test(fuzz): seed varint decode corpus (FCV-19.b)#4757
Merged
Conversation
oferchen
force-pushed
the
test/fcv-19b-varint-seeds
branch
from
0e659af to
6adbdd7
Compare
2 tasks
oferchen
force-pushed
the
test/fcv-19b-varint-seeds
branch
6 times, most recently
from
09dd391 to
f070773
Compare
Add 24 libfuzzer seed files covering the upstream rsync varint and varlong wire-format boundary classes: - 1-byte forms: zero, one, and the 0x7F maximum - 2-byte continuation forms: low, mid, and 16383 boundary - 3/4/5-byte forms at each prefix-byte boundary, including i32 max - varlong-only leading tags 0xF8/0xFC/0xFE up to the 9-byte limit - 0xFF overflow leading tag that trips read_varlong's sizeof(u.b) guard - Continuation-bit pathology: 16 bytes of 0xFF - Truncation mid-field at each length class (2/3/4/5-byte forms) - Empty input and 16-byte all-zero input
oferchen
force-pushed
the
test/fcv-19b-varint-seeds
branch
from
f070773 to
9337ea9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add 24 libfuzzer seed files for the
varint_decodefuzz target so thecorpus exercises every wire-format boundary class of the upstream
read_varint/read_varlongcodec instead of relying on libFuzzer tosynthesise them from the single pre-existing
seed_basicblob.Coverage matrix:
0xxxxxxx):0x00,0x01,0x7Fboundary10xxxxxx + 1): values 1, 128, and the 16383 boundary110xxxxx + 2): 16384 and the 2097151 boundary1110xxxx + 3): 2097152 and the 268435455 boundary11110xxx + 4): 268435456, i32::MAX, and the all-ones (-1) payload (largest legalread_varintform)0xF8/0xFC/0xFEfilled to 7-byte and 9-byte payloads, hitting the upstreamsizeof u.b == 9ceiling0xFFwith full 10-byte payload that tripsread_varlong's overflow guard, plus a 16-byte run of0xFFfor the pathological streaming caseTest plan
cargo +nightly fuzz build varint_decodecovered by existing CI if wired)fuzz/corpus/varint_decode/