feat(fuzz): fuzz deserialize better

The fuzzer will do a better job finding interesing inputs if we make the type of deserization a branch rather than always trying all types for every input.
RoaringBitmap · Sep 19, 2024 · 4bab7ec · 4bab7ec
1 parent 5c85403
commit 4bab7ec
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 5 deletions.
diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
diff --git a/fuzz/fuzz_targets/deserialize.rs b/fuzz/fuzz_targets/deserialize.rs
@@ -2,6 +2,7 @@
 
 use croaring::{Bitmap, Bitmap64, Native, Portable};
 use libfuzzer_sys::fuzz_target;
+use libfuzzer_sys::arbitrary::{self, Arbitrary};
 
 fn check_bitmap<D: croaring::bitmap::Deserializer>(input: &[u8]) {
     let bitmap = Bitmap::try_deserialize::<D>(input);
@@ -63,8 +64,18 @@ fn check_bitmap64<D: croaring::bitmap64::Deserializer>(input: &[u8]) {
     }
 }
 
-fuzz_target!(|input: &[u8]| {
-    check_bitmap::<Portable>(input);
-    check_bitmap::<Native>(input);
-    check_bitmap64::<Portable>(input);
+#[derive(Arbitrary, Debug)]
+enum BitmapType {
+    Portable32,
+    Native32,
+    Portable64,
+}
+
+fuzz_target!(|input: (BitmapType, &[u8])| {
+    let (ty, input) = input;
+    match ty {
+        BitmapType::Portable32 => check_bitmap::<Portable>(input),
+        BitmapType::Native32 => check_bitmap::<Native>(input),
+        BitmapType::Portable64 => check_bitmap64::<Portable>(input),
+    }
 });