3 ms·
> Surprisingly, libFuzzer struggled to figure out that input should be of size 1024 and couldn’t start fuzzing. Is this surprising? Does libFuzzer support Redq
by mmsc 2y ago
> Surprisingly, libFuzzer struggled to figure out that input should be of size 1024 and couldn’t start fuzzing.
Is this surprising? Does libFuzzer support Redqueen or laf-intel like AFL++ [0][1] which will pick up on any comparisons (like a comparison to size=1024) and fuzz with the intention of changing that comparison to become true or false (to put it overly simple)?
0: https://github.com/AFLplusplus/AFLplusplus/blob/stable/instrumentation/README.cmplog.md https://github.com/AFLplusplus/AFLplusplus/blob/stable/instr...
1: https://github.com/AFLplusplus/AFLplusplus/blob/stable/instrumentation/README.laf-intel.md https://github.com/AFLplusplus/AFLplusplus/blob/stable/instr...
- circus1540 2y agolibfuzzer has features to solve comparisons including a comparison table and value profile. in either case, it should be pretty easy to find that a 1024 size input unlocks new coverage without any of those fancy features. i doubt that was the problem here.