Skip to content

feat: add fuzz targets for ELF, MCUboot, and format detection (CV-15)#56

Merged
avrabe merged 1 commit intomainfrom
feat/fuzz-elf-mcuboot
Mar 17, 2026
Merged

feat: add fuzz targets for ELF, MCUboot, and format detection (CV-15)#56
avrabe merged 1 commit intomainfrom
feat/fuzz-elf-mcuboot

Conversation

@avrabe
Copy link
Contributor

@avrabe avrabe commented Mar 17, 2026

Summary

3 new fuzz targets for the binary signing parsers introduced in PR #55, bringing the total to 9.

Target Tests STPA-Sec artifacts
fuzz_elf_parsing ELF header, section overlaps, resource bounds, hash SC-12, UCA-13, UCA-17, AS-14
fuzz_mcuboot_parsing MCUboot magic, image size, payload, TLV roundtrip SC-13, UCA-14, AS-15
fuzz_format_detection Magic bytes, polyglot rejection, consistency SC-15, AS-17

Test plan

  • All 3 fuzz targets compile (cargo check)
  • cargo test — 616 tests pass
  • CV-15 artifact status updated to approved
  • CI passes

🤖 Generated with Claude Code

Three new fuzz targets for the binary signing parsers:

- fuzz_elf_parsing: Tests ELF header validation, section overlap
  detection (SC-12, UCA-13), resource bounds (UCA-17), .sigil section
  discovery, and full-file hash computation (AS-14)

- fuzz_mcuboot_parsing: Tests MCUboot magic validation, image size
  verification (SC-13, UCA-14, AS-15), payload extraction, TLV trailer
  serialization, and signature attachment roundtrip

- fuzz_format_detection: Tests magic byte detection for all formats,
  polyglot file rejection (SC-15, AS-17), and format consistency
  validation between declared and detected formats

Total fuzz targets: 9 (6 existing + 3 new)

Implements: CV-15
Refs: SC-12, SC-13, SC-15, UCA-13, UCA-14, UCA-17, AS-14, AS-15, AS-17

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@avrabe avrabe merged commit f5ec8b1 into main Mar 17, 2026
11 checks passed
@avrabe avrabe deleted the feat/fuzz-elf-mcuboot branch March 17, 2026 19:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant