doc: clarify libfuzzer-nosan preset uses build_fuzz_nosan dir
What the developer wrote
Authored by ImMike
doc: clarify libfuzzer-nosan preset uses build_fuzz_nosan dir
The fuzzing quickstart documents the libfuzzer preset with build_fuzz
as the build directory, then mentions libfuzzer-nosan as an alternative
without noting that this preset uses a different binary directory
(build_fuzz_nosan, per CMakePresets.json line 54). A reader following
the quickstart with --preset=libfuzzer-nosan and then running
'cmake --build build_fuzz' as shown will operate against the wrong
(or empty) directory.
Add a clarifying note at the first mention in the Quickstart.
What changed, and why it matters
This is a documentation-only change that adds a clarifying note to the fuzzing quickstart guide. It explains that using the libfuzzer-nosan preset creates binaries in a different directory (build_fuzz_nosan) than the regular libfuzzer preset (build_fuzz). There is no code change and no security issue.
No security action needed. This is a benign documentation clarification.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies doc/fuzzing.md to note that the libfuzzer-nosan CMake preset outputs to build_fuzz_nosan rather than build_fuzz. This prevents readers from accidentally running cmake –build build_fuzz or executing build_fuzz/bin/fuzz when they selected the nosan preset. No source code, build system logic, or cryptographic behavior is changed.
Changed components
doc/fuzzing.mdInspect captured patch +2 / −0
diff --git a/doc/fuzzing.md b/doc/fuzzing.md
index 4b108862..253f3f12 100644
--- a/doc/fuzzing.md
+++ b/doc/fuzzing.md
@@ -14,6 +14,8 @@ $ FUZZ=process_message build_fuzz/bin/fuzz
```
One can use `--preset=libfuzzer-nosan` to do the same without common sanitizers enabled.
+Note that this preset uses a different build directory, so replace `build_fuzz` with
+`build_fuzz_nosan` in the build and run commands above.
See [further](#run-without-sanitizers-for-increased-throughput) for more information.
There is also a runner script to execute all fuzz targets. Refer to
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.