Add mini CmpLog

examples/cmplog.rs

@@ -0,0 +1,31 @@
+fn main() {
+    // This fuzz harness demonstrates the capabilities of CmpLog.
+    // Simply run the fuzzer with the `-c 0` flag and it should find the crash immediately.
+    afl::fuzz!(|data: &[u8]| {
+        if data.len() != 16 {
+            return;
+        }
+        if data[0] != b'A' {
+            return;
+        }
+        if data[1] != b'B' {
+            return;
+        }
+        if data[2] != b'C' {
+            return;
+        }
+        if data[3] != b'D' {
+            return;
+        }
+
+        if data[4..8] != 0x69694141_i32.to_le_bytes() {
+            return;
+        };
+
+        if data[8..12] != *b"1234" || data[12..16] != *b"EFGH" {
+            return;
+        };
+
+        panic!("BOOM");
+    });
+}

src/bin/cargo-afl.rs

@@ -43,6 +43,9 @@ fn main() {
             let args = sub_matches
                 .get_many::<OsString>("afl-fuzz args")
                 .unwrap_or_default();
+            // We prepend -c0 to the AFL++ arguments
+            let cmplog_flag = vec![OsString::from("-c0")];
+            let args = cmplog_flag.iter().chain(args);
             let timeout = sub_matches.get_one::<u64>("max_total_time").copied();
             if timeout.is_some() {
                 eprintln!(
@@ -370,6 +373,8 @@ where
          -C llvm-args=-sanitizer-coverage-level=3 \
          -C llvm-args=-sanitizer-coverage-trace-pc-guard \
          -C llvm-args=-sanitizer-coverage-prune-blocks=0 \
+         -C llvm-args=-sanitizer-coverage-trace-compares \
+         -C llvm-args=-sanitizer-coverage-trace-divs \
          -C opt-level=3 \
          -C target-cpu=native "
     );