1[!fuzz-instrumented] skip
2[short] skip
3env GOCACHE=$WORK/cache
4
5# Test that fuzzing a target with a failure in f.Add prints the crash
6# and doesn't write anything to testdata/fuzz
7! go test -fuzz=FuzzWithAdd -run=FuzzWithAdd -fuzztime=1x
8! stdout ^ok
9! stdout 'Failing input written to testdata[/\\]fuzz[/\\]FuzzWithAdd[/\\]'
10stdout FAIL
11
12# Test that fuzzing a target with a success in f.Add and a fuzztime of only
13# 1 does not produce a crash.
14go test -fuzz=FuzzWithGoodAdd -run=FuzzWithGoodAdd -fuzztime=1x
15stdout ok
16! stdout FAIL
17
18# Test that fuzzing a target with a failure in testdata/fuzz prints the crash
19# and doesn't write anything to testdata/fuzz
20! go test -fuzz=FuzzWithTestdata -run=FuzzWithTestdata -fuzztime=1x
21! stdout ^ok
22! stdout 'Failing input written to testdata[/\\]fuzz[/\\]FuzzWithTestdata[/\\]'
23stdout 'failure while testing seed corpus entry: FuzzWithTestdata/1'
24stdout FAIL
25
26# Test that fuzzing a target with no seed corpus or cache finds a crash, prints
27# it, and write it to testdata
28! go test -fuzz=FuzzWithNoCache -run=FuzzWithNoCache -fuzztime=1x
29! stdout ^ok
30stdout 'Failing input written to testdata[/\\]fuzz[/\\]FuzzWithNoCache[/\\]'
31stdout FAIL
32
33# Write a crashing input to the cache
34mkdir $GOCACHE/fuzz/example.com/x/FuzzWithCache
35cp cache-file $GOCACHE/fuzz/example.com/x/FuzzWithCache/1
36
37# Test that fuzzing a target with a failure in the cache prints the crash
38# and writes this as a "new" crash to testdata/fuzz
39! go test -fuzz=FuzzWithCache -run=FuzzWithCache -fuzztime=1x
40! stdout ^ok
41stdout 'Failing input written to testdata[/\\]fuzz[/\\]FuzzWithCache[/\\]'
42stdout FAIL
43
44# Write a crashing input to the cache
45mkdir $GOCACHE/fuzz/example.com/x/FuzzWithMinimizableCache
46cp cache-file-bytes $GOCACHE/fuzz/example.com/x/FuzzWithMinimizableCache/1
47
48# Test that fuzzing a target with a failure in the cache minimizes it and writes
49# the new crash to testdata/fuzz
50! go test -fuzz=FuzzWithMinimizableCache -run=FuzzWithMinimizableCache -fuzztime=10000x
51! stdout ^ok
52stdout 'gathering baseline coverage'
53stdout 'got the minimum size!'
54stdout 'contains a non-zero byte of length 10'
55stdout 'Failing input written to testdata[/\\]fuzz[/\\]FuzzWithMinimizableCache[/\\]'
56stdout FAIL
57# Make sure this crash didn't come from fuzzing
58# (the log line that states fuzzing began shouldn't have printed)
59! stdout 'execs'
60
61# Clear the fuzz cache and make sure it's gone
62go clean -fuzzcache
63! exists $GOCACHE/fuzz
64
65# The tests below should operate the exact same as the previous tests. If -fuzz
66# is enabled, then whatever target is going to be fuzzed shouldn't be run by
67# anything other than the workers.
68
69# Test that fuzzing a target (with -run=None set) with a failure in f.Add prints
70# the crash and doesn't write anything to testdata/fuzz -fuzztime=1x
71! go test -fuzz=FuzzWithAdd -run=None
72! stdout ^ok
73! stdout 'Failing input written to testdata[/\\]fuzz[/\\]FuzzWithAdd[/\\]'
74stdout FAIL
75
76# Test that fuzzing a target (with -run=None set) with a success in f.Add and a
77# fuzztime of only 1 does not produce a crash.
78go test -fuzz=FuzzWithGoodAdd -run=None -fuzztime=1x
79stdout ok
80! stdout FAIL
81
82# Test that fuzzing a target (with -run=None set) with a failure in
83# testdata/fuzz prints the crash and doesn't write anything to testdata/fuzz
84! go test -fuzz=FuzzWithTestdata -run=None -fuzztime=1x
85! stdout ^ok
86! stdout 'Failing input written to testdata[/\\]fuzz[/\\]FuzzWithTestdata[/\\]'
87stdout FAIL
88
89# Write a crashing input to the cache
90mkdir $GOCACHE/fuzz/example.com/x/FuzzRunNoneWithCache
91cp cache-file $GOCACHE/fuzz/example.com/x/FuzzRunNoneWithCache/1
92
93# Test that fuzzing a target (with -run=None set) with a failure in the cache
94# prints the crash and writes this as a "new" crash to testdata/fuzz
95! go test -fuzz=FuzzRunNoneWithCache -run=None -fuzztime=1x
96! stdout ^ok
97stdout 'Failing input written to testdata[/\\]fuzz[/\\]FuzzRunNoneWithCache[/\\]'
98stdout FAIL
99
100# Clear the fuzz cache and make sure it's gone
101go clean -fuzzcache
102! exists $GOCACHE/fuzz
103
104# The tests below should operate the exact same way for the previous tests with
105# a seed corpus (namely, they should still fail). However, the binary is built
106# without instrumentation, so this should be a "testing only" run which executes
107# the seed corpus before attempting to fuzz.
108
109go test -c
110! exec ./x.test$GOEXE -test.fuzz=FuzzWithAdd -test.run=FuzzWithAdd -test.fuzztime=1x -test.fuzzcachedir=$WORK/cache
111! stdout ^ok
112! stdout 'Failing input written to testdata[/\\]fuzz[/\\]FuzzWithAdd[/\\]'
113stdout FAIL
114stderr warning
115
116go test -c
117! exec ./x.test$GOEXE -test.fuzz=FuzzWithTestdata -test.run=FuzzWithTestdata -test.fuzztime=1x -test.fuzzcachedir=$WORK/cache
118! stdout ^ok
119! stdout 'Failing input written to testdata[/\\]fuzz[/\\]FuzzWithTestdata[/\\]'
120stdout FAIL
121stderr warning
122
123-- go.mod --
124module example.com/x
125
126go 1.16
127-- x_test.go --
128package x
129
130import "testing"
131
132func FuzzWithAdd(f *testing.F) {
133 f.Add(10)
134 f.Fuzz(func(t *testing.T, i int) {
135 if i == 10 {
136 t.Error("bad thing here")
137 }
138 })
139}
140
141func FuzzWithGoodAdd(f *testing.F) {
142 f.Add(10)
143 f.Fuzz(func(t *testing.T, i int) {
144 if i != 10 {
145 t.Error("bad thing here")
146 }
147 })
148}
149
150func FuzzWithTestdata(f *testing.F) {
151 f.Fuzz(func(t *testing.T, i int) {
152 if i == 10 {
153 t.Error("bad thing here")
154 }
155 })
156}
157
158func FuzzWithNoCache(f *testing.F) {
159 f.Fuzz(func(t *testing.T, i int) {
160 t.Error("bad thing here")
161 })
162}
163
164func FuzzWithCache(f *testing.F) {
165 f.Fuzz(func(t *testing.T, i int) {
166 if i == 10 {
167 t.Error("bad thing here")
168 }
169 })
170}
171
172func FuzzWithMinimizableCache(f *testing.F) {
173 f.Fuzz(func(t *testing.T, b []byte) {
174 if len(b) < 10 {
175 return
176 }
177 for _, n := range b {
178 if n != 0 {
179 if len(b) == 10 {
180 t.Log("got the minimum size!")
181 }
182 t.Fatalf("contains a non-zero byte of length %d", len(b))
183 }
184 }
185 })
186}
187
188func FuzzRunNoneWithCache(f *testing.F) {
189 f.Fuzz(func(t *testing.T, i int) {
190 if i == 10 {
191 t.Error("bad thing here")
192 }
193 })
194}
195-- testdata/fuzz/FuzzWithTestdata/1 --
196go test fuzz v1
197int(10)
198-- cache-file --
199go test fuzz v1
200int(10)
201-- cache-file-bytes --
202go test fuzz v1
203[]byte("11111111111111111111")
View as plain text