merge: lane/core

tools/fuzz/CMakeLists.txt

@@ -0,0 +1,42 @@
+# libFuzzer targets for CORE parsers. Lane CORE owns tools/fuzz.
+#
+# Self-guarding: the top-level CMakeLists.txt add_subdirectory()s every tools/* that has a
+# CMakeLists, unconditionally, so this file must opt out on its own when fuzzing isn't
+# wanted or the compiler can't do libFuzzer.
+#
+# Each target compiles the parser sources directly (not the whole libveloxcore) so the
+# code under test is fully fuzzer-instrumented without a second build of the library.
+
+if(NOT VELOX_BUILD_FUZZ)
+    return()
+endif()
+if(NOT CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+    message(STATUS "tools/fuzz: libFuzzer needs Clang (have ${CMAKE_CXX_COMPILER_ID}); "
+                   "skipping fuzz targets.")
+    return()
+endif()
+
+set(_core ${CMAKE_SOURCE_DIR}/core)
+set(_fuzz_flags -g -O1 -fsanitize=fuzzer,address,undefined -fno-omit-frame-pointer)
+
+function(vdm_add_fuzzer name)
+    add_executable(${name} ${ARGN})
+    target_include_directories(${name} PRIVATE ${_core}/include ${_core}/src)
+    target_compile_features(${name} PRIVATE cxx_std_23)
+    target_compile_options(${name} PRIVATE ${_fuzz_flags})
+    target_link_options(${name} PRIVATE ${_fuzz_flags})
+endfunction()
+
+vdm_add_fuzzer(fuzz_content_disposition
+    content_disposition_fuzz.cpp
+    ${_core}/src/net/content_disposition.cpp
+    ${_core}/src/net/text_codec.cpp)
+
+vdm_add_fuzzer(fuzz_url
+    url_fuzz.cpp
+    ${_core}/src/net/url.cpp
+    ${_core}/src/net/text_codec.cpp)
+
+# Seed corpora live next to the harnesses.
+file(GLOB _cd_seeds ${CMAKE_CURRENT_SOURCE_DIR}/corpus/content_disposition/*)
+file(GLOB _url_seeds ${CMAKE_CURRENT_SOURCE_DIR}/corpus/url/*)

tools/fuzz/content_disposition_fuzz.cpp

@@ -0,0 +1,23 @@
+// Fuzz target for the Content-Disposition parser (AGENT-CORE §3: mojibake source, needs a
+// fuzz target). The parser must be total on any input — no crash, no UB, bounded work.
+//
+//   clang++ -std=c++23 -fsanitize=fuzzer,address,undefined ... (see CMakeLists.txt)
+//   ./fuzz_content_disposition -max_len=4096 corpus/content_disposition/
+
+#include <cstddef>
+#include <cstdint>
+#include <string_view>
+
+#include "vdm/net/content_disposition.hpp"
+
+extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t *data, std::size_t size) {
+    std::string_view header(reinterpret_cast<const char *>(data), size);
+    auto cd = vdm::net::parse_content_disposition(header);
+
+    // Light invariants: a returned filename never contains a path separator or NUL.
+    for (char c : cd.filename)
+        if (c == '/' || c == '\\' || c == '\0')
+            __builtin_trap();
+
+    return 0;
+}

tools/fuzz/corpus/content_disposition/ext5987

@@ -0,0 +1 @@
+attachment; filename*=UTF-8''%e2%82%ac%20rates.pdf

tools/fuzz/corpus/content_disposition/inline

@@ -0,0 +1 @@
+inline

tools/fuzz/corpus/content_disposition/plain

@@ -0,0 +1 @@
+attachment; filename="report.pdf"

tools/fuzz/corpus/content_disposition/rfc2047

@@ -0,0 +1 @@
+attachment; filename="=?UTF-8?B?4oKsIHJhdGVzLnBkZg==?="

tools/fuzz/corpus/content_disposition/traversal

@@ -0,0 +1 @@
+attachment; filename="../../etc/passwd"

tools/fuzz/corpus/url/basic

@@ -0,0 +1 @@
+https://example.com/path/to/file.iso?sig=abc#f

tools/fuzz/corpus/url/encoded

@@ -0,0 +1 @@
+https://x.com/%2e%2e/%2f

tools/fuzz/corpus/url/ftp

@@ -0,0 +1 @@
+ftp://host/x

tools/fuzz/corpus/url/ipv6

@@ -0,0 +1 @@
+http://[2001:db8::1]:9000/a%20b.bin

tools/fuzz/url_fuzz.cpp

@@ -0,0 +1,24 @@
+// Fuzz target for the URL splitter (AGENT-CORE stage 3: "a fuzz target ... URL parsing").
+// split_url / url_filename must be total on any input.
+
+#include <cstddef>
+#include <cstdint>
+#include <string_view>
+
+#include "vdm/net/url.hpp"
+
+extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t *data, std::size_t size) {
+    std::string_view url(reinterpret_cast<const char *>(data), size);
+
+    auto u = vdm::net::split_url(url);
+    (void)u;
+
+    std::string name = vdm::net::url_filename(url);
+    for (char c : name)
+        if (c == '/' || c == '\\' || c == '\0')
+            __builtin_trap();
+    if (name == "." || name == "..")
+        __builtin_trap();
+
+    return 0;
+}