rust-fuzz / libfuzzer

Rust bindings and utilities for LLVM’s libFuzzer
Apache License 2.0
208 stars 44 forks source link

Feature request: integration with proptest and/or quickcheck #58

Open danwallach opened 4 years ago

danwallach commented 4 years ago

The idea: if a project already has property-based tests, whether using proptest or quickcheck (or maybe something else?), it's useful to do fuzz testing with those APIs. That way, cargo test will still run quickly, while cargo fuzz will reuse all the same property-testing code, generators, etc., and run for as long as you want to see if it can find anything.

Manishearth commented 4 years ago

I've kinda wanted this for a while, however there's an important thing to note: Arbitrary works differently from quickcheck and proptest because those operate on an unlimited pool of entropy, and Arbitrary operates on a limited byte string (and has to try and not introduce too much obfuscation). Without this, fuzzing will be very slow and ineffective.

That said, the opposite direction is less of a problem: We can probably write a wrapper that takes anything that implements Arbitrary and gives you something that implements quickcheck::Arbitrary, and maybe something similar for proptest.

danwallach commented 4 years ago

It's also possible that you could reimplement the various macros used by proptest to generate "proptest-native" code vs. "libfuzzer-native" code at compile time, depending on your build target.