oversight-rust/fuzz/README.md

34 lines · markdown

# Oversight fuzz harnesses
 
Two libFuzzer-based harnesses for the security-critical parsers:
- `container_parser` - hammers the `.sealed` binary format parser
- `manifest_parser` - hammers the canonical-JSON manifest parser
 
## Setup (one time)
 
```bash
cargo install cargo-fuzz
```
 
Requires a nightly Rust toolchain for fuzzing (sanitizers, coverage):
```bash
rustup install nightly
```
 
## Run
 
```bash
cd oversight-rust/fuzz
cargo +nightly fuzz run container_parser -- -max_total_time=300
cargo +nightly fuzz run manifest_parser -- -max_total_time=300
```
 
## What "pass" looks like
 
The harness runs until you stop it. "Pass" means: no panics, no hangs,
no OOMs, no memory safety violations (Rust + libFuzzer's AddressSanitizer
catches memory bugs). Any crash input is saved to `fuzz/artifacts/...` for
reproduction.
 
Target: run continuously for at least 24 hours before a paid security audit
engagement, per our ROADMAP.md prerequisites.

1	# Oversight fuzz harnesses
2
3	Two libFuzzer-based harnesses for the security-critical parsers:
4	- `container_parser` - hammers the `.sealed` binary format parser
5	- `manifest_parser` - hammers the canonical-JSON manifest parser
6
7	## Setup (one time)
8
9	```bash
10	cargo install cargo-fuzz
11	```
12
13	Requires a nightly Rust toolchain for fuzzing (sanitizers, coverage):
14	```bash
15	rustup install nightly
16	```
17
18	## Run
19
20	```bash
21	cd oversight-rust/fuzz
22	cargo +nightly fuzz run container_parser -- -max_total_time=300
23	cargo +nightly fuzz run manifest_parser -- -max_total_time=300
24	```
25
26	## What "pass" looks like
27
28	The harness runs until you stop it. "Pass" means: no panics, no hangs,
29	no OOMs, no memory safety violations (Rust + libFuzzer's AddressSanitizer
30	catches memory bugs). Any crash input is saved to `fuzz/artifacts/...` for
31	reproduction.
32
33	Target: run continuously for at least 24 hours before a paid security audit
34	engagement, per our ROADMAP.md prerequisites.