gear icon indicating copy to clipboard operation
gear copied to clipboard

Add lazy pages fuzzer

Open ByteNacked opened this issue 1 year ago • 3 comments

Resolves # .

Add lazy pages fuzzer.

The fuzzer generates programs with additional global variables and memory accesses. It then runs these programs in both Wasmer and Wasmi, comparing the results. It compares the used memory pages and the values of global variables.

@reviewer-or-team

ByteNacked avatar Jun 10 '24 22:06 ByteNacked

@techraed @grishasobol

As an idea, maybe using a coverage-guided fuzzer is not optimal here, because it generates inputs based on coverage, and this might not be exactly optimal for this use case. Maybe we should use a simple fuzzer that just generates random inputs?

Consider this concerning hypothetical case of a coverage-based fuzzer:

  1. The fuzzer generates a memory access address, for example: 123465.
  2. The fuzzer tries to expand coverage and changes it to 645612 but sees it doesn't change coverage in any way.
  3. The fuzzer stops generating new memory access addresses because they don't expand coverage. Or worse, it simplifies this part of the input (the generated memory access address becomes 0) and doesn't change it later for the same reason.

The real cases might be not that severe but the point is same.

ByteNacked avatar Jun 20 '24 15:06 ByteNacked

@grishasobol please take a look at lazy pages stuff

techraed avatar Jul 02 '24 11:07 techraed

Also what do you think of using gear_wasm_module::WasmModule which is the wrapper that already has utility methods over the parity_wasm::Module, that can be beneficial here?

Well, I used same Module as used in gear-wasm-instrument because I need compatibility with this crate.

ByteNacked avatar Jul 04 '24 18:07 ByteNacked

Well, I used same Module as used in gear-wasm-instrument because I need compatibility with this crate.

Well, the wrapper gives you access to the underlying Module that you are using.

techraed avatar Jul 07 '24 10:07 techraed