rust-fuzz / libfuzzer

Rust bindings and utilities for LLVM’s libFuzzer
Apache License 2.0
206 stars 44 forks source link

Add support for defining custom mutators #79

Closed fitzgen closed 3 years ago

fitzgen commented 3 years ago

See the doc comments for the fuzz_mutator! macro for example usage and user-level information.

There is some slightly funky stuff going on with data, size, and max_size that doesn't feel 100% Rust-y / is a little subtle to support size-aware mutations. data is basically a vec's heap allocation, size is basically vec.len(), and max(size, max_size) is basically vec.capacity(). Not sure that this API can really be improved upon while remaining a thin wrapper over what libfuzzer gives us (i.e. doesn't introduce a ~fork of std::vec::Vec) but I'm open to ideas!

Supersedes #62.

fitzgen commented 3 years ago

Thanks for review @Manishearth @frewsxcv!

I've pushed a tiny commit that adds a max_size parameter to the libfuzzer_sys::fuzzer_mutate function, so that users can force libfuzzer to only make shrinking mutations on the data they ask it to mutate (the old signature only allowed users to force equal-or-smaller mutations or allow growth as well).

I'll merge and cut a release as soon as CI is green!

fitzgen commented 3 years ago

Published!