| 1 |
# Seed corpora |
| 2 |
|
| 3 |
Hand-written starting inputs, one directory per fuzz target. These are |
| 4 |
committed; `corpus/` is not. |
| 5 |
|
| 6 |
The split follows `astra-soak-overview`, which calls a minimized corpus |
| 7 |
"accumulated compute, not a build artifact": |
| 8 |
|
| 9 |
- **These seeds are human intent.** Each names a shape of the grammar worth |
| 10 |
reaching in the first second rather than the first hour: each of the three |
| 11 |
verbs, each quoting style, and one file per class of thing that must be |
| 12 |
refused. They are reviewable in a diff and they do not churn. |
| 13 |
- **`corpus/` is machine output and lives on astra**, under the soak runner's |
| 14 |
persistent directory. Minimize with `cargo +nightly fuzz cmin command` and |
| 15 |
commit it once it represents real soak hours, not before. |
| 16 |
|
| 17 |
Run against these on a machine with no corpus: |
| 18 |
|
| 19 |
mkdir -p fuzz/corpus/command |
| 20 |
cargo +nightly fuzz run command fuzz/corpus/command fuzz/seeds/command |
| 21 |
|
| 22 |
The `mkdir` is needed once. `cargo fuzz` creates the default corpus directory |
| 23 |
for you only when you name no directories at all; pass them explicitly and |
| 24 |
libFuzzer requires every one to exist already. |
| 25 |
|
| 26 |
**Name the corpus directory first and this one second.** libFuzzer writes new |
| 27 |
inputs into whichever directory it is given first and treats the rest as |
| 28 |
read-only. Passing `fuzz/seeds/command` alone dumps hundreds of machine-generated |
| 29 |
files in here and buries the hand-written ones, which is exactly the split this |
| 30 |
directory exists to keep. |
| 31 |
|
| 32 |
## What the accept/reject seeds are for |
| 33 |
|
| 34 |
Roughly half of these are inputs the parser refuses, which is not wasted budget. |
| 35 |
The oracle only fires on an *accepted* request, so a rejected seed contributes |
| 36 |
coverage of the reject paths and, more usefully, sits one mutation away from an |
| 37 |
accepted one. `07-dotdot-before-suffix` and `15-quote-in-name` are the two worth |
| 38 |
knowing: the first is the shape a `.git` suffix strip can get wrong, and the |
| 39 |
second is the shape the round-trip oracle exists to catch. |
| 40 |
|
| 41 |
## Crash seeds |
| 42 |
|
| 43 |
An input that once found a bug stays here forever, and also becomes a file under |
| 44 |
`fuzz/regressions/`, which `tests/regressions.rs` replays on stable. None yet. |
| 45 |
|