#2454·capstone

[Tests] Extend fuzzer

Author: Rot127Created Aug 22, 2024Updated Aug 4, 2026
LabelsenhancementTesting

The fuzzer could need some extensions. For example, it determines the mode and arch by comparing the strings of the enum identifiers CS_ARCH and CS_MODE. This makes it too maintenance heavy. And easy to forget to add new identifiers there.

It would be better to:

  • have it use the test_mapping.h file (from https://github.com/capstone-engine/capstone/pull/2456). To get the mode and arch values for fuzzing. Or something similar centralized.
  • Allow to track fuzzing coverage of the source code.
  • Consume the yaml test files for fuzzer input generation. Not the legacy MC/*.cs files. (see https://github.com/capstone-engine/capstone/pull/2456)
  • Remove dead code like travis.yaml
  • Use cmake build AND use it in the OSSFuzz build script (removing hard-coded paths)
  • Don't use the Python bindings to generate the corpus. It should simply parse the yaml files and get the binry info from somewhere else. Currently the fuzzer build step compiles Capstone multiple times.
  • LoongArch is not fuzzed
  • Missing modes or architectures are currently just ignored. But it should fail if this is the case.
  • THe fuzzer should also fuzz with ASAN and MSAN. Not just ASAN as it does currently.

cc @catenacyber Because you did most work on it in the past :)

Source: capstone-engine/capstone