fuzzjudge

package
v0.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 10, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Documentation

Overview

Package fuzzjudge decides, from the progress lines the Go fuzzer prints, whether a fuzz run stalled. `go test -fuzz` ends with PASS after a time limit whether or not anything ran in the last minutes, so scripts/fuzz.sh passes the log through cmd/fuzzjudge.

What it can see is the whole run's rate, not one input or one worker. It fails a run in which

  • no execution happened for StallGap anywhere in the run, including at the end of the log; or
  • the rate in the second half of the run (the median of the stretches that had executions) fell below MinRatio of the rate in the first half (after its first tenth, which is warm-up): a collapse to under a third; or
  • the share of the second half that was idle (stretches between progress lines with no execution) is more than MaxIdleRise above the share of the first half's: a run that pauses in stretches of less than StallGap and runs at full rate between them has a healthy median rate and no stall, and is mostly idle.

It does not fail the pauses the fuzzer makes itself (12 to 18 seconds with no execution, seen in real runs), nor a stall of 30 seconds or less at the end, nor a rate that varies by a factor of two, nor the same pauses in both halves. A stall of one input in one of several workers leaves most of the rate, so it is the watchdog in scripts/fuzz/fuzz_test.go that stops an input that takes ten seconds, while it runs.

Index

Constants

View Source 
const (
	// StallGap is the time without an execution that is a stall. The fuzzer pauses
	// by itself for 12 to 18 seconds (seen in real runs), so it is more than that.
	StallGap = 30 * time.Second
	// MinRatio is the least rate of the second half of a run, as a part of the rate
	// of its first half. The rate of a real run varies by a factor of two from one
	// half to the other (the fuzzer pauses to minimise an input that found new
	// coverage), so only a collapse is a stall.
	MinRatio = 0.3
	// MaxIdleRise is the most the share of idle time of the second half of a run may
	// exceed the first half's (a fraction of the half: 0.5 is 50 points). The fuzzer's
	// own pauses (12 to 18 seconds, seen in real runs) fall in either half, so only a
	// share far above the first half's is a stall.
	MaxIdleRise = 0.5
)

Variables

This section is empty.

Functions

func Run 

func Run(args []string, in io.Reader, out, errOut io.Writer) int

Run reads a fuzz log from in, judges it, prints one line about the target to out and returns the exit code: 0 for a sound run, 1 for a stalled one, 2 for a log that cannot be read.

Types

type Sample 

type Sample struct {
	Elapsed time.Duration
	Execs   int64
}

Sample is one progress line: the time since the run began and the executions so far.

func Parse 

func Parse(r io.Reader) ([]Sample, error)

Parse reads the progress lines of a fuzz log, ignoring the others.

type Verdict 

type Verdict struct {
	Execs     int64
	Elapsed   time.Duration
	FirstRate float64 // executions a second in the first half, after the first tenth
	LastRate  float64 // and in the second half
	FirstIdle float64 // the share of the first half (after its first tenth) with no execution, from 0 to 1
	LastIdle  float64 // and of the second half
	Problem   string  // empty when the run is sound
}

Verdict is the judgement of a run.

func Judge 

func Judge(samples []Sample) Verdict

Judge judges a run from its samples.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.