverse mutations",{"type":42,"tag":98,"props":126,"children":127},{},[128],{"type":47,"value":129},"Medium",{"type":42,"tag":71,"props":131,"children":132},{},[133,138,143],{"type":42,"tag":98,"props":134,"children":135},{},[136],{"type":47,"value":137},"LibAFL",{"type":42,"tag":98,"props":139,"children":140},{},[141],{"type":47,"value":142},"Custom fuzzers, research projects",{"type":42,"tag":98,"props":144,"children":145},{},[146],{"type":47,"value":147},"High",{"type":42,"tag":71,"props":149,"children":150},{},[151,156,161],{"type":42,"tag":98,"props":152,"children":153},{},[154],{"type":47,"value":155},"Honggfuzz",{"type":42,"tag":98,"props":157,"children":158},{},[159],{"type":47,"value":160},"Hardware-based coverage",{"type":42,"tag":98,"props":162,"children":163},{},[164],{"type":47,"value":129},{"type":42,"tag":50,"props":166,"children":167},{},[168],{"type":42,"tag":169,"props":170,"children":171},"strong",{},[172],{"type":47,"value":173},"Choose libFuzzer when:",{"type":42,"tag":175,"props":176,"children":177},"ul",{},[178,184,189,194],{"type":42,"tag":179,"props":180,"children":181},"li",{},[182],{"type":47,"value":183},"You need a simple, quick setup for C\u002FC++ code",{"type":42,"tag":179,"props":185,"children":186},{},[187],{"type":47,"value":188},"Project uses Clang for compilation",{"type":42,"tag":179,"props":190,"children":191},{},[192],{"type":47,"value":193},"Single-core fuzzing is sufficient initially",{"type":42,"tag":179,"props":195,"children":196},{},[197],{"type":47,"value":198},"Transitioning to AFL++ later is an option (harnesses are compatible)",{"type":42,"tag":50,"props":200,"children":201},{},[202,207],{"type":42,"tag":169,"props":203,"children":204},{},[205],{"type":47,"value":206},"Note:",{"type":47,"value":208}," Fuzzing harnesses written for libFuzzer are compatible with AFL++, making it easy to transition if you need more advanced features like better multi-core support.",{"type":42,"tag":56,"props":210,"children":212},{"id":211},"quick-start",[213],{"type":47,"value":214},"Quick Start",{"type":42,"tag":216,"props":217,"children":222},"pre",{"className":218,"code":219,"language":220,"meta":221,"style":221},"language-c++ shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","#include \u003Cstdint.h>\n#include \u003Cstddef.h>\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    \u002F\u002F Validate input if needed\n    if (size \u003C 1) return 0;\n\n    \u002F\u002F Call your target function with fuzzer-provided data\n    my_target_function(data, size);\n\n    return 0;\n}\n","c++","",[223],{"type":42,"tag":224,"props":225,"children":226},"code",{"__ignoreMap":221},[227,238,247,257,266,275,284,292,301,310,318,327],{"type":42,"tag":228,"props":229,"children":232},"span",{"class":230,"line":231},"line",1,[233],{"type":42,"tag":228,"props":234,"children":235},{},[236],{"type":47,"value":237},"#include \u003Cstdint.h>\n",{"type":42,"tag":228,"props":239,"children":241},{"class":230,"line":240},2,[242],{"type":42,"tag":228,"props":243,"children":244},{},[245],{"type":47,"value":246},"#include \u003Cstddef.h>\n",{"type":42,"tag":228,"props":248,"children":250},{"class":230,"line":249},3,[251],{"type":42,"tag":228,"props":252,"children":254},{"emptyLinePlaceholder":253},true,[255],{"type":47,"value":256},"\n",{"type":42,"tag":228,"props":258,"children":260},{"class":230,"line":259},4,[261],{"type":42,"tag":228,"props":262,"children":263},{},[264],{"type":47,"value":265},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n",{"type":42,"tag":228,"props":267,"children":269},{"class":230,"line":268},5,[270],{"type":42,"tag":228,"props":271,"children":272},{},[273],{"type":47,"value":274},"    \u002F\u002F Validate input if needed\n",{"type":42,"tag":228,"props":276,"children":278},{"class":230,"line":277},6,[279],{"type":42,"tag":228,"props":280,"children":281},{},[282],{"type":47,"value":283},"    if (size \u003C 1) return 0;\n",{"type":42,"tag":228,"props":285,"children":287},{"class":230,"line":286},7,[288],{"type":42,"tag":228,"props":289,"children":290},{"emptyLinePlaceholder":253},[291],{"type":47,"value":256},{"type":42,"tag":228,"props":293,"children":295},{"class":230,"line":294},8,[296],{"type":42,"tag":228,"props":297,"children":298},{},[299],{"type":47,"value":300},"    \u002F\u002F Call your target function with fuzzer-provided data\n",{"type":42,"tag":228,"props":302,"children":304},{"class":230,"line":303},9,[305],{"type":42,"tag":228,"props":306,"children":307},{},[308],{"type":47,"value":309},"    my_target_function(data, size);\n",{"type":42,"tag":228,"props":311,"children":313},{"class":230,"line":312},10,[314],{"type":42,"tag":228,"props":315,"children":316},{"emptyLinePlaceholder":253},[317],{"type":47,"value":256},{"type":42,"tag":228,"props":319,"children":321},{"class":230,"line":320},11,[322],{"type":42,"tag":228,"props":323,"children":324},{},[325],{"type":47,"value":326},"    return 0;\n",{"type":42,"tag":228,"props":328,"children":330},{"class":230,"line":329},12,[331],{"type":42,"tag":228,"props":332,"children":333},{},[334],{"type":47,"value":335},"}\n",{"type":42,"tag":50,"props":337,"children":338},{},[339],{"type":47,"value":340},"Compile and run:",{"type":42,"tag":216,"props":342,"children":346},{"className":343,"code":344,"language":345,"meta":221,"style":221},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","clang++ -fsanitize=fuzzer,address -g -O2 harness.cc target.cc -o fuzz\nmkdir corpus\u002F\n.\u002Ffuzz corpus\u002F\n","bash",[347],{"type":42,"tag":224,"props":348,"children":349},{"__ignoreMap":221},[350,395,408],{"type":42,"tag":228,"props":351,"children":352},{"class":230,"line":231},[353,359,365,370,375,380,385,390],{"type":42,"tag":228,"props":354,"children":356},{"style":355},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[357],{"type":47,"value":358},"clang++",{"type":42,"tag":228,"props":360,"children":362},{"style":361},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[363],{"type":47,"value":364}," -fsanitize=fuzzer,address",{"type":42,"tag":228,"props":366,"children":367},{"style":361},[368],{"type":47,"value":369}," -g",{"type":42,"tag":228,"props":371,"children":372},{"style":361},[373],{"type":47,"value":374}," -O2",{"type":42,"tag":228,"props":376,"children":377},{"style":361},[378],{"type":47,"value":379}," harness.cc",{"type":42,"tag":228,"props":381,"children":382},{"style":361},[383],{"type":47,"value":384}," target.cc",{"type":42,"tag":228,"props":386,"children":387},{"style":361},[388],{"type":47,"value":389}," -o",{"type":42,"tag":228,"props":391,"children":392},{"style":361},[393],{"type":47,"value":394}," fuzz\n",{"type":42,"tag":228,"props":396,"children":397},{"class":230,"line":240},[398,403],{"type":42,"tag":228,"props":399,"children":400},{"style":355},[401],{"type":47,"value":402},"mkdir",{"type":42,"tag":228,"props":404,"children":405},{"style":361},[406],{"type":47,"value":407}," corpus\u002F\n",{"type":42,"tag":228,"props":409,"children":410},{"class":230,"line":249},[411,416],{"type":42,"tag":228,"props":412,"children":413},{"style":355},[414],{"type":47,"value":415},".\u002Ffuzz",{"type":42,"tag":228,"props":417,"children":418},{"style":361},[419],{"type":47,"value":407},{"type":42,"tag":56,"props":421,"children":423},{"id":422},"installation",[424],{"type":47,"value":425},"Installation",{"type":42,"tag":427,"props":428,"children":430},"h3",{"id":429},"prerequisites",[431],{"type":47,"value":432},"Prerequisites",{"type":42,"tag":175,"props":434,"children":435},{},[436,441],{"type":42,"tag":179,"props":437,"children":438},{},[439],{"type":47,"value":440},"LLVM\u002FClang compiler (includes libFuzzer)",{"type":42,"tag":179,"props":442,"children":443},{},[444],{"type":47,"value":445},"LLVM tools for coverage analysis (optional)",{"type":42,"tag":427,"props":447,"children":449},{"id":448},"linux-ubuntudebian",[450],{"type":47,"value":451},"Linux (Ubuntu\u002FDebian)",{"type":42,"tag":216,"props":453,"children":455},{"className":343,"code":454,"language":345,"meta":221,"style":221},"apt install clang llvm\n",[456],{"type":42,"tag":224,"props":457,"children":458},{"__ignoreMap":221},[459],{"type":42,"tag":228,"props":460,"children":461},{"class":230,"line":231},[462,467,472,477],{"type":42,"tag":228,"props":463,"children":464},{"style":355},[465],{"type":47,"value":466},"apt",{"type":42,"tag":228,"props":468,"children":469},{"style":361},[470],{"type":47,"value":471}," install",{"type":42,"tag":228,"props":473,"children":474},{"style":361},[475],{"type":47,"value":476}," clang",{"type":42,"tag":228,"props":478,"children":479},{"style":361},[480],{"type":47,"value":481}," llvm\n",{"type":42,"tag":50,"props":483,"children":484},{},[485],{"type":47,"value":486},"For the latest LLVM version:",{"type":42,"tag":216,"props":488,"children":490},{"className":343,"code":489,"language":345,"meta":221,"style":221},"# Add LLVM repository from apt.llvm.org\n# Then install specific version, e.g.:\napt install clang-18 llvm-18\n",[491],{"type":42,"tag":224,"props":492,"children":493},{"__ignoreMap":221},[494,503,511],{"type":42,"tag":228,"props":495,"children":496},{"class":230,"line":231},[497],{"type":42,"tag":228,"props":498,"children":500},{"style":499},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[501],{"type":47,"value":502},"# Add LLVM repository from apt.llvm.org\n",{"type":42,"tag":228,"props":504,"children":505},{"class":230,"line":240},[506],{"type":42,"tag":228,"props":507,"children":508},{"style":499},[509],{"type":47,"value":510},"# Then install specific version, e.g.:\n",{"type":42,"tag":228,"props":512,"children":513},{"class":230,"line":249},[514,518,522,527],{"type":42,"tag":228,"props":515,"children":516},{"style":355},[517],{"type":47,"value":466},{"type":42,"tag":228,"props":519,"children":520},{"style":361},[521],{"type":47,"value":471},{"type":42,"tag":228,"props":523,"children":524},{"style":361},[525],{"type":47,"value":526}," clang-18",{"type":42,"tag":228,"props":528,"children":529},{"style":361},[530],{"type":47,"value":531}," llvm-18\n",{"type":42,"tag":427,"props":533,"children":535},{"id":534},"macos",[536],{"type":47,"value":537},"macOS",{"type":42,"tag":216,"props":539,"children":541},{"className":343,"code":540,"language":345,"meta":221,"style":221},"# Using Homebrew\nbrew install llvm\n\n# Or using Nix\nnix-env -i clang\n",[542],{"type":42,"tag":224,"props":543,"children":544},{"__ignoreMap":221},[545,553,569,576,584],{"type":42,"tag":228,"props":546,"children":547},{"class":230,"line":231},[548],{"type":42,"tag":228,"props":549,"children":550},{"style":499},[551],{"type":47,"value":552},"# Using Homebrew\n",{"type":42,"tag":228,"props":554,"children":555},{"class":230,"line":240},[556,561,565],{"type":42,"tag":228,"props":557,"children":558},{"style":355},[559],{"type":47,"value":560},"brew",{"type":42,"tag":228,"props":562,"children":563},{"style":361},[564],{"type":47,"value":471},{"type":42,"tag":228,"props":566,"children":567},{"style":361},[568],{"type":47,"value":481},{"type":42,"tag":228,"props":570,"children":571},{"class":230,"line":249},[572],{"type":42,"tag":228,"props":573,"children":574},{"emptyLinePlaceholder":253},[575],{"type":47,"value":256},{"type":42,"tag":228,"props":577,"children":578},{"class":230,"line":259},[579],{"type":42,"tag":228,"props":580,"children":581},{"style":499},[582],{"type":47,"value":583},"# Or using Nix\n",{"type":42,"tag":228,"props":585,"children":586},{"class":230,"line":268},[587,592,597],{"type":42,"tag":228,"props":588,"children":589},{"style":355},[590],{"type":47,"value":591},"nix-env",{"type":42,"tag":228,"props":593,"children":594},{"style":361},[595],{"type":47,"value":596}," -i",{"type":42,"tag":228,"props":598,"children":599},{"style":361},[600],{"type":47,"value":601}," clang\n",{"type":42,"tag":427,"props":603,"children":605},{"id":604},"windows",[606],{"type":47,"value":607},"Windows",{"type":42,"tag":50,"props":609,"children":610},{},[611,613,622],{"type":47,"value":612},"Install Clang through Visual Studio. Refer to ",{"type":42,"tag":614,"props":615,"children":619},"a",{"href":616,"rel":617},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fcpp\u002Fbuild\u002Fclang-support-msbuild?view=msvc-170",[618],"nofollow",[620],{"type":47,"value":621},"Microsoft's documentation",{"type":47,"value":623}," for setup instructions.",{"type":42,"tag":50,"props":625,"children":626},{},[627,632],{"type":42,"tag":169,"props":628,"children":629},{},[630],{"type":47,"value":631},"Recommendation:",{"type":47,"value":633}," If possible, fuzz on a local x86_64 VM or rent one on DigitalOcean, AWS, or Hetzner. Linux provides the best support for libFuzzer.",{"type":42,"tag":427,"props":635,"children":637},{"id":636},"verification",[638],{"type":47,"value":639},"Verification",{"type":42,"tag":216,"props":641,"children":643},{"className":343,"code":642,"language":345,"meta":221,"style":221},"clang++ --version\n# Should show LLVM version information\n",[644],{"type":42,"tag":224,"props":645,"children":646},{"__ignoreMap":221},[647,659],{"type":42,"tag":228,"props":648,"children":649},{"class":230,"line":231},[650,654],{"type":42,"tag":228,"props":651,"children":652},{"style":355},[653],{"type":47,"value":358},{"type":42,"tag":228,"props":655,"children":656},{"style":361},[657],{"type":47,"value":658}," --version\n",{"type":42,"tag":228,"props":660,"children":661},{"class":230,"line":240},[662],{"type":42,"tag":228,"props":663,"children":664},{"style":499},[665],{"type":47,"value":666},"# Should show LLVM version information\n",{"type":42,"tag":56,"props":668,"children":670},{"id":669},"writing-a-harness",[671],{"type":47,"value":672},"Writing a Harness",{"type":42,"tag":427,"props":674,"children":676},{"id":675},"harness-structure",[677],{"type":47,"value":678},"Harness Structure",{"type":42,"tag":50,"props":680,"children":681},{},[682,684,690],{"type":47,"value":683},"The harness is the entry point for the fuzzer. libFuzzer calls the ",{"type":42,"tag":224,"props":685,"children":687},{"className":686},[],[688],{"type":47,"value":689},"LLVMFuzzerTestOneInput",{"type":47,"value":691}," function repeatedly with different inputs.",{"type":42,"tag":216,"props":693,"children":695},{"className":218,"code":694,"language":220,"meta":221,"style":221},"#include \u003Cstdint.h>\n#include \u003Cstddef.h>\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    \u002F\u002F 1. Optional: Validate input size\n    if (size \u003C MIN_REQUIRED_SIZE) {\n        return 0;  \u002F\u002F Reject inputs that are too small\n    }\n\n    \u002F\u002F 2. Optional: Convert raw bytes to structured data\n    \u002F\u002F Example: Parse two integers from byte array\n    if (size >= 2 * sizeof(uint32_t)) {\n        uint32_t a = *(uint32_t*)(data);\n        uint32_t b = *(uint32_t*)(data + sizeof(uint32_t));\n        my_function(a, b);\n    }\n\n    \u002F\u002F 3. Call target function\n    target_function(data, size);\n\n    \u002F\u002F 4. Always return 0 (non-zero reserved for future use)\n    return 0;\n}\n",[696],{"type":42,"tag":224,"props":697,"children":698},{"__ignoreMap":221},[699,706,713,720,727,735,743,751,759,766,774,782,790,799,808,817,825,833,842,851,859,868,876],{"type":42,"tag":228,"props":700,"children":701},{"class":230,"line":231},[702],{"type":42,"tag":228,"props":703,"children":704},{},[705],{"type":47,"value":237},{"type":42,"tag":228,"props":707,"children":708},{"class":230,"line":240},[709],{"type":42,"tag":228,"props":710,"children":711},{},[712],{"type":47,"value":246},{"type":42,"tag":228,"props":714,"children":715},{"class":230,"line":249},[716],{"type":42,"tag":228,"props":717,"children":718},{"emptyLinePlaceholder":253},[719],{"type":47,"value":256},{"type":42,"tag":228,"props":721,"children":722},{"class":230,"line":259},[723],{"type":42,"tag":228,"props":724,"children":725},{},[726],{"type":47,"value":265},{"type":42,"tag":228,"props":728,"children":729},{"class":230,"line":268},[730],{"type":42,"tag":228,"props":731,"children":732},{},[733],{"type":47,"value":734},"    \u002F\u002F 1. Optional: Validate input size\n",{"type":42,"tag":228,"props":736,"children":737},{"class":230,"line":277},[738],{"type":42,"tag":228,"props":739,"children":740},{},[741],{"type":47,"value":742},"    if (size \u003C MIN_REQUIRED_SIZE) {\n",{"type":42,"tag":228,"props":744,"children":745},{"class":230,"line":286},[746],{"type":42,"tag":228,"props":747,"children":748},{},[749],{"type":47,"value":750},"        return 0;  \u002F\u002F Reject inputs that are too small\n",{"type":42,"tag":228,"props":752,"children":753},{"class":230,"line":294},[754],{"type":42,"tag":228,"props":755,"children":756},{},[757],{"type":47,"value":758},"    }\n",{"type":42,"tag":228,"props":760,"children":761},{"class":230,"line":303},[762],{"type":42,"tag":228,"props":763,"children":764},{"emptyLinePlaceholder":253},[765],{"type":47,"value":256},{"type":42,"tag":228,"props":767,"children":768},{"class":230,"line":312},[769],{"type":42,"tag":228,"props":770,"children":771},{},[772],{"type":47,"value":773},"    \u002F\u002F 2. Optional: Convert raw bytes to structured data\n",{"type":42,"tag":228,"props":775,"children":776},{"class":230,"line":320},[777],{"type":42,"tag":228,"props":778,"children":779},{},[780],{"type":47,"value":781},"    \u002F\u002F Example: Parse two integers from byte array\n",{"type":42,"tag":228,"props":783,"children":784},{"class":230,"line":329},[785],{"type":42,"tag":228,"props":786,"children":787},{},[788],{"type":47,"value":789},"    if (size >= 2 * sizeof(uint32_t)) {\n",{"type":42,"tag":228,"props":791,"children":793},{"class":230,"line":792},13,[794],{"type":42,"tag":228,"props":795,"children":796},{},[797],{"type":47,"value":798},"        uint32_t a = *(uint32_t*)(data);\n",{"type":42,"tag":228,"props":800,"children":802},{"class":230,"line":801},14,[803],{"type":42,"tag":228,"props":804,"children":805},{},[806],{"type":47,"value":807},"        uint32_t b = *(uint32_t*)(data + sizeof(uint32_t));\n",{"type":42,"tag":228,"props":809,"children":811},{"class":230,"line":810},15,[812],{"type":42,"tag":228,"props":813,"children":814},{},[815],{"type":47,"value":816},"        my_function(a, b);\n",{"type":42,"tag":228,"props":818,"children":820},{"class":230,"line":819},16,[821],{"type":42,"tag":228,"props":822,"children":823},{},[824],{"type":47,"value":758},{"type":42,"tag":228,"props":826,"children":828},{"class":230,"line":827},17,[829],{"type":42,"tag":228,"props":830,"children":831},{"emptyLinePlaceholder":253},[832],{"type":47,"value":256},{"type":42,"tag":228,"props":834,"children":836},{"class":230,"line":835},18,[837],{"type":42,"tag":228,"props":838,"children":839},{},[840],{"type":47,"value":841},"    \u002F\u002F 3. Call target function\n",{"type":42,"tag":228,"props":843,"children":845},{"class":230,"line":844},19,[846],{"type":42,"tag":228,"props":847,"children":848},{},[849],{"type":47,"value":850},"    target_function(data, size);\n",{"type":42,"tag":228,"props":852,"children":854},{"class":230,"line":853},20,[855],{"type":42,"tag":228,"props":856,"children":857},{"emptyLinePlaceholder":253},[858],{"type":47,"value":256},{"type":42,"tag":228,"props":860,"children":862},{"class":230,"line":861},21,[863],{"type":42,"tag":228,"props":864,"children":865},{},[866],{"type":47,"value":867},"    \u002F\u002F 4. Always return 0 (non-zero reserved for future use)\n",{"type":42,"tag":228,"props":869,"children":871},{"class":230,"line":870},22,[872],{"type":42,"tag":228,"props":873,"children":874},{},[875],{"type":47,"value":326},{"type":42,"tag":228,"props":877,"children":879},{"class":230,"line":878},23,[880],{"type":42,"tag":228,"props":881,"children":882},{},[883],{"type":47,"value":335},{"type":42,"tag":427,"props":885,"children":887},{"id":886},"harness-rules",[888],{"type":47,"value":889},"Harness Rules",{"type":42,"tag":63,"props":891,"children":892},{},[893,909],{"type":42,"tag":67,"props":894,"children":895},{},[896],{"type":42,"tag":71,"props":897,"children":898},{},[899,904],{"type":42,"tag":75,"props":900,"children":901},{},[902],{"type":47,"value":903},"Do",{"type":42,"tag":75,"props":905,"children":906},{},[907],{"type":47,"value":908},"Don't",{"type":42,"tag":91,"props":910,"children":911},{},[912,933,946,959,978,991],{"type":42,"tag":71,"props":913,"children":914},{},[915,920],{"type":42,"tag":98,"props":916,"children":917},{},[918],{"type":47,"value":919},"Handle all input types (empty, huge, malformed)",{"type":42,"tag":98,"props":921,"children":922},{},[923,925,931],{"type":47,"value":924},"Call ",{"type":42,"tag":224,"props":926,"children":928},{"className":927},[],[929],{"type":47,"value":930},"exit()",{"type":47,"value":932}," - stops fuzzing process",{"type":42,"tag":71,"props":934,"children":935},{},[936,941],{"type":42,"tag":98,"props":937,"children":938},{},[939],{"type":47,"value":940},"Join all threads before returning",{"type":42,"tag":98,"props":942,"children":943},{},[944],{"type":47,"value":945},"Leave threads running",{"type":42,"tag":71,"props":947,"children":948},{},[949,954],{"type":42,"tag":98,"props":950,"children":951},{},[952],{"type":47,"value":953},"Keep harness fast and simple",{"type":42,"tag":98,"props":955,"children":956},{},[957],{"type":47,"value":958},"Add excessive logging or complexity",{"type":42,"tag":71,"props":960,"children":961},{},[962,967],{"type":42,"tag":98,"props":963,"children":964},{},[965],{"type":47,"value":966},"Maintain determinism",{"type":42,"tag":98,"props":968,"children":969},{},[970,972],{"type":47,"value":971},"Use random number generators or read ",{"type":42,"tag":224,"props":973,"children":975},{"className":974},[],[976],{"type":47,"value":977},"\u002Fdev\u002Frandom",{"type":42,"tag":71,"props":979,"children":980},{},[981,986],{"type":42,"tag":98,"props":982,"children":983},{},[984],{"type":47,"value":985},"Reset global state between runs",{"type":42,"tag":98,"props":987,"children":988},{},[989],{"type":47,"value":990},"Rely on state from previous executions",{"type":42,"tag":71,"props":992,"children":993},{},[994,999],{"type":42,"tag":98,"props":995,"children":996},{},[997],{"type":47,"value":998},"Use narrow, focused targets",{"type":42,"tag":98,"props":1000,"children":1001},{},[1002],{"type":47,"value":1003},"Mix unrelated data formats (PNG + TCP) in one harness",{"type":42,"tag":50,"props":1005,"children":1006},{},[1007],{"type":42,"tag":169,"props":1008,"children":1009},{},[1010],{"type":47,"value":1011},"Rationale:",{"type":42,"tag":175,"props":1013,"children":1014},{},[1015,1025,1035],{"type":42,"tag":179,"props":1016,"children":1017},{},[1018,1023],{"type":42,"tag":169,"props":1019,"children":1020},{},[1021],{"type":47,"value":1022},"Speed matters:",{"type":47,"value":1024}," Aim for 100s-1000s executions per second per core",{"type":42,"tag":179,"props":1026,"children":1027},{},[1028,1033],{"type":42,"tag":169,"props":1029,"children":1030},{},[1031],{"type":47,"value":1032},"Reproducibility:",{"type":47,"value":1034}," Crashes must be reproducible after fuzzing completes",{"type":42,"tag":179,"props":1036,"children":1037},{},[1038,1043],{"type":42,"tag":169,"props":1039,"children":1040},{},[1041],{"type":47,"value":1042},"Isolation:",{"type":47,"value":1044}," Each execution should be independent",{"type":42,"tag":427,"props":1046,"children":1048},{"id":1047},"using-fuzzeddataprovider-for-complex-inputs",[1049],{"type":47,"value":1050},"Using FuzzedDataProvider for Complex Inputs",{"type":42,"tag":50,"props":1052,"children":1053},{},[1054,1056,1062],{"type":47,"value":1055},"For complex inputs (strings, multiple parameters), use the ",{"type":42,"tag":224,"props":1057,"children":1059},{"className":1058},[],[1060],{"type":47,"value":1061},"FuzzedDataProvider",{"type":47,"value":1063}," helper:",{"type":42,"tag":216,"props":1065,"children":1067},{"className":218,"code":1066,"language":220,"meta":221,"style":221},"#include \u003Cstdint.h>\n#include \u003Cstddef.h>\n#include \"FuzzedDataProvider.h\"  \u002F\u002F From LLVM project\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    FuzzedDataProvider fuzzed_data(data, size);\n\n    \u002F\u002F Extract structured data\n    size_t allocation_size = fuzzed_data.ConsumeIntegral\u003Csize_t>();\n    std::vector\u003Cchar> str1 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n    std::vector\u003Cchar> str2 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n\n    \u002F\u002F Call target with extracted data\n    char* result = concat(&str1[0], str1.size(), &str2[0], str2.size(), allocation_size);\n    if (result != NULL) {\n        free(result);\n    }\n\n    return 0;\n}\n",[1068],{"type":42,"tag":224,"props":1069,"children":1070},{"__ignoreMap":221},[1071,1078,1085,1098,1105,1112,1120,1127,1135,1143,1151,1159,1166,1174,1182,1190,1198,1205,1212,1219],{"type":42,"tag":228,"props":1072,"children":1073},{"class":230,"line":231},[1074],{"type":42,"tag":228,"props":1075,"children":1076},{},[1077],{"type":47,"value":237},{"type":42,"tag":228,"props":1079,"children":1080},{"class":230,"line":240},[1081],{"type":42,"tag":228,"props":1082,"children":1083},{},[1084],{"type":47,"value":246},{"type":42,"tag":228,"props":1086,"children":1087},{"class":230,"line":249},[1088,1093],{"type":42,"tag":228,"props":1089,"children":1090},{},[1091],{"type":47,"value":1092},"#include \"FuzzedDataProvider.h\"",{"type":42,"tag":228,"props":1094,"children":1095},{},[1096],{"type":47,"value":1097},"  \u002F\u002F From LLVM project\n",{"type":42,"tag":228,"props":1099,"children":1100},{"class":230,"line":259},[1101],{"type":42,"tag":228,"props":1102,"children":1103},{"emptyLinePlaceholder":253},[1104],{"type":47,"value":256},{"type":42,"tag":228,"props":1106,"children":1107},{"class":230,"line":268},[1108],{"type":42,"tag":228,"props":1109,"children":1110},{},[1111],{"type":47,"value":265},{"type":42,"tag":228,"props":1113,"children":1114},{"class":230,"line":277},[1115],{"type":42,"tag":228,"props":1116,"children":1117},{},[1118],{"type":47,"value":1119},"    FuzzedDataProvider fuzzed_data(data, size);\n",{"type":42,"tag":228,"props":1121,"children":1122},{"class":230,"line":286},[1123],{"type":42,"tag":228,"props":1124,"children":1125},{"emptyLinePlaceholder":253},[1126],{"type":47,"value":256},{"type":42,"tag":228,"props":1128,"children":1129},{"class":230,"line":294},[1130],{"type":42,"tag":228,"props":1131,"children":1132},{},[1133],{"type":47,"value":1134},"    \u002F\u002F Extract structured data\n",{"type":42,"tag":228,"props":1136,"children":1137},{"class":230,"line":303},[1138],{"type":42,"tag":228,"props":1139,"children":1140},{},[1141],{"type":47,"value":1142},"    size_t allocation_size = fuzzed_data.ConsumeIntegral\u003Csize_t>();\n",{"type":42,"tag":228,"props":1144,"children":1145},{"class":230,"line":312},[1146],{"type":42,"tag":228,"props":1147,"children":1148},{},[1149],{"type":47,"value":1150},"    std::vector\u003Cchar> str1 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n",{"type":42,"tag":228,"props":1152,"children":1153},{"class":230,"line":320},[1154],{"type":42,"tag":228,"props":1155,"children":1156},{},[1157],{"type":47,"value":1158},"    std::vector\u003Cchar> str2 = fuzzed_data.ConsumeBytesWithTerminator\u003Cchar>(32, 0xFF);\n",{"type":42,"tag":228,"props":1160,"children":1161},{"class":230,"line":329},[1162],{"type":42,"tag":228,"props":1163,"children":1164},{"emptyLinePlaceholder":253},[1165],{"type":47,"value":256},{"type":42,"tag":228,"props":1167,"children":1168},{"class":230,"line":792},[1169],{"type":42,"tag":228,"props":1170,"children":1171},{},[1172],{"type":47,"value":1173},"    \u002F\u002F Call target with extracted data\n",{"type":42,"tag":228,"props":1175,"children":1176},{"class":230,"line":801},[1177],{"type":42,"tag":228,"props":1178,"children":1179},{},[1180],{"type":47,"value":1181},"    char* result = concat(&str1[0], str1.size(), &str2[0], str2.size(), allocation_size);\n",{"type":42,"tag":228,"props":1183,"children":1184},{"class":230,"line":810},[1185],{"type":42,"tag":228,"props":1186,"children":1187},{},[1188],{"type":47,"value":1189},"    if (result != NULL) {\n",{"type":42,"tag":228,"props":1191,"children":1192},{"class":230,"line":819},[1193],{"type":42,"tag":228,"props":1194,"children":1195},{},[1196],{"type":47,"value":1197},"        free(result);\n",{"type":42,"tag":228,"props":1199,"children":1200},{"class":230,"line":827},[1201],{"type":42,"tag":228,"props":1202,"children":1203},{},[1204],{"type":47,"value":758},{"type":42,"tag":228,"props":1206,"children":1207},{"class":230,"line":835},[1208],{"type":42,"tag":228,"props":1209,"children":1210},{"emptyLinePlaceholder":253},[1211],{"type":47,"value":256},{"type":42,"tag":228,"props":1213,"children":1214},{"class":230,"line":844},[1215],{"type":42,"tag":228,"props":1216,"children":1217},{},[1218],{"type":47,"value":326},{"type":42,"tag":228,"props":1220,"children":1221},{"class":230,"line":853},[1222],{"type":42,"tag":228,"props":1223,"children":1224},{},[1225],{"type":47,"value":335},{"type":42,"tag":50,"props":1227,"children":1228},{},[1229,1231,1237,1239,1246],{"type":47,"value":1230},"Download ",{"type":42,"tag":224,"props":1232,"children":1234},{"className":1233},[],[1235],{"type":47,"value":1236},"FuzzedDataProvider.h",{"type":47,"value":1238}," from the ",{"type":42,"tag":614,"props":1240,"children":1243},{"href":1241,"rel":1242},"https:\u002F\u002Fgithub.com\u002Fllvm\u002Fllvm-project\u002Fblob\u002Fmain\u002Fcompiler-rt\u002Finclude\u002Ffuzzer\u002FFuzzedDataProvider.h",[618],[1244],{"type":47,"value":1245},"LLVM repository",{"type":47,"value":1247},".",{"type":42,"tag":427,"props":1249,"children":1251},{"id":1250},"interleaved-fuzzing",[1252],{"type":47,"value":1253},"Interleaved Fuzzing",{"type":42,"tag":50,"props":1255,"children":1256},{},[1257],{"type":47,"value":1258},"Use a single harness to test multiple related functions:",{"type":42,"tag":216,"props":1260,"children":1262},{"className":218,"code":1261,"language":220,"meta":221,"style":221},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    if (size \u003C 1 + 2 * sizeof(int32_t)) {\n        return 0;\n    }\n\n    uint8_t mode = data[0];\n    int32_t numbers[2];\n    memcpy(numbers, data + 1, 2 * sizeof(int32_t));\n\n    \u002F\u002F Select function based on first byte\n    switch (mode % 4) {\n        case 0: add(numbers[0], numbers[1]); break;\n        case 1: subtract(numbers[0], numbers[1]); break;\n        case 2: multiply(numbers[0], numbers[1]); break;\n        case 3: divide(numbers[0], numbers[1]); break;\n    }\n\n    return 0;\n}\n",[1263],{"type":42,"tag":224,"props":1264,"children":1265},{"__ignoreMap":221},[1266,1273,1281,1289,1296,1303,1311,1319,1327,1334,1342,1350,1358,1366,1374,1382,1389,1396,1403],{"type":42,"tag":228,"props":1267,"children":1268},{"class":230,"line":231},[1269],{"type":42,"tag":228,"props":1270,"children":1271},{},[1272],{"type":47,"value":265},{"type":42,"tag":228,"props":1274,"children":1275},{"class":230,"line":240},[1276],{"type":42,"tag":228,"props":1277,"children":1278},{},[1279],{"type":47,"value":1280},"    if (size \u003C 1 + 2 * sizeof(int32_t)) {\n",{"type":42,"tag":228,"props":1282,"children":1283},{"class":230,"line":249},[1284],{"type":42,"tag":228,"props":1285,"children":1286},{},[1287],{"type":47,"value":1288},"        return 0;\n",{"type":42,"tag":228,"props":1290,"children":1291},{"class":230,"line":259},[1292],{"type":42,"tag":228,"props":1293,"children":1294},{},[1295],{"type":47,"value":758},{"type":42,"tag":228,"props":1297,"children":1298},{"class":230,"line":268},[1299],{"type":42,"tag":228,"props":1300,"children":1301},{"emptyLinePlaceholder":253},[1302],{"type":47,"value":256},{"type":42,"tag":228,"props":1304,"children":1305},{"class":230,"line":277},[1306],{"type":42,"tag":228,"props":1307,"children":1308},{},[1309],{"type":47,"value":1310},"    uint8_t mode = data[0];\n",{"type":42,"tag":228,"props":1312,"children":1313},{"class":230,"line":286},[1314],{"type":42,"tag":228,"props":1315,"children":1316},{},[1317],{"type":47,"value":1318},"    int32_t numbers[2];\n",{"type":42,"tag":228,"props":1320,"children":1321},{"class":230,"line":294},[1322],{"type":42,"tag":228,"props":1323,"children":1324},{},[1325],{"type":47,"value":1326},"    memcpy(numbers, data + 1, 2 * sizeof(int32_t));\n",{"type":42,"tag":228,"props":1328,"children":1329},{"class":230,"line":303},[1330],{"type":42,"tag":228,"props":1331,"children":1332},{"emptyLinePlaceholder":253},[1333],{"type":47,"value":256},{"type":42,"tag":228,"props":1335,"children":1336},{"class":230,"line":312},[1337],{"type":42,"tag":228,"props":1338,"children":1339},{},[1340],{"type":47,"value":1341},"    \u002F\u002F Select function based on first byte\n",{"type":42,"tag":228,"props":1343,"children":1344},{"class":230,"line":320},[1345],{"type":42,"tag":228,"props":1346,"children":1347},{},[1348],{"type":47,"value":1349},"    switch (mode % 4) {\n",{"type":42,"tag":228,"props":1351,"children":1352},{"class":230,"line":329},[1353],{"type":42,"tag":228,"props":1354,"children":1355},{},[1356],{"type":47,"value":1357},"        case 0: add(numbers[0], numbers[1]); break;\n",{"type":42,"tag":228,"props":1359,"children":1360},{"class":230,"line":792},[1361],{"type":42,"tag":228,"props":1362,"children":1363},{},[1364],{"type":47,"value":1365},"        case 1: subtract(numbers[0], numbers[1]); break;\n",{"type":42,"tag":228,"props":1367,"children":1368},{"class":230,"line":801},[1369],{"type":42,"tag":228,"props":1370,"children":1371},{},[1372],{"type":47,"value":1373},"        case 2: multiply(numbers[0], numbers[1]); break;\n",{"type":42,"tag":228,"props":1375,"children":1376},{"class":230,"line":810},[1377],{"type":42,"tag":228,"props":1378,"children":1379},{},[1380],{"type":47,"value":1381},"        case 3: divide(numbers[0], numbers[1]); break;\n",{"type":42,"tag":228,"props":1383,"children":1384},{"class":230,"line":819},[1385],{"type":42,"tag":228,"props":1386,"children":1387},{},[1388],{"type":47,"value":758},{"type":42,"tag":228,"props":1390,"children":1391},{"class":230,"line":827},[1392],{"type":42,"tag":228,"props":1393,"children":1394},{"emptyLinePlaceholder":253},[1395],{"type":47,"value":256},{"type":42,"tag":228,"props":1397,"children":1398},{"class":230,"line":835},[1399],{"type":42,"tag":228,"props":1400,"children":1401},{},[1402],{"type":47,"value":326},{"type":42,"tag":228,"props":1404,"children":1405},{"class":230,"line":844},[1406],{"type":42,"tag":228,"props":1407,"children":1408},{},[1409],{"type":47,"value":335},{"type":42,"tag":1411,"props":1412,"children":1413},"blockquote",{},[1414],{"type":42,"tag":50,"props":1415,"children":1416},{},[1417,1422,1424,1429],{"type":42,"tag":169,"props":1418,"children":1419},{},[1420],{"type":47,"value":1421},"See Also:",{"type":47,"value":1423}," For detailed harness writing techniques, patterns for handling complex inputs,\nstructure-aware fuzzing, and protobuf-based fuzzing, see the ",{"type":42,"tag":169,"props":1425,"children":1426},{},[1427],{"type":47,"value":1428},"fuzz-harness-writing",{"type":47,"value":1430}," technique skill.",{"type":42,"tag":56,"props":1432,"children":1434},{"id":1433},"compilation",[1435],{"type":47,"value":1436},"Compilation",{"type":42,"tag":427,"props":1438,"children":1440},{"id":1439},"basic-compilation",[1441],{"type":47,"value":1442},"Basic Compilation",{"type":42,"tag":50,"props":1444,"children":1445},{},[1446,1448,1454],{"type":47,"value":1447},"The key flag is ",{"type":42,"tag":224,"props":1449,"children":1451},{"className":1450},[],[1452],{"type":47,"value":1453},"-fsanitize=fuzzer",{"type":47,"value":1455},", which:",{"type":42,"tag":175,"props":1457,"children":1458},{},[1459,1472,1477],{"type":42,"tag":179,"props":1460,"children":1461},{},[1462,1464,1470],{"type":47,"value":1463},"Links the libFuzzer runtime (provides ",{"type":42,"tag":224,"props":1465,"children":1467},{"className":1466},[],[1468],{"type":47,"value":1469},"main",{"type":47,"value":1471}," function)",{"type":42,"tag":179,"props":1473,"children":1474},{},[1475],{"type":47,"value":1476},"Enables SanitizerCoverage instrumentation for coverage tracking",{"type":42,"tag":179,"props":1478,"children":1479},{},[1480,1482],{"type":47,"value":1481},"Disables built-in functions like ",{"type":42,"tag":224,"props":1483,"children":1485},{"className":1484},[],[1486],{"type":47,"value":1487},"memcmp",{"type":42,"tag":216,"props":1489,"children":1491},{"className":343,"code":1490,"language":345,"meta":221,"style":221},"clang++ -fsanitize=fuzzer -g -O2 harness.cc target.cc -o fuzz\n",[1492],{"type":42,"tag":224,"props":1493,"children":1494},{"__ignoreMap":221},[1495],{"type":42,"tag":228,"props":1496,"children":1497},{"class":230,"line":231},[1498,1502,1507,1511,1515,1519,1523,1527],{"type":42,"tag":228,"props":1499,"children":1500},{"style":355},[1501],{"type":47,"value":358},{"type":42,"tag":228,"props":1503,"children":1504},{"style":361},[1505],{"type":47,"value":1506}," -fsanitize=fuzzer",{"type":42,"tag":228,"props":1508,"children":1509},{"style":361},[1510],{"type":47,"value":369},{"type":42,"tag":228,"props":1512,"children":1513},{"style":361},[1514],{"type":47,"value":374},{"type":42,"tag":228,"props":1516,"children":1517},{"style":361},[1518],{"type":47,"value":379},{"type":42,"tag":228,"props":1520,"children":1521},{"style":361},[1522],{"type":47,"value":384},{"type":42,"tag":228,"props":1524,"children":1525},{"style":361},[1526],{"type":47,"value":389},{"type":42,"tag":228,"props":1528,"children":1529},{"style":361},[1530],{"type":47,"value":394},{"type":42,"tag":50,"props":1532,"children":1533},{},[1534],{"type":42,"tag":169,"props":1535,"children":1536},{},[1537],{"type":47,"value":1538},"Flags explained:",{"type":42,"tag":175,"props":1540,"children":1541},{},[1542,1552,1563,1574],{"type":42,"tag":179,"props":1543,"children":1544},{},[1545,1550],{"type":42,"tag":224,"props":1546,"children":1548},{"className":1547},[],[1549],{"type":47,"value":1453},{"type":47,"value":1551},": Enable libFuzzer",{"type":42,"tag":179,"props":1553,"children":1554},{},[1555,1561],{"type":42,"tag":224,"props":1556,"children":1558},{"className":1557},[],[1559],{"type":47,"value":1560},"-g",{"type":47,"value":1562},": Add debug symbols (helpful for crash analysis)",{"type":42,"tag":179,"props":1564,"children":1565},{},[1566,1572],{"type":42,"tag":224,"props":1567,"children":1569},{"className":1568},[],[1570],{"type":47,"value":1571},"-O2",{"type":47,"value":1573},": Production-level optimizations (recommended for fuzzing)",{"type":42,"tag":179,"props":1575,"children":1576},{},[1577,1583,1585,1590],{"type":42,"tag":224,"props":1578,"children":1580},{"className":1579},[],[1581],{"type":47,"value":1582},"-DNO_MAIN",{"type":47,"value":1584},": Define macro if your code has a ",{"type":42,"tag":224,"props":1586,"children":1588},{"className":1587},[],[1589],{"type":47,"value":1469},{"type":47,"value":1591}," function",{"type":42,"tag":427,"props":1593,"children":1595},{"id":1594},"with-sanitizers",[1596],{"type":47,"value":1597},"With Sanitizers",{"type":42,"tag":50,"props":1599,"children":1600},{},[1601],{"type":42,"tag":169,"props":1602,"children":1603},{},[1604],{"type":47,"value":1605},"AddressSanitizer (recommended):",{"type":42,"tag":216,"props":1607,"children":1609},{"className":343,"code":1608,"language":345,"meta":221,"style":221},"clang++ -fsanitize=fuzzer,address -g -O2 -U_FORTIFY_SOURCE harness.cc target.cc -o fuzz\n",[1610],{"type":42,"tag":224,"props":1611,"children":1612},{"__ignoreMap":221},[1613],{"type":42,"tag":228,"props":1614,"children":1615},{"class":230,"line":231},[1616,1620,1624,1628,1632,1637,1641,1645,1649],{"type":42,"tag":228,"props":1617,"children":1618},{"style":355},[1619],{"type":47,"value":358},{"type":42,"tag":228,"props":1621,"children":1622},{"style":361},[1623],{"type":47,"value":364},{"type":42,"tag":228,"props":1625,"children":1626},{"style":361},[1627],{"type":47,"value":369},{"type":42,"tag":228,"props":1629,"children":1630},{"style":361},[1631],{"type":47,"value":374},{"type":42,"tag":228,"props":1633,"children":1634},{"style":361},[1635],{"type":47,"value":1636}," -U_FORTIFY_SOURCE",{"type":42,"tag":228,"props":1638,"children":1639},{"style":361},[1640],{"type":47,"value":379},{"type":42,"tag":228,"props":1642,"children":1643},{"style":361},[1644],{"type":47,"value":384},{"type":42,"tag":228,"props":1646,"children":1647},{"style":361},[1648],{"type":47,"value":389},{"type":42,"tag":228,"props":1650,"children":1651},{"style":361},[1652],{"type":47,"value":394},{"type":42,"tag":50,"props":1654,"children":1655},{},[1656],{"type":42,"tag":169,"props":1657,"children":1658},{},[1659],{"type":47,"value":1660},"Multiple sanitizers:",{"type":42,"tag":216,"props":1662,"children":1664},{"className":343,"code":1663,"language":345,"meta":221,"style":221},"clang++ -fsanitize=fuzzer,address,undefined -g -O2 harness.cc target.cc -o fuzz\n",[1665],{"type":42,"tag":224,"props":1666,"children":1667},{"__ignoreMap":221},[1668],{"type":42,"tag":228,"props":1669,"children":1670},{"class":230,"line":231},[1671,1675,1680,1684,1688,1692,1696,1700],{"type":42,"tag":228,"props":1672,"children":1673},{"style":355},[1674],{"type":47,"value":358},{"type":42,"tag":228,"props":1676,"children":1677},{"style":361},[1678],{"type":47,"value":1679}," -fsanitize=fuzzer,address,undefined",{"type":42,"tag":228,"props":1681,"children":1682},{"style":361},[1683],{"type":47,"value":369},{"type":42,"tag":228,"props":1685,"children":1686},{"style":361},[1687],{"type":47,"value":374},{"type":42,"tag":228,"props":1689,"children":1690},{"style":361},[1691],{"type":47,"value":379},{"type":42,"tag":228,"props":1693,"children":1694},{"style":361},[1695],{"type":47,"value":384},{"type":42,"tag":228,"props":1697,"children":1698},{"style":361},[1699],{"type":47,"value":389},{"type":42,"tag":228,"props":1701,"children":1702},{"style":361},[1703],{"type":47,"value":394},{"type":42,"tag":1411,"props":1705,"children":1706},{},[1707],{"type":42,"tag":50,"props":1708,"children":1709},{},[1710,1714,1716,1721,1723,1728],{"type":42,"tag":169,"props":1711,"children":1712},{},[1713],{"type":47,"value":1421},{"type":47,"value":1715}," For detailed sanitizer configuration, common issues, ASAN_OPTIONS flags,\nand advanced sanitizer usage, see the ",{"type":42,"tag":169,"props":1717,"children":1718},{},[1719],{"type":47,"value":1720},"address-sanitizer",{"type":47,"value":1722}," and ",{"type":42,"tag":169,"props":1724,"children":1725},{},[1726],{"type":47,"value":1727},"undefined-behavior-sanitizer",{"type":47,"value":1729},"\ntechnique skills.",{"type":42,"tag":427,"props":1731,"children":1733},{"id":1732},"build-flags",[1734],{"type":47,"value":1735},"Build Flags",{"type":42,"tag":63,"props":1737,"children":1738},{},[1739,1755],{"type":42,"tag":67,"props":1740,"children":1741},{},[1742],{"type":42,"tag":71,"props":1743,"children":1744},{},[1745,1750],{"type":42,"tag":75,"props":1746,"children":1747},{},[1748],{"type":47,"value":1749},"Flag",{"type":42,"tag":75,"props":1751,"children":1752},{},[1753],{"type":47,"value":1754},"Purpose",{"type":42,"tag":91,"props":1756,"children":1757},{},[1758,1774,1791,1808,1825,1841,1857],{"type":42,"tag":71,"props":1759,"children":1760},{},[1761,1769],{"type":42,"tag":98,"props":1762,"children":1763},{},[1764],{"type":42,"tag":224,"props":1765,"children":1767},{"className":1766},[],[1768],{"type":47,"value":1453},{"type":42,"tag":98,"props":1770,"children":1771},{},[1772],{"type":47,"value":1773},"Enable libFuzzer runtime and instrumentation",{"type":42,"tag":71,"props":1775,"children":1776},{},[1777,1786],{"type":42,"tag":98,"props":1778,"children":1779},{},[1780],{"type":42,"tag":224,"props":1781,"children":1783},{"className":1782},[],[1784],{"type":47,"value":1785},"-fsanitize=address",{"type":42,"tag":98,"props":1787,"children":1788},{},[1789],{"type":47,"value":1790},"Enable AddressSanitizer (memory error detection)",{"type":42,"tag":71,"props":1792,"children":1793},{},[1794,1803],{"type":42,"tag":98,"props":1795,"children":1796},{},[1797],{"type":42,"tag":224,"props":1798,"children":1800},{"className":1799},[],[1801],{"type":47,"value":1802},"-fsanitize=undefined",{"type":42,"tag":98,"props":1804,"children":1805},{},[1806],{"type":47,"value":1807},"Enable UndefinedBehaviorSanitizer",{"type":42,"tag":71,"props":1809,"children":1810},{},[1811,1820],{"type":42,"tag":98,"props":1812,"children":1813},{},[1814],{"type":42,"tag":224,"props":1815,"children":1817},{"className":1816},[],[1818],{"type":47,"value":1819},"-fsanitize=fuzzer-no-link",{"type":42,"tag":98,"props":1821,"children":1822},{},[1823],{"type":47,"value":1824},"Instrument without linking fuzzer (for libraries)",{"type":42,"tag":71,"props":1826,"children":1827},{},[1828,1836],{"type":42,"tag":98,"props":1829,"children":1830},{},[1831],{"type":42,"tag":224,"props":1832,"children":1834},{"className":1833},[],[1835],{"type":47,"value":1560},{"type":42,"tag":98,"props":1837,"children":1838},{},[1839],{"type":47,"value":1840},"Include debug symbols",{"type":42,"tag":71,"props":1842,"children":1843},{},[1844,1852],{"type":42,"tag":98,"props":1845,"children":1846},{},[1847],{"type":42,"tag":224,"props":1848,"children":1850},{"className":1849},[],[1851],{"type":47,"value":1571},{"type":42,"tag":98,"props":1853,"children":1854},{},[1855],{"type":47,"value":1856},"Production optimization level",{"type":42,"tag":71,"props":1858,"children":1859},{},[1860,1869],{"type":42,"tag":98,"props":1861,"children":1862},{},[1863],{"type":42,"tag":224,"props":1864,"children":1866},{"className":1865},[],[1867],{"type":47,"value":1868},"-U_FORTIFY_SOURCE",{"type":42,"tag":98,"props":1870,"children":1871},{},[1872],{"type":47,"value":1873},"Disable fortification (can interfere with ASan)",{"type":42,"tag":427,"props":1875,"children":1877},{"id":1876},"building-static-libraries",[1878],{"type":47,"value":1879},"Building Static Libraries",{"type":42,"tag":50,"props":1881,"children":1882},{},[1883],{"type":47,"value":1884},"For projects that produce static libraries:",{"type":42,"tag":1886,"props":1887,"children":1888},"ol",{},[1889],{"type":42,"tag":179,"props":1890,"children":1891},{},[1892],{"type":47,"value":1893},"Build the library with fuzzing instrumentation:",{"type":42,"tag":216,"props":1895,"children":1897},{"className":343,"code":1896,"language":345,"meta":221,"style":221},"export CC=clang CFLAGS=\"-fsanitize=fuzzer-no-link -fsanitize=address\"\nexport CXX=clang++ CXXFLAGS=\"$CFLAGS\"\n.\u002Fconfigure --enable-shared=no\nmake\n",[1898],{"type":42,"tag":224,"props":1899,"children":1900},{"__ignoreMap":221},[1901,1946,1984,1997],{"type":42,"tag":228,"props":1902,"children":1903},{"class":230,"line":231},[1904,1910,1916,1922,1927,1931,1936,1941],{"type":42,"tag":228,"props":1905,"children":1907},{"style":1906},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[1908],{"type":47,"value":1909},"export",{"type":42,"tag":228,"props":1911,"children":1913},{"style":1912},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1914],{"type":47,"value":1915}," CC",{"type":42,"tag":228,"props":1917,"children":1919},{"style":1918},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1920],{"type":47,"value":1921},"=",{"type":42,"tag":228,"props":1923,"children":1924},{"style":1912},[1925],{"type":47,"value":1926},"clang CFLAGS",{"type":42,"tag":228,"props":1928,"children":1929},{"style":1918},[1930],{"type":47,"value":1921},{"type":42,"tag":228,"props":1932,"children":1933},{"style":1918},[1934],{"type":47,"value":1935},"\"",{"type":42,"tag":228,"props":1937,"children":1938},{"style":361},[1939],{"type":47,"value":1940},"-fsanitize=fuzzer-no-link -fsanitize=address",{"type":42,"tag":228,"props":1942,"children":1943},{"style":1918},[1944],{"type":47,"value":1945},"\"\n",{"type":42,"tag":228,"props":1947,"children":1948},{"class":230,"line":240},[1949,1953,1958,1962,1967,1971,1975,1980],{"type":42,"tag":228,"props":1950,"children":1951},{"style":1906},[1952],{"type":47,"value":1909},{"type":42,"tag":228,"props":1954,"children":1955},{"style":1912},[1956],{"type":47,"value":1957}," CXX",{"type":42,"tag":228,"props":1959,"children":1960},{"style":1918},[1961],{"type":47,"value":1921},{"type":42,"tag":228,"props":1963,"children":1964},{"style":1912},[1965],{"type":47,"value":1966},"clang++ CXXFLAGS",{"type":42,"tag":228,"props":1968,"children":1969},{"style":1918},[1970],{"type":47,"value":1921},{"type":42,"tag":228,"props":1972,"children":1973},{"style":1918},[1974],{"type":47,"value":1935},{"type":42,"tag":228,"props":1976,"children":1977},{"style":1912},[1978],{"type":47,"value":1979},"$CFLAGS",{"type":42,"tag":228,"props":1981,"children":1982},{"style":1918},[1983],{"type":47,"value":1945},{"type":42,"tag":228,"props":1985,"children":1986},{"class":230,"line":249},[1987,1992],{"type":42,"tag":228,"props":1988,"children":1989},{"style":355},[1990],{"type":47,"value":1991},".\u002Fconfigure",{"type":42,"tag":228,"props":1993,"children":1994},{"style":361},[1995],{"type":47,"value":1996}," --enable-shared=no\n",{"type":42,"tag":228,"props":1998,"children":1999},{"class":230,"line":259},[2000],{"type":42,"tag":228,"props":2001,"children":2002},{"style":355},[2003],{"type":47,"value":2004},"make\n",{"type":42,"tag":1886,"props":2006,"children":2007},{"start":240},[2008],{"type":42,"tag":179,"props":2009,"children":2010},{},[2011],{"type":47,"value":2012},"Link the static library with your harness:",{"type":42,"tag":216,"props":2014,"children":2016},{"className":343,"code":2015,"language":345,"meta":221,"style":221},"clang++ -fsanitize=fuzzer -fsanitize=address harness.cc libmylib.a -o fuzz\n",[2017],{"type":42,"tag":224,"props":2018,"children":2019},{"__ignoreMap":221},[2020],{"type":42,"tag":228,"props":2021,"children":2022},{"class":230,"line":231},[2023,2027,2031,2036,2040,2045,2049],{"type":42,"tag":228,"props":2024,"children":2025},{"style":355},[2026],{"type":47,"value":358},{"type":42,"tag":228,"props":2028,"children":2029},{"style":361},[2030],{"type":47,"value":1506},{"type":42,"tag":228,"props":2032,"children":2033},{"style":361},[2034],{"type":47,"value":2035}," -fsanitize=address",{"type":42,"tag":228,"props":2037,"children":2038},{"style":361},[2039],{"type":47,"value":379},{"type":42,"tag":228,"props":2041,"children":2042},{"style":361},[2043],{"type":47,"value":2044}," libmylib.a",{"type":42,"tag":228,"props":2046,"children":2047},{"style":361},[2048],{"type":47,"value":389},{"type":42,"tag":228,"props":2050,"children":2051},{"style":361},[2052],{"type":47,"value":394},{"type":42,"tag":427,"props":2054,"children":2056},{"id":2055},"cmake-integration",[2057],{"type":47,"value":2058},"CMake Integration",{"type":42,"tag":216,"props":2060,"children":2064},{"className":2061,"code":2062,"language":2063,"meta":221,"style":221},"language-cmake shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","project(FuzzTarget)\ncmake_minimum_required(VERSION 3.0)\n\nadd_executable(fuzz main.cc harness.cc)\ntarget_compile_definitions(fuzz PRIVATE NO_MAIN=1)\ntarget_compile_options(fuzz PRIVATE -g -O2 -fsanitize=fuzzer -fsanitize=address)\ntarget_link_libraries(fuzz -fsanitize=fuzzer -fsanitize=address)\n","cmake",[2065],{"type":42,"tag":224,"props":2066,"children":2067},{"__ignoreMap":221},[2068,2076,2084,2091,2099,2107,2115],{"type":42,"tag":228,"props":2069,"children":2070},{"class":230,"line":231},[2071],{"type":42,"tag":228,"props":2072,"children":2073},{},[2074],{"type":47,"value":2075},"project(FuzzTarget)\n",{"type":42,"tag":228,"props":2077,"children":2078},{"class":230,"line":240},[2079],{"type":42,"tag":228,"props":2080,"children":2081},{},[2082],{"type":47,"value":2083},"cmake_minimum_required(VERSION 3.0)\n",{"type":42,"tag":228,"props":2085,"children":2086},{"class":230,"line":249},[2087],{"type":42,"tag":228,"props":2088,"children":2089},{"emptyLinePlaceholder":253},[2090],{"type":47,"value":256},{"type":42,"tag":228,"props":2092,"children":2093},{"class":230,"line":259},[2094],{"type":42,"tag":228,"props":2095,"children":2096},{},[2097],{"type":47,"value":2098},"add_executable(fuzz main.cc harness.cc)\n",{"type":42,"tag":228,"props":2100,"children":2101},{"class":230,"line":268},[2102],{"type":42,"tag":228,"props":2103,"children":2104},{},[2105],{"type":47,"value":2106},"target_compile_definitions(fuzz PRIVATE NO_MAIN=1)\n",{"type":42,"tag":228,"props":2108,"children":2109},{"class":230,"line":277},[2110],{"type":42,"tag":228,"props":2111,"children":2112},{},[2113],{"type":47,"value":2114},"target_compile_options(fuzz PRIVATE -g -O2 -fsanitize=fuzzer -fsanitize=address)\n",{"type":42,"tag":228,"props":2116,"children":2117},{"class":230,"line":286},[2118],{"type":42,"tag":228,"props":2119,"children":2120},{},[2121],{"type":47,"value":2122},"target_link_libraries(fuzz -fsanitize=fuzzer -fsanitize=address)\n",{"type":42,"tag":50,"props":2124,"children":2125},{},[2126],{"type":47,"value":2127},"Build with:",{"type":42,"tag":216,"props":2129,"children":2131},{"className":343,"code":2130,"language":345,"meta":221,"style":221},"cmake -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ .\ncmake --build .\n",[2132],{"type":42,"tag":224,"props":2133,"children":2134},{"__ignoreMap":221},[2135,2157],{"type":42,"tag":228,"props":2136,"children":2137},{"class":230,"line":231},[2138,2142,2147,2152],{"type":42,"tag":228,"props":2139,"children":2140},{"style":355},[2141],{"type":47,"value":2063},{"type":42,"tag":228,"props":2143,"children":2144},{"style":361},[2145],{"type":47,"value":2146}," -DCMAKE_C_COMPILER=clang",{"type":42,"tag":228,"props":2148,"children":2149},{"style":361},[2150],{"type":47,"value":2151}," -DCMAKE_CXX_COMPILER=clang++",{"type":42,"tag":228,"props":2153,"children":2154},{"style":361},[2155],{"type":47,"value":2156}," .\n",{"type":42,"tag":228,"props":2158,"children":2159},{"class":230,"line":240},[2160,2164,2169],{"type":42,"tag":228,"props":2161,"children":2162},{"style":355},[2163],{"type":47,"value":2063},{"type":42,"tag":228,"props":2165,"children":2166},{"style":361},[2167],{"type":47,"value":2168}," --build",{"type":42,"tag":228,"props":2170,"children":2171},{"style":361},[2172],{"type":47,"value":2156},{"type":42,"tag":56,"props":2174,"children":2176},{"id":2175},"corpus-management",[2177],{"type":47,"value":2178},"Corpus Management",{"type":42,"tag":427,"props":2180,"children":2182},{"id":2181},"creating-initial-corpus",[2183],{"type":47,"value":2184},"Creating Initial Corpus",{"type":42,"tag":50,"props":2186,"children":2187},{},[2188],{"type":47,"value":2189},"Create a directory for the corpus (can start empty):",{"type":42,"tag":216,"props":2191,"children":2193},{"className":343,"code":2192,"language":345,"meta":221,"style":221},"mkdir corpus\u002F\n",[2194],{"type":42,"tag":224,"props":2195,"children":2196},{"__ignoreMap":221},[2197],{"type":42,"tag":228,"props":2198,"children":2199},{"class":230,"line":231},[2200,2204],{"type":42,"tag":228,"props":2201,"children":2202},{"style":355},[2203],{"type":47,"value":402},{"type":42,"tag":228,"props":2205,"children":2206},{"style":361},[2207],{"type":47,"value":407},{"type":42,"tag":50,"props":2209,"children":2210},{},[2211,2216],{"type":42,"tag":169,"props":2212,"children":2213},{},[2214],{"type":47,"value":2215},"Optional but recommended:",{"type":47,"value":2217}," Provide seed inputs (valid example files):",{"type":42,"tag":216,"props":2219,"children":2221},{"className":343,"code":2220,"language":345,"meta":221,"style":221},"# For a PNG parser:\ncp examples\u002F*.png corpus\u002F\n\n# For a protocol parser:\ncp test_packets\u002F*.bin corpus\u002F\n",[2222],{"type":42,"tag":224,"props":2223,"children":2224},{"__ignoreMap":221},[2225,2233,2260,2267,2275],{"type":42,"tag":228,"props":2226,"children":2227},{"class":230,"line":231},[2228],{"type":42,"tag":228,"props":2229,"children":2230},{"style":499},[2231],{"type":47,"value":2232},"# For a PNG parser:\n",{"type":42,"tag":228,"props":2234,"children":2235},{"class":230,"line":240},[2236,2241,2246,2251,2256],{"type":42,"tag":228,"props":2237,"children":2238},{"style":355},[2239],{"type":47,"value":2240},"cp",{"type":42,"tag":228,"props":2242,"children":2243},{"style":361},[2244],{"type":47,"value":2245}," examples\u002F",{"type":42,"tag":228,"props":2247,"children":2248},{"style":1912},[2249],{"type":47,"value":2250},"*",{"type":42,"tag":228,"props":2252,"children":2253},{"style":361},[2254],{"type":47,"value":2255},".png",{"type":42,"tag":228,"props":2257,"children":2258},{"style":361},[2259],{"type":47,"value":407},{"type":42,"tag":228,"props":2261,"children":2262},{"class":230,"line":249},[2263],{"type":42,"tag":228,"props":2264,"children":2265},{"emptyLinePlaceholder":253},[2266],{"type":47,"value":256},{"type":42,"tag":228,"props":2268,"children":2269},{"class":230,"line":259},[2270],{"type":42,"tag":228,"props":2271,"children":2272},{"style":499},[2273],{"type":47,"value":2274},"# For a protocol parser:\n",{"type":42,"tag":228,"props":2276,"children":2277},{"class":230,"line":268},[2278,2282,2287,2291,2296],{"type":42,"tag":228,"props":2279,"children":2280},{"style":355},[2281],{"type":47,"value":2240},{"type":42,"tag":228,"props":2283,"children":2284},{"style":361},[2285],{"type":47,"value":2286}," test_packets\u002F",{"type":42,"tag":228,"props":2288,"children":2289},{"style":1912},[2290],{"type":47,"value":2250},{"type":42,"tag":228,"props":2292,"children":2293},{"style":361},[2294],{"type":47,"value":2295},".bin",{"type":42,"tag":228,"props":2297,"children":2298},{"style":361},[2299],{"type":47,"value":407},{"type":42,"tag":50,"props":2301,"children":2302},{},[2303],{"type":42,"tag":169,"props":2304,"children":2305},{},[2306],{"type":47,"value":2307},"Benefits of seed inputs:",{"type":42,"tag":175,"props":2309,"children":2310},{},[2311,2316,2321],{"type":42,"tag":179,"props":2312,"children":2313},{},[2314],{"type":47,"value":2315},"Fuzzer doesn't start from scratch",{"type":42,"tag":179,"props":2317,"children":2318},{},[2319],{"type":47,"value":2320},"Reaches valid code paths faster",{"type":42,"tag":179,"props":2322,"children":2323},{},[2324],{"type":47,"value":2325},"Significantly improves effectiveness",{"type":42,"tag":427,"props":2327,"children":2329},{"id":2328},"corpus-structure",[2330],{"type":47,"value":2331},"Corpus Structure",{"type":42,"tag":50,"props":2333,"children":2334},{},[2335],{"type":47,"value":2336},"The corpus directory contains:",{"type":42,"tag":175,"props":2338,"children":2339},{},[2340,2345,2350],{"type":42,"tag":179,"props":2341,"children":2342},{},[2343],{"type":47,"value":2344},"Input files that trigger unique code paths",{"type":42,"tag":179,"props":2346,"children":2347},{},[2348],{"type":47,"value":2349},"Minimized versions (libFuzzer automatically minimizes)",{"type":42,"tag":179,"props":2351,"children":2352},{},[2353,2355,2361],{"type":47,"value":2354},"Named by content hash (e.g., ",{"type":42,"tag":224,"props":2356,"children":2358},{"className":2357},[],[2359],{"type":47,"value":2360},"a9993e364706816aba3e25717850c26c9cd0d89d",{"type":47,"value":2362},")",{"type":42,"tag":427,"props":2364,"children":2366},{"id":2365},"corpus-minimization",[2367],{"type":47,"value":2368},"Corpus Minimization",{"type":42,"tag":50,"props":2370,"children":2371},{},[2372],{"type":47,"value":2373},"libFuzzer automatically minimizes corpus entries during fuzzing. To explicitly minimize:",{"type":42,"tag":216,"props":2375,"children":2377},{"className":343,"code":2376,"language":345,"meta":221,"style":221},"mkdir minimized_corpus\u002F\n.\u002Ffuzz -merge=1 minimized_corpus\u002F corpus\u002F\n",[2378],{"type":42,"tag":224,"props":2379,"children":2380},{"__ignoreMap":221},[2381,2393],{"type":42,"tag":228,"props":2382,"children":2383},{"class":230,"line":231},[2384,2388],{"type":42,"tag":228,"props":2385,"children":2386},{"style":355},[2387],{"type":47,"value":402},{"type":42,"tag":228,"props":2389,"children":2390},{"style":361},[2391],{"type":47,"value":2392}," minimized_corpus\u002F\n",{"type":42,"tag":228,"props":2394,"children":2395},{"class":230,"line":240},[2396,2400,2405,2410],{"type":42,"tag":228,"props":2397,"children":2398},{"style":355},[2399],{"type":47,"value":415},{"type":42,"tag":228,"props":2401,"children":2402},{"style":361},[2403],{"type":47,"value":2404}," -merge=1",{"type":42,"tag":228,"props":2406,"children":2407},{"style":361},[2408],{"type":47,"value":2409}," minimized_corpus\u002F",{"type":42,"tag":228,"props":2411,"children":2412},{"style":361},[2413],{"type":47,"value":407},{"type":42,"tag":50,"props":2415,"children":2416},{},[2417,2419,2425],{"type":47,"value":2418},"This creates a deduplicated, minimized corpus in ",{"type":42,"tag":224,"props":2420,"children":2422},{"className":2421},[],[2423],{"type":47,"value":2424},"minimized_corpus\u002F",{"type":47,"value":1247},{"type":42,"tag":1411,"props":2427,"children":2428},{},[2429],{"type":42,"tag":50,"props":2430,"children":2431},{},[2432,2436,2438,2443],{"type":42,"tag":169,"props":2433,"children":2434},{},[2435],{"type":47,"value":1421},{"type":47,"value":2437}," For corpus creation strategies, seed selection, format-specific corpus building,\nand corpus maintenance, see the ",{"type":42,"tag":169,"props":2439,"children":2440},{},[2441],{"type":47,"value":2442},"fuzzing-corpus",{"type":47,"value":1430},{"type":42,"tag":56,"props":2445,"children":2447},{"id":2446},"running-campaigns",[2448],{"type":47,"value":2449},"Running Campaigns",{"type":42,"tag":427,"props":2451,"children":2453},{"id":2452},"basic-run",[2454],{"type":47,"value":2455},"Basic Run",{"type":42,"tag":216,"props":2457,"children":2459},{"className":343,"code":2458,"language":345,"meta":221,"style":221},".\u002Ffuzz corpus\u002F\n",[2460],{"type":42,"tag":224,"props":2461,"children":2462},{"__ignoreMap":221},[2463],{"type":42,"tag":228,"props":2464,"children":2465},{"class":230,"line":231},[2466,2470],{"type":42,"tag":228,"props":2467,"children":2468},{"style":355},[2469],{"type":47,"value":415},{"type":42,"tag":228,"props":2471,"children":2472},{"style":361},[2473],{"type":47,"value":407},{"type":42,"tag":50,"props":2475,"children":2476},{},[2477],{"type":47,"value":2478},"This runs until a crash is found or you stop it (Ctrl+C).",{"type":42,"tag":427,"props":2480,"children":2482},{"id":2481},"recommended-continue-after-crashes",[2483],{"type":47,"value":2484},"Recommended: Continue After Crashes",{"type":42,"tag":216,"props":2486,"children":2488},{"className":343,"code":2487,"language":345,"meta":221,"style":221},".\u002Ffuzz -fork=1 -ignore_crashes=1 corpus\u002F\n",[2489],{"type":42,"tag":224,"props":2490,"children":2491},{"__ignoreMap":221},[2492],{"type":42,"tag":228,"props":2493,"children":2494},{"class":230,"line":231},[2495,2499,2504,2509],{"type":42,"tag":228,"props":2496,"children":2497},{"style":355},[2498],{"type":47,"value":415},{"type":42,"tag":228,"props":2500,"children":2501},{"style":361},[2502],{"type":47,"value":2503}," -fork=1",{"type":42,"tag":228,"props":2505,"children":2506},{"style":361},[2507],{"type":47,"value":2508}," -ignore_crashes=1",{"type":42,"tag":228,"props":2510,"children":2511},{"style":361},[2512],{"type":47,"value":407},{"type":42,"tag":50,"props":2514,"children":2515},{},[2516,2518,2524,2525,2531],{"type":47,"value":2517},"The ",{"type":42,"tag":224,"props":2519,"children":2521},{"className":2520},[],[2522],{"type":47,"value":2523},"-fork",{"type":47,"value":1722},{"type":42,"tag":224,"props":2526,"children":2528},{"className":2527},[],[2529],{"type":47,"value":2530},"-ignore_crashes",{"type":47,"value":2532}," flags (experimental but widely used) allow fuzzing to continue after finding crashes.",{"type":42,"tag":427,"props":2534,"children":2536},{"id":2535},"common-options",[2537],{"type":47,"value":2538},"Common Options",{"type":42,"tag":50,"props":2540,"children":2541},{},[2542],{"type":42,"tag":169,"props":2543,"children":2544},{},[2545],{"type":47,"value":2546},"Control input size:",{"type":42,"tag":216,"props":2548,"children":2550},{"className":343,"code":2549,"language":345,"meta":221,"style":221},".\u002Ffuzz -max_len=4000 corpus\u002F\n",[2551],{"type":42,"tag":224,"props":2552,"children":2553},{"__ignoreMap":221},[2554],{"type":42,"tag":228,"props":2555,"children":2556},{"class":230,"line":231},[2557,2561,2566],{"type":42,"tag":228,"props":2558,"children":2559},{"style":355},[2560],{"type":47,"value":415},{"type":42,"tag":228,"props":2562,"children":2563},{"style":361},[2564],{"type":47,"value":2565}," -max_len=4000",{"type":42,"tag":228,"props":2567,"children":2568},{"style":361},[2569],{"type":47,"value":407},{"type":42,"tag":50,"props":2571,"children":2572},{},[2573],{"type":47,"value":2574},"Rule of thumb: 2x the size of minimal realistic input.",{"type":42,"tag":50,"props":2576,"children":2577},{},[2578],{"type":42,"tag":169,"props":2579,"children":2580},{},[2581],{"type":47,"value":2582},"Set timeout:",{"type":42,"tag":216,"props":2584,"children":2586},{"className":343,"code":2585,"language":345,"meta":221,"style":221},".\u002Ffuzz -timeout=2 corpus\u002F\n",[2587],{"type":42,"tag":224,"props":2588,"children":2589},{"__ignoreMap":221},[2590],{"type":42,"tag":228,"props":2591,"children":2592},{"class":230,"line":231},[2593,2597,2602],{"type":42,"tag":228,"props":2594,"children":2595},{"style":355},[2596],{"type":47,"value":415},{"type":42,"tag":228,"props":2598,"children":2599},{"style":361},[2600],{"type":47,"value":2601}," -timeout=2",{"type":42,"tag":228,"props":2603,"children":2604},{"style":361},[2605],{"type":47,"value":407},{"type":42,"tag":50,"props":2607,"children":2608},{},[2609],{"type":47,"value":2610},"Abort test cases that run longer than 2 seconds.",{"type":42,"tag":50,"props":2612,"children":2613},{},[2614],{"type":42,"tag":169,"props":2615,"children":2616},{},[2617],{"type":47,"value":2618},"Use a dictionary:",{"type":42,"tag":216,"props":2620,"children":2622},{"className":343,"code":2621,"language":345,"meta":221,"style":221},".\u002Ffuzz -dict=.\u002Fformat.dict corpus\u002F\n",[2623],{"type":42,"tag":224,"props":2624,"children":2625},{"__ignoreMap":221},[2626],{"type":42,"tag":228,"props":2627,"children":2628},{"class":230,"line":231},[2629,2633,2638],{"type":42,"tag":228,"props":2630,"children":2631},{"style":355},[2632],{"type":47,"value":415},{"type":42,"tag":228,"props":2634,"children":2635},{"style":361},[2636],{"type":47,"value":2637}," -dict=.\u002Fformat.dict",{"type":42,"tag":228,"props":2639,"children":2640},{"style":361},[2641],{"type":47,"value":407},{"type":42,"tag":50,"props":2643,"children":2644},{},[2645],{"type":42,"tag":169,"props":2646,"children":2647},{},[2648],{"type":47,"value":2649},"Close stdout\u002Fstderr (speed up fuzzing):",{"type":42,"tag":216,"props":2651,"children":2653},{"className":343,"code":2652,"language":345,"meta":221,"style":221},".\u002Ffuzz -close_fd_mask=3 corpus\u002F\n",[2654],{"type":42,"tag":224,"props":2655,"children":2656},{"__ignoreMap":221},[2657],{"type":42,"tag":228,"props":2658,"children":2659},{"class":230,"line":231},[2660,2664,2669],{"type":42,"tag":228,"props":2661,"children":2662},{"style":355},[2663],{"type":47,"value":415},{"type":42,"tag":228,"props":2665,"children":2666},{"style":361},[2667],{"type":47,"value":2668}," -close_fd_mask=3",{"type":42,"tag":228,"props":2670,"children":2671},{"style":361},[2672],{"type":47,"value":407},{"type":42,"tag":50,"props":2674,"children":2675},{},[2676],{"type":42,"tag":169,"props":2677,"children":2678},{},[2679],{"type":47,"value":2680},"See all options:",{"type":42,"tag":216,"props":2682,"children":2684},{"className":343,"code":2683,"language":345,"meta":221,"style":221},".\u002Ffuzz -help=1\n",[2685],{"type":42,"tag":224,"props":2686,"children":2687},{"__ignoreMap":221},[2688],{"type":42,"tag":228,"props":2689,"children":2690},{"class":230,"line":231},[2691,2695],{"type":42,"tag":228,"props":2692,"children":2693},{"style":355},[2694],{"type":47,"value":415},{"type":42,"tag":228,"props":2696,"children":2697},{"style":361},[2698],{"type":47,"value":2699}," -help=1\n",{"type":42,"tag":427,"props":2701,"children":2703},{"id":2702},"multi-core-fuzzing",[2704],{"type":47,"value":2705},"Multi-Core Fuzzing",{"type":42,"tag":50,"props":2707,"children":2708},{},[2709],{"type":42,"tag":169,"props":2710,"children":2711},{},[2712],{"type":47,"value":2713},"Option 1: Jobs and workers (recommended):",{"type":42,"tag":216,"props":2715,"children":2717},{"className":343,"code":2716,"language":345,"meta":221,"style":221},".\u002Ffuzz -jobs=4 -workers=4 -fork=1 -ignore_crashes=1 corpus\u002F\n",[2718],{"type":42,"tag":224,"props":2719,"children":2720},{"__ignoreMap":221},[2721],{"type":42,"tag":228,"props":2722,"children":2723},{"class":230,"line":231},[2724,2728,2733,2738,2742,2746],{"type":42,"tag":228,"props":2725,"children":2726},{"style":355},[2727],{"type":47,"value":415},{"type":42,"tag":228,"props":2729,"children":2730},{"style":361},[2731],{"type":47,"value":2732}," -jobs=4",{"type":42,"tag":228,"props":2734,"children":2735},{"style":361},[2736],{"type":47,"value":2737}," -workers=4",{"type":42,"tag":228,"props":2739,"children":2740},{"style":361},[2741],{"type":47,"value":2503},{"type":42,"tag":228,"props":2743,"children":2744},{"style":361},[2745],{"type":47,"value":2508},{"type":42,"tag":228,"props":2747,"children":2748},{"style":361},[2749],{"type":47,"value":407},{"type":42,"tag":175,"props":2751,"children":2752},{},[2753,2764,2775],{"type":42,"tag":179,"props":2754,"children":2755},{},[2756,2762],{"type":42,"tag":224,"props":2757,"children":2759},{"className":2758},[],[2760],{"type":47,"value":2761},"-jobs=4",{"type":47,"value":2763},": Run 4 sequential campaigns",{"type":42,"tag":179,"props":2765,"children":2766},{},[2767,2773],{"type":42,"tag":224,"props":2768,"children":2770},{"className":2769},[],[2771],{"type":47,"value":2772},"-workers=4",{"type":47,"value":2774},": Process jobs in parallel with 4 processes",{"type":42,"tag":179,"props":2776,"children":2777},{},[2778],{"type":47,"value":2779},"Test cases are shared between jobs",{"type":42,"tag":50,"props":2781,"children":2782},{},[2783],{"type":42,"tag":169,"props":2784,"children":2785},{},[2786],{"type":47,"value":2787},"Option 2: Fork mode:",{"type":42,"tag":216,"props":2789,"children":2791},{"className":343,"code":2790,"language":345,"meta":221,"style":221},".\u002Ffuzz -fork=4 -ignore_crashes=1 corpus\u002F\n",[2792],{"type":42,"tag":224,"props":2793,"children":2794},{"__ignoreMap":221},[2795],{"type":42,"tag":228,"props":2796,"children":2797},{"class":230,"line":231},[2798,2802,2807,2811],{"type":42,"tag":228,"props":2799,"children":2800},{"style":355},[2801],{"type":47,"value":415},{"type":42,"tag":228,"props":2803,"children":2804},{"style":361},[2805],{"type":47,"value":2806}," -fork=4",{"type":42,"tag":228,"props":2808,"children":2809},{"style":361},[2810],{"type":47,"value":2508},{"type":42,"tag":228,"props":2812,"children":2813},{"style":361},[2814],{"type":47,"value":407},{"type":42,"tag":50,"props":2816,"children":2817},{},[2818,2822],{"type":42,"tag":169,"props":2819,"children":2820},{},[2821],{"type":47,"value":206},{"type":47,"value":2823}," For serious multi-core fuzzing, consider switching to AFL++, Honggfuzz, or LibAFL.",{"type":42,"tag":427,"props":2825,"children":2827},{"id":2826},"re-executing-test-cases",[2828],{"type":47,"value":2829},"Re-executing Test Cases",{"type":42,"tag":50,"props":2831,"children":2832},{},[2833],{"type":42,"tag":169,"props":2834,"children":2835},{},[2836],{"type":47,"value":2837},"Re-run a single crash:",{"type":42,"tag":216,"props":2839,"children":2841},{"className":343,"code":2840,"language":345,"meta":221,"style":221},".\u002Ffuzz .\u002Fcrash-a9993e364706816aba3e25717850c26c9cd0d89d\n",[2842],{"type":42,"tag":224,"props":2843,"children":2844},{"__ignoreMap":221},[2845],{"type":42,"tag":228,"props":2846,"children":2847},{"class":230,"line":231},[2848,2852],{"type":42,"tag":228,"props":2849,"children":2850},{"style":355},[2851],{"type":47,"value":415},{"type":42,"tag":228,"props":2853,"children":2854},{"style":361},[2855],{"type":47,"value":2856}," .\u002Fcrash-a9993e364706816aba3e25717850c26c9cd0d89d\n",{"type":42,"tag":50,"props":2858,"children":2859},{},[2860],{"type":42,"tag":169,"props":2861,"children":2862},{},[2863],{"type":47,"value":2864},"Test all inputs in a directory without fuzzing:",{"type":42,"tag":216,"props":2866,"children":2868},{"className":343,"code":2867,"language":345,"meta":221,"style":221},".\u002Ffuzz -runs=0 corpus\u002F\n",[2869],{"type":42,"tag":224,"props":2870,"children":2871},{"__ignoreMap":221},[2872],{"type":42,"tag":228,"props":2873,"children":2874},{"class":230,"line":231},[2875,2879,2884],{"type":42,"tag":228,"props":2876,"children":2877},{"style":355},[2878],{"type":47,"value":415},{"type":42,"tag":228,"props":2880,"children":2881},{"style":361},[2882],{"type":47,"value":2883}," -runs=0",{"type":42,"tag":228,"props":2885,"children":2886},{"style":361},[2887],{"type":47,"value":407},{"type":42,"tag":427,"props":2889,"children":2891},{"id":2890},"interpreting-output",[2892],{"type":47,"value":2893},"Interpreting Output",{"type":42,"tag":50,"props":2895,"children":2896},{},[2897],{"type":47,"value":2898},"When fuzzing runs, you'll see statistics like:",{"type":42,"tag":216,"props":2900,"children":2904},{"className":2901,"code":2903,"language":47},[2902],"language-text","INFO: Seed: 3517090860\nINFO: Loaded 1 modules (9 inline 8-bit counters)\n#2      INITED cov: 3 ft: 4 corp: 1\u002F1b exec\u002Fs: 0 rss: 26Mb\n#57     NEW    cov: 4 ft: 5 corp: 2\u002F4b lim: 4 exec\u002Fs: 0 rss: 26Mb\n",[2905],{"type":42,"tag":224,"props":2906,"children":2907},{"__ignoreMap":221},[2908],{"type":47,"value":2903},{"type":42,"tag":63,"props":2910,"children":2911},{},[2912,2928],{"type":42,"tag":67,"props":2913,"children":2914},{},[2915],{"type":42,"tag":71,"props":2916,"children":2917},{},[2918,2923],{"type":42,"tag":75,"props":2919,"children":2920},{},[2921],{"type":47,"value":2922},"Output",{"type":42,"tag":75,"props":2924,"children":2925},{},[2926],{"type":47,"value":2927},"Meaning",{"type":42,"tag":91,"props":2929,"children":2930},{},[2931,2948,2965,2982,2999,3016,3033],{"type":42,"tag":71,"props":2932,"children":2933},{},[2934,2943],{"type":42,"tag":98,"props":2935,"children":2936},{},[2937],{"type":42,"tag":224,"props":2938,"children":2940},{"className":2939},[],[2941],{"type":47,"value":2942},"INITED",{"type":42,"tag":98,"props":2944,"children":2945},{},[2946],{"type":47,"value":2947},"Fuzzing initialized",{"type":42,"tag":71,"props":2949,"children":2950},{},[2951,2960],{"type":42,"tag":98,"props":2952,"children":2953},{},[2954],{"type":42,"tag":224,"props":2955,"children":2957},{"className":2956},[],[2958],{"type":47,"value":2959},"NEW",{"type":42,"tag":98,"props":2961,"children":2962},{},[2963],{"type":47,"value":2964},"New coverage found, added to corpus",{"type":42,"tag":71,"props":2966,"children":2967},{},[2968,2977],{"type":42,"tag":98,"props":2969,"children":2970},{},[2971],{"type":42,"tag":224,"props":2972,"children":2974},{"className":2973},[],[2975],{"type":47,"value":2976},"REDUCE",{"type":42,"tag":98,"props":2978,"children":2979},{},[2980],{"type":47,"value":2981},"Input minimized while keeping coverage",{"type":42,"tag":71,"props":2983,"children":2984},{},[2985,2994],{"type":42,"tag":98,"props":2986,"children":2987},{},[2988],{"type":42,"tag":224,"props":2989,"children":2991},{"className":2990},[],[2992],{"type":47,"value":2993},"cov: N",{"type":42,"tag":98,"props":2995,"children":2996},{},[2997],{"type":47,"value":2998},"Number of coverage edges hit",{"type":42,"tag":71,"props":3000,"children":3001},{},[3002,3011],{"type":42,"tag":98,"props":3003,"children":3004},{},[3005],{"type":42,"tag":224,"props":3006,"children":3008},{"className":3007},[],[3009],{"type":47,"value":3010},"corp: X\u002FYb",{"type":42,"tag":98,"props":3012,"children":3013},{},[3014],{"type":47,"value":3015},"Corpus size: X entries, Y total bytes",{"type":42,"tag":71,"props":3017,"children":3018},{},[3019,3028],{"type":42,"tag":98,"props":3020,"children":3021},{},[3022],{"type":42,"tag":224,"props":3023,"children":3025},{"className":3024},[],[3026],{"type":47,"value":3027},"exec\u002Fs: N",{"type":42,"tag":98,"props":3029,"children":3030},{},[3031],{"type":47,"value":3032},"Executions per second",{"type":42,"tag":71,"props":3034,"children":3035},{},[3036,3045],{"type":42,"tag":98,"props":3037,"children":3038},{},[3039],{"type":42,"tag":224,"props":3040,"children":3042},{"className":3041},[],[3043],{"type":47,"value":3044},"rss: NMb",{"type":42,"tag":98,"props":3046,"children":3047},{},[3048],{"type":47,"value":3049},"Resident memory usage",{"type":42,"tag":50,"props":3051,"children":3052},{},[3053],{"type":42,"tag":169,"props":3054,"children":3055},{},[3056],{"type":47,"value":3057},"On crash:",{"type":42,"tag":216,"props":3059,"children":3062},{"className":3060,"code":3061,"language":47},[2902],"==11672== ERROR: libFuzzer: deadly signal\nartifact_prefix='.\u002F'; Test unit written to .\u002Fcrash-a9993e364706816aba3e25717850c26c9cd0d89d\n0x61,0x62,0x63,\nabc\nBase64: YWJj\n",[3063],{"type":42,"tag":224,"props":3064,"children":3065},{"__ignoreMap":221},[3066],{"type":47,"value":3061},{"type":42,"tag":50,"props":3068,"children":3069},{},[3070,3072,3078],{"type":47,"value":3071},"The crash is saved to ",{"type":42,"tag":224,"props":3073,"children":3075},{"className":3074},[],[3076],{"type":47,"value":3077},".\u002Fcrash-\u003Chash>",{"type":47,"value":3079}," with the input shown in hex, UTF-8, and Base64.",{"type":42,"tag":50,"props":3081,"children":3082},{},[3083,3087,3089,3095],{"type":42,"tag":169,"props":3084,"children":3085},{},[3086],{"type":47,"value":1032},{"type":47,"value":3088}," Use ",{"type":42,"tag":224,"props":3090,"children":3092},{"className":3091},[],[3093],{"type":47,"value":3094},"-seed=\u003Cvalue>",{"type":47,"value":3096}," to reproduce a fuzzing campaign (single-core only).",{"type":42,"tag":56,"props":3098,"children":3100},{"id":3099},"fuzzing-dictionary",[3101],{"type":47,"value":3102},"Fuzzing Dictionary",{"type":42,"tag":50,"props":3104,"children":3105},{},[3106],{"type":47,"value":3107},"Dictionaries help the fuzzer discover interesting inputs faster by providing hints about the input format.",{"type":42,"tag":427,"props":3109,"children":3111},{"id":3110},"dictionary-format",[3112],{"type":47,"value":3113},"Dictionary Format",{"type":42,"tag":50,"props":3115,"children":3116},{},[3117],{"type":47,"value":3118},"Create a text file with quoted strings (one per line):",{"type":42,"tag":216,"props":3120,"children":3124},{"className":3121,"code":3122,"language":3123,"meta":221,"style":221},"language-conf shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Lines starting with '#' are comments\n\n# Magic bytes\nmagic=\"\\x89PNG\"\nmagic2=\"IEND\"\n\n# Keywords\n\"GET\"\n\"POST\"\n\"Content-Type\"\n\n# Hex sequences\ndelimiter=\"\\xFF\\xD8\\xFF\"\n","conf",[3125],{"type":42,"tag":224,"props":3126,"children":3127},{"__ignoreMap":221},[3128,3136,3143,3151,3159,3167,3174,3182,3190,3198,3206,3213,3221],{"type":42,"tag":228,"props":3129,"children":3130},{"class":230,"line":231},[3131],{"type":42,"tag":228,"props":3132,"children":3133},{},[3134],{"type":47,"value":3135},"# Lines starting with '#' are comments\n",{"type":42,"tag":228,"props":3137,"children":3138},{"class":230,"line":240},[3139],{"type":42,"tag":228,"props":3140,"children":3141},{"emptyLinePlaceholder":253},[3142],{"type":47,"value":256},{"type":42,"tag":228,"props":3144,"children":3145},{"class":230,"line":249},[3146],{"type":42,"tag":228,"props":3147,"children":3148},{},[3149],{"type":47,"value":3150},"# Magic bytes\n",{"type":42,"tag":228,"props":3152,"children":3153},{"class":230,"line":259},[3154],{"type":42,"tag":228,"props":3155,"children":3156},{},[3157],{"type":47,"value":3158},"magic=\"\\x89PNG\"\n",{"type":42,"tag":228,"props":3160,"children":3161},{"class":230,"line":268},[3162],{"type":42,"tag":228,"props":3163,"children":3164},{},[3165],{"type":47,"value":3166},"magic2=\"IEND\"\n",{"type":42,"tag":228,"props":3168,"children":3169},{"class":230,"line":277},[3170],{"type":42,"tag":228,"props":3171,"children":3172},{"emptyLinePlaceholder":253},[3173],{"type":47,"value":256},{"type":42,"tag":228,"props":3175,"children":3176},{"class":230,"line":286},[3177],{"type":42,"tag":228,"props":3178,"children":3179},{},[3180],{"type":47,"value":3181},"# Keywords\n",{"type":42,"tag":228,"props":3183,"children":3184},{"class":230,"line":294},[3185],{"type":42,"tag":228,"props":3186,"children":3187},{},[3188],{"type":47,"value":3189},"\"GET\"\n",{"type":42,"tag":228,"props":3191,"children":3192},{"class":230,"line":303},[3193],{"type":42,"tag":228,"props":3194,"children":3195},{},[3196],{"type":47,"value":3197},"\"POST\"\n",{"type":42,"tag":228,"props":3199,"children":3200},{"class":230,"line":312},[3201],{"type":42,"tag":228,"props":3202,"children":3203},{},[3204],{"type":47,"value":3205},"\"Content-Type\"\n",{"type":42,"tag":228,"props":3207,"children":3208},{"class":230,"line":320},[3209],{"type":42,"tag":228,"props":3210,"children":3211},{"emptyLinePlaceholder":253},[3212],{"type":47,"value":256},{"type":42,"tag":228,"props":3214,"children":3215},{"class":230,"line":329},[3216],{"type":42,"tag":228,"props":3217,"children":3218},{},[3219],{"type":47,"value":3220},"# Hex sequences\n",{"type":42,"tag":228,"props":3222,"children":3223},{"class":230,"line":792},[3224],{"type":42,"tag":228,"props":3225,"children":3226},{},[3227],{"type":47,"value":3228},"delimiter=\"\\xFF\\xD8\\xFF\"\n",{"type":42,"tag":427,"props":3230,"children":3232},{"id":3231},"using-a-dictionary",[3233],{"type":47,"value":3234},"Using a Dictionary",{"type":42,"tag":216,"props":3236,"children":3237},{"className":343,"code":2621,"language":345,"meta":221,"style":221},[3238],{"type":42,"tag":224,"props":3239,"children":3240},{"__ignoreMap":221},[3241],{"type":42,"tag":228,"props":3242,"children":3243},{"class":230,"line":231},[3244,3248,3252],{"type":42,"tag":228,"props":3245,"children":3246},{"style":355},[3247],{"type":47,"value":415},{"type":42,"tag":228,"props":3249,"children":3250},{"style":361},[3251],{"type":47,"value":2637},{"type":42,"tag":228,"props":3253,"children":3254},{"style":361},[3255],{"type":47,"value":407},{"type":42,"tag":427,"props":3257,"children":3259},{"id":3258},"generating-a-dictionary",[3260],{"type":47,"value":3261},"Generating a Dictionary",{"type":42,"tag":50,"props":3263,"children":3264},{},[3265],{"type":42,"tag":169,"props":3266,"children":3267},{},[3268],{"type":47,"value":3269},"From header files:",{"type":42,"tag":216,"props":3271,"children":3273},{"className":343,"code":3272,"language":345,"meta":221,"style":221},"grep -o '\".*\"' header.h > header.dict\n",[3274],{"type":42,"tag":224,"props":3275,"children":3276},{"__ignoreMap":221},[3277],{"type":42,"tag":228,"props":3278,"children":3279},{"class":230,"line":231},[3280,3285,3289,3294,3299,3304,3309,3314],{"type":42,"tag":228,"props":3281,"children":3282},{"style":355},[3283],{"type":47,"value":3284},"grep",{"type":42,"tag":228,"props":3286,"children":3287},{"style":361},[3288],{"type":47,"value":389},{"type":42,"tag":228,"props":3290,"children":3291},{"style":1918},[3292],{"type":47,"value":3293}," '",{"type":42,"tag":228,"props":3295,"children":3296},{"style":361},[3297],{"type":47,"value":3298},"\".*\"",{"type":42,"tag":228,"props":3300,"children":3301},{"style":1918},[3302],{"type":47,"value":3303},"'",{"type":42,"tag":228,"props":3305,"children":3306},{"style":361},[3307],{"type":47,"value":3308}," header.h",{"type":42,"tag":228,"props":3310,"children":3311},{"style":1918},[3312],{"type":47,"value":3313}," >",{"type":42,"tag":228,"props":3315,"children":3316},{"style":361},[3317],{"type":47,"value":3318}," header.dict\n",{"type":42,"tag":50,"props":3320,"children":3321},{},[3322],{"type":42,"tag":169,"props":3323,"children":3324},{},[3325],{"type":47,"value":3326},"From man pages:",{"type":42,"tag":216,"props":3328,"children":3330},{"className":343,"code":3329,"language":345,"meta":221,"style":221},"man curl | grep -oP '^\\s*(--|-)\\K\\S+' | sed 's\u002F[,.]$\u002F\u002F' | sed 's\u002F^\u002F\"&\u002F; s\u002F$\u002F&\"\u002F' | sort -u > man.dict\n",[3331],{"type":42,"tag":224,"props":3332,"children":3333},{"__ignoreMap":221},[3334],{"type":42,"tag":228,"props":3335,"children":3336},{"class":230,"line":231},[3337,3342,3347,3352,3357,3362,3366,3371,3375,3379,3384,3388,3393,3397,3401,3405,3409,3414,3418,3422,3427,3432,3436],{"type":42,"tag":228,"props":3338,"children":3339},{"style":355},[3340],{"type":47,"value":3341},"man",{"type":42,"tag":228,"props":3343,"children":3344},{"style":361},[3345],{"type":47,"value":3346}," curl",{"type":42,"tag":228,"props":3348,"children":3349},{"style":1918},[3350],{"type":47,"value":3351}," |",{"type":42,"tag":228,"props":3353,"children":3354},{"style":355},[3355],{"type":47,"value":3356}," grep",{"type":42,"tag":228,"props":3358,"children":3359},{"style":361},[3360],{"type":47,"value":3361}," -oP",{"type":42,"tag":228,"props":3363,"children":3364},{"style":1918},[3365],{"type":47,"value":3293},{"type":42,"tag":228,"props":3367,"children":3368},{"style":361},[3369],{"type":47,"value":3370},"^\\s*(--|-)\\K\\S+",{"type":42,"tag":228,"props":3372,"children":3373},{"style":1918},[3374],{"type":47,"value":3303},{"type":42,"tag":228,"props":3376,"children":3377},{"style":1918},[3378],{"type":47,"value":3351},{"type":42,"tag":228,"props":3380,"children":3381},{"style":355},[3382],{"type":47,"value":3383}," sed",{"type":42,"tag":228,"props":3385,"children":3386},{"style":1918},[3387],{"type":47,"value":3293},{"type":42,"tag":228,"props":3389,"children":3390},{"style":361},[3391],{"type":47,"value":3392},"s\u002F[,.]$\u002F\u002F",{"type":42,"tag":228,"props":3394,"children":3395},{"style":1918},[3396],{"type":47,"value":3303},{"type":42,"tag":228,"props":3398,"children":3399},{"style":1918},[3400],{"type":47,"value":3351},{"type":42,"tag":228,"props":3402,"children":3403},{"style":355},[3404],{"type":47,"value":3383},{"type":42,"tag":228,"props":3406,"children":3407},{"style":1918},[3408],{"type":47,"value":3293},{"type":42,"tag":228,"props":3410,"children":3411},{"style":361},[3412],{"type":47,"value":3413},"s\u002F^\u002F\"&\u002F; s\u002F$\u002F&\"\u002F",{"type":42,"tag":228,"props":3415,"children":3416},{"style":1918},[3417],{"type":47,"value":3303},{"type":42,"tag":228,"props":3419,"children":3420},{"style":1918},[3421],{"type":47,"value":3351},{"type":42,"tag":228,"props":3423,"children":3424},{"style":355},[3425],{"type":47,"value":3426}," sort",{"type":42,"tag":228,"props":3428,"children":3429},{"style":361},[3430],{"type":47,"value":3431}," -u",{"type":42,"tag":228,"props":3433,"children":3434},{"style":1918},[3435],{"type":47,"value":3313},{"type":42,"tag":228,"props":3437,"children":3438},{"style":361},[3439],{"type":47,"value":3440}," man.dict\n",{"type":42,"tag":50,"props":3442,"children":3443},{},[3444],{"type":42,"tag":169,"props":3445,"children":3446},{},[3447],{"type":47,"value":3448},"From binary strings:",{"type":42,"tag":216,"props":3450,"children":3452},{"className":343,"code":3451,"language":345,"meta":221,"style":221},"strings .\u002Fbinary | sed 's\u002F^\u002F\"&\u002F; s\u002F$\u002F&\"\u002F' > strings.dict\n",[3453],{"type":42,"tag":224,"props":3454,"children":3455},{"__ignoreMap":221},[3456],{"type":42,"tag":228,"props":3457,"children":3458},{"class":230,"line":231},[3459,3464,3469,3473,3477,3481,3485,3489,3493],{"type":42,"tag":228,"props":3460,"children":3461},{"style":355},[3462],{"type":47,"value":3463},"strings",{"type":42,"tag":228,"props":3465,"children":3466},{"style":361},[3467],{"type":47,"value":3468}," .\u002Fbinary",{"type":42,"tag":228,"props":3470,"children":3471},{"style":1918},[3472],{"type":47,"value":3351},{"type":42,"tag":228,"props":3474,"children":3475},{"style":355},[3476],{"type":47,"value":3383},{"type":42,"tag":228,"props":3478,"children":3479},{"style":1918},[3480],{"type":47,"value":3293},{"type":42,"tag":228,"props":3482,"children":3483},{"style":361},[3484],{"type":47,"value":3413},{"type":42,"tag":228,"props":3486,"children":3487},{"style":1918},[3488],{"type":47,"value":3303},{"type":42,"tag":228,"props":3490,"children":3491},{"style":1918},[3492],{"type":47,"value":3313},{"type":42,"tag":228,"props":3494,"children":3495},{"style":361},[3496],{"type":47,"value":3497}," strings.dict\n",{"type":42,"tag":50,"props":3499,"children":3500},{},[3501,3506],{"type":42,"tag":169,"props":3502,"children":3503},{},[3504],{"type":47,"value":3505},"Using LLMs:",{"type":47,"value":3507}," Ask ChatGPT or similar to generate a dictionary for your format (e.g., \"Generate a libFuzzer dictionary for a JSON parser\").",{"type":42,"tag":1411,"props":3509,"children":3510},{},[3511],{"type":42,"tag":50,"props":3512,"children":3513},{},[3514,3518,3520,3525],{"type":42,"tag":169,"props":3515,"children":3516},{},[3517],{"type":47,"value":1421},{"type":47,"value":3519}," For advanced dictionary generation, format-specific dictionaries, and\ndictionary optimization strategies, see the ",{"type":42,"tag":169,"props":3521,"children":3522},{},[3523],{"type":47,"value":3524},"fuzzing-dictionaries",{"type":47,"value":1430},{"type":42,"tag":56,"props":3527,"children":3529},{"id":3528},"coverage-analysis",[3530],{"type":47,"value":3531},"Coverage Analysis",{"type":42,"tag":50,"props":3533,"children":3534},{},[3535,3537,3542],{"type":47,"value":3536},"While libFuzzer shows basic coverage stats (",{"type":42,"tag":224,"props":3538,"children":3540},{"className":3539},[],[3541],{"type":47,"value":2993},{"type":47,"value":3543},"), detailed coverage analysis requires additional tools.",{"type":42,"tag":427,"props":3545,"children":3547},{"id":3546},"source-based-coverage",[3548],{"type":47,"value":3549},"Source-Based Coverage",{"type":42,"tag":50,"props":3551,"children":3552},{},[3553],{"type":42,"tag":169,"props":3554,"children":3555},{},[3556],{"type":47,"value":3557},"1. Recompile with coverage instrumentation:",{"type":42,"tag":216,"props":3559,"children":3561},{"className":343,"code":3560,"language":345,"meta":221,"style":221},"clang++ -fsanitize=fuzzer -fprofile-instr-generate -fcoverage-mapping harness.cc target.cc -o fuzz\n",[3562],{"type":42,"tag":224,"props":3563,"children":3564},{"__ignoreMap":221},[3565],{"type":42,"tag":228,"props":3566,"children":3567},{"class":230,"line":231},[3568,3572,3576,3581,3586,3590,3594,3598],{"type":42,"tag":228,"props":3569,"children":3570},{"style":355},[3571],{"type":47,"value":358},{"type":42,"tag":228,"props":3573,"children":3574},{"style":361},[3575],{"type":47,"value":1506},{"type":42,"tag":228,"props":3577,"children":3578},{"style":361},[3579],{"type":47,"value":3580}," -fprofile-instr-generate",{"type":42,"tag":228,"props":3582,"children":3583},{"style":361},[3584],{"type":47,"value":3585}," -fcoverage-mapping",{"type":42,"tag":228,"props":3587,"children":3588},{"style":361},[3589],{"type":47,"value":379},{"type":42,"tag":228,"props":3591,"children":3592},{"style":361},[3593],{"type":47,"value":384},{"type":42,"tag":228,"props":3595,"children":3596},{"style":361},[3597],{"type":47,"value":389},{"type":42,"tag":228,"props":3599,"children":3600},{"style":361},[3601],{"type":47,"value":394},{"type":42,"tag":50,"props":3603,"children":3604},{},[3605],{"type":42,"tag":169,"props":3606,"children":3607},{},[3608],{"type":47,"value":3609},"2. Run fuzzer to collect coverage:",{"type":42,"tag":216,"props":3611,"children":3613},{"className":343,"code":3612,"language":345,"meta":221,"style":221},"LLVM_PROFILE_FILE=\"coverage-%p.profraw\" .\u002Ffuzz -runs=10000 corpus\u002F\n",[3614],{"type":42,"tag":224,"props":3615,"children":3616},{"__ignoreMap":221},[3617],{"type":42,"tag":228,"props":3618,"children":3619},{"class":230,"line":231},[3620,3625,3629,3633,3638,3642,3647,3652],{"type":42,"tag":228,"props":3621,"children":3622},{"style":1912},[3623],{"type":47,"value":3624},"LLVM_PROFILE_FILE",{"type":42,"tag":228,"props":3626,"children":3627},{"style":1918},[3628],{"type":47,"value":1921},{"type":42,"tag":228,"props":3630,"children":3631},{"style":1918},[3632],{"type":47,"value":1935},{"type":42,"tag":228,"props":3634,"children":3635},{"style":361},[3636],{"type":47,"value":3637},"coverage-%p.profraw",{"type":42,"tag":228,"props":3639,"children":3640},{"style":1918},[3641],{"type":47,"value":1935},{"type":42,"tag":228,"props":3643,"children":3644},{"style":355},[3645],{"type":47,"value":3646}," .\u002Ffuzz",{"type":42,"tag":228,"props":3648,"children":3649},{"style":361},[3650],{"type":47,"value":3651}," -runs=10000",{"type":42,"tag":228,"props":3653,"children":3654},{"style":361},[3655],{"type":47,"value":407},{"type":42,"tag":50,"props":3657,"children":3658},{},[3659],{"type":42,"tag":169,"props":3660,"children":3661},{},[3662],{"type":47,"value":3663},"3. Merge coverage data:",{"type":42,"tag":216,"props":3665,"children":3667},{"className":343,"code":3666,"language":345,"meta":221,"style":221},"llvm-profdata merge -sparse coverage-*.profraw -o coverage.profdata\n",[3668],{"type":42,"tag":224,"props":3669,"children":3670},{"__ignoreMap":221},[3671],{"type":42,"tag":228,"props":3672,"children":3673},{"class":230,"line":231},[3674,3679,3684,3689,3694,3698,3703,3707],{"type":42,"tag":228,"props":3675,"children":3676},{"style":355},[3677],{"type":47,"value":3678},"llvm-profdata",{"type":42,"tag":228,"props":3680,"children":3681},{"style":361},[3682],{"type":47,"value":3683}," merge",{"type":42,"tag":228,"props":3685,"children":3686},{"style":361},[3687],{"type":47,"value":3688}," -sparse",{"type":42,"tag":228,"props":3690,"children":3691},{"style":361},[3692],{"type":47,"value":3693}," coverage-",{"type":42,"tag":228,"props":3695,"children":3696},{"style":1912},[3697],{"type":47,"value":2250},{"type":42,"tag":228,"props":3699,"children":3700},{"style":361},[3701],{"type":47,"value":3702},".profraw",{"type":42,"tag":228,"props":3704,"children":3705},{"style":361},[3706],{"type":47,"value":389},{"type":42,"tag":228,"props":3708,"children":3709},{"style":361},[3710],{"type":47,"value":3711}," coverage.profdata\n",{"type":42,"tag":50,"props":3713,"children":3714},{},[3715],{"type":42,"tag":169,"props":3716,"children":3717},{},[3718],{"type":47,"value":3719},"4. Generate coverage report:",{"type":42,"tag":216,"props":3721,"children":3723},{"className":343,"code":3722,"language":345,"meta":221,"style":221},"llvm-cov show .\u002Ffuzz -instr-profile=coverage.profdata\n",[3724],{"type":42,"tag":224,"props":3725,"children":3726},{"__ignoreMap":221},[3727],{"type":42,"tag":228,"props":3728,"children":3729},{"class":230,"line":231},[3730,3735,3740,3744],{"type":42,"tag":228,"props":3731,"children":3732},{"style":355},[3733],{"type":47,"value":3734},"llvm-cov",{"type":42,"tag":228,"props":3736,"children":3737},{"style":361},[3738],{"type":47,"value":3739}," show",{"type":42,"tag":228,"props":3741,"children":3742},{"style":361},[3743],{"type":47,"value":3646},{"type":42,"tag":228,"props":3745,"children":3746},{"style":361},[3747],{"type":47,"value":3748}," -instr-profile=coverage.profdata\n",{"type":42,"tag":50,"props":3750,"children":3751},{},[3752],{"type":42,"tag":169,"props":3753,"children":3754},{},[3755],{"type":47,"value":3756},"5. Generate HTML report:",{"type":42,"tag":216,"props":3758,"children":3760},{"className":343,"code":3759,"language":345,"meta":221,"style":221},"llvm-cov show .\u002Ffuzz -instr-profile=coverage.profdata -format=html > coverage.html\n",[3761],{"type":42,"tag":224,"props":3762,"children":3763},{"__ignoreMap":221},[3764],{"type":42,"tag":228,"props":3765,"children":3766},{"class":230,"line":231},[3767,3771,3775,3779,3784,3789,3793],{"type":42,"tag":228,"props":3768,"children":3769},{"style":355},[3770],{"type":47,"value":3734},{"type":42,"tag":228,"props":3772,"children":3773},{"style":361},[3774],{"type":47,"value":3739},{"type":42,"tag":228,"props":3776,"children":3777},{"style":361},[3778],{"type":47,"value":3646},{"type":42,"tag":228,"props":3780,"children":3781},{"style":361},[3782],{"type":47,"value":3783}," -instr-profile=coverage.profdata",{"type":42,"tag":228,"props":3785,"children":3786},{"style":361},[3787],{"type":47,"value":3788}," -format=html",{"type":42,"tag":228,"props":3790,"children":3791},{"style":1918},[3792],{"type":47,"value":3313},{"type":42,"tag":228,"props":3794,"children":3795},{"style":361},[3796],{"type":47,"value":3797}," coverage.html\n",{"type":42,"tag":427,"props":3799,"children":3801},{"id":3800},"improving-coverage",[3802],{"type":47,"value":3803},"Improving Coverage",{"type":42,"tag":50,"props":3805,"children":3806},{},[3807],{"type":42,"tag":169,"props":3808,"children":3809},{},[3810],{"type":47,"value":3811},"Tips:",{"type":42,"tag":175,"props":3813,"children":3814},{},[3815,3820,3825,3830,3835],{"type":42,"tag":179,"props":3816,"children":3817},{},[3818],{"type":47,"value":3819},"Provide better seed inputs in corpus",{"type":42,"tag":179,"props":3821,"children":3822},{},[3823],{"type":47,"value":3824},"Use dictionaries for format-aware fuzzing",{"type":42,"tag":179,"props":3826,"children":3827},{},[3828],{"type":47,"value":3829},"Check if harness properly exercises target",{"type":42,"tag":179,"props":3831,"children":3832},{},[3833],{"type":47,"value":3834},"Consider structure-aware fuzzing for complex formats",{"type":42,"tag":179,"props":3836,"children":3837},{},[3838],{"type":47,"value":3839},"Run longer campaigns (days\u002Fweeks)",{"type":42,"tag":1411,"props":3841,"children":3842},{},[3843],{"type":42,"tag":50,"props":3844,"children":3845},{},[3846,3850,3852,3856],{"type":42,"tag":169,"props":3847,"children":3848},{},[3849],{"type":47,"value":1421},{"type":47,"value":3851}," For detailed coverage analysis techniques, identifying coverage gaps,\nsystematic coverage improvement, and comparing coverage across fuzzers, see the\n",{"type":42,"tag":169,"props":3853,"children":3854},{},[3855],{"type":47,"value":3528},{"type":47,"value":1430},{"type":42,"tag":56,"props":3858,"children":3860},{"id":3859},"sanitizer-integration",[3861],{"type":47,"value":3862},"Sanitizer Integration",{"type":42,"tag":427,"props":3864,"children":3866},{"id":3865},"addresssanitizer-asan",[3867],{"type":47,"value":3868},"AddressSanitizer (ASan)",{"type":42,"tag":50,"props":3870,"children":3871},{},[3872,3874],{"type":47,"value":3873},"ASan detects memory errors like buffer overflows and use-after-free bugs. ",{"type":42,"tag":169,"props":3875,"children":3876},{},[3877],{"type":47,"value":3878},"Highly recommended for fuzzing.",{"type":42,"tag":50,"props":3880,"children":3881},{},[3882],{"type":42,"tag":169,"props":3883,"children":3884},{},[3885],{"type":47,"value":3886},"Enable ASan:",{"type":42,"tag":216,"props":3888,"children":3889},{"className":343,"code":1608,"language":345,"meta":221,"style":221},[3890],{"type":42,"tag":224,"props":3891,"children":3892},{"__ignoreMap":221},[3893],{"type":42,"tag":228,"props":3894,"children":3895},{"class":230,"line":231},[3896,3900,3904,3908,3912,3916,3920,3924,3928],{"type":42,"tag":228,"props":3897,"children":3898},{"style":355},[3899],{"type":47,"value":358},{"type":42,"tag":228,"props":3901,"children":3902},{"style":361},[3903],{"type":47,"value":364},{"type":42,"tag":228,"props":3905,"children":3906},{"style":361},[3907],{"type":47,"value":369},{"type":42,"tag":228,"props":3909,"children":3910},{"style":361},[3911],{"type":47,"value":374},{"type":42,"tag":228,"props":3913,"children":3914},{"style":361},[3915],{"type":47,"value":1636},{"type":42,"tag":228,"props":3917,"children":3918},{"style":361},[3919],{"type":47,"value":379},{"type":42,"tag":228,"props":3921,"children":3922},{"style":361},[3923],{"type":47,"value":384},{"type":42,"tag":228,"props":3925,"children":3926},{"style":361},[3927],{"type":47,"value":389},{"type":42,"tag":228,"props":3929,"children":3930},{"style":361},[3931],{"type":47,"value":394},{"type":42,"tag":50,"props":3933,"children":3934},{},[3935],{"type":42,"tag":169,"props":3936,"children":3937},{},[3938],{"type":47,"value":3939},"Example ASan output:",{"type":42,"tag":216,"props":3941,"children":3944},{"className":3942,"code":3943,"language":47},[2902],"==1276163==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000c4ab1\nWRITE of size 1 at 0x6020000c4ab1 thread T0\n    #0 0x55555568631a in check_buf(char*, unsigned long) main.cc:13:25\n    #1 0x5555556860bf in LLVMFuzzerTestOneInput harness.cc:7:3\n",[3945],{"type":42,"tag":224,"props":3946,"children":3947},{"__ignoreMap":221},[3948],{"type":47,"value":3943},{"type":42,"tag":50,"props":3950,"children":3951},{},[3952],{"type":42,"tag":169,"props":3953,"children":3954},{},[3955],{"type":47,"value":3956},"Configure ASan with environment variables:",{"type":42,"tag":216,"props":3958,"children":3960},{"className":343,"code":3959,"language":345,"meta":221,"style":221},"ASAN_OPTIONS=verbosity=1:abort_on_error=1 .\u002Ffuzz corpus\u002F\n",[3961],{"type":42,"tag":224,"props":3962,"children":3963},{"__ignoreMap":221},[3964],{"type":42,"tag":228,"props":3965,"children":3966},{"class":230,"line":231},[3967,3972,3976,3981,3985,3990,3995,3999,4004,4008],{"type":42,"tag":228,"props":3968,"children":3969},{"style":1912},[3970],{"type":47,"value":3971},"ASAN_OPTIONS",{"type":42,"tag":228,"props":3973,"children":3974},{"style":1918},[3975],{"type":47,"value":1921},{"type":42,"tag":228,"props":3977,"children":3978},{"style":1912},[3979],{"type":47,"value":3980},"verbosity",{"type":42,"tag":228,"props":3982,"children":3983},{"style":1918},[3984],{"type":47,"value":1921},{"type":42,"tag":228,"props":3986,"children":3987},{"style":361},[3988],{"type":47,"value":3989},"1:",{"type":42,"tag":228,"props":3991,"children":3992},{"style":1912},[3993],{"type":47,"value":3994},"abort_on_error",{"type":42,"tag":228,"props":3996,"children":3997},{"style":1918},[3998],{"type":47,"value":1921},{"type":42,"tag":228,"props":4000,"children":4001},{"style":361},[4002],{"type":47,"value":4003},"1",{"type":42,"tag":228,"props":4005,"children":4006},{"style":355},[4007],{"type":47,"value":3646},{"type":42,"tag":228,"props":4009,"children":4010},{"style":361},[4011],{"type":47,"value":407},{"type":42,"tag":50,"props":4013,"children":4014},{},[4015],{"type":42,"tag":169,"props":4016,"children":4017},{},[4018],{"type":47,"value":4019},"Important flags:",{"type":42,"tag":175,"props":4021,"children":4022},{},[4023,4034,4045],{"type":42,"tag":179,"props":4024,"children":4025},{},[4026,4032],{"type":42,"tag":224,"props":4027,"children":4029},{"className":4028},[],[4030],{"type":47,"value":4031},"verbosity=1",{"type":47,"value":4033},": Show ASan is active",{"type":42,"tag":179,"props":4035,"children":4036},{},[4037,4043],{"type":42,"tag":224,"props":4038,"children":4040},{"className":4039},[],[4041],{"type":47,"value":4042},"detect_leaks=0",{"type":47,"value":4044},": Disable leak detection (leaks reported at end)",{"type":42,"tag":179,"props":4046,"children":4047},{},[4048,4054,4056,4062,4064,4070],{"type":42,"tag":224,"props":4049,"children":4051},{"className":4050},[],[4052],{"type":47,"value":4053},"abort_on_error=1",{"type":47,"value":4055},": Call ",{"type":42,"tag":224,"props":4057,"children":4059},{"className":4058},[],[4060],{"type":47,"value":4061},"abort()",{"type":47,"value":4063}," instead of ",{"type":42,"tag":224,"props":4065,"children":4067},{"className":4066},[],[4068],{"type":47,"value":4069},"_exit()",{"type":47,"value":4071}," on errors",{"type":42,"tag":50,"props":4073,"children":4074},{},[4075],{"type":42,"tag":169,"props":4076,"children":4077},{},[4078],{"type":47,"value":4079},"Drawbacks:",{"type":42,"tag":175,"props":4081,"children":4082},{},[4083,4088,4100],{"type":42,"tag":179,"props":4084,"children":4085},{},[4086],{"type":47,"value":4087},"2-4x slowdown",{"type":42,"tag":179,"props":4089,"children":4090},{},[4091,4093,4099],{"type":47,"value":4092},"Requires ~20TB virtual memory (disable memory limits: ",{"type":42,"tag":224,"props":4094,"children":4096},{"className":4095},[],[4097],{"type":47,"value":4098},"-rss_limit_mb=0",{"type":47,"value":2362},{"type":42,"tag":179,"props":4101,"children":4102},{},[4103],{"type":47,"value":4104},"Best supported on Linux",{"type":42,"tag":1411,"props":4106,"children":4107},{},[4108],{"type":42,"tag":50,"props":4109,"children":4110},{},[4111,4115,4117,4121],{"type":42,"tag":169,"props":4112,"children":4113},{},[4114],{"type":47,"value":1421},{"type":47,"value":4116}," For comprehensive ASan configuration, common pitfalls, symbolization,\nand combining with other sanitizers, see the ",{"type":42,"tag":169,"props":4118,"children":4119},{},[4120],{"type":47,"value":1720},{"type":47,"value":1430},{"type":42,"tag":427,"props":4123,"children":4125},{"id":4124},"undefinedbehaviorsanitizer-ubsan",[4126],{"type":47,"value":4127},"UndefinedBehaviorSanitizer (UBSan)",{"type":42,"tag":50,"props":4129,"children":4130},{},[4131],{"type":47,"value":4132},"UBSan detects undefined behavior like integer overflow, null pointer dereference, etc.",{"type":42,"tag":50,"props":4134,"children":4135},{},[4136],{"type":42,"tag":169,"props":4137,"children":4138},{},[4139],{"type":47,"value":4140},"Enable UBSan:",{"type":42,"tag":216,"props":4142,"children":4144},{"className":343,"code":4143,"language":345,"meta":221,"style":221},"clang++ -fsanitize=fuzzer,undefined -g -O2 harness.cc target.cc -o fuzz\n",[4145],{"type":42,"tag":224,"props":4146,"children":4147},{"__ignoreMap":221},[4148],{"type":42,"tag":228,"props":4149,"children":4150},{"class":230,"line":231},[4151,4155,4160,4164,4168,4172,4176,4180],{"type":42,"tag":228,"props":4152,"children":4153},{"style":355},[4154],{"type":47,"value":358},{"type":42,"tag":228,"props":4156,"children":4157},{"style":361},[4158],{"type":47,"value":4159}," -fsanitize=fuzzer,undefined",{"type":42,"tag":228,"props":4161,"children":4162},{"style":361},[4163],{"type":47,"value":369},{"type":42,"tag":228,"props":4165,"children":4166},{"style":361},[4167],{"type":47,"value":374},{"type":42,"tag":228,"props":4169,"children":4170},{"style":361},[4171],{"type":47,"value":379},{"type":42,"tag":228,"props":4173,"children":4174},{"style":361},[4175],{"type":47,"value":384},{"type":42,"tag":228,"props":4177,"children":4178},{"style":361},[4179],{"type":47,"value":389},{"type":42,"tag":228,"props":4181,"children":4182},{"style":361},[4183],{"type":47,"value":394},{"type":42,"tag":50,"props":4185,"children":4186},{},[4187],{"type":42,"tag":169,"props":4188,"children":4189},{},[4190],{"type":47,"value":4191},"Combine with ASan:",{"type":42,"tag":216,"props":4193,"children":4194},{"className":343,"code":1663,"language":345,"meta":221,"style":221},[4195],{"type":42,"tag":224,"props":4196,"children":4197},{"__ignoreMap":221},[4198],{"type":42,"tag":228,"props":4199,"children":4200},{"class":230,"line":231},[4201,4205,4209,4213,4217,4221,4225,4229],{"type":42,"tag":228,"props":4202,"children":4203},{"style":355},[4204],{"type":47,"value":358},{"type":42,"tag":228,"props":4206,"children":4207},{"style":361},[4208],{"type":47,"value":1679},{"type":42,"tag":228,"props":4210,"children":4211},{"style":361},[4212],{"type":47,"value":369},{"type":42,"tag":228,"props":4214,"children":4215},{"style":361},[4216],{"type":47,"value":374},{"type":42,"tag":228,"props":4218,"children":4219},{"style":361},[4220],{"type":47,"value":379},{"type":42,"tag":228,"props":4222,"children":4223},{"style":361},[4224],{"type":47,"value":384},{"type":42,"tag":228,"props":4226,"children":4227},{"style":361},[4228],{"type":47,"value":389},{"type":42,"tag":228,"props":4230,"children":4231},{"style":361},[4232],{"type":47,"value":394},{"type":42,"tag":427,"props":4234,"children":4236},{"id":4235},"memorysanitizer-msan",[4237],{"type":47,"value":4238},"MemorySanitizer (MSan)",{"type":42,"tag":50,"props":4240,"children":4241},{},[4242],{"type":47,"value":4243},"MSan detects uninitialized memory reads. More complex to use (requires rebuilding all dependencies).",{"type":42,"tag":216,"props":4245,"children":4247},{"className":343,"code":4246,"language":345,"meta":221,"style":221},"clang++ -fsanitize=fuzzer,memory -g -O2 harness.cc target.cc -o fuzz\n",[4248],{"type":42,"tag":224,"props":4249,"children":4250},{"__ignoreMap":221},[4251],{"type":42,"tag":228,"props":4252,"children":4253},{"class":230,"line":231},[4254,4258,4263,4267,4271,4275,4279,4283],{"type":42,"tag":228,"props":4255,"children":4256},{"style":355},[4257],{"type":47,"value":358},{"type":42,"tag":228,"props":4259,"children":4260},{"style":361},[4261],{"type":47,"value":4262}," -fsanitize=fuzzer,memory",{"type":42,"tag":228,"props":4264,"children":4265},{"style":361},[4266],{"type":47,"value":369},{"type":42,"tag":228,"props":4268,"children":4269},{"style":361},[4270],{"type":47,"value":374},{"type":42,"tag":228,"props":4272,"children":4273},{"style":361},[4274],{"type":47,"value":379},{"type":42,"tag":228,"props":4276,"children":4277},{"style":361},[4278],{"type":47,"value":384},{"type":42,"tag":228,"props":4280,"children":4281},{"style":361},[4282],{"type":47,"value":389},{"type":42,"tag":228,"props":4284,"children":4285},{"style":361},[4286],{"type":47,"value":394},{"type":42,"tag":427,"props":4288,"children":4290},{"id":4289},"common-sanitizer-issues",[4291],{"type":47,"value":4292},"Common Sanitizer Issues",{"type":42,"tag":63,"props":4294,"children":4295},{},[4296,4312],{"type":42,"tag":67,"props":4297,"children":4298},{},[4299],{"type":42,"tag":71,"props":4300,"children":4301},{},[4302,4307],{"type":42,"tag":75,"props":4303,"children":4304},{},[4305],{"type":47,"value":4306},"Issue",{"type":42,"tag":75,"props":4308,"children":4309},{},[4310],{"type":47,"value":4311},"Solution",{"type":42,"tag":91,"props":4313,"children":4314},{},[4315,4336,4362,4381,4406],{"type":42,"tag":71,"props":4316,"children":4317},{},[4318,4323],{"type":42,"tag":98,"props":4319,"children":4320},{},[4321],{"type":47,"value":4322},"ASan slows fuzzing too much",{"type":42,"tag":98,"props":4324,"children":4325},{},[4326,4328,4334],{"type":47,"value":4327},"Use ",{"type":42,"tag":224,"props":4329,"children":4331},{"className":4330},[],[4332],{"type":47,"value":4333},"-fsanitize-recover=address",{"type":47,"value":4335}," for non-fatal errors",{"type":42,"tag":71,"props":4337,"children":4338},{},[4339,4344],{"type":42,"tag":98,"props":4340,"children":4341},{},[4342],{"type":47,"value":4343},"Out of memory",{"type":42,"tag":98,"props":4345,"children":4346},{},[4347,4349,4355,4357],{"type":47,"value":4348},"Set ",{"type":42,"tag":224,"props":4350,"children":4352},{"className":4351},[],[4353],{"type":47,"value":4354},"ASAN_OPTIONS=rss_limit_mb=0",{"type":47,"value":4356}," or ",{"type":42,"tag":224,"props":4358,"children":4360},{"className":4359},[],[4361],{"type":47,"value":4098},{"type":42,"tag":71,"props":4363,"children":4364},{},[4365,4370],{"type":42,"tag":98,"props":4366,"children":4367},{},[4368],{"type":47,"value":4369},"Stack exhaustion",{"type":42,"tag":98,"props":4371,"children":4372},{},[4373,4375],{"type":47,"value":4374},"Increase stack size: ",{"type":42,"tag":224,"props":4376,"children":4378},{"className":4377},[],[4379],{"type":47,"value":4380},"ASAN_OPTIONS=stack_size=8388608",{"type":42,"tag":71,"props":4382,"children":4383},{},[4384,4395],{"type":42,"tag":98,"props":4385,"children":4386},{},[4387,4389],{"type":47,"value":4388},"False positives with ",{"type":42,"tag":224,"props":4390,"children":4392},{"className":4391},[],[4393],{"type":47,"value":4394},"_FORTIFY_SOURCE",{"type":42,"tag":98,"props":4396,"children":4397},{},[4398,4399,4404],{"type":47,"value":4327},{"type":42,"tag":224,"props":4400,"children":4402},{"className":4401},[],[4403],{"type":47,"value":1868},{"type":47,"value":4405}," flag",{"type":42,"tag":71,"props":4407,"children":4408},{},[4409,4414],{"type":42,"tag":98,"props":4410,"children":4411},{},[4412],{"type":47,"value":4413},"MSan reports in dependencies",{"type":42,"tag":98,"props":4415,"children":4416},{},[4417,4419],{"type":47,"value":4418},"Rebuild all dependencies with ",{"type":42,"tag":224,"props":4420,"children":4422},{"className":4421},[],[4423],{"type":47,"value":4424},"-fsanitize=memory",{"type":42,"tag":56,"props":4426,"children":4428},{"id":4427},"real-world-examples",[4429],{"type":47,"value":4430},"Real-World Examples",{"type":42,"tag":427,"props":4432,"children":4434},{"id":4433},"example-1-fuzzing-libpng",[4435],{"type":47,"value":4436},"Example 1: Fuzzing libpng",{"type":42,"tag":50,"props":4438,"children":4439},{},[4440],{"type":47,"value":4441},"libpng is a widely-used library for reading\u002Fwriting PNG images. Bugs can lead to security issues.",{"type":42,"tag":50,"props":4443,"children":4444},{},[4445],{"type":42,"tag":169,"props":4446,"children":4447},{},[4448],{"type":47,"value":4449},"1. Get source code:",{"type":42,"tag":216,"props":4451,"children":4453},{"className":343,"code":4452,"language":345,"meta":221,"style":221},"curl -L -O https:\u002F\u002Fdownloads.sourceforge.net\u002Fproject\u002Flibpng\u002Flibpng16\u002F1.6.37\u002Flibpng-1.6.37.tar.xz\ntar xf libpng-1.6.37.tar.xz\ncd libpng-1.6.37\u002F\n",[4454],{"type":42,"tag":224,"props":4455,"children":4456},{"__ignoreMap":221},[4457,4480,4498],{"type":42,"tag":228,"props":4458,"children":4459},{"class":230,"line":231},[4460,4465,4470,4475],{"type":42,"tag":228,"props":4461,"children":4462},{"style":355},[4463],{"type":47,"value":4464},"curl",{"type":42,"tag":228,"props":4466,"children":4467},{"style":361},[4468],{"type":47,"value":4469}," -L",{"type":42,"tag":228,"props":4471,"children":4472},{"style":361},[4473],{"type":47,"value":4474}," -O",{"type":42,"tag":228,"props":4476,"children":4477},{"style":361},[4478],{"type":47,"value":4479}," https:\u002F\u002Fdownloads.sourceforge.net\u002Fproject\u002Flibpng\u002Flibpng16\u002F1.6.37\u002Flibpng-1.6.37.tar.xz\n",{"type":42,"tag":228,"props":4481,"children":4482},{"class":230,"line":240},[4483,4488,4493],{"type":42,"tag":228,"props":4484,"children":4485},{"style":355},[4486],{"type":47,"value":4487},"tar",{"type":42,"tag":228,"props":4489,"children":4490},{"style":361},[4491],{"type":47,"value":4492}," xf",{"type":42,"tag":228,"props":4494,"children":4495},{"style":361},[4496],{"type":47,"value":4497}," libpng-1.6.37.tar.xz\n",{"type":42,"tag":228,"props":4499,"children":4500},{"class":230,"line":249},[4501,4507],{"type":42,"tag":228,"props":4502,"children":4504},{"style":4503},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[4505],{"type":47,"value":4506},"cd",{"type":42,"tag":228,"props":4508,"children":4509},{"style":361},[4510],{"type":47,"value":4511}," libpng-1.6.37\u002F\n",{"type":42,"tag":50,"props":4513,"children":4514},{},[4515],{"type":42,"tag":169,"props":4516,"children":4517},{},[4518],{"type":47,"value":4519},"2. Install dependencies:",{"type":42,"tag":216,"props":4521,"children":4523},{"className":343,"code":4522,"language":345,"meta":221,"style":221},"apt install zlib1g-dev\n",[4524],{"type":42,"tag":224,"props":4525,"children":4526},{"__ignoreMap":221},[4527],{"type":42,"tag":228,"props":4528,"children":4529},{"class":230,"line":231},[4530,4534,4538],{"type":42,"tag":228,"props":4531,"children":4532},{"style":355},[4533],{"type":47,"value":466},{"type":42,"tag":228,"props":4535,"children":4536},{"style":361},[4537],{"type":47,"value":471},{"type":42,"tag":228,"props":4539,"children":4540},{"style":361},[4541],{"type":47,"value":4542}," zlib1g-dev\n",{"type":42,"tag":50,"props":4544,"children":4545},{},[4546],{"type":42,"tag":169,"props":4547,"children":4548},{},[4549],{"type":47,"value":4550},"3. Compile with fuzzing instrumentation:",{"type":42,"tag":216,"props":4552,"children":4553},{"className":343,"code":1896,"language":345,"meta":221,"style":221},[4554],{"type":42,"tag":224,"props":4555,"children":4556},{"__ignoreMap":221},[4557,4592,4627,4638],{"type":42,"tag":228,"props":4558,"children":4559},{"class":230,"line":231},[4560,4564,4568,4572,4576,4580,4584,4588],{"type":42,"tag":228,"props":4561,"children":4562},{"style":1906},[4563],{"type":47,"value":1909},{"type":42,"tag":228,"props":4565,"children":4566},{"style":1912},[4567],{"type":47,"value":1915},{"type":42,"tag":228,"props":4569,"children":4570},{"style":1918},[4571],{"type":47,"value":1921},{"type":42,"tag":228,"props":4573,"children":4574},{"style":1912},[4575],{"type":47,"value":1926},{"type":42,"tag":228,"props":4577,"children":4578},{"style":1918},[4579],{"type":47,"value":1921},{"type":42,"tag":228,"props":4581,"children":4582},{"style":1918},[4583],{"type":47,"value":1935},{"type":42,"tag":228,"props":4585,"children":4586},{"style":361},[4587],{"type":47,"value":1940},{"type":42,"tag":228,"props":4589,"children":4590},{"style":1918},[4591],{"type":47,"value":1945},{"type":42,"tag":228,"props":4593,"children":4594},{"class":230,"line":240},[4595,4599,4603,4607,4611,4615,4619,4623],{"type":42,"tag":228,"props":4596,"children":4597},{"style":1906},[4598],{"type":47,"value":1909},{"type":42,"tag":228,"props":4600,"children":4601},{"style":1912},[4602],{"type":47,"value":1957},{"type":42,"tag":228,"props":4604,"children":4605},{"style":1918},[4606],{"type":47,"value":1921},{"type":42,"tag":228,"props":4608,"children":4609},{"style":1912},[4610],{"type":47,"value":1966},{"type":42,"tag":228,"props":4612,"children":4613},{"style":1918},[4614],{"type":47,"value":1921},{"type":42,"tag":228,"props":4616,"children":4617},{"style":1918},[4618],{"type":47,"value":1935},{"type":42,"tag":228,"props":4620,"children":4621},{"style":1912},[4622],{"type":47,"value":1979},{"type":42,"tag":228,"props":4624,"children":4625},{"style":1918},[4626],{"type":47,"value":1945},{"type":42,"tag":228,"props":4628,"children":4629},{"class":230,"line":249},[4630,4634],{"type":42,"tag":228,"props":4631,"children":4632},{"style":355},[4633],{"type":47,"value":1991},{"type":42,"tag":228,"props":4635,"children":4636},{"style":361},[4637],{"type":47,"value":1996},{"type":42,"tag":228,"props":4639,"children":4640},{"class":230,"line":259},[4641],{"type":42,"tag":228,"props":4642,"children":4643},{"style":355},[4644],{"type":47,"value":2004},{"type":42,"tag":50,"props":4646,"children":4647},{},[4648],{"type":42,"tag":169,"props":4649,"children":4650},{},[4651],{"type":47,"value":4652},"4. Get a harness (or write your own):",{"type":42,"tag":216,"props":4654,"children":4656},{"className":343,"code":4655,"language":345,"meta":221,"style":221},"curl -O https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002Ff8e5fa92b0e37ab597616f554bee254157998227\u002Fcontrib\u002Foss-fuzz\u002Flibpng_read_fuzzer.cc\n",[4657],{"type":42,"tag":224,"props":4658,"children":4659},{"__ignoreMap":221},[4660],{"type":42,"tag":228,"props":4661,"children":4662},{"class":230,"line":231},[4663,4667,4671],{"type":42,"tag":228,"props":4664,"children":4665},{"style":355},[4666],{"type":47,"value":4464},{"type":42,"tag":228,"props":4668,"children":4669},{"style":361},[4670],{"type":47,"value":4474},{"type":42,"tag":228,"props":4672,"children":4673},{"style":361},[4674],{"type":47,"value":4675}," https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002Ff8e5fa92b0e37ab597616f554bee254157998227\u002Fcontrib\u002Foss-fuzz\u002Flibpng_read_fuzzer.cc\n",{"type":42,"tag":50,"props":4677,"children":4678},{},[4679],{"type":42,"tag":169,"props":4680,"children":4681},{},[4682],{"type":47,"value":4683},"5. Prepare corpus and dictionary:",{"type":42,"tag":216,"props":4685,"children":4687},{"className":343,"code":4686,"language":345,"meta":221,"style":221},"mkdir corpus\u002F\ncurl -o corpus\u002Finput.png https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002Facfd50ae0ba3198ad734e5d4dec2b05341e50924\u002Fcontrib\u002Fpngsuite\u002Fiftp1n3p08.png\ncurl -O https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002F2fff013a6935967960a5ae626fc21432807933dd\u002Fcontrib\u002Foss-fuzz\u002Fpng.dict\n",[4688],{"type":42,"tag":224,"props":4689,"children":4690},{"__ignoreMap":221},[4691,4702,4723],{"type":42,"tag":228,"props":4692,"children":4693},{"class":230,"line":231},[4694,4698],{"type":42,"tag":228,"props":4695,"children":4696},{"style":355},[4697],{"type":47,"value":402},{"type":42,"tag":228,"props":4699,"children":4700},{"style":361},[4701],{"type":47,"value":407},{"type":42,"tag":228,"props":4703,"children":4704},{"class":230,"line":240},[4705,4709,4713,4718],{"type":42,"tag":228,"props":4706,"children":4707},{"style":355},[4708],{"type":47,"value":4464},{"type":42,"tag":228,"props":4710,"children":4711},{"style":361},[4712],{"type":47,"value":389},{"type":42,"tag":228,"props":4714,"children":4715},{"style":361},[4716],{"type":47,"value":4717}," corpus\u002Finput.png",{"type":42,"tag":228,"props":4719,"children":4720},{"style":361},[4721],{"type":47,"value":4722}," https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002Facfd50ae0ba3198ad734e5d4dec2b05341e50924\u002Fcontrib\u002Fpngsuite\u002Fiftp1n3p08.png\n",{"type":42,"tag":228,"props":4724,"children":4725},{"class":230,"line":249},[4726,4730,4734],{"type":42,"tag":228,"props":4727,"children":4728},{"style":355},[4729],{"type":47,"value":4464},{"type":42,"tag":228,"props":4731,"children":4732},{"style":361},[4733],{"type":47,"value":4474},{"type":42,"tag":228,"props":4735,"children":4736},{"style":361},[4737],{"type":47,"value":4738}," https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002F2fff013a6935967960a5ae626fc21432807933dd\u002Fcontrib\u002Foss-fuzz\u002Fpng.dict\n",{"type":42,"tag":50,"props":4740,"children":4741},{},[4742],{"type":42,"tag":169,"props":4743,"children":4744},{},[4745],{"type":47,"value":4746},"6. Link and compile fuzzer:",{"type":42,"tag":216,"props":4748,"children":4750},{"className":343,"code":4749,"language":345,"meta":221,"style":221},"clang++ -fsanitize=fuzzer -fsanitize=address libpng_read_fuzzer.cc .libs\u002Flibpng16.a -lz -o fuzz\n",[4751],{"type":42,"tag":224,"props":4752,"children":4753},{"__ignoreMap":221},[4754],{"type":42,"tag":228,"props":4755,"children":4756},{"class":230,"line":231},[4757,4761,4765,4769,4774,4779,4784,4788],{"type":42,"tag":228,"props":4758,"children":4759},{"style":355},[4760],{"type":47,"value":358},{"type":42,"tag":228,"props":4762,"children":4763},{"style":361},[4764],{"type":47,"value":1506},{"type":42,"tag":228,"props":4766,"children":4767},{"style":361},[4768],{"type":47,"value":2035},{"type":42,"tag":228,"props":4770,"children":4771},{"style":361},[4772],{"type":47,"value":4773}," libpng_read_fuzzer.cc",{"type":42,"tag":228,"props":4775,"children":4776},{"style":361},[4777],{"type":47,"value":4778}," .libs\u002Flibpng16.a",{"type":42,"tag":228,"props":4780,"children":4781},{"style":361},[4782],{"type":47,"value":4783}," -lz",{"type":42,"tag":228,"props":4785,"children":4786},{"style":361},[4787],{"type":47,"value":389},{"type":42,"tag":228,"props":4789,"children":4790},{"style":361},[4791],{"type":47,"value":394},{"type":42,"tag":50,"props":4793,"children":4794},{},[4795],{"type":42,"tag":169,"props":4796,"children":4797},{},[4798],{"type":47,"value":4799},"7. Run fuzzing campaign:",{"type":42,"tag":216,"props":4801,"children":4803},{"className":343,"code":4802,"language":345,"meta":221,"style":221},".\u002Ffuzz -close_fd_mask=3 -dict=.\u002Fpng.dict corpus\u002F\n",[4804],{"type":42,"tag":224,"props":4805,"children":4806},{"__ignoreMap":221},[4807],{"type":42,"tag":228,"props":4808,"children":4809},{"class":230,"line":231},[4810,4814,4818,4823],{"type":42,"tag":228,"props":4811,"children":4812},{"style":355},[4813],{"type":47,"value":415},{"type":42,"tag":228,"props":4815,"children":4816},{"style":361},[4817],{"type":47,"value":2668},{"type":42,"tag":228,"props":4819,"children":4820},{"style":361},[4821],{"type":47,"value":4822}," -dict=.\u002Fpng.dict",{"type":42,"tag":228,"props":4824,"children":4825},{"style":361},[4826],{"type":47,"value":407},{"type":42,"tag":427,"props":4828,"children":4830},{"id":4829},"example-2-simple-division-bug",[4831],{"type":47,"value":4832},"Example 2: Simple Division Bug",{"type":42,"tag":50,"props":4834,"children":4835},{},[4836],{"type":47,"value":4837},"Harness that finds a division-by-zero bug:",{"type":42,"tag":216,"props":4839,"children":4841},{"className":218,"code":4840,"language":220,"meta":221,"style":221},"#include \u003Cstdint.h>\n#include \u003Cstddef.h>\n\ndouble divide(uint32_t numerator, uint32_t denominator) {\n    \u002F\u002F Bug: No check if denominator is zero\n    return numerator \u002F denominator;\n}\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    if(size != 2 * sizeof(uint32_t)) {\n        return 0;\n    }\n\n    uint32_t numerator = *(uint32_t*)(data);\n    uint32_t denominator = *(uint32_t*)(data + sizeof(uint32_t));\n\n    divide(numerator, denominator);\n\n    return 0;\n}\n",[4842],{"type":42,"tag":224,"props":4843,"children":4844},{"__ignoreMap":221},[4845,4852,4859,4866,4874,4882,4890,4897,4904,4911,4919,4926,4933,4940,4948,4956,4963,4971,4978,4985],{"type":42,"tag":228,"props":4846,"children":4847},{"class":230,"line":231},[4848],{"type":42,"tag":228,"props":4849,"children":4850},{},[4851],{"type":47,"value":237},{"type":42,"tag":228,"props":4853,"children":4854},{"class":230,"line":240},[4855],{"type":42,"tag":228,"props":4856,"children":4857},{},[4858],{"type":47,"value":246},{"type":42,"tag":228,"props":4860,"children":4861},{"class":230,"line":249},[4862],{"type":42,"tag":228,"props":4863,"children":4864},{"emptyLinePlaceholder":253},[4865],{"type":47,"value":256},{"type":42,"tag":228,"props":4867,"children":4868},{"class":230,"line":259},[4869],{"type":42,"tag":228,"props":4870,"children":4871},{},[4872],{"type":47,"value":4873},"double divide(uint32_t numerator, uint32_t denominator) {\n",{"type":42,"tag":228,"props":4875,"children":4876},{"class":230,"line":268},[4877],{"type":42,"tag":228,"props":4878,"children":4879},{},[4880],{"type":47,"value":4881},"    \u002F\u002F Bug: No check if denominator is zero\n",{"type":42,"tag":228,"props":4883,"children":4884},{"class":230,"line":277},[4885],{"type":42,"tag":228,"props":4886,"children":4887},{},[4888],{"type":47,"value":4889},"    return numerator \u002F denominator;\n",{"type":42,"tag":228,"props":4891,"children":4892},{"class":230,"line":286},[4893],{"type":42,"tag":228,"props":4894,"children":4895},{},[4896],{"type":47,"value":335},{"type":42,"tag":228,"props":4898,"children":4899},{"class":230,"line":294},[4900],{"type":42,"tag":228,"props":4901,"children":4902},{"emptyLinePlaceholder":253},[4903],{"type":47,"value":256},{"type":42,"tag":228,"props":4905,"children":4906},{"class":230,"line":303},[4907],{"type":42,"tag":228,"props":4908,"children":4909},{},[4910],{"type":47,"value":265},{"type":42,"tag":228,"props":4912,"children":4913},{"class":230,"line":312},[4914],{"type":42,"tag":228,"props":4915,"children":4916},{},[4917],{"type":47,"value":4918},"    if(size != 2 * sizeof(uint32_t)) {\n",{"type":42,"tag":228,"props":4920,"children":4921},{"class":230,"line":320},[4922],{"type":42,"tag":228,"props":4923,"children":4924},{},[4925],{"type":47,"value":1288},{"type":42,"tag":228,"props":4927,"children":4928},{"class":230,"line":329},[4929],{"type":42,"tag":228,"props":4930,"children":4931},{},[4932],{"type":47,"value":758},{"type":42,"tag":228,"props":4934,"children":4935},{"class":230,"line":792},[4936],{"type":42,"tag":228,"props":4937,"children":4938},{"emptyLinePlaceholder":253},[4939],{"type":47,"value":256},{"type":42,"tag":228,"props":4941,"children":4942},{"class":230,"line":801},[4943],{"type":42,"tag":228,"props":4944,"children":4945},{},[4946],{"type":47,"value":4947},"    uint32_t numerator = *(uint32_t*)(data);\n",{"type":42,"tag":228,"props":4949,"children":4950},{"class":230,"line":810},[4951],{"type":42,"tag":228,"props":4952,"children":4953},{},[4954],{"type":47,"value":4955},"    uint32_t denominator = *(uint32_t*)(data + sizeof(uint32_t));\n",{"type":42,"tag":228,"props":4957,"children":4958},{"class":230,"line":819},[4959],{"type":42,"tag":228,"props":4960,"children":4961},{"emptyLinePlaceholder":253},[4962],{"type":47,"value":256},{"type":42,"tag":228,"props":4964,"children":4965},{"class":230,"line":827},[4966],{"type":42,"tag":228,"props":4967,"children":4968},{},[4969],{"type":47,"value":4970},"    divide(numerator, denominator);\n",{"type":42,"tag":228,"props":4972,"children":4973},{"class":230,"line":835},[4974],{"type":42,"tag":228,"props":4975,"children":4976},{"emptyLinePlaceholder":253},[4977],{"type":47,"value":256},{"type":42,"tag":228,"props":4979,"children":4980},{"class":230,"line":844},[4981],{"type":42,"tag":228,"props":4982,"children":4983},{},[4984],{"type":47,"value":326},{"type":42,"tag":228,"props":4986,"children":4987},{"class":230,"line":853},[4988],{"type":42,"tag":228,"props":4989,"children":4990},{},[4991],{"type":47,"value":335},{"type":42,"tag":50,"props":4993,"children":4994},{},[4995],{"type":47,"value":4996},"Compile and fuzz:",{"type":42,"tag":216,"props":4998,"children":5000},{"className":343,"code":4999,"language":345,"meta":221,"style":221},"clang++ -fsanitize=fuzzer harness.cc -o fuzz\n.\u002Ffuzz\n",[5001],{"type":42,"tag":224,"props":5002,"children":5003},{"__ignoreMap":221},[5004,5027],{"type":42,"tag":228,"props":5005,"children":5006},{"class":230,"line":231},[5007,5011,5015,5019,5023],{"type":42,"tag":228,"props":5008,"children":5009},{"style":355},[5010],{"type":47,"value":358},{"type":42,"tag":228,"props":5012,"children":5013},{"style":361},[5014],{"type":47,"value":1506},{"type":42,"tag":228,"props":5016,"children":5017},{"style":361},[5018],{"type":47,"value":379},{"type":42,"tag":228,"props":5020,"children":5021},{"style":361},[5022],{"type":47,"value":389},{"type":42,"tag":228,"props":5024,"children":5025},{"style":361},[5026],{"type":47,"value":394},{"type":42,"tag":228,"props":5028,"children":5029},{"class":230,"line":240},[5030],{"type":42,"tag":228,"props":5031,"children":5032},{"style":355},[5033],{"type":47,"value":5034},".\u002Ffuzz\n",{"type":42,"tag":50,"props":5036,"children":5037},{},[5038],{"type":47,"value":5039},"The fuzzer will quickly find inputs causing a crash.",{"type":42,"tag":56,"props":5041,"children":5043},{"id":5042},"advanced-usage",[5044],{"type":47,"value":5045},"Advanced Usage",{"type":42,"tag":427,"props":5047,"children":5049},{"id":5048},"tips-and-tricks",[5050],{"type":47,"value":5051},"Tips and Tricks",{"type":42,"tag":63,"props":5053,"children":5054},{},[5055,5071],{"type":42,"tag":67,"props":5056,"children":5057},{},[5058],{"type":42,"tag":71,"props":5059,"children":5060},{},[5061,5066],{"type":42,"tag":75,"props":5062,"children":5063},{},[5064],{"type":47,"value":5065},"Tip",{"type":42,"tag":75,"props":5067,"children":5068},{},[5069],{"type":47,"value":5070},"Why It Helps",{"type":42,"tag":91,"props":5072,"children":5073},{},[5074,5087,5100,5119,5138,5151],{"type":42,"tag":71,"props":5075,"children":5076},{},[5077,5082],{"type":42,"tag":98,"props":5078,"children":5079},{},[5080],{"type":47,"value":5081},"Start with single-core, switch to AFL++ for multi-core",{"type":42,"tag":98,"props":5083,"children":5084},{},[5085],{"type":47,"value":5086},"libFuzzer harnesses work with AFL++",{"type":42,"tag":71,"props":5088,"children":5089},{},[5090,5095],{"type":42,"tag":98,"props":5091,"children":5092},{},[5093],{"type":47,"value":5094},"Use dictionaries for structured formats",{"type":42,"tag":98,"props":5096,"children":5097},{},[5098],{"type":47,"value":5099},"10-100x faster bug discovery",{"type":42,"tag":71,"props":5101,"children":5102},{},[5103,5114],{"type":42,"tag":98,"props":5104,"children":5105},{},[5106,5108],{"type":47,"value":5107},"Close file descriptors with ",{"type":42,"tag":224,"props":5109,"children":5111},{"className":5110},[],[5112],{"type":47,"value":5113},"-close_fd_mask=3",{"type":42,"tag":98,"props":5115,"children":5116},{},[5117],{"type":47,"value":5118},"Speed boost if SUT writes output",{"type":42,"tag":71,"props":5120,"children":5121},{},[5122,5133],{"type":42,"tag":98,"props":5123,"children":5124},{},[5125,5127],{"type":47,"value":5126},"Set reasonable ",{"type":42,"tag":224,"props":5128,"children":5130},{"className":5129},[],[5131],{"type":47,"value":5132},"-max_len",{"type":42,"tag":98,"props":5134,"children":5135},{},[5136],{"type":47,"value":5137},"Prevents wasted time on huge inputs",{"type":42,"tag":71,"props":5139,"children":5140},{},[5141,5146],{"type":42,"tag":98,"props":5142,"children":5143},{},[5144],{"type":47,"value":5145},"Run for days\u002Fweeks, not minutes",{"type":42,"tag":98,"props":5147,"children":5148},{},[5149],{"type":47,"value":5150},"Coverage plateaus take time to break",{"type":42,"tag":71,"props":5152,"children":5153},{},[5154,5159],{"type":42,"tag":98,"props":5155,"children":5156},{},[5157],{"type":47,"value":5158},"Use seed corpus from test suites",{"type":42,"tag":98,"props":5160,"children":5161},{},[5162],{"type":47,"value":5163},"Starts fuzzing from valid inputs",{"type":42,"tag":427,"props":5165,"children":5167},{"id":5166},"structure-aware-fuzzing",[5168],{"type":47,"value":5169},"Structure-Aware Fuzzing",{"type":42,"tag":50,"props":5171,"children":5172},{},[5173],{"type":47,"value":5174},"For highly structured inputs (e.g., complex protocols, file formats), use libprotobuf-mutator:",{"type":42,"tag":175,"props":5176,"children":5177},{},[5178,5183,5188],{"type":42,"tag":179,"props":5179,"children":5180},{},[5181],{"type":47,"value":5182},"Define input structure using Protocol Buffers",{"type":42,"tag":179,"props":5184,"children":5185},{},[5186],{"type":47,"value":5187},"libFuzzer mutates protobuf messages (structure-preserving mutations)",{"type":42,"tag":179,"props":5189,"children":5190},{},[5191],{"type":47,"value":5192},"Harness converts protobuf to native format",{"type":42,"tag":50,"props":5194,"children":5195},{},[5196,5198,5205],{"type":47,"value":5197},"See ",{"type":42,"tag":614,"props":5199,"children":5202},{"href":5200,"rel":5201},"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Fdocs\u002Fstructure-aware-fuzzing.md",[618],[5203],{"type":47,"value":5204},"structure-aware fuzzing documentation",{"type":47,"value":5206}," for details.",{"type":42,"tag":427,"props":5208,"children":5210},{"id":5209},"custom-mutators",[5211],{"type":47,"value":5212},"Custom Mutators",{"type":42,"tag":50,"props":5214,"children":5215},{},[5216],{"type":47,"value":5217},"libFuzzer allows custom mutators for specialized fuzzing:",{"type":42,"tag":216,"props":5219,"children":5221},{"className":218,"code":5220,"language":220,"meta":221,"style":221},"extern \"C\" size_t LLVMFuzzerCustomMutator(uint8_t *Data, size_t Size,\n                                          size_t MaxSize, unsigned int Seed) {\n    \u002F\u002F Custom mutation logic\n    return new_size;\n}\n\nextern \"C\" size_t LLVMFuzzerCustomCrossOver(const uint8_t *Data1, size_t Size1,\n                                            const uint8_t *Data2, size_t Size2,\n                                            uint8_t *Out, size_t MaxOutSize,\n                                            unsigned int Seed) {\n    \u002F\u002F Custom crossover logic\n    return new_size;\n}\n",[5222],{"type":42,"tag":224,"props":5223,"children":5224},{"__ignoreMap":221},[5225,5233,5241,5249,5257,5264,5271,5279,5287,5295,5303,5311,5318],{"type":42,"tag":228,"props":5226,"children":5227},{"class":230,"line":231},[5228],{"type":42,"tag":228,"props":5229,"children":5230},{},[5231],{"type":47,"value":5232},"extern \"C\" size_t LLVMFuzzerCustomMutator(uint8_t *Data, size_t Size,\n",{"type":42,"tag":228,"props":5234,"children":5235},{"class":230,"line":240},[5236],{"type":42,"tag":228,"props":5237,"children":5238},{},[5239],{"type":47,"value":5240},"                                          size_t MaxSize, unsigned int Seed) {\n",{"type":42,"tag":228,"props":5242,"children":5243},{"class":230,"line":249},[5244],{"type":42,"tag":228,"props":5245,"children":5246},{},[5247],{"type":47,"value":5248},"    \u002F\u002F Custom mutation logic\n",{"type":42,"tag":228,"props":5250,"children":5251},{"class":230,"line":259},[5252],{"type":42,"tag":228,"props":5253,"children":5254},{},[5255],{"type":47,"value":5256},"    return new_size;\n",{"type":42,"tag":228,"props":5258,"children":5259},{"class":230,"line":268},[5260],{"type":42,"tag":228,"props":5261,"children":5262},{},[5263],{"type":47,"value":335},{"type":42,"tag":228,"props":5265,"children":5266},{"class":230,"line":277},[5267],{"type":42,"tag":228,"props":5268,"children":5269},{"emptyLinePlaceholder":253},[5270],{"type":47,"value":256},{"type":42,"tag":228,"props":5272,"children":5273},{"class":230,"line":286},[5274],{"type":42,"tag":228,"props":5275,"children":5276},{},[5277],{"type":47,"value":5278},"extern \"C\" size_t LLVMFuzzerCustomCrossOver(const uint8_t *Data1, size_t Size1,\n",{"type":42,"tag":228,"props":5280,"children":5281},{"class":230,"line":294},[5282],{"type":42,"tag":228,"props":5283,"children":5284},{},[5285],{"type":47,"value":5286},"                                            const uint8_t *Data2, size_t Size2,\n",{"type":42,"tag":228,"props":5288,"children":5289},{"class":230,"line":303},[5290],{"type":42,"tag":228,"props":5291,"children":5292},{},[5293],{"type":47,"value":5294},"                                            uint8_t *Out, size_t MaxOutSize,\n",{"type":42,"tag":228,"props":5296,"children":5297},{"class":230,"line":312},[5298],{"type":42,"tag":228,"props":5299,"children":5300},{},[5301],{"type":47,"value":5302},"                                            unsigned int Seed) {\n",{"type":42,"tag":228,"props":5304,"children":5305},{"class":230,"line":320},[5306],{"type":42,"tag":228,"props":5307,"children":5308},{},[5309],{"type":47,"value":5310},"    \u002F\u002F Custom crossover logic\n",{"type":42,"tag":228,"props":5312,"children":5313},{"class":230,"line":329},[5314],{"type":42,"tag":228,"props":5315,"children":5316},{},[5317],{"type":47,"value":5256},{"type":42,"tag":228,"props":5319,"children":5320},{"class":230,"line":792},[5321],{"type":42,"tag":228,"props":5322,"children":5323},{},[5324],{"type":47,"value":335},{"type":42,"tag":427,"props":5326,"children":5328},{"id":5327},"performance-tuning",[5329],{"type":47,"value":5330},"Performance Tuning",{"type":42,"tag":63,"props":5332,"children":5333},{},[5334,5350],{"type":42,"tag":67,"props":5335,"children":5336},{},[5337],{"type":42,"tag":71,"props":5338,"children":5339},{},[5340,5345],{"type":42,"tag":75,"props":5341,"children":5342},{},[5343],{"type":47,"value":5344},"Setting",{"type":42,"tag":75,"props":5346,"children":5347},{},[5348],{"type":47,"value":5349},"Impact",{"type":42,"tag":91,"props":5351,"children":5352},{},[5353,5369,5386,5403,5416,5441],{"type":42,"tag":71,"props":5354,"children":5355},{},[5356,5364],{"type":42,"tag":98,"props":5357,"children":5358},{},[5359],{"type":42,"tag":224,"props":5360,"children":5362},{"className":5361},[],[5363],{"type":47,"value":5113},{"type":42,"tag":98,"props":5365,"children":5366},{},[5367],{"type":47,"value":5368},"Closes stdout\u002Fstderr, speeds up fuzzing",{"type":42,"tag":71,"props":5370,"children":5371},{},[5372,5381],{"type":42,"tag":98,"props":5373,"children":5374},{},[5375],{"type":42,"tag":224,"props":5376,"children":5378},{"className":5377},[],[5379],{"type":47,"value":5380},"-max_len=\u003Creasonable_size>",{"type":42,"tag":98,"props":5382,"children":5383},{},[5384],{"type":47,"value":5385},"Avoids wasting time on huge inputs",{"type":42,"tag":71,"props":5387,"children":5388},{},[5389,5398],{"type":42,"tag":98,"props":5390,"children":5391},{},[5392],{"type":42,"tag":224,"props":5393,"children":5395},{"className":5394},[],[5396],{"type":47,"value":5397},"-timeout=\u003Cseconds>",{"type":42,"tag":98,"props":5399,"children":5400},{},[5401],{"type":47,"value":5402},"Detects hangs, prevents stuck executions",{"type":42,"tag":71,"props":5404,"children":5405},{},[5406,5411],{"type":42,"tag":98,"props":5407,"children":5408},{},[5409],{"type":47,"value":5410},"Disable ASan for baseline",{"type":42,"tag":98,"props":5412,"children":5413},{},[5414],{"type":47,"value":5415},"2-4x speed boost (but misses memory bugs)",{"type":42,"tag":71,"props":5417,"children":5418},{},[5419,5436],{"type":42,"tag":98,"props":5420,"children":5421},{},[5422,5423,5429,5430],{"type":47,"value":4327},{"type":42,"tag":224,"props":5424,"children":5426},{"className":5425},[],[5427],{"type":47,"value":5428},"-jobs",{"type":47,"value":1722},{"type":42,"tag":224,"props":5431,"children":5433},{"className":5432},[],[5434],{"type":47,"value":5435},"-workers",{"type":42,"tag":98,"props":5437,"children":5438},{},[5439],{"type":47,"value":5440},"Limited multi-core support",{"type":42,"tag":71,"props":5442,"children":5443},{},[5444,5449],{"type":42,"tag":98,"props":5445,"children":5446},{},[5447],{"type":47,"value":5448},"Run on Linux",{"type":42,"tag":98,"props":5450,"children":5451},{},[5452],{"type":47,"value":5453},"Best platform support and performance",{"type":42,"tag":56,"props":5455,"children":5457},{"id":5456},"troubleshooting",[5458],{"type":47,"value":5459},"Troubleshooting",{"type":42,"tag":63,"props":5461,"children":5462},{},[5463,5483],{"type":42,"tag":67,"props":5464,"children":5465},{},[5466],{"type":42,"tag":71,"props":5467,"children":5468},{},[5469,5474,5479],{"type":42,"tag":75,"props":5470,"children":5471},{},[5472],{"type":47,"value":5473},"Problem",{"type":42,"tag":75,"props":5475,"children":5476},{},[5477],{"type":47,"value":5478},"Cause",{"type":42,"tag":75,"props":5480,"children":5481},{},[5482],{"type":47,"value":4311},{"type":42,"tag":91,"props":5484,"children":5485},{},[5486,5504,5529,5552,5577,5595,5618,5644,5662],{"type":42,"tag":71,"props":5487,"children":5488},{},[5489,5494,5499],{"type":42,"tag":98,"props":5490,"children":5491},{},[5492],{"type":47,"value":5493},"No crashes found after hours",{"type":42,"tag":98,"props":5495,"children":5496},{},[5497],{"type":47,"value":5498},"Poor corpus, low coverage",{"type":42,"tag":98,"props":5500,"children":5501},{},[5502],{"type":47,"value":5503},"Add seed inputs, use dictionary, check harness",{"type":42,"tag":71,"props":5505,"children":5506},{},[5507,5512,5517],{"type":42,"tag":98,"props":5508,"children":5509},{},[5510],{"type":47,"value":5511},"Very slow executions\u002Fsec (\u003C100)",{"type":42,"tag":98,"props":5513,"children":5514},{},[5515],{"type":47,"value":5516},"Target too complex, excessive logging",{"type":42,"tag":98,"props":5518,"children":5519},{},[5520,5522,5527],{"type":47,"value":5521},"Optimize target, use ",{"type":42,"tag":224,"props":5523,"children":5525},{"className":5524},[],[5526],{"type":47,"value":5113},{"type":47,"value":5528},", reduce logging",{"type":42,"tag":71,"props":5530,"children":5531},{},[5532,5536,5541],{"type":42,"tag":98,"props":5533,"children":5534},{},[5535],{"type":47,"value":4343},{"type":42,"tag":98,"props":5537,"children":5538},{},[5539],{"type":47,"value":5540},"ASan's 20TB virtual memory",{"type":42,"tag":98,"props":5542,"children":5543},{},[5544,5545,5550],{"type":47,"value":4348},{"type":42,"tag":224,"props":5546,"children":5548},{"className":5547},[],[5549],{"type":47,"value":4098},{"type":47,"value":5551}," to disable RSS limit",{"type":42,"tag":71,"props":5553,"children":5554},{},[5555,5560,5565],{"type":42,"tag":98,"props":5556,"children":5557},{},[5558],{"type":47,"value":5559},"Fuzzer stops after first crash",{"type":42,"tag":98,"props":5561,"children":5562},{},[5563],{"type":47,"value":5564},"Default behavior",{"type":42,"tag":98,"props":5566,"children":5567},{},[5568,5569,5575],{"type":47,"value":4327},{"type":42,"tag":224,"props":5570,"children":5572},{"className":5571},[],[5573],{"type":47,"value":5574},"-fork=1 -ignore_crashes=1",{"type":47,"value":5576}," to continue",{"type":42,"tag":71,"props":5578,"children":5579},{},[5580,5585,5590],{"type":42,"tag":98,"props":5581,"children":5582},{},[5583],{"type":47,"value":5584},"Can't reproduce crash",{"type":42,"tag":98,"props":5586,"children":5587},{},[5588],{"type":47,"value":5589},"Non-determinism in harness\u002Ftarget",{"type":42,"tag":98,"props":5591,"children":5592},{},[5593],{"type":47,"value":5594},"Remove random number generation, global state",{"type":42,"tag":71,"props":5596,"children":5597},{},[5598,5608,5613],{"type":42,"tag":98,"props":5599,"children":5600},{},[5601,5603],{"type":47,"value":5602},"Linking errors with ",{"type":42,"tag":224,"props":5604,"children":5606},{"className":5605},[],[5607],{"type":47,"value":1453},{"type":42,"tag":98,"props":5609,"children":5610},{},[5611],{"type":47,"value":5612},"Missing libFuzzer runtime",{"type":42,"tag":98,"props":5614,"children":5615},{},[5616],{"type":47,"value":5617},"Ensure using Clang, check LLVM installation",{"type":42,"tag":71,"props":5619,"children":5620},{},[5621,5626,5631],{"type":42,"tag":98,"props":5622,"children":5623},{},[5624],{"type":47,"value":5625},"GCC project won't compile with Clang",{"type":42,"tag":98,"props":5627,"children":5628},{},[5629],{"type":47,"value":5630},"GCC-specific code",{"type":42,"tag":98,"props":5632,"children":5633},{},[5634,5636,5642],{"type":47,"value":5635},"Switch to AFL++ with ",{"type":42,"tag":224,"props":5637,"children":5639},{"className":5638},[],[5640],{"type":47,"value":5641},"gcc_plugin",{"type":47,"value":5643}," instead",{"type":42,"tag":71,"props":5645,"children":5646},{},[5647,5652,5657],{"type":42,"tag":98,"props":5648,"children":5649},{},[5650],{"type":47,"value":5651},"Coverage not improving",{"type":42,"tag":98,"props":5653,"children":5654},{},[5655],{"type":47,"value":5656},"Corpus plateau",{"type":42,"tag":98,"props":5658,"children":5659},{},[5660],{"type":47,"value":5661},"Run longer, add dictionary, improve seeds, check coverage report",{"type":42,"tag":71,"props":5663,"children":5664},{},[5665,5670,5675],{"type":42,"tag":98,"props":5666,"children":5667},{},[5668],{"type":47,"value":5669},"Crashes but ASan doesn't trigger",{"type":42,"tag":98,"props":5671,"children":5672},{},[5673],{"type":47,"value":5674},"Memory error not detected without ASan",{"type":42,"tag":98,"props":5676,"children":5677},{},[5678,5680],{"type":47,"value":5679},"Recompile with ",{"type":42,"tag":224,"props":5681,"children":5683},{"className":5682},[],[5684],{"type":47,"value":1785},{"type":42,"tag":56,"props":5686,"children":5688},{"id":5687},"related-skills",[5689],{"type":47,"value":5690},"Related Skills",{"type":42,"tag":427,"props":5692,"children":5694},{"id":5693},"technique-skills",[5695],{"type":47,"value":5696},"Technique Skills",{"type":42,"tag":63,"props":5698,"children":5699},{},[5700,5716],{"type":42,"tag":67,"props":5701,"children":5702},{},[5703],{"type":42,"tag":71,"props":5704,"children":5705},{},[5706,5711],{"type":42,"tag":75,"props":5707,"children":5708},{},[5709],{"type":47,"value":5710},"Skill",{"type":42,"tag":75,"props":5712,"children":5713},{},[5714],{"type":47,"value":5715},"Use Case",{"type":42,"tag":91,"props":5717,"children":5718},{},[5719,5734,5749,5764,5779,5794],{"type":42,"tag":71,"props":5720,"children":5721},{},[5722,5729],{"type":42,"tag":98,"props":5723,"children":5724},{},[5725],{"type":42,"tag":169,"props":5726,"children":5727},{},[5728],{"type":47,"value":1428},{"type":42,"tag":98,"props":5730,"children":5731},{},[5732],{"type":47,"value":5733},"Detailed guidance on writing effective harnesses, structure-aware fuzzing, and FuzzedDataProvider usage",{"type":42,"tag":71,"props":5735,"children":5736},{},[5737,5744],{"type":42,"tag":98,"props":5738,"children":5739},{},[5740],{"type":42,"tag":169,"props":5741,"children":5742},{},[5743],{"type":47,"value":1720},{"type":42,"tag":98,"props":5745,"children":5746},{},[5747],{"type":47,"value":5748},"Memory error detection configuration, ASAN_OPTIONS, and troubleshooting",{"type":42,"tag":71,"props":5750,"children":5751},{},[5752,5759],{"type":42,"tag":98,"props":5753,"children":5754},{},[5755],{"type":42,"tag":169,"props":5756,"children":5757},{},[5758],{"type":47,"value":1727},{"type":42,"tag":98,"props":5760,"children":5761},{},[5762],{"type":47,"value":5763},"Detecting undefined behavior during fuzzing",{"type":42,"tag":71,"props":5765,"children":5766},{},[5767,5774],{"type":42,"tag":98,"props":5768,"children":5769},{},[5770],{"type":42,"tag":169,"props":5771,"children":5772},{},[5773],{"type":47,"value":3528},{"type":42,"tag":98,"props":5775,"children":5776},{},[5777],{"type":47,"value":5778},"Measuring fuzzing effectiveness and identifying untested code paths",{"type":42,"tag":71,"props":5780,"children":5781},{},[5782,5789],{"type":42,"tag":98,"props":5783,"children":5784},{},[5785],{"type":42,"tag":169,"props":5786,"children":5787},{},[5788],{"type":47,"value":2442},{"type":42,"tag":98,"props":5790,"children":5791},{},[5792],{"type":47,"value":5793},"Building and managing seed corpora, corpus minimization strategies",{"type":42,"tag":71,"props":5795,"children":5796},{},[5797,5804],{"type":42,"tag":98,"props":5798,"children":5799},{},[5800],{"type":42,"tag":169,"props":5801,"children":5802},{},[5803],{"type":47,"value":3524},{"type":42,"tag":98,"props":5805,"children":5806},{},[5807],{"type":47,"value":5808},"Creating format-specific dictionaries for faster bug discovery",{"type":42,"tag":427,"props":5810,"children":5812},{"id":5811},"related-fuzzers",[5813],{"type":47,"value":5814},"Related Fuzzers",{"type":42,"tag":63,"props":5816,"children":5817},{},[5818,5833],{"type":42,"tag":67,"props":5819,"children":5820},{},[5821],{"type":42,"tag":71,"props":5822,"children":5823},{},[5824,5828],{"type":42,"tag":75,"props":5825,"children":5826},{},[5827],{"type":47,"value":5710},{"type":42,"tag":75,"props":5829,"children":5830},{},[5831],{"type":47,"value":5832},"When to Consider",{"type":42,"tag":91,"props":5834,"children":5835},{},[5836,5852,5868],{"type":42,"tag":71,"props":5837,"children":5838},{},[5839,5847],{"type":42,"tag":98,"props":5840,"children":5841},{},[5842],{"type":42,"tag":169,"props":5843,"children":5844},{},[5845],{"type":47,"value":5846},"aflpp",{"type":42,"tag":98,"props":5848,"children":5849},{},[5850],{"type":47,"value":5851},"When you need serious multi-core fuzzing, or when libFuzzer coverage plateaus",{"type":42,"tag":71,"props":5853,"children":5854},{},[5855,5863],{"type":42,"tag":98,"props":5856,"children":5857},{},[5858],{"type":42,"tag":169,"props":5859,"children":5860},{},[5861],{"type":47,"value":5862},"honggfuzz",{"type":42,"tag":98,"props":5864,"children":5865},{},[5866],{"type":47,"value":5867},"When you want hardware-based coverage feedback on Linux",{"type":42,"tag":71,"props":5869,"children":5870},{},[5871,5879],{"type":42,"tag":98,"props":5872,"children":5873},{},[5874],{"type":42,"tag":169,"props":5875,"children":5876},{},[5877],{"type":47,"value":5878},"libafl",{"type":42,"tag":98,"props":5880,"children":5881},{},[5882],{"type":47,"value":5883},"When building custom fuzzers or conducting fuzzing research",{"type":42,"tag":56,"props":5885,"children":5887},{"id":5886},"resources",[5888],{"type":47,"value":5889},"Resources",{"type":42,"tag":427,"props":5891,"children":5893},{"id":5892},"official-documentation",[5894],{"type":47,"value":5895},"Official Documentation",{"type":42,"tag":175,"props":5897,"children":5898},{},[5899,5911,5923],{"type":42,"tag":179,"props":5900,"children":5901},{},[5902,5909],{"type":42,"tag":614,"props":5903,"children":5906},{"href":5904,"rel":5905},"https:\u002F\u002Fllvm.org\u002Fdocs\u002FLibFuzzer.html",[618],[5907],{"type":47,"value":5908},"LLVM libFuzzer Documentation",{"type":47,"value":5910}," - Official reference",{"type":42,"tag":179,"props":5912,"children":5913},{},[5914,5921],{"type":42,"tag":614,"props":5915,"children":5918},{"href":5916,"rel":5917},"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Ftutorial\u002FlibFuzzerTutorial.md",[618],[5919],{"type":47,"value":5920},"libFuzzer Tutorial by Google",{"type":47,"value":5922}," - Step-by-step guide",{"type":42,"tag":179,"props":5924,"children":5925},{},[5926,5933],{"type":42,"tag":614,"props":5927,"children":5930},{"href":5928,"rel":5929},"https:\u002F\u002Fclang.llvm.org\u002Fdocs\u002FSanitizerCoverage.html",[618],[5931],{"type":47,"value":5932},"SanitizerCoverage",{"type":47,"value":5934}," - Coverage instrumentation details",{"type":42,"tag":427,"props":5936,"children":5938},{"id":5937},"advanced-topics",[5939],{"type":47,"value":5940},"Advanced Topics",{"type":42,"tag":175,"props":5942,"children":5943},{},[5944,5953,5963],{"type":42,"tag":179,"props":5945,"children":5946},{},[5947],{"type":42,"tag":614,"props":5948,"children":5950},{"href":5200,"rel":5949},[618],[5951],{"type":47,"value":5952},"Structure-Aware Fuzzing with libprotobuf-mutator",{"type":42,"tag":179,"props":5954,"children":5955},{},[5956],{"type":42,"tag":614,"props":5957,"children":5960},{"href":5958,"rel":5959},"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Ffuzzing\u002Fblob\u002Fmaster\u002Fdocs\u002Fsplit-inputs.md",[618],[5961],{"type":47,"value":5962},"Split Inputs in libFuzzer",{"type":42,"tag":179,"props":5964,"children":5965},{},[5966],{"type":42,"tag":614,"props":5967,"children":5969},{"href":1241,"rel":5968},[618],[5970],{"type":47,"value":5971},"FuzzedDataProvider Header",{"type":42,"tag":427,"props":5973,"children":5975},{"id":5974},"example-projects",[5976],{"type":47,"value":5977},"Example Projects",{"type":42,"tag":175,"props":5979,"children":5980},{},[5981,5993],{"type":42,"tag":179,"props":5982,"children":5983},{},[5984,5991],{"type":42,"tag":614,"props":5985,"children":5988},{"href":5986,"rel":5987},"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Foss-fuzz",[618],[5989],{"type":47,"value":5990},"OSS-Fuzz",{"type":47,"value":5992}," - Continuous fuzzing for open-source projects (many libFuzzer examples)",{"type":42,"tag":179,"props":5994,"children":5995},{},[5996,6003],{"type":42,"tag":614,"props":5997,"children":6000},{"href":5998,"rel":5999},"https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus\u002Ftree\u002Fstable\u002Fdictionaries",[618],[6001],{"type":47,"value":6002},"AFL++ Dictionary Collection",{"type":47,"value":6004}," - Reusable dictionaries",{"type":42,"tag":6006,"props":6007,"children":6008},"style",{},[6009],{"type":47,"value":6010},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":6012,"total":6162},[6013,6025,6034,6054,6069,6082,6094,6104,6117,6128,6140,6151],{"slug":1720,"name":1720,"fn":6014,"description":6015,"org":6016,"tags":6017,"stars":23,"repoUrl":24,"updatedAt":6024},"detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6018,6019,6022,6023],{"name":18,"slug":19,"type":16},{"name":6020,"slug":6021,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:14.925095",{"slug":5846,"name":5846,"fn":6026,"description":6027,"org":6028,"tags":6029,"stars":23,"repoUrl":24,"updatedAt":6033},"perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6030,6031,6032],{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:12.433192",{"slug":6035,"name":6035,"fn":6036,"description":6037,"org":6038,"tags":6039,"stars":23,"repoUrl":24,"updatedAt":6053},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6040,6043,6046,6049,6052],{"name":6041,"slug":6042,"type":16},"Agents","agents",{"name":6044,"slug":6045,"type":16},"CI\u002FCD","ci-cd",{"name":6047,"slug":6048,"type":16},"Code Analysis","code-analysis",{"name":6050,"slug":6051,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":6055,"name":6055,"fn":6056,"description":6057,"org":6058,"tags":6059,"stars":23,"repoUrl":24,"updatedAt":6068},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6060,6063,6064,6065],{"name":6061,"slug":6062,"type":16},"Audit","audit",{"name":6047,"slug":6048,"type":16},{"name":14,"slug":15,"type":16},{"name":6066,"slug":6067,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":6070,"name":6070,"fn":6071,"description":6072,"org":6073,"tags":6074,"stars":23,"repoUrl":24,"updatedAt":6081},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6075,6078],{"name":6076,"slug":6077,"type":16},"Engineering","engineering",{"name":6079,"slug":6080,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":6083,"name":6083,"fn":6084,"description":6085,"org":6086,"tags":6087,"stars":23,"repoUrl":24,"updatedAt":6093},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6088,6091,6092],{"name":6089,"slug":6090,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:14.575191",{"slug":6095,"name":6095,"fn":6096,"description":6097,"org":6098,"tags":6099,"stars":23,"repoUrl":24,"updatedAt":6103},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6100,6101,6102],{"name":6061,"slug":6062,"type":16},{"name":6047,"slug":6048,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",{"slug":6105,"name":6105,"fn":6106,"description":6107,"org":6108,"tags":6109,"stars":23,"repoUrl":24,"updatedAt":6116},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6110,6113,6114,6115],{"name":6111,"slug":6112,"type":16},"Architecture","architecture",{"name":6061,"slug":6062,"type":16},{"name":6047,"slug":6048,"type":16},{"name":6076,"slug":6077,"type":16},"2026-07-18T05:47:40.122449",{"slug":6118,"name":6118,"fn":6119,"description":6120,"org":6121,"tags":6122,"stars":23,"repoUrl":24,"updatedAt":6127},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6123,6124,6125,6126],{"name":6061,"slug":6062,"type":16},{"name":6047,"slug":6048,"type":16},{"name":6076,"slug":6077,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":6129,"name":6129,"fn":6130,"description":6131,"org":6132,"tags":6133,"stars":23,"repoUrl":24,"updatedAt":6139},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6134,6135,6138],{"name":6061,"slug":6062,"type":16},{"name":6136,"slug":6137,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":6141,"name":6141,"fn":6142,"description":6143,"org":6144,"tags":6145,"stars":23,"repoUrl":24,"updatedAt":6150},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6146,6147,6148,6149],{"name":6061,"slug":6062,"type":16},{"name":18,"slug":19,"type":16},{"name":6047,"slug":6048,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":6152,"name":6152,"fn":6153,"description":6154,"org":6155,"tags":6156,"stars":23,"repoUrl":24,"updatedAt":6161},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6157,6158,6159,6160],{"name":6061,"slug":6062,"type":16},{"name":6047,"slug":6048,"type":16},{"name":14,"slug":15,"type":16},{"name":6066,"slug":6067,"type":16},"2026-07-18T05:47:42.84568",111,{"items":6164,"total":6210},[6165,6172,6178,6186,6193,6198,6204],{"slug":1720,"name":1720,"fn":6014,"description":6015,"org":6166,"tags":6167,"stars":23,"repoUrl":24,"updatedAt":6024},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6168,6169,6170,6171],{"name":18,"slug":19,"type":16},{"name":6020,"slug":6021,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":5846,"name":5846,"fn":6026,"description":6027,"org":6173,"tags":6174,"stars":23,"repoUrl":24,"updatedAt":6033},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6175,6176,6177],{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":6035,"name":6035,"fn":6036,"description":6037,"org":6179,"tags":6180,"stars":23,"repoUrl":24,"updatedAt":6053},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6181,6182,6183,6184,6185],{"name":6041,"slug":6042,"type":16},{"name":6044,"slug":6045,"type":16},{"name":6047,"slug":6048,"type":16},{"name":6050,"slug":6051,"type":16},{"name":14,"slug":15,"type":16},{"slug":6055,"name":6055,"fn":6056,"description":6057,"org":6187,"tags":6188,"stars":23,"repoUrl":24,"updatedAt":6068},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6189,6190,6191,6192],{"name":6061,"slug":6062,"type":16},{"name":6047,"slug":6048,"type":16},{"name":14,"slug":15,"type":16},{"name":6066,"slug":6067,"type":16},{"slug":6070,"name":6070,"fn":6071,"description":6072,"org":6194,"tags":6195,"stars":23,"repoUrl":24,"updatedAt":6081},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6196,6197],{"name":6076,"slug":6077,"type":16},{"name":6079,"slug":6080,"type":16},{"slug":6083,"name":6083,"fn":6084,"description":6085,"org":6199,"tags":6200,"stars":23,"repoUrl":24,"updatedAt":6093},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6201,6202,6203],{"name":6089,"slug":6090,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":6095,"name":6095,"fn":6096,"description":6097,"org":6205,"tags":6206,"stars":23,"repoUrl":24,"updatedAt":6103},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[6207,6208,6209],{"name":6061,"slug":6062,"type":16},{"name":6047,"slug":6048,"type":16},{"name":14,"slug":15,"type":16},77]