Everything You Ever Wanted To Know About Test-Case Reduction, But Didn’t Know to Ask

Summary: Trail of Bits explains test-case reduction, the process of turning a large failing input into a smaller one that triggers the same behavior, and walks through DeepState's reducer shrinking a file-system corruption test from 16 steps to a reset at the fourth block write during creation of the file "aaaaa". The post notes that AFL and libFuzzer include limited built-in reduction, that the technique is also called minimization, shrinking, or delta-debugging, and that DeepState's reducer uses interleaved passes rather than Zeller's delta-debugging binary search.
Bottom line: The post states that the simpler the input, the easier it is to construct an exploit from a fuzzer-generated crash or to conclude a bug cannot be exploited, which puts reduction directly in the path between a crash and a working exploit.

Read the original at Trail of Bits Blog ↗