Allow for multiple inputs to a fuzz_target, such data from corpus + an additional Arbitrary

Open
#119 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
rust
Domain
testing-qa

Research direction

Start by reviewing the referenced fuzz/fuzz_targets/fuzz_skrifa_outline.rs target and the existing fuzz-target input API. Investigate how corpus-mutated &[u8] inputs and separately generated Arbitrary values could be provided together. Done means a fuzz target can preserve corpus-derived font data while independently generating configuration input.

Written by the indexing model from the issue text.

Description

To fuzz font processing, such as loading glyph outlines, we would like to have two inputs:

  1. The usual data: &[u8], mutated from a corpus entry
    • data is thus relatively likely to be a somewhat valid font and trigger interesting processing
  2. An additional Arbitrary, generated by the fuzzer
    • This configures font processing, such as specifying hinting on/off, what variation settings to use, etc

If I simply carve an Arbitrary off the incoming data, say taking the head and considering the tail to be a font binary, then tail becomes very unlikely to be a valid font. Full disclosue: I initially did exactly this; coverage of the target code remained very low.

Thinking "aloud" I suppose I could glue extra bytes onto corpus entries to use to populate my Arbitrary?

Dominant language
C++
Stars
267
Forks
51
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rust-fuzz/libfuzzer

All issues in rust-fuzz/libfuzzer

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.