test: add parser and serializer fuzzing

[rgerhards]

Summary

• add parser and serializer libFuzzer targets with deterministic corpus replay in make check
• add retained parser and serializer seed corpora plus a fuzzing maintenance guide
• run the sanitizer fuzzers daily for five minutes each, while skipping an exact commit already covered by a successful daily campaign

Validation

• actionlint .github/workflows/daily_fuzz.yml
• yamllint .github/workflows/daily_fuzz.yml
• make check (20/20)
• local sanitizer fuzz campaign: parser 5:01 and serializer 5:01, no ASan/UBSan finding

---

Summary by cubic

Add libFuzzer fuzzing for the JSON parser and serializer with deterministic corpus replay in make check. Adds PR smoke runs and a daily ASan/UBSan fuzzing job with caching and failure reporting.

• New Features

  • Make targets: fuzz and fuzz-smoke (supports FUZZ_SECONDS, FUZZ_RSS_LIMIT_MB, FUZZ_CC).
  • Deterministic corpus replay via test_fuzz_parser and test_fuzz_serializer in the test suite.
  • Hardened harnesses: parser strict/chunked parsing with canonical round-trips; serializer checks sizes and buffered writes; bounded input/depth/node limits.
  • Seed corpora for parser and serializer, tests/fuzz/json.dict, and tests/fuzz/README.md with usage notes.
  • CI: PRs run fuzz-smoke (30s); daily 5-minute run skips already-fuzzed commits via cache, enforces concurrency/timeouts, uses actions/checkout, actions/cache, actions/github-script, and creates/updates a “Daily fuzzing failures” issue with commit and run link on failure.

• Dependencies

  • Requires Clang with libFuzzer and a C++ standard library; set FUZZ_CXX_LIBS if needed. The workflow installs autoconf, automake, clang, g++, and libtool.

^{Written for commit 65edfb2. Summary will update on new commits.}

[Copilot]

Pull request overview

Adds libFuzzer-based fuzzing for libfastjson’s parser and serializer, including deterministic seed-corpus replay during make check and a scheduled GitHub Actions job to run short ASan/UBSan fuzz campaigns.

Changes:

• Introduce parser and serializer fuzz targets plus deterministic corpus replay test executables.
• Check in seed corpora and a fuzzing maintenance README/dictionary.
• Add a daily scheduled GitHub Actions workflow to run make fuzz-smoke, with caching to skip already-fuzzed commits.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/test_fuzz_serializer.test	Adds make check driver to replay serializer seed corpus.
tests/test_fuzz_serializer.c	Adds serializer fuzz target + replay main() under FUZZ_REPLAY.
tests/test_fuzz_parser.test	Adds make check driver to replay parser seed corpus.
tests/test_fuzz_parser.c	Adds parser fuzz target + replay main() under FUZZ_REPLAY.
tests/Makefile.am	Wires new fuzz replay tests into TESTS and ships fuzz assets via EXTRA_DIST.
tests/fuzz/README.md	Documents how to build/run fuzzers and maintain the corpus.
tests/fuzz/json.dict	Adds a small JSON dictionary for fuzzing.
tests/fuzz/corpus/serializer/strings.seed	Adds serializer seed input.
tests/fuzz/corpus/serializer/nesting.seed	Adds serializer seed input.
tests/fuzz/corpus/parser/truncated.json	Adds parser seed input.
tests/fuzz/corpus/parser/object.json	Adds parser seed input.
tests/fuzz/corpus/parser/number.json	Adds parser seed input.
tests/fuzz/corpus/parser/invalid.json	Adds parser seed input.
tests/fuzz/corpus/parser/escaped.json	Adds parser seed input.
tests/fuzz/corpus/parser/deep.json	Adds parser seed input.
tests/fuzz/corpus/parser/array.json	Adds parser seed input.
Makefile.am	Adds make fuzz and make fuzz-smoke targets for libFuzzer + sanitizers.
.github/workflows/daily_fuzz.yml	Adds scheduled workflow to run fuzz-smoke daily with caching/skip logic.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.