48 lines
1.9 KiB
Markdown
48 lines
1.9 KiB
Markdown
# Fuzzing
|
|
|
|
Fuzz targets exercise untrusted wire and persistence parsers under libFuzzer,
|
|
ASan, and UBSan. The current targets cover the MCP/JSON-RPC codec, the
|
|
argument parser that backs constrained policy decisions, and the retained
|
|
change-manifest decoder, strict canonical session-plan validation, and
|
|
change-apply journal recovery parser, and retained library-bundle verifier.
|
|
Checked
|
|
corpus files are stable review artifacts; fuzzing must mutate a copy rather
|
|
than writing generated units into the repository.
|
|
|
|
Configure and build the targets with a Clang distribution that includes the
|
|
libFuzzer runtime. Apple Clang installations do not always ship that runtime;
|
|
Homebrew LLVM is the default used by preflight on macOS.
|
|
|
|
```sh
|
|
cmake --preset fuzz -DCMAKE_CXX_COMPILER=/path/to/clang++
|
|
cmake --build --preset fuzz
|
|
```
|
|
|
|
Run the MCP codec target against a disposable corpus copy:
|
|
|
|
```sh
|
|
corpus_copy="$(mktemp -d "${TMPDIR:-/tmp}/glove-mcp-corpus.XXXXXX")"
|
|
cp -R fuzz/corpus/mcp_codec/. "${corpus_copy}/"
|
|
./build/fuzz/fuzz/glove_mcp_codec_fuzzer \
|
|
-runs=10000 -max_len=65536 -timeout=5 -rss_limit_mb=2048 \
|
|
"${corpus_copy}"
|
|
```
|
|
|
|
Run the policy target the same way, substituting
|
|
`fuzz/corpus/policy_jsonpath` and `glove_policy_jsonpath_fuzzer`.
|
|
|
|
Run the manifest target the same way, substituting
|
|
`fuzz/corpus/change_manifest` and `glove_change_manifest_fuzzer`.
|
|
|
|
Run the session-plan target the same way, substituting
|
|
`fuzz/corpus/session_plan` and `glove_session_plan_fuzzer`.
|
|
|
|
Run the change-apply journal target the same way, substituting
|
|
`fuzz/corpus/change_apply_journal` and `glove_change_apply_journal_fuzzer`.
|
|
|
|
Run the library-bundle target the same way, substituting
|
|
`fuzz/corpus/library_bundle` and `glove_library_bundle_fuzzer`.
|
|
|
|
Crashes, sanitizer findings, or timeouts are failures. Minimize a reproducer
|
|
before adding it to the checked corpus, and give each retained input a
|
|
descriptive filename tied to the parser invariant it covers.
|