Fuzz targets for the preprocessor and the compiler #16

New issue

Closed

opened 2026-10-14 01:26:58 -05:00 by jeff · 1 comment

jeff commented

2026-10-14 01:26:58 -05:00

Owner

Parent

Part of #1

What to build

Fuzz targets on Zig's built-in fuzzer for preprocessing and for compiling, with a seed corpus drawn from the test fixtures. Any input either produces a result or diagnostics; none panics, leaks or hangs.

Acceptance criteria

zig build fuzz --fuzz fuzzes both targets, with coverage (test binaries built with LLVM).
The seed corpus runs as ordinary tests under zig build test.
CI runs a bounded fuzz run on every push.
Every finding fixed along the way gets a regression input in the corpus.

## Parent Part of #1 ## What to build Fuzz targets on Zig's built-in fuzzer for preprocessing and for compiling, with a seed corpus drawn from the test fixtures. Any input either produces a result or diagnostics; none panics, leaks or hangs. ## Acceptance criteria - [ ] `zig build fuzz --fuzz` fuzzes both targets, with coverage (test binaries built with LLVM). - [ ] The seed corpus runs as ordinary tests under `zig build test`. - [ ] CI runs a bounded fuzz run on every push. - [ ] Every finding fixed along the way gets a regression input in the corpus.

jeff added the

ready-for-agent

label

2026-10-14 01:26:58 -05:00

jeff added a new dependency

2026-10-14 01:27:07 -05:00

#7 Preprocessor: conditionals, includes and foreach

jeff added a new dependency

2026-10-14 01:27:07 -05:00

#8 Fragments, references and several WiX sources

jeff self-assigned this

2026-10-14 05:40:09 -05:00

jeff referenced this issue from a commit

2026-10-14 06:26:51 -05:00

Fuzz the preprocessor and the whole build (#16)

jeff commented

2026-10-14 06:56:47 -05:00

Author

Owner

Done in 591e638 (CI run 12 green), with the bound lowered to 10K in the commit after.

The targets: two fuzz targets on Zig's built-in fuzzer, built with LLVM so coverage guides it. One preprocesses arbitrary text; the other runs an arbitrary WiX source through the whole build, preprocessing, compiling, linking and writing, cabinets included. A failure without a diagnostic fails the target.
Seed corpus: every end-to-end fixture, length-prefixed as Smith.slice reads it. The corpus runs as ordinary tests under zig build test, and tests/fuzz/regressions.zig is where a found input goes.
CI: a bounded run. 10K keeps the test job to a few minutes; 50K took it from about eight minutes to twenty.
Results: about 1.7 million runs across both targets locally found nothing. Coverage levels off around 23% of the instrumented binary.
Fixed in advance: includes and loops can each repeat what they hold, and together without bound, so preprocessing now stops with an error past 64 MiB of output.

Done in 591e638 (CI run 12 green), with the bound lowered to 10K in the commit after. - **The targets:** two fuzz targets on Zig's built-in fuzzer, built with LLVM so coverage guides it. One preprocesses arbitrary text; the other runs an arbitrary WiX source through the whole build, preprocessing, compiling, linking and writing, cabinets included. A failure without a diagnostic fails the target. - **Seed corpus:** every end-to-end fixture, length-prefixed as `Smith.slice` reads it. The corpus runs as ordinary tests under `zig build test`, and `tests/fuzz/regressions.zig` is where a found input goes. - **CI:** a bounded run. 10K keeps the test job to a few minutes; 50K took it from about eight minutes to twenty. - **Results:** about 1.7 million runs across both targets locally found nothing. Coverage levels off around 23% of the instrumented binary. - **Fixed in advance:** includes and loops can each repeat what they hold, and together without bound, so preprocessing now stops with an error past 64 MiB of output.

jeff closed this issue

2026-10-14 06:56:47 -05:00