-
Notifications
You must be signed in to change notification settings - Fork 95
Description
deepstate-afl and other fuzzer executors should have an option to abort the fuzz run and return a non-zero exit code on the discovery of a failing input. This is essential for using fuzzers in mutation-testing loops!
Sketch:
if --abort-on-fail is present, the executor code that checks for --timeout (which works correctly) should have an equivalent that watches for the the_fuzzer/crashes (or equivalent for non-AFL fuzzers) becoming non-empty and shuts down as with a timeout, but forcing return value (check return from timeout: that should be zero, since stop on timeout is a normal stop, not sure what it is right now). libFuzzer may be most difficult to check (since it drops crash files in current dir, I believe), and can operate with a stop-on-fail by default, possibly, anyway.