Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

synchro: add fuzzer for ParseISO #33

Merged
merged 1 commit into from
Feb 23, 2024
Merged

Conversation

uji
Copy link
Contributor

@uji uji commented Feb 23, 2024

Implement a fuzzer using the Fuzzing feature of the Go standard and run it continuously with CI.
This is particularly useful in finding vulnerabilities, as it allows them to reach edge cases that are often overlooked by humans.

Details

  • Implementation of FuzzParseISO
    • This explores whether there are any cases where ParseISO causes a panic.
    • A similar fuzzer has been implemented in chrono, which served as an inspiration.
  • Configuration for automatic execution in CI.
    • To provide rapid feedback to developers before merging into the base branch, Fuzzing will also be conducted in the Test workflow.
    • There are other approaches to test more comprehensively at a lower frequency (often referred to as Batch Fuzzing), but given the size of the codebase, this is considered unnecessary at present, as lightweight Fuzzing can achieve sufficient coverage.
    • Set to 300 second because the increase in 'New interesting' slows down and stops growing.
Graph showing the increase in "New interesting" when running for 10 minutes on GItHub Actions.

image

References

@uji uji force-pushed the uji/add-fuzz-targets branch 2 times, most recently from 8327009 to 6ad1ae5 Compare February 23, 2024 15:55
@uji uji marked this pull request as ready for review February 23, 2024 16:01
@uji uji force-pushed the uji/add-fuzz-targets branch 3 times, most recently from 1207744 to 4dc7368 Compare February 23, 2024 16:09
@uji uji marked this pull request as draft February 23, 2024 16:09
@uji uji marked this pull request as ready for review February 23, 2024 16:40
Copy link

codecov bot commented Feb 23, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 46.86%. Comparing base (2206fae) to head (215ac01).

Additional details and impacted files
@@             Coverage Diff              @@
##              main      #33       +/-   ##
============================================
- Coverage   100.00%   46.86%   -53.14%     
============================================
  Files           15      434      +419     
  Lines         2635     5659     +3024     
============================================
+ Hits          2635     2652       +17     
- Misses           0     3004     +3004     
- Partials         0        3        +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Owner

@Code-Hex Code-Hex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great! Thank you so much!

@Code-Hex Code-Hex merged commit 455ec08 into Code-Hex:main Feb 23, 2024
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants