rust-fuzz / arbitrary

Generating structured data from arbitrary, unstructured input.

Home Page:https://docs.rs/arbitrary/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Question: Are size hints still needed/used?

bhansconnect opened this issue · comments

I was looking over this library and noticed that all of the generic collection types are generated from iterators. Essentially, they decide how long the collection should by by repeatedly opting into the collection with new boolean true values. As such, they don't actually have a use for the size hint.

The only place that the size hint looks to be used is in arbitrary_len, which uses the size hint to try and ensure it has enough randomness to generate a collection. That said, the only collections that still use it are byte slices and strings. Both of those have a known size of the underlying type. Exactly 1 byte. So they should have no need for the size hint.

I totally could be missing something, but is the size hint unneeded now? I guess for recursive types, you need to ensure that they default to the base case when they run out of data, but size hints seem unnecessary still.

Is this a correct analysis?

The primary consumer of this method is the libfuzzer_sys::fuzz_target! macro: https://docs.rs/libfuzzer-sys/latest/src/libfuzzer_sys/lib.rs.html#262-270

Ah. I missed that use. Makes a lot of sense. If there isn't going to be enough data, just ignore the input.

Thanks.