@@ -354,16 +354,18 @@ Output
354
354
355
355
During operation the fuzzer prints information to ``stderr ``, for example::
356
356
357
- INFO: Seed: 1523017872
358
- INFO: Loaded 1 modules (16 guards): [0x744e60, 0x744ea0),
359
- INFO: -max_len is not provided, using 64
357
+ INFO: Running with entropic power schedule (0xFF, 100).
358
+ INFO: Seed: 1434179311
359
+ INFO: Loaded 1 modules (8 inline 8-bit counters): 8 [0x5f03d189be90, 0x5f03d189be98),
360
+ INFO: Loaded 1 PC tables (8 PCs): 8 [0x5f03d189be98,0x5f03d189bf18),
361
+ INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
360
362
INFO: A corpus is not provided, starting from an empty corpus
361
- #0 READ units: 1
362
- #1 INITED cov: 3 ft: 2 corp: 1/1b exec/s: 0 rss: 24Mb
363
- #3811 NEW cov: 4 ft: 3 corp: 2/2b exec/s: 0 rss: 25Mb L: 1 MS: 5 ChangeBit-ChangeByte- ChangeBit-ShuffleBytes-ChangeByte -
364
- #3827 NEW cov: 5 ft: 4 corp: 3/4b exec/s: 0 rss: 25Mb L: 2 MS: 1 CopyPart -
365
- #3963 NEW cov: 6 ft: 5 corp: 4/6b exec/s: 0 rss: 25Mb L: 2 MS: 2 ShuffleBytes-ChangeBit -
366
- #4167 NEW cov: 7 ft: 6 corp: 5/9b exec/s: 0 rss: 25Mb L: 3 MS: 1 InsertByte -
363
+ #2 INITED cov: 2 ft: 2 corp: 1/1b exec/s: 0 rss: 31Mb
364
+ #144 NEW cov: 3 ft: 3 corp: 2/2b lim: 4 exec/s: 0 rss: 31Mb L: 1/1 MS: 2 ChangeByte-ChangeByte-
365
+ #157 NEW cov: 4 ft: 4 corp: 3/4b lim: 4 exec/s: 0 rss: 31Mb L: 2/2 MS: 3 CrossOver- ChangeBit-CrossOver -
366
+ #1345 NEW cov: 5 ft: 5 corp: 4/8b lim: 14 exec/s: 0 rss: 32Mb L: 4/4 MS: 3 InsertByte-ChangeBit-CrossOver -
367
+ #1696 NEW cov: 6 ft: 6 corp: 5/10b lim: 17 exec/s: 0 rss: 32Mb L: 2/4 MS: 1 EraseBytes -
368
+ #1832 REDUCE cov: 6 ft: 6 corp: 5/9b lim: 17 exec/s: 0 rss: 32Mb L: 3/3 MS: 1 EraseBytes -
367
369
...
368
370
369
371
The early parts of the output include information about the fuzzer options and
@@ -407,7 +409,7 @@ Each output line also reports the following statistics (when non-zero):
407
409
``corp: ``
408
410
Number of entries in the current in-memory test corpus and its size in bytes.
409
411
``lim: ``
410
- Current limit on the length of new entries in the corpus. Increases over time
412
+ Current limit on the length of new entries in the corpus. Increases over time
411
413
until the max length (``-max_len ``) is reached.
412
414
``exec/s: ``
413
415
Number of fuzzer iterations per second.
@@ -418,7 +420,8 @@ For ``NEW`` and ``REDUCE`` events, the output line also includes information
418
420
about the mutation operation that produced the new input:
419
421
420
422
``L: ``
421
- Size of the new input in bytes.
423
+ Size of the new/reduced input in bytes and the size of the largest input
424
+ in current in-memory test corpus.
422
425
``MS: <n> <operations> ``
423
426
Count and list of the mutation operations used to generate the input.
424
427
@@ -453,19 +456,26 @@ A simple function that does something interesting if it receives the input
453
456
454
457
You should get an error pretty quickly::
455
458
456
- INFO: Seed: 1523017872
457
- INFO: Loaded 1 modules (16 guards): [0x744e60, 0x744ea0),
458
- INFO: -max_len is not provided, using 64
459
+ INFO: Running with entropic power schedule (0xFF, 100).
460
+ INFO: Seed: 1434179311
461
+ INFO: Loaded 1 modules (8 inline 8-bit counters): 8 [0x5f03d189be90, 0x5f03d189be98),
462
+ INFO: Loaded 1 PC tables (8 PCs): 8 [0x5f03d189be98,0x5f03d189bf18),
463
+ INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
459
464
INFO: A corpus is not provided, starting from an empty corpus
460
- #0 READ units: 1
461
- #1 INITED cov: 3 ft: 2 corp: 1/1b exec/s: 0 rss: 24Mb
462
- #3811 NEW cov: 4 ft: 3 corp: 2/2b exec/s: 0 rss: 25Mb L: 1 MS: 5 ChangeBit-ChangeByte- ChangeBit-ShuffleBytes-ChangeByte -
463
- #3827 NEW cov: 5 ft: 4 corp: 3/4b exec/s: 0 rss: 25Mb L: 2 MS: 1 CopyPart -
464
- #3963 NEW cov: 6 ft: 5 corp: 4/6b exec/s: 0 rss: 25Mb L: 2 MS: 2 ShuffleBytes-ChangeBit -
465
- #4167 NEW cov: 7 ft: 6 corp: 5/9b exec/s: 0 rss: 25Mb L: 3 MS: 1 InsertByte -
466
- ==31511 == ERROR: libFuzzer: deadly signal
465
+ #2 INITED cov: 2 ft: 2 corp: 1/1b exec/s: 0 rss: 31Mb
466
+ #144 NEW cov: 3 ft: 3 corp: 2/2b lim: 4 exec/s: 0 rss: 31Mb L: 1/1 MS: 2 ChangeByte-ChangeByte-
467
+ #157 NEW cov: 4 ft: 4 corp: 3/4b lim: 4 exec/s: 0 rss: 31Mb L: 2/2 MS: 3 CrossOver- ChangeBit-CrossOver -
468
+ #1345 NEW cov: 5 ft: 5 corp: 4/8b lim: 14 exec/s: 0 rss: 32Mb L: 4/4 MS: 3 InsertByte-ChangeBit-CrossOver -
469
+ #1696 NEW cov: 6 ft: 6 corp: 5/10b lim: 17 exec/s: 0 rss: 32Mb L: 2/4 MS: 1 EraseBytes -
470
+ #1832 REDUCE cov: 6 ft: 6 corp: 5/9b lim: 17 exec/s: 0 rss: 32Mb L: 3/3 MS: 1 EraseBytes -
471
+ ==840148 == ERROR: libFuzzer: deadly signal
467
472
...
468
- artifact_prefix='./'; Test unit written to ./crash-b13e8756b13a00cf168300179061fb4b91fefbed
473
+ SUMMARY: libFuzzer: deadly signal
474
+ MS: 2 CopyPart-ChangeByte-; base unit: dbee5f8c7a5da845446e75b4a5708e74428b520a
475
+ 0x48,0x49,0x21,
476
+ HI!
477
+ artifact_prefix='./'; Test unit written to ./crash-7a8dc3985d2a90fb6e62e94910fc11d31949c348
478
+ Base64: SEkh
469
479
470
480
471
481
More examples
0 commit comments