Skip to content

[fork CI check] Parser tests, fuzzing, gate tests, CodeQL - #1

Closed
deadp wants to merge 6 commits into
mainfrom
test-hardening
Closed

deadp wants to merge 6 commits into
mainfrom
test-hardening

Conversation

@deadp

@deadp deadp commented Sep 16, 2026

Copy link
Copy Markdown
Owner

Validation-only PR inside the fork, to run the new workflows on GitHub runners before proposing upstream. Not for merge.

🤖 Generated with Claude Code

deadp and others added 6 commits September 16, 2026 21:52
Locks in the Host, Origin and Sec-Fetch-Site checks that keep other
origins and DNS-rebinding pages from driving the local interface.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Synthetic images are built in code (tests/imagebuild_*.py) so no evidence
or binary fixture is committed. Ten engine bugs found along the way are
recorded as expected failures, each naming the fault: inline data and
inline directories, sparse extents, extent-tree blow-up, the deleted-file
path without a journal, short and truncated hives, over-broad EWF segment
discovery, truncated zlib chunks, and split raw sets.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Volumes are built in code (FAT32 sparsely, as it needs ~34 MB) and opened
the way the server opens them. Seven engine bugs are recorded as expected
failures: scrambled deleted long names and wrong slack for deleted files
on FAT; an unbounded contiguous run list, truncated contiguous directories
and unconverted UTC offsets on exFAT; invalid MFT records served from the
cache, and a record count that ignores volume size when $MFT is unreadable.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
tests/fuzz.py mutates the synthetic images and drives the app's own entry
points in a child worker, so hangs and memory blow-ups are caught and
their inputs kept for replay. It runs in its own workflow: briefly and
non-blocking on PRs that touch the engine, and at length weekly or on
demand.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
EwfImage._fh is a method, not a handle, so the harness's cleanup raised
on every EWF case and swamped the real findings.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@deadp

deadp commented Sep 16, 2026

Copy link
Copy Markdown
Owner Author

Validation done; proposed upstream as switch-nz#13.

@deadp deadp closed this Sep 16, 2026
@deadp
deadp deleted the test-hardening branch September 17, 2026 03:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant