2016-11-21 23:01:14 +00:00
|
|
|
# OSS-Fuzz Glossary
|
2016-11-21 22:29:12 +00:00
|
|
|
|
2016-11-21 23:16:58 +00:00
|
|
|
**WORK-IN-PROGRESS**
|
|
|
|
|
|
2016-11-21 22:55:05 +00:00
|
|
|
Naming things is hard.<BR>
|
|
|
|
|
This page tries to reduce confusion around fuzz-related terminology.
|
2016-11-21 22:29:12 +00:00
|
|
|
|
2016-11-21 22:49:57 +00:00
|
|
|
## Fuzz Target
|
2016-11-22 00:30:10 +00:00
|
|
|
Or **Target Function** or **Fuzzing Target Function**, or **Fuzzing Entry Point**.<BR>
|
2016-11-21 22:37:27 +00:00
|
|
|
A function to which we apply fuzzing.
|
2016-11-21 22:56:05 +00:00
|
|
|
A [specific signature](http://libfuzzer.info#fuzz-target) must be used for OSS-Fuzz.
|
2016-11-21 22:37:27 +00:00
|
|
|
Examples: [openssl](https://github.com/openssl/openssl/blob/master/fuzz/x509.c),
|
|
|
|
|
[SQLite](https://www.sqlite.org/src/artifact/ad79e867fb504338),
|
2016-11-21 22:50:42 +00:00
|
|
|
[re2](https://github.com/google/re2/blob/master/re2/fuzzing/re2_fuzzer.cc).
|
|
|
|
|
|
2016-11-21 22:37:27 +00:00
|
|
|
A Fuzz Target can and should also be used for regression testing
|
|
|
|
|
and for reproducing bug reports, see [ideal integration](ideal_integration.md).
|
2016-11-21 22:29:58 +00:00
|
|
|
|
2016-11-22 02:21:09 +00:00
|
|
|
## Library Config
|
2016-11-21 23:16:58 +00:00
|
|
|
???Any better name???
|
|
|
|
|
|
|
|
|
|
OSS-Fuzz-specific term. <BR>
|
|
|
|
|
OSS-Fuzz applies fuzzing to [Fuzz Targets](#fuzz-target)
|
|
|
|
|
that test APIs of some specific opensource library
|
|
|
|
|
(or sometimes, internal functions of some application).
|
|
|
|
|
One library may have more than one Fuzz Target
|
|
|
|
|
(example: [openssl](https://github.com/openssl/openssl/blob/master/fuzz/)),
|
|
|
|
|
but OSS-Fuzz will have a single set of configuration files for such library.
|
2016-11-22 02:21:09 +00:00
|
|
|
This is what we call **Library Config**.
|
2016-11-21 23:16:58 +00:00
|
|
|
|
2016-11-21 22:49:57 +00:00
|
|
|
## Fuzzing Engine
|
|
|
|
|
|
2016-11-22 00:29:42 +00:00
|
|
|
A tool that tries to find interesting inputs for a Fuzz Target by executing it.
|
2016-11-21 22:49:57 +00:00
|
|
|
Examples: [libFuzzer](http://lbfuzzer.info),
|
|
|
|
|
[AFL](lcamtuf.coredump.cx/afl/),
|
|
|
|
|
[honggfuzz](https://github.com/google/honggfuzz), etc
|
|
|
|
|
|
2016-11-21 22:58:26 +00:00
|
|
|
See also [Mutation Engine](#mutation-engine) and [Test Generator](#test-generator).
|
2016-11-21 22:49:57 +00:00
|
|
|
|
2016-11-22 02:07:12 +00:00
|
|
|
## Job type
|
2016-11-22 00:29:42 +00:00
|
|
|
|
2016-11-22 02:21:09 +00:00
|
|
|
A [ClusterFuzz](clusterfuzz.md) specific term.
|
|
|
|
|
This refers to a build of all fuzz targets for a given library
|
|
|
|
|
(see [library config](library-config)) with a specific [fuzzing engine](#fuzzing-engine),
|
2016-11-22 00:29:42 +00:00
|
|
|
in a specific build mode (e.g. with enabled or disabled assertions),
|
|
|
|
|
optionally combined with a [sanitizer](#sanitizer).
|
|
|
|
|
|
2016-11-22 02:10:00 +00:00
|
|
|
For example, we have a "libfuzzer_asan_sqlite" job type, indicating a build of all sqlite3 fuzz target using libFuzzer and ASan.
|
2016-11-22 02:08:18 +00:00
|
|
|
|
2016-11-21 22:49:57 +00:00
|
|
|
## Test Input
|
|
|
|
|
A sequence of bytes that is used as the input to a Fuzz Target.
|
2016-11-21 22:54:13 +00:00
|
|
|
Typicaly, a test input is stored in a separate file.
|
|
|
|
|
|
2016-11-21 23:00:26 +00:00
|
|
|
## Reproducer
|
|
|
|
|
Or a **testcase**.<BR>
|
|
|
|
|
A [Test Input](#test-input) that causes a specific bug to reproduce.
|
|
|
|
|
|
2016-11-21 22:54:13 +00:00
|
|
|
## Corpus
|
|
|
|
|
Or **test corpus**, or **fuzzing corpus**.
|
|
|
|
|
A set of [test inputs](#test-input).
|
2016-11-21 22:49:57 +00:00
|
|
|
|
|
|
|
|
## Mutation Engine
|
|
|
|
|
A tool that take a set of testcases
|
|
|
|
|
and creates their mutations, but do not directly feed the mutations to Fuzz Targets.
|
2016-11-21 22:54:13 +00:00
|
|
|
Example: [Radamsa](https://github.com/aoh/radamsa),
|
2016-11-21 22:49:57 +00:00
|
|
|
|
|
|
|
|
## Test Generator
|
2016-11-21 22:54:13 +00:00
|
|
|
A tool that generates testcases according to some rules or grammar.
|
|
|
|
|
Example: [csmith](https://embed.cs.utah.edu/csmith/) (a test generator for the C language).
|
2016-11-21 22:49:57 +00:00
|
|
|
|
2016-11-22 00:29:42 +00:00
|
|
|
## Sanitizer
|
|
|
|
|
A dynamic testing tool that can detect bugs during program execution.
|
|
|
|
|
An incomplete list:
|
|
|
|
|
[ASan](http://clang.llvm.org/docs/AddressSanitizer.html),
|
|
|
|
|
[MSan](http://clang.llvm.org/docs/MemorySanitizer.html),
|
|
|
|
|
[TSan](http://clang.llvm.org/docs/ThreadSanitizer.html),
|
|
|
|
|
[LSan](http://clang.llvm.org/docs/LeakSanitizer.html),
|
|
|
|
|
[UBSan](http://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html).
|
|
|
|
|
|
2016-11-21 22:49:57 +00:00
|
|
|
## Fuzzer
|
|
|
|
|
|
|
|
|
|
The most overloaded term, which makes it bad (maybe, we should try avoiding it?).
|
2016-11-22 00:33:18 +00:00
|
|
|
Sometimes the "Fuzzer" is referred to a [fuzz target](#fuzz-target),
|
|
|
|
|
sometimes to a [fuzzing engine](#fuzzing-engine),
|
|
|
|
|
[mutation engine](#mutation-engine),
|
|
|
|
|
or a [test generator](#test-generator).
|
|
|
|
|
sometimes to a [fuzzer build](#fuzzer-build).
|
2016-11-21 22:49:57 +00:00
|
|
|
|
