samiandClaude Sonnet 5
092e99f7a0
util/crc32.hpp — header-only CRC-32 (zlib polynomial, reflected), used to integrity-check the sidecar. meta/veloxpart — the <name>.veloxpart.meta resume file (docs/04 §5). Little-endian, versioned, CRC-32 over the whole record. Layout: magic, version, flags, total_size, downloaded, url set (original/effective/ mirrors), etag/last-modified/content-type, segment records (start, end INCLUSIVE, completed), optional sha256 streaming-hash blob. parse_veloxpart() is the attacker-facing surface (the file sits in a world-writable-ish download dir) and is total on any byte string: CRC checked before any field is interpreted; magic, a version it understands, every count and length bounded by a hard cap AND checked against the remaining buffer; ByteReader latches on overrun; trailing bytes rejected. Every malformation is meta_corrupt / meta_version_unsupported, never a crash or an unbounded allocation. serialize_veloxpart() is deterministic (unchanged sidecar isn't rewritten). File helpers write atomically (temp + rename) and fdatasync the file and its directory. Tests: crc32 known vector; full + minimal round-trips; deterministic serialize; file round-trip; and a truncation/corruption table — bad magic, CRC mismatch (payload and CRC-field flips), future version, truncation at every stage, hostile url_count / segment_count / lp_string length (the case the brief singles out), trailing bytes, impossible segment.completed. tools/fuzz/fuzz_veloxpart — feeds raw bytes and bytes-with-valid-CRC (so the field parser and ByteReader bounds checks are actually reached), and round-trip-stability-checks anything accepted. Ran 1.1M execs clean under ASan+UBSan+libFuzzer (clang++-21); fuzz_content_disposition and fuzz_url likewise re-run to 1.1M. tools/fuzz gains a -runs=0 seed-replay CTest smoke per target (regression tripwire; the campaign stays manual). Fuzz-found and fixed: parse_content_disposition could emit a filename containing NUL / control bytes from a mangled filename* ext-value — strip_path only removed path separators. Now sanitize_leaf() also drops C0 controls and DEL (rules/ still owns the authoritative sanitize; `..` and printable-unsafe content pass through as before). Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01HPPSGhiArbvQgwC2DNiURS
57 lines
2.3 KiB
CMake
57 lines
2.3 KiB
CMake
# libFuzzer targets for CORE parsers. Lane CORE owns tools/fuzz.
|
|
#
|
|
# Self-guarding: the top-level CMakeLists.txt add_subdirectory()s every tools/* that has a
|
|
# CMakeLists, unconditionally, so this file must opt out on its own when fuzzing isn't
|
|
# wanted or the compiler can't do libFuzzer.
|
|
#
|
|
# Each target compiles the parser sources directly (not the whole libveloxcore) so the
|
|
# code under test is fully fuzzer-instrumented without a second build of the library.
|
|
|
|
if(NOT VELOX_BUILD_FUZZ)
|
|
return()
|
|
endif()
|
|
if(NOT CMAKE_CXX_COMPILER_ID MATCHES "Clang")
|
|
message(STATUS "tools/fuzz: libFuzzer needs Clang (have ${CMAKE_CXX_COMPILER_ID}); "
|
|
"skipping fuzz targets.")
|
|
return()
|
|
endif()
|
|
|
|
set(_core ${CMAKE_SOURCE_DIR}/core)
|
|
set(_fuzz_flags -g -O1 -fsanitize=fuzzer,address,undefined -fno-omit-frame-pointer)
|
|
|
|
# corpus_dir is the seed set (checked in, small, hand-named). It is passed read-only:
|
|
# the CTest smoke run uses -runs so libFuzzer exits, and a real campaign is
|
|
# `bin/<name> corpus/<x>/` by hand.
|
|
function(vdm_add_fuzzer name corpus_dir)
|
|
add_executable(${name} ${ARGN})
|
|
target_include_directories(${name} PRIVATE ${_core}/include ${_core}/src)
|
|
target_compile_features(${name} PRIVATE cxx_std_23)
|
|
target_compile_options(${name} PRIVATE ${_fuzz_flags})
|
|
target_link_options(${name} PRIVATE ${_fuzz_flags})
|
|
|
|
if(VELOX_BUILD_TESTS)
|
|
# Regression tripwire only: replay the checked-in seeds once (-runs=0, no
|
|
# mutation, no corpus writes) so a parser change that breaks a known-good or
|
|
# known-hostile input fails CI in a fraction of a second. The 1M-exec bar
|
|
# (AGENT-CORE M1 DoD) is a separate campaign job: `bin/<name> corpus/<x>/`.
|
|
add_test(NAME ${name}_smoke
|
|
COMMAND ${name} -runs=0 ${CMAKE_CURRENT_SOURCE_DIR}/${corpus_dir})
|
|
set_tests_properties(${name}_smoke PROPERTIES LABELS "fuzz" TIMEOUT 60)
|
|
endif()
|
|
endfunction()
|
|
|
|
vdm_add_fuzzer(fuzz_content_disposition corpus/content_disposition
|
|
content_disposition_fuzz.cpp
|
|
${_core}/src/net/content_disposition.cpp
|
|
${_core}/src/net/text_codec.cpp)
|
|
|
|
vdm_add_fuzzer(fuzz_url corpus/url
|
|
url_fuzz.cpp
|
|
${_core}/src/net/url.cpp
|
|
${_core}/src/net/text_codec.cpp)
|
|
|
|
vdm_add_fuzzer(fuzz_veloxpart corpus/veloxpart
|
|
veloxpart_fuzz.cpp
|
|
${_core}/src/meta/veloxpart.cpp
|
|
${_core}/src/util/error.cpp)
|