diff --git a/docs/advanced-topics/ideal_integration.md b/docs/advanced-topics/ideal_integration.md index b86ff3bf5544..85785ab8150c 100644 --- a/docs/advanced-topics/ideal_integration.md +++ b/docs/advanced-topics/ideal_integration.md @@ -45,13 +45,13 @@ This makes it easy to maintain the fuzzers and minimizes breakages that can arise as source code changes over time. Make sure to fuzz the target locally for a small period of time to ensure that -it does not crash, hang, or run out of memory instantly. If you're having -trouble, read about [what makes a good fuzz +it does not crash, hang, or run out of memory instantly. Also make sure that the fuzzer can +make at least some progress. If you're having trouble, read about [what makes a good fuzz target](https://github.com/google/fuzzing/blob/master/docs/good-fuzz-target.md). The interface between the [fuzz target](https://llvm.org/docs/LibFuzzer.html#fuzz-target) and the fuzzing engines is C, so you can use either C or C++ to implement the -fuzz target. +fuzz target. Make sure to not return values other than **zero** [^1]. Examples: [boringssl](https://github.com/google/boringssl/tree/master/fuzz), @@ -64,6 +64,10 @@ Examples: [pcre2](https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_fuzzsupport.c?view=markup), [ffmpeg](https://github.com/FFmpeg/FFmpeg/blob/master/tools/target_dec_fuzzer.c). +[^1]: While LibFuzzer uses a non-zero value as a signal to discard inputs other fuzzers in +use by OSS-Fuzz do not necessarily support this behavior. (Discarding inputs can be used +to stop a fuzzer from exploring further, which should only be used with good reason.) + ## Build support Many different build systems exist in the open-source world. The less OSS-Fuzz