Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clean-up differential fuzzing infrastructure #896

Open
Robbepop opened this issue Jan 16, 2024 · 0 comments
Open

Clean-up differential fuzzing infrastructure #896

Robbepop opened this issue Jan 16, 2024 · 0 comments
Labels
enhancement New feature or request tech-debt An issue to resolve some technical debt.

Comments

@Robbepop
Copy link
Member

Our latest attempts at improving the differential fuzzer led to a lot of technical debt which we should get rid of in order to properly implement both:

Problems

  • The main problem is that all of the differential fuzzing code is located in a single rather large file which we should split up into multiple logical modules.
  • Another problem is that the current handling of different cases is a bit bloated and could seriously be improved to remove duplicated code.
  • Furthermore we need a design decision whether we always want to fuzz all supported engines or continue to only fuzz all engines in case both Wasmi (register) and Wasmi (stack) disagree. For performance reasons we currently only run the Wasmtime backend if both Wasmi (register) and Wasmi (stack) disagree because spinning up and running Wasmtime has a larger overhead which we generally want to avoid for most test runs. However, this technique may not find bugs where both Wasmi backends are affected similarly.
  • Ideally we also want to improve shared objects (linear memory and globals) mismatch between the fuzzed engines. Currently, for example, linear memory hashes are compared instead of their actual content which does not provide us with all information needed in case of a mismatch, e.g. which memory location is at fault and which bytes etc.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request tech-debt An issue to resolve some technical debt.
Projects
None yet
Development

No branches or pull requests

1 participant