Running Jazzer just over input corpus

[Qffsky]

I want to make a coverage report(--coverage_dump), while using several workers(so i provide option jobs=N). This is not supported by Jazzer. I am wondering if there is some other way to achieve what i want. The closest thing that i have come up with is to:

1. Run jazzer with jobs=N to generate corpus
2. Run jazzer JUST with generated corpus and --coverage_dump to generate JaCoCo report

The problem is with the second step, as functionality of running input corpus is supported only for junit-integration(when JAZZER_FUZZ variable is not set). Is there something i'm missing or is there is no other way around this? And if so, is there any advice on parts of source code that i should change to implement this feature?

Thanks!

[centic9]

Not sure if this is what you are looking for, but I do normal fuzzing runs in some projects which builds up the usual directory with corpus-files.

Then a script coverageReport.sh runs jazzer with some options to execute these corpus files while JaCoCo is injected and thus collects coverage information. A 2nd step then produces the JaCoCo report.

See https://github.com/centic9/demo-fuzz/blob/main/coverageReport.sh for a demo project and https://github.com/centic9/compress-fuzz for a real-life example.

If you provide a valid path to the actual sources of the fuzzed code via --sourcefiles at the end of the script, the JaCoCo report is produced properly.

[Qffsky]

Thank you so much for the reply! Actually looking through your script i have discovered the very thing that i needed. The thing i was looking for is -runs=0, which just runs jazzer for every input in corpus