feat: add fuzzing support and related configurations

[niteshpurohit]

• Introduced fuzzing capabilities by adding new CMake configurations and scripts.
• Implemented fuzz targets for the binary-envelope component.
• Created ExpectFuzzWrapper and ExpectFuzzReleaseExclusion CMake scripts for validation.
• Added a fuzz corpus directory with initial test data.
• Developed a shell script to facilitate fuzz testing execution.
• Enhanced the CMakeLists to include fuzzing configurations and targets.

closes: #77
closes: #76

[Copilot]

🟡 Changes recommended

Critical CMake configuration and sanitizer-validation issues, plus TSAN incompatibility and input-validation defects, remain unresolved.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds opt-in Clang libFuzzer support for binary-envelope parsing, including CMake integration, a seed corpus, execution tooling, and sanitizer CI coverage.

Changes:

• Adds fuzzing configuration, targets, and validation scripts.
• Adds a binary-envelope fuzz harness and seed corpus.
• Adds fuzz execution tooling and ASan/UBSan CI coverage.

File summaries

File	Description
tests/configure/probes/libfuzzer.cpp	Probes libFuzzer availability.
scripts/fuzz	Builds and runs registered fuzz targets.
fuzz/corpus/README.md	Documents corpus conventions.
fuzz/corpus/binary-envelope/magic-prefix	Adds an initial corpus seed.
fuzz/binary_envelope.cpp	Implements the binary-envelope fuzz harness.
CMakeLists.txt	Registers fuzz targets and verification integration.
cmake/LaghuFuzzing.cmake	Defines fuzz configuration and target management.
cmake/ExpectFuzzWrapper.cmake	Validates fuzz script behavior.
cmake/ExpectFuzzReleaseExclusion.cmake	Checks production artifacts exclude fuzz symbols.
.github/workflows/toolchain.yml	Runs sanitizer corpus replay and fuzz campaigns.

Review details

• Files reviewed: 10/10 changed files
• Comments generated: 5
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Unresolved CI validation, sanitizer-probe, and corpus-seed issues remain.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/toolchain.yml:194

• The fuzz configuration registers laghu.fuzz.wrapper and laghu.fuzz.release_exclusion, but this workflow only invokes scripts/fuzz; neither validation test runs in CI. A regression in the registry/wrapper or release-artifact exclusion can therefore pass unnoticed. Run the fuzz-specific CTest tests (or laghu_verify_toolchain) after configuring this build.

.github/workflows/toolchain.yml:196

• This campaign is built with ASan/UBSan, so a discovered crash or sanitizer violation returns nonzero, but continue-on-error: true converts that failure into a successful job. The fuzz lane can therefore report success while finding a regression; make it blocking or add an explicit failure/artifact triage path.

        continue-on-error: true

fuzz/corpus/binary-envelope/magic-prefix:1

• This is the only checked-in seed, and it is only four bytes, so every initial input exits at the decoder's input.size() < binary_envelope_header_size guard. Reaching checksum validation and successful decoding would require guessing a 32-bit checksum; add a valid minimal envelope seed (for example, the empty-payload vector from tests/core/binary_envelope.cpp) alongside this prefix so the fuzz campaign exercises the full parser.

LGHU

• Files reviewed: 13/13 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Fuzz instrumentation, build isolation, and CI failure handling issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

.github/workflows/toolchain.yml:200

• The fuzz campaign is the step that can discover a new sanitizer crash, but continue-on-error makes that failure non-gating and leaves CI green even when the fuzzer finds one. Remove this override (or set it to false) so discovered crashes cannot be silently ignored.

        continue-on-error: true

cmake/LaghuFuzzing.cmake:56

• With LAGHU_BUILD_FUZZERS=ON, this plain add_executable adds the fuzzer to the default all target, so a normal production build also compiles the sanitizer/libFuzzer binary instead of keeping it separate. Mark the target EXCLUDE_FROM_ALL; the wrapper and laghu_verify_toolchain already build it explicitly.

  add_executable("${target}" "${source}")

fuzz/corpus/binary-envelope/magic-prefix:1

• This seed is shorter than the 16-byte envelope header, so every corpus replay exits at the initial input.size() < binary_envelope_header_size check and the fuzzer has no valid input from which to reach version, length, checksum, or payload decoding. Please add a valid 19-byte envelope seed (the golden vector in tests/core/binary_envelope.cpp:43-48 is suitable) while retaining malformed seeds for rejection paths.

LGHU

• Files reviewed: 13/14 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

Two moderate review findings remain unresolved in the fuzzing probe and CI campaign.

Review details

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

cmake/LaghuFuzzing.cmake:34

• This try_compile does not disable CMake's module dependency scanning, unlike the other probes (cmake/LaghuToolchain.cmake:58-62) and the top-level project setting (CMakeLists.txt:11-14). On a supported Clang installation without clang-scan-deps, enabling fuzzers can therefore fail during this probe before the fuzzer runtime is tested. Pass -DCMAKE_CXX_SCAN_FOR_MODULES=OFF in CMAKE_FLAGS here as well.

.github/workflows/toolchain.yml:202

• A nonzero fuzzer exit is the signal for a newly found crash or sanitizer failure, but continue-on-error lets this campaign step pass in either case. That masks regressions discovered by the new fuzzing job; remove this setting so the bounded campaign fails CI, or explicitly handle only an intentional non-crash outcome.

        continue-on-error: true

• Files reviewed: 16/17 changed files
• Comments generated: 0 new
• Review effort level: Lite