[libFuzzer] mention more trophies

[oota-llvm.git] / docs / LibFuzzer.rst

diff --git a/docs/LibFuzzer.rst b/docs/LibFuzzer.rst
index 519c651bf00851043d36f8a8c69bbe449a20dae9..b51e0418c65e698b277626c4b0f2dee3af836bdd 100644 (file)
--- a/docs/LibFuzzer.rst
+++ b/docs/LibFuzzer.rst
@@ -61,7 +61,7 @@ The most important flags are::
   mutate_depth                         5       Apply this number of consecutive mutations to each input.
   timeout                              1200    Timeout in seconds (if positive). If one unit runs more than this number of seconds the process will abort.
   help                                 0       Print help.
-  save_minimized_corpus                0       If 1, the minimized corpus is saved into the first input directory
+  save_minimized_corpus                0       If 1, the minimized corpus is saved into the first input directory. Example: ./fuzzer -save_minimized_corpus=1 NEW_EMPTY_DIR OLD_CORPUS
   jobs                                 0       Number of jobs to run. If jobs >= 1 we spawn this number of jobs in separate worker processes with stdout/stderr redirected to fuzz-JOB.log.
   workers                              0       Number of simultaneous worker processes to run the jobs. If zero, "min(jobs,NumberOfCpuCores()/2)" is used.
   sync_command                         0       Execute an external command "<sync_command> <test_corpus>" to synchronize the test corpus.
@@ -439,6 +439,10 @@ Trophies
 
 * ICU: http://bugs.icu-project.org/trac/ticket/11838
 
+* Freetype: https://savannah.nongnu.org/search/?words=LibFuzzer&type_of_search=bugs&Search=Search&exact=1#options
+
+* Linux Kernel's BPF verifier: https://github.com/iovisor/bpf-fuzzer
+
 * LLVM:
 
   * Clang: https://llvm.org/bugs/show_bug.cgi?id=23057