- fuzz_fts5_query: sanitized MCP/CLI search text must execute as MATCH on
an FTS5 table shaped like documents_fts, also after re-sanitizing.
- fuzz_utf8: sanitizer output is well-formed and preserves valid input; a
UTF-8 verdict implies well-formed bytes; UTF-16/Latin-1 conversions
produce well-formed UTF-8.
- fuzz_text_extractors: HTML/plain-text extraction, title and section
detection on arbitrary bytes, with an output-size bound; run with
-timeout to catch super-linear scans.
- fuzz_compressed_block: stored blocks decode within the header's size and
-rss_limit_mb; zstd/LZMA round-trip exactly.
Seeds in generate_corpus.sh; the Forgejo fuzz-smoke lane builds and runs
them and triggers on the parsers' sources. Five minutes per harness on a
Linux x86 host after the fixes in this series: no findings.
Fuzzing belongs on our own compute rather than GitHub-hosted runners.
Move the smoke job to .forgejo/workflows on the self-hosted label, pin
actions to code.forgejo.org, and add a preflight that fails clearly when
the runner lacks clang's libFuzzer runtime or the build tools.
Note that once .forgejo/workflows exists, Forgejo runs only those
workflows and stops executing the .github/workflows copies.
