Lets imagine we have a target node that is an integer type <pfx:target>10</pfx:target>
below are how each of the different fuzzing techniques would change this integer.
Note, for integers, the value used by the fuzzing technique can be specified in either base 10 or base 16 (Hexadecimal) formats. If specified in Hex the value must have a '0x' prefix and it will be treated as a positive number. Also, that if a value does not fit within the restrictions of the type e.g. too big, or negative, then it will be ignored e.g. if the type of a node is an unsignedShort then values greater than 65535 or negative values will be ignored. Replace integers Input
| Output
| Example State
| 0
| <pfx:target>0</pfx:target>
| pfx-target-0-ReplaceInteger-0
| 1
| <pfx:target>1</pfx:target>
| pfx-target-0-ReplaceInteger-1
| 2
| <pfx:target>2</pfx:target>
| pfx-target-0-ReplaceInteger-2
| 0xa
| <pfx:target>10</pfx:target>
| pfx-target-0-ReplaceInteger-3
| 20
| <pfx:target>20</pfx:target>
| pfx-target-0-ReplaceInteger-4
|
Replace with random integers Like Replace integers except the value is randomly generated. The randomly generated value will be an appropriate size for the target type e.g. 2 bytes for shorts and unsignedShorts, 4 bytes for ints and unsignedInts, etc. Add, Subtract, Multiply and Divide integers Input
| Output
| Example State
| 2 | <pfx:target>12</pfx:target>
| pfx-target-0-AddInteger-0
| 2 | <pfx:target>8</pfx:target>
| pfx-target-0-SubtractInteger-0
| 2 | <pfx:target>20</pfx:target> | pfx-target-0-MultiplyInteger-0
| 2 | <pfx:target>5</pfx:target>
| pfx-target-0-DivideInteger-0
|
The Add, Subtract, Multiply and Divide fuzzing techniques work as you would expect, there are some things to note though, overflows/wrapping can occur for all types, however internally the numbers are converted to either 64-bit signed or unsigned integers and the operation carried out and then converted back to their original types. This means that the overflow/wrapping occurs only for 64-bit numbers typically as usually converting back to the original type will fail if an overflow/wrap occurs.
|