fuzz: seed ipc_body with the daemon-stop bodies #226

Merged

natsukium merged 1 commit from issue-152 into main 2026-09-08 21:49:05 +09:00

Conversation 0 Commits 1 Files changed 3 +2

natsukium commented 2026-09-08 20:21:19 +09:00

Owner

Copy link

The extend-ipc checklist asks for a curated fuzz/seeds/ipc_body/ seed per new message, and the daemon-stop pair shipped without one. Nothing failed as a result — the gap only meant libFuzzer had to rediscover the OpsStop / OpsStopReply tags on its own, and both an empty submessage nested in a oneof and an AttachFailure value at the top of the enum range are shapes random mutation reaches late. These three seeds put those arms in front of the first mutations.

Seeds added (bytes produced by felis_protocol::codec::encode, so they decode to the messages their names claim):

• proto-ops-stop-when-empty.bin — OpsMsg::Stop { mode: WhenEmpty }
• proto-ops-stop-reply-draining.bin — OpsMsg::StopReply { outcome: Draining { sessions: 2 } }
• proto-session-attach-failed-draining.bin — SessionMsg::AttachFailed { reason: DaemonDraining, .. }

Verified with ./fuzz/seed-corpus.sh plus cargo fuzz run ipc_body -- -runs=10000 (clean) and a full just check (clean).

Fixes #152

The `extend-ipc` checklist asks for a curated `fuzz/seeds/ipc_body/` seed per new message, and the daemon-stop pair shipped without one. Nothing failed as a result — the gap only meant libFuzzer had to rediscover the `OpsStop` / `OpsStopReply` tags on its own, and both an empty submessage nested in a oneof and an `AttachFailure` value at the top of the enum range are shapes random mutation reaches late. These three seeds put those arms in front of the first mutations. Seeds added (bytes produced by `felis_protocol::codec::encode`, so they decode to the messages their names claim): - `proto-ops-stop-when-empty.bin` — `OpsMsg::Stop { mode: WhenEmpty }` - `proto-ops-stop-reply-draining.bin` — `OpsMsg::StopReply { outcome: Draining { sessions: 2 } }` - `proto-session-attach-failed-draining.bin` — `SessionMsg::AttachFailed { reason: DaemonDraining, .. }` Verified with `./fuzz/seed-corpus.sh` plus `cargo fuzz run ipc_body -- -runs=10000` (clean) and a full `just check` (clean). Fixes #152

natsukium added 1 commit 2026-09-08 20:21:19 +09:00

fuzz: seed ipc_body with the daemon-stop bodies ... c8d92542a1

The daemon-stop pair and the drain refusal reason reached the wire
without a curated seed, so libFuzzer had to rediscover their tags from
scratch: a `StopIfEmpty`-style empty submessage nested in a oneof and an
`AttachFailure` value at the top of the enum range are exactly the
shapes random mutation finds late. Priming the corpus puts the
`OpsStop` / `OpsStopReply` arms and the `DAEMON_DRAINING` sentinel in
reach of the first mutations instead.

Assisted-by: Claude Code

natsukium force-pushed issue-152 from c8d92542a1 to ae86753293 2026-09-08 20:40:05 +09:00 Compare

natsukium merged commit 500a615c72 into main 2026-09-08 21:49:05 +09:00

natsukium deleted branch issue-152 2026-09-08 21:49:05 +09:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

priority/P0

Must be resolved before the v0.1.0 tag

  

priority/P1

Must be settled before the first public contract freezes

  

priority/P2

Explicitly deferred until after v0.1.0

  

release/v0.1.0

Work tracked for the first tagged release

  

status/blocked

Cannot start now: waits on an upstream release, another issue, or a recorded revisit trigger

  

status/planned

Triaged with a source-grounded plan and a passed pi review; ready to implement

  

type/bug

Shipped behavior that contradicts the docs or the code's own intent; needs a product code change

  

type/design

An open scope or trade-off question; needs a recorded decision in the owning explanation doc before code

  

type/test-gap

Documented or reviewed behavior that no test pins; usually split from a review finding, needs no product code change

  

type/tracker

Parent issue that tracks child work

No labels

priority/P0

priority/P1

priority/P2

release/v0.1.0

status/blocked

status/planned

type/bug

type/design

type/test-gap

type/tracker

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

natsukium/felis!226

No description provided.