Skip to content

fuzz testing: continue after finding bugs #56430

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
fuzzah opened this issue Oct 26, 2022 · 2 comments
Closed

fuzz testing: continue after finding bugs #56430

fuzzah opened this issue Oct 26, 2022 · 2 comments

Comments

@fuzzah
Copy link

fuzzah commented Oct 26, 2022

Currently fuzzing stops after discovering any one bug, even if -test.fuzztime option was passed.
It would be convenient to allow fuzzing indefinitely or until -test.fuzztime was reached.

My case is fuzzing for very long time (e.g. two weeks) and reviewing the findings later in one seat.
Currently to start a fuzzing campaign I need to waste 15 minutes to fetch new sources and build them only to crash after 5 seconds of fuzzing and stop the whole process. This is already not time-efficient: if build time takes 15 minutes I want to fuzz for at least 15 minutes, otherwise 99% of fuzzing resources go to building and 1% - to actual fuzzing.
Then I report one found bug and wait for devs to fix it which may take from 1 hour to few days! After that I waste 15 minutes again to build and then fuzz for 5 more seconds to find similar bug on the very next line of code and report this similar bug again. Devs are angry on me because I could report both at the same time and lots of time is wasted from all sides. All this wasted time my giant fuzzing farm rests (and is NOT moving towards ROI).

Other fuzzers can continue after finding bugs:
AFL, AFL++, WinAFL and the likes don't stop by default, even with many found bugs,
libFuzzer stops on crash by default, but has option -ignore_crashes that saves crashing samples to disk but allows to continue fuzzing process,
go-fuzz and honggfuzz don't stop on crash by default.

These fuzzers allow to spend 1% of resources on building and 99% on fuzzing itself and utilize fuzzing hardware efficiently.
And this is what I propose Go fuzzing to allow as well.

@fuzzah fuzzah changed the title fuzz testing: continue after finding crashes fuzz testing: continue after finding bugs Oct 26, 2022
@seankhliao
Copy link
Member

Duplicate of #48127

@seankhliao seankhliao marked this as a duplicate of #48127 Oct 26, 2022
@seankhliao seankhliao closed this as not planned Won't fix, can't repro, duplicate, stale Oct 26, 2022
@fuzzah
Copy link
Author

fuzzah commented Oct 26, 2022

oops, didn't know it was planned already.
@seankhliao thank you!

@golang golang locked and limited conversation to collaborators Oct 26, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

3 participants