libfuzzer | Rust bindings and utilities for LLVM ’ s libFuzzer | Compiler library

After newstr = (char *)malloc(200);, newstr is not yet properly initialized so you must not call strncat( newstr, ... ).
You can solve that e.g. by calling strcpy( newstr, "" ); after malloc() or by replacing malloc(200) with calloc(200,1) which fills the entire buffer with NUL.

Besides, as @stevesummit has mentioned, despite its declaration there is no guarantee, that strlen(str) < 50. So instead of allocating a fix number of 200 characters, you should alloc strlen(str)*4 + 1 ... or strlen(str)*5 + 1 if what you're doing is HTML esacping and you realize that & should be replaced by &

Afl supports feeding inputs through files, not only stdin. To test a library that receives input through arguments, you can write a simple executable that will open an input file, read it's contents, call the needed library functions with argument values read from this file and close the file.

In this context, PC means Program Counter as explained in this blog post

In order to log coverage, the function trace_pc will log the program counter. With this information, the fuzzer knows, which paths are traversed on the given input values. Each fuzzing engine runs through this process differently.

Late answer - there will be single instance per multiple runs.

You are not accounting for C++'s name mangling. The symbol for stub_main is likely a string containing main as well as some obfuscated info about arguments, type of function, and return type. In my platform it's __Z9stub_mainiPPc. The symbol for main would likely just be main or main_.

You can try looking how main and stub_main definitions mangle in your platform with objdump -d *.o, and then you can replace these strings with objcopy --redefine-sym.

Alternatively, as matoro said, you can declare the function as extern "C" so that no name mangling takes place.