You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@datafusion.apache.org by lu...@apache.org on 2026/09/16 14:33:56 UTC
(datafusion-sqlparser-rs) 01/01: Fuzz: Replace honggfuzz harness with cargo-fuzz
This is an automated email from the ASF dual-hosted git repository.
LucaCappelletti94 pushed a commit to branch cargo-fuzz-harness
in repository https://gitbox.apache.org/repos/asf/datafusion-sqlparser-rs.git
commit 009db9891c5cff35ce7c086468989e8161704d4c
Author: LucaCappelletti94 <ca...@gmail.com>
AuthorDate: Wed Sep 16 16:33:44 2026 +0200
Fuzz: Replace honggfuzz harness with cargo-fuzz
---
docs/fuzzing.md | 34 +++++++++----------------
fuzz/.gitignore | 6 ++---
fuzz/Cargo.toml | 10 ++++++--
fuzz/fuzz_targets/fuzz_parse_sql.rs | 49 +++++++++++++++++--------------------
4 files changed, 45 insertions(+), 54 deletions(-)
diff --git a/docs/fuzzing.md b/docs/fuzzing.md
index cc4ca4d7..7b1d9e8d 100644
--- a/docs/fuzzing.md
+++ b/docs/fuzzing.md
@@ -19,39 +19,27 @@
# Fuzzing
-## Installing `honggfuzz`
+The fuzz targets use [cargo-fuzz](https://github.com/rust-fuzz/cargo-fuzz) (libFuzzer) and need a nightly toolchain.
+```shell
+cargo install cargo-fuzz
```
-cargo install honggfuzz
-```
-
-Install [dependencies](https://github.com/rust-fuzz/honggfuzz-rs#dependencies) for your system.
-
-## Running the fuzzer
-
-Running the fuzzer is as easy as running in the `fuzz` directory.
-Choose a target:
-
-These are `[[bin]]` entries in `Cargo.toml`.
-List them with `cargo read-manifest | jq '.targets[].name'` from the `fuzz` directory.
-
-Run the fuzzer:
+Run a target from the `fuzz` directory:
```shell
cd fuzz
-cargo hfuzz run <target>
+cargo fuzz run fuzz_parse_sql -- -max_total_time=600
```
-After a panic is found, get a stack trace with:
+Targets live in `fuzz_targets/`. A run grows a coverage corpus under `corpus/<target>/`; pass existing corpora to widen from them, e.g. `cargo fuzz run fuzz_parse_sql corpus/fuzz_parse_sql`.
+
+Crashes are written to `artifacts/<target>/`. Reproduce with:
```shell
-cargo hfuzz run-debug <target> hfuzz_workspace/<target>/*.fuzz
+cargo fuzz run fuzz_parse_sql artifacts/fuzz_parse_sql/crash-<sha>
```
-For example, with the `fuzz_parse_sql` target:
+Minimize a crash with `cargo fuzz tmin fuzz_parse_sql <crash-file>`.
-```shell
-cargo hfuzz run fuzz_parse_sql
-cargo hfuzz run-debug fuzz_parse_sql hfuzz_workspace/fuzz_parse_sql/*.fuzz
-```
+Sanitizers are enabled by default (`-s address`, also `undefined`, `none`). See `cargo fuzz run --help` for the full option set.
diff --git a/fuzz/.gitignore b/fuzz/.gitignore
index 9c64849b..ec43de48 100644
--- a/fuzz/.gitignore
+++ b/fuzz/.gitignore
@@ -1,3 +1,3 @@
-corpus
-hfuzz_target
-hfuzz_workspace
+/artifacts
+/corpus
+/target
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
index c162854d..4ee8c504 100644
--- a/fuzz/Cargo.toml
+++ b/fuzz/Cargo.toml
@@ -18,11 +18,14 @@
[package]
name = "fuzz"
version = "0.1.0"
-edition = "2018"
+edition = "2021"
publish = false
+[package.metadata]
+cargo-fuzz = true
+
[dependencies]
-honggfuzz = "0.5.54"
+libfuzzer-sys = "0.4"
sqlparser = { path = ".." }
# Prevent this from interfering with workspaces
@@ -32,3 +35,6 @@ members = ["."]
[[bin]]
name = "fuzz_parse_sql"
path = "fuzz_targets/fuzz_parse_sql.rs"
+test = false
+doc = false
+bench = false
diff --git a/fuzz/fuzz_targets/fuzz_parse_sql.rs b/fuzz/fuzz_targets/fuzz_parse_sql.rs
index 15c198cb..89c84184 100644
--- a/fuzz/fuzz_targets/fuzz_parse_sql.rs
+++ b/fuzz/fuzz_targets/fuzz_parse_sql.rs
@@ -15,36 +15,33 @@
// specific language governing permissions and limitations
// under the License.
-use honggfuzz::fuzz;
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
use sqlparser::dialect::{
- AnsiDialect, BigQueryDialect, ClickHouseDialect, DatabricksDialect, DuckDbDialect,
+ AnsiDialect, BigQueryDialect, ClickHouseDialect, DatabricksDialect, Dialect, DuckDbDialect,
GenericDialect, HiveDialect, MsSqlDialect, MySqlDialect, OracleDialect, PostgreSqlDialect,
RedshiftSqlDialect, SQLiteDialect, SnowflakeDialect,
};
use sqlparser::parser::Parser;
-
-fn main() {
- let dialects: Vec<Box<dyn sqlparser::dialect::Dialect>> = vec![
- Box::new(AnsiDialect::default()),
- Box::new(BigQueryDialect::default()),
- Box::new(ClickHouseDialect::default()),
- Box::new(DatabricksDialect::default()),
- Box::new(DuckDbDialect::default()),
- Box::new(GenericDialect::default()),
- Box::new(HiveDialect::default()),
- Box::new(MsSqlDialect::default()),
- Box::new(MySqlDialect::default()),
- Box::new(OracleDialect::default()),
- Box::new(PostgreSqlDialect::default()),
- Box::new(RedshiftSqlDialect::default()),
- Box::new(SQLiteDialect::default()),
- Box::new(SnowflakeDialect::default()),
+fuzz_target!(|sql: &str| {
+ let dialects: [&dyn Dialect; 14] = [
+ &AnsiDialect {},
+ &BigQueryDialect {},
+ &ClickHouseDialect {},
+ &DatabricksDialect {},
+ &DuckDbDialect {},
+ &GenericDialect {},
+ &HiveDialect {},
+ &MsSqlDialect {},
+ &MySqlDialect {},
+ &OracleDialect {},
+ &PostgreSqlDialect {},
+ &RedshiftSqlDialect {},
+ &SQLiteDialect {},
+ &SnowflakeDialect {},
];
- loop {
- fuzz!(|data: String| {
- for dialect in &dialects {
- let _ = Parser::parse_sql(dialect.as_ref(), &data);
- }
- });
+ for dialect in dialects {
+ let _ = Parser::parse_sql(dialect, sql);
}
-}
+});
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@datafusion.apache.org
For additional commands, e-mail: commits-help@datafusion.apache.org