fuzz: stream cmin

This commit is contained in:
Mitchell Hashimoto
2026-03-01 15:00:04 -08:00
parent dce2326c4c
commit 8cebcaa468
660 changed files with 232 additions and 30 deletions

Binary file not shown.

View File

@@ -5,7 +5,8 @@
- Run a specific fuzzer with `zig build run-<name>` (e.g. `zig build run-parser`)
- Corpus directories follow the naming convention `corpus/<fuzzer>-<variant>`
(e.g. `corpus/parser-initial`, `corpus/stream-cmin`).
- After running `afl-cmin`/`afl-tmin`, run `corpus/sanitize-filenames.sh`
- Do NOT run `afl-tmin` unless explicitly requested — it is very slow.
- After running `afl-cmin`, run `corpus/sanitize-filenames.sh`
before committing to replace colons with underscores (colons are invalid
on Windows NTFS).
@@ -31,11 +32,5 @@ not from a file argument. This affects how you invoke AFL++ tools:
-- zig-out/bin/fuzz-stream
```
- **`afl-tmin`**: Also requires `AFL_NO_FORKSRV=1`, no `@@`:
```sh
AFL_NO_FORKSRV=1 afl-tmin -i <input> -o <output> -- zig-out/bin/fuzz-stream
```
If you pass `@@` or a filename argument, `afl-showmap`/`afl-cmin`/`afl-tmin`
If you pass `@@` or a filename argument, `afl-showmap`/`afl-cmin`
will see only ~4 tuples (the C main paths) and produce useless results.

View File

@@ -104,29 +104,10 @@ AFL_NO_FORKSRV=1 afl-cmin.bash \
a bug in AFL++ 4.35c. Use the `afl-cmin.bash` script instead (typically
found in AFL++'s `libexec` directory).
### Test case minimization (`afl-tmin`)
Shrink each file in the minimized corpus to the smallest input that
preserves its unique coverage:
```sh
mkdir -p corpus/stream-min
for f in corpus/stream-cmin/*; do
AFL_NO_FORKSRV=1 afl-tmin \
-i "$f" \
-o "corpus/stream-min/$(basename "$f")" \
-- zig-out/bin/fuzz-stream
done
```
This is slow (hundreds of executions per file) but produces the most
compact corpus. It can be skipped if you only need edge-level
deduplication from `afl-cmin`.
### Windows compatibility
AFL++ output filenames contain colons (e.g., `id:000024,time:0,...`), which
are invalid on Windows (NTFS). After running `afl-cmin` or `afl-tmin`,
are invalid on Windows (NTFS). After running `afl-cmin`,
rename the output files to replace colons with underscores before committing:
```sh
@@ -140,3 +121,4 @@ rename the output files to replace colons with underscores before committing:
| `corpus/parser-initial/` | Hand-written seed inputs for vt-parser |
| `corpus/parser-cmin/` | Output of `afl-cmin` (edge-deduplicated corpus) |
| `corpus/stream-initial/` | Hand-written seed inputs for vt-stream |
| `corpus/stream-cmin/` | Output of `afl-cmin` (edge-deduplicated corpus) |

View File

@@ -12,7 +12,7 @@ const Fuzzer = struct {
pub fn corpus(comptime self: Fuzzer) []const u8 {
// Change this suffix to use cmin vs initial corpus
return "corpus/" ++ self.name ++ "-initial";
return "corpus/" ++ self.name ++ "-cmin";
}
};

View File

@@ -10,7 +10,7 @@ cd "$(dirname "$0")" || exit 1
if [ $# -gt 0 ]; then
set -- "$@"
else
set -- parser-cmin parser-min
set -- parser-cmin stream-cmin
fi
for dir in "$@"; do

View File

@@ -0,0 +1,2 @@
ABCDhello
world

View File

@@ -0,0 +1 @@
DDDM

View File

@@ -0,0 +1 @@
]52;c;SGVsbG8=

View File

@@ -0,0 +1 @@
Hsllo,<2C><> Wo<57>ld!

View File

@@ -0,0 +1,2 @@
]0yĻ<79>]MMy<4D><79><EFBFBD>
]0;l,o

View File

@@ -0,0 +1 @@
!M

View File

@@ -0,0 +1 @@
<EFBFBD>Hel,N, Uorlo!

View File

@@ -0,0 +1 @@
52;c;!

View File

@@ -0,0 +1 @@
0;20Hfoored

View File

@@ -0,0 +1,2 @@
<EFBFBD><EFBFBD>llo)lo) <20>orld <20>
<20>orld <20>

View File

@@ -0,0 +1 @@
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>orlq!

View File

@@ -0,0 +1 @@
y<EFBFBD>Ķ  0Hello,]5

View File

@@ -0,0 +1 @@
<EFBFBD>Hell=o,Z<><5A><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><7F>World

View File

@@ -0,0 +1 @@
Hellg,<2C>lTo,WW

View File

@@ -0,0 +1 @@
l)----<0F>d!

View File

@@ -0,0 +1 @@
<01><>ld!

View File

@@ -0,0 +1,2 @@
 rldWorld<6C>r
lllllllllld!

View File

@@ -0,0 +1 @@
<04><04>llo,WorldHe

View File

@@ -0,0 +1 @@
55:0:0m[58:5:200m

View File

@@ -0,0 +1 @@
4344h[/25h"[?1<><31>?1<><31><EFBFBD><EFBFBD><EFBFBD>?1<><31><EFBFBD>

View File

@@ -0,0 +1 @@
<EFBFBD><EFBFBD><03><><EFBFBD><EFBFBD><7F><EFBFBD><7F><EFBFBD><EFBFBD><EFBFBD>!

View File

@@ -0,0 +1,2 @@
<0F>- Wor<6F>d<EFBFBD>!

View File

@@ -0,0 +1 @@
[O1XXXXXXXWo

Some files were not shown because too many files have changed in this diff Show More