libfuzzer icon indicating copy to clipboard operation
libfuzzer copied to clipboard

Allow for multiple inputs to a fuzz_target, such data from corpus + an additional Arbitrary

Open rsheeter opened this issue 1 year ago • 4 comments

To fuzz font processing, such as loading glyph outlines, we would like to have two inputs:

  1. The usual data: &[u8], mutated from a corpus entry
    • data is thus relatively likely to be a somewhat valid font and trigger interesting processing
  2. An additional Arbitrary, generated by the fuzzer
    • This configures font processing, such as specifying hinting on/off, what variation settings to use, etc

If I simply carve an Arbitrary off the incoming data, say taking the head and considering the tail to be a font binary, then tail becomes very unlikely to be a valid font. Full disclosue: I initially did exactly this; coverage of the target code remained very low.

Thinking "aloud" I suppose I could glue extra bytes onto corpus entries to use to populate my Arbitrary?

rsheeter avatar Jun 26 '24 20:06 rsheeter