pub trait Fuzzer<E, EM, ST>: Sized + UsesStatewhere
Self::State: HasMetadata + HasExecutions + HasLastReportTime,
E: UsesState<State = Self::State>,
EM: ProgressReporter<State = Self::State>,
ST: StagesTuple<E, EM, Self::State, Self>,{
// Required method
fn fuzz_one(
&mut self,
stages: &mut ST,
executor: &mut E,
state: &mut EM::State,
manager: &mut EM
) -> Result<CorpusId, Error>;
// Provided methods
fn fuzz_loop(
&mut self,
stages: &mut ST,
executor: &mut E,
state: &mut EM::State,
manager: &mut EM
) -> Result<(), Error> { ... }
fn fuzz_loop_for(
&mut self,
stages: &mut ST,
executor: &mut E,
state: &mut EM::State,
manager: &mut EM,
iters: u64
) -> Result<CorpusId, Error> { ... }
}
Expand description
The main fuzzer trait.
Required Methods§
sourcefn fuzz_one(
&mut self,
stages: &mut ST,
executor: &mut E,
state: &mut EM::State,
manager: &mut EM
) -> Result<CorpusId, Error>
fn fuzz_one( &mut self, stages: &mut ST, executor: &mut E, state: &mut EM::State, manager: &mut EM ) -> Result<CorpusId, Error>
Fuzz for a single iteration. Returns the index of the last fuzzed corpus item. (Note: An iteration represents a complete run of every stage. Therefore it does not mean that the harness is executed for once, because each stage could run the harness for multiple times)
If you use this fn in a restarting scenario to only run for n
iterations,
before exiting, make sure you call event_mgr.on_restart(&mut state)?;
.
This way, the state will be available in the next, respawned, iteration.
Provided Methods§
sourcefn fuzz_loop(
&mut self,
stages: &mut ST,
executor: &mut E,
state: &mut EM::State,
manager: &mut EM
) -> Result<(), Error>
fn fuzz_loop( &mut self, stages: &mut ST, executor: &mut E, state: &mut EM::State, manager: &mut EM ) -> Result<(), Error>
Fuzz forever (or until stopped)
sourcefn fuzz_loop_for(
&mut self,
stages: &mut ST,
executor: &mut E,
state: &mut EM::State,
manager: &mut EM,
iters: u64
) -> Result<CorpusId, Error>
fn fuzz_loop_for( &mut self, stages: &mut ST, executor: &mut E, state: &mut EM::State, manager: &mut EM, iters: u64 ) -> Result<CorpusId, Error>
Fuzz for n iterations. Returns the index of the last fuzzed corpus item. (Note: An iteration represents a complete run of every stage. therefore the number n is not always equal to the number of the actual harness executions, because each stage could run the harness for multiple times)
If you use this fn in a restarting scenario to only run for n
iterations,
before exiting, make sure you call event_mgr.on_restart(&mut state)?;
.
This way, the state will be available in the next, respawned, iteration.