Finding bugs you didn't think to test for

8 pointsposted 11 hours ago
by wh33zle

2 Comments

mabliang

11 hours ago

Does coverage guidance actually help much here, or does most of the value come from having a good generator and reference model?

wh33zle

10 hours ago

Coverage is just the feedback loop. If you don't have a good generator, feedback that certain areas are uncovered doesn't really help. But without coverage, the generator doesn't really explore deeper states.

Under the hood, the fuzzer actually works with _features_, not source code coverage and there are ways in explicitly giving the fuzzer additional feedback. Some early data suggests that this is very effevtive.