Repository: google/clusterfuzz

Issue:
Fuzzing with AFL doesn't work
Follow the guid to build fuzzer.
```
# Build afl-fuzz and FuzzingEngine.a
./build_afl.bash
# Compile target using ASan, coverage instrumentation, and link against FuzzingEngine.a
$CXX -fsanitize=address -fsanitize-coverage=trace-pc-guard fuzzer.cc FuzzingEngine.a -o fuzzer
# Test out the build by fuzzing it. INPUT_CORPUS is a directory containing files. Ctrl-C when done.
AFL_SKIP_CPUFREQ=1 ./afl-fuzz -i $INPUT_CORPUS -o output -m none ./fuzzer
# Create a fuzzer build to upload to ClusterFuzz.
zip fuzzer-build.zip fuzzer afl-fuzz afl-showmap
```
issue1:
when execute "$CXX -fsanitize=address -fsanitize-coverage=trace-pc-guard fuzzer.cc FuzzingEngine.a -o fuzzer", there is an error. Because FuzzingEngine.a doesn't contain afl-compiler-rt.o.
```
FuzzingEngine.a(aflpp_driver.o): In function `main':
/home/icsl/clusterfuzz/test/afl-build/utils/aflpp_driver/aflpp_driver.c:248: undefined reference to `__afl_manual_init'
/home/icsl/clusterfuzz/test/afl-build/utils/aflpp_driver/aflpp_driver.c:256: undefined reference to `__afl_manual_init'
/home/icsl/clusterfuzz/test/afl-build/utils/aflpp_driver/aflpp_driver.c:263: undefined reference to `__afl_persistent_loop'
/home/icsl/clusterfuzz/test/afl-build/utils/aflpp_driver/aflpp_driver.c:274: undefined reference to `__afl_fuzz_len'
/home/icsl/clusterfuzz/test/afl-build/utils/aflpp_driver/aflpp_driver.c:277: undefined reference to `__afl_fuzz_ptr'
/home/icsl/clusterfuzz/test/afl-build/utils/aflpp_driver/aflpp_driver.c:263: undefined reference to `__afl_persistent_loop'
clang: error: linker command failed with exit code 1 (use -v to see invocation)
```
fuzzer.cc:
```
#include <stdint.h>
#include <stddef.h>

void fuzz(const uint8_t *f){
        if(f[0] == 'c'){
                if(f[1] == 'f'){
                        char* p=0;
                        *p = 0x12;
                }
                else if(f[1] == 'u'){
                        int x = 0;
                        x = 100/x;
                }
        }
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size){
        fuzz(Data);
        return 0;
}
```
After adding afl-compiler-rt.o to FuzzingEngine.a, the fuzzer can be compiled. And it runs well with afl-fuzz.

issue2:
Then I upload the zip file, it comes an invalid option error.
```
2021-04-09 12:38:36,524 - run_bot - INFO - Executing command 'fuzz afl afl_asan_linux_fuzzer'
2021-04-09 12:38:36,637 - run_bot - INFO - Setting up fuzzer and data bundles.
2021-04-09 12:38:36,658 - run_bot - INFO - Retrieving custom binary build r1.
2021-04-09 12:38:36,658 - run_bot - INFO - Build already exists.
2021-04-09 12:38:36,668 - run_bot - INFO - Picked fuzz target fuzzer for fuzzing.
2021-04-09 12:38:36,669 - run_bot - INFO - Setup application path.
2021-04-09 12:38:36,671 - run_bot - INFO - Checking for bad build.
2021-04-09 12:38:36,687 - run_bot - INFO - Recorded use of fuzz target afl_fuzzer.
2021-04-09 12:38:36,789 - run_bot - INFO - Corpus for target fuzzer has no new updates, skipping rsync.
2021-04-09 12:38:36,794 - run_bot - INFO - 2001 corpus files for target fuzzer synced to disk.
2021-04-09 12:38:36,794 - run_bot - INFO - Fuzzing round 0.
2021-04-09 12:38:36,795 - run_bot - INFO - Strategy pool was generated according to default parameters. Chosen strategies: corpus_subset, corpus_mutations_ml_rnn
2021-04-09 12:38:38,913 - run_bot - INFO - Merging corpus.
2021-04-09 12:38:38,934 - run_bot - ERROR - afl-showmap didn't output any coverage for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot2/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00710-in1 (192935 bytes).
Command: ['/home/icsl/clusterfuzz/clusterfuzz-master/my_bot2/clusterfuzz/bot/builds/afl_asan_linux_fuzzer/custom/afl-showmap', '-l1', '-L0', '-pfast', '-o/home/icsl/clusterfuzz/clusterfuzz-master/my_bot2/clusterfuzz/bot/inputs/fuzzer-testcases-disk/temp-144860/afl_showmap_output', '-mnone', '/home/icsl/clusterfuzz/clusterfuzz-master/my_bot2/clusterfuzz/bot/builds/afl_asan_linux_fuzzer/custom/fuzzer', '1']
Return code: 1
Time executed: 0.0004336833953857422
Output: /home/icsl/clusterfuzz/clusterfuzz-master/my_bot2/clusterfuzz/bot/builds/afl_asan_linux_fuzzer/custom/afl-showmap: invalid option -- 'l'
afl-showmap++3.12c by Michal Zalewski

/home/icsl/clusterfuzz/clusterfuzz-master/my_bot2/clusterfuzz/bot/builds/afl_asan_linux_fuzzer/custom/afl-showmap [ options ] -- /path/to/target_app [ ... ]

Required parameters:
-o file - file to write the trace data to

Execution control settings:
-t msec - timeout for each run (none)
-m megs - memory limit for child process (0 MB)
-Q - use binary-only instrumentation (QEMU mode)
-U - use Unicorn-based instrumentation (Unicorn mode)
-W - use qemu-based instrumentation with Wine (Wine mode)
(Not necessary, here for consistency with other afl-* tools)

Other settings:
-i dir - process all files in this directory, must be combined with -o.
With -C, -o is a file, without -C it must be a directory
and each bitmap will be written there individually.
-C - collect coverage, writes all edges to -o and gives a summary
Must be combined with -i.
-q - sink program's output and don't show messages
-e - show edge coverage only, ignore hit counts
-r - show real tuple values instead of AFL filter values
-s - do not classify the map
-c - allow core dumps

This tool displays raw tuple data captured by AFL instrumentation.
For additional help, consult docs/README.md.

Environment variables used:
LD_BIND_LAZY: do not set LD_BIND_NOW env var for target
AFL_CMIN_CRASHES_ONLY: (cmin_mode) only write tuples for crashing inputs
AFL_CMIN_ALLOW_ANY: (cmin_mode) write tuples for crashing inputs also
AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash
AFL_DEBUG: enable extra developer output
AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in milliseconds)
AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL)
AFL_MAP_SIZE: the shared memory size for that target. must be >= the size the target was compiled for
AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target
AFL_QUIET: do not print extra informational output
NoneType: None
2021-04-09 12:38:38,935 - run_bot - WARNING - Timed out in merge while processing initial corpus.
NoneType: None
```
I find that the function fun_afl_fuzz sets the args in file fuzzers/afl/launcher.py.
After deleting the scheduler, MOPT and CMPLOG level options, afl-showmap can do the merge.
```
self.remove_arg(showmap_args, constants.CMPLOG_LEVEL_FLAG)
self.remove_arg(showmap_args, constants.SCHEDULER_FLAG)
self.remove_arg(showmap_args, constants.MOPT_FLAG)
```
issue3:
But it seems that the bot spends a lot time on afl-showmap. And ignore 2 crashes.
bot.log:
```
2021-04-09 16:56:25,775 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00671-in1: 0 features
2021-04-09 16:56:25,798 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00122-in1: 0 features
2021-04-09 16:56:25,821 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-02000-in1: 0 features
2021-04-09 16:56:25,844 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00558-in1: 0 features
2021-04-09 16:56:25,866 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00446-in1: 0 features
2021-04-09 16:56:25,889 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-01179-in1: 0 features
2021-04-09 16:56:25,911 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00614-in1: 0 features
2021-04-09 16:56:25,948 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/fuzzer-testcases-disk/temp-200018/afl_output_dir/default/queue/id:001973,src:000000,time:70,op:havoc,rep:2,+cov: 0 features
2021-04-09 16:56:25,969 - run_bot - INFO - Merge completed successfully.
2021-04-09 16:56:25,983 - run_bot - INFO - Used strategies.
2021-04-09 16:56:26,567 - run_bot - INFO - Uploaded file to logs bucket.
2021-04-09 16:56:26,567 - run_bot - INFO - Uploaded file to logs bucket.
2021-04-09 16:56:26,617 - run_bot - INFO - All fuzzing rounds complete.
2021-04-09 16:56:26,623 - run_bot - INFO - 0 new corpus files generated by fuzzer fuzzer (job afl_asan_linux_fuzzer).
2021-04-09 16:56:26,624 - run_bot - INFO - Finished processing test cases.
2021-04-09 16:56:26,624 - run_bot - INFO - Raw crash count: 2
2021-04-09 16:56:26,630 - run_bot - INFO - Ignore crash (reason=Empty crash state or type, type=, state=).
2021-04-09 16:56:26,630 - run_bot - INFO - Ignore crash (reason=Empty crash state or type, type=, state=).
2021-04-09 16:56:26,630 - run_bot - INFO - Finished processing crashes.
2021-04-09 16:56:26,630 - run_bot - INFO - New crashes: 0, known crashes: 0, processed groups: []
2021-04-09 16:56:26,834 - run_bot - INFO - Using local source, skipping source code update.
2021-04-09 16:56:26,834 - run_bot - INFO - Running platform initialization scripts.
2021-04-09 16:56:27,340 - run_bot - INFO - Completed running platform initialization scripts.
2021-04-09 16:56:27,361 - run_bot - INFO - Executing command 'fuzz afl afl_asan_linux_fuzzer'
2021-04-09 16:56:27,476 - run_bot - INFO - Setting up fuzzer and data bundles.
2021-04-09 16:56:27,494 - run_bot - INFO - Retrieving custom binary build r1.
2021-04-09 16:56:27,495 - run_bot - INFO - Build already exists.
2021-04-09 16:56:27,505 - run_bot - INFO - Picked fuzz target fuzzer for fuzzing.
2021-04-09 16:56:27,505 - run_bot - INFO - Setup application path.
2021-04-09 16:56:27,508 - run_bot - INFO - Checking for bad build.
2021-04-09 16:56:27,524 - run_bot - INFO - Recorded use of fuzz target afl_fuzzer.
2021-04-09 16:56:27,625 - run_bot - INFO - Corpus for target fuzzer has no new updates, skipping rsync.
2021-04-09 16:56:27,630 - run_bot - INFO - 2001 corpus files for target fuzzer synced to disk.
2021-04-09 16:56:27,631 - run_bot - INFO - Fuzzing round 0.
2021-04-09 16:56:27,631 - run_bot - INFO - Strategy pool was generated according to default parameters. Chosen strategies:
2021-04-09 16:56:27,640 - run_bot - INFO - Strategy pool was generated according to default parameters. Chosen strategies:
2021-04-09 16:56:29,713 - run_bot - INFO - Merging corpus.
2021-04-09 16:56:29,750 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00710-in1: 3 features
2021-04-09 16:56:29,773 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-01285-in1: 3 features
2021-04-09 16:56:29,796 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00886-in1: 3 features
2021-04-09 16:56:29,820 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-01721-in1: 3 features
2021-04-09 16:56:29,843 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-01894-in1: 3 features
2021-04-09 16:56:29,866 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00232-in1: 3 features
2021-04-09 16:56:29,889 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-01124-in1: 3 features
2021-04-09 16:56:29,912 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-01690-in1: 3 features
2021-04-09 16:56:29,935 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-01903-in1: 3 features
2021-04-09 16:56:29,958 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00539-in1: 3 features
2021-04-09 16:56:29,981 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00967-in1: 3 features
2021-04-09 16:56:30,004 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00400-in1: 3 features
2021-04-09 16:56:30,027 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00931-in1: 3 features
2021-04-09 16:56:30,050 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-01559-in1: 3 features
2021-04-09 16:56:30,073 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-01244-in1: 3 features
..........
2021-04-09 16:57:16,146 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00318-in1: 3 features
2021-04-09 16:57:16,169 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00515-in1: 3 features
2021-04-09 16:57:16,192 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00671-in1: 3 features
2021-04-09 16:57:16,214 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00122-in1: 3 features
2021-04-09 16:57:16,237 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-02000-in1: 3 features
2021-04-09 16:57:16,260 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00558-in1: 3 features
2021-04-09 16:57:16,283 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00446-in1: 3 features
2021-04-09 16:57:16,305 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-01179-in1: 3 features
2021-04-09 16:57:16,328 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/data-bundles/fuzzer/radamsa-00614-in1: 3 features
2021-04-09 16:57:16,378 - run_bot - INFO - afl-showmap succeedded for file /home/icsl/clusterfuzz/clusterfuzz-master/my_bot/clusterfuzz/bot/inputs/fuzzer-testcases-disk/temp-200018/afl_output_dir/default/queue/id:001973,src:000000,time:667,op:havoc,rep:16,+cov: 3 features
2021-04-09 16:57:16,385 - run_bot - INFO - Merge completed successfully.
2021-04-09 16:57:16,400 - run_bot - INFO - Used strategies.
2021-04-09 16:57:17,520 - run_bot - INFO - Uploaded file to logs bucket.
2021-04-09 16:57:17,521 - run_bot - INFO - Uploaded file to logs bucket.
2021-04-09 16:57:17,572 - run_bot - INFO - Fuzzing round 1.
2021-04-09 16:57:17,572 - run_bot - INFO - Strategy pool was generated according to default parameters. Chosen strategies:
2021-04-09 16:57:17,581 - run_bot - INFO - Strategy pool was generated according to default parameters. Chosen strategies: corpus_subset, corpus_mutations_ml_rnn
2021-04-09 16:57:17,639 - run_bot - INFO - GCS model directory for fuzzer fuzzer is gs://test-corpus-bucket/rnn/fuzzer.
2021-04-09 16:57:17,640 - run_bot - INFO - ML RNN model for fuzzer fuzzer does not exist. Skip generation.
2021-04-09 16:57:19,323 - run_bot - INFO - Merging corpus.
......
2021-04-12 13:21:03,781 - run_bot - INFO - Merge completed successfully.
2021-04-12 13:21:03,795 - run_bot - INFO - Used strategies.
2021-04-12 13:21:04,366 - run_bot - INFO - Uploaded file to logs bucket.
2021-04-12 13:21:04,366 - run_bot - INFO - Uploaded file to logs bucket.
2021-04-12 13:21:04,418 - run_bot - INFO - Fuzzing round 1.
2021-04-12 13:21:04,419 - run_bot - INFO - Strategy pool was generated according to default parameters. Chosen strategies: corpus_mutations_ml_rnn
2021-04-12 13:21:04,428 - run_bot - INFO - Strategy pool was generated according to default parameters. Chosen strategies: corpus_mutations_radamsa, corpus_subset
2021-04-12 13:21:30,144 - run_bot - INFO - Added 0 tests using Radamsa mutations.
2021-04-12 13:21:31,646 - run_bot - INFO - Used strategies.
2021-04-12 13:21:32,191 - run_bot - INFO - Uploaded file to logs bucket.
2021-04-12 13:21:32,191 - run_bot - INFO - Uploaded file to logs bucket.
2021-04-12 13:21:32,244 - run_bot - INFO - All fuzzing rounds complete.
2021-04-12 13:21:32,250 - run_bot - INFO - 0 new corpus files generated by fuzzer fuzzer (job afl_asan_linux_fuzzer).
2021-04-12 13:21:32,250 - run_bot - INFO - Finished processing test cases.
2021-04-12 13:21:32,250 - run_bot - INFO - Raw crash count: 2
2021-04-12 13:21:32,257 - run_bot - INFO - Ignore crash (reason=Empty crash state or type, type=, state=).
2021-04-12 13:21:32,257 - run_bot - INFO - Ignore crash (reason=Empty crash state or type, type=, state=).
2021-04-12 13:21:32,257 - run_bot - INFO - Finished processing crashes.
2021-04-12 13:21:32,257 - run_bot - INFO - New crashes: 0, known crashes: 0, processed groups: []
2021-04-12 13:21:32,495 - run_bot - INFO - Using local source, skipping source code update.
2021-04-12 13:21:32,495 - run_bot - INFO - Running platform initialization scripts.
2021-04-12 13:21:33,002 - run_bot - INFO - Completed running platform initialization scripts.
2021-04-12 13:21:33,024 - run_bot - INFO - Executing command 'fuzz afl afl_asan_linux_fuzzer'
2021-04-12 13:21:33,158 - run_bot - INFO - Setting up fuzzer and data bundles.
2021-04-12 13:21:33,181 - run_bot - INFO - Retrieving custom binary build r1.
2021-04-12 13:21:33,181 - run_bot - INFO - Build already exists.
2021-04-12 13:21:33,191 - run_bot - INFO - Picked fuzz target fuzzer for fuzzing.
2021-04-12 13:21:33,192 - run_bot - INFO - Setup application path.
2021-04-12 13:21:33,194 - run_bot - INFO - Checking for bad build.
2021-04-12 13:21:33,208 - run_bot - INFO - Recorded use of fuzz target afl_fuzzer.
2021-04-12 13:21:33,309 - run_bot - INFO - Corpus for target fuzzer has no new updates, skipping rsync.
2021-04-12 13:21:33,314 - run_bot - INFO - 2001 corpus files for target fuzzer synced to disk.
2021-04-12 13:21:33,315 - run_bot - INFO - Fuzzing round 0.
2021-04-12 13:21:33,315 - run_bot - INFO - Strategy pool was generated according to default parameters. Chosen strategies: corpus_subset, corpus_mutations_ml_rnn
2021-04-12 13:21:35,009 - run_bot - INFO - Used strategies.
2021-04-12 13:21:35,545 - run_bot - INFO - Uploaded file to logs bucket.
2021-04-12 13:21:35,546 - run_bot - INFO - Uploaded file to logs bucket.
2021-04-12 13:21:35,598 - run_bot - INFO - Fuzzing round 1.
2021-04-12 13:21:35,598 - run_bot - INFO - Strategy pool was generated according to default parameters. Chosen strategies:
2021-04-12 13:21:35,608 - run_bot - INFO - Strategy pool was generated according to default parameters. Chosen strategies: corpus_subset, corpus_mutations_ml_rnn
2021-04-12 13:21:35,667 - run_bot - INFO - GCS model directory for fuzzer fuzzer is gs://test-corpus-bucket/rnn/fuzzer.
2021-04-12 13:21:35,667 - run_bot - INFO - ML RNN model for fuzzer fuzzer does not exist. Skip generation.
2021-04-12 13:21:37,369 - run_bot - INFO - Used strategies.
2021-04-12 13:21:37,924 - run_bot - INFO - Uploaded file to logs bucket.
2021-04-12 13:21:37,924 - run_bot - INFO - Uploaded file to logs bucket.
2021-04-12 13:21:37,977 - run_bot - INFO - All fuzzing rounds complete.
2021-04-12 13:21:37,983 - run_bot - INFO - 0 new corpus files generated by fuzzer fuzzer (job afl_asan_linux_fuzzer).
2021-04-12 13:21:37,983 - run_bot - INFO - Finished processing test cases.
2021-04-12 13:21:37,983 - run_bot - INFO - Raw crash count: 2
2021-04-12 13:21:37,989 - run_bot - INFO - Ignore crash (reason=Empty crash state or type, type=, state=).
2021-04-12 13:21:37,989 - run_bot - INFO - Ignore crash (reason=Empty crash state or type, type=, state=).
2021-04-12 13:21:37,989 - run_bot - INFO - Finished processing crashes.
2021-04-12 13:21:37,989 - run_bot - INFO - New crashes: 0, known crashes: 0, processed groups: []
2021-04-12 13:21:38,221 - run_bot - INFO - Using local source, skipping source code update.
2021-04-12 13:21:38,221 - run_bot - INFO - Running platform initialization scripts.
2021-04-12 13:21:38,745 - run_bot - INFO - Completed running platform initialization scripts.
2021-04-12 13:21:38,767 - run_bot - INFO - Executing command 'fuzz afl afl_asan_linux_fuzzer'
2021-04-12 13:21:38,902 - run_bot - INFO - Setting up fuzzer and data bundles.
2021-04-12 13:21:38,926 - run_bot - INFO - Retrieving custom binary build r1.
2021-04-12 13:21:38,926 - run_bot - INFO - Build already exists.
2021-04-12 13:21:38,937 - run_bot - INFO - Picked fuzz target fuzzer for fuzzing.
2021-04-12 13:21:38,937 - run_bot - INFO - Setup application path.
```


Discussion:

Resolving patch:
diff --git a/src/python/bot/fuzzers/afl/launcher.py b/src/python/bot/fuzzers/afl/launcher.py
--- a/src/python/bot/fuzzers/afl/launcher.py
+++ b/src/python/bot/fuzzers/afl/launcher.py
@@ -1025,10 +1025,15 @@ def merge_corpus(self):
     # Hack around minijail.
     showmap_args = self._fuzz_args
     showmap_args[-1] = '1'
-    # Remove arguments for afl-fuzz.
-    self.remove_arg(showmap_args, constants.INPUT_FLAG)
+    # Remove arguments that are just for afl-fuzz.
     self.remove_arg(showmap_args, constants.DICT_FLAG)
+    self.remove_arg(showmap_args, constants.INPUT_FLAG)
     self.remove_arg(showmap_args, constants.INSTANCE_ID_FLAG)
+    self.remove_arg(showmap_args, constants.MOPT_FLAG)
+    self.remove_arg(showmap_args, constants.CMPLOG_LEVEL_FLAG)
+    self.remove_arg(showmap_args, constants.QUEUE_OLD_STRATEGY_FLAG)
+    self.remove_arg(showmap_args, constants.SCHEDULER_FLAG)
+    self.remove_arg(showmap_args, constants.CMPLOG_FLAG)
 
     # Replace -o argument.
     if environment.get_value('USE_MINIJAIL'):


Test patch: