Prompt file imported from xsscx/fuzz (.github/prompts/triage-new-poc.prompt.md). Copyright stays with the author.

Triage New PoC File

Name: triage-new-poc
Author: xsscx

Purpose

When a new crash file is discovered (from CFL fuzzing, manual testing, or external report), triage it and integrate into this corpus.

When to Use

After a CFL fuzzer discovers a new crash (crash-* file in research repo root)
When receiving an externally reported ICC crash file
When promoting a slow-unit-* or oom-* to the PoC corpus

Workflow

Step 1 — Classify the crash

Run with ASAN-instrumented tools to identify the vulnerability:

# From xsscx/research
ASAN_OPTIONS=detect_leaks=0 iccanalyzer-lite/iccanalyzer-lite -a <crash_file>

Determine:

Crash type: ASAN (heap-buffer-overflow, stack-buffer-overflow, use-after-free) or UBSAN (runtime error) or signal (SIGSEGV, SIGABRT)
CWE classification: Map to CWE-122, CWE-121, CWE-476, CWE-789, etc.
Crash location: Class::Method at File.cpp:LineN
Affected component: Which iccDEV library function

Step 2 — Check for duplicates

# Compare crash stack trace against existing PoCs
for existing in graphics/icc/*.icc; do
  ASAN_OPTIONS=detect_leaks=0 iccanalyzer-lite/iccanalyzer-lite -a "$existing" 2>&1 \
    | grep -E 'ERROR:|runtime error:' | head -1
done | sort -u

Step 3 — Name the file

Use the naming convention:

{crash_type}-{Class}-{Method}-{File}_cpp-Line{N}.icc

Abbreviations:

Crash Type	Prefix
Heap buffer overflow	`hbo`
Stack buffer overflow	`sbo`
SIGSEGV / NULL deref	`segv` or `npd`
Out of memory	`oom`
Undefined behavior	`ub`
Stack overflow	`so`

Step 4 — Place and seed

# Add to corpus
cp <crash_file> graphics/icc/<new_name>.icc

# Seed CFL fuzzers
cp graphics/icc/<new_name>.icc ../cfl/corpus-icc_profile_fuzzer/
cp graphics/icc/<new_name>.icc ../cfl/corpus-icc_toxml_fuzzer/

Step 5 — For multi-profile crash files

If the crash came from a multi-profile fuzzer (link, v5dspobs, applyprofiles), extract individual profiles first:

# From xsscx/research
.github/scripts/unbundle-fuzzer-input.sh <fuzzer_type> <crash_file>
# Output: ./tmp/icc_<fuzzer>/ with individual profiles

Step 6 — Verify with upstream tools

# Check if upstream tool also crashes (confirms it's a valid upstream bug)
iccDEV/Build/Tools/IccToXml/IccToXml <new_name>.icc /tmp/test.xml

Step 7 — Commit

git add graphics/icc/<new_name>.icc
git commit -m "fuzz: add {crash_type} PoC for {Class}::{Method}

CWE-{N}: {description}
Crash site: {File}.cpp:{Line}
Found by: {fuzzer_name} / {tool}"

Output

Named PoC file in graphics/icc/
CWE classification
Whether upstream tool also crashes (valid upstream bug vs. fuzzer-only)
CFL patch recommendation if applicable

# Triage New PoC File ## Purpose When a new crash file is discovered (from CFL fuzzing, manual testing, or external report), triage it and integrate into this corpus. ## When to Use - After a CFL fuzzer discovers a new crash (`crash-*` file in research repo root) - When receiving an externally reported ICC crash file - When promoting a `slow-unit-*` or `oom-*` to the PoC corpus ## Workflow ### Step 1 — Classify the crash Run with ASAN-instrumented tools to identify the vulnerability: ```bash # From xsscx/research ASAN_OPTIONS=detect_leaks=0 iccanalyzer-lite/iccanalyzer-lite -a <crash_file> ``` Determine: - **Crash type**: ASAN (heap-buffer-overflow, stack-buffer-overflow, use-after-free) or UBSAN (runtime error) or signal (SIGSEGV, SIGABRT) - **CWE classification**: Map to CWE-122, CWE-121, CWE-476, CWE-789, etc. - **Crash location**: Class::Method at File.cpp:LineN - **Affected component**: Which iccDEV library function ### Step 2 — Check for duplicates ```bash # Compare crash stack trace against existing PoCs for existing in graphics/icc/*.icc; do ASAN_OPTIONS=detect_leaks=0 iccanalyzer-lite/iccanalyzer-lite -a "$existing" 2>&1 \ | grep -E 'ERROR:|runtime error:' | head -1 done | sort -u ``` ### Step 3 — Name the file Use the naming convention: ``` {crash_type}-{Class}-{Method}-{File}_cpp-Line{N}.icc ``` Abbreviations: | Crash Type | Prefix | |-----------|--------| | Heap buffer overflow | `hbo` | | Stack buffer overflow | `sbo` | | SIGSEGV / NULL deref | `segv` or `npd` | | Out of memory | `oom` | | Undefined behavior | `ub` | | Stack overflow | `so` | ### Step 4 — Place and seed ```bash # Add to corpus cp <crash_file> graphics/icc/<new_name>.icc # Seed CFL fuzzers cp graphics/icc/<new_name>.icc ../cfl/corpus-icc_profile_fuzzer/ cp graphics/icc/<new_name>.icc ../cfl/corpus-icc_toxml_fuzzer/ ``` ### Step 5 — For multi-profile crash files If the crash came from a multi-profile fuzzer (link, v5dspobs, applyprofiles), extract individual profiles first: ```bash # From xsscx/research .github/scripts/unbundle-fuzzer-input.sh <fuzzer_type> <crash_file> # Output: ./tmp/icc_<fuzzer>/ with individual profiles ``` ### Step 6 — Verify with upstream tools ```bash # Check if upstream tool also crashes (confirms it's a valid upstream bug) iccDEV/Build/Tools/IccToXml/IccToXml <new_name>.icc /tmp/test.xml ``` ### Step 7 — Commit ```bash git add graphics/icc/<new_name>.icc git commit -m "fuzz: add {crash_type} PoC for {Class}::{Method} CWE-{N}: {description} Crash site: {File}.cpp:{Line} Found by: {fuzzer_name} / {tool}" ``` ## Output - Named PoC file in `graphics/icc/` - CWE classification - Whether upstream tool also crashes (valid upstream bug vs. fuzzer-only) - CFL patch recommendation if applicable

{ "prompt": "# Triage New PoC File\n\n## Purpose\nWhen a new crash file is discovered (from CFL fuzzing, manual testing, or external\nreport), triage it and integrate into this corpus.\n\n## When to Use\n- After a CFL fuzzer discovers a new crash (`crash-*` file in research repo root)\n- When receiving an externally reported ICC crash file\n- When promoting a `slow-unit-*` or `oom-*` to the PoC corpus\n\n## Workflow\n\n### Step 1 — Classify the crash\nRun with ASAN-instrumented tools to identify the vulnerability:\n```bash\n# From xsscx/research\nASAN_OPTIONS=detect_leaks=0 iccanalyzer-lite/iccanalyzer-lite -a <crash_file>\n```\n\nDetermine:\n- **Crash type**: ASAN (heap-buffer-overflow, stack-buffer-overflow, use-after-free)\n or UBSAN (runtime error) or signal (SIGSEGV, SIGABRT)\n- **CWE classification**: Map to CWE-122, CWE-121, CWE-476, CWE-789, etc.\n- **Crash location**: Class::Method at File.cpp:LineN\n- **Affected component**: Which iccDEV library function\n\n### Step 2 — Check for duplicates\n```bash\n# Compare crash stack trace against existing PoCs\nfor existing in graphics/icc/*.icc; do\n ASAN_OPTIONS=detect_leaks=0 iccanalyzer-lite/iccanalyzer-lite -a \"$existing\" 2>&1 \\\n | grep -E 'ERROR:|runtime error:' | head -1\ndone | sort -u\n```\n\n### Step 3 — Name the file\nUse the naming convention:\n```\n{crash_type}-{Class}-{Method}-{File}_cpp-Line{N}.icc\n```\n\nAbbreviations:\n| Crash Type | Prefix |\n|-----------|--------|\n| Heap buffer overflow | `hbo` |\n| Stack buffer overflow | `sbo` |\n| SIGSEGV / NULL deref | `segv` or `npd` |\n| Out of memory | `oom` |\n| Undefined behavior | `ub` |\n| Stack overflow | `so` |\n\n### Step 4 — Place and seed\n```bash\n# Add to corpus\ncp <crash_file> graphics/icc/<new_name>.icc\n\n# Seed CFL fuzzers\ncp graphics/icc/<new_name>.icc ../cfl/corpus-icc_profile_fuzzer/\ncp graphics/icc/<new_name>.icc ../cfl/corpus-icc_toxml_fuzzer/\n```\n\n### Step 5 — For multi-profile crash files\nIf the crash came from a multi-profile fuzzer (link, v5dspobs, applyprofiles),\nextract individual profiles first:\n```bash\n# From xsscx/research\n.github/scripts/unbundle-fuzzer-input.sh <fuzzer_type> <crash_file>\n# Output: ./tmp/icc_<fuzzer>/ with individual profiles\n```\n\n### Step 6 — Verify with upstream tools\n```bash\n# Check if upstream tool also crashes (confirms it's a valid upstream bug)\niccDEV/Build/Tools/IccToXml/IccToXml <new_name>.icc /tmp/test.xml\n```\n\n### Step 7 — Commit\n```bash\ngit add graphics/icc/<new_name>.icc\ngit commit -m \"fuzz: add {crash_type} PoC for {Class}::{Method}\n\nCWE-{N}: {description}\nCrash site: {File}.cpp:{Line}\nFound by: {fuzzer_name} / {tool}\"\n```\n\n## Output\n- Named PoC file in `graphics/icc/`\n- CWE classification\n- Whether upstream tool also crashes (valid upstream bug vs. fuzzer-only)\n- CFL patch recommendation if applicable", "variables": [], "notes": "Determine: - **Crash type**: ASAN (heap-buffer-overflow, stack-buffer-overflow, use-after-free) or UBSAN (runtime error) or signal (SIGSEGV, SIGABRT) - **CWE classification**: Map to CWE-122, CWE-121, CWE-476, CWE-789, etc. - **Crash location**: Class::Method at File.cpp:LineN - **Affected component**: Which iccDEV library function", "metadata": { "source": { "provider": "github-prompts", "repository": "https://github.com/xsscx/fuzz", "path": ".github/prompts/triage-new-poc.prompt.md", "ref": "782dd8a10bea50ed83c5d4d410624447ba503e7e", "url": "https://github.com/xsscx/fuzz/blob/782dd8a10bea50ed83c5d4d410624447ba503e7e/.github/prompts/triage-new-poc.prompt.md", "key": "xsscx/fuzz/.github/prompts/triage-new-poc.prompt.md" } } }

triage-new-poc

About