fuzz-target-every-parse: the §3.2 differential target — three parsers + skip_forward through the doc-hidden surfaces via shared invariants, 66 committed seeds + gitignore negation + README row; two real skip_forward findings fixed inline (division-by-zero/negative-interval wrap on sqlite+mem, i64 gap subtraction overflow on all three engines incl. pg) and registered as PROVENANCE D-38

This commit is contained in:
glm-5.3-flash committed 2026-10-10 22:01:13 +00:00
1 parent 1f6cc0970a
commit f7c1bd79b0
80 files changed
+1559 -18

No files matched your search

+122
View File
@@ -124,8 +124,130 @@ def payload_codec_seeds():
i += 1
def every_parse_seeds():
i = 0
# Every grammar-valid unit form (s|m|h|d), single and multi-digit.
for spec in [
"@every 1s",
"@every 5s",
"@every 9s",
"@every 17s",
"@every 42m",
"@every 1m",
"@every 90m",
"@every 2h",
"@every 24h",
"@every 1d",
"@every 7d",
"@every 365d",
]:
write_seed("every_parse", i, spec.encode())
i += 1
# Leading-zero forms (parsed through, value = the digits).
for spec in ["@every 007s", "@every 007m", "@every 000000042h", "@every 007d"]:
write_seed("every_parse", i, spec.encode())
i += 1
# The n <= 0 arms: positive zero (with and without leading zeros)
# and the negative shapes (digits == 0 inside the grammar).
for spec in ["@every 0s", "@every 00m", "@every 0000d", "@every -5s", "@every -0s"]:
write_seed("every_parse", i, spec.encode())
i += 1
# The i64::MAX neighborhood: giant-n accept at scale-1, digit
# overflow past i64, and unit-multiplier overflow above it.
for spec in [
"@every 9223372036854775807s",
"@every 9223372036854775806s",
"@every 9223372036854775808s",
"@every 9223372036854775807m",
"@every 9223372036854775807h",
"@every 9223372036854775807d",
"@every 18446744073709551616s",
"@every 18446744073709551616000000m",
]:
write_seed("every_parse", i, spec.encode())
i += 1
# The digit-overflow boundary at exactly i64::MAX/86400 (and ±1).
for spec in [
"@every 106751991167300d",
"@every 106751991167301d",
"@every 106751991167299d",
]:
write_seed("every_parse", i, spec.encode())
i += 1
# d-unit multiplier blowups.
for spec in ["@every 2147483647d", "@every 4294967295d", "@every 100000000000d"]:
write_seed("every_parse", i, spec.encode())
i += 1
# Whitespace / garbage / truncation shapes.
for raw in [
b"@every",
b"@every ",
b"@every 5s",
b"@every 5s ",
b"@every\t5s",
b"@every 5 s",
b"@every 5sx",
b"@every 5S",
b"@every +5s",
b"@every .5s",
b"@every 3.5s",
b"@every 5.0s",
b"@every 5\ts",
b"@every \xc3\xa9s",
b"\xff @every \xff 5s \xfe",
b"@every 5s\xff",
]:
write_seed("every_parse", i, raw)
i += 1
# Non-grammar prefixes and shapes (cron / @once adjacency).
for raw in [
b"@once",
b"@hourly",
b"@daily",
b"@weekly",
b"*/5 * * * *",
b"0 0 * * *",
b"every 5s",
b"5s",
b"@every 5",
b"@every s",
]:
write_seed("every_parse", i, raw)
i += 1
# Byte payloads ≥ 24 bytes: the boundary-arithmetic leg folds
# adversarial (next_fire_at, now, interval) triples straight out of
# the bytes — the i64::MAX neighborhood, negative shapes, d-blowups.
for raw in [
b"@every 9223372036854775807s skip-forward-triple payload XXXXX",
b"\x00" * 24,
b"\xff" * 24,
bytes([
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, # next = i64::MAX
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, # now = 2^62
0x80, 0xC8, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, # interval = 250000
]),
bytes([
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, # next = i64::MIN + 1
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F, # now = i64::MAX
0x80, 0x92, 0xFC, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, # interval = negative
]),
]:
write_seed("every_parse", i, raw)
i += 1
def main():
payload_codec_seeds()
every_parse_seeds()
if __name__ == "__main__":