jperezduerto.info
Security in depth · Unit 21 · Lesson 5 of 6
Fuzzing explores input behavior
Interpret a clean test run using what the test actually exercised.
Helpful before thisMemory safety: boundaries and lifetimes
After this lesson you can
- Identify a coverage gap without treating a clean fuzzing run as proof of correctness.
One idea. One situation. One reasoned decision.
How it works
Fuzz testing automatically exercises many input variations to discover unexpected behavior in a controlled test environment. It needs useful input boundaries, instrumentation or observation, and a way to triage findings. A discovered crash is a lead for diagnosis, not a complete impact assessment. A long run with no findings also does not prove complete correctness or coverage of every meaningful state.
A clean result needs a coverage denominator
A fictional parser supports plain and compressed records. An isolated test report provides these observations; no test program or target access is needed.
| Record | Observation |
|---|---|
| F1 | 10,000 generated inputs; zero observed crashes |
| F2 | Every input used the plain-record entry point |
| F3 | The compressed-record decoder was never entered |
Worked decision: report no observed crashes for this plain-entry test run. Do not claim the compressed decoder was tested. Increasing the count through the same entry point would not, by itself, resolve F3.
The next test objective should explicitly cover the missing decoder and its documented valid and invalid states, with instrumentation showing which intended paths execute. Useful starting examples and a meaningful way to detect violations matter alongside volume. Coverage is evidence of exercised behavior, not a universal correctness certificate.
If a later report records a crash, preserve its test context and have the responsible team investigate the violated assumption. A repeated symptom can support diagnosis, but it does not alone identify the root cause or establish a specific security impact. Keep the coverage finding and any defect finding separate so both receive appropriate follow-up.
The key distinction: Testing explores defined cases and states, not every possibility.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which statement is supported by F1-F3?
Show the answer
Correct answer: No crashes were observed in this run; compressed decoding remains unassessed. This keeps the observed result attached to its actual scope and identifies the explicit coverage gap without inventing a defect.
Try it
- WriteWrite a revised test objective for the compressed-record path. Specify useful coverage evidence and distinguish a discovered crash from a confirmed cause or impact.