re-fuzzing

Write a harness implementing LLVMFuzzerTestOneInput that feeds fuzz data to the target parse function, then compile it with afl-clang-fast using -fsanitize=fuzzer,address. Run afl-fuzz with -i in -o out and the @@ placeholder for the input file.

AFL++ is the main coverage-guided fuzzer for file-based targets and supports QEMU mode for closed-source binaries. libFuzzer ships with clang and suits single-function library fuzzing, while honggfuzz offers hardware-counter and multi-threaded fuzzing as an alternative.

Yes, AFL++ supports QEMU mode via the -Q flag, which fuzzes uninstrumented binaries without recompilation. It runs roughly 2-5 times slower than compile-time instrumentation but requires no source access.

This usually means the target was not instrumented, so no coverage feedback reaches the fuzzer. Verify instrumentation with afl-showmap before starting, check that you compiled with an afl-* compiler wrapper, and confirm the @@ placeholder reaches the real parsing code.

ASAN-instrumented targets are killed by default memory limits unless you pass -m none to afl-fuzz. Always combine AFL_USE_ASAN=1 with -m none and a generous -t timeout, and confirm ASAN reports correctly by running a known-crashing input manually first.

Do not fuzz the whole service process; write a harness that reads input from a file and calls the protocol parsing function directly. Use captured real traffic as seed corpus so the fuzzer targets the parser rather than the network stack.