-
Notifications
You must be signed in to change notification settings - Fork 85
Open
Description
I invested some time looking through Arbitrary/libfuzzer-sys to determine the best way to limit recursion (in my case). I'm going to list what I looked at:
- https://docs.rs/libfuzzer-sys/0.4.7/src/libfuzzer_sys/lib.rs.html#262-270, how
size_hint
is used to bail out in case of "not enough data". - Improving support for generating recursive types #78 (comment), custom Arbitrary impl with
depth
, switch to non-recursive generation as the limit is surpassed. - List of breaking changes for next breaking release #217, coming breaking changes.
- https://github.com/search?q=repo%3Abytecodealliance%2Fwasm-tools%20impl%3C%27a%3E%20Arbitrary&type=code, wasm smith.
Questions I'm trying to answer:
- Isn't using
size_hint
faster than limiting with a customarbitrary
implementation? If you implementsize_hint
, you can set the size hint to something likeu64::MAX
, which will be interpreted by libfuzzer-sys as not generating this input. The check for supplied bytes being less than the hint returns-1
. While this may not be ideal for varying recursion depths since it's currently hardcoded, there are workarounds.
My thought is that calculating the hint is much faster than limiting while generating the data structure, especially if you know your boundaries and just want to go a bit higher. - Has it been empirically found that continuously generating the non-recursive data structure improves coverage? (ref to point 2 in the previous list)
Metadata
Metadata
Assignees
Labels
No labels