Artifact of Fuzz3: Entropy as a Third Oracle (2026)

Abstract. Abstract. Fuzz testing finds security issues and improves robustness; however, it has only two implicit test oracles: timeout and crash. Information theory gives a third: entropy, which is generic, low-cost and widely applicable. Fuzz3 is SBSE blackbox and programming language agnostic. Applied to 4 open source software, it found 4 bugs, 1 already fixed.

Methodology

Supported Mutator Operators. The mutators Fuzz3 currently supports are as follows:

Bug Found

We fuzzed with Fuzz3 the following SUTs:

We found several bugs using Fuzz3:

Bug #1 – Crash in clang-format caused by a NUL character inside a comment 

We found a bug in clang-format. With `--dry-run` it crashes on an input file that contains a NUL byte (i.e. `^@`) inside a block comment:

#if defined(AAA) && (BBB + 3) > 9 /*^@comment */ && !defined(CCC)
int f(void) [ return 1; }
#elif defined(DDD) || defined(EEE)
int f(void) { return 2; } /* trailing */
#else
int f(void) { return 3; }   

We reported the bug in clang‑23. Tracing it back showed it existed already in clang‑10.

The report was acknowledged within one hour and fixed by the LLVM developers on the same day [1].

---

Bug #2 – Hang in clang-format caused by a non‑printable character in a comment

`clang-format test.c` hangs on the following input because it contains a non‑printable ASCII escape character (hex `0x1B`, also shown as `^[`):

int32_t f[][1];
// g^[];
               void main() {}

The escape character began an incomplete terminal‑control sequence. We did not file a bug report with the LLVM developers, as the issue seems more general OS matter (it also makes the `cat` utility hang). Redirecting the output to a file avoids the hang.

---

Bug #3 – Failures in the CI pipeline of Cirq due to missing LaTeX dependencies  

We fuzzed the Cirq test suite with pytest. Because we used an empty list of mutators, the only expected source of output variation was the total runtime (in seconds).

At the start of fuzzing, while collecting initial input‑output entropy, the measured output entropy was 2.585, larger than expected from runtime variation.

The root cause turned out to be missing LaTeX libraries, which produced errors such as:

cirq-core/cirq/contrib/quantikz/circuit_to_latex_render_test.py:41: AssertionError
!!! pdflatex failed on run 1 (exit code 1) !!!
! LaTeX Error: File `standalone.cls' not found.
...
E           pylatex.errors.CompilerError: No LaTex compiler was found

Consequences: Two tests in `cirq.contrib` failed instead of being skipped when external dependencies are absent. 

Additionally, the error messages were not printed in a deterministic order, inflating the initial output entropy.

We reported the issue (including the logs) to the Cirq developers [1].

---

Bug #4 – Improper URL validation and wrong response codes in httpcore

The bug in httpcore concerns malformed URLs being accepted as valid. An example (anonymised) is:

```
http://www.xxxx/xxxx/\nhttp://www.xxxx/xxx/
```

Instead of returning a 404 or raising an exception, the library returns a 301 redirect, and the redirect URL itself is malformed:

```
http://www.xxxx/xxxx/http:/www.xxxx/xxxx/
```

Similar malformed inputs also produced 301 responses with redirects that point to syntactically valid but incorrect domains.  

We reported this bug to the developers [1].

---

References

1. Anonymous, *2026* – internal bug‑report identifiers in this Zenodo record (see PDF files)   ````