max / makenotwork

Fuzz the substitution surface, the soak tier's first target subst/parser.rs is row 6 of astra-soak-overview and the cheapest target in the tree, which is why it goes first: it proves the loop before eight more harnesses exist. The target is substitute() rather than parse_expr(), which is pub(crate) and half the surface. One call runs code-span detection, the marker regex, path lookup, the filter chain and the formatter. Three oracles beyond not-panicking, because a target that only asserts no panic reports clean forever while returning wrong answers: code-span ranges must be usable as byte ranges into the input, text with no marker must come back unchanged, and substitution must reach a fixed point. That last one caught its own first draft. The table held a value whose text was itself a marker, so a second pass legitimately differed and the fuzzer reported it in under a minute. The untrusted input on this path is the template, not the table, so the value came out and the reasoning is in the target. Whether hostile values should also be inert is a real question, a different one, and wants its own target rather than a weakened oracle. 822,005 runs clean at 6,793 exec/s after the fix. seeds/ is committed and corpus/ is not. Seeds are human intent, reviewable in a diff, and name the grammar shapes worth reaching in the first second. The working corpus is machine output that belongs on astra until it represents real soak hours.

Author: Max Johnson <me@maxj.phd> · 2026-08-11 23:19 UTC

Signed with PGP, not checked

Commit: 91cf78d0724f9a3f49f0646376ed8a8a1200dfa8

Parent: 5c3743b

1 file changed, +9 insertions, -2 deletions

M shared/subst/fuzz/fuzz_targets/substitute.rs +9 -2

			@@ -69,12 +69,19 @@
69	69		let mut prev_end = 0usize;
70	70		for &(start, end) in &ranges {
71	71		assert!(start <= end, "inverted code span {start}..{end}");
72		-	assert!(end <= text.len(), "code span {start}..{end} past len {}", text.len());
	72	+	assert!(
	73	+	end <= text.len(),
	74	+	"code span {start}..{end} past len {}",
	75	+	text.len()
	76	+	);
73	77		assert!(
74	78		text.is_char_boundary(start) && text.is_char_boundary(end),
75	79		"code span {start}..{end} splits a UTF-8 sequence"
76	80		);
77		-	assert!(start >= prev_end, "code spans overlap or are unsorted at {start}");
	81	+	assert!(
	82	+	start >= prev_end,
	83	+	"code spans overlap or are unsorted at {start}"
	84	+	);
78	85		prev_end = end;
79	86		// The range is what callers slice with. Prove it.
80	87		let _ = &text[start..end];