4 ms·
Somewhat contrary to what the other comments so far have said, I would say that this is definitely related to fuzzing. In fact, it is fuzzing, plain and simple,
by feanaro 9y ago
Somewhat contrary to what the other comments so far have said, I would say that this is definitely related to fuzzing. In fact, it is fuzzing, plain and simple, but unguided and of a more limited scope than what afl gets you.
afl is guided in the sense that it uses binary instrumentation and an evolutionary algorithm to guide testing towards increased program coverage. It also exercises the whole program instead of just a preselected set of functions. There's also libFuzzer, which like afl uses coverage to guide the fuzzing process, but fuzzes only preselected entry point functions. Finally, there are unguided fuzzers like radamsa which simply mutate a bunch of known inputs to produce new ones using techniques that have been empirically shown to lead to bugs often. This is probably the most similar to what Hypothesis does.
An important mention, with regards to the QuickCheck connection, is QuickFuzz, which uses QuickCheck as a test case generator for a variety of formats in QuickFuzz which then get mutated by general-purpose fuzzers like radamsa: http://quickfuzz.org/ http://quickfuzz.org/
Overall, I'd say the goals of fuzzers like afl/libFuzzer/radamsa are very similar to the goals of libraries like Hypothesis/Quickcheck, with the former group being a bit more security-oriented while the latter group's emphasis is a bit more on general program correctness. It should be obvious those two areas are very much overlapping, though.