Add fuzzing infrastructure with cargo-fuzz

[RAprogramm]

Closes #25

Changes

Added comprehensive fuzzing infrastructure using cargo-fuzz and libFuzzer.

Fuzz Targets

Created 4 fuzz targets to test critical functionality:

fuzz_new_from_strings.rs

• Tests CStringArray::new(Vec<String>) constructor
• Splits random UTF-8 input by newlines (up to 10000 strings)
• Validates proper string-to-CString conversion
• Tested: 142 coverage, 106K+ executions

fuzz_from_cstrings.rs

• Tests zero-copy from_cstrings(Vec<CString>) constructor
• Validates ownership transfer without copying
• Tests with up to 10000 pre-constructed CStrings
• Tested: 108 coverage, 780K+ executions

fuzz_pointer_operations.rs

• Tests unsafe pointer operations and FFI safety
• Validates as_ptr() returns valid char** pointer
• Tests iteration over null-terminated pointer array
• Tests get() bounds checking and element access
• Tested: 79 coverage, 402K+ executions

fuzz_try_from.rs

• Tests all TryFrom trait implementations
• TryFrom<Vec<&str>> - string slice conversion
• TryFrom<Vec<String>> - owned string conversion
• TryFrom<Vec<CString>> - CString conversion
• Tested: 185 coverage, 317K+ executions

CI Integration

Created .github/workflows/fuzz.yml:

• Runs daily at 02:00 UTC via scheduled cron
• Manual runs via workflow_dispatch
• Matrix strategy runs all 4 targets in parallel
• 5-minute timeout per target (300 seconds)
• Uploads crash artifacts if failures occur
• Uses Rust nightly with cargo-fuzz

REUSE Compliance

Updated REUSE.toml:

• Added .github/workflows/*.yml to CC0-1.0 annotation
• Added fuzz/Cargo.toml to CC0-1.0 annotation
• Added fuzz/fuzz_targets/*.rs with MIT license annotation
• All fuzz targets have proper SPDX headers

Benefits

• Automated security testing finds edge cases and crashes
• Validates unsafe pointer operations with random inputs
• Tests FFI boundary conditions systematically
• Continuous fuzzing detects regressions early
• Industry-standard libFuzzer integration
• Complements existing Miri unsafe code validation
• Professional security testing infrastructure

Testing

All fuzz targets tested locally with cargo-fuzz:

cargo +nightly fuzz run fuzz_new_from_strings -- -max_total_time=10
cargo +nightly fuzz run fuzz_from_cstrings -- -max_total_time=10
cargo +nightly fuzz run fuzz_pointer_operations -- -max_total_time=10
cargo +nightly fuzz run fuzz_try_from -- -max_total_time=10

All targets completed successfully with no crashes:

• High execution rates (36K-77K exec/s)
• Good coverage (79-185 branches)
• No undefined behavior detected
• No memory safety violations

Security Impact

This fuzzing infrastructure significantly improves the security posture:

• Systematic testing of all unsafe code paths
• Random input generation finds unexpected edge cases
• Continuous daily fuzzing catches regressions
• Crash artifacts enable quick debugging
• Validates correctness of FFI boundary

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".