search

rust-fuzz / honggfuzz-rs

Fuzz your Rust code with Google-developed Honggfuzz !
https://crates.io/crates/honggfuzz
Apache License 2.0
449 stars 40 forks source link

Shrinking test cases #11

Closed g2p closed 5 years ago

g2p commented 6 years ago

Is there an API that would yield the cov code of a given vector? I'd like to be able to shrink test cases using custom code (truncating to a length determined from contents, for example), and such an API would provide a convenient way to do it. Alternatively, a way to provide a function that yields shrink candidates would also work. Or any other convenient way to achieve the same goal of shrinking test cases.

PaulGrandperrin commented 6 years ago

I reckon shrinking is not yet implemented in upstream honggfuzz. There is this opened issue: google/honggfuzz#195 What do you think @robertswiecki ?

robertswiecki commented 6 years ago

Hi,

By function/API do you mean like a cmdline switch which would make honggfuzz into a one-pass mode with dumping coverage data and status about crashes?

g2p commented 6 years ago

I don't know enough about honggfuzz's preferred mode of interfacing. But that single-pass mode would work, as long as you can give it input vectors that aren't necessarily in the input directory yet (edit: or just pass the input directory through a flag). As far as how things would look like from the honggfuzz-rs point of view, a function yielding shrink candidates from inside the fuzzer target would be great.

PaulGrandperrin commented 5 years ago

It seems to me that this functionality is really dependant on the upstream project. If it gets implemented someday, I'll sure make it available in honggfuzz-rs but in the meantime, I'll close this issue... Thanks @g2p for the report!