afl.rs

There is afl-rs https://github.com/rust-fuzz/afl.rs also we're working on a fuzzing library that's completely written in rust right now, stay tuned :)

There may be more static analysis tools available for C++, but the quality of the static analysis built right into Rust's type system blows all of them out of the water; no tool for C++ that I've used (Coverity, Infer, PVS-Studio, ...) can reliably prevent use-after-free or data races. Due to the type system, safe Rust code has much less need for sanitizers (leaks and lock order checks are useful) or fuzzers (they'll only find infinite loops); granted, you do have a point in that sanitizers are very useful for unsafe Rust code. There's AFL for Rust: https://github.com/rust-fuzz/afl.rs [Edit:] With regard to theorem provers, my understanding is that you typically work in some sort of functional language and the correct C/C++ code is generated as a final step at the end (program extraction); certainly Coq and the HOL family work that way. T

We have! afl.rs[1] is awesome, and seeing as it's found some interesting bugs, I think Rust would be a great addition to Fuzzbuzz. It's on our roadmap. [1] https://github.com/rust-fuzz/afl.rs

Someome made afl work with rust here: https://github.com/rust-fuzz/afl.rs

It does look like the afl.rs project (afl for rust code) has been run on regex: https://github.com/frewsxcv/afl.rs#trophy-case Which resulted in just one issue? I'm not sure how long they fuzzed or what the methodology was, but this was the panic they found (still not a memory safety issue, more akin to an unchecked exception in Java than a crash in C++): https://github.com/rust-lang/regex/issues/84 Since that issue is from the same time as Rust's 1.0 release, I suspect that either it hasn't been run again recently or that things are pretty stable in the regex crate w.r.t. fuzzing.

If you run it in a spawned thread, the thread will actually just unwind and disappear if it panics (by default). But to detect panics, you can use `afl.rs` to fuzz a parser: https://github.com/frewsxcv/afl.rs#user-content-trophy-case

Great to read real-world use cases. Tangent-ish question, I've seen some work on AFL for Rust[1], how much of this understanding maps to Rust? Is the instrumentation path pretty uniform for LLVM based binaries? [1] https://github.com/frewsxcv/afl.rs

Somewhat interesting for those who missed it - another rust/brotli project was a target for afl-rust. IIRC it didn't find any memory safety issues, but it definitely exposed a few panic crashes: https://github.com/frewsxcv/afl.rs (discussion https://news.ycombinator.com/item?id=11936983) I don't think they mentioned fuzzing their Brotli decompressor in this article, but I hope they try afl-rust.

This is what I'm striving for: #[fuzz] fn test_fuzz(bytes: Vec<u8>) { ... } This would live alongside other test cases and everytime fuzzing is desired, one could just do `cargo fuzz`. Relevant issues and a pull request: https://github.com/frewsxcv/afl.rs/issues/24 https://github.com/frewsxcv/afl.rs/issues/31 https://github.com/frewsxcv/afl.rs/pull/46 There's still a little more work to do though. Mainly, I want to compile AFL as a part of the workflow (see the afl-sys crate in the repo) so the user doesn't need to manually install AFL to use `cargo fuzz`.

Regarding using stable builds of Rust with afl.rs: If I could, I would. afl.rs uses a Rust compiler plugin to register the LLVM pass needed to instrument Rust programs so that AFL can run on them: https://github.com/frewsxcv/afl.rs/blob/master/afl-plugin/li... Compiler plugins in Rust are currently unstable, and as far as I know, are not on a path to stability in the near-term. https://doc.rust-lang.org/book/compiler-plugins.html

Nice! It’s already proven to be useful: https://github.com/frewsxcv/afl.rs#trophy-case