corpus

Documentation

Index

• type Corpus
  • func NewCorpus(corpusDirectory string) (*Corpus, error)
  • func (c *Corpus) ActiveMutableSequenceCount() int
  • func (c *Corpus) AddTestResultCallSequence(callSequence calls.CallSequence, mutationChooserWeight *big.Int, ...) error
  • func (c *Corpus) CallSequenceEntryCount() (int, int)
  • func (c *Corpus) CheckSequenceCoverageAndUpdate(callSequence calls.CallSequence, mutationChooserWeight *big.Int, ...) error
  • func (c *Corpus) CoverageMaps() *coverage.CoverageMaps
  • func (c *Corpus) Flush() error
  • func (c *Corpus) Initialize(baseTestChain *chain.TestChain, contractDefinitions contracts.Contracts) (int, int, error)
  • func (c *Corpus) RandomMutationTargetSequence() (calls.CallSequence, error)
  • func (c *Corpus) UnexecutedCallSequence() *calls.CallSequence

Types

type Corpus

type Corpus struct {
	// contains filtered or unexported fields
}

Corpus describes an archive of fuzzer-generated artifacts used to further fuzzing efforts. These artifacts are reusable across fuzzer runs. Changes to the fuzzer/chain configuration or definitions within smart contracts may create incompatibilities with corpus items.

func NewCorpus

func NewCorpus(corpusDirectory string) (*Corpus, error)

NewCorpus initializes a new Corpus object, reading artifacts from the provided directory. If the directory refers to an empty path, artifacts will not be persistently stored.

func (*Corpus) ActiveMutableSequenceCount

func (c *Corpus) ActiveMutableSequenceCount() int

ActiveMutableSequenceCount returns the count of call sequences recorded in the corpus which have been validated after Corpus initialization and are ready for use in mutations.

func (*Corpus) AddTestResultCallSequence

func (c *Corpus) AddTestResultCallSequence(callSequence calls.CallSequence, mutationChooserWeight *big.Int, flushImmediately bool) error

AddTestResultCallSequence adds a call sequence recorded to the corpus due to a test case provider flagging it to be recorded. Returns an error, if one occurs.

func (*Corpus) CallSequenceEntryCount

func (c *Corpus) CallSequenceEntryCount() (int, int)

CallSequenceEntryCount returns the total number of call sequences that increased coverage and also any test results that led to a failure.

func (*Corpus) CheckSequenceCoverageAndUpdate

func (c *Corpus) CheckSequenceCoverageAndUpdate(callSequence calls.CallSequence, mutationChooserWeight *big.Int, flushImmediately bool) error

CheckSequenceCoverageAndUpdate checks if the most recent call executed in the provided call sequence achieved coverage the Corpus did not with any of its call sequences. If it did, the call sequence is added to the corpus and the Corpus coverage maps are updated accordingly. Returns an error if one occurs.

func (*Corpus) CoverageMaps

func (c *Corpus) CoverageMaps() *coverage.CoverageMaps

CoverageMaps exposes coverage details for all call sequences known to the corpus.

func (*Corpus) Flush

func (c *Corpus) Flush() error

Flush writes corpus changes to disk. Returns an error if one occurs.

func (*Corpus) Initialize

func (c *Corpus) Initialize(baseTestChain *chain.TestChain, contractDefinitions contracts.Contracts) (int, int, error)

Initialize initializes any runtime data needed for a Corpus on startup. Call sequences are replayed on the post-setup (deployment) test chain to calculate coverage, while resolving references to compiled contracts. Returns the active number of corpus items, total number of corpus items, or an error if one occurred. If an error is returned, then the corpus counts returned will always be zero.

func (*Corpus) RandomMutationTargetSequence

func (c *Corpus) RandomMutationTargetSequence() (calls.CallSequence, error)

RandomMutationTargetSequence returns a weighted random call sequence from the Corpus, or an error if one occurs.

func (*Corpus) UnexecutedCallSequence

func (c *Corpus) UnexecutedCallSequence() *calls.CallSequence

UnexecutedCallSequence returns a call sequence loaded from disk which has not yet been returned by this method. It is intended to be used by the fuzzer to run all un-executed call sequences (without mutations) to check for test failures. If a call sequence is returned, it will not be returned by this method again. Returns a call sequence loaded from disk which has not yet been executed, to check for test failures. If all sequences in the corpus have been executed, this will return nil.