Re:Fuzzing is magic – Or how I found a panic in Rust's regex...
by lbrandy on Saturday April 01, 2017 @09:31PM
(#14015218)
libfuzzer (and many of the fuzzers used widely today) is a coverage (as in, code-coverage) directed fuzzer. So it's not just randomly mutating the input, but "selecting" for random inputs that happen to light up new code paths. It works with a (or generates a random) corpus, and prefers the sample inputs that light up new code paths in subsequent mutations of the population.
[ Parent
| on HN ]
There are no comments on this comment yet.