Re:Jazzer brings modern fuzz testing to the JVM
by serjd on Thursday February 11, 2021 @05:02AM
(#26099901)
We are aware of JQF and the jUnit integration is the best part there. We opted to taking the "Fuzzed Data Provider" approach to be more compatible to the approach in C/C++, Go and Python...
[ Parent
| on HN ]
Re:Jazzer brings modern fuzz testing to the JVM
by ekiwi on Thursday February 11, 2021 @03:53PM
(#26106997)
How do you deal with structured formats, like XML?
In JQF you would just write a XML generator (see their examples). If you just use the "sequence of bytes" approach as AFL does, then a lot of your inputs might be immediately rejected by the parser.
Re:Jazzer brings modern fuzz testing to the JVM
by fhenneke on Friday February 12, 2021 @05:04AM
(#26112070)
The FuzzedDataProvider (docs at https://codeintelligencetesting.github.io/jazzer-api/com/cod...) offers many of the functions you would need to write such a generator. If there is something missing that could be generally useful, we can always add it.
Re:Jazzer brings modern fuzz testing to the JVM
by serjd on Friday February 12, 2021 @03:42AM
(#26111760)
We use our internal grammar generator similar to libprotobuf mutator. For the OSS solution, we recommend to use libprotobuf mutator though. The reason to abstract this is that we don't want to write the grammars for a single programming language only.