1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
|
# TODO(jayconrod): support shared memory on more platforms.
[!darwin] [!linux] [!windows] skip
[short] skip
env GOCACHE=$WORK/cache
# Test that fuzzing a target with a failure in f.Add prints the crash
# and doesn't write anything to testdata/fuzz
! go test -fuzz=FuzzWithAdd -run=FuzzWithAdd -fuzztime=1x
! stdout ^ok
! stdout 'Crash written to testdata[/\\]fuzz[/\\]FuzzWithAdd[/\\]'
stdout FAIL
# Test that fuzzing a target with a sucess in f.Add and a fuzztime of only
# 1 does not produce a crash.
go test -fuzz=FuzzWithGoodAdd -run=FuzzWithGoodAdd -fuzztime=1x
stdout ok
! stdout FAIL
# Test that fuzzing a target with a failure in testdata/fuzz prints the crash
# and doesn't write anything to testdata/fuzz
! go test -fuzz=FuzzWithTestdata -run=FuzzWithTestdata -fuzztime=1x
! stdout ^ok
! stdout 'Crash written to testdata[/\\]fuzz[/\\]FuzzWithTestdata[/\\]'
stdout FAIL
# Test that fuzzing a target with no seed corpus or cache finds a crash, prints
# it, and write it to testdata
! go test -fuzz=FuzzWithNoCache -run=FuzzWithNoCache -fuzztime=1x
! stdout ^ok
stdout 'Crash written to testdata[/\\]fuzz[/\\]FuzzWithNoCache[/\\]'
stdout FAIL
# Write a crashing input to the cache
mkdir $GOCACHE/fuzz/example.com/x/FuzzWithCache
cp cache-file $GOCACHE/fuzz/example.com/x/FuzzWithCache/1
# Test that fuzzing a target with a failure in the cache prints the crash
# and writes this as a "new" crash to testdata/fuzz
! go test -fuzz=FuzzWithCache -run=FuzzWithCache -fuzztime=1x
! stdout ^ok
stdout 'Crash written to testdata[/\\]fuzz[/\\]FuzzWithCache[/\\]'
stdout FAIL
# Clear the fuzz cache and make sure it's gone
go clean -fuzzcache
! exists $GOCACHE/fuzz
# The tests below should operate the exact same as the previous tests. If -fuzz
# is enabled, then whatever target is going to be fuzzed shouldn't be run by
# anything other than the workers.
# Test that fuzzing a target (with -run=None set) with a failure in f.Add prints
# the crash and doesn't write anything to testdata/fuzz -fuzztime=1x
! go test -fuzz=FuzzWithAdd -run=None
! stdout ^ok
! stdout 'Crash written to testdata[/\\]fuzz[/\\]FuzzWithAdd[/\\]'
stdout FAIL
# Test that fuzzing a target (with -run=None set) with a sucess in f.Add and a
# fuzztime of only 1 does not produce a crash.
go test -fuzz=FuzzWithGoodAdd -run=None -fuzztime=1x
stdout ok
! stdout FAIL
# Test that fuzzing a target (with -run=None set) with a failure in
# testdata/fuzz prints the crash and doesn't write anything to testdata/fuzz
! go test -fuzz=FuzzWithTestdata -run=None -fuzztime=1x
! stdout ^ok
! stdout 'Crash written to testdata[/\\]fuzz[/\\]FuzzWithTestdata[/\\]'
stdout FAIL
# Write a crashing input to the cache
mkdir $GOCACHE/fuzz/example.com/x/FuzzRunNoneWithCache
cp cache-file $GOCACHE/fuzz/example.com/x/FuzzRunNoneWithCache/1
# Test that fuzzing a target (with -run=None set) with a failure in the cache
# prints the crash and writes this as a "new" crash to testdata/fuzz
! go test -fuzz=FuzzRunNoneWithCache -run=None -fuzztime=1x
! stdout ^ok
stdout 'Crash written to testdata[/\\]fuzz[/\\]FuzzRunNoneWithCache[/\\]'
stdout FAIL
# Clear the fuzz cache and make sure it's gone
go clean -fuzzcache
! exists $GOCACHE/fuzz
# The tests below should operate the exact same way for the previous tests with
# a seed corpus (namely, they should still fail). However, the binary is built
# without instrumentation, so this should be a "testing only" run which executes
# the seed corpus before attempting to fuzz.
go test -c
! exec ./x.test$GOEXE -test.fuzz=FuzzWithAdd -test.run=FuzzWithAdd -test.fuzztime=1x -test.fuzzcachedir=$WORK/cache
! stdout ^ok
! stdout 'Crash written to testdata[/\\]fuzz[/\\]FuzzWithAdd[/\\]'
stdout FAIL
stderr warning
go test -c
! exec ./x.test$GOEXE -test.fuzz=FuzzWithTestdata -test.run=FuzzWithTestdata -test.fuzztime=1x -test.fuzzcachedir=$WORK/cache
! stdout ^ok
! stdout 'Crash written to testdata[/\\]fuzz[/\\]FuzzWithTestdata[/\\]'
stdout FAIL
stderr warning
-- go.mod --
module example.com/x
go 1.16
-- x_test.go --
package x
import "testing"
func FuzzWithAdd(f *testing.F) {
f.Add(10)
f.Fuzz(func(t *testing.T, i int) {
if i == 10 {
t.Error("bad thing here")
}
})
}
func FuzzWithGoodAdd(f *testing.F) {
f.Add(10)
f.Fuzz(func(t *testing.T, i int) {
if i != 10 {
t.Error("bad thing here")
}
})
}
func FuzzWithTestdata(f *testing.F) {
f.Fuzz(func(t *testing.T, i int) {
if i == 10 {
t.Error("bad thing here")
}
})
}
func FuzzWithNoCache(f *testing.F) {
f.Fuzz(func(t *testing.T, i int) {
t.Error("bad thing here")
})
}
func FuzzWithCache(f *testing.F) {
f.Fuzz(func(t *testing.T, i int) {
if i == 10 {
t.Error("bad thing here")
}
})
}
func FuzzRunNoneWithCache(f *testing.F) {
f.Fuzz(func(t *testing.T, i int) {
if i == 10 {
t.Error("bad thing here")
}
})
}
-- testdata/fuzz/FuzzWithTestdata/1 --
go test fuzz v1
int(10)
-- cache-file --
go test fuzz v1
int(10)
|
