Fuzzer not crashing with basic string comparison
- Dominant language
- C++
- Stars
- 1.1k
- Forks
- 137
- Avg merge
- 3d 6h
- Merged PRs (30d)
- 22
Description
Playing around with [codelab](https://github.com/google/fuzztest/tree/main/codelab) example I noticed fuzzer is not able to find basic string comparison crashes with input domains.
I am trying below test:
```
void StringCmp(std::string s) {
EXPECT_NE(s, "Hello");
}
FUZZ_TEST(ExpTests, StringCmp).
WithDomains(/*s:*/fuzztest::PrintableAsciiString());
```
Running this in fuzzing mode following [quickstart-cmake](https://github.com/google/fuzztest/blob/main/doc/quickstart-cmake.md#fuzzing-mode) doesn't crash whereas removing the domain constraint for `PrintableAsciiString()` followed from [here](https://github.com/google/fuzztest/blob/main/doc/domains-reference.md#string-domains), crashes instantly. Tried with `AsciiString()` domain as well and it is not crashing.
Already ran fuzzer for 5 hours (and still running...) and it's not reporting the bug whereas without domain it is able to find `"Hello"` string and crash instantly. Tried with 6a370aed314173f472b265c8196bd4810846c831, couldn't try `main` because of https://github.com/google/fuzztest/issues/1192
Seems like there might be some issue while using tokens received from string comparison instructions enabled via `-fsanitize-coverage=trace-cmp` when domains are enabled.
Contributor guide
Assessment
This issue has not been assessed yet.