deepstate-afl and other fuzzer executors should have an option to abort the fuzz run and return a non-zero exit code on the discovery of a failing input. This is essential for using fuzzers in mutation-testing loops!
Sketch:
if --abort-on-fail is present, the executor code that checks for --timeout (which works correctly) should have an equivalent that watches for the the_fuzzer/crashes (or equivalent for non-AFL fuzzers) becoming non-empty and shuts down as with a timeout, but forcing return value (check return from timeout: that should be zero, since stop on timeout is a normal stop, not sure what it is right now). libFuzzer may be most difficult to check (since it drops crash files in current dir, I believe), and can operate with a stop-on-fail by default, possibly, anyway.
deepstate-afland other fuzzer executors should have an option to abort the fuzz run and return a non-zero exit code on the discovery of a failing input. This is essential for using fuzzers in mutation-testing loops!Sketch:
if
--abort-on-failis present, the executor code that checks for--timeout(which works correctly) should have an equivalent that watches for thethe_fuzzer/crashes(or equivalent for non-AFL fuzzers) becoming non-empty and shuts down as with a timeout, but forcing return value (check return from timeout: that should be zero, since stop on timeout is a normal stop, not sure what it is right now). libFuzzer may be most difficult to check (since it drops crash files in current dir, I believe), and can operate with a stop-on-fail by default, possibly, anyway.