c4-project / c4f

The C4 Concurrent C Fuzzer
MIT License
14 stars 1 forks source link

Fuzzer flags with adjustable probabilities #134

Closed MattWindsor91 closed 4 years ago

MattWindsor91 commented 5 years ago

Pursuant to #133, I think the fuzzer will eventually need some notion of tunable flag weights. These would have the possibility of being randomly generated (eg as part of the payload generator) with some control over the odds of true vs odds of false.

Here's a sketch of some possible syntax:

fuzz {
  action foo.bar.baz 1 # existing weight syntax

  flag type.bool 0 # never selected
  flag type.bool 1 # always selected
  flag type.atomic_bool 1:2 # 1 true per 2 false = ~33% probability
}

Eventually we might be able to generalise this syntax to support per-action weightings:

fuzz {
  action foo.bar.baz {
    weight 1
    flag type.bool 0 # has precedence
  }
  flag type.bool 1
}

Another eventual possibility might be generalising to arbitrary integers etc., but working out how we'd specify probability distributions for them in the config file seems a bit difficult!

MattWindsor91 commented 4 years ago

Per the syntax sketch for #159, I'd be tempted to add some noise words to the syntax here:

set flag type.bool to 0
set flag type.bool to 1
set flag type.bool with ratio 1:2

where the parser can omit to, or with (but probably not ratio).

MattWindsor91 commented 4 years ago

This is implemented now.