Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

workaround to uses of arbitrary_loop causing non-determinism #199

Open
0xalpharush opened this issue Sep 18, 2024 · 2 comments
Open

workaround to uses of arbitrary_loop causing non-determinism #199

0xalpharush opened this issue Sep 18, 2024 · 2 comments

Comments

@0xalpharush
Copy link

0xalpharush commented Sep 18, 2024

I am implementing Arbitrary by hand and using it with cargo-fuzz. Ideally, I'd like to allow the fuzzer to control the length but I wanted to experiment with different upper bounds before picking one in the harness. However, I noticed that I could not re-use the corpus given changing the upper bound introduced non-determinism, and I'd like to be able to simply insert/ extend from the corpus instead of starting from scratch. Is there an alternative pattern to support looping being configurable without affecting how the rest of the input is interpreted?

For example, I have something in my harness very similar to https://github.com/bytecodealliance/wasm-tools/blob/main/crates/wasm-smith/src/core.rs#L1070 where I am modifying u.arbitrary_loop(Some(1), Some(100),. to u.arbitrary_loop(Some(1), Some(1000),.

@fitzgen
Copy link
Member

fitzgen commented Sep 18, 2024

Unfortunately this is a fairly fundamental limitation of arbitrary's approach. You could do things like always consume 100 bytes of input, create a new Unstructured of those 100 bytes, and do your arbitrary loop with that sub-Unstructured but it is pretty clonky and maybe wastes bytes or maybe 100 bytes isn't enough, etc...

@0xalpharush
Copy link
Author

Thanks, I will have to re-think my approach and consider how to seed the fuzzer more effectively

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants