Andy DixonandClaude
cddde5ca52
build.sh builds the Rust targets with the Go-era names, refuses an OUT that is /, $HOME or the tree, checks static linking and names the Go targets Rust cannot build. packaging/package.sh builds and inspects packages without signing or publishing; repo.sh reuses it. Seven fuzz targets (one found a URL-parser panic, fixed here with a regression test), cargo-deny policy, CI for lint, tests on Linux/macOS/Windows, cross builds with qemu runs, supply chain and fuzzing. Compatibility specification and security notes. Co-Authored-By: Claude <noreply@anthropic.com>
16 lines
574 B
Rust
16 lines
574 B
Rust
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
//! The Fury header parser never panics, and accepts only canonical headers:
|
|
//! whatever it accepts re-serialises to exactly the bytes it consumed.
|
|
#![no_main]
|
|
use std::io::Read;
|
|
use vault::crypto::header;
|
|
|
|
libfuzzer_sys::fuzz_target!(|data: &[u8]| {
|
|
if let Ok((h, mut rest)) = header::parse(data) {
|
|
let mut tail = Vec::new();
|
|
rest.read_to_end(&mut tail).unwrap();
|
|
let consumed = &data[..data.len() - tail.len()];
|
|
assert_eq!(h.marshal(), consumed, "non-canonical header accepted");
|
|
}
|
|
});
|