Struct wasm_mutate::WasmMutate

source · [−]

pub struct WasmMutate<'wasm> { /* private fields */ }

Expand description

A WebAssembly test case mutator.

This is the main entry point into this crate. It provides various methods for configuring what kinds of mutations might be applied to the input Wasm. Once configured, you can apply a transformation to the input Wasm via the run method.

Example

use wasm_mutate::WasmMutate;

let input_wasm = wat::parse_str(r#"
           (module
            (func (export "hello") (result i32)
             (i32.const 1234)
            )
           )
           "#)?;

// Create a `WasmMutate` builder and configure it.
let mut mutate = WasmMutate::default();
mutate
    // Set the RNG seed.
    .seed(42)
    // Allow mutations that change the semantics of the Wasm module.
    .preserve_semantics(false)
    // Use at most this much "fuel" when trying to mutate the Wasm module before
    // giving up.
    .fuel(1_000);

// Run the configured `WasmMutate` to get a sequence of mutations of the input
// Wasm!
for mutated_wasm in mutate.run(&input_wasm)? {
    let mutated_wasm = mutated_wasm?;
    // Feed `mutated_wasm` into your tests...
}

Implementations

source

impl<'wasm> WasmMutate<'wasm>

source

pub fn seed(&mut self, seed: u64) -> &mut Self

Set the RNG seed used to choose which transformation to apply.

Given the same input Wasm and same seed, wasm-mutate will always generate the same output Wasm.

source

pub fn preserve_semantics(&mut self, preserve_semantics: bool) -> &mut Self

Configure whether we will only perform semantics-preserving transformations on the Wasm module.

source

pub fn fuel(&mut self, fuel: u64) -> &mut Self

Configure the fuel used during the mutation

source

pub fn reduce(&mut self, reduce: bool) -> &mut Self

Configure whether we will only perform size-reducing transformations on the Wasm module.

Setting this to true allows wasm-mutate to be used as a test case reducer.

source

pub fn raw_mutate_func(
&mut self,
raw_mutate_func: Option<Arc<dyn Fn(&mut Vec<u8>, usize) -> Result<()>>>
) -> &mut Self

Set a custom raw mutation function.

This is used when we need some underlying raw bytes, for example when mutating the contents of a data segment.

You can override this to use libFuzzer’s LLVMFuzzerMutate function to get raw bytes from libFuzzer, for example.

The function is given the raw data buffer and the maximum size the mutated data should be. After mutating the data, the function should resize the data to its final, mutated size, which should be less than or equal to the maximum size.

source