# Libraries and parsers: bounded fuzzing to a minimal reproducer

Build a realistic local harness, instrument the target, bound fuzzing resources, and turn unique faults into defensible library or consumer reports.

## Investigation sequence

1. Choose contract
2. Build harness
3. Instrument target
4. Fuzz within bounds
5. Minimize root cause
6. Verify consumer impact

## Used in these playbooks

[OSS & self-hosted](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/oss.html) · [Desktop & extensions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/desktop.html) · [Mobile](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/mobile.html) · [Network services](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/network.html) · [Hardware & firmware](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/hardware.html) · [AI, agents & MCP](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/ai.html)

## Choose an attacker-relevant parser contract

Select a public API and a realistic input boundary: imported image, archive, document, packet, model file, project metadata, or CLI input file. Record who supplies bytes, the consumer's preprocessing, format limits, parser options, and the privilege of the process. Fuzzing an internal helper with impossible arguments may reveal a harness defect rather than a violated library contract.

Keep the first harness narrow: one parse operation, deterministic configuration, fresh state for each input, bounded allocations, and cleanup on both success and failure. Remove network and uncontrolled filesystem side effects. Seed with a few valid, small representative samples to reach deeper code; an all-random corpus may spend every iteration failing the magic-header check.

## Harness and build cheat sheet

The following is a **template**: `product_parser.h`, `ProductDocument`, and the parser functions are placeholders to replace with the target's documented API. Return/error ownership must follow that API. The commands have not been executed here.

```cpp
#include <cstddef>
#include <cstdint>
#include "product_parser.h"

extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
    if (size > 65536) return 0;
    ProductDocument* doc = product_parse(data, size);
    if (doc != nullptr) product_document_free(doc);
    return 0;
}
```

Build the target library itself with compatible sanitizer and coverage instrumentation; instrumenting only the harness misses much of the parser's behavior. Replace the source list with its reviewed build recipe. The example assumes Clang and a compatible C++ project. [AddressSanitizer build guidance](https://clang.llvm.org/docs/AddressSanitizer.html).

```bash
clang++ -g -O1 -fno-omit-frame-pointer \
  -fsanitize=fuzzer,address,undefined -fno-sanitize-recover=undefined \
  ./fuzz_parser.cc ./parser.cc -o ./fuzz_parser
mkdir -p ./corpus ./artifacts ./evidence
./fuzz_parser ./corpus -max_total_time=120 -timeout=2 \
  -rss_limit_mb=512 -max_len=65536 -artifact_prefix=./artifacts/
```

Add reviewed seed files before running. libFuzzer's time, input-length, timeout, and RSS settings bound the campaign; they are not a VM resource boundary. Run inside your local disposable environment with external memory/CPU limits appropriate for the workload. Track new coverage and distinct root causes rather than raw executions. [libFuzzer reference](https://llvm.org/docs/LibFuzzer.html).

## Interpret the failure precisely

| Observation | Immediate question | Defensible first claim |
|---|---|---|
| ASan heap read overflow | Does the public API permit this byte sequence? | Out-of-bounds read in the tested build |
| ASan write overflow | Which length check and allocation disagree? | Out-of-bounds write; execution impact unproven |
| Use-after-free | Did the harness violate ownership rules? | Lifetime defect if public usage is valid |
| UBSan arithmetic finding | Does overflow reach an unsafe allocation/index? | Undefined operation plus traced consequence |
| Timeout or RSS limit | Is it reproducible at modest input sizes? | Bounded evidence of resource exhaustion |

`-fno-sanitize-recover=undefined` makes the selected UBSan failures terminate instead of allowing a fuzzing run to continue after a diagnostic, which helps preserve reproducible failing inputs. UBSan checks selected undefined behaviors, not every arithmetic error. Unsigned integer wrap is defined in C/C++ and is not part of the default `undefined` group; choose additional checks when the target's threat model requires them. [UndefinedBehaviorSanitizer](https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html).

## Minimize and verify the consumer

Copy one candidate into `./artifacts/repro.bin`, then minimize with a unique output path. Preserve the original input, toolchain, build flags, revision, and symbolized trace.

```bash
./fuzz_parser -timeout=2 -rss_limit_mb=512 ./artifacts/repro.bin
./fuzz_parser -minimize_crash=1 -max_total_time=60 -timeout=2 -rss_limit_mb=512 \
  -exact_artifact_path=./artifacts/minimized.bin ./artifacts/repro.bin
```

Replay the minimized bytes through a supported consumer in the [pinned OSS lab](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/oss-lab-reproduction.html). If the consumer rejects them before calling the library, report the library contract separately and leave consumer exposure unproven. A sanitizer crash is not proof of remote code execution, and its absence in an optimized build does not erase a confirmed memory-safety defect.

Hypothetical root cause: a header count is multiplied into a narrow allocation size, then a wider loop trusts the original count. Preserve the values, allocation site, failing access, and missing bound. The fix should bind accepted count to available input and checked allocation size; merely suppressing the crash is insufficient.

- [ ] Public API and ownership contract respected.
- [ ] Target code, not only harness, instrumented.
- [ ] Resources, seeds, revision, and toolchain recorded.
- [ ] Minimal input reproduces the same root cause.
- [ ] Normal input succeeds in affected and fixed builds.
- [ ] Library impact and real consumer exposure are stated separately.

Replay timeout and memory artifacts under the same resource limits as discovery. A minimized crash must retain the original root cause; a shorter input that fails differently is not equivalent evidence.


## Vulnerability reverse references

- [JavaScript prototype pollution](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/prototype-pollution.html) — An attacker-controlled property path changes inherited object state, which can affect unrelated objects and security-sensitive consumers.
- [Out-of-bounds memory read](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/out-of-bounds-read.html) — A parser or native consumer reads outside the valid extent of an object or buffer, potentially causing a crash or disclosure depending on how the result is used.
- [Out-of-bounds memory write](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/out-of-bounds-write.html) — A native component writes beyond an allocated object because length, index, or allocation assumptions do not agree.
- [Use after free in a public API or parser lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/use-after-free.html) — Code uses an object after its lifetime has ended, often across callbacks, error handling, reference counting, or asynchronous operations.
- [Integer overflow affecting allocation or bounds](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/integer-overflow.html) — Input-derived arithmetic wraps or overflows so the checked size, allocation size, and later operation refer to different effective values.
- [Parser resource exhaustion and decompression amplification](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/parser-resource-exhaustion.html) — A small accepted input causes disproportionate CPU, memory, recursion, or expanded output consumption without effective limits at the relevant consumer.
- [Regular-expression denial of service](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/regex-dos.html) — An attacker-controlled string makes the chosen regular-expression engine perform excessive backtracking or other disproportionate matching work.