jazzer icon indicating copy to clipboard operation
jazzer copied to clipboard

Hierarchically budget fuzzer bytes with Autofuzz

Open fmeum opened this issue 3 years ago • 0 comments

Currently, whenever Autofuzz needs to decide how many bytes from the fuzzer input to spend on the construction of an object, it uses half of the remaining bytes. While this ensures that primitives with non-trivial values can be generated with arbitrarily many nested object constructions, this strategy does not make good use of the fuzzer input in the case of flat call graphs (e.g. a foo(String, int) method). Experiments show that ignoring half of the fuzzer input hurts efficiency quite a bit.

This commit switches to a new strategy that hierarchically assigns a "budget" for every consume or autofuzz call:

  1. Every call to consume or autofuzz is allocated a fraction of the remaining bytes and assigns equal parts of this budget to the recursive invocations it makes.
  2. By constructing the objects that consume a bounded number of bytes first in autofuzz, the remaining budget for an autofuzz invocation can be evenly distributed among the variable-length objects without risking that primitive arguments are forced to trivial values.

fmeum avatar Apr 26 '22 13:04 fmeum