fuzzingbook

fuzzingbook copied to clipboard

Describe the bug Because the GrammarCoverageFuzzer inherits from the GrammarFuzzer, it still uses the expansion strategy based on costs. This can result in the fuzzer avoiding completely parts of the grammar because it first selects expansions with maximum cost. For a fuzzer that pretends to cover the grammar that is pretty confusing.

To Reproduce For example, the following code will never produce an 'a':

from fuzzingbook.GrammarCoverageFuzzer import GrammarCoverageFuzzer

grammar = {
    '<start>': ['<A>', '<B>'],
    '<A>': ['a'],
    '<B>': ['b<C>', '<D>'],
    '<C>': ['c'],
    '<D>': ['d']
}

fuzzer = GrammarCoverageFuzzer(grammar, min_nonterminals=5, max_nonterminals=10)

for i in range(100):
    print(fuzzer.fuzz())
    print('-----------')