22 unstable releases (3 breaking)

0.4.4 Apr 1, 2021
0.4.3 Mar 31, 2021
0.4.0 Feb 25, 2021
0.3.0 Dec 14, 2020
0.1.11 Nov 23, 2020

#6 in WebAssembly

Download history 1416/week @ 2021-01-11 1197/week @ 2021-01-18 2073/week @ 2021-01-25 1976/week @ 2021-02-01 823/week @ 2021-02-08 1520/week @ 2021-02-15 1062/week @ 2021-02-22 1613/week @ 2021-03-01 1456/week @ 2021-03-08 1429/week @ 2021-03-15 1761/week @ 2021-03-22 1017/week @ 2021-03-29 1134/week @ 2021-04-05 1262/week @ 2021-04-12 650/week @ 2021-04-19 655/week @ 2021-04-26

6,427 downloads per month

Apache-2.0 WITH LLVM-exception

445KB
7.5K SLoC

wasm-smith

A WebAssembly test case generator.

Rust

Features

  • Always valid: All generated Wasm modules pass validation. wasm-smith gets past your wasm parser and validator, exercising the guts of your Wasm compiler, runtime, or tool.

  • Supports the full WebAssembly language: Doesn't have blind spots or unimplemented instructions.

  • Implements the Arbitrary trait: Easy to use with cargo fuzz and libfuzzer-sys!

  • Deterministic: Given the same input seed, always generates the same output Wasm module, so you can always reproduce test failures.

  • Plays nice with mutation-based fuzzers: Small changes to the input tend to produce small changes to the output Wasm module. Larger inputs tend to generate larger Wasm modules.

Usage

With cargo fuzz and libfuzzer-sys

First, use cargo fuzz to define a new fuzz target:

$ cargo fuzz add my_wasm_smith_fuzz_target

Next, add wasm-smith to your dependencies:

# fuzz/Cargo.toml

[dependencies]
wasm-smith = "0.4.0"

Then, define your fuzz target so that it takes arbitrary wasm_smith::Modules as an argument, convert the module into serialized Wasm bytes via the to_bytes method, and then feed it into your system:

// fuzz/fuzz_targets/my_wasm_smith_fuzz_target.rs

#![no_main]

use libfuzzer_sys::fuzz_target;
use wasm_smith::Module;

fuzz_target!(|module: Module| {
    let wasm_bytes = module.to_bytes();

    // Your code here...
});

Finally, start fuzzing:

$ cargo fuzz run my_wasm_smith_fuzz_target

Note: Also check out the validate fuzz target defined in this repository. Using the wasmparser crate, it checks that every module generated by wasm-smith validates successfully.

As a Command Line Tool

Install the CLI tool via cargo:

$ cargo install --all-features wasm-smith

Convert some arbitrary input into a valid Wasm module:

$ head -c 100 /dev/urandom | wasm-smith -o test.wasm

Finally, run your tool on the generated Wasm module:

$ my-wasm-tool test.wasm

Dependencies

~0.9–1.6MB
~34K SLoC