mirror of
https://github.com/xroche/httrack.git
synced 2026-07-24 01:29:49 +03:00
a707d4b845
* Add libFuzzer harnesses for the HTTP header and cache-index parsers P3-5 fuzz Tier-2. Two more harnesses over hostile-input parsers that read structured bytes into fixed buffers: fuzz-header drives treatfirstline plus treathead on each response-header line (the Content-Type/-Encoding path hardened in #506, and the cookie/Location/Content-Range fields); fuzz-cachendx drives the hts-cache/*.ndx length-prefixed scan that cache_readex_new loads on --update. fuzz-cachendx found the over-advance fixed in the parent commit; its seed corpus carries the two crash reproducers as replay regressions. The cache harness stops at the scan rather than the trailing coucal insert, whose murmur hash trips a separate pointer-overflow the .ndx parser does not own. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com> * Correct copyright year on the new fuzz harnesses (2026) fuzz-header.c and fuzz-cachendx.c are new in the 2026 audit cycle; match the sibling *_selftest.c files rather than the boilerplate 1998. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com> --------- Signed-off-by: Xavier Roche <roche@httrack.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>