<p>When a fuzz-test crashes it will print the error stack. The top will give you an idea what caused the issue, and the bottom will provide you with a text-formatted version of the crashing fuzz seed.</p>
<pre><code>fuzz: ../../src/wallet/test/fuzz/coinselection.cpp:120: void wallet::coinselection_fuzz_target(FuzzBufferType): Assertion `result_bnb-&gt;GetChange(coin_params.m_cost_of_change, CAmount{0}) == 0' failed.
==2010034== ERROR: libFuzzer: deadly signal
    #0 0x55c5cfab4841 in __sanitizer_print_stack_trace (/home/murch/Workspace/pr-27585/fuzz-build/src/test/fuzz/fuzz+0x1611841) (BuildId: 7e7dce8b351f3ad01c4e9815f15265d8d7a64c61)
    …
    [skipped]
    …
artifact_prefix='./'; Test unit written to ./crash-05d2df3cebde688a5114737869a65484cecd9f45
Base64: MP3//////wT/LzMBEABL////////Wv///yWyEABLAADoQP//PP//CAAAPQAAAAAAAAAAPQEAAAAAAAAA/V12+w==
</code></pre>
<p>To figure out what caused the crash, you can use run the fuzzer against just the crashing seed, and use your regular debugging approach e.g.:</p>
<pre class="lang-bash prettyprint-override"><code>$ FUZZ=coinselection src/test/fuzz/fuzz crash-05d2df3cebde688a5114737869a65484cecd9f45
</code></pre>
<p>If you are not the author of the PR that caused the crashing fuzz test, you can provide the fuzz seed to the other developer via the <em>base64</em> encoding at the bottom of the error message. Leave them for example instructions like this in a comment on the PR:</p>
<pre class="lang-bash prettyprint-override"><code>$ echo &quot;MP3//////wT/LzMBEABL////////Wv///yWyEABLAADoQP//PP//CAAAPQAAAAAAAAAAPQEAAAAA AAAA/V12+w==&quot; | base64 -d &gt; crash.input
$ FUZZ=coinselection src/test/fuzz/fuzz crash.input
</code></pre>
<p>The string in the quotation marks is simply the base64 encoding from above.</p>

CC BY-SA 4.0
2023-08-15T17:22:26.263Z
2023-08-15T17:36:22.600Z
2023-08-15T17:36:22.600Z
Murch
<p>When you run a fuzzer and it crashes, what is a way that you can easily transfer the fuzz seed to the author of the PR?</p>

<bitcoin-core-development><fuzz-test>
How can you transfer a seed that crashed a fuzz test via text?
Murch
# How can you transfer a seed that crashed a fuzz test via text?

(Asked by: username_0 on 2023-08-15)

When you run a fuzzer and it crashes, what is a way that you can easily transfer the fuzz seed to the author of the PR?

**Tags:** bitcoin-core-development, fuzz-test


---

## 1 answers

### Answer by username_0 on 2023-08-15. Score: 1 | Accepted answer

When a fuzz-test crashes it will print the error stack. The top will give you an idea what caused the issue, and the bottom will provide you with a text-formatted version of the crashing fuzz seed.
fuzz: ../../src/wallet/test/fuzz/coinselection.cpp:120: void wallet::coinselection_fuzz_target(FuzzBufferType): Assertion `result_bnb->GetChange(coin_params.m_cost_of_change, CAmount{0}) == 0' failed.
==2010034== ERROR: libFuzzer: deadly signal
    #0 0x55c5cfab4841 in __sanitizer_print_stack_trace (/home/murch/Workspace/pr-27585/fuzz-build/src/test/fuzz/fuzz+0x1611841) (BuildId: 7e7dce8b351f3ad01c4e9815f15265d8d7a64c61)
    …
    [skipped]
    …
artifact_prefix='./'; Test unit written to ./crash-05d2df3cebde688a5114737869a65484cecd9f45
Base64: MP3//////wT/LzMBEABL////////Wv///yWyEABLAADoQP//PP//CAAAPQAAAAAAAAAAPQEAAAAAAAAA/V12+w==

To figure out what caused the crash, you can use run the fuzzer against just the crashing seed, and use your regular debugging approach e.g.:
$ FUZZ=coinselection src/test/fuzz/fuzz crash-05d2df3cebde688a5114737869a65484cecd9f45

If you are not the author of the PR that caused the crashing fuzz test, you can provide the fuzz seed to the other developer via the base64 encoding at the bottom of the error message. Leave them for example instructions like this in a comment on the PR:
$ echo "MP3//////wT/LzMBEABL////////Wv///yWyEABLAADoQP//PP//CAAAPQAAAAAAAAAAPQEAAAAA AAAA/V12+w==" | base64 -d > crash.input
$ FUZZ=coinselection src/test/fuzz/fuzz crash.input

The string in the quotation marks is simply the base64 encoding from above.


---

