auto-fuzz-test icon indicating copy to clipboard operation
auto-fuzz-test copied to clipboard

Write fuzz harnesses to ready-to-use projects

Open Shnatsel opened this issue 7 years ago • 2 comments

Fuzzing harness generator should operate in a manner similar to cargo fuzz init: it should create a subfolder in your project that would already have a Cargo.toml and have everything ready to go.

Since currently some harnesses may not be generate correctly and may not compile, we do not want to take the cargo-fuzz approach of "one project with many binaries", but rather generate multiple independently compiled projects so that if one fails to compile, the rest can still function.

Shnatsel avatar Mar 23 '19 22:03 Shnatsel

Right now fuzzing harnesses are not even written to individual files, they're just returned as strings. We probably want to write a layer on top of that.

Shnatsel avatar Mar 23 '19 22:03 Shnatsel

Sample Cargo.toml to generate: https://github.com/Shnatsel/image-png/blob/master/png-afl/Cargo.toml The rest of that directory layout can be used as reference as well.

https://github.com/Eh2406/auto-fuzz-test/blob/master/src/crate_parse.rs provides facilities for parsing Cargo.toml of the crate to fuzz, but for now we can get away with just passing it on the command line - we'll need to add it anyway to support non-Cargo build systems eventually

Shnatsel avatar Jun 25 '19 21:06 Shnatsel