Skip to content

Honggfuzz Configuration#

run_time#

  • Number of seconds this fuzzing session will last.

(default: 0 [no limit])

[honggfuzz]
run_time = 0

iterations#

  • Number of fuzzing iterations.

(default: 0 [no limit])

[honggfuzz]
iterations = 0

threads#

  • Number of concurrent fuzzing threads.

(default: 0 [number of CPUs / 2])

```bash
[honggfuzz]
threads = 0

keep_output#

  • Don't close children's stdin, stdout, stderr; can be noisy.

(default: false)

[honggfuzz]
keep_output = false

verbose#

  • Disable ANSI console; use simple log output.

(default: false)

[honggfuzz]
verbose = false

exit_upon_crash#

  • Exit upon seeing the first crash.

(default: false)

[honggfuzz]
exit_upon_crash = false

mutations_per_run#

  • Maximal number of mutations per one run.

(default: 6)

[honggfuzz]
mutations_per_run = 6

cargo_target_dir#

  • Target compilation directory, to not clash with cargo build's default target directory.

(default: "" ["trident-tests/fuzzing/honggfuzz/hfuzz_target"])

[honggfuzz]
cargo_target_dir = ""

hfuzz_workspace#

  • Honggfuzz working directory.

(default: "" ["trident-tests/fuzzing/honggfuzz/hfuzz_workspace"])

[honggfuzz]
hfuzz_workspace = ""

crashdir#

  • Directory where crashes are saved to.

(default: "" [workspace directory])

[honggfuzz]
crashdir = ""

extension#

  • Input file extension.

(default: "" ['fuzz'])

[honggfuzz]
extension = "fuzz"

timeout#

  • Timeout in seconds. This will terminate the fuzzing thread if it's running for more than this time.

(default: 10)

[honggfuzz]
timeout = 10

max_file_size#

  • Maximal size of files processed by the fuzzer in bytes.

(default: 1048576 = 1MB)

[honggfuzz]
max_file_size = 1048576

save_all#

  • Save all test-cases (not only the unique ones) by appending the current time-stamp to the filenames.

(default: false)

[honggfuzz]
save_all = false

fuzzer_loopcount#

  • The fuzzer loopcount represents a number of iterations each fuzzer-created process needs to execute before it finishes and generates a profraw file.

Impact on performance and code coverage accuracy

If the loopcount is too low, the fuzzer will be slower because new processes will need to be created more often. However, the higher the loopcount, the higher the chance that the process will crash and not generate any profraw file, thus reducing the code coverage accuracy.

(default: 10)

[honggfuzz]
fuzzer_loopcount = 10