Fuzz Testing for rustyhdf5-format

Uses cargo-fuzz (libFuzzer) to test parser robustness against malformed inputs.

Prerequisites

cargo install cargo-fuzz
rustup toolchain install nightly

Fuzz Targets

Target	Parser	Description
`fuzz_superblock`	`Superblock::parse`	Superblock parsing (v0-v3) with signature search
`fuzz_object_header`	`ObjectHeader::parse`	Object header v1/v2 with various offset/length sizes
`fuzz_datatype`	`Datatype::parse`	All 12 HDF5 datatype classes (recursive)
`fuzz_dataspace`	`Dataspace::parse`	Dataspace messages with various length sizes
`fuzz_fractal_heap`	`FractalHeapHeader::parse`	Fractal heap header parsing
`fuzz_btree_v2`	`BTreeV2Header::parse`	B-tree v2 header parsing
`fuzz_filter_pipeline`	`FilterPipeline::parse`	Filter pipeline messages (v1/v2)
`fuzz_full_file`	signature + superblock + root group	End-to-end file parsing chain

Running

Run a single target (runs indefinitely until stopped or a crash is found):

cd crates/rustyhdf5-format
cargo +nightly fuzz run fuzz_datatype

Run with a time limit (seconds):

cargo +nightly fuzz run fuzz_datatype -- -max_total_time=60

Run all targets for 30 seconds each:

for target in fuzz_superblock fuzz_object_header fuzz_datatype fuzz_dataspace \
              fuzz_fractal_heap fuzz_btree_v2 fuzz_filter_pipeline fuzz_full_file; do
    echo "=== $target ==="
    cargo +nightly fuzz run "$target" -- -max_total_time=30 -max_len=4096
done

Reproducing Crashes

If a crash is found, the input is saved to fuzz/artifacts/<target>/. Reproduce with:

cargo +nightly fuzz run fuzz_datatype fuzz/artifacts/fuzz_datatype/crash-<hash>

Minimize the crashing input:

cargo +nightly fuzz tmin fuzz_datatype fuzz/artifacts/fuzz_datatype/crash-<hash>

Design

Each fuzz target feeds arbitrary bytes directly to a parser entry point. The parsers must never panic on any input -- they should return Err(FormatError) for malformed data. Any panic found by fuzzing is a bug that should be fixed with proper bounds checks and error returns.

2.2 KiB Raw Blame History