# On the Analysis of Coverage Feedback in a Fuzzing Proprietary System
## 4 Results
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**No** & **Project Name** & **Default** & **Partial** & **No Cov** & **Seed** & **Bug Type** \\ \hline
1 & coturn/FuzzStun & 33 & 43 & 60 & Y & Heap BOF \\
2 & example/do_softuff_fuzzer & 497 & 10 K & 33 K & Y & Heap BOF \\
3 & hihors/format_command_fuzzer & 4 K & 2 K & 5 K & - & Heap BOF \\
4 & librdka/fauz_regxx & 822 K & 2 M & - & - & Heap BOF \\
5 & librdew/llvmfuzz & 256 K & 279 K & - & - & Heap BOF \\
6 & libyaml/libyaml_dumper_fuzzer & 4 M & 10 M & - & Y & Heap BOF \\
7 & llvm/llvm-special-case-list-fuzzer & 28 M & - & - & - & Heap BOF \\
8 & lzo/lzo_decompress_target & 162 K & 134 K & - & Y & Heap BOF \\
9 & nrlpser/Fuzzzerzer & 2 K & 6 K & 6 K & Y & Heap BOF \\
10 & open2541/fuzz_dmds_message & 33 K & 11 K & - & Y & Heap BOF \\
11 & openbaled/fuzz\_obconversion_smiles & 402 & 1 K & 701 & - & Heap BOF \\
12 & planpap/port/fuzz\_iblse & 46 & 72 & 56 & - & Heap BOF \\
13 & pumpp/Fuzzzml & 33 K & 15 K & 1 K & Y & Heap BOF \\
14 & readstat/taiz_format_sas/Tcat & 285 K & 580 K & 13 M & Y & Heap BOF \\
15 & readstat/taiz_format_sav & 5 M & 6 M & - & Y & Heap BOF \\
16 & rwhy/iuz_ruby_gems & 3 M & 3 M & - & - & Heap BOF \\
17 & sentiru/Fuzz1 BML-Oader & 5 M & 5 M & - & - & Heap BOF \\
18 & siml/sml_load_fuzzer & 52 K & - & - & Heap BOF \\
19 & vlc/vlc-demux-cio-libFuzzer & 262 & 263 & 186 & - & Heap BOF \\
20 & vkulz-loader/json load_fuzzer & 54 K & 84 K & 127 K & Y & Heap BOF \\
21 & cblos/d2C-2 compress_smk_fuzzer & 451 M & 67 M & - & Y & Negative Size Param \\
22 & fluent-bit/cmetrics_decode_fuzz & 3 K & 1 K & 4 K & - & Invalid Free \\
23 & vkulz-loader/instance_create_fuzzer & 20 K & 5 K & 4 K & Y & Invalid Free \\
24 & vkulz-loader/instance_cmemetre_fuzzer & 19 K & 3 K & 9 K & Y & Invalid Free \\
25 & augpass/augess_fauzzer & 2 K & 183 & 3 K & - & SEGV \\
26 & bloaty/fuzz_target & 2 M & 2 M & - & Y & SEGV \\
27 & fluent-bit/cmetrics_decode_fuzz & 71 M & 9793 M & - & - & SEGV \\
28 & gley/tauz_demangle & 20 K & 15 K & - & - & SEGV \\
29 & haproxy/taiz_cfg_parser & 807 K & 616 K & - & - & SEGV \\
30 & hirds/format_command_fuzzer & 12 K & 2 K & 215 K & - & Heap BOF \\
31 & hmswpm/fuzz_tpm,severe & 9 K & 11 K & 2 M & - & SEGV \\
32 & libfp/bpf-object-fuzzer & 120 K & 94 K & 11 K & Y & SEGV \\
33 & liblci/liblci_extended_fuzzer & 623 K & 1 M & - & - & SEGV \\
34 & liblweb/llvmfuz & 561 K & 199 K & - & - & SEGV \\
35 & oatry/taiz_mapper & 7 M & 5M & - & - & SEGV \\
36 & pcapplusplus/FuzzTargetNg & 187 & 128 & 145 Y & Y & SEGV \\
37 & php/p-fuzz-execute & 924 K & 625 K & 2 M & Y & SEGV \\
38 & php/php-fuzz-function-jit & 32 K & 42 K & 66 K & Y & SEGV \\
39 & wabet/read_binary_fuzzer & 393 K & 3212 K & - & - & SEGV \\
40 & wavld/read_binary_fuzzer & 60 M & 51 M & - & - & SEGV \\
41 & augpass/augess_api_fuzzer & 67 K & 70 K & - & - & UAF \\
42 & augpass/augess_escape_name_fuzzer & 1 M & 1 M & - & - & UAF \\
43 & cblos/d/decompress_frame_fuzzer & 168 K & 121 K & - & Y & Heap BOF \\
44 & cups/FuzzCUPS & 15 K & 14 K & 14 K & Y & Heap BOF \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Evaluation results for using 44 real-world bugs found with libFuzzer. We have reproduced each bug with modified versions of Clang with regard to coverage feedback. Default, Partial, and No Cov columns each indicate running the original/ customized version of libFuzzer that measures coverage information with coarse granularity/customized libFuzzer, which does not provide coverage feedback. Each number represents the average execution counts required to reproduce the bug. Seed indicates whether the fuzzer has been provided a proper sample test case at the beginning of fuzzing. feature. A total of 15 out of 20 cases of bug reproduction failures in the no-coverage experiment lacked initial seed data. However, in cases where a proper initial seed was given (e.g., highlighted with red color in the table), the difference in performance for reproducing the bug was relatively insignificant (typically, all cases found the same bug within the range of x2 to x3 fuzzing execution attempts).