Function FuzzEncodingJSON

encoding_json_fuzz_test.go:653–703

============================================================================= The fuzzer (testing.F, native go-fuzz) ============================================================================= FuzzEncodingJSON is the structure-aware differential fuzzer for encoding/json. It reuses the generator (g

(f *testing.F)

// Verifies: SYS-REQ-035 [no-panic on malformed input] against the reference
// Go stdlib implementation.
func FuzzEncodingJSON(f *testing.F) {
	// Seed with the encoding/json-specific dangerous corpus.
	for _, s := range encodingJSONSeeds {
		f.Add(s)
	}
	// Reuse the jsonparser seed corpus (data only) — these are the
	// known-dangerous shapes from the structure-aware fuzzer.
	for _, s := range structureAwareSeeds {
		f.Add(s.data)
	}

	f.Fuzz(func(t *testing.T, data []byte) {
		// Derive deterministic RNG from the fuzz inputs so generation and
		// mutation decisions are a pure function of the engine-supplied
		// bytes (coverage feedback stays meaningful).
		r := newRandFromSeed(data)

		// --- Structure-aware generation layer (reuse from json_fuzz_test.go) ---
		// When the engine mutates data into non-JSON garbage, or ~30% of the
		// time regardless, regenerate valid JSON from the grammar.
		work := data
		if !looksLikeJSON(data) || r.Intn(10) < 3 {
			depth := r.Intn(4) // mostly depth 0–3
			if r.Intn(10) == 0 {
				depth = 5 + r.Intn(3) // occasionally deep
			}
			work = genJSON(r, depth)
		}

		// --- Deep-nesting injection (Gate D coverage during fuzzing) ---
		// Occasionally replace the input with deeply-nested arrays to keep
		// stack-safety coverage active during the fuzz campaign. The
		// deterministic-depth regression is in TestEncodingJSONCorpusSanity.
		if r.Intn(40) == 0 {
			depth := 100 * (1 << r.Intn(5)) // 100..1600
			if r.Intn(8) == 0 {
				depth = 10000 + r.Intn(90000) // occasionally very deep
			}
			work = genDeepNesting(depth, r.Intn(2) == 0)
		}

		// --- JSON-aware mutation layer (reuse from json_fuzz_test.go) ---
		// Apply 0–3 mutations at structural boundaries.
		for n := r.Intn(4); n > 0; n-- {
			work = applyMutation(r, work)
		}

		// --- Gates A–G ---
		runEncodingJSONGates(t, work)
	})
}

// =============================================================================
// Non-fuzz regression test (runs under plain `go test`)