Demonstration of issues with using gofuzz (no-hypen) with go-fuzz (has a hypen)

antifuzz.go

// +build gofuzz

// Package antifuzz shows how gofuzz transformation of inputs breaks coverage guidance.
//
// When running "go-fuzz -func FuzzGood", a crasher is found almost immediately. In contrast,
// when running "go-fuzz -func FuzzBad" no crasher is found and it likely won't for a long time.
package antifuzz

import fuzz "github.com/google/gofuzz"

func uut(data []byte) {

	if len(data) < 5 {
		return
	}
	if data[0] == 1 {
		if data[1] == 2 {
			if data[2] == 3 {
				if data[3] == 4 {
					if data[4] == 5 {
						panic("found the bug")
					}
				}
			}
		}
	}
}

// FuzzBad uses NewFromGoFuzz to build an input to uut.
func FuzzBad(data []byte) int {
	var input []byte
	fuzz.NewFromGoFuzz(data).Fuzz(&input)
	uut(input)
	return 0
}

// FuzzGood simply passes in the data it receives from go-fuzz (note the hyphen).
func FuzzGood(data []byte) int {
	uut(data)
	return 0
}