Skip to content

Additional fuzz targets to improve security testing coverage#3451

Open
emptyiscolor wants to merge 1 commit intoeclipse-mosquitto:developfrom
emptyiscolor:develop
Open

Additional fuzz targets to improve security testing coverage#3451
emptyiscolor wants to merge 1 commit intoeclipse-mosquitto:developfrom
emptyiscolor:develop

Conversation

@emptyiscolor
Copy link
Copy Markdown

@emptyiscolor emptyiscolor commented Jan 24, 2026

Commit 23c918ee addressed issue #3435 and introduced initial fuzz targets to improve testing coverage. This PR continues that effort by adding more fuzz targets to further increase security testing coverage for Mosquitto.

New broker fuzzers:

  • broker_fuzz_bridge_remap_topic_in - Tests bridge topic remapping logic
  • broker_fuzz_properties_to_json - Tests MQTT v5 properties to JSON conversion
  • broker_fuzz_property_read_all - Tests property reading/parsing
  • broker_fuzz_proxy_v1_decode - Tests PROXY protocol v1 decoding
  • broker_fuzz_subscribe - Tests subscription handling
  • broker_fuzz_will_set - Tests will message setting
  • broker_fuzz_ws_prepare_packet - Tests WebSocket packet preparation

New dynamic-security plugin fuzzers:

  • dynsec_fuzz_config_from_json - Tests dynamic security config parsing from JSON
  • dynsec_fuzz_roles_process_add_acl - Tests role ACL processing

All fuzzers follow the existing fuzzer style in the repository and include seed corpora for effective fuzzing.

Test plan

  • Fuzzers build successfully with oss-fuzz infrastructure:
    cd $PATH_TO_OSS_FUZZ
    python3 infra/helper.py build_fuzzers --clean mosquitto $PATH_TO_mosquitto_src
    python3 infra/helper.py check_fuzzers mosquitto
  • All fuzzers pass the oss-fuzz check_fuzzers validation
  • Seed corpora included for each fuzzer

New broker fuzzers:

  • broker_fuzz_bridge_remap_topic_in - Tests bridge topic remapping logic
  • broker_fuzz_properties_to_json - Tests MQTT v5 properties to JSON conversion
  • broker_fuzz_property_read_all - Tests property reading/parsing
  • broker_fuzz_proxy_v1_decode - Tests PROXY protocol v1 decoding
  • broker_fuzz_subscribe - Tests subscription handling
  • broker_fuzz_will_set - Tests will message setting
  • broker_fuzz_ws_prepare_packet - Tests WebSocket packet preparation

New dynamic-security plugin fuzzers:

  • dynsec_fuzz_config_from_json - Tests dynamic security config parsing from JSON
  • dynsec_fuzz_roles_process_add_acl - Tests role ACL processing

All fuzzers follow the existing fuzzer style in the repository and include seed corpora for effective fuzzing.

Test

  • Fuzzers build successfully with oss-fuzz infrastructure:
    cd $PATH_TO_OSS_FUZZ
    python3 infra/helper.py build_fuzzers --clean mosquitto $PATH_TO_mosquitto_src
    python3 infra/helper.py check_fuzzers mosquitto
  • All fuzzers pass the oss-fuzz check_fuzzers validation
  • Seed corpora included for each fuzzer

Thank you for contributing your time to the Mosquitto project!

Before you go any further, please note that we cannot accept contributions if
you haven't signed the Eclipse Contributor Agreement.
If you aren't able to do that, or just don't want to, please describe your bug
fix/feature change in an issue. For simple bug fixes it is can be just as easy
for us to be told about the problem and then go fix it directly.

Then please check the following list of things we ask for in your pull request:

  • Have you signed the Eclipse Contributor Agreement, using the same email address as you used in your commits?
  • Do each of your commits have a "Signed-off-by" line, with the correct email address? Use "git commit -s" to generate this line for you.
  • If you are contributing a new feature, is your work based off the develop branch?
  • If you are contributing a bugfix, is your work based off the fixes branch?
  • Have you added an explanation of what your changes do and why you'd like us to include them?
  • Have you successfully run make test with your changes locally?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant