Skip to content

Release v0.5.0: Fuzzing Infrastructure and Core Stability

Choose a tag to compare

@gooderfreed gooderfreed released this 03 May 00:22
· 38 commits to main since this release

This release focuses on establishing a robust fuzzing pipeline using libFuzzer. Continuous execution of randomized, concurrent allocation cycles helped identify and resolve several complex architectural edge cases related to ABI-masquerading, alignment padding, and boundary conditions.

Fuzzing Suite

  • fuzz_core: Tests the Triple-Key LLRB tree, block splitting, and merging.
  • fuzz_bump & fuzz_slab: Isolates and verifies the sub-allocator state machines.
  • fuzz_chaos: Simulates concurrent lifecycles of nested sub-allocators, dynamically creating and destroying arenas to verify isolation and detect Use-After-Free scenarios.

Core Bug Fixes

  • ABI Padding Desync: Sub-allocators (Bump/Slab) previously failed to account for 8-byte alignment padding injected by em_alloc on 64-bit systems. Fixed by utilizing the XOR-magic detector across all create_internal functions to accurately locate block headers.
  • Tail OOM Absorption: Prevented the allocator from incorrectly absorbing an occupied tail block during adjacent deallocation when the arena is completely full.
  • Scratch Garbage Leaf in LLRB: Cleared union pointers in freed scratchpads to prevent wild pointer dereferencing (0xdeadbeef...) if a dirty tail is later sliced for padding and inserted into the free tree.
  • Zero-Capacity Bump Trim: Trimming an empty bump allocator previously calculated a 0-byte payload, corrupting the heap layout. Fixed by enforcing EM_MIN_BUFFER_SIZE limits.

Developer Experience

  • Added Makefile integration for fuzzing:
    • make fuzz_[name] to run specific targets.
    • make replay_[name] CRASH=... to replay crash inputs with step-by-step ASCII visual debugging (print_fancy).
  • Added explicit regression tests for all newly discovered edge cases to validation_test.c.

Complex inside. Simple outside.