[Numpy-discussion] Re: Fuzzing integration of Numpy into OSS-Fuzz

2022-07-02 Thread Ralf Gommers
On Mon, Jun 27, 2022 at 9:16 PM DavidKorczynski wrote: > Thanks for the detailed insights Zac! > Thanks indeed, this was very helpful. > Numpy maintainers, are you interested in trying out OSS-Fuzz? The only > thing needed is some maintainer email for receiving issues and then I > can get thin

[Numpy-discussion] Re: Fuzzing integration of Numpy into OSS-Fuzz

2022-06-27 Thread DavidKorczynski
Thanks for the detailed insights Zac! Numpy maintainers, are you interested in trying out OSS-Fuzz? The only thing needed is some maintainer email for receiving issues and then I can get things moving. On 10/06/2022 04:45, Zac Hatfield-Dodds wrote: As a maintainer of Hypothesis and sometime-fuz

[Numpy-discussion] Re: Fuzzing integration of Numpy into OSS-Fuzz

2022-06-09 Thread Zac Hatfield-Dodds
As a maintainer of Hypothesis and sometime-fuzzing-researcher, hopefully sharing my perspective might help. Firstly, fuzzing and property-based testing are clearly related fields! Personally I tend to divide them more by the UX than underlying tool: PBT tends to be quick (seconds), done by dev

[Numpy-discussion] Re: Fuzzing integration of Numpy into OSS-Fuzz

2022-06-09 Thread david korczynski
Coverage-guided fuzzing is fundamentally just a technique that iteratively generates input that explores more code relative to the possible execution space of the code targeted. What the fuzzer gives you to play with is a byte-array that you can massage in any way possible and pass it into the

[Numpy-discussion] Re: Fuzzing integration of Numpy into OSS-Fuzz

2022-06-08 Thread Aaron Meurer
I know the hypothesis developers consider Hypothesis to be different from fuzzing. But I've never been exactly clear just what is meant by "fuzzing" in the context you are suggesting. When you say you want to "fuzz NumPy" what sorts of things would the fuzzer be doing? Would you need to tell it wha

[Numpy-discussion] Re: Fuzzing integration of Numpy into OSS-Fuzz

2022-06-08 Thread david korczynski
I'm not 100% about the important differences, so this is a bit of an intuitive analysis from my side (I know little about Hypothesis and more about fuzzing). Hypothesis has support for traditional fuzzing [sic]: https://hypothesis.readthedocs.io/en/latest/details.html?highlight=fuzz#use-with-exte

[Numpy-discussion] Re: Fuzzing integration of Numpy into OSS-Fuzz

2022-06-07 Thread Matti Picus
On 7/6/22 14:02, david korczynski wrote: Hi Numpy maintainers, Would you be interested in integrating continuous fuzzing by way of OSS-Fuzz? Fuzzing is a way to automate test-case generation and has been heavily used for memory unsafe languages. Recently efforts have been put into fuzzing memor