agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Andrew Dunstan <andrew@dunslane.net>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Add built-in fuzzing harnesses for security testing.
Date: Fri, 10 Apr 2026 13:32:37 +0000
Message-ID: <E1wBByO-000Iys-28@gemulon.postgresql.org> (raw)
Add built-in fuzzing harnesses for security testing.
Add 12 libFuzzer-compatible fuzzing harnesses behind a new -Dfuzzing=true
meson option. Each harness implements LLVMFuzzerTestOneInput() and can
also be built in standalone mode (reading from files) when no fuzzer
engine is detected.
Frontend targets (no backend dependencies):
fuzz_json - non-incremental JSON parser (pg_parse_json)
fuzz_json_incremental - incremental/chunked JSON parser
fuzz_conninfo - libpq connection string parser (PQconninfoParse)
fuzz_pglz - PGLZ decompressor (pglz_decompress)
fuzz_unescapebytea - libpq bytea unescape (PQunescapeBytea)
fuzz_b64decode - base64 decoder (pg_b64_decode)
fuzz_saslprep - SASLprep normalization (pg_saslprep)
fuzz_parsepgarray - array literal parser (parsePGArray)
fuzz_pgbench_expr - pgbench expression parser (via Bison/Flex)
Backend targets (link against postgres_lib):
fuzz_rawparser - SQL raw parser (raw_parser)
fuzz_regex - regex engine (pg_regcomp/pg_regexec)
fuzz_typeinput - type input functions (numeric/date/timestamp/interval)
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/4a18907b412e77684bf888ad6d1b4844d220196a
Modified Files
--------------
meson_options.txt | 3 +
src/test/fuzzing/fuzz_b64decode.c | 98 ++++++++++++++
src/test/fuzzing/fuzz_conninfo.c | 105 +++++++++++++++
src/test/fuzzing/fuzz_json.c | 104 +++++++++++++++
src/test/fuzzing/fuzz_json_incremental.c | 127 ++++++++++++++++++
src/test/fuzzing/fuzz_parsepgarray.c | 102 +++++++++++++++
src/test/fuzzing/fuzz_pgbench_expr.c | 211 ++++++++++++++++++++++++++++++
src/test/fuzzing/fuzz_pglz.c | 127 ++++++++++++++++++
src/test/fuzzing/fuzz_rawparser.c | 162 +++++++++++++++++++++++
src/test/fuzzing/fuzz_regex.c | 193 +++++++++++++++++++++++++++
src/test/fuzzing/fuzz_saslprep.c | 104 +++++++++++++++
src/test/fuzzing/fuzz_typeinput.c | 218 +++++++++++++++++++++++++++++++
src/test/fuzzing/fuzz_unescapebytea.c | 103 +++++++++++++++
src/test/fuzzing/meson.build | 203 ++++++++++++++++++++++++++++
src/test/meson.build | 2 +
15 files changed, 1862 insertions(+)
Message-ID: <E1wBByO-000Iys-28@gemulon.postgresql.org>
Permalink: ../E1wBByO-000Iys-28@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wBByO-000Iys-28@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: andrew@dunslane.net, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add built-in fuzzing harnesses for security testing.
In-Reply-To: <E1wBByO-000Iys-28@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox