glm-5.3-flash
752e36b526
- bast_compile smoke: 543k execs, 10830 edges, coverage still growing at budget end; data_access smoke: 3.5M execs, saturated at 379 edges - both exited 0, empty artifact dirs, oom/timeout/crash 0/0/0 - json.dict: libFuzzer's parser rejects \u escapes and unquoted tails (caught at campaign launch, not by the fuzzer) - plan doc §3/§5/§6/§7 updated with wave-1 results
alktype fuzzing
cargo-fuzz targets for the binary struct engine's untrusted-input
surfaces. The design and operating rules live in
docs/plans/fuzzing.md (adopted from alkhttp's
docs/plans/fuzzing.md; rationale in alkcall's
docs/research/fuzzing.md) — this README is the operational
cheat-sheet.
Layout
fuzz_targets/— nightly-onlyfuzz_target!binaries (thin wrappers).shared/— stable-toolchain library holding the invariant logic; the corpus replay tests run here on plaincargo test.corpus/<target>/— committed seeds (regenerate withpython3 fuzz/gen_fuzz_seeds.py).artifacts/— gitignored crash/oom/timeout artifacts + campaign logs.
Targets
| Target | Drives |
|---|---|
bast_compile |
AlkTypeEngine::compile in both layout modes over attacker-shaped BAST JSON (the whole schema side through one choke point) + validate_bast_doc + build_validator |
data_access |
the hand-rolled decode core (src/data_access.rs): fixed-width kinds, bool strictness, length-prefixed and indirect string/bytes, enums — over raw bytes with attacker-chosen offsets and endianness |
Running a campaign — always detached
Agent sessions must never run fuzzing in the foreground (an OOM in a target can take down the session host; see docs/plans/fuzzing.md §2). Use the detached runner:
fuzz/run-detached.sh bast_compile
# poll:
tail -n 50 fuzz/artifacts/bast_compile-*.log
ls fuzz/artifacts/bast_compile/
pgrep -f "cargo fuzz run bast_compile"
FUZZ_RUNTIME_SECS=1800 fuzz/run-detached.sh bast_compile for a longer
campaign. The runner pins -fork=1 -rss_limit_mb=2048 -malloc_limit_mb=2048 -timeout=25 and detaches via setsid + nohup.
Corpus replay (the standing fuzz gate)
cargo test --manifest-path fuzz/shared/Cargo.toml
replays every committed seed through the same invariant functions the fuzz targets run — on stable, without nightly, no cargo-fuzz. Part of the release verification checklist (AGENTS.md).
Toolchain
fuzz/rust-toolchain.toml pins nightly (+ llvm-tools-preview) for
this subtree only; the main crate stays stable at MSRV 1.85. cargo fuzz build works from any CWD inside fuzz/ (rustup resolves the
toolchain per directory). Build:
cd fuzz && cargo fuzz build
# or from the repo root — the toolchain file is picked up by path:
cargo fuzz build -D