Tips for more effective fuzz testing with AFL++

Effective fuzzing can expose defects in almost any program that accepts complex input, but it depends on configuring the test so faults are detectable and reproducible. For C and C++ targets on Linux, the guidance recommends AFL++ with AddressSanitizer and UndefinedBehaviorSanitizer, plus stronger ASan settings to catch use-after-return and more memory errors. Persistent-mode tests must reset global state and avoid feeding uninitialized data into the target. A crucial safeguard is to copy each input into a buffer sized to its actual length: AFL++’s own buffer has extra capacity, which can conceal out-of-bounds reads from ASan.

The testing harness can be made simpler and more effective by including the target’s source files directly, allowing access to static functions and state and making it easier to replace troublesome symbols without changing the project. Other practical recommendations include skipping deallocation unless cleanup itself is under test, using Linux memory file descriptors to supply input to programs that insist on named paths, and shrinking oversized fixed buffers so fuzzing reaches edge cases sooner. Together, these techniques reduce build and setup work while improving coverage, crash detection, and reproducibility. They also make quick, targeted fuzz tests feasible during reviews, potentially uncovering defects that existing tests or earlier fuzzing efforts missed.