Use bugs to measure fuzzer performance
Open
core feature
priority
- Dominant language
- Python
- Stars
- 1.2k
- Forks
- 302
- PR merge metrics
- No merged PRs in 30d
Description
My view of fuzzers is that "better" fuzzers can find more exploitable bugs than worse fuzzers. While coverage is a decent, easy-to-use, proxy for this, we should look into using crashes to determine fuzzer performance.
We already save the crashes found in each cycle/corpus snapshot.
Here's what's left to do that I can think of:
1. Implementing a method for identifying crashes. ClusterFuzz's method (similar to stack hashing) works pretty well in practice.
2. Finding a way to rank fuzzers based on the crashes they find.
Contributor guide
Assessment
This issue has not been assessed yet.