TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A February 5, 2025, article on nullprogram.com presents practical advice for improving fuzz testing with AFL++ on source-available C and C++ software running on glibc-based Linux. Its recommendations include using AddressSanitizer and UndefinedBehaviorSanitizer, adjusting selected AddressSanitizer settings, and preferring persistent mode where practical. The author describes experience testing about 1,000 projects, but the guidance is not a controlled comparison or a guarantee that any particular program will contain a bug.
A February 5, 2025, article on nullprogram.com outlines ways to make AFL++ fuzz testing more effective on source-available C and C++ programs running on glibc-based Linux. Drawing on the author’s experience fuzzing about 1,000 projects over six years, it highlights sanitizer configuration and persistent mode as practical ways to expose defects and run tests more efficiently.
The author recommends compiling targets with AddressSanitizer (ASan) and UndefinedBehaviorSanitizer (UBSan), which can detect classes of memory-safety and undefined-behavior defects during fuzzing. The article also advises setting ASan options so that errors stop execution in a way AFL++ can use, and suggests enabling detection of stack-use-after-return bugs. These settings can make testing more sensitive, although the article notes that this can slow fuzzing slightly.
Another recommendation is to raise ASan’s allocation-fill limit. The author says its default pattern-filling limit of 4 KiB can leave some uninitialized-memory errors undetected when larger allocations are involved. For C++ projects using GCC’s libstdc++, the article suggests considering _GLIBCXX_DEBUG to add checks for container errors that ASan may not detect. It warns that this option changes the application binary interface, so the test build must account for that difference.
The article favors AFL++’s persistent mode, which runs multiple test cases in one process, over repeatedly launching a target. The author says it is typically an order of magnitude faster, while cautioning that persistent mode brings pitfalls that require careful handling. The proposed workflow includes writing a small harness and, where useful, compiling selected source files into the harness’s translation unit. This can expose internal or static functions for testing, but requires attention to how program state is reset between inputs.
More Defects per Fuzzing Run
Fuzz testing feeds software a large stream of generated or mutated inputs to find failures that ordinary tests may miss. Sanitizers and assertions help turn otherwise silent memory or undefined-behavior problems into detectable failures, while persistent mode can increase the number of test cases run in a given period. For teams maintaining parsers and other complex-input software, those choices affect both the defects a campaign can detect and the time needed to search for them.
The advice is practical rather than a new benchmark or a report of a newly discovered vulnerability. The author argues that fuzzing remains underused and that even previously tested programs may benefit from better configurations. Readers should treat that as the author’s assessment, not as evidence that every untested application contains a defect or that these settings will find one in every campaign.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Bose SoundLink Flex Bluetooth Speaker (2nd Gen), Black
As an affiliate, we earn on qualifying purchases.
The Guide’s Linux Scope
The article is specifically about AFL++ applied to source-available C and C++ targets on glibc-based Linux distributions. It is not presented as a universal setup guide for every operating system, language, or fuzzing engine. The author directs readers to AFL++’s upstream performance documentation and technical white paper for additional implementation detail.
The recommendations build on the author’s reported experience fuzzing roughly 1,000 projects over six years. The article also frames its checklist as complementary to earlier writing. It does not supply a controlled experiment comparing all suggested settings, nor does the source material establish that its performance estimate applies to every target.
“After fuzz testing ~1,000 projects over the past six years, I’ve accumulated tips for picking that fruit.”
— The nullprogram.com author
Limits of the Performance Claims
The article’s claims are based on the author’s experience and do not report a controlled evaluation of each recommendation across a defined set of programs. The order-of-magnitude speed estimate for persistent mode may vary by target and setup; a project-specific result is not supplied. The source also cautions that persistent mode has pitfalls, but the provided material does not detail all of them.
It is also unclear from the article alone how often each setting reveals additional defects, or what trade-offs they produce across different workloads. The guidance is scoped to particular C and C++ targets and Linux environments, so its suitability for other configurations must be evaluated separately.
Applying the Checklist to Targets
The article points readers to AFL++’s official performance tips and technical white paper for further setup guidance. For developers, the next step is to apply suitable sanitizer settings and a harness to a specific target, then check that crashes can be reproduced and investigated. Teams adopting persistent mode also need to validate that the target’s state is reset appropriately between test cases.
No release, benchmark, or follow-up milestone is announced in the source material. Whether these techniques uncover defects or improve throughput will depend on the program, harness, compiler configuration, and testing environment.
Key Questions
What is the article about?
It offers practical AFL++ guidance for fuzz testing source-available C and C++ software on glibc-based Linux, based on the author’s reported testing experience.
Which sanitizers does the author recommend?
The article recommends using AddressSanitizer and UndefinedBehaviorSanitizer together when fuzzing, with selected ASan settings to improve error detection and handling.
Why use AFL++ persistent mode?
Persistent mode runs multiple test cases in one process. The author says it is typically much faster, but also warns that it has pitfalls and requires careful handling of program state.
Does the article prove these settings will find a bug?
No. It offers experience-based recommendations, not a controlled study or a guarantee. Results depend on the target, harness, and testing configuration.
Source: nullprogram.com
