Add Better Support for AFL/gcc
- Dominant language
- Python
- Stars
- 5.6k
- Forks
- 629
- Avg merge
- 4d 6h
- Merged PRs (30d)
- 22
Description
Some potential users (@asudhak and @acatinahat) have said using libFuzzer will be too difficult to use for them because they depend on `gcc`.
I see two ways to support `gcc` users:
1. Make libFuzzer usable with `gcc` ("libfuzzer-gcc").
2. Support fuzzing with `afl-gcc` based targets and no libFuzzer build ("afl-gcc").
@asudhak and @acatinahat preferred the afl-gcc option over the libfuzzer-gcc option. However I think libfuzzer-gcc is worth exploring anyway because it is considerably easier for ClusterFuzz to support and maintain, and it will probably do better, since in our experience, libFuzzer finds more bugs than AFL.
Supporting libfuzzer-gcc would only require (once again) supporting `trace-pc-guard` instrumentation in libFuzzer.
afl-gcc would require:
1. Supporting afl targets not compiled with `afl_driver.cpp` (including creating a convention so that ClusterFuzz could recognize these as targets.
2. Supporting corpus pruning with afl.
3. Supporting testcase minimization with afl.
Contributor guide
Assessment
This issue has not been assessed yet.