Corpus management update

This commit is contained in:
Mitchell Hashimoto
2026-02-28 20:42:33 -08:00
parent 1d9f080309
commit eb7d28d180
910 changed files with 303 additions and 3 deletions

6
test/fuzz-libghostty/.gitattributes vendored Normal file
View File

@@ -0,0 +1,6 @@
# Hand-written seed corpus: binary files, track as-is
corpus/initial/** binary
# Generated/minimized corpora: binary, mark as generated
corpus/vt-parser-cmin/** binary linguist-generated=true
corpus/vt-parser-min/** binary linguist-generated=true

View File

@@ -2,3 +2,34 @@
- `ghostty-fuzz` is a binary built with `afl-cc`
- Build `ghostty-fuzz` with `zig build`
## Important: stdin-based input
The instrumented binary (`afl.c` harness) reads fuzz input from **stdin**,
not from a file argument. This affects how you invoke AFL++ tools:
- **`afl-fuzz`**: Uses shared-memory fuzzing automatically; `@@` works
because AFL writes directly to shared memory, bypassing file I/O.
- **`afl-showmap`**: Must pipe input via stdin, **not** `@@`:
```sh
cat testcase | afl-showmap -o map.txt -- zig-out/bin/ghostty-fuzz
```
- **`afl-cmin`**: Do **not** use `@@`. Requires `AFL_NO_FORKSRV=1` with
the bash version due to a bug in the Python `afl-cmin` (AFL++ 4.35c):
```sh
AFL_NO_FORKSRV=1 /opt/homebrew/Cellar/afl++/4.35c/libexec/afl-cmin.bash \
-i afl-out/default/queue -o corpus/vt-parser-cmin \
-- zig-out/bin/ghostty-fuzz
```
- **`afl-tmin`**: Also requires `AFL_NO_FORKSRV=1`, no `@@`:
```sh
AFL_NO_FORKSRV=1 afl-tmin -i <input> -o <output> -- zig-out/bin/ghostty-fuzz
```
If you pass `@@` or a filename argument, `afl-showmap`/`afl-cmin`/`afl-tmin`
will see only ~4 tuples (the C main paths) and produce useless results.

View File

@@ -66,9 +66,62 @@ issue. The filename encodes metadata about how it was found (e.g.
## Reproducing a Crash
Replay any crashing input by passing it directly to the harness:
Replay any crashing input by piping it into the harness:
```sh
# Via command-line argument
zig-out/bin/ghostty-fuzz afl-out/default/crashes/<filename>
cat afl-out/default/crashes/<filename> | zig-out/bin/ghostty-fuzz
```
## Corpus Management
After a fuzzing run, the queue in `afl-out/default/queue/` typically
contains many redundant inputs. Use `afl-cmin` to find the smallest
subset that preserves full edge coverage, and `afl-tmin` to shrink
individual test cases.
> **Important:** The instrumented binary reads input from **stdin**, not
> from file arguments. Do **not** use `@@` with `afl-cmin`, `afl-tmin`,
> or `afl-showmap` — it will cause them to see only the C harness
> coverage (~4 tuples) instead of the Zig VT parser coverage.
### Corpus minimization (`afl-cmin`)
Reduce the evolved queue to a minimal set covering all discovered edges:
```sh
AFL_NO_FORKSRV=1 afl-cmin.bash \
-i afl-out/default/queue \
-o corpus/vt-parser-cmin \
-- zig-out/bin/ghostty-fuzz
```
`AFL_NO_FORKSRV=1` is required because the Python `afl-cmin` wrapper has
a bug in AFL++ 4.35c. Use the `afl-cmin.bash` script instead (typically
found in AFL++'s `libexec` directory).
### Test case minimization (`afl-tmin`)
Shrink each file in the minimized corpus to the smallest input that
preserves its unique coverage:
```sh
mkdir -p corpus/vt-parser-min
for f in corpus/vt-parser-cmin/*; do
AFL_NO_FORKSRV=1 afl-tmin \
-i "$f" \
-o "corpus/vt-parser-min/$(basename "$f")" \
-- zig-out/bin/ghostty-fuzz
done
```
This is slow (hundreds of executions per file) but produces the most
compact corpus. It can be skipped if you only need edge-level
deduplication from `afl-cmin`.
### Corpus directories
| Directory | Contents |
|------------------------|--------------------------------------------------|
| `corpus/initial/` | Hand-written seed inputs for `afl-fuzz -i` |
| `corpus/vt-parser-cmin/` | Output of `afl-cmin` (edge-deduplicated corpus) |
| `corpus/vt-parser-min/` | Output of `afl-tmin` (individually minimized) |

View File

@@ -0,0 +1 @@
]8;;https://example.comlink]8;;

View File

@@ -0,0 +1 @@
<EFBFBD>test<EFBFBD>

View File

@@ -0,0 +1 @@


View File

@@ -0,0 +1 @@
[>c

View File

@@ -0,0 +1 @@
beforeredafte\ore831mredafte\

View File

@@ -0,0 +1 @@
<EFBFBD><EFBFBD>2(((((((((((

View File

@@ -0,0 +1 @@
oo<ereda<ereda

View File

@@ -0,0 +1 @@
<07><><EFBFBD><07>]0;Tit:<0F><>]0;Tit]0;Tit

View File

@@ -0,0 +1 @@
<0E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>$$$$4$<07><06>$$$$3$$$$$$$$$$$$$$$ $<24><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>

View File

@@ -0,0 +1 @@
(d(d$;]5;]5;]5;]5$;$;]5;]5;]5;]5;

View File

@@ -0,0 +1 @@
[(((((((((((((((((((((((((((((((((((((((((4;

View File

@@ -0,0 +1 @@
;2<>2<EFBFBD><32>2G<0E>0G

View File

@@ -0,0 +1 @@
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;]4<0E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;]4

View File

@@ -0,0 +1 @@
[;2;<>4;5;7;8;9m;5;7;8;9m[;2;3;4;5;7;8T0T0

View File

@@ -0,0 +1 @@
[4::::::::::::::::::::9:::::::::::3<33>[:S4:3<33>

View File

@@ -0,0 +1 @@
[1;<3B>cG<63>col[1;<3B>col(1;2<><32>2<EFBFBD><32>ol81;2<><32>

View File

@@ -0,0 +1 @@
<EFBFBD>[4:---------------------------lm<07>

View File

@@ -0,0 +1 @@
]0;Tit(<28>]0;T]0;Tit(<28>]0;Tt

View File

@@ -0,0 +1,2 @@
!W2;]2;]52]5<10><EFBFBD>;]5 ;;]5 ;52;x;SG>
c <20>

View File

@@ -0,0 +1 @@
]1icon]555555551]55(5555511<17>L15L

View File

@@ -0,0 +1 @@
]112+12<15><>[3le<S]2;]A2+12;x;24eine3(

View File

@@ -0,0 +1 @@
]2;]52;$$$]2;]52;$$$$$$le[$$$le[

View File

@@ -0,0 +1 @@
1;iu]C1n<07>]C[1ink]8;b]1;icc[1ink]8;b1inn]8;b]@;]@iccon

View File

@@ -0,0 +1 @@
i]1Ricfi<1B>]1Rin]1xicon]1Rico@]1

View File

@@ -0,0 +1,2 @@
n]1Y]c;;]5 ;G<><47><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;]5 ;x;<3B><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;]5 ;x;SG52;x;SG>
c<EFBFBD><EFBFBD>o

View File

@@ -0,0 +1 @@
}<7D>j(<28>?o;<3B>1}P1000p\lBo;<3B>1}<7D>Bo^

View File

@@ -0,0 +1 @@
<EFBFBD><EFBFBD><EFBFBD>31m<EFBFBD>7;1;1;;8b\8b<1B>7;1;;gW<67>`\8"1m<31>7g

View File

@@ -0,0 +1 @@
]1;iRonS7<53><37><EFBFBD>nS(7!;n+<2B>7iPn';6<>771 c77cU <20>7iPn';-<2D>771 c77cU

View File

@@ -0,0 +1 @@
]<>ic;>]10;r]3<>]10;r]10;];ic]i[1

View File

@@ -0,0 +1 @@
W<>6;i]@>]12]12];>i]4<><0E>883@>]12]12]<>ic11

View File

@@ -0,0 +1 @@
<1B>1b<31>7;831m<31>7<1B>1b<31>7;831m<31>7;8b<>7;;8b<>

View File

@@ -0,0 +1 @@
]<>]<>j;1]9;9>iq<71>ic/c;1]9;9>%1<17>.c;>11ic^4<0F>

View File

@@ -0,0 +1 @@
Bs+@]10BG<42>G@]10BG<42>G@]104rgf<0E>]104rgf<0E>

View File

@@ -0,0 +1 @@
]4;1;rgb:]4;1;rgb:ff/00/00ff/00/00

View File

@@ -0,0 +1 @@
]5551]5551]55(4;1;rgb:ff/00/00]55(4;1;rgb:ff/00/00

View File

@@ -0,0 +1,2 @@
]1 >]c;i1]4<0E>8<EFBFBD>1#9 ;
]9;11;rgb:ff/00/00

Some files were not shown because too many files have changed in this diff Show More