IFuzzTarget

Remarks

A target is a place where bytes we did not write meet code that believes things. Every one of these corresponds to a real receive path: the packet reader under the session, the bit reader under replication, the handshake a connection performs before it is anybody, the remote call a client is allowed to make. What they have in common is the contract in PacketReader's remarks — that a malformed input is a refused message rather than an exception out of a decoder — and this interface is how that contract is tested rather than asserted.

The signature is what makes this more than a random-bytes loop. There is no instrumentation here and therefore no edge coverage; what a target returns instead is a cheap number summarising how the decode went — which reads succeeded, which counter moved, where it stopped. An input that produces a signature no earlier input produced is kept, and the mutator works from what was kept. That is a weaker signal than libFuzzer's and it is deliberately not called coverage, but it is enough to walk a decoder into its branches, which uniform random bytes will not do: the odds of thirty-two random bits being a tick a snapshot will accept are what they sound like.

Fields and properties (6)

• string Name

  What to call it on a command line and in a report.

• string What

  Which receive path this is, in one line.

• IFuzzDomain? Domain

  How its inputs are made, or null for byte havoc.

• bool NoveltyGuides

  Whether a behaviour nothing produced before is worth keeping the input for.

• long Held

  How many things the decoder is currently holding on to.

• long HeldCap

  How many it may hold before that is the finding.

Methods (4)

• void Seed(ICollection<byte[]> corpus)

  Adds well-formed inputs for the mutator to start from.

• void Maintain()

  Puts the target back into a state worth fuzzing, before the next case.

• long Run(ReadOnlySpan<byte> input)

  Pushes one input through the decoder.

• long AllowanceFor(int inputLength)

  How many bytes an input of a given length may cause to be allocated.

Used by (28)

• AssetMetaTargetVixen.Fuzz
• BitReaderTargetVixen.Fuzz
• BundleTargetVixen.Fuzz
• ChunkFormatTargetVixen.Fuzz
• ChurningTargetVixen.Fuzz.Tests
• DeltaCodecTargetVixen.Fuzz
• FuzzGateTestsVixen.Fuzz.Tests
• FuzzSessionVixen.Fuzz
• FuzzTargetsVixen.Fuzz
• HandshakeTargetVixen.Fuzz
• HeightmapPngTargetVixen.Fuzz
• HoardingTargetVixen.Fuzz.Tests
• InputBufferTargetVixen.Fuzz
• LayerRuleTargetVixen.Fuzz
• PacketReaderTargetVixen.Fuzz
• QuietTargetVixen.Fuzz.Tests
• RavenTargetVixen.Fuzz
• RpcRouterTargetVixen.Fuzz
• ScriptedTargetVixen.Fuzz.Tests
• SessionClientTargetVixen.Fuzz
• SnapshotInspectorTargetVixen.Fuzz
• SnapshotTargetVixen.Fuzz
• StallingTargetVixen.Fuzz.Tests
• StyleValueTargetVixen.Fuzz
• SyncListTargetVixen.Fuzz
• UdpTransportTargetVixen.Fuzz
• VxmlTargetVixen.Fuzz
• WebSocketUpgradeTargetVixen.Fuzz