libFuzzer has an optional mechanism to explicitly reject fuzz inputs. This directive forces the fuzzer to forget the observed coverage for the current input, and does not allow adding it to the corpus collection.
Use the custom --features reject-invalid-in-corpus crate feature to enable this logic in the fuzz harnesses that make use of it. The flag is optional and off by default, see Cargo.toml.
This is a heavy-handed approach and reduces fuzzer coverage visibility into the rejected code paths, but may be useful for time-constrained runs.
Expected effects:
- reduce some runtime overhead on rejected inputs by skipping post-processing steps
- increases ratio of "valid" inputs in working corpus
The expectation is that this makes it more likely to create valid inputs by mutation, at least on short runs with a limited amount of executions that start on a pre-seeded corpus.
- https://github.com/trifectatechfoundation/compression-corpus
- https://gitlab.com/bzip2/bzip2-testfiles
- See the GitHub workflow definitions for more information on seed corpus usage
- There is an existing bzip2 format fuzz dictionary: https://github.com/google/fuzzing/blob/master/dictionaries/bz2.dict
- This could be useful for fuzz tests which consume compressed input and attempt to decompress it
- However, there are only very few common input chunks that bzip2 streams share with each other, so the practical benefits of running the fuzzer with this dictionary is likely limited
- See https://llvm.org/docs/LibFuzzer.html#dictionaries for more background