Module fuzzcheck::builder

Builders used to set up a fuzz test.

This module contains 5 types to build a fuzz test: FuzzerBuilder[1–5].

The idea is to help you specify each part of the fuzzer progressively:

1. the function to fuzz
2. the mutator to generate arguments to the test function (called “inputs” or “test cases”)
3. the serializer to save test cases to the file system
4. the sensor to provide feedback after running the test function, and the pool to interpret the feedback from the sensor
5. other settings for the fuzzer, such as the maximum allowed complexity for the test cases, where to save the corpora or artifacts on the file system, etc.

In most cases, you don’t need to manually specify all these components. If the argument type of the function has a default mutator and is serializable with serde, then you can write:

let _ = fuzzcheck::fuzz_test(test_function) // FuzzerBuilder1
    .default_options() // FuzzerBuilder5!  we use the default values for stages 2 to 5
    .launch();

This is equivalent to:

let _ = fuzzcheck::fuzz_test(test_function)
    .default_mutator()      // the default is `<T as DefaultMutator>::default_mutator()`
    .serde_serializer()   // the default is `SerdeSerializer::new()`
    .default_sensor_and_pool() // the default is `default_sensor_and_pool().finish()`
    .arguments_from_cargo_fuzzcheck()
    .launch();

If you’d like to use a custom mutator, serializer, sensor and pool, or argumemts, you can write:

let _ = fuzzcheck::fuzz_test(test_function)
    .mutator(my_mutator)         // the default is `<T as DefaultMutator>::default_mutator()`
    .serializer(my_serializer)   // the default is `SerdeSerializer::new()`
    .sensor_and_pool(sensor, pool)
    .arguments(arguments)
    .launch();

To build a custom sensor and pool, you may want to look at the Sensor, Pool, and CompatibleWithSensor traits. You can also look at the types provided in the sensors_and_pools module. But the easiest way to customize them is to use the CodeCoverageSensorAndPoolBuilder, although it only offers a couple limited options.

Structs

CodeCoverageSensorAndPoolBuilder

A builder to create a sensor and pool that can be given as argument to FuzzerBuilder3::sensor_and_pool.

FuzzerBuilder1

A fuzz-test builder that knows the function to fuzz-test. It is created by calling fuzz_test(..).

FuzzerBuilder2

A fuzz-test builder that knows the function to fuzz-test and the mutator.

FuzzerBuilder3

A fuzz-test builder that knows the function to fuzz-test, the mutator, and the serializer.

FuzzerBuilder4

A fuzz-test builder that knows the function to fuzz-test, the mutator, the serializer, the sensor, and the pool.

FuzzerBuilder5

A fuzz-test builder that knows every necessary detail to start fuzzing.

Enums

ReturnBool

Marker type for a function of type Fn(&T) -> bool

ReturnResult

Marker type for a function of type Fn(&T) -> Result<V, E>

ReturnVoid

Marker type for a function of type Fn(&T)

Traits

FuzzTestFunction

A function that can be fuzz-tested.

Functions

basic_sensor_and_pool

Create the initial sensor and pool builder

default_sensor_and_pool

Create the sensor and pool builder that is used by default by fuzzcheck

fuzz_test

Build a fuzz test for the given function!

max_cov_hits_sensor_and_pool

Type Definitions

BasicAndDiverseAndMaxHitsPool

An alias for the combination of the BasicPool, the DiversePool, and the MaxHitsPool

BasicAndDiversePool

An alias for the combination of the BasicPool and the DiversePool

BasicAndMaxHitsPool

An alias for the combination of the BasicPool and the MaxHitsPool

BasicPool

An alias for the basic pool chosen to handle the CodeCoverageSensor’s observations

DiversePool

An alias for the type of the pool which tries to find a fixed-length set of test cases which, together, activate the most counters.

MaxHitsPool

An alias for the type of the pool which tries to find test cases repeatedly hitting the same counters.