Vixen
02b45cc4
csharp
public interface IFuzzTarget

One decoder, wrapped so that arbitrary bytes can be pushed into it.

No guide page documents this yet — the page shows what the code says about itself.

Remarks

A target is a place where bytes we did not write meet code that believes things. Every one of these corresponds to a real receive path: the packet reader under the session, the bit reader under replication, the handshake a connection performs before it is anybody, the remote call a client is allowed to make. What they have in common is the contract in PacketReader's remarks — that a malformed input is a refused message rather than an exception out of a decoder — and this interface is how that contract is tested rather than asserted.

The signature is what makes this more than a random-bytes loop. There is no instrumentation here and therefore no edge coverage; what a target returns instead is a cheap number summarising how the decode went — which reads succeeded, which counter moved, where it stopped. An input that produces a signature no earlier input produced is kept, and the mutator works from what was kept. That is a weaker signal than libFuzzer's and it is deliberately not called coverage, but it is enough to walk a decoder into its branches, which uniform random bytes will not do: the odds of thirty-two random bits being a tick a snapshot will accept are what they sound like.

Fields and properties (4)

  • string Name

    What to call it on a command line and in a report.

  • string What

    Which receive path this is, in one line.

  • long Held

    How many things the decoder is currently holding on to.

  • long HeldCap

    How many it may hold before that is the finding.

Methods (4)

  • void Seed(ICollection<byte[]> corpus)

    Adds well-formed inputs for the mutator to start from.

  • void Maintain()

    Puts the target back into a state worth fuzzing, before the next case.

  • long Run(ReadOnlySpan<byte> input)

    Pushes one input through the decoder.

  • long AllowanceFor(int inputLength)

    How many bytes an input of a given length may cause to be allocated.

Used by (15)

  • BitReaderTargetVixen.Net.Fuzz
  • DeltaCodecTargetVixen.Net.Fuzz
  • FuzzGateTestsVixen.Net.Fuzz.Tests
  • FuzzSessionVixen.Net.Fuzz
  • FuzzTargetsVixen.Net.Fuzz
  • HandshakeTargetVixen.Net.Fuzz
  • InputBufferTargetVixen.Net.Fuzz
  • PacketReaderTargetVixen.Net.Fuzz
  • RpcRouterTargetVixen.Net.Fuzz
  • SessionClientTargetVixen.Net.Fuzz
  • SnapshotInspectorTargetVixen.Net.Fuzz
  • SnapshotTargetVixen.Net.Fuzz
  • SyncListTargetVixen.Net.Fuzz
  • UdpTransportTargetVixen.Net.Fuzz
  • WebSocketUpgradeTargetVixen.Net.Fuzz