Module builder

Expand description

Builders used to set up a fuzz test.

This module contains 5 types to build a fuzz test: FuzzerBuilder[1–5].

The idea is to help you specify each part of the fuzzer progressively:

the function to fuzz
the mutator to generate arguments to the test function (called “inputs” or “test cases”)
the serializer to save test cases to the file system
the sensor to provide feedback after running the test function, and the pool to interpret the feedback from the sensor
other settings for the fuzzer, such as the maximum allowed complexity for the test cases, where to save the corpora or artifacts on the file system, etc.

In most cases, you don’t need to manually specify all these components. If the argument type of the function has a default mutator and is serializable with serde, then you can write:

let _ = fuzzcheck::fuzz_test(test_function) // FuzzerBuilder1
    .default_options() // FuzzerBuilder5!  we use the default values for stages 2 to 5
    .launch();

This is equivalent to:

let _ = fuzzcheck::fuzz_test(test_function)
    .default_mutator()      // the default is `<T as DefaultMutator>::default_mutator()`
    .serde_serializer()   // the default is `SerdeSerializer::new()`
    .default_sensor_and_pool() // the default is `default_sensor_and_pool().finish()`
    .arguments_from_cargo_fuzzcheck()
    .launch();

If you’d like to use a custom mutator, serializer, sensor and pool, or arguments, you can write:

let _ = fuzzcheck::fuzz_test(test_function)
    .mutator(my_mutator)         // the default is `<T as DefaultMutator>::default_mutator()`
    .serializer(my_serializer)   // the default is `SerdeSerializer::new()`
    .sensor_and_pool(sensor, pool)
    .arguments(arguments)
    .launch();

To build a custom sensor and pool, you may want to look at the Sensor, Pool, and CompatibleWithObservations traits. You can also look at the types provided in the sensors_and_pools module. But the easiest way to customize them is to use the SensorAndPoolBuilder, although it only offers a couple limited options.

Structs§

FuzzerBuilder1: A fuzz-test builder that knows the function to fuzz-test. It is created by calling fuzz_test(..).
FuzzerBuilder2: A fuzz-test builder that knows the function to fuzz-test and the mutator.
FuzzerBuilder3: A fuzz-test builder that knows the function to fuzz-test, the mutator, and the serializer.
FuzzerBuilder4: A fuzz-test builder that knows the function to fuzz-test, the mutator, the serializer, the sensor, and the pool.
FuzzerBuilder5: A fuzz-test builder that knows every necessary detail to start fuzzing.
SensorAndPoolBuilder: A builder to create a sensor and pool that can be given as argument to FuzzerBuilder3::sensor_and_pool.

Enums§

ReturnBool: Marker type for a function of type Fn(&T) -> bool
ReturnResult: Marker type for a function of type Fn(&T) -> Result<V, E>
ReturnVoid: Marker type for a function of type Fn(&T)

Traits§

FuzzTestFunction: A function that can be fuzz-tested.

Functions§

basic_sensor_and_pool: Create the initial sensor and pool builder
basic_sensor_and_pool_with_custom_filter: Like basic_sensor_and_pool, but uses a closure to determine which function should be observed by the code coverage sensor.
default_sensor_and_pool: Create the sensor and pool builder that is used by default by fuzzcheck
default_sensor_and_pool_with_custom_filter: Like default_sensor_and_pool, but uses a closure to determine which function should be observed by the code coverage sensor.
fuzz_test: Build a fuzz test for the given function!
max_cov_hits_sensor_and_pool

Type Aliases§