Skip to content

test(preset): cargo-fuzz targets + no-panic regression tests for parsers#32

Merged
ealtun21 merged 2 commits into
masterfrom
feat/parser-fuzz-hardening
Jul 1, 2026
Merged

test(preset): cargo-fuzz targets + no-panic regression tests for parsers#32
ealtun21 merged 2 commits into
masterfrom
feat/parser-fuzz-hardening

Conversation

@ealtun21

@ealtun21 ealtun21 commented Jul 1, 2026

Copy link
Copy Markdown
Owner

Adds cargo-fuzz harness for the untrusted .fac / APO / GraphicEQ parsers (backlog item 11) plus no-panic regression tests.

  • 3 fuzz targets + seed corpus under crates/resonance-preset/fuzz/ (its own workspace root — excluded from cargo build/test --all).
  • Fuzzing found 0 crashes across ~20.8M+ execs (.fac) + APO + GraphicEQ — the parsers were already hardened (count caps, bounds-checked indexing, non-finite rejection, singularity-guarded fitter).
  • 3 no-panic #[test]s (one per parser) lock the property in as fast unit tests. resonance-preset now 31 tests.

No production-code changes; test infrastructure only. make check green.

ealtun21 added 2 commits July 1, 2026 06:12
…arsers

Add a cargo-fuzz harness (crates/resonance-preset/fuzz) with one target per
untrusted-input parser:

  fuzz_fac      -> fac::parse_fac
  fuzz_apo      -> apo::parse_apo (transitively the GraphicEQ fitter)
  fuzz_graphic  -> graphic::fit_graphic_eq (raw f64 pairs) + graphic_eq_summary

Each target only asserts the parser returns without panicking. Seed corpus is
built from the parser test fixtures (valid presets, band-header form, channel
directives, glued GraphicEQ pairs, a binary f64-pair set). The fuzz crate is
its own workspace root (empty [workspace]) so 'cargo build --all' /
'cargo test --all' from the repo root never build it. Backlog item 11.
Each parser was fuzzed for 3 min (~20.8M execs fuzz_fac, ~78.6k fuzz_apo,
~4.5k fuzz_graphic) with zero crashes — the parsers already carry prior
hardening (MAX_COUNT/MAX_BANDS bounds, parse_finite NaN/Inf rejection,
MAX_FIT_POINTS DoS cap, bounds-checked indexing). Lock the no-panic property
in as fast unit tests feeding the adversarial input classes libFuzzer explored
(empty, NUL bytes, truncated, negative counts, non-finite/zero/negative/huge
freqs, degenerate cancelling pairs, over-cap point sets, glued/empty pairs).
@ealtun21 ealtun21 merged commit d04b6bd into master Jul 1, 2026
2 of 3 checks passed
@ealtun21 ealtun21 deleted the feat/parser-fuzz-hardening branch July 2, 2026 03:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant