glm-5.3-flash
b10e980346
- VariableEncoding gains MaxLengthReserved (public enum, semver-major
for 0.x; breaks exhaustive matches) — W3-3 root fix
- read_field/write_field correctly treat aligned maxLength reservations
as raw zero-padded/NUL-trimmed windows (W3-3, a0dd3d2)
- plan_read_array bounds check for truncated fixed-stride arrays (W2-1)
- data_access::read_reservation{,_string}/write_reservation public API
- 0.4.0 changelog entry; fuzz Cargo.lock version sync
Verification: cargo test --release 573 passed/0 failed; clippy
--all-targets -D warnings clean; wasm32-unknown-unknown release build
clean; fuzz corpus replay 30/30; cargo doc --no-deps clean;
cargo publish --dry-run --allow-dirty (67 files, 1.3MiB) verified
alktype fuzzing
cargo-fuzz targets for the binary struct engine's untrusted-input
surfaces. The design and operating rules live in
docs/plans/fuzzing.md (adopted from alkhttp's
docs/plans/fuzzing.md; rationale in alkcall's
docs/research/fuzzing.md) — this README is the operational
cheat-sheet.
Layout
fuzz_targets/— nightly-onlyfuzz_target!binaries (thin wrappers).shared/— stable-toolchain library holding the invariant logic; the corpus replay tests run here on plaincargo test.corpus/<target>/— committed seeds (regenerate withpython3 fuzz/gen_fuzz_seeds.py).artifacts/— gitignored crash/oom/timeout artifacts + campaign logs.
Targets
| Target | Drives |
|---|---|
bast_compile |
AlkTypeEngine::compile in both layout modes over attacker-shaped BAST JSON (the whole schema side through one choke point) + validate_bast_doc + build_validator |
data_access |
the hand-rolled decode core (src/data_access.rs): fixed-width kinds, bool strictness, length-prefixed and indirect string/bytes, enums — over raw bytes with attacker-chosen offsets and endianness |
read_opseq |
the stateful SequentialReader (packed read side): op sequences (Next / NextBorrowed / Field / Reset / End) over hostile buffers under the compiled plan — cursor discipline, plan-order walks, the record-count spin bound, ADR-007 reader independence |
layout_build |
the packed write side (LayoutBuilder::build) with adversarial var_sizes over a five-schema menu — position disjointness/bounds, failed-write buffer-untouched contracts, write→read pair round trip |
Running a campaign — always detached
Agent sessions must never run fuzzing in the foreground (an OOM in a target can take down the session host; see docs/plans/fuzzing.md §2). Use the detached runner:
fuzz/run-detached.sh bast_compile
# poll:
tail -n 50 fuzz/artifacts/bast_compile-*.log
ls fuzz/artifacts/bast_compile/
pgrep -f "cargo fuzz run bast_compile"
FUZZ_RUNTIME_SECS=1800 fuzz/run-detached.sh bast_compile for a longer
campaign. The runner pins -fork=1 -rss_limit_mb=2048 -malloc_limit_mb=2048 -timeout=25 and detaches via setsid + nohup.
Corpus replay (the standing fuzz gate)
cargo test --manifest-path fuzz/shared/Cargo.toml
replays every committed seed through the same invariant functions the fuzz targets run — on stable, without nightly, no cargo-fuzz. Part of the release verification checklist (AGENTS.md).
Toolchain
fuzz/rust-toolchain.toml pins nightly (+ llvm-tools-preview) for
this subtree only; the main crate stays stable at MSRV 1.85. cargo fuzz build works from any CWD inside fuzz/ (rustup resolves the
toolchain per directory). Build:
cd fuzz && cargo fuzz build
# or from the repo root — the toolchain file is picked up by path:
cargo fuzz build -D