Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

internal/fuzz: implement better prioritization algorithm in fuzzing engine #46224

Open
katiehockman opened this issue May 18, 2021 · 0 comments
Labels
fuzz Issues related to native fuzzing support NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone

Comments

@katiehockman
Copy link
Contributor

Currently, every item in the corpus is equally likely to be mutated by the fuzzing engine. The coordinator loops through each item in the corpus sequentially, and passes each one to a worker to be mutated.

However, we should consider more heavily prioritizing interesting inputs that were more recently discovered, rather than giving them equal weight to older corpus entries. go-fuzz runs a "smash" which "gives some minimal attention to every new input." https://github.com/dvyukov/go-fuzz/blob/master/go-fuzz/worker.go#L444

(from @rolandshoemaker)
The go-fuzz implementation of this is essentially the deterministic fuzzing stage of AFL, described in section 6 of https://lcamtuf.coredump.cx/afl/technical_details.txt. It definitely seems like a good idea, but I think an implementation requires figuring out a way to return multiple new inputs from the fuzz function since there are likely to be >1 new interesting inputs discovered (another option could be to return some kind of signal in the fuzzResponse that the deterministic stage didn't finish, and an indication of where in the stage it should be restarted from, but that seems overly complicated).

@katiehockman katiehockman added the fuzz Issues related to native fuzzing support label May 18, 2021
@katiehockman katiehockman added this to the Backlog milestone May 18, 2021
@katiehockman katiehockman added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label May 18, 2021
@rsc rsc changed the title [dev.fuzz] internal/fuzz: implement better prioritization algorithm in fuzzing engine internal/fuzz: implement better prioritization algorithm in fuzzing engine Sep 21, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
fuzz Issues related to native fuzzing support NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
Status: No status
Development

No branches or pull requests

1 participant