<p>A fuzzing harness is a test case or a particular test target. This <a href="https://vdalabs.com/2019/02/01/microsoft-security-risk-detection-writing-a-custom-test-harness-to-fuzz-libraries/" rel="nofollow noreferrer">blog post</a> defines a harness as an &quot;entry point executable&quot;. When you want to fuzz input that is not reachable from the command line you need to write a new testing harness.</p>
<blockquote>
<p>For example, if we wanted to assess the security of a client/server application, a testing harness would need to perform many actions, like starting the server process prior to sending network input from a client connection. Or if we wanted to fuzz test the inputs of functions in a DLL (loaded library), since there is no entry point defined we would need to write a testing harness to pass input from the command line into DLL functions.</p>
</blockquote>
<p>This blog post goes through an example of writing a test harness to take input from a file and then pass that input to a vulnerable function that we want to fuzz.</p>
<p>There is also a <a href="https://github.com/google/fuzzing/blob/master/docs/glossary.md" rel="nofollow noreferrer">glossary</a> of fuzzing terms here.</p>
<p>Thanks to Marco Falke for answering this question on IRC.</p>

CC BY-SA 4.0
2020-12-01T14:54:45.877Z
2021-01-03T14:40:54.420Z
2021-01-03T14:40:54.420Z
Michael Folkson
<p>The Bitcoin Core fuzzing <a href="https://github.com/bitcoin/bitcoin/blob/master/doc/fuzzing.md" rel="nofollow noreferrer">docs</a> refer to &quot;fuzzing harnesses&quot;. What is a harness in this context?</p>
<p>(There have been two previous Bitcoin Core PR review club sessions on fuzz testing at the time of writing, in <a href="https://bitcoincore.reviews/17860" rel="nofollow noreferrer">January 2020</a> and in <a href="https://bitcoincore.reviews/18521" rel="nofollow noreferrer">April 2020</a>. The latter was on <a href="https://github.com/bitcoin/bitcoin/pull/18521" rel="nofollow noreferrer">PR 18521</a> which added a <code>process_messages</code> harness.)</p>

<bitcoin-core-development><testing><fuzz-test>
What is a fuzz testing harness?
Michael Folkson
# What is a fuzz testing harness?

(Asked by: username_0 on 2020-12-01)

The Bitcoin Core fuzzing [docs](https://github.com/bitcoin/bitcoin/blob/master/doc/fuzzing.md) refer to "fuzzing harnesses". What is a harness in this context?

(There have been two previous Bitcoin Core PR review club sessions on fuzz testing at the time of writing, in [January 2020](https://bitcoincore.reviews/17860) and in [April 2020](https://bitcoincore.reviews/18521). The latter was on [PR 18521](https://github.com/bitcoin/bitcoin/pull/18521) which added a `process_messages` harness.)

**Tags:** bitcoin-core-development, testing, fuzz-test


---

## 1 answers

### Answer by username_0 on 2020-12-01. Score: 0 | Accepted answer

A fuzzing harness is a test case or a particular test target. This [blog post](https://vdalabs.com/2019/02/01/microsoft-security-risk-detection-writing-a-custom-test-harness-to-fuzz-libraries/) defines a harness as an "entry point executable". When you want to fuzz input that is not reachable from the command line you need to write a new testing harness.

> For example, if we wanted to assess the security of a client/server application, a testing harness would need to perform many actions, like starting the server process prior to sending network input from a client connection. Or if we wanted to fuzz test the inputs of functions in a DLL (loaded library), since there is no entry point defined we would need to write a testing harness to pass input from the command line into DLL functions.

This blog post goes through an example of writing a test harness to take input from a file and then pass that input to a vulnerable function that we want to fuzz.

There is also a [glossary](https://github.com/google/fuzzing/blob/master/docs/glossary.md) of fuzzing terms here.

Thanks to Marco Falke for answering this question on IRC.


---

