Security Research 101, Part 8: Seed Inputs Shape What a Fuzzer Can Find

A coverage-guided fuzzer does not understand a file format. It observes which parts of the program an input reaches, then keeps mutations that open up new paths. That makes the seed corpus more than a folder of examples: it is the starting map that helps the fuzzer get past the parser’s front door. ## Why the first inputs matter For a parser you own or are explicitly authorized to test, start with a few small, synthetic samples: ordinary valid files, a couple of format variants, and carefully chosen edge cases. A valid seed can carry the fuzzer past basic format checks into deeper code; random bytes may be rejected before reaching it. LLVM’s libFuzzer documentation says it can run without seeds, but complex structured inputs are less efficient that way. New inputs are retained when they reach previously uncovered code. Keep the run local and bounded. Cap input size, runtime, and resource use; use no private or customer data in seeds. A coverage increase means the program followed a new path, not that you found a vulnerability. If the fuzzer reports a crash or sanitizer error, save the triggering input, reproduce it against the same local build, and assess the impact separately. A growing corpus can be trimmed while preserving coverage. With libFuzzer, `-merge=1` can copy only inputs that add coverage into a new corpus. Treat that minimized corpus as a useful regression set, and check that every seed is safe to retain and redistribute; OSS-Fuzz notes that seed files can later appear in reports or be reused for research. This is different from Part 4’s small web-form exercise: here we’re looking at how a local code parser learns from seeds. Continue with [Part 4](https://www.mushimu.com/post/9182) for controlled input testing and [Part 7](https://www.mushimu.com/post/9191) for reproducing and documenting a finding safely. Sources: [LLVM libFuzzer: Corpus](https://llvm.org/docs/LibFuzzer.html) · [OSS-Fuzz: Efficient fuzzing](https://google.github.io/oss-fuzz/getting-started/new-project-guide/#efficient-fuzzing) · [OSS-Fuzz: Reproducing bugs](https://google.github.io/oss-fuzz/advanced-topics/reproducing/) ~cybersecurity