Fuzzing Class Interfaces for Generating and Running Tests with libFuzzer
summary
Shows how to use clang's libFuzzer to generate and execute unit tests by interpreting fuzzer byte streams as sequences of C++ class member calls and arguments. Uses coverage feedback to grow combinations of interface operations, supports optional preconditions to filter invalid call sequences, checks class invariants between calls, and applies sanitizers; implementation is pure C++ with no code generation and can shrink findings to regression tests.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:40Overview
- 1:36The (simplified) container vision
- 2:21Example Unit Test Case
- 3:31Possible undetected bugs
- 4:45Too many states
- 8:07What we would need
- 13:04Fuzzing in general
- 17:22Clang Sanitizers
- 18:56Fuzzing example - UBSanitizer
- 19:34Fuzzing example - MemorySanitizer
- 22:03Transforming libFuzzer to an Interface Fuzzer
- 23:15Interface Description
- 26:06Interpreting the Generated Strings
- 29:42Crashes are not Enough
- 30:20Invariants
- 32:03Case Study 1: Simplified Deque
- 34:16Case Study 2: Robin-hood Hash Map
- 39:08Summary
related talks
25mHow fuzzing helps to find bugs
24mWhy you should be using automated fuzzing to test for security issues in your code
53mFuzzing 101
31m“Fuzz or lose..."
39mMaking Fuzzing Part of Your Software Development Lifecycle
21mModern Testing and Fuzzing in Bitcoin Core
23mContinuous Fuzzing Best Practices
54mBuild Safer Modern C++ Application: Mix Assertion, Logging, Unit Testing and Fuzzing with ZeroErr