fuzzberon

Grammar-based, type-aware fuzzer for the Oberon-07 programming language.

fuzzberon generates random Oberon-07 modules by walking Wirth's EBNF productions top-down. Unlike a purely syntactic generator, it threads a typed symbol table through the walk, so the output is close to compilable and exercises far more of a compiler front-end than token soup:

• identifiers are declared before use and reused by reference;
• record fields belong to their record type (no invented selectors);
• designators legally traverse arrays, records and pointers, with in-range index expressions;
• operators are applied to operands of the right type (DIV on integers, / on reals and sets, & on booleans, ...);
• procedure calls match the declared signature, including VAR parameters (which receive designators, not expressions);
• proper procedures are called as statements, function procedures inside expressions of their result type;
• FOR control variables are plain INTEGER variables, array lengths are positive, CASE labels are distinct, hex literals start with a digit.

For negative testing of a type checker, --chaos P injects a wrong-typed subexpression with probability P at every expression node.

Usage

No dependencies beyond Python 3.8+.

python3 oberon_fuzzer.py # one module to stdout
python3 oberon_fuzzer.py -n 5 --seed 42 # five reproducible modules
python3 oberon_fuzzer.py -d 6 # deeper statement nesting
python3 oberon_fuzzer.py --chaos 0.05 # sprinkle type errors
python3 oberon_fuzzer.py -n 100 -o out # write 100 .Mod files
python3 oberon_fuzzer.py --selftest 200 # sanity-check 200 seeds

Option	Description
-n, --count N	number of modules to generate (default: 1)
--seed S	base RNG seed; program i uses S + i
-d, --max-depth D	statement nesting budget (default: 4)
--chaos P	probability of a wrong-typed subexpression (default: 0)
-o, --out-dir DIR	write each module to a .Mod file in DIR
--selftest N	generate and structurally check N seeds, then exit

Sample output

MODULEFuzz1824;CONST
c1 =8935;
c2 = c1 +4;TYPE
T3 =ARRAY18OFCHAR;VAR
g4:INTEGER;
g8:SET;
v9*:BOOLEAN;PROCEDUREP11();BEGINIF(g4 >0) & (g4 IN g8)THENFOR g4 := c2 *7668TO c1 DOCASE g4 OF91:INCL(g8, 23)
| 54: g4 :=ABS(c2)ENDENDENDENDP11;BEGIN
P11()ENDFuzz1824.

How it works

Each generator method in OberonFuzzer mirrors one production of the report The Programming Language Oberon (revision 2016). A small structural type model (Basic, Array, Record, Pointer, Named) backs a scoped symbol table; expression generation dispatches on the requested type, and leaf_paths enumerates every legal selector chain from a variable down to a basic-typed component. Layout sentinels in the token stream drive a tiny renderer that produces indented source.

Library use

fromoberon_fuzzerimportgenerate_programsrc=generate_program(seed=42, max_depth=4, chaos=0.0)

License

MIT