1# Fuzzing 2 3## Test Case Generators and Oracles 4 5Test case generators and oracles live in the `wasmtime-fuzzing` crate, located 6in the `crates/fuzzing` directory. 7 8A *test case generator* takes raw, unstructured input from a fuzzer and 9translates that into a test case. This might involve interpreting the raw input 10as "DNA" or pre-determined choices through a decision tree and using it to 11generate an in-memory data structure, or it might be a no-op where we interpret 12the raw bytes as if they were Wasm. 13 14An *oracle* takes a test case and determines whether we have a bug. For example, 15one of the simplest oracles is to take a Wasm binary as an input test case, 16validate and instantiate it, and (implicitly) check that no assertions failed or 17segfaults happened. A more complicated oracle might compare the result of 18executing a Wasm file with and without optimizations enabled, and make sure that 19the two executions are observably identical. 20 21Our test case generators and oracles strive to be fuzzer-agnostic: they can be 22reused with libFuzzer or AFL or any other fuzzing engine or driver. 23 24## libFuzzer and `cargo fuzz` Fuzz Targets 25 26We combine a test case generator and one more oracles into a *fuzz 27target*. Because the target needs to pipe the raw input from a fuzzer into the 28test case generator, it is specific to a particular fuzzer. This is generally 29fine, since they're only a couple of lines of glue code. 30 31Currently, all of our fuzz targets are written for 32[libFuzzer](https://www.llvm.org/docs/LibFuzzer.html) and [`cargo 33fuzz`](https://rust-fuzz.github.io/book/cargo-fuzz.html). They are defined in 34the `fuzz` subdirectory. 35 36See 37[`fuzz/README.md`](https://github.com/bytecodealliance/wasmtime/blob/main/fuzz/README.md) 38for details on how to run these fuzz targets and set up a corpus of seed inputs. 39