Function FuzzJSONStructureAware

json_fuzz_test.go:1509–1568

FuzzJSONStructureAware is the structure-aware fuzzer. It combines: - Grammar-based JSON generation (always emits valid structures). - JSON-aware mutation operators (break structures at known-dangerous boundaries: value boundaries, mid-key, mid-structure, mid-escape). - Adversarial key-path generatio

(f *testing.F)

//           GetBoolean, GetUnsafeString, ArrayEach, ObjectEach, EachKey,
//           ParseInt, ParseFloat
func FuzzJSONStructureAware(f *testing.F) {
	// Seed with known-dangerous corpora (the actual bugs we've found).
	for _, s := range structureAwareSeeds {
		f.Add(s.data, s.path)
	}

	f.Fuzz(func(t *testing.T, data []byte, pathBytes []byte) {
		// Derive deterministic RNG from the fuzz inputs so generation and
		// mutation decisions are a pure function of the engine-supplied bytes.
		r := newRandFromSeed(data, pathBytes)

		// --- Structure-aware generation layer ---
		// When the fuzz engine mutates data into non-JSON garbage (or ~30%
		// of the time regardless), regenerate valid JSON from the grammar.
		// This maintains structural coverage that blind byte mutation cannot
		// reach in reasonable time.
		work := data
		if !looksLikeJSON(data) || r.Intn(10) < 3 {
			depth := r.Intn(4) // mostly depth 0–3
			if r.Intn(10) == 0 {
				depth = 5 + r.Intn(3) // occasionally deep (stress recursion)
			}
			work = genJSON(r, depth)
		}

		// --- Deep-nesting injection (closes Dimension 5 DoS blind spot) ---
		// The grammar generator's maxGenDepth=5 cannot produce pathological
		// nesting. Occasionally replace work with deeply-nested arrays so the
		// parser's own stack-safety (not just encoding/json's) gets fuzzed.
		// Both closed ([[[...1...]]]) and unclosed ([[[...) shapes are tested;
		// the unclosed shape forces full descent before error recovery.
		//
		// Capped at 1000 levels in the fuzz body: deeper inputs make the
		// existing Get-family gates (6+ calls, each O(n)) dominate the
		// worker's per-exec budget. The non-fuzz TestDoSPerformance gate
		// covers 100k+ level nesting separately.
		if r.Intn(40) == 0 {
			depth := 50 * (1 << r.Intn(5)) // 50..800
			work = genDeepNesting(depth, r.Intn(2) == 0)
		}

		// --- JSON-aware mutation layer ---
		// Apply 0–3 mutations at structural boundaries. Each operator
		// targets a specific bug class (truncation, duplication, corruption).
		for n := r.Intn(4); n > 0; n-- {
			work = applyMutation(r, work)
		}

		// --- Adversarial key-path layer ---
		// Derive the path from pathBytes (split on '/'); occasionally inject
		// a hazard component (empty key, OOB index) or regenerate from grammar.
		path := splitPathComponents(pathBytes)
		if r.Intn(5) == 0 { // 20% chance
			path = injectPathHazard(r, path)
		}

		// --- Gates ---
		runStructureAwareGates(t, work, path)