Skip to content

fuzz: add dedicated number boundary fuzzer #153

@membphis

Description

@membphis

Background

Current fuzz targets (fuzz_parse_eager, fuzz_parse_lazy) generate arbitrary JSON, but number parsing edge cases are underrepresented due to random generation bias.

JSON Test Suite includes specific number edge cases (i_number_huge_exp.json, i_number_real_overflow.json), but systematic fuzzing of number boundaries is missing.

Goal

Add a dedicated fuzz target that generates numbers at parsing boundaries to stress-test the number decoder.

Scope

Number Patterns to Generate

  • Exponent boundaries: 1e308, 1e-308, 1e309 (overflow), 1e-324 (underflow)
  • Integer boundaries: 9223372036854775807 (i64::MAX), 9223372036854775808 (overflow)
  • Leading zeros: 00, 01, -00, 0.0, 00.0
  • Decimal precision: 17+ digit mantissas
  • Sign variations: -0, +1 (invalid), --1 (invalid)
  • Whitespace adjacency: numbers preceded/followed by various whitespace

Validation

  • EAGER mode must reject RFC 8259 violations (leading zeros, + prefix)
  • Valid numbers must round-trip through get_f64 / get_i64 correctly
  • Overflow detection must be consistent between modes

Acceptance Criteria

  • New fuzz target fuzz_numbers in fuzz/fuzz_targets/
  • Generator produces numbers biased toward boundary conditions
  • Target validates both parse success/failure and decoded value correctness
  • Corpus seeded with JSON Test Suite i_number_* cases
  • Added to fuzz.yml timed fuzzing schedule

Technical Notes

  • Use arbitrary crate to generate structured number components (sign, integer, fraction, exponent)
  • Consider property: parse(format!("[{}]", n)).get_f64("[0]") round-trips for valid numbers

References

  • RFC 8259 §6 number grammar
  • JSON Test Suite number cases: tests/vendor/JSONTestSuite/test_parsing/i_number_*

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions