Skip to content

fuzz: Enhance fuzzing capabilities with new chunked and boundary tests#264

Merged
Kludex merged 1 commit intoKludex:masterfrom
manunio:feat-improv-fuzz-targets
Apr 13, 2026
Merged

fuzz: Enhance fuzzing capabilities with new chunked and boundary tests#264
Kludex merged 1 commit intoKludex:masterfrom
manunio:feat-improv-fuzz-targets

Conversation

@manunio
Copy link
Copy Markdown
Contributor

@manunio manunio commented Apr 13, 2026

Summary

  • Add chunked-write fuzz variants for Base64Decoder and QuotedPrintableDecoder in fuzz_decoders.py to exercise decoder state across split inputs.
  • Add a dedicated fuzz_multipart_parser.py target that drives MultipartParser directly with fuzz-generated boundaries, chunked writes, max_size enforcement, and invalid boundary construction.
  • Add a dedicated fuzz_querystring.py target covering QuerystringParser with single writes, chunked writes, and max_size truncation; both strict and non-strict parsing modes.
  • fuzz_form.py: replace Mock callbacks with real no-ops, add parse_multipart_raw (fuzz-generated boundary), parse_multipart_with_content_length, and parse_form_urlencoded_chunked via create_form_parser.
  • Expand fuzz_options_header.py to cover bytes input, latin-1 decoded string input, and None input as separate sub-targets.
  • Add ConsumeBool() helper to EnhancedDataProvider in helpers.py.
  • Suppress logging noise in all fuzz files via logging.disable(logging.CRITICAL), this is generally recommended for fuzz performance improvements .

@Kludex
Copy link
Copy Markdown
Owner

Kludex commented Apr 13, 2026

You are the expert.

Let me know if I can merge it.

@manunio
Copy link
Copy Markdown
Contributor Author

manunio commented Apr 13, 2026

Yes please merge it.

@Kludex Kludex merged commit b2ddd09 into Kludex:master Apr 13, 2026
9 checks passed
@Kludex
Copy link
Copy Markdown
Owner

Kludex commented Apr 13, 2026

@manunio
Copy link
Copy Markdown
Contributor Author

manunio commented Apr 13, 2026

Thanks @manunio 🙏

Let's see https://github.com/Kludex/python-multipart/actions/runs/24344710532/job/71082324098 👀

It failed because of sarif, will have to update cifuzz,
let me check.

@manunio
Copy link
Copy Markdown
Contributor Author

manunio commented Apr 13, 2026

Hopefully this will fix it: google/oss-fuzz#15352

@Kludex
Copy link
Copy Markdown
Owner

Kludex commented Apr 23, 2026

@manunio anything we can do to help in that PR?

@manunio
Copy link
Copy Markdown
Contributor Author

manunio commented Apr 23, 2026

@Kludex I’ve asked the other members for a review. In the meantime, I think it’s better to disable the sarif generation I have a proposed a pr here: #269. Unfortunately, I don't have a way to test this locally. I hope disabling it fixes the issue until the upstream fix is merged. If that doesn't work either, disabling cifuzz.yml altogether would be a good backup option.

@manunio
Copy link
Copy Markdown
Contributor Author

manunio commented Apr 25, 2026

@Kludex for commit 78e29ab and eb109cc i can see that cifuzz was passing and for 3e64f5f it was failing because of network issues..

270.2 Err:8 http://archive.ubuntu.com/ubuntu focal/main amd64 libtool all 2.4.6-14
270.2   Connection failed [IP: 185.125.190.81 80]
270.2 E: Failed to fetch http://archive.ubuntu.com/ubuntu/pool/main/libt/libtool/libtool_2.4.6-14_all.deb  Connection failed [IP: 185.125.190.81 80]
270.2 E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants