test(fuzz): fuzz B-tree v2 traversal, not just header parsing

The existing target only called `BTreeV2Header::parse`, so the
recursive walk behind it — where a node that is its own child overflowed
the stack — was never fuzzed at all. Parsing also requires a valid
Jenkins checksum, which random input essentially never produces, so
almost every input stopped at the first branch.

The target now walks the tree after a successful parse, and also builds
a header straight from the input bytes so the traversal is reachable
without forging a checksum.

Checked both ways: against the unfixed traversal libFuzzer finds the
stack overflow (ASan: stack-overflow), and against the fix that same
input executes in 0 ms and 34.7 million further runs produce no crash,
timeout or OOM.

Corpora and crash artifacts stay out of the repository; the two crafted
inputs are covered by unit tests instead.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

This commit is contained in:

osobh

2026-09-20 17:03:21 -07:00

co-authored by

Claude Opus 5

parent e9aeb110b7

commit 0901fb1499

2 changed files with 30 additions and 6 deletions

crates/clawhdf5-format/fuzz/.gitignore

View File

@@ -1 +1,4 @@
 target/
 corpus/
 artifacts/
 coverage/