@@ -32,9 +32,13 @@ impl From<()> for Corpus {
32
32
}
33
33
}
34
34
35
- impl From < Corpus > for i32 {
36
- fn from ( value : Corpus ) -> i32 {
37
- match value {
35
+ impl Corpus {
36
+ #[ doc( hidden) ]
37
+ /// Convert this Corpus result into the [integer codes used by
38
+ /// `libFuzzer`](https://llvm.org/docs/LibFuzzer.html#rejecting-unwanted-inputs).
39
+ /// This is -1 for reject, 0 for keep.
40
+ pub fn to_libfuzzer_code ( self ) -> i32 {
41
+ match self {
38
42
Corpus :: Keep => 0 ,
39
43
Corpus :: Reject => -1 ,
40
44
}
@@ -118,8 +122,17 @@ pub fn initialize(_argc: *const isize, _argv: *const *const *const u8) -> isize
118
122
///
119
123
/// ## Rejecting Inputs
120
124
///
121
- /// To indicate whether an input should be kept in or rejected from the corpus,
122
- /// return a [Corpus] value from your fuzz target. For example:
125
+ /// It may be desirable to reject some inputs, i.e. to not add them to the
126
+ /// corpus.
127
+ ///
128
+ /// For example, when fuzzing an API consisting of parsing and other logic,
129
+ /// one may want to allow only those inputs into the corpus that parse
130
+ /// successfully. To indicate whether an input should be kept in or rejected
131
+ /// from the corpus, return either [Corpus::Keep] or [Corpus::Reject] from your
132
+ /// fuzz target. The default behavior (e.g. if `()` is returned) is to keep the
133
+ /// input in the corpus.
134
+ ///
135
+ /// For example:
123
136
///
124
137
/// ```no_run
125
138
/// #![no_main]
@@ -134,7 +147,7 @@ pub fn initialize(_argc: *const isize, _argv: *const *const *const u8) -> isize
134
147
///
135
148
/// let key = parts[0];
136
149
/// let value = parts[1];
137
- /// my_crate::parse(key, value);
150
+ /// let _result: Result<_, _> = my_crate::parse(key, value);
138
151
/// Corpus::Keep
139
152
/// );
140
153
/// # mod my_crate { pub fn parse(_key: &str, _value: &str) -> Result<(), ()> { unimplemented!() } }
@@ -281,8 +294,8 @@ macro_rules! fuzz_target {
281
294
Err ( _) => return -1 ,
282
295
} ;
283
296
284
- let result: i32 = :: libfuzzer_sys:: Corpus :: from( run( data) ) . into ( ) ;
285
- result
297
+ let result = :: libfuzzer_sys:: Corpus :: from( run( data) ) ;
298
+ result. to_libfuzzer_code ( )
286
299
}
287
300
288
301
// See above for why this is split to a separate function.
0 commit comments