How to generate dependent arbitrary inputs?

[Timmmm]

E.g. if I'm fuzzing an image encoding library, I want my input to be width & height (with some probability density function - so not a completely arbitrary usize - I don't want to fuzz terapixel images), and then a random array of pixels with the same size as width & height.

Is there a way to do that? I couldn't see much in the docs about this sort of thing.

[kpcyrd]

I understand the question as "I want to call a function:

fn example(height: usize, width: usize)

but with constraints for height and width".

There's a chapter about Structure-Aware Fuzzing, you'd then add any additional constraints as the first thing you do in your fuzz function:

fuzz_target!(|height: usize, width: usize| {
    if height > 10_000 { return }
    if width > 100_000 { return }

    // more of your code here
    // ...
}

You are essentially adding gates, inputs that have higher coverage are often considered "better" by the fuzzer so if you don't like a certain input you can "return early" to give it a lower score.

Only inputs that pass all your gates are going to get the fuzzer coverage score from the code you're trying to fuzz.

[Timmmm]

But won't that mean 99.99% of the time the function just returns, because the chances of getting an acceptably small width & height from a random usize are very low?

And what about the actual image data (just an array of u8 in my case)? If I add if data.len() != width * height { return; } then surely the chances of getting past the returns is infinitesimal?

I've used RapidCheck in the past and they recommend not gating like this for rare conditions and instead generating the right data directly in the function.

RapidCheck isn't coverage guided but is the coverage guiding really that smart? Surely it's better to help it in any case?

[fitzgen]

You will basically end up passing an Unstructured around to non-Arbitrary::arbitrary methods that have the context for the additional constraints you have that you couldn't pass through to Arbitrary implementations.

For example, wasm-smith implements arbitrary WebAssembly module generation:

• Arbitrary for Module creates a default config and calls Module::new(config, u):

  https://github.com/bytecodealliance/wasm-tools/blob/5068b3a840061bf90430ec1787635fe6a5dd2b5a/crates/wasm-smith/src/core.rs#L156-L160

• That goes through a couple helper functions to end up in the Module::build function, which is the main driver for generating the module:

  https://github.com/bytecodealliance/wasm-tools/blob/5068b3a840061bf90430ec1787635fe6a5dd2b5a/crates/wasm-smith/src/core.rs#L425

• Each of the methods in there will generate some part of the wasm module, and this depends on things that were generated (or not) earlier in the process. For example, you can only generate functions of function types that were previously declared.

  https://github.com/bytecodealliance/wasm-tools/blob/5068b3a840061bf90430ec1787635fe6a5dd2b5a/crates/wasm-smith/src/core.rs#L548-L561

  https://github.com/bytecodealliance/wasm-tools/blob/5068b3a840061bf90430ec1787635fe6a5dd2b5a/crates/wasm-smith/src/core.rs#L1527-L1542