# Fuzz targets

Coverage-guided fuzzing of everything that reads input we do not control.
The property tests (`cargo test`, e.g. `crates/packet/tests/properties.rs`)
check the same things on generated input and run on every build; these
targets go further by letting libFuzzer follow code coverage for as long as
you leave them running.

| Target         | Input                                                            |
|----------------|------------------------------------------------------------------|
| `message`      | Raw bytes as they come off a TCP connection                      |
| `message_body` | A message body behind a correct header (reaches the body parsers) |
| `prefix_text`  | A prefix as text                                                 |
| `config`       | The configuration file                                           |

For the two message targets a finding is either a panic, or a message the
decoder accepted that cannot be written and read back as itself.

## Running

libFuzzer needs a nightly toolchain and `cargo-fuzz`:

```bash
rustup toolchain install nightly
cargo install cargo-fuzz
```

Then, from this directory:

```bash
cargo +nightly fuzz run message_body corpus/message_body seeds/message_body -- -max_total_time=300
```

The first directory is the working corpus, which the fuzzer adds to and
which is not checked in. `seeds/` holds a few valid inputs to start from.
Leave out `-max_total_time` to run until interrupted.

## When it finds something

The input is saved under `artifacts/<target>/`. Reproduce it with

```bash
cargo +nightly fuzz run message_body artifacts/message_body/crash-...
```

Fix the bug, and add a unit test with the input next to the code it broke,
so that `cargo test` keeps it fixed without anyone having to run the fuzzer.