Fuzzing with honggfuzz-rs

[goffrie]

This uses honggfuzz-rs to generate a "script" that is used to mock out IO. It's pretty simple, but I've found it able to detect all the issues in #260, #261, and #262 (the latter two being issues that we actually hit in production).

Run with HFUZZ_RUN_ARGS="-t 1" cargo hfuzz run h2-fuzz (short timeout because it seems to run into infinite loops pretty often - probably something to do with hitting EOF and I'm not sure if it's a problem with the I/O mock or h2.)

This doesn't have to be merged as-is, just wanted to share the code.

[hawkw]

This is very cool, thanks for sharing!

[carllerche]

I tried running this and get:

LLVM ERROR: Global variable '__sancov_gen_' has an invalid section specifier '__sancov_guards': mach-o section specifier requires a segment and section separated by a comma.
error: Could not compile `string`.
warning: build failed, waiting for other jobs to finish...
LLVM ERROR: Global variable '__sancov_gen_' has an invalid section specifier '__sancov_guards': mach-o section specifier requires a segment and section separated by a comma.
error: Could not compile `libc`.
warning: build failed, waiting for other jobs to finish...
LLVM ERROR: Global variable '__sancov_gen_' has an invalid section specifier '__sancov_guards': mach-o section specifier requires a segment and section separated by a comma.
error: Could not compile `byteorder`.
warning: build failed, waiting for other jobs to finish...
LLVM ERROR: Global variable '__sancov_gen_' has an invalid section specifier '__sancov_guards': mach-o section specifier requires a segment and section separated by a comma.
error: Could not compile `log`.
warning: build failed, waiting for other jobs to finish...
LLVM ERROR: Global variable '__sancov_gen_' has an invalid section specifier '__sancov_guards': mach-o section specifier requires a segment and section separated by a comma.
error: Could not compile `indexmap`.
warning: build failed, waiting for other jobs to finish...
LLVM ERROR: Global variable '__sancov_gen_' has an invalid section specifier '__sancov_guards': mach-o section specifier requires a segment and section separated by a comma.
error: Could not compile `termcolor`.
warning: build failed, waiting for other jobs to finish...
LLVM ERROR: Global variable '__sancov_gen_' has an invalid section specifier '__sancov_guards': mach-o section specifier requires a segment and section separated by a comma.
error: Could not compile `futures`.

[carllerche]

I think that I might be on an old rustc.

[carllerche]

Ok, I managed to get an error. I'm going to see if I can figure out how to convert to a test.

[carllerche]

Thanks! I pulled this in in #274. I cleaned up the organization a bit, but the fuzz test is the same.