fuzz: Enhance fuzzing capabilities with new chunked and boundary tests#264
Conversation
|
You are the expert. Let me know if I can merge it. |
|
Yes please merge it. |
It failed because of sarif, will have to update cifuzz, |
|
Hopefully this will fix it: google/oss-fuzz#15352 |
|
@manunio anything we can do to help in that PR? |
|
@Kludex I’ve asked the other members for a review. In the meantime, I think it’s better to disable the sarif generation I have a proposed a pr here: #269. Unfortunately, I don't have a way to test this locally. I hope disabling it fixes the issue until the upstream fix is merged. If that doesn't work either, disabling cifuzz.yml altogether would be a good backup option. |
|
@Kludex for commit 78e29ab and eb109cc i can see that cifuzz was passing and for 3e64f5f it was failing because of network issues.. |
…15352) This bug was caused by cifuzz action: https://github.com/Kludex/python-multipart/actions/runs/24344710532/job/71082324098 When the following pr was merged: Kludex/python-multipart#264
Summary
Base64DecoderandQuotedPrintableDecoderinfuzz_decoders.pyto exercise decoder state across split inputs.fuzz_multipart_parser.pytarget that drivesMultipartParserdirectly with fuzz-generated boundaries, chunked writes, max_size enforcement, and invalid boundary construction.fuzz_querystring.pytarget coveringQuerystringParserwith single writes, chunked writes, and max_size truncation; both strict and non-strict parsing modes.fuzz_form.py: replace Mock callbacks with real no-ops, addparse_multipart_raw(fuzz-generated boundary),parse_multipart_with_content_length, andparse_form_urlencoded_chunkedviacreate_form_parser.fuzz_options_header.pyto cover bytes input, latin-1 decoded string input, andNoneinput as separate sub-targets.ConsumeBool()helper toEnhancedDataProviderinhelpers.py.logging.disable(logging.CRITICAL), this is generally recommended for fuzz performance improvements .