Jens-G opened a new pull request, #3835: URL: https://github.com/apache/thrift/pull/3835
Implements [THRIFT-6211](https://issues.apache.org/jira/browse/THRIFT-6211). ## The gap The Go tree has only [go-fuzz](https://github.com/dvyukov/go-fuzz) style targets — `func FuzzX(data []byte) int` behind the `gofuzz` build tag, which is what the OSS-Fuzz build consumes. Nothing in this repository fuzzes them: `make -C lib/go check` recurses into `lib/go/test/fuzz` and runs `go test -tags gofuzz`, and the only test there is ```go func TestFuzz(t *testing.T) { FuzzTutorial([]byte{1, 2, 3}) } ``` one call, one three-byte input. That is a compile check against generated-code drift, worth keeping, but it finds nothing. There is also no corpus anywhere in the tree, so an input OSS-Fuzz finds and we fix has nowhere to land as a regression test. ## What this adds Native `testing.F` targets **alongside** the go-fuzz ones — the go-fuzz targets are untouched and OSS-Fuzz keeps consuming them. The lever is that **`go test` without `-fuzz` replays every `f.Add` seed and every file under `testdata/fuzz/<Target>/` as an ordinary test case.** So the existing `make check` picks up regression coverage on both Go versions in the CI matrix at no extra runtime and with no fuzzing infrastructure in the PR path, and a committed failing input keeps a fixed bug fixed. **`lib/go/thrift/fuzz_test.go`** — twelve targets that need no generated code. They drive the read paths through `ReadMessageBegin` plus `Skip`, which is what generated struct-read code amounts to: dispatch on the wire-supplied type, read containers at wire-supplied sizes. Because they need only the library, they live with it and run in `go test -race ./thrift`, which `make check` already invokes. They reach ground no existing target does: `THeaderProtocol` (client-type detection, transform-ID list, info-header parsing), `TFramedTransport`, `TSimpleJSONProtocol`, a server-side dispatch hop through `TMultiplexedProcessor`, and `ParseTuuid`. **`lib/go/test/fuzz/fuzz_native_test.go`** — native equivalents of the existing struct-read and round-trip targets, which do need `gen-go`. The file carries no build tag, so a single `go test -tags gofuzz` builds and runs both sets and the make target needs no change. Only `EXTRA_DIST` gains the new file. **Docs** — `FUZZING.md` and `lib/go/test/fuzz/README.md` describe both kinds, how to fuzz one for real, and that a failing input belongs in `testdata/fuzz/<Target>/` alongside the fix. ## Verification - 18 targets fuzzed 60s each: **~19M executions, no failures.** - Seed-corpus replay: 147 cases in `lib/go/thrift`, 60 in `lib/go/test/fuzz`, all passing. - `go vet -stdmethods=false ./thrift` and `go test -race ./thrift` clean. - `gofmt` clean; `codespell` (what `make style` runs) clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
