Struct FuzzRun 

pub struct FuzzRun { /* private fields */ }

Configuration for a fuzz run.

Example

use dev_fuzz::{FuzzBudget, FuzzRun, Sanitizer};
use std::time::Duration;

let run = FuzzRun::new("parse_input", "0.1.0")
    .budget(FuzzBudget::time(Duration::from_secs(60)))
    .sanitizer(Sanitizer::Address)
    .timeout_per_iter(Duration::from_secs(5))
    .rss_limit_mb(2048);

let _result = run.execute().unwrap();

Implementations

impl FuzzRun

pub fn new(target: impl Into<String>, version: impl Into<String>) -> Self

Begin a new fuzz run against the given fuzz target.

target is the libFuzzer target name (the file under fuzz/fuzz_targets/<target>.rs). version is descriptive and flows into the produced Report.

pub fn budget(self, budget: FuzzBudget) -> Self

Set the run budget. Default: 60 seconds of wall-clock time.

pub fn fuzz_budget(&self) -> FuzzBudget

Selected budget.

pub fn in_dir(self, dir: impl Into<PathBuf>) -> Self

Run cargo fuzz from dir instead of the current directory.

pub fn sanitizer(self, sanitizer: Sanitizer) -> Self

Pick the sanitizer to enable. Default: Sanitizer::Address.

pub fn timeout_per_iter(self, d: Duration) -> Self

Per-iteration timeout. Translates to libFuzzer’s -timeout=<secs> (whole seconds, at least 1). libFuzzer’s own default is 1200 s.

pub fn rss_limit_mb(self, mb: u32) -> Self

Per-iteration RSS limit, in megabytes. Translates to libFuzzer’s -rss_limit_mb=<N>.

pub fn allow(self, name: impl Into<String>) -> Self

Suppress a finding whose reproducer-path basename matches name.

Useful for known false positives that have a triaged reproducer already on disk (e.g. crash-deadbeef). The match is on the final path component only.

pub fn allow_all<I, S>(self, names: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Bulk version of allow.

pub fn run_timeout(self, limit: Duration) -> Self

Kill cargo fuzz (and every process it started) if the whole run, build included, takes longer than limit.

The FuzzBudget is enforced by libFuzzer itself and only between inputs, and it does not cover building the target. This is a hard backstop on top of it: set it comfortably above the budget plus build time. Findings written before the limit expired are still returned; with none, execute returns FuzzError::SubprocessFailed with a message that starts with timed out after. Default: no limit.

On Unix the child runs in its own process group while a limit is set, so that the whole tree can be killed at once.

pub fn target_name(&self) -> &str

Target name (the fuzz_targets/<name>.rs file).

pub fn subject_version(&self) -> &str

Descriptive subject version.

pub fn execute(&self) -> Result<FuzzResult, FuzzError>

Execute the fuzz run.

Spawns cargo +nightly fuzz run <target> with the configured budget, sanitizer, and limits. Captures stderr (where libFuzzer writes its findings) and parses out crash / timeout / OOM records with reproducer paths.

Tool / nightly / target-not-found preconditions surface as typed FuzzError variants. No panics.

Trait Implementations

impl Clone for FuzzRun

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FuzzRun

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.