You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently fuzzing stops after discovering any one bug, even if -test.fuzztime option was passed.
It would be convenient to allow fuzzing indefinitely or until -test.fuzztime was reached.
My case is fuzzing for very long time (e.g. two weeks) and reviewing the findings later in one seat.
Currently to start a fuzzing campaign I need to waste 15 minutes to fetch new sources and build them only to crash after 5 seconds of fuzzing and stop the whole process. This is already not time-efficient: if build time takes 15 minutes I want to fuzz for at least 15 minutes, otherwise 99% of fuzzing resources go to building and 1% - to actual fuzzing.
Then I report one found bug and wait for devs to fix it which may take from 1 hour to few days! After that I waste 15 minutes again to build and then fuzz for 5 more seconds to find similar bug on the very next line of code and report this similar bug again. Devs are angry on me because I could report both at the same time and lots of time is wasted from all sides. All this wasted time my giant fuzzing farm rests (and is NOT moving towards ROI).
Other fuzzers can continue after finding bugs:
AFL, AFL++, WinAFL and the likes don't stop by default, even with many found bugs,
libFuzzer stops on crash by default, but has option -ignore_crashes that saves crashing samples to disk but allows to continue fuzzing process,
go-fuzz and honggfuzz don't stop on crash by default.
These fuzzers allow to spend 1% of resources on building and 99% on fuzzing itself and utilize fuzzing hardware efficiently.
And this is what I propose Go fuzzing to allow as well.
The text was updated successfully, but these errors were encountered:
Currently fuzzing stops after discovering any one bug, even if
-test.fuzztime
option was passed.It would be convenient to allow fuzzing indefinitely or until
-test.fuzztime
was reached.My case is fuzzing for very long time (e.g. two weeks) and reviewing the findings later in one seat.
Currently to start a fuzzing campaign I need to waste 15 minutes to fetch new sources and build them only to crash after 5 seconds of fuzzing and stop the whole process. This is already not time-efficient: if build time takes 15 minutes I want to fuzz for at least 15 minutes, otherwise 99% of fuzzing resources go to building and 1% - to actual fuzzing.
Then I report one found bug and wait for devs to fix it which may take from 1 hour to few days! After that I waste 15 minutes again to build and then fuzz for 5 more seconds to find similar bug on the very next line of code and report this similar bug again. Devs are angry on me because I could report both at the same time and lots of time is wasted from all sides. All this wasted time my giant fuzzing farm rests (and is NOT moving towards ROI).
Other fuzzers can continue after finding bugs:
AFL, AFL++, WinAFL and the likes don't stop by default, even with many found bugs,
libFuzzer stops on crash by default, but has option
-ignore_crashes
that saves crashing samples to disk but allows to continue fuzzing process,go-fuzz and honggfuzz don't stop on crash by default.
These fuzzers allow to spend 1% of resources on building and 99% on fuzzing itself and utilize fuzzing hardware efficiently.
And this is what I propose Go fuzzing to allow as well.
The text was updated successfully, but these errors were encountered: