samiandClaude Sonnet 5
092e99f7a0
util/crc32.hpp — header-only CRC-32 (zlib polynomial, reflected), used to integrity-check the sidecar. meta/veloxpart — the <name>.veloxpart.meta resume file (docs/04 §5). Little-endian, versioned, CRC-32 over the whole record. Layout: magic, version, flags, total_size, downloaded, url set (original/effective/ mirrors), etag/last-modified/content-type, segment records (start, end INCLUSIVE, completed), optional sha256 streaming-hash blob. parse_veloxpart() is the attacker-facing surface (the file sits in a world-writable-ish download dir) and is total on any byte string: CRC checked before any field is interpreted; magic, a version it understands, every count and length bounded by a hard cap AND checked against the remaining buffer; ByteReader latches on overrun; trailing bytes rejected. Every malformation is meta_corrupt / meta_version_unsupported, never a crash or an unbounded allocation. serialize_veloxpart() is deterministic (unchanged sidecar isn't rewritten). File helpers write atomically (temp + rename) and fdatasync the file and its directory. Tests: crc32 known vector; full + minimal round-trips; deterministic serialize; file round-trip; and a truncation/corruption table — bad magic, CRC mismatch (payload and CRC-field flips), future version, truncation at every stage, hostile url_count / segment_count / lp_string length (the case the brief singles out), trailing bytes, impossible segment.completed. tools/fuzz/fuzz_veloxpart — feeds raw bytes and bytes-with-valid-CRC (so the field parser and ByteReader bounds checks are actually reached), and round-trip-stability-checks anything accepted. Ran 1.1M execs clean under ASan+UBSan+libFuzzer (clang++-21); fuzz_content_disposition and fuzz_url likewise re-run to 1.1M. tools/fuzz gains a -runs=0 seed-replay CTest smoke per target (regression tripwire; the campaign stays manual). Fuzz-found and fixed: parse_content_disposition could emit a filename containing NUL / control bytes from a mangled filename* ext-value — strip_path only removed path separators. Now sanitize_leaf() also drops C0 controls and DEL (rules/ still owns the authoritative sanitize; `..` and printable-unsafe content pass through as before). Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01HPPSGhiArbvQgwC2DNiURS
47 lines
2.1 KiB
CMake
47 lines
2.1 KiB
CMake
# CORE unit tests.
|
|
#
|
|
# Harness is the provisional header-only vtest (support/vtest.hpp); PKG owns the final
|
|
# framework choice (core/docs/pkg-requests-m1.md P2). vdm_add_test() is the only thing
|
|
# test files touch, so swapping harnesses is a one-function edit.
|
|
|
|
add_library(vtest_main STATIC support/vtest_main.cpp)
|
|
target_include_directories(vtest_main PUBLIC ${CMAKE_CURRENT_SOURCE_DIR}/support)
|
|
target_compile_features(vtest_main PUBLIC cxx_std_23)
|
|
|
|
function(vdm_add_test name)
|
|
add_executable(${name} ${ARGN})
|
|
target_link_libraries(${name} PRIVATE veloxcore vtest_main)
|
|
target_compile_options(${name} PRIVATE -Wall -Wextra -Wpedantic -Werror)
|
|
add_test(NAME ${name} COMMAND ${name})
|
|
endfunction()
|
|
|
|
vdm_add_test(veloxcore_result_test util/result_test.cpp)
|
|
vdm_add_test(veloxcore_event_bus_test util/event_bus_test.cpp)
|
|
vdm_add_test(veloxcore_thread_pool_test util/thread_pool_test.cpp)
|
|
vdm_add_test(veloxcore_bytes_test util/bytes_test.cpp)
|
|
vdm_add_test(veloxcore_log_test util/log_test.cpp)
|
|
|
|
# net/ integration tests drive tools/testserver (lane PKG/QA). Skip cleanly if it isn't
|
|
# in the tree yet (lanes merge independently).
|
|
vdm_add_test(veloxcore_content_disposition_test net/content_disposition_test.cpp)
|
|
vdm_add_test(veloxcore_url_test net/url_test.cpp)
|
|
vdm_add_test(veloxcore_sparse_file_test io/sparse_file_test.cpp)
|
|
vdm_add_test(veloxcore_write_buffer_test io/write_buffer_test.cpp)
|
|
vdm_add_test(veloxcore_veloxpart_test meta/veloxpart_test.cpp)
|
|
|
|
set(_testserver ${CMAKE_SOURCE_DIR}/tools/testserver/testserver.py)
|
|
foreach(net_it http_client probe)
|
|
vdm_add_test(veloxcore_${net_it}_test net/${net_it}_test.cpp)
|
|
target_include_directories(veloxcore_${net_it}_test
|
|
PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/net)
|
|
if(EXISTS ${_testserver})
|
|
target_compile_definitions(veloxcore_${net_it}_test
|
|
PRIVATE VDM_TESTSERVER_PY="${_testserver}")
|
|
set_tests_properties(veloxcore_${net_it}_test PROPERTIES TIMEOUT 120)
|
|
endif()
|
|
endforeach()
|
|
if(NOT EXISTS ${_testserver})
|
|
message(STATUS "veloxcore: tools/testserver not present; net integration tests will "
|
|
"skip their server-backed cases.")
|
|
endif()
|