wasm-smith

A WebAssembly test case generator.

• Features
• Usage
  • With cargo fuzz and libfuzzer-sys
  • As a Command Line Tool

Features

• Always valid: All generated Wasm modules pass validation. wasm-smith gets past your wasm parser and validator, exercising the guts of your Wasm compiler, runtime, or tool.

• Supports the full WebAssembly language: Doesn't have blind spots or unimplemented instructions.

• Implements the Arbitrary trait: Easy to use with cargo fuzz and libfuzzer-sys!

• Deterministic: Given the same input seed, always generates the same output Wasm module, so you can always reproduce test failures.

• Plays nice with mutation-based fuzzers: Small changes to the input tend to produce small changes to the output Wasm module. Larger inputs tend to generate larger Wasm modules.

Usage

With cargo fuzz and libfuzzer-sys

First, use cargo fuzz to define a new fuzz target:

shell $ cargo fuzz my_wasm_smith_fuzz_target

Next, add wasm-smith to your dependencies:

```toml

fuzz/Cargo.toml

[dependencies] wasm-smith = "0.1.0" ```

Then, define your fuzz target so that it takes arbitrary wasm_smith::Modules as an argument, convert the module into serialized Wasm bytes via the to_bytes method, and then feed it into your system:

```rust // fuzz/fuzztargets/mywasmsmithfuzz_target.rs

![no_main]

use libfuzzersys::fuzztarget; use wasm_smith::Module;

fuzztarget!(|module: Module| { let wasmbytes = module.to_bytes();

// Your code here...

}); ```

Finally, start fuzzing:

shell $ cargo fuzz run my_wasm_smith_fuzz_target

Note: Also check out the validate fuzz target defined in this repository. Using the wasmparser crate, it checks that every module generated by wasm-smith validates successfully.

As a Command Line Tool

Install the CLI tool via cargo:

shell $ cargo install --all-features wasm-smith

Convert some arbitrary input into a valid Wasm module:

shell $ head -c 100 /dev/urandom | wasm-smith -o test.wasm

Finally, run your tool on the generated Wasm module:

shell $ my-wasm-tool test.wasm