rust-fuzz / cargo-fuzz

Command line helpers for fuzzing
https://rust-fuzz.github.io/book/cargo-fuzz.html
Apache License 2.0
1.48k stars 108 forks source link

feature request: `cargo fuzz miri <target>` to run all corpus items in miri #370

Open 5225225 opened 2 months ago

5225225 commented 2 months ago

The use case here would be fuzzing some unsafe heavy code to find a corpus that should see a wide variety of inputs, then running the fuzzer, feeding each corpus item in turn to the fuzzer. This is useful since the fuzzer can't really notice rust specific UB if it doesn't happen to crash, but that's still UB that the user wants to know about.

This is not asking for fuzzing to be ran using miri (like #311), just running the fuzzer body once per corpus item. This is not exactly hard to do manually (refactor out the fuzzer body into a lib.rs, add a #[test] that reads each corpus item and feeds it to that, then run cargo miri test), but it's a bit of a pain.

Manishearth commented 2 months ago

Oh that's a clever idea. I'm in favor though don't have time to implement it myself.

fitzgen commented 2 months ago

Same