The default afl behaviour is to classify runs that overrun the timeout limit by 2x as hangs. These get saved and can later be inspected to identify issues in the fuzzing code. The recommended action when experiencing a lot of timeouts is to artificially reduce the timeout limit until regular timeouts get saved as hangs. See here AFLplusplus/AFLplusplus#2011
When I tried the same by appending -t 10 (default is 1000) to cargo afl fuzz i still only get timeouts but 0 hangs. I wonder if this is a afl.rs specific issue:
The default afl behaviour is to classify runs that overrun the timeout limit by 2x as hangs. These get saved and can later be inspected to identify issues in the fuzzing code. The recommended action when experiencing a lot of timeouts is to artificially reduce the timeout limit until regular timeouts get saved as hangs. See here AFLplusplus/AFLplusplus#2011
When I tried the same by appending -t 10 (default is 1000) to cargo afl fuzz i still only get timeouts but 0 hangs. I wonder if this is a afl.rs specific issue: