Skip to content

Fuzzing improvements#15

Merged
cgwalters merged 2 commits intomainfrom
fuzzing-improvements
Mar 3, 2026
Merged

Fuzzing improvements#15
cgwalters merged 2 commits intomainfrom
fuzzing-improvements

Conversation

@cgwalters
Copy link
Collaborator

No description provided.

The differential fuzzer was failing in CI because tar-core correctly
rejects malformed PAX extension records while tar-rs silently skips
them (via .flatten()). This is an intentional strictness difference,
not a bug.

Add a structured allowlist of known behavioral divergences between
tar-core and tar-rs. When tar-core parses fewer entries than tar-rs,
we check whether the terminal error falls into an allowlisted
category before failing the test. Entries that were successfully
parsed by both sides are still compared for correctness.

To support this, add parse_tar_core_detailed() to testutil which
returns both the parsed entries and any terminal ParseError, rather
than silently discarding the error.

Fixes: https://github.com/cgwalters/tar-core/actions/runs/22591594816

Assisted-by: OpenCode (Claude claude-opus-4-6)
The sans-IO parser returns NeedData when given insufficient input,
and callers must retry with more bytes. Previously, fuzz targets
always passed the entire remaining input, so the NeedData/retry
path was only exercised at the very end of truncated inputs.

Now both targets feed the parser through a variable-sized window:
each parse call gets a fresh chunk size (1 byte to 1 MiB) from a
seeded SmallRng, simulating the non-uniform read patterns that real
I/O produces. On NeedData the window grows to the requested minimum
to guarantee forward progress.

Assisted-by: OpenCode (Claude claude-opus-4-6)
@cgwalters cgwalters merged commit 518dcfb into main Mar 3, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant