rust-lang / rust-lang/rust-bindgen
Investigate fuzzing with `cargo fuzz`
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 5.3k
- Forks
- 829
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 15
Description
https://github.com/rust-fuzz/cargo-fuzz
Uses libFuzzer behind the scenes.
Unsure if this is really worth it, hence "investigate" rather than "use". libFuzzer is pretty much throwing random bytes (whose next generations are then guided by coverage information from the last generations) at a function and seeing if it can trigger a panic or segfault or something. For us, the function would be something like "treat these bytes as C/C++ header source and generate bindings to them". This is likely to bounce off of libclang's parser more than it would ever even get into bindgen code, but who knows: maybe the coverage guiding works better than I think?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the cargo-fuzz project and libFuzzer behavior described in the issue, then identify how bindgen receives C/C++ header input. Determine whether fuzzing can reach bindgen code beyond libclang and whether coverage guidance makes the approach worthwhile. Done means documenting a clear recommendation about adopting or rejecting this investigation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- testing-qa
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100