commit 38e2d6c75d65d770d518286e0f4abd7914719dfa from: Sergey Bronnikov date: Tue Apr 04 18:53:54 2023 UTC Updated Glossary (markdown) commit - 49a1e1f275125808dc5dc82b692b92f50e715708 commit + 38e2d6c75d65d770d518286e0f4abd7914719dfa blob - 68d6b02ff1c0567b69b990bce58a3de6f2f0f351 blob + a73f8a69a7a6d1ae510bd8dffc664126750e07d3 --- Glossary.md +++ Glossary.md @@ -10,7 +10,7 @@ Coverage: Some information about the behavior of the target when it executes a given input. Coverage is usually represented as the feature set that the input has triggered in the target. -Corpus: (also **test corpus**, or **fuzzing corpus**) (*plural*: corpora) A set of [test inputs](#test-input). In most contexts, it refers to a set of minimal test inputs that generate maximal code coverage. +Corpus: (also **test corpus**, or **fuzzing corpus**) (*plural*: corpora) A set of [test inputs](#Test_Input). In most contexts, it refers to a set of minimal test inputs that generate maximal code coverage. Cross-pollination: The term is taken from botany, where one plant pollinates a plant of another variety. In fuzzing, cross-pollination means using a corpus for one [fuzz target](#Fuzz_target) to expand a [corpus](#corpus) for another fuzz target. For example, if there are two libraries that process the same common data format, it is often beneficial to cross-pollinate their respective corpora. @@ -18,13 +18,13 @@ Distillation (creating a distilled corpus): A process of choosing a subset of a larger corpus, such that the subset has the same coverage features as the original corpus. -Dictionary: A file which specifies interesting tokens for a [fuzz target](#Fuzz_target). Most [fuzzing engines](#fuzzing-engine) support dictionaries, and will adjust their mutation strategies to process these tokens together. +Dictionary: A file which specifies interesting tokens for a [fuzz target](#Fuzz_target). Most [fuzzing engines](#fuzzing_engine) support dictionaries, and will adjust their mutation strategies to process these tokens together. ### F Fuzz Target (also **Target Function**, or **Fuzzing Target Function**, or **Fuzzing Entry Point**): A binary, a library, an API, or rather anything that can consume bytes for input and produce some sort of coverage data as an output. See the [libFuzzer documentation](https://llvm.org/docs/LibFuzzer.html#fuzz-target) for a more detailed explanation. A fuzz target is typically given the array of bytes by [libFuzzer](https://llvm.org/docs/LibFuzzer.html) or [AFL](http://lcamtuf.coredump.cx/afl/) for coverage guided fuzzing. Read more about good fuzzing target [here](https://github.com/google/fuzzing/blob/master/docs/good-fuzz-target.md). -Fuzzer: The most overloaded term and used in a variety of contexts, which makes it bad. Sometimes, "Fuzzer" is referred to a [fuzz target](#Fuzz_target), a [fuzzing engine](#fuzzing-engine), a [mutation engine](#mutation-engine), a [test generator](#test-generator) or +Fuzzer: The most overloaded term and used in a variety of contexts, which makes it bad. Sometimes, "Fuzzer" is referred to a [fuzz target](#Fuzz_target), a [fuzzing engine](#fuzzing_engine), a [mutation engine](#mutation-engine), a [test generator](#test-generator) or a [fuzzer build](#fuzzer-build). Fuzz Input: A sequence of bytes that can be fed to a target. The input can be an arbitrary bag of bytes, or some structured data, e.g. serialized proto. @@ -35,7 +35,7 @@ a [fuzzer build](#fuzzer-build). Fuzzer Build: A build that contains all the fuzz targets for a given project, which is run with a specific fuzzing engine, in a specific build mode (e.g. with enabled/disabled assertions), and optionally combined with a sanitizer. In [OSS-Fuzz](https://google.github.io/oss-fuzz/), it is also known as a [job type](https://google.github.io/oss-fuzz/reference/glossary/#job-type). -Fuzzing Engine: A program that produces an infinite stream of inputs for a [fuzz target](#Fuzz_target) and orchestrates the execution. Examples: [libFuzzer](http://libfuzzer.info), [AFL](lcamtuf.coredump.cx/afl/), [honggfuzz](https://github.com/google/honggfuzz), etc. See related terms [Mutation Engine](#mutation-engine) and [Test Generator](#test-generator). +Fuzzing Engine: A program that produces an infinite stream of inputs for a [fuzz target](#Fuzz_target) and orchestrates the execution. Examples: [libFuzzer](http://libfuzzer.info), [AFL](lcamtuf.coredump.cx/afl/), [honggfuzz](https://github.com/google/honggfuzz), etc. See related terms [Mutation Engine](#mutation_engine) and [Test Generator](#test_generator). ### M @@ -49,7 +49,7 @@ a [fuzzer build](#fuzzer-build). Reliability of reproduction: A crash is reliably reproducible if the target program consistently crashes with the same [crash state](https://google.github.io/clusterfuzz/reference/glossary/#crash-state) for the given input. -Reproducer: (also **Test Case**): A [test input](#test-input) that can be used to reproduce a bug when processed by a fuzz target. +Reproducer: (also **Test Case**): A [test input](#Test_Input) that can be used to reproduce a bug when processed by a fuzz target. ### S