Gunnar's fuzz targets
The parsers that read bytes a stranger chose, one cargo-fuzz target each. Every target calls one entry function in src/lib.rs, the same function tests/seeds.rs drives on a plain cargo test.
| target | what it reads | Gunnar code |
pack_scan |
a pushed pack's framing, split at every byte boundary | gunnar-server storage/pack_end.rs (compiled in from its source file) |
object_decode |
commit, tag and tree payloads, SHA-1 and SHA-256 | gunnar-store object |
receive_preamble |
a pushing client's ref commands and capabilities (pkt-lines) | gunnar-wire receive_pack |
upload_request |
upload-pack v2 fetch and ls-refs arguments |
gunnar-wire upload_pack |
envelope_open |
an encrypted repository's blob envelope, v1 and v2, whole and streamed | gunnar-crypt envelope |
crypt_files |
the key ring, the member list, a quantum-safe identity, the key door's exec line | gunnar-crypt |
commit_signature |
a commit's SSH signature (gpgsig) |
gunnar-policy signature |
sshsig_event |
a forge event's sshsig and authorized-key lines |
gunnar-core sshsig, auth |
corpus/<target>/ holds small hand-made seeds. A seed named ok-* must be accepted by its target (tests/seeds.rs fails otherwise), so the fuzzer starts at the deep end of the parser. cargo test --manifest-path fuzz/Cargo.toml --no-default-features -- --ignored write_seeds regenerates them from the throwaway keys in src/lib.rs. The grown corpus and any crash files stay out of git.
Running
With cargo-fuzz and a nightly toolchain: cargo fuzz run <target> from the repository root.
With plain stable cargo (what the dwarves forge does every night):
RUSTFLAGS="--cfg fuzzing -Cpasses=sancov-module -Cllvm-args=-sanitizer-coverage-level=4 \
-Cllvm-args=-sanitizer-coverage-inline-8bit-counters -Cllvm-args=-sanitizer-coverage-pc-table \
-Cllvm-args=-sanitizer-coverage-trace-compares -Cdebug-assertions" \
cargo build --release --manifest-path fuzz/Cargo.toml --bins --target x86_64-unknown-linux-gnu
mkdir -p /tmp/corpus/pack_scan && cp fuzz/corpus/pack_scan/* /tmp/corpus/pack_scan/
fuzz/target/x86_64-unknown-linux-gnu/release/pack_scan -max_total_time=600 -artifact_prefix=/tmp/crashes/ /tmp/corpus/pack_scan--target matters: without it the instrumentation flags reach build scripts and proc-macros too, and those do not link. A crash becomes a regression test in the crate that owns the parser, with the crashing input, before the fix.