Skip to content

fuzz: Enhance fuzzing capabilities with new chunked and boundary tests#264

Merged
Kludex merged 1 commit into
Kludex:masterfrom
manunio:feat-improv-fuzz-targets
Apr 13, 2026
Merged

fuzz: Enhance fuzzing capabilities with new chunked and boundary tests#264
Kludex merged 1 commit into
Kludex:masterfrom
manunio:feat-improv-fuzz-targets

Conversation

@manunio

@manunio manunio commented Apr 13, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Add chunked-write fuzz variants for Base64Decoder and QuotedPrintableDecoder in fuzz_decoders.py to exercise decoder state across split inputs.
  • Add a dedicated fuzz_multipart_parser.py target that drives MultipartParser directly with fuzz-generated boundaries, chunked writes, max_size enforcement, and invalid boundary construction.
  • Add a dedicated fuzz_querystring.py target covering QuerystringParser with single writes, chunked writes, and max_size truncation; both strict and non-strict parsing modes.
  • fuzz_form.py: replace Mock callbacks with real no-ops, add parse_multipart_raw (fuzz-generated boundary), parse_multipart_with_content_length, and parse_form_urlencoded_chunked via create_form_parser.
  • Expand fuzz_options_header.py to cover bytes input, latin-1 decoded string input, and None input as separate sub-targets.
  • Add ConsumeBool() helper to EnhancedDataProvider in helpers.py.
  • Suppress logging noise in all fuzz files via logging.disable(logging.CRITICAL), this is generally recommended for fuzz performance improvements .
@Kludex

Kludex commented Apr 13, 2026

Copy link
Copy Markdown
Owner

You are the expert.

Let me know if I can merge it.

@manunio

manunio commented Apr 13, 2026

Copy link
Copy Markdown
Contributor Author

Yes please merge it.

@Kludex Kludex merged commit b2ddd09 into Kludex:master Apr 13, 2026
9 checks passed
@manunio

manunio commented Apr 13, 2026

Copy link
Copy Markdown
Contributor Author

Thanks @manunio 🙏

Let's see https://github.com/Kludex/python-multipart/actions/runs/24344710532/job/71082324098 👀

It failed because of sarif, will have to update cifuzz,
let me check.

@manunio

manunio commented Apr 13, 2026

Copy link
Copy Markdown
Contributor Author

Hopefully this will fix it: google/oss-fuzz#15352

@Kludex

Kludex commented Apr 23, 2026

Copy link
Copy Markdown
Owner

@manunio anything we can do to help in that PR?

@manunio

manunio commented Apr 23, 2026

Copy link
Copy Markdown
Contributor Author

@Kludex I’ve asked the other members for a review. In the meantime, I think it’s better to disable the sarif generation I have a proposed a pr here: #269. Unfortunately, I don't have a way to test this locally. I hope disabling it fixes the issue until the upstream fix is merged. If that doesn't work either, disabling cifuzz.yml altogether would be a good backup option.

@manunio

manunio commented Apr 25, 2026

Copy link
Copy Markdown
Contributor Author

@Kludex for commit 78e29ab and eb109cc i can see that cifuzz was passing and for 3e64f5f it was failing because of network issues..

270.2 Err:8 http://archive.ubuntu.com/ubuntu focal/main amd64 libtool all 2.4.6-14
270.2   Connection failed [IP: 185.125.190.81 80]
270.2 E: Failed to fetch http://archive.ubuntu.com/ubuntu/pool/main/libt/libtool/libtool_2.4.6-14_all.deb  Connection failed [IP: 185.125.190.81 80]
270.2 E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

2 participants