Rust SIG Meeting - 2026-07-21

[PLeVasseur]

Hey folks 👋 welcome to our 14th meeting of 2026.

Rust SIG Meeting 2026-07-21

Agenda

1. Solicitation of notetaker
   • Pete LeVasseur
2. Rust Watercooler Chat Topic: Fuzzing Eclipse Zenoh with Rust, cargo-fuzz, and OSS-Fuzz; ChenYing Kuo / ZettaScale
3. Review GitHub repo content and discuss how to enrich it (Pete)
   1. Issues
   2. Discussions are now active. The SIG previously agreed to take meeting notes there.
4. Office hours: Rust + Automotive questions — come chat (All)
5. Discuss upcoming events / news related to Rust & Automotive (All)
6. Meeting close

Check-in area

We had roughly xx people present at peak attendance, including those listed below.

• @terechko
• @AnotherDaniel
• @evshary
• @mik90
• @cpetig
• @AntonSchmukel
• @sankurm

Housekeeping

• Document space: https://drive.google.com/drive/folders/1Ub0qTLKvTFilPC9TFVEdTyWn_9qJ-vYD?usp=drive_link
• GitHub repo: https://github.com/rust-sig/rust-sig
• Eclipse SDV Slack channel: #rust-sig

Tasks / action items

• No explicit action items were captured in the source notes.

Watercooler chat: Fuzzing Eclipse Zenoh with Rust, cargo-fuzz, and OSS-Fuzz; ChenYing Kuo / ZettaScale

Zenoh fuzz testing intro

• Eclipse Zenoh: Rust-based communication middleware, used in ROS, uProtocol., etc
• fuzz testing is relevant bcs network protocols have to deal with all kinds of inputs, and should perform consistently regardless
• fuzzing isn't random - better fuzzed content ('corpus') can help reach deeper code paths in testing

Tools

• different frameworks (libFuzzer/cargo-fuzz, AFL/afl.rs, honggfuzz/honggfuzz-rs)
• using cargo-fuzz (Rust-friendly, LLVM-based, no requirements for the specific features of other tools like process isolation)
• rust-fuzz.github.io/book/

What was fuzzed

• protocol decode handlers
• roundtrip (encode-decode of fuzzed payloads)
• configuration parser

fuzz + CI

• smoke tests for PRs
• nightly and weekly test suites
• use OSS-Fuzz infra (https://github.com/google/oss-fuzz)
  • coverage reports and dashboards

demo

• 'rust_fuzz_examples': https://github.com/evshary/rust_fuzz_examples/tree/main

what was found

• encode/decode mismatches
• panics from unexpected inputs
• timeouts
• OOM/memory leak conditions
• Also refer to Zenoh issue #2592 for findings and related know-how (Umbrella issue for fuzz tests in Zenoh eclipse-zenoh/zenoh#2592)

limitations, next steps

• coverage does not imply correctness, no crash != no bug
• random inputs might not reach deeper control flows/states
• more state- and control-flow-aware fuzzing

discussion

• good relationship of findings vs effort to set up, for the Zenoh codebase
• no experience in that context with fuzzing a Rust-C++ FFI
• question about research/papers wrt designing fuzz corpus for complex input-output functions: no references, as for network protocol infra so far random inputs do the job well (e.g. encoding/decoding)
  • more bespoke fuzz content might require using different fuzzing frameworks

Recent events / things coming up for Rust

xx

Requested topics

xx

Material

xx

[terechko]

@terechko

[cpetig]

@cpetig

[AntonSchmukel]

@AntonSchmukel

[bharatGoswami8]

@bharatGoswami8

[mik90]

@mik90

[sankurm]

@sankurm

[evshary]

@evshary

[AnotherDaniel]

Meeting notes

Watercooler chat: Fuzzing Eclipse Zenoh with Rust, cargo-fuzz, and OSS-Fuzz; ChenYing Kuo / ZettaScale

Zenoh fuzz testing intro

• Eclipse Zenoh: Rust-based communication middleware, used in ROS, uProtocol., etc
• fuzz testing is relevant bcs network protocols have to deal with all kinds of inputs, and should perform consistently regardless
• fuzzing isn't random - better fuzzed content ('corpus') can help reach deeper code paths in testing

Tools

• different frameworks (libFuzzer/cargo-fuzz, AFL/afl.rs, honggfuzz/honggfuzz-rs)
• using cargo-fuzz (Rust-friendly, LLVM-based, no requirements for the specific features of other tools like process isolation)
• rust-fuzz.github.io/book/

What was fuzzed

• protocol decode handlers
• roundtrip (encode-decode of fuzzed payloads)
• configuration parser

fuzz + CI

• smoke tests for PRs
• nightly and weekly test suites
• use OSS-Fuzz infra (https://github.com/google/oss-fuzz)
  • coverage reports and dashboards

demo

• 'rust_fuzz_examples': https://github.com/evshary/rust_fuzz_examples/tree/main

what was found

• encode/decode mismatches
• panics from unexpected inputs
• timeouts
• OOM/memory leak conditions
• Also refer to Zenoh issue #2592 for findings and related know-how (Umbrella issue for fuzz tests in Zenoh eclipse-zenoh/zenoh#2592)

limitations, next steps

• coverage does not imply correctness, no crash != no bug
• random inputs might not reach deeper control flows/states
• more state- and control-flow-aware fuzzing

discussion

• good relationship of findings vs effort to set up, for the Zenoh codebase
• no experience in that context with fuzzing a Rust-C++ FFI
• question about research/papers wrt designing fuzz corpus for complex input-output functions: no references, as for network protocol infra so far random inputs do the job well (e.g. encoding/decoding)
  • more bespoke fuzz content might require using different fuzzing frameworks

other topics/items

none