qemu/docs/image-fuzzer.txt

6 # it under the terms of the GNU General Public License as published by
7 # the Free Software Foundation, either version 2 of the License, or
11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
15 # You should have received a copy of the GNU General Public License
25 The goal of the image fuzzer is to catch crashes of qemu-io/qemu-img
37 The test means execution of all available commands under test with the same
45 generator should be specified as a mandatory parameter of the test runner.
49 The runner activates generation of core dumps during test executions, but it
57 ``qemu-img`` is required for creation of backing files, so it's mandatory to set
61 The runner accepts a JSON array of fields expected to be fuzzed via the
70 The runner accepts a list of commands under test as a JSON array via
82 Values for last two aliases will be generated based on a size of a virtual
83 disk of the generated image.
102 a single public API. See details in 'Test runner/image fuzzer' chapter of
111 of bits are set to ones. All fuzzed values are checked on non-equality to the
112 current valid value of the field. In case of equality the value will be
115 'layout.py' creates a random valid image, fuzzes a random subset of the image
120     of fields of this element will be fuzzed every test.
144 the size of the virtual disk.
146 fuzz_config has a form of a list of lists. Every sublist can have one
147 or two elements: first element is a name of a parent image element, second one
148 if exists is a name of a field in this element.
189 10. Should accept a vector of actions as an argument (for test reproducing and
190     for test case specification, e.g. group of tests for header structure,
191     group of test for snapshots, etc)
192 11. Action vector should be randomly generated from the pool of available
194 12. Pool of actions should be defined automatically based on an image template
197     of all possible test commands can be available in the test runner
199 14. Should support an external cancellation of a test run
204 18. Usage of external libraries should be limited as much as possible.
210 Main target image format is qcow2, but support of image templates should
221 allows the fuzzer to generate the pool of all available areas can be fuzzed
222 and randomly select some of them and so compose its own action vector.
223 Also complexity of a template defines complexity of the fuzzer, so its
231 Action vector is a sequence of structure elements retrieved from an image
232 format, each of them will be fuzzed for the test image. It's a subset of
233 elements of the action pool. Example: header, refcount table, etc.
234 Action pool is all available elements of an image structure that generated
236 Image template is a formal description of an image structure and relations
238 Test image is an output image of the fuzzer defined by the current seed and