bb5cb6a4d0
A first step in cleaning up RLP, which has lots of interesting issues - the next step would be to clean up the exception handling as well (Resultify?) * remove `RlpNode` (unused) * single-pass parsing for most functionality via RlpItem * stricter conformance to spec * remove float support * warn about signed integers * raise on invalid RLP earlier * avoid several pointless allocations, in particular in `listLen`, `listElem` etc * include spec docs |
||
|---|---|---|
| .. | ||
| discovery | ||
| discoveryv5 | ||
| enr | ||
| rlp | ||
| rlpx | ||
| fuzzing_helpers.nim | ||
| readme.md | ||
readme.md
Fuzzing Tests
This directory contains a set of subdirectories which hold one or more test cases that can be used for fuzzing.
The fuzzing test cases use the fuzzing templates from nim-testutils.
For more details see the fuzzing readme of nim-testutils.
Some of the subdirectories also hold corpus generation tooling in order to have some corpus files to start fuzzing from.
Prerequisites
As explained
in nim-testutils fuzzing readme, first install the fuzzer you want to run.
Next install nim-testutils its ntu application.
E.g. by running the nim-testutils nimble install:
nimble install testutils
How to run
To start fuzzing a test case run following command:
# Rlp fuzzing with libFuzzer
ntu fuzz --fuzzer:libFuzzer rlp/rlp_decode
# Rlp fuzzing with afl
ntu fuzz --fuzzer:afl rlp/rlp_decode
Or another example:
# ENR fuzzing with libFuzzer
ntu fuzz --fuzzer:libFuzzer enr/fuzz_enr
# ENR fuzzing with afl
ntu fuzz --fuzzer:afl enr/fuzz_enr
Manual adjustments
The ntu application is still very limited in its functionality. Many of the underlying fuzzer functionality is not available for adjustment so you might want to configure the setup in a more manual way.
How to do this is briefly explained here for afl and here for libFuzzer.