TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A February 5, 2025 article on nullprogram.com presents practical advice for improving fuzz testing with AFL++ on source-available C and C++ software running on glibc-based Linux. Its recommendations include configuring AddressSanitizer and UndefinedBehaviorSanitizer, using persistent mode, and shaping a small test harness around the code under test.
A February 5, 2025 article on nullprogram.com offers a set of techniques for finding more defects with AFL++, a fuzzing tool used to test C and C++ software. The author, drawing on experience fuzzing about 1,000 projects over six years, focuses on sanitizer settings, persistent-mode test harnesses and ways to expose code paths that ordinary tests may miss.
The article recommends compiling fuzz targets with both AddressSanitizer (ASan) and UndefinedBehaviorSanitizer (UBSan). These tools detect classes of memory-safety and undefined-behavior defects while inputs are being tested. It also advises setting ASan options for AFL++ and enabling checks such as use-after-return detection. The author says increasing ASan’s allocation-fill limit can help reveal bugs involving uninitialized memory in allocations larger than the default fill range.
For C++ programs using GCC’s standard library, the article suggests considering -D_GLIBCXX_DEBUG, which adds container checks that can catch some out-of-bounds accesses ASan may not detect. The author cautions that this option changes the application binary interface, so it must be used with awareness of compatibility implications.
The guide favors AFL++’s persistent mode over simpler instrumentation when the work involved in creating a harness is practical. In this mode, a target can process multiple test cases within one process, which the author describes as typically an order of magnitude faster. The article also recommends including relevant source files directly in a fuzzing harness when useful, giving the harness access to internal and static functions. It notes that persistent mode requires care around program state and test-case setup.
More Defects From Each Fuzzing Run
Fuzzing tests software by feeding it many inputs, including malformed or unexpected ones, and watching for failures. Better instrumentation and a well-targeted harness can make those runs more likely to expose bugs that existing tests do not cover. The article’s advice is aimed at developers who already use AFL++ as well as those deciding how to start testing a program that accepts complex input.
The recommendations also highlight a practical trade-off: persistent mode can increase throughput, but it introduces additional requirements for isolating test cases and resetting state. Sanitizers can reveal defects, while their runtime costs and configuration affect how many inputs a target can process. The guide presents these as implementation choices rather than guarantees that fuzzing will find every flaw.
Products Worth Considering
Logitech MX Keys S Wireless Keyboard, Graphite
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
As an affiliate, we earn on qualifying purchases.
A Practitioner’s AFL++ Checklist
The article is a technical how-to, not a report of a newly discovered vulnerability or a change to AFL++ itself. Its stated scope is source-available C and C++ targets on glibc-based Linux distributions. The author says the checklist is based on fuzzing roughly 1,000 projects over six years and is intended to complement AFL++’s upstream performance guidance and technical documentation.
Fuzzing coverage depends on how the target is built and which code paths the harness reaches. A program can have been fuzzed previously and still contain defects that a different harness or configuration might expose. The article’s claims about the potential effectiveness of fuzzing reflect the author’s experience; they do not establish that every untested program contains a bug or that the listed settings will find one in a particular target.
“After fuzz testing ~1,000 projects over the past six years, I’ve accumulated tips for picking that fruit.”
— The nullprogram.com author
Limits and Trade-Offs Remain
The supplied article excerpt does not provide comparative benchmark data, independent validation of the author’s recommendations, or results for specific software projects. Its estimate that persistent mode is typically an order of magnitude faster is the author’s characterization, not a universal performance guarantee. Actual gains depend on the program, harness, build and machine.
Some implementation details also remain target-specific. Persistent-mode harnesses must account for state carried between inputs, and the article notes that its template has constraints on where the input buffer and length are used. The excerpt ends partway through its discussion of replacing program symbols, so it does not establish the full scope of the article’s later recommendations.
Apply the Advice to Each Target
Developers using the checklist can compare its recommendations with the AFL++ upstream documentation and test changes against their own targets. A practical next step is to build a small harness, enable relevant sanitizers, and verify that repeated inputs do not leave state that affects later test cases. The article does not announce a product release, scheduled follow-up or broader study; any results from applying the advice will depend on the software being tested.
Key Questions
What is the article about?
It is a February 5, 2025 practitioner’s checklist for improving AFL++ fuzzing of C and C++ programs, based on the author’s reported experience testing about 1,000 projects.
Which sanitizers does the guide recommend?
It recommends using AddressSanitizer and UndefinedBehaviorSanitizer together when building a fuzz target, then configuring ASan to suit AFL++ and the defects being sought.
Why use AFL++ persistent mode?
Persistent mode lets a target process multiple test cases in one process. The author says it is typically much faster, but it requires care to manage program state between inputs.
Does the article prove these settings find bugs in every program?
No. The recommendations are based on the author’s experience, and the article excerpt provides no independent evaluation or guarantee. Results depend on the target, harness, build and test inputs.
Source: nullprogram.com
