Skip to content

Add fuzzer for compression module#45

Open
AdamKorcz wants to merge 1 commit intopython:mainfrom
AdamKorcz:add-compression-fuzzer
Open

Add fuzzer for compression module#45
AdamKorcz wants to merge 1 commit intopython:mainfrom
AdamKorcz:add-compression-fuzzer

Conversation

@AdamKorcz
Copy link
Copy Markdown
Contributor

@AdamKorcz AdamKorcz commented Apr 10, 2026

Fuzzes the CPython zlib, bz2, and lzma C modules (Modules/zlibmodule.c, Modules/_bz2module.c, Modules/_lzmamodule.c). Dispatches per input across six targets: zlib.decompressobj() with a fuzzed wbits (covering raw, zlib, gzip, and auto headers via -15/0/15/31/47) and an optional zdict, plus optional flush() and copy() to exercise the internal state-copy path; zlib.compress() / compressobj() at fuzzed levels 0–9 with optional copy/flush; zlib.crc32() / adler32(); bz2.compress() and BZ2Decompressor with a per-call output cap; LZMADecompressor across FORMAT_AUTO/XZ/ALONE/RAW (with LZMA2 filter and memlimit tuning); and lzma.compress(). All decompressions use a 1 MiB output cap to keep decompression-bomb inputs bounded.

@AdamKorcz AdamKorcz requested a review from a team as a code owner April 10, 2026 19:57
@AdamKorcz AdamKorcz marked this pull request as draft April 10, 2026 21:26
@AdamKorcz AdamKorcz marked this pull request as draft April 10, 2026 21:26
@AdamKorcz AdamKorcz marked this pull request as draft April 10, 2026 21:26
@AdamKorcz AdamKorcz force-pushed the add-compression-fuzzer branch from f1e1751 to 9dd0ba6 Compare April 11, 2026 21:00
@AdamKorcz AdamKorcz force-pushed the add-compression-fuzzer branch from 9dd0ba6 to 87ac5e2 Compare April 22, 2026 20:32
@AdamKorcz AdamKorcz marked this pull request as ready for review April 22, 2026 20:43
Fuzzes the CPython zlib, bz2, and lzma C modules (Modules/zlibmodule.c,
Modules/_bz2module.c, Modules/_lzmamodule.c). Dispatches per input
across six targets: zlib.decompressobj() with a fuzzed wbits (covering
raw, zlib, gzip, and auto headers via -15/0/15/31/47) and an optional
zdict, plus optional flush() and copy() to exercise the internal
state-copy path; zlib.compress() / compressobj() at fuzzed levels 0–9
with optional copy/flush; zlib.crc32() / adler32(); bz2.compress() and
BZ2Decompressor with a per-call output cap; LZMADecompressor across
FORMAT_AUTO/XZ/ALONE/RAW (with LZMA2 filter and memlimit tuning); and
lzma.compress(). All decompressions use a 1 MiB output cap to keep
decompression-bomb inputs bounded.
@AdamKorcz AdamKorcz force-pushed the add-compression-fuzzer branch from 87ac5e2 to ae7345c Compare April 22, 2026 21:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant