Document cargo-afl fuzzing support - #2815
Conversation
3031dac to
b05257e
Compare
github-actions
Bot
added
preview
There was a problem hiding this comment.
Pull request overview
Adds a step-by-step guide for fuzzing Soroban contracts with cargo-afl.
Changes:
- Documents installation, configuration, execution, and crash replay.
- Adds an AFL++ fuzz-target example and references.
Suppressed comments (5)
docs/build/guides/testing/fuzzing.mdx:148
- This dependency name does not match the package used by the linked increment example (
soroban-increment-contract). Cargo therefore looks for a package namedmy-contractat..and fails before compiling the target.
my-contract = { path = ".." }
docs/build/guides/testing/fuzzing.mdx:169
- An arbitrary
u64makes most executions effectively unbounded: the provided eight-byte seed decodes to a value in the quadrillions, so the very first execution spends its time in the loop and is classified as a timeout instead of exercising useful inputs. Bound the generated operation count to keep every fuzz iteration fast.
pub by: u64,
docs/build/guides/testing/fuzzing.mdx:184
lastis never updated, soSome(current) > Noneis true on every successful call and the stated monotonicity property is not actually tested. Save each successful value after asserting it.
Ok(Ok(current)) => assert!(Some(current) > last),
docs/build/guides/testing/fuzzing.mdx:218
- After AFL++ records more than one crash, this wildcard expands to multiple paths and the shell rejects the input redirection as ambiguous. Select and quote one concrete crash path before replaying it.
RUST_BACKTRACE=1 ./target/debug/fuzz_target_1 < out/default/crashes/id:000000*
docs/build/guides/testing/fuzzing.mdx:211
- This rationale is incorrect for
cargo-afl: its build wrapper explicitly passes both-C overflow_checksand-C debug-assertionsfor instrumented Cargo builds, including release builds. Avoid telling readers that release mode necessarily loses these checks.
Fuzz debug builds, at least at first: they keep integer overflow checks and `debug_assert!`s enabled, and those catch bugs a release build won't.
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
🤖 Automated message from Kaan's Automated Triage Bot. Verified the |
kaankacar
added
the
bot:ready-to-merge
|
@kaankacar I undid some of the changes because they added some information that wasn't critical, and I think they were distracting for a minimal tutorial. It looks like the changes were driven by Copilot feedback. Thanks for fixing the |
|
🤖 Automated message from Kaan's Automated Triage Bot. Re-checked at 7ee9244. Your trims kept every functional fix: the |
|
Hello @leighmcculloch , looks like the automated triage bot has picked up your PRs too :) This is a good feedback for the bot's judgement call, I'm fixing the bot in a way where it doesn't interfere with ongoing PRs(as long as a review is not requested). I do apologize on behalf of my bot if it has gotten annoying :) |
kaankacar
removed
the
bot:ready-to-merge
|
PR Preview: torn down |
What
Add a step-by-step guide for fuzzing Soroban contracts with
cargo-afl(AFL++) to the fuzzing guide, replacing the placeholder note that just pointed readers to the generic Rust Fuzz book.Why
We should demonstrate it as the fuzzing tools can be a bit overwhelming.