Like XML, JSON, …

Get code coverage working

Make mutations smarter instead of just rolling a dice

One may prefer one mutation strategy over applying n strategies per test case per mutation.
Currently, only one mutation is applied per test case.

Currently, we rely on hard-coded grammars that don't cover 100% of the targeted grammar specification. One such approach to improve that is to implement a learning tokenizer that evolves at runtime. This could result in a complete re-write of the existing grammar mutator or just as an additional extension of it.

Ref: https://www.usenix.org/system/files/sec21-salls.pdf

Would probably be nice to extend the struct to have an accessed_ctr / priority field on top of an index field. The former could be used to keep track on how successful a test case is in driving a fuzzer into interesting areas. The latter could be used to allow stuff like:

let tc_byte = consume8(&test_case.data);
let tc_2bytes = consume16(&test_case.data);
let tc_as_string = consume_str(&test_case.data);

Currently, our mutations are more or less based on a whole byte vector level represented by a Vec<u8>. It would be nice to offer more type-based mutations as well that span over all native Rust types.
This would allow a more generic approach and special mutators owned by types.
Something like:

/// Specific mutations that work a string level without or only partially having to rely on converting the string to a [u8]
impl mutate for String {}

/// Specfic mutations that work on a byte level
impl mutate for u8 {}