coverage-analysis

To measure fuzzing coverage, build your project with instrumentation flags like -fprofile-instr-generate -fcoverage-mapping, run the fuzzer to generate a .profraw file, then merge and analyze it using llvm-profdata and llvm-cov to identify unexercised code paths.

You generate an HTML coverage report by first merging raw profile data with llvm-profdata merge, then running llvm-cov show with the -format=html flag and specifying the output directory to visualize executed and missed code paths.

Coverage analysis is applicable to C/C++, Rust, and multi-language fuzzing campaigns, requiring instrumentation builds and LLVM tooling to generate reports that reveal exactly which parts of the code are exercised by your harnesses.

Low code coverage indicates your harness is not reaching deep code paths, which you can improve by tuning harness inputs, expanding the corpus, and adding dictionary entries based on uncovered branches revealed in the coverage report.

The required LLVM compiler flags for fuzzing coverage instrumentation are -fprofile-instr-generate and -fcoverage-mapping, which attach the necessary instrumentation to identify executed code paths during your fuzzing campaigns.