Vibe Fuzz Parser Inputs

vibe-fuzz-parser-inputs

Every parser will eventually see input you didn't expect. Fuzz testing finds the crashes before production does.

When to Use This Skill

• Implementing any parser (YAML, JSON, XML, config, DSL)
• Processing user-supplied input
• Handling webhook payloads or API responses
• Parsing file formats

When NOT to Use This Skill

• The parser is a well-tested standard library (e.g., encoding/json)
• You're only reading known, controlled input
• The parser is trivial (e.g., splitting a string by comma)

Steps

Go Fuzz Tests

1. Create fuzz test file (parser_fuzz_test.go):

```go func FuzzParseConfig(f testing.F) { // Seed corpus from existing test fixtures files, := filepath.Glob("testdata/.yaml") for , file := range files { data, _ := os.ReadFile(file) f.Add(data) }

// Add targeted seeds f.Add([]byte("")) // empty f.Add([]byte("{}")) // minimal valid f.Add([]byte("\x00\x00")) // binary

f.Fuzz(func(t *testing.T, data []byte) { // Should never panic result, err := ParseConfig(data) if err != nil { return // errors are fine } // If no error, result should be valid if result.Name == "" { t.Error("parsed successfully but Name is empty") } }) } ```

1. Seed the corpus from:

• Existing test fixtures
• Real production examples
• Known edge cases
• Minimally valid inputs
• Binary/garbage data

1. Run initial fuzz:

``bash go test -fuzz=FuzzParseConfig -fuzztime=30s ``

1. Record results:

• Crashes found
• New corpus entries generated
• Edge cases discovered

1. Fix crashes -- Every panic or unexpected behavior becomes a permanent test case

Other Languages

• JavaScript/TypeScript: Use jest-fuzz or fast-check property-based testing
• Python: Use hypothesis for property-based testing
• Rust: Use cargo-fuzz with libfuzzer

Output Format

Fuzz Test: [Parser Name]

Seeds: X (Y from fixtures, Z manual) Duration: [fuzz time] Corpus growth: X -> Y entries (Z% expansion) Crashes found: N

| # | Input (hex) | Crash Type | Fix | |---|-------------|-----------|-----| | 1 | \x00\xff... | nil panic in tokenizer | Added nil check at line 42 |

New Edge Cases Discovered

1. [Description] -- added as permanent test case

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: ash1794
• Source: ash1794/vibe-engineering
• License: MIT

Install and usage instructions live in the source repository linked above.