PDFuzz Artifact

PDFUZZ Artifact Contents src/pdffuzzer.cpp: AFL++ custom mutator (PDFUZZ core). UNIFUZZ_seeds/: PDF seeds from UNIFUZZ. src/fuzzing_scripts/: fuzzing launchers for Xpdf/Poppler tools, PDFium, MuPDF. src/arlington_tsvs/: Arlington PDF model TSVs used as inputs for ambiguity mining. src/agents/arlington_agent.py: LLM-driven pipeline to classify objects, analyze ambiguities, and generate strategies/seeds. src/llm/: LLM client/config (llm_config.yaml) and prompt templates. offine_analysis/analysis/: precomputed ambiguity analysis (*_ambiguities.json). offine_analysis/strategies/: derived mutation strategies (*_strategies.json). experiments/coverage/: Coverage experiment outputs. The Magma evaluation results located at https://zenodo.org/records/18476054. parsers.md: parser versions/commits used in the paper. Quick Start (Fuzzing) Build AFL++ and the target parser (see parsers.md for versions). Build the custom mutator shared library: g++ -std=c++17 -O2 -fPIC -shared src/pdffuzzer.cpp -o libpdffuzzer.so Run a fuzzing script (example: Xpdf pdftotext): export AFL_ROOT=/path/to/AFLplusplusexport TARGET_ROOT=/path/to/xpdf-4.00export AFL_CUSTOM_MUTATOR_LIBRARY=/path/to/libpdffuzzer.soexport PDFFUZZ_ENABLE_BYTE=1export PDFFUZZ_ENABLE_AMBIG=1./src/fuzzing_scripts/unifuzz_xpdf4.00_pdftotext_pdffuzzer.sh \ -M normal -i /UNIFUZZ_seeds -o /path/to/out Notes: The scripts in src/fuzzing_scripts/ also contain a MUTATOR_SO=... path you can edit if you prefer not to set AFL_CUSTOM_MUTATOR_LIBRARY. Optional: LLM Ambiguity Pipeline Requires an API key (see src/llm/llm_config.yaml). export OPENAI_API_KEY=...python -m src.agents.arlington_agent full \ --tsv-dir src/arlington_tsvs \ --out-dir /tmp/arlington_groups \ --workspace /tmp/llm_workspace