View line coverage

[binier]

Is there a way to view line coverage after running a fuzzer? For example with LCOV http://ltp.sourceforge.net/coverage/lcov.php

[loiclec]

AFAIK, I have all the information to create a coverage report for each test case (or all test case combined). But I still need to write that functionality, it is a work in progress.

[loiclec]

To be clear, I have always wanted to have that feature, but I am hesitating on the best way to design it. I think in about a month, I should have a first version of it released :)

[binier]

Thanks for quick responses :) Sounds great.

[loiclec]

I’m very late to it, but I am finally making a code coverage viewer for fuzzcheck :)

I am writing some details of how it would work here so that anybody can comment on the scope or design, or ask for feature requests.

The idea is:

First, fuzzcheck will write additional files at the end of each fuzzing run under the ./fuzz/<fuzz_target>/stats/<timestamp>/ folder. The code coverage viewer will read the ./fuzz/<fuzz_target>/stats/<latest_timestamp>/ folder and then serve an interactive webpage located at localhost:8000. This is what the page looks like:

• On the top left, you can choose to view the code coverage associated with either all inputs combined, or the coverage of a single input.

• On the top right is a list of all inputs saved by the fuzzer. Hovering the mouse over any input name will display its content.

• The next row contains a list of files and functions. The page will only show the code coverage of the selected function. Functions are sorted by their line number and there are key shortcuts to navigate between them. I don’t display the whole file because a generic function may be monomorphized multiple times and each different instance will have different code coverage. It is also simpler for me to write this way.

• On the bottom left is the actual code coverage viewer. Code is highlighted in red if it hasn’t been reached and in green if it has. Notice the ⦿ after an “if” condition. These represent unwritten “else” branches.

• Hovering over any green code region will display the smallest input to reach that region on the right hand side, as you can see from this gif:

• There is also an option to filter functions based on their coverage, to hide those that have 100% or 0% coverage. If the coverage of a single input is displayed, there is an option to only show functions for which this input is the smallest one to reach a region in the function. These regions are displayed in blue.

  

That is what I have for now :)

[loiclec]

Not a lot has changed since last week, it is essentially the same. But I have put the tool online here: https://github.com/loiclec/fuzzcheck-view

[loiclec]

oops, but I should say that I haven't yet published to crates.io the version of fuzzcheck that saves all the necessary files that fuzzcheck-view uses. It's only on GitHub for now

[teymour-aldridge]

Is the latest version of fuzzcheck-view compatible with the latest version of fuzzcheck?

[loiclec]

I pushed a tiny update to fuzzcheck-view today that solves one incompatibility, but I need to look properly at it tomorrow. So... maybe?