test: Improve AFL++ fuzzing infrastructure by vyavdoshenko · Pull Request #6618 · dragonflydb/dragonfly

vyavdoshenko · 2026-02-13T15:32:29Z

Expand seed corpus, add RESP-aware custom mutator, and improve fuzzing tooling.

Changes:
Custom mutator (fuzz/resp_mutator.py):

AFL++ Python mutator that parses RESP and mutates at the command/argument level instead of random bytes
Knows 150+ Dragonfly commands with correct arities
Mutations: replace/insert/remove commands, mutate arguments, wrap in MULTI/EXEC, swap order
Runs alongside AFL++ built-in mutations (havoc integration at 50%)

Seed corpus (fuzz/seeds/resp/):

Expanded from 17 to 79 seeds covering all command families (string, list, hash, set, zset, stream, JSON, search, bloom, geo, HLL, bitops, scripting, ACL, pub/sub, transactions, server ops)

Fuzzing scripts (fuzz/run_fuzzer.sh):

Default to 1 proactor thread for stable coverage
Sync AFL_PERSISTENT_RECORD with afl_loop_limit (default 10000) for full crash replay
Auto-configure system (core_pattern, CPU governor)
512KB AFL bitmap (AFL_MAP_SIZE) to reduce hash collisions
Load custom mutator automatically

Dictionary (fuzz/dict/resp.dict):

Added 200+ tokens: missing commands, subcommands, arguments, malformed RESP patterns, and inline commands
Removed duplicate entries and oversized tokens (AFL++ warns on >33B)

Crash tooling:

replay_crash.py — replays RECORD files against a running instance
package_crash.sh — packages crash + RECORD files into a self-contained archive

Minor (src/server/dfly_main.cc):

Reduce fuzz client socket timeout from 2s to 200ms
Use MSG_NOSIGNAL to avoid SIGPIPE

Closes: #5713
Closes: #5710
Closes: #5708

Copilot

Pull request overview

This PR significantly improves Dragonfly's AFL++ fuzzing infrastructure to make it more effective at finding bugs and easier to reproduce crashes. The changes implement a RESP-aware custom mutator, expand the seed corpus from 17 to 79 files covering all command families, improve crash replay capabilities, and optimize AFL++ configuration for better coverage stability and crash reproducibility.

Changes:

Added custom RESP mutator that operates at command/argument level instead of random bytes
Expanded seed corpus to 79 files covering all Redis command families (string, list, hash, set, zset, stream, JSON, search, bloom, geo, HLL, bitops, scripting, ACL, pub/sub, transactions, server ops)
Improved AFL++ configuration with persistent record for full crash replay, optimized bitmap size, and better system configuration
Added crash replay tooling (replay_crash.py, package_crash.sh) for reproducing and sharing crashes
Reduced fuzz client socket timeout from 2s to 200ms and added MSG_NOSIGNAL to prevent SIGPIPE
Enhanced dictionary with 200+ tokens while removing duplicates and oversized entries
Updated documentation with comprehensive fuzzing instructions

Reviewed changes

Copilot reviewed 69 out of 69 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/server/dfly_main.cc	Reduced socket timeout to 200ms, added MSG_NOSIGNAL flag
fuzz/resp_mutator.py	AFL++ custom mutator for RESP protocol with 150+ commands
fuzz/run_fuzzer.sh	AFL++ wrapper script with system configuration and environment setup
fuzz/replay_crash.py	Tool to replay crashes from AFL_PERSISTENT_RECORD files
fuzz/package_crash.sh	Script to package crashes for sharing with developers
fuzz/seeds/resp/*	79 seed files covering all command families
fuzz/dict/resp.dict	Enhanced dictionary with duplicates removed
fuzz/FUZZING.md	Comprehensive fuzzing documentation

Copilot · 2026-02-13T15:37:49Z

fuzz/resp_mutator.py

+"""
+
+import random
+import struct


Import of 'struct' is not used.

Suggested change

import struct

Copilot · 2026-02-13T15:37:49Z

fuzz/replay_crash.py

+    except Exception:
+        pass
+
+    try:
+        s.recv(4096)
+    except Exception:
+        pass


'except' clause does nothing but pass and there is no explanatory comment.

Suggested change

except Exception:

pass

try:

s.recv(4096)

except Exception:

pass

except Exception as e:

sys.stderr.write(f"\033[0;31m[WARN]\033[0m Failed to send data: {e}\n")

try:

s.recv(4096)

except Exception as e:

sys.stderr.write(f"\033[0;31m[WARN]\033[0m Failed to receive response: {e}\n")

Copilot · 2026-02-13T15:37:49Z

fuzz/replay_crash.py

+    except Exception:
+        pass
+
+    try:
+        s.recv(4096)
+    except Exception:
+        pass


'except' clause does nothing but pass and there is no explanatory comment.

Suggested change

except Exception:

pass

try:

s.recv(4096)

except Exception:

pass

except OSError as exc:

# Ignore send errors: the fuzzer only needs best-effort delivery.

print(f"\033[0;33m[WARN]\033[0m Send failed: {exc}", file=sys.stderr)

try:

s.recv(4096)

except OSError as exc:

# Ignore receive errors: crash reproduction only depends on what was sent.

print(f"\033[0;33m[WARN]\033[0m Receive failed: {exc}", file=sys.stderr)

augmentcode · 2026-02-13T15:37:51Z

🤖 Augment PR Summary

Summary: This PR expands Dragonfly’s AFL++ fuzzing infrastructure to improve coverage and make crashes easier to reproduce/share.

Changes:

Updates fuzz/run_fuzzer.sh to default to 1 proactor thread, add AFL_LOOP_LIMIT, sync AFL_PERSISTENT_RECORD, increase AFL bitmap size, and auto-load a Python RESP-aware custom mutator.
Adds a RESP protocol custom mutator (fuzz/resp_mutator.py) that mutates at command/argument granularity (including MULTI/EXEC wrapping) while keeping framing valid.
Greatly expands the RESP seed corpus under fuzz/seeds/resp/ to cover more command families.
Extends the AFL dictionary (fuzz/dict/resp.dict) with many additional commands/tokens and smaller RESP framing fragments.
Adds crash tooling: fuzz/replay_crash.py to replay RECORD sequences and fuzz/package_crash.sh to bundle crashes for sharing.
Updates fuzz/FUZZING.md to document the new workflow, env vars, mutator, and crash replay/packaging steps.
Adjusts the fuzz client in src/server/dfly_main.cc to use shorter socket timeouts and MSG_NOSIGNAL to avoid SIGPIPE during fuzzing.

Technical Notes: The focus is on higher-quality inputs (RESP-aware mutations), more stable coverage (1 thread + larger map), and reproducible stateful crashes via persistent RECORD replay.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 5 suggestions posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-02-13T15:37:53Z

fuzz/seeds/resp/generic_ops.resp

+KEYS
+$1
+*
+*3


This seed appears to contain invalid RESP array counts (e.g., the SCAN request starts with *3 but includes 5 bulk strings), which likely makes the seed rejected by the RESP parser and reduces initial corpus usefulness.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-02-13T15:37:53Z

fuzz/seeds/resp/generic_ops2.resp

+$3
+val
+*2
+$2


The bulk length for DEL is declared as $2 but the payload is DEL (3 bytes), making this seed invalid RESP and likely rejected before command execution.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-02-13T15:37:53Z

fuzz/seeds/resp/transaction_ops2.resp

+tk
+$3
+val
+*1


The WATCH command is encoded with *1 but includes both WATCH and the key (2 elements), so this request is invalid RESP and may never reach the transaction logic.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-02-13T15:37:53Z

fuzz/resp_mutator.py

+    (b"MULTI", 0, 0), (b"EXEC", 0, 0), (b"DISCARD", 0, 0),
+    (b"WATCH", 1, 3), (b"UNWATCH", 0, 0),
+    # Script
+    (b"EVAL", 2, 6), (b"EVALSHA", 2, 6), (b"EVALRO", 2, 6),


Dragonfly registers the readonly scripting commands as EVAL_RO/EVALSHA_RO, but the mutator uses EVALRO and doesn’t include EVALSHA_RO; this likely generates unknown commands and reduces scripting coverage.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-02-13T15:37:53Z

src/server/dfly_main.cc

    if (connect(s, (struct sockaddr*)&a, sizeof(a)) == 0) {
-      send(s, data, len, 0);
-      // Just read once - don't wait for full response
+      send(s, data, len, MSG_NOSIGNAL);


MSG_NOSIGNAL is not universally available across platforms; if USE_AFL is ever built on non-Linux targets this may break compilation in the fuzz harness path.

Severity: low

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

vyavdoshenko added 16 commits February 10, 2026 21:11

test: fuzzing updated

1f0ca71

fix: Merge branch 'main' into bobik/fuzz_update

287eb10

test: fuzzing updated

4a8fb57

fix: update fuzzer

1351927

fix: merge branch 'main' into bobik/fuzz_update

457c80c

fix: add seeds

f43c8e3

test: fuzzing updated

5964e29

test: fuzzing updated

38be02f

test: update fuzzer

45a68b7

test: update fuzzer

a56abeb

test: update fuzzer

f94b58a

test: update fuzzer

f3de04a

test: update fuzzer

a8f7089

test: fuzzing updated

d465595

fix: merge branch 'main' into bobik/fuzz_update

a6ad316

test: update fuzzer

64ae48a

vyavdoshenko requested review from dranikpg, kostasrim and romange February 13, 2026 15:32

vyavdoshenko self-assigned this Feb 13, 2026

Copilot AI review requested due to automatic review settings February 13, 2026 15:32

Copilot started reviewing on behalf of vyavdoshenko February 13, 2026 15:32 View session

Copilot AI reviewed Feb 13, 2026

View reviewed changes

augmentcode bot reviewed Feb 13, 2026

View reviewed changes

romange approved these changes Feb 13, 2026

View reviewed changes

vyavdoshenko merged commit 05ea2a3 into main Feb 13, 2026
16 checks passed

vyavdoshenko deleted the bobik/fuzz_update branch February 13, 2026 17:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

test: Improve AFL++ fuzzing infrastructure#6618

test: Improve AFL++ fuzzing infrastructure#6618
vyavdoshenko merged 16 commits intomainfrom
bobik/fuzz_update

vyavdoshenko commented Feb 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 13, 2026

Uh oh!

Copilot AI Feb 13, 2026

Uh oh!

Copilot AI Feb 13, 2026

Uh oh!

augmentcode bot commented Feb 13, 2026

Uh oh!

augmentcode bot left a comment

Uh oh!

augmentcode bot Feb 13, 2026

Uh oh!

augmentcode bot Feb 13, 2026

Uh oh!

augmentcode bot Feb 13, 2026

Uh oh!

augmentcode bot Feb 13, 2026

Uh oh!

augmentcode bot Feb 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-    except Exception:
-        pass
-    try:
-        s.recv(4096)
-    except Exception:
-        pass
+    except OSError as exc:
+        # Ignore send errors: the fuzzer only needs best-effort delivery.
+        print(f"\033[0;33m[WARN]\033[0m Send failed: {exc}", file=sys.stderr)
+    try:
+        s.recv(4096)
+    except OSError as exc:
+        # Ignore receive errors: crash reproduction only depends on what was sent.
+        print(f"\033[0;33m[WARN]\033[0m Receive failed: {exc}", file=sys.stderr)

Conversation

vyavdoshenko commented Feb 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

augmentcode bot commented Feb 13, 2026

Uh oh!

augmentcode bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

augmentcode bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

augmentcode bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

augmentcode bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

augmentcode bot Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants