Fuzz Testing

Also Known As

TL;DR

Explanation

Fuzzing sends unexpected input: very long strings, null bytes, Unicode edge cases, negative numbers where positive is expected, malformed JSON, and boundary-crossing values. Coverage-guided fuzzers (American Fuzzy Lop, libFuzzer) track which code paths are covered and generate inputs to explore uncovered paths. For PHP: Paraunit, php-fuzzer, or manual property-based testing with Eris. Fuzzing is essential for parsers, decoders, file processors, and any code accepting external input. It finds bugs that would take years of production traffic to surface naturally.

Common Misconception

Why It Matters

Common Mistakes

• Not running fuzz testing long enough — many bugs only appear after millions of iterations.
• Fuzzing without a corpus of valid inputs — fuzzers starting from valid inputs find more coverage faster.
• Not capturing minimised repro cases — fuzzers should shrink failing inputs to the minimal reproducing case.
• Fuzzing only the happy path inputs — the value of fuzzing is in the unexpected and malformed.

Code Examples

// Parser with no fuzz testing — crashes in production:
function parseCustomFormat(string $input): array {
    // Assumes: well-formed input, ASCII only, max 1000 chars
    // Production receives: 50KB Unicode string with null bytes
    // Result: Fatal error, memory exhaustion, or security bypass
    $parts = explode(':', $input);
    return ['key' => $parts[0], 'value' => $parts[1]]; // Undefined offset!
}

// Property-based fuzzing with Eris:
use Eris\Generator;

public function testParserHandlesArbitraryInput(): void {
    $this->forAll(
        Generator\string()  // Random strings of any content
    )->then(function(string $input) {
        // Should never throw or crash:
        $result = parseCustomFormat($input);
        $this->assertIsArray($result); // Must always return array
    });
}
// Runs hundreds of random inputs, shrinks failures to minimal case

References

• ↗ https://github.com/nikic/PHP-Fuzzer

Tags

Related Terms