moodmosaic

Wrap-Up: An Input Coverage Playbook

This post is part of the Input Coverage > Code Coverage series.

  1. Start with property tests. Prove the obvious.
  2. Add libFuzzer on raw bytes. Hunt the non-obvious.
  3. Add AFL++ for stdin and CLI and process-level issues.
  4. One entry point. One Makefile. Short runs by default.
  5. Turn crashes into tests. Keep them forever.
  6. Cap resource use. Bound lengths and counts.
  7. Mock I/O. Keep the hot path fast.
  8. Keep corpora small and clean.
  9. Only increase complexity when it pays off.

Less ceremony. More input coverage. Fewer surprises.