In libfuzzer you can return -1 to exclude an input from the corpus. extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (size >

In libfuzzer you can return -1 to exclude an input from the corpus. extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (size > 256) { return -1; } handle(data, size); return 0; } or extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (size < 5 || !(data[0] == 'M' && data[1] == 'A' && data[2] == 'G' && data[3] == 'I' && data[4] == 'C')) { return -1; } handle(data, size); return 0; } There's also something called structure aware fuzzing. Say you're fuzzing a function that takes a JSON string as an input. When fuzzers do traditional mutations like bit flips, or re-inserting parts of the input at random points, you'll get coverage but it might not be deep because the function will fail at the JSON parsing stage instead of going into the actual logic a lot of the time. If they use a well tested JSON parsing library, you probably don't want to spend time fuzzing that because oss-fuzz is already doing it with supercomputers. The solution is that fuzzers such as libfuzzer can generate random data that conforms to a protobuf type you give it, and from there you can use that to properly serialize a JSON message and then pass that to the function. I don't know of any fuzzers written to handle the case you are describing. You would have to put the ranges yourself in the fuzzing handler. If you had a program that say took integers and you wanted to find out within which bounds does it not crash you could probably write a program using binary search pretty easily. Note: I learned most of this about a week and a half ago, may be subtly wrong.