Skip to content

Commit

Permalink
add honggfuzz target
Browse files Browse the repository at this point in the history
  • Loading branch information
zzjas committed Sep 14, 2024
1 parent 04ade7e commit b0ec137
Show file tree
Hide file tree
Showing 5 changed files with 82 additions and 0 deletions.
22 changes: 22 additions & 0 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ install-deps:
cargo install cargo-fuzz
cargo install cargo-afl
cargo install cargo-binutils
cargo install honggfuzz

clean:
cargo clean
2 changes: 2 additions & 0 deletions fuzz/.gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -3,3 +3,5 @@ corpus
artifacts
coverage
afl
hfuzz_target
hfuzz_workspace
8 changes: 8 additions & 0 deletions fuzz/Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ edition = "2021"
cargo-fuzz = true

[dependencies]
honggfuzz = "0.5"
afl = "*"
arbitrary = { workspace = true }
libfuzzer-sys = "0.4.7"
Expand Down Expand Up @@ -42,3 +43,10 @@ path = "fuzz_targets/opt_noopt.rs"
test = false
doc = false
bench = false

[[bin]]
name = "hfuzz-v1v2"
path = "fuzz_targets/hfuzz_v1v2.rs"
test = false
doc = false
bench = false
49 changes: 49 additions & 0 deletions fuzz/fuzz_targets/hfuzz_v1v2.rs
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
use arbitrary::Unstructured;
use honggfuzz::fuzz;
use move_smith::{
config::Config,
execution::{
transactional::{
CommonRunConfig, TransactionalExecutor, TransactionalInputBuilder, TransactionalResult,
},
ExecutionManager,
},
CodeGenerator, MoveSmith,
};
use once_cell::sync::Lazy;
use std::{env, path::PathBuf, sync::Mutex};

static CONFIG: Lazy<Config> = Lazy::new(|| {
let config_path =
env::var("MOVE_SMITH_CONFIG").unwrap_or_else(|_| "MoveSmith.toml".to_string());
let config_path = PathBuf::from(config_path);
Config::from_toml_file_or_default(&config_path)
});

static RUNNER: Lazy<Mutex<ExecutionManager<TransactionalResult, TransactionalExecutor>>> =
Lazy::new(|| {
Mutex::new(ExecutionManager::<TransactionalResult, TransactionalExecutor>::default())
});

fn main() {
loop {
fuzz!(|data: &[u8]| {
let u = &mut Unstructured::new(data);
let mut smith = MoveSmith::new(&CONFIG.generation);
match smith.generate(u) {
Ok(()) => (),
Err(_) => return,
};
let code = smith.get_compile_unit().emit_code();
let mut input_builder = TransactionalInputBuilder::new();
let input = input_builder
.set_code(&code)
.with_common_runs(&CommonRunConfig::V1V2Comparison)
.build();
let bug = RUNNER.lock().unwrap().execute_check_new_bug(&input);
if bug.unwrap() {
panic!("Found bug")
}
});
}
}

0 comments on commit b0ec137

Please sign in to comment.