chore: make fuzz actually fuzz (DSPX-4903) by dmihalcik-virtru · Pull Request #4096 · opentdf/platform

dmihalcik-virtru · 2026-09-23T18:10:36Z

Problem

make fuzz has never fuzzed anything.

fuzz:
	cd sdk && go test ./... -fuzztime=2m

Without -fuzz=<regexp>, go test treats a FuzzXxx function as an ordinary test that replays only its seed corpus. No mutation, no coverage-guided exploration. -fuzztime is silently ignored when -fuzz is absent:

$ go test -run 'XXXNONE' -fuzztime=20s ./internal/zipstream/
ok  github.com/opentdf/platform/sdk/internal/zipstream  0.298s  [no tests to run]

A 20-second budget returned in 0.3 seconds.

Two more defects in the same two lines:

-fuzz takes one package and one target per invocation. go test ./... -fuzz=... is rejected outright, so this needs a loop, not just an extra flag.
Scope was sdk only, missing lib/ocrypto's FuzzUncompressECPubKey. The sibling test and bench targets both iterate $(HAND_MODS).

Change

Rewrites the target to discover every FuzzXxx across $(HAND_MODS) and run each one with -fuzz. Discovery is dynamic, so a new target is picked up without editing the Makefile. A grep narrows to candidate packages first, because go test -list builds a test binary per package and nearly all of them have no fuzz targets.

Discovery skips testdata and vendor, and a failing go test -list (e.g. a package that does not compile) aborts the run with its errors visible instead of being treated as "no targets" — otherwise make fuzz could pass having fuzzed nothing.

Adds FUZZTIME (default 30s, per target) and fuzz to .PHONY, and documents the target in AGENTS.md — including the crasher workflow, which is a real footgun: Go writes a crasher to testdata/fuzz/<Target>/<hash>, and every later plain go test replays it as a seed, so committing one before its fix turns the whole suite red.

No production code changes. No new fuzz targets, no seed-corpus additions.

Verification

All six targets are now discovered and fuzzed, in both modules:

==> lib/ocrypto . FuzzUncompressECPubKey
==> sdk . FuzzLoadTDF
==> sdk . FuzzNewResourceLocatorFromReader
==> sdk . FuzzNewAttributeNameFQN
==> sdk . FuzzNewAttributeValueFQN
==> sdk ./internal/zipstream FuzzReader

make fuzz FUZZTIME=2s confirms real fuzzing rather than seed replay:

fuzz: elapsed: 0s, gathering baseline coverage: 76/76 completed, now fuzzing with 18 workers

and a failing target propagates a non-zero exit (make: *** [fuzz] Error 1).

Heads-up: this makes `make fuzz` fail on `main` today

Within ~1 second of actually fuzzing, FuzzReader finds a live panic:

panic: runtime error: makeslice: len out of range
  readBytes(...)        reader.go:375
  ReadAllFileData(...)  reader.go:354

A ZIP64 size field ≥ 2^63 converts to a negative int64 at reader.go:173, passes the upper-bound-only check at reader.go:350, and reaches make([]byte, negative).

That bug is already fixed by #4043 / DSPX-4590 (in review), whose code comment describes this exact failure mode. It is deliberately not fixed here — this PR is the runner only. So make fuzz will fail on main until DSPX-4590 lands. That is the target doing its job, and it is safe: make fuzz is not referenced anywhere in .github/, so nothing in CI depends on it and this cannot turn CI red.

Wiring fuzzing into CI is intentionally out of scope; it needs corpus persistence and a triage story first, and should be its own ticket.

Testing notes

make fuzz FUZZTIME=2s — discovery, real fuzzing, non-zero exit on failure, all verified above.
No Go code touched, so make test / make lint are unaffected.
Any crashers produced during verification were removed; this branch adds no testdata/fuzz files.

Summary by CodeRabbit

New Features
- Added make fuzz to discover and run fuzz tests across supported packages, with a configurable run time.
Documentation
- Clarified how fuzzing differs from make test, how to configure its run time, where Go stores crash cases, and how to preserve a crash case with its fix.

coderabbitai · 2026-09-23T18:10:46Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 34e138d0-d145-477c-b288-00c314685792

📥 Commits

Reviewing files that changed from the base of the PR and between 8232392 and bf58ec7.

📒 Files selected for processing (2)

AGENTS.md
Makefile

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The Makefile adds make fuzz to discover fuzz targets across HAND_MODS and run each target for a configurable duration. AGENTS.md documents the command, seed replay, crash-corpus location, and crasher handling.

Changes

Fuzz target workflow

Layer / File(s)	Summary
Discover and run fuzz targets `Makefile`, `AGENTS.md`	The Makefile discovers fuzz targets across `HAND_MODS`, excludes `testdata` and `vendor`, and runs each target for `FUZZTIME` (default `30s`). It stops on listing or fuzz-test failures. `AGENTS.md` documents the command and explains seed replay, crash-corpus location, and committing crashers with their fixes.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: marythought

Merge Risk: ⚪ Minimal · up to bf58e

No actionable issue introduced by this change remains; the fuzz target's documented behavior matches its implementation.

Architecture Summary

Architecture risk: 🔵 Low · up to bf58e

The change affects 2 systems.

Changed systems: AGENTS.md, Makefile

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

observed — AGENTS.md (service) was modified; 1 changed file maps to changed impact.
observed — Makefile (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

observed — Modified behavior in AGENTS.md: Adds make fuzz to the documented commands, noting that it fuzzes all FuzzXxx targets and is not included in make test or CI.
observed — Modified behavior in AGENTS.md: Adds fuzz-test guidance covering make fuzz, the FUZZTIME override, seed replay by ordinary go test, Go’s crasher-file location, and committing crashers with their fixes.
observed — Modified behavior in Makefile: Adds fuzz to the Makefile’s .PHONY targets.
observed — Modified behavior in Makefile: Adds the FUZZTIME default and comments describing per-target time budgeting, fuzz target discovery and execution constraints, failure handling, and crasher corpus behavior.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: updating make fuzz to perform real fuzzing across discovered FuzzXxx targets. The DSPX-4903 reference is acceptable and does not reduce clarity.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit finds the fuzzers’ trail
Each target gets its timed-out tale
Seed cases wait for tests to run
Crashers join their fixes, one by one
The burrow hums; the work is done.}

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-23T18:16:48Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	245.657415ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	133.379653ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	469.554454ms
Throughput	212.97 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	58.99405566s
Average Latency	588.69756ms
Throughput	84.75 requests/second

github-actions · 2026-09-23T18:25:35Z

X-Test Results

✅ go@main-main
✅ java@main-main
✅ js@main-main
✅ go@pull-4096-v0.9.0
bats-test-results
✅ js@main-pull-4096
✅ js@main-v0.9.0
✅ java@main-pull-4096
govulncheck-failure-1
✅ java@main-v0.9.0
✅ go@pull-4096-pull-4096
govulncheck-failure-8
opentdf~~platform~~L13TYI.dockerbuild
cukes-report
✅ go@main-pull-4096
✅ go@pull-4096-main
✅ go@main-v0.9.0
govulncheck-failure-3

Previously stderr from 'go test -list' was discarded, so a package that failed to compile was treated as having no fuzz targets and 'make fuzz' could pass having fuzzed nothing. Abort with the errors visible instead, and skip testdata and vendor when discovering candidate packages. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

github-actions · 2026-10-01T16:35:03Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	121.304046ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	72.742721ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	251.395904ms
Throughput	397.78 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.50050456s
Average Latency	364.149457ms
Throughput	136.98 requests/second

github-actions · 2026-10-01T16:38:57Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

otdfctl
service
tests-bdd

See the workflow run for details.

github-actions · 2026-10-01T16:45:19Z

X-Test Results

✅ js@main-pull-4096
✅ go@main-pull-4096
✅ java@main-v0.9.0
✅ go@main-v0.9.0
bats-test-results
✅ go@pull-4096-pull-4096
✅ go@pull-4096-main
govulncheck-failure-1
✅ java@main-pull-4096
✅ js@main-main
✅ go@main-main
govulncheck-failure-3
govulncheck-failure-8
✅ go@pull-4096-v0.9.0
✅ java@main-main
✅ js@main-v0.9.0
opentdf~~platform~~DIQ2QI.dockerbuild

dmihalcik-virtru requested a review from a team as a code owner September 23, 2026 18:10

github-actions Bot added the size/s label Sep 23, 2026

build: make fuzz actually fuzz (DSPX-4903)

56ef391

dmihalcik-virtru changed the title ~~build: make fuzz actually fuzz (DSPX-4903)~~ chore: make fuzz actually fuzz (DSPX-4903) Oct 1, 2026

dmihalcik-virtru force-pushed the dspx-4903-make-fuzz-actually-fuzz branch from 34caae5 to bf58ec7 Compare October 1, 2026 16:30

elizabethhealy approved these changes Oct 1, 2026

View reviewed changes

pflynn-virtru approved these changes Oct 1, 2026

View reviewed changes

dmihalcik-virtru added this pull request to the merge queue Oct 1, 2026

Merged via the queue into main with commit 38f60cb Oct 1, 2026
49 checks passed

dmihalcik-virtru deleted the dspx-4903-make-fuzz-actually-fuzz branch October 1, 2026 19:14

Navigation Menu

chore: make fuzz actually fuzz (DSPX-4903) - #4096

chore: make fuzz actually fuzz (DSPX-4903)#4096
dmihalcik-virtru merged 2 commits into
mainfrom
dspx-4903-make-fuzz-actually-fuzz

dmihalcik-virtru commented Sep 23, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Sep 23, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-actions Bot commented Sep 23, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dmihalcik-virtru commented Sep 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Change

Verification

Heads-up: this makes make fuzz fail on main today

Testing notes

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Architecture Summary

Uh oh!

github-actions Bot commented Sep 23, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 23, 2026

X-Test Results

Uh oh!

github-actions Bot commented Oct 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Oct 1, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions Bot commented Oct 1, 2026

X-Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dmihalcik-virtru commented Sep 23, 2026 •

edited by coderabbitai Bot

Loading

Heads-up: this makes `make fuzz` fail on `main` today

coderabbitai Bot commented Sep 23, 2026 •

edited

Loading