From e35f7d615d890022152952a130e01716425b598a Mon Sep 17 00:00:00 2001
From: Peter Samarin <peter.samarin@code-intelligence.com>
Date: Thu, 26 Jan 2023 17:01:58 +0100
Subject: [PATCH 1/4] fuzztests: check error code of each individual fuzztest

---
 fuzztests/runFuzzTests.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fuzztests/runFuzzTests.js b/fuzztests/runFuzzTests.js
index 7f5963cb5..b7f43a7c1 100755
--- a/fuzztests/runFuzzTests.js
+++ b/fuzztests/runFuzzTests.js
@@ -47,7 +47,8 @@ async function executeFuzzTest(file, name) {
 		});
 		test.on("close", (code) => {
 			console.log(`--- Finished fuzz test ${file} > ${name} with code ${code}`);
-			resolve();
+			if (code !== 0 && code !== null) reject(code);
+			else resolve();
 		});
 	});
 }

From 11eeae25fa0a2b6d5893a8facdbb70167ac69c77 Mon Sep 17 00:00:00 2001
From: Peter Samarin <peter.samarin@code-intelligence.com>
Date: Thu, 26 Jan 2023 17:20:39 +0100
Subject: [PATCH 2/4] Fix fuzztests

---
 fuzztests/FuzzedDataProvider.fuzz.js | 36 +++++++++++++++-------------
 fuzztests/fuzzer.fuzz.js             |  6 ++---
 fuzztests/instrument.fuzz.js         |  7 +++---
 fuzztests/runFuzzTests.js            |  2 +-
 packages/jest-runner/config.ts       |  2 +-
 packages/jest-runner/fuzz.ts         | 23 +++++++++---------
 6 files changed, 40 insertions(+), 36 deletions(-)

diff --git a/fuzztests/FuzzedDataProvider.fuzz.js b/fuzztests/FuzzedDataProvider.fuzz.js
index 110082ed5..f677eadb4 100644
--- a/fuzztests/FuzzedDataProvider.fuzz.js
+++ b/fuzztests/FuzzedDataProvider.fuzz.js
@@ -23,23 +23,27 @@ describe("FuzzedDataProvider", () => {
 	// FuzzedDataProvider as possible, before invoking a terminating one
 	// like consumeRemainingXY. Strange combinations of functions could produce a
 	// one off error.
-	it.fuzz("consumes the provided input", (data) => {
-		const provider = new FuzzedDataProvider(data);
-		const properties = Object.getOwnPropertyNames(
-			Object.getPrototypeOf(provider)
-		);
-		const methodNames = properties
-			.filter((p) => provider[p] instanceof Function)
-			.filter((m) => provider[m].length === 0);
+	it.fuzz(
+		"consumes the provided input",
+		(data) => {
+			const provider = new FuzzedDataProvider(data);
+			const properties = Object.getOwnPropertyNames(
+				Object.getPrototypeOf(provider)
+			);
+			const methodNames = properties
+				.filter((p) => provider[p] instanceof Function)
+				.filter((m) => provider[m].length === 0);
 
-		let usedMethods = "";
-		while (provider.remainingBytes > 0) {
-			const methodName = provider.pickValue(methodNames);
-			provider[methodName].call(provider);
-			usedMethods += methodName;
-		}
-		jazzer.exploreState(hash(usedMethods), 31);
-	});
+			let usedMethods = "";
+			while (provider.remainingBytes > 0) {
+				const methodName = provider.pickValue(methodNames);
+				provider[methodName].call(provider);
+				usedMethods += methodName;
+			}
+			jazzer.exploreState(hash(usedMethods), 31);
+		},
+		40000
+	);
 });
 
 const hash = (str) => {
diff --git a/fuzztests/fuzzer.fuzz.js b/fuzztests/fuzzer.fuzz.js
index 2f7084aa5..4a7427e37 100644
--- a/fuzztests/fuzzer.fuzz.js
+++ b/fuzztests/fuzzer.fuzz.js
@@ -25,15 +25,15 @@ describe("fuzzer", () => {
 		let a = provider.consumeString(10);
 		let b = provider.consumeString(10);
 		let op = provider.consumeString(5);
-		expect(fuzzer.traceStrCmp(a, b, op, 0)).toBeDefined();
+		expect(fuzzer.tracer.traceStrCmp(a, b, op, 0)).toBeDefined();
 	});
 
 	it.fuzz("use never zero policy", (data) => {
 		const provider = new FuzzedDataProvider(data);
 		const iterations = provider.consumeIntegralInRange(1, 1 << 16);
 		for (let i = 0; i < iterations; i++) {
-			fuzzer.incrementCounter(0);
+			fuzzer.coverageTracker.incrementCounter(0);
 		}
-		expect(fuzzer.readCounter(0)).not.toEqual(0);
+		expect(fuzzer.coverageTracker.readCounter(0)).not.toEqual(0);
 	});
 });
diff --git a/fuzztests/instrument.fuzz.js b/fuzztests/instrument.fuzz.js
index 7447d3d51..5a42d0282 100644
--- a/fuzztests/instrument.fuzz.js
+++ b/fuzztests/instrument.fuzz.js
@@ -16,12 +16,13 @@
 
 /* eslint-disable no-undef, @typescript-eslint/no-var-requires */
 
-const { shouldInstrumentFn } = require("@jazzer.js/instrumentor");
+const { Instrumentor } = require("@jazzer.js/instrumentor");
 const { FuzzedDataProvider } = require("@jazzer.js/core");
 
 describe("instrument", () => {
 	it.fuzz("shouldInstrumentFn", (data) => {
 		const provider = new FuzzedDataProvider(data);
+		const filename = provider.consumeString(10);
 		const includes = provider.consumeStringArray(
 			provider.consumeIntegralInRange(0, 10),
 			5
@@ -31,8 +32,8 @@ describe("instrument", () => {
 			5
 		);
 
-		const check = shouldInstrumentFn(includes, excludes);
-
+		const instrumentor = new Instrumentor(includes, excludes);
+		const check = instrumentor.shouldInstrumentForFuzzing(filename);
 		const includeAll = includes.some((e) => e === "*");
 		const excludeAll = excludes.some((e) => e === "*");
 
diff --git a/fuzztests/runFuzzTests.js b/fuzztests/runFuzzTests.js
index b7f43a7c1..b0f446fbf 100755
--- a/fuzztests/runFuzzTests.js
+++ b/fuzztests/runFuzzTests.js
@@ -9,7 +9,7 @@ const fs = require("fs/promises");
 const { spawn } = require("child_process");
 
 const fuzzTestFileExtension = "fuzz.js";
-const fuzzTestNameRegex = /it.fuzz\("(.*)"/g;
+const fuzzTestNameRegex = /it.fuzz\(\s*"(.*)"/g;
 
 async function findFuzzTestNamesInFile(file) {
 	const fuzzTestNames = [];
diff --git a/packages/jest-runner/config.ts b/packages/jest-runner/config.ts
index cd685c375..205751306 100644
--- a/packages/jest-runner/config.ts
+++ b/packages/jest-runner/config.ts
@@ -27,7 +27,7 @@ export const defaultOptions: Options = {
 	fuzzerOptions: [],
 	sync: false,
 	expectedErrors: [],
-	timeout: 5000, // default Jest timeout
+	timeout: undefined,
 	coverage: false,
 	coverageDirectory: "coverage",
 	coverageReporters: ["json", "text", "lcov", "clover"], // default Jest reporters
diff --git a/packages/jest-runner/fuzz.ts b/packages/jest-runner/fuzz.ts
index 6b3d4db43..852055be6 100644
--- a/packages/jest-runner/fuzz.ts
+++ b/packages/jest-runner/fuzz.ts
@@ -42,7 +42,11 @@ export class FuzzerStartError extends FuzzerError {}
 // Use Jests global object definition.
 const g = globalThis as unknown as Global.Global;
 
-export type FuzzTest = (name: Global.TestNameLike, fn: FuzzTarget) => void;
+export type FuzzTest = (
+	name: Global.TestNameLike,
+	fn: FuzzTarget,
+	timeout?: number
+) => void;
 
 export const skip: FuzzTest = (name) => {
 	g.test.skip(toTestName(name), () => {
@@ -50,7 +54,7 @@ export const skip: FuzzTest = (name) => {
 	});
 };
 
-export const fuzz: FuzzTest = (name, fn) => {
+export const fuzz: FuzzTest = (name, fn, timeout) => {
 	const testName = toTestName(name);
 
 	// Request the current test file path from the worker to create appropriate
@@ -64,15 +68,14 @@ export const fuzz: FuzzTest = (name, fn) => {
 	// points to the element containing the fuzz function.
 	const testStatePath = currentTestStatePath(testName);
 
-	// The timeout setting is extracted from the test state and defaults to 5s.
-	// Setting timeouts on this level is necessary, as they apply to the
-	// individual inputs and not the whole run.
-	const timeout = currentTimeout();
-
 	const corpus = new Corpus(testFile, testStatePath);
 
 	const fuzzingConfig = loadConfig();
-	fuzzingConfig.timeout = timeout;
+
+	// Timeout priority is: test timeout > config timeout > default timeout.
+	if (!timeout)
+		if (fuzzingConfig.timeout) timeout = fuzzingConfig.timeout;
+		else timeout = 5000;
 
 	if (fuzzingConfig.dryRun) {
 		runInRegressionMode(name, fn, corpus, timeout);
@@ -231,7 +234,3 @@ const currentTestStatePath = (testName: string): string[] => {
 	}
 	return elements;
 };
-
-const currentTimeout = (): number => {
-	return circus.getState().testTimeout || 5000;
-};

From 58411652a56baa0c76c7c3461b2e1be975a11d74 Mon Sep 17 00:00:00 2001
From: Peter Samarin <peter.samarin@code-intelligence.com>
Date: Tue, 31 Jan 2023 16:58:22 +0100
Subject: [PATCH 3/4] Remove signal listeners for SIGALRM and SIGINT introduced
 by "signal-exit"

---
 packages/instrumentor/edgeIdStrategy.ts | 12 ++++++++++++
 tests/timeout/fuzz.js                   | 13 ++++++++++++-
 tests/timeout/package.json              |  8 ++++----
 3 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/packages/instrumentor/edgeIdStrategy.ts b/packages/instrumentor/edgeIdStrategy.ts
index c739c7841..6e838ed9b 100644
--- a/packages/instrumentor/edgeIdStrategy.ts
+++ b/packages/instrumentor/edgeIdStrategy.ts
@@ -21,6 +21,18 @@ import process from "process";
 
 import { fuzzer } from "@jazzer.js/fuzzer";
 
+if (process.listeners) {
+	// "signal-exit" library imported by "proper-lockfile" inserts listeners for all important signals, such as SIGALRM and SIGINT (see https://github.com/tapjs/signal-exit/blob/39a5946d2b04d00106400c0dcc5d358a40892438/signals.js)
+	// libFuzzer has a SIGALRM handler to deal with -timeout flag, here we give the control back to libFuzzer by removing the SIGALRM listeners inserted by "signal-exit".
+	if (process.listeners("SIGALRM").length > 0) {
+		process.removeListener("SIGALRM", process.listeners("SIGALRM")[0]);
+	}
+	// SIGINT: in synchronous mode, pressing CTRL-C does not abort the process. Removing the SIGINT listener inserted by "signal-exit" gives the control back to the users.
+	if (process.listeners("SIGINT").length > 0) {
+		process.removeListener("SIGINT", process.listeners("SIGINT")[0]);
+	}
+}
+
 export interface EdgeIdStrategy {
 	nextEdgeId(): number;
 	startForSourceFile(filename: string): void;
diff --git a/tests/timeout/fuzz.js b/tests/timeout/fuzz.js
index 434e03bc8..94395620e 100644
--- a/tests/timeout/fuzz.js
+++ b/tests/timeout/fuzz.js
@@ -14,13 +14,24 @@
  * limitations under the License.
  */
 
+/**
+ * This is a regression test that checks that running this function with "-timeout=1" does not result in a timeout.
+ *
+ * @param { Buffer } data
+ */
+module.exports.fuzz = function (data) {
+	if (data.length < 8) {
+		return;
+	}
+};
+
 /**
  * Timeouts are directly handled by libFuzzer and can not be intercepted.
  * Due to this, the example is not executed during the test phase.
  *
  * @param { Buffer } data
  */
-module.exports.fuzz = function (data) {
+module.exports.timeout = function (data) {
 	return new Promise((resolve) => {
 		if (data.length <= 10) {
 			resolve();
diff --git a/tests/timeout/package.json b/tests/timeout/package.json
index 8dba7b013..506b58a97 100644
--- a/tests/timeout/package.json
+++ b/tests/timeout/package.json
@@ -1,10 +1,10 @@
 {
-	"name": "jazzerjs-timeout-example",
+	"name": "jazzerjs-timeout-test",
 	"version": "1.0.0",
-	"description": "An example showing how Jazzer.js handles timeouts",
+	"description": "Timeout test: checking that the handler for the SIGALRM signal does not return with error code.",
 	"scripts": {
-		"timeout": "jazzer fuzz -- -timeout=1",
-		"fuzz": "echo \"skipped\"",
+		"timeout": "jazzer fuzz -f=timeout -- -timeout=1",
+		"fuzz": "jazzer fuzz -- -timeout=1 -max_total_time=10",
 		"dryRun": "echo \"skipped\""
 	},
 	"devDependencies": {

From 074745bdc79f01f40cbaa5c7bb77d0491c380542 Mon Sep 17 00:00:00 2001
From: Peter Samarin <peter.samarin@code-intelligence.com>
Date: Tue, 31 Jan 2023 19:37:46 +0100
Subject: [PATCH 4/4] "--timeout=..." is now a native Jazzer.js flag

---
 docs/fuzz-settings.md                            | 10 ++++------
 docs/jest-integration.md                         | 14 +++++++++-----
 examples/jest_integration/integration.fuzz.js    | 16 ++++++++++++++++
 .../test                                         |  1 +
 .../test                                         |  1 +
 fuzztests/.jazzerjsrc                            |  3 ++-
 fuzztests/FuzzedDataProvider.fuzz.js             |  2 +-
 fuzztests/runFuzzTests.js                        |  9 ++++++---
 packages/core/cli.ts                             |  7 +++++++
 packages/core/core.ts                            | 10 ++++++----
 packages/instrumentor/edgeIdStrategy.ts          | 10 +++++++---
 packages/jest-runner/config.ts                   |  2 +-
 packages/jest-runner/fuzz.ts                     |  8 +++++---
 tests/timeout/fuzz.js                            |  2 +-
 tests/timeout/package.json                       |  4 ++--
 15 files changed, 69 insertions(+), 30 deletions(-)
 create mode 100644 examples/jest_integration/integration.fuzz/My_describe/My_fuzz_test_with_an_explicit_timeout_(async)/test
 create mode 100644 examples/jest_integration/integration.fuzz/My_describe/My_fuzz_test_with_an_explicit_timeout_(sync)/test

diff --git a/docs/fuzz-settings.md b/docs/fuzz-settings.md
index 2d787dbef..faab7600c 100644
--- a/docs/fuzz-settings.md
+++ b/docs/fuzz-settings.md
@@ -55,18 +55,16 @@ npx jazzer fuzzTarget -- -use_value_profile=1
 ## Timeout
 
 Invocations of fuzz targets, which take longer than the configured timeout, will
-cause fuzzing to stop and a timeout finding to be reported. This feature is
-directly provided by the underlying fuzzing engine, libFuzzer.
-
-A [default timeout](https://www.llvm.org/docs/LibFuzzer.html#output) of 1200
-seconds is preconfigured, but can be changed using the `-timeout` fuzzer flag.
+cause fuzzing to stop and a timeout finding to be reported. A default timeout of
+5000 milliseconds is preconfigured, but can be changed using the `--timeout`
+fuzzer flag.
 
 Timeouts work in the sync- and asynchronous fuzzing mode.
 
 **Example invocation:**
 
 ```shell
-npx jazzer fuzzTarget -- -timeout=10
+npx jazzer fuzzTarget --timeout=10000
 ```
 
 **Example output:**
diff --git a/docs/jest-integration.md b/docs/jest-integration.md
index e7cc6dcdd..10e778179 100644
--- a/docs/jest-integration.md
+++ b/docs/jest-integration.md
@@ -82,7 +82,8 @@ which can be specified through the CLI client.
 	"excludes": ["node_modules"],
 	"customHooks": [],
 	"fuzzerOptions": [],
-	"sync": false
+	"sync": false,
+	"timeout": 1000
 }
 ```
 
@@ -105,9 +106,13 @@ The resulting code looks very similar to normal Jest tests.
 
 ```javascript
 describe("My describe", () => {
-	it.fuzz("My fuzz test", (data) => {
-		target.fuzzMe(data);
-	});
+	it.fuzz(
+		"My fuzz test",
+		(data) => {
+			target.fuzzMe(data);
+		},
+		2000
+	);
 });
 ```
 
@@ -327,4 +332,3 @@ reimplemented.
 
 - Mock functions
 - Isolated workers
-- Test-based timeouts (third parameter to `test` functions)
diff --git a/examples/jest_integration/integration.fuzz.js b/examples/jest_integration/integration.fuzz.js
index fcac2bba8..fdd954c65 100644
--- a/examples/jest_integration/integration.fuzz.js
+++ b/examples/jest_integration/integration.fuzz.js
@@ -24,6 +24,22 @@ describe("My describe", () => {
 		target.fuzzMe(data);
 	});
 
+	it.fuzz(
+		"My fuzz test with an explicit timeout (async)",
+		async (data) => {
+			target.fuzzMe(data);
+		},
+		1000
+	);
+
+	it.fuzz(
+		"My fuzz test with an explicit timeout (sync)",
+		(data) => {
+			target.fuzzMe(data);
+		},
+		1000
+	);
+
 	it.fuzz("My callback fuzz test", (data, done) => {
 		target.callbackFuzzMe(data, done);
 	});
diff --git a/examples/jest_integration/integration.fuzz/My_describe/My_fuzz_test_with_an_explicit_timeout_(async)/test b/examples/jest_integration/integration.fuzz/My_describe/My_fuzz_test_with_an_explicit_timeout_(async)/test
new file mode 100644
index 000000000..30d74d258
--- /dev/null
+++ b/examples/jest_integration/integration.fuzz/My_describe/My_fuzz_test_with_an_explicit_timeout_(async)/test
@@ -0,0 +1 @@
+test
\ No newline at end of file
diff --git a/examples/jest_integration/integration.fuzz/My_describe/My_fuzz_test_with_an_explicit_timeout_(sync)/test b/examples/jest_integration/integration.fuzz/My_describe/My_fuzz_test_with_an_explicit_timeout_(sync)/test
new file mode 100644
index 000000000..30d74d258
--- /dev/null
+++ b/examples/jest_integration/integration.fuzz/My_describe/My_fuzz_test_with_an_explicit_timeout_(sync)/test
@@ -0,0 +1 @@
+test
\ No newline at end of file
diff --git a/fuzztests/.jazzerjsrc b/fuzztests/.jazzerjsrc
index 0803d9c29..19aa8372b 100644
--- a/fuzztests/.jazzerjsrc
+++ b/fuzztests/.jazzerjsrc
@@ -1,4 +1,5 @@
 {
 	"fuzzerOptions": ["-use_value_profile=1", "-max_total_time=30"],
-	"includes": ["jazzer.js"]
+	"includes": ["jazzer.js"],
+	"timeout": 1000
 }
diff --git a/fuzztests/FuzzedDataProvider.fuzz.js b/fuzztests/FuzzedDataProvider.fuzz.js
index f677eadb4..3294a3740 100644
--- a/fuzztests/FuzzedDataProvider.fuzz.js
+++ b/fuzztests/FuzzedDataProvider.fuzz.js
@@ -42,7 +42,7 @@ describe("FuzzedDataProvider", () => {
 			}
 			jazzer.exploreState(hash(usedMethods), 31);
 		},
-		40000
+		5000
 	);
 });
 
diff --git a/fuzztests/runFuzzTests.js b/fuzztests/runFuzzTests.js
index b0f446fbf..ae0c06837 100755
--- a/fuzztests/runFuzzTests.js
+++ b/fuzztests/runFuzzTests.js
@@ -9,7 +9,7 @@ const fs = require("fs/promises");
 const { spawn } = require("child_process");
 
 const fuzzTestFileExtension = "fuzz.js";
-const fuzzTestNameRegex = /it.fuzz\(\s*"(.*)"/g;
+const fuzzTestNameRegex = /it.fuzz\s*\(\s*"(.*)"/g;
 
 async function findFuzzTestNamesInFile(file) {
 	const fuzzTestNames = [];
@@ -47,8 +47,11 @@ async function executeFuzzTest(file, name) {
 		});
 		test.on("close", (code) => {
 			console.log(`--- Finished fuzz test ${file} > ${name} with code ${code}`);
-			if (code !== 0 && code !== null) reject(code);
-			else resolve();
+			if (code !== 0 && code !== null) {
+				reject(code);
+			} else {
+				resolve();
+			}
 		});
 	});
 }
diff --git a/packages/core/cli.ts b/packages/core/cli.ts
index fc4658e41..35aa872d4 100644
--- a/packages/core/cli.ts
+++ b/packages/core/cli.ts
@@ -181,6 +181,12 @@ yargs(process.argv.slice(2))
 					type: "string",
 					group: "Fuzzer:",
 					default: ["json", "text", "lcov", "clover"],
+				})
+				.option("timeout", {
+					describe: "Timeout in milliseconds for each fuzz test execution.",
+					type: "number",
+					group: "Fuzzer:",
+					default: 5000,
 				});
 		},
 		// eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -196,6 +202,7 @@ yargs(process.argv.slice(2))
 				excludes: args.instrumentation_excludes,
 				dryRun: args.dry_run,
 				sync: args.sync,
+				timeout: args.timeout,
 				fuzzerOptions: args.corpus.concat(args._),
 				customHooks: args.custom_hooks,
 				expectedErrors: args.expected_errors,
diff --git a/packages/core/core.ts b/packages/core/core.ts
index 699913b91..ecc28421a 100644
--- a/packages/core/core.ts
+++ b/packages/core/core.ts
@@ -52,7 +52,7 @@ export interface Options {
 	fuzzerOptions: string[];
 	customHooks: string[];
 	expectedErrors: string[];
-	timeout?: number;
+	timeout: number;
 	idSyncFile?: string;
 	coverage: boolean; // Enables source code coverage report generation.
 	coverageDirectory: string;
@@ -290,10 +290,12 @@ function buildFuzzerOptions(options: Options): string[] {
 		// the last provided option takes precedence
 		opts = opts.concat("-runs=0");
 	}
-	if (options.timeout != undefined) {
-		const inSeconds = options.timeout / 1000;
-		opts = opts.concat(`-timeout=${inSeconds}`);
+
+	if (options.timeout <= 0) {
+		throw new Error("timeout must be > 0");
 	}
+	const inSeconds = Math.ceil(options.timeout / 1000);
+	opts = opts.concat(`-timeout=${inSeconds}`);
 
 	return [prepareLibFuzzerArg0(opts), ...opts];
 }
diff --git a/packages/instrumentor/edgeIdStrategy.ts b/packages/instrumentor/edgeIdStrategy.ts
index 6e838ed9b..acdbe737c 100644
--- a/packages/instrumentor/edgeIdStrategy.ts
+++ b/packages/instrumentor/edgeIdStrategy.ts
@@ -22,12 +22,16 @@ import process from "process";
 import { fuzzer } from "@jazzer.js/fuzzer";
 
 if (process.listeners) {
-	// "signal-exit" library imported by "proper-lockfile" inserts listeners for all important signals, such as SIGALRM and SIGINT (see https://github.com/tapjs/signal-exit/blob/39a5946d2b04d00106400c0dcc5d358a40892438/signals.js)
-	// libFuzzer has a SIGALRM handler to deal with -timeout flag, here we give the control back to libFuzzer by removing the SIGALRM listeners inserted by "signal-exit".
+	// "signal-exit" library imported by "proper-lockfile" inserts listeners
+	// for all important signals, such as SIGALRM and SIGINT
+	// (see https://github.com/tapjs/signal-exit/blob/39a5946d2b04d00106400c0dcc5d358a40892438/signals.js)
+	// libFuzzer has a SIGALRM handler to deal with -timeout flag, here we give
+	// the control back to libFuzzer by removing the SIGALRM listeners inserted by "signal-exit".
 	if (process.listeners("SIGALRM").length > 0) {
 		process.removeListener("SIGALRM", process.listeners("SIGALRM")[0]);
 	}
-	// SIGINT: in synchronous mode, pressing CTRL-C does not abort the process. Removing the SIGINT listener inserted by "signal-exit" gives the control back to the users.
+	// SIGINT: in synchronous mode, pressing CTRL-C does not abort the process.
+	// Removing the SIGINT listener inserted by "signal-exit" gives the control back to the users.
 	if (process.listeners("SIGINT").length > 0) {
 		process.removeListener("SIGINT", process.listeners("SIGINT")[0]);
 	}
diff --git a/packages/jest-runner/config.ts b/packages/jest-runner/config.ts
index 205751306..cd685c375 100644
--- a/packages/jest-runner/config.ts
+++ b/packages/jest-runner/config.ts
@@ -27,7 +27,7 @@ export const defaultOptions: Options = {
 	fuzzerOptions: [],
 	sync: false,
 	expectedErrors: [],
-	timeout: undefined,
+	timeout: 5000, // default Jest timeout
 	coverage: false,
 	coverageDirectory: "coverage",
 	coverageReporters: ["json", "text", "lcov", "clover"], // default Jest reporters
diff --git a/packages/jest-runner/fuzz.ts b/packages/jest-runner/fuzz.ts
index 852055be6..4dd9b9054 100644
--- a/packages/jest-runner/fuzz.ts
+++ b/packages/jest-runner/fuzz.ts
@@ -73,9 +73,11 @@ export const fuzz: FuzzTest = (name, fn, timeout) => {
 	const fuzzingConfig = loadConfig();
 
 	// Timeout priority is: test timeout > config timeout > default timeout.
-	if (!timeout)
-		if (fuzzingConfig.timeout) timeout = fuzzingConfig.timeout;
-		else timeout = 5000;
+	if (!timeout) {
+		timeout = fuzzingConfig.timeout;
+	} else {
+		fuzzingConfig.timeout = timeout;
+	}
 
 	if (fuzzingConfig.dryRun) {
 		runInRegressionMode(name, fn, corpus, timeout);
diff --git a/tests/timeout/fuzz.js b/tests/timeout/fuzz.js
index 94395620e..dd9322ae4 100644
--- a/tests/timeout/fuzz.js
+++ b/tests/timeout/fuzz.js
@@ -15,7 +15,7 @@
  */
 
 /**
- * This is a regression test that checks that running this function with "-timeout=1" does not result in a timeout.
+ * This is a regression test that checks that running this function with "--timeout=1000" does not result in a timeout.
  *
  * @param { Buffer } data
  */
diff --git a/tests/timeout/package.json b/tests/timeout/package.json
index 506b58a97..77b0b2d27 100644
--- a/tests/timeout/package.json
+++ b/tests/timeout/package.json
@@ -3,8 +3,8 @@
 	"version": "1.0.0",
 	"description": "Timeout test: checking that the handler for the SIGALRM signal does not return with error code.",
 	"scripts": {
-		"timeout": "jazzer fuzz -f=timeout -- -timeout=1",
-		"fuzz": "jazzer fuzz -- -timeout=1 -max_total_time=10",
+		"timeout": "jazzer fuzz -f=timeout --timeout=1000 -- -max_total_time=10",
+		"fuzz": "jazzer fuzz --timeout=1000 -- -max_total_time=10",
 		"dryRun": "echo \"skipped\""
 	},
 	"devDependencies": {