Golang standard library fuzzing

AlexeiSosnov · January 9, 2025, 2:51pm

Hello

I do not find any reference in documentation about standard library fuzzing. Is standard library (TLS, http server, etc.) itself fuzzed by Golang developers? Are there any publicly available fuzzing tests, reports or corpuses?

Dean_Davidson · January 9, 2025, 5:53pm

I’m not sure how widespread fuzzing in the stdlib is. There are some fuzz tests:

github.com

golang/go/blob/f5a89dff67ae00bfc70fbfccc1b1cc044e565b50/src/internal/fuzz/encoding_test.go#L324


      
          		if err != nil {
          			t.Fatal(err)
          		}
          		i2 := vs[0].(int8)
          		if i2 != i1 {
          			t.Fatalf("unmarshaled %v, want %v:\n%s", i2, i1, buf)
          		}
          	}
          }
          
          func FuzzFloat64RoundTrip(f *testing.F) {
          	f.Add(math.Float64bits(0))
          	f.Add(math.Float64bits(math.Copysign(0, -1)))
          	f.Add(math.Float64bits(math.MaxFloat64))
          	f.Add(math.Float64bits(math.SmallestNonzeroFloat64))
          	f.Add(math.Float64bits(math.NaN()))
          	f.Add(uint64(0x7FF0000000000001)) // signaling NaN
          	f.Add(math.Float64bits(math.Inf(1)))
          	f.Add(math.Float64bits(math.Inf(-1)))
          
          	f.Fuzz(func(t *testing.T, u1 uint64) {

But I’m not sure about public reports.