public sealed class FuzzSessionRuns one target until it is told to stop, and holds it to its promises.
No guide page documents this yet — the page shows what the code says about itself.
Remarks
The oracles are the point, not the loop. Pushing bytes at a decoder proves nothing on its own — the decoder has to be measured while it does it. Three things are measured: that nothing was thrown, that the allocation was proportionate to the input, and that the case finished quickly. Everything else about the decode is the target's business.
Deterministic, and that is a requirement rather than a nicety. The generator is seeded, the mutations are a pure function of it, and the corpus grows in a fixed order, so a failure on a CI machine is reproduced locally from the seed and the target name. A fuzzer whose findings cannot be replayed has handed you a rumour.
It does not stop at the first finding. One malformed shape usually reaches several decoders and several of a decoder's paths, and a run that stops at the first one turns a morning's fixing into a week of one-a-day. It stops at MaxFindings, which is there so a target that throws on everything does not fill memory with the evidence.
Fields and properties (5)
public const int MaxFindingsHow many findings are collected before a run gives up.
public const int WindowCasesHow many cases the allocation budget is measured over. See Weigh.
public TimeSpan CaseBudgetHow long one input may take to decode before that is itself the finding.
public int WarmUpCasesHow many cases run before allocation is held against the target, so that one-off start-up costs are not reported as an amplifying packet.
public string? RegressionDirectoryWhere committed regression inputs are read from, or null to skip them.
Methods (3)
public FuzzSession(IFuzzTarget target, ulong seed)Creates a run over one target.
public FuzzOutcome Run(long cases)Runs a fixed number of cases.
public FuzzOutcome RunFor(TimeSpan budget)Runs for a length of time.
Used by (1)
- FuzzGateTestsVixen.Net.Fuzz.Tests