Skip to content

cranelift-assembler-x64: add Intel XED as a fuzzer disassembler oracle #13915

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jlb6740 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

cranelift-assembler-x64: add Intel XED as a fuzzer disassembler oracle #13915

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 39 additions & 22 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,6 +409,7 @@ clap = { version = "4.5.48", default-features = false, features = ["std", "deriv
clap_complete = "4.5.58"
hashbrown = { version = "0.17", default-features = false }
capstone = { version = "0.14.0", default-features = false, features = ['full', 'arch_x86', 'arch_riscv', 'arch_arm64', 'arch_sysz'] }
xed-sys = { version = "0.6" }
smallvec = { version = "1.15.1", features = ["union"] }
tracing = { version = "0.1.41", default-features = false }
bitflags = "2.9.4"
Expand Down
6 changes: 6 additions & 0 deletions cranelift/assembler-x64/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ rust-version.workspace = true
[dependencies]
arbitrary = { workspace = true, features = ["derive"], optional = true }
capstone = { workspace = true, optional = true }
xed-sys = { workspace = true, optional = true }

[dev-dependencies]
arbitrary = { workspace = true, features = ["derive"] }
Expand All @@ -23,3 +24,8 @@ workspace = true

[features]
fuzz = ['dep:arbitrary', 'dep:capstone']
# Adds Intel XED as a second, optional disassembler oracle for the roundtrip
# fuzzer. This is additive on top of `fuzz` (Capstone remains the default
# oracle); XED is only built when this feature is explicitly enabled. Note that
# building XED requires Python 3.9+ and a C compiler.
fuzz-xed = ['fuzz', 'dep:xed-sys']
12 changes: 12 additions & 0 deletions cranelift/assembler-x64/fuzz/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,21 @@ cargo-fuzz = true
libfuzzer-sys = { workspace = true }
cranelift-assembler-x64 = { path = "..", features = ['fuzz'] }

[features]
# Enable the Intel XED disassembler oracle for the `roundtrip-xed` target.
# This builds XED from source, so it requires a C compiler and Python.
fuzz-xed = ["cranelift-assembler-x64/fuzz-xed"]

[[bin]]
name = "roundtrip"
path = "fuzz_targets/roundtrip.rs"
test = false
doc = false
bench = false

[[bin]]
name = "roundtrip-xed"
path = "fuzz_targets/roundtrip-xed.rs"
test = false
doc = false
bench = false
16 changes: 16 additions & 0 deletions cranelift/assembler-x64/fuzz/fuzz_targets/roundtrip-xed.rs
View file
Open in desktop

@alexcrichton alexcrichton Jul 22, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In addition to the testing-on-CI concern, could this get folded into the misc fuzzer instead of making a new fuzzer?

@jlb6740 jlb6740 Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In addition to the testing-on-CI concern, could this get folded into the misc fuzzer instead of making a new fuzzer?

Hi @alexcrichton, yes will do. I will also add CI support and eventually support in oss-fuzz once it's been vetted here for a period of time.

Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
#![no_main]

use cranelift_assembler_x64::{Inst, fuzz};
use libfuzzer_sys::fuzz_target;

// This target drives the Intel XED disassembler oracle instead of Capstone.
// XED understands newer encodings (e.g. APX) that the bundled Capstone does
// not. Building XED from source is only done when the `fuzz-xed` feature is
// enabled; without it this target is a no-op so the default fuzz build does
// not require a C compiler and Python.
fuzz_target!(|inst: Inst<fuzz::FuzzRegs>| {
#[cfg(feature = "fuzz-xed")]
fuzz::roundtrip_xed(&inst);
#[cfg(not(feature = "fuzz-xed"))]
let _ = inst;
});
Loading
Loading