{"id":15642138,"url":"https://github.com/langston-barrett/tree-crasher","last_synced_at":"2025-04-13T02:25:29.104Z","repository":{"id":143570771,"uuid":"616071631","full_name":"langston-barrett/tree-crasher","owner":"langston-barrett","description":"Easy-to-use grammar-based black-box fuzzer. Has found dozens of bugs in important targets like Clang, Deno, and rustc.","archived":false,"fork":false,"pushed_at":"2025-04-01T15:26:37.000Z","size":1205,"stargazers_count":68,"open_issues_count":6,"forks_count":9,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-04-04T04:47:59.159Z","etag":null,"topics":["black-box-testing","fuzzer","fuzzing","grammar-based","grammar-based-fuzzing"],"latest_commit_sha":null,"homepage":"https://langston-barrett.github.io/tree-crasher/","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/langston-barrett.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-03-19T14:33:10.000Z","updated_at":"2025-04-01T15:26:40.000Z","dependencies_parsed_at":"2024-02-21T22:29:10.682Z","dependency_job_id":"5ddafbc6-4ae0-4f01-97f7-01536e75a46d","html_url":"https://github.com/langston-barrett/tree-crasher","commit_stats":{"total_commits":98,"total_committers":6,"mean_commits":"16.333333333333332","dds":0.3979591836734694,"last_synced_commit":"0979122ad5ea9ae61019effb18c5d8da80906953"},"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/langston-barrett%2Ftree-crasher","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/langston-barrett%2Ftree-crasher/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/langston-barrett%2Ftree-crasher/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/langston-barrett%2Ftree-crasher/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/langston-barrett","download_url":"https://codeload.github.com/langston-barrett/tree-crasher/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248655303,"owners_count":21140466,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["black-box-testing","fuzzer","fuzzing","grammar-based","grammar-based-fuzzing"],"created_at":"2024-10-03T11:54:49.886Z","updated_at":"2025-04-13T02:25:29.070Z","avatar_url":"https://github.com/langston-barrett.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# tree-crasher\n\ntree-crasher is an easy-to-use grammar-based black-box fuzzer. It parses a\nnumber of input files using [tree-sitter][tree-sitter] grammars, and produces\nnew files formed by splicing together their ASTs.\n\ntree-crasher aims to occupy a different niche from more advanced grammar-based \nfuzzers like Gramatron, Nautilus, and Grammarinator. Rather than achieve\nmaximal coverage and bug-finding through complete, hand-written grammars and\ncomplex techniques like coverage-based feedback, tree-crasher aims to achieve\nmaximal ease-of-use by using off-the-shelf tree-sitter grammars and not\nrequiring any instrumentation (nor even source code) for the target. In short,\ntree-crasher wants to be the [Radamsa][radamsa] of grammar-based fuzzing.\n\ntree-crasher uses [treereduce][treereduce] to automatically minimize generated\ntest-cases.\n\nFor more information, see [the documentation][doc].\n\n## Examples\n\nWhen reading these examples, keep in mind that fuzzing can cause unpredictable\nbehaviors. Always fuzz in a VM or Docker container with a memory limit, no\nnetwork access, and no important files.\n\n### JavaScript interpreters\n\nObtain a collection of JavaScript files and put them in `corpus/` (for\nexample, using [this script](./scripts/corpora/js.sh)). Then here's how to fuzz\n[JerryScript][jerryscript] and [Boa][boa]:\n\n```sh\ntree-crasher-javascript corpus/ jerry\ntree-crasher-javascript corpus/ boa\n```\n\n(By default, tree-crasher passes input to the target on stdin.)\n\n[boa]: https://github.com/boa-dev/boa\n[jerryscript]: https://github.com/jerryscript-project/jerryscript\n\n### Python's regex engine\n\nWrite `rx.py` like so:\n```python\nimport re\nimport sys\ntry:\n    s = sys.stdin.read()\n    r = re.compile(s)\n    print(r.match(s))\nexcept:\n    pass\n```\n\nPut some sample regular expressions in `corpus/`. Then:\n```sh\ntree-crasher-regex corpus/ -- python3 $PWD/rx.py\n```\n\n### rustc\n\ntree-crasher has found many bugs in rustc. Here's how it was done! The special\n`@@` symbol on the command line gets replaced by the file generated by\ntree-crasher.\n\n```sh\ntree-crasher-rust \\\n  --interesting-stderr \"(?m)^error: internal compiler error:\" \\\n  corpus \\ \n  -- \\\n  rustc +nightly --crate-type=lib --emit=mir -Zmir-opt-level=4 @@.rs\n```\n\n(The regex syntax is that of the\n[regex crate](https://docs.rs/regex/latest/regex/).)\n\n### More examples\n\nSee [the documentation][doc] for more examples.\n\n## Bugs found\n\ntree-crasher uses [tree-splicer][tree-splicer] to generate test cases, see the\nlist of bugs found in that project's README.\n\nIf you find a bug with tree-crasher, please let me know! One great way to do so\nwould be to submit a PR to tree-splicer to add it to the README.\n\n## Supported languages\n\ntree-crasher supports 9+ languages, see [the documentation][doc] for details.\n\n## Documentation\n\nDocumentation is available [online][doc] or in `./doc`.\n\n[doc]: https://langston-barrett.github.io/tree-crasher/\n[radamsa]: https://gitlab.com/akihe/radamsa\n[tree-sitter]: https://tree-sitter.github.io/tree-sitter/\n[tree-splicer]: https://github.com/langston-barrett/tree-splicer\n[treereduce]: https://github.com/langston-barrett/treereduce\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flangston-barrett%2Ftree-crasher","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flangston-barrett%2Ftree-crasher","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flangston-barrett%2Ftree-crasher/lists"}