Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add AFL fuzzing to test compression with miniz decompression #40

Merged
merged 1 commit into from
Jan 23, 2020

Conversation

aschampion
Copy link
Contributor

AFL fuzzer started in #37 with roundtrip errors reported in #39. This differs from the fuzzer binary I'm currently running in that it was only testing CompressionOptions::default(), but since ::fast() was used in the original motivating bugs it should be used here too to exercise more code paths.

Draft PR for now, since the found code paths from the current fuzz should probably be added as seeds.

@oyvindln
Copy link
Collaborator

Thanks. Could maybe merge this and add more paths later? (and speaking of miniz_oxide, that librarly could also use some more extensive fuzzing.)

@aschampion
Copy link
Contributor Author

and speaking of miniz_oxide, that librarly could also use some more extensive fuzzing

This could decompress with two libraries (inflate or a different miniz_oxide backend) and compare the results, as a way of both increasing confidence the error is in the compression and also fuzzing those decoders. The downside would be the decoder libraries exploding the path search/coverage space of the fuzzer.

@aschampion aschampion mentioned this pull request Jan 17, 2020
@aschampion
Copy link
Contributor Author

I've had to terminate the fuzzing temporarily, and this should restart with the changes from #41, so for my reference here was the status of the first run:

                 american fuzzy lop 2.52b (deflate-fuzz-target)

┌─ process timing ─────────────────────────────────────┬─ overall results ─────┐
│        run time : 72 days, 2 hrs, 21 min, 47 sec     │  cycles done : 3      │
│   last new path : 2 days, 2 hrs, 55 min, 16 sec      │  total paths : 1021   │
│ last uniq crash : 12 days, 19 hrs, 58 min, 0 sec     │ uniq crashes : 46     │
│  last uniq hang : none seen yet                      │   uniq hangs : 0      │
├─ cycle progress ────────────────────┬─ map coverage ─┴───────────────────────┤
│  now processing : 651* (63.76%)     │    map density : 2.96% / 3.59%         │
│ paths timed out : 0 (0.00%)         │ count coverage : 4.69 bits/tuple       │
├─ stage progress ────────────────────┼─ findings in depth ────────────────────┤
│  now trying : interest 16/8         │ favored paths : 28 (2.74%)             │
│ stage execs : 688k/1.33M (51.68%)   │  new edges on : 53 (5.19%)             │
│ total execs : 529M                  │ total crashes : 976k (46 unique)       │
│  exec speed : 85.74/sec (slow!)     │  total tmouts : 617 (62 unique)        │
├─ fuzzing strategy yields ───────────┴───────────────┬─ path geometry ────────┤
│   bit flips : 167/19.6M, 21/19.6M, 13/19.6M         │    levels : 8          │
│  byte flips : 1/2.44M, 3/2.41M, 9/2.41M             │   pending : 915        │
│ arithmetics : 21/133M, 2/24.2M, 1/1.17M             │  pend fav : 0          │
│  known ints : 5/15.6M, 12/65.0M, 48/104M            │ own finds : 1018       │
│  dictionary : 0/0, 0/0, 25/118M                     │  imported : n/a        │
│       havoc : 736/522k, 0/0                         │ stability : 99.92%     │
│        trim : 0.00%/69.1k, 1.67%                    ├────────────────────────┘
^C────────────────────────────────────────────────────┘          [cpu000: 10%]

@aschampion aschampion mentioned this pull request Jan 19, 2020
@oyvindln oyvindln marked this pull request as ready for review January 23, 2020 01:16
@oyvindln
Copy link
Collaborator

Adding this now, can add further stuff later.

@oyvindln oyvindln merged commit 8640a15 into image-rs:dev Jan 23, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants