honggfuzz VS sanitizers

Ex ( AFL, WinAFL, HonggFuzz, LibFuzzer, Jazzer )

I once used Hongfuzz as a code-coverage tool, see: https://github.com/google/honggfuzz/tree/master/socketfuzzer

Here's the libbfd-based code in case anyone would like to port it, it's basically addr2line.

https://github.com/google/honggfuzz/blob/master/linux/bfd.c

AddressSanitizer is really useful, it's similar to Valgrind but has much lower overhead.

And if you're up for it, I'd further recommend adding some ways to deal with buffer overflows in debug builds. The way I deal with this is by using Address-Sanitizer's manual poisoning api. Bonus point if you leave additional poisoned space between allocations so off by one errors are likely to end up in a poisoned region instead of nearby allocation.

It also doesn't hurt that Miri can find many kinds of unsafe violations even in unsafe blocks. Zig may get something like this one day, but even if it does, checking things at runtime is not a substitute for compile time -- the C++ Sanitizers haven't exactly solved the safety story for C++ even over a decade later.

This is where stuff like ASan is really useful.

Use: https://github.com/google/sanitizers/wiki/AddressSanitizer

Have you tried using tools like ASAN/LSAN or valgrind to confirm that there are indeed no memory leaks?

Compile with ASAN and UBSAn