# fuzzing hubble-commit

commit blocks come from PDSes we do not trust, and a panic in the firehose
intake task takes the connection down with it. these targets exist to make
sure malformed input produces an error rather than an abort.

```
cargo +nightly fuzz run car    fuzz/corpus/car    fuzz/seeds/car
cargo +nightly fuzz run invert fuzz/corpus/invert fuzz/seeds/invert
```

- **car** — CARv1 framing against arbitrary bytes.
- **invert** — one byte of operation count, three bytes per operation, then the
  CAR. operation CIDs are drawn from the CAR's own blocks, so inputs get past
  trivial mismatches and reach the tree itself rather than only the decoder.

`seeds/` is derived from the vendored mst-test-suite CARs: `car` seeds are
those files verbatim, `invert` seeds are each prefixed with four different
operation specs. they are committed because they are small, deterministic, and
give the fuzzer real trees to mutate from. `corpus/` and `artifacts/` are not.

## found so far

- `Cid::from_bytes_raw` indexed `bytes[3]` with a minimum length of 3, so a
  three-byte CID body panicked. reachable from any DAG-CBOR a peer sends. the
  bug is upstream in dasl 0.2.0 and is fixed in our vendored copy, marked
  `DIVERGES FROM UPSTREAM`; it wants reporting before we un-vendor.