6ffcd4ead9
This commit improves the stability of the fuzz targets by ensuring the generated configs and modules are congruent, especially when the pooling allocator is being used. For the `differential` target, this means both configurations must use the same allocation strategy for now as one side generates the module that might not be compatible with another arbitrary config now that we fuzz the pooling allocator. These changes also ensure that constraints put on the config are more consistently applied, especially when using a fuel-based timeout.
42 lines
1.2 KiB
Rust
42 lines
1.2 KiB
Rust
#![no_main]
|
|
|
|
use libfuzzer_sys::arbitrary::{Result, Unstructured};
|
|
use libfuzzer_sys::fuzz_target;
|
|
use wasmtime_fuzzing::oracles::Timeout;
|
|
use wasmtime_fuzzing::{generators, oracles};
|
|
|
|
fuzz_target!(|data: &[u8]| {
|
|
// errors in `run` have to do with not enough input in `data`, which we
|
|
// ignore here since it doesn't affect how we'd like to fuzz.
|
|
drop(run(data));
|
|
});
|
|
|
|
fn run(data: &[u8]) -> Result<()> {
|
|
let mut u = Unstructured::new(data);
|
|
let mut config: generators::Config = u.arbitrary()?;
|
|
|
|
// Pick either fuel, duration-based, or module-based timeout. Note that the
|
|
// module-based timeout is implemented with wasm-smith's
|
|
// `ensure_termination` option.
|
|
let timeout = if u.arbitrary()? {
|
|
config.generate_timeout(&mut u)?
|
|
} else {
|
|
Timeout::None
|
|
};
|
|
|
|
// Enable module linking for this fuzz target specifically
|
|
config.module_config.config.module_linking_enabled = u.arbitrary()?;
|
|
|
|
let module = config.generate(
|
|
&mut u,
|
|
if let Timeout::None = timeout {
|
|
Some(1000)
|
|
} else {
|
|
None
|
|
},
|
|
)?;
|
|
|
|
oracles::instantiate(&module.to_bytes(), true, &config, timeout);
|
|
Ok(())
|
|
}
|