feat: Fuzz Infrastructure Setup (TASK-500)

build.zig

@@ -428,12 +428,63 @@ pub fn build(b: *std.Build) void {
     test_step.dependOn(&run_checker_tests.step);
     test_step.dependOn(&run_loop_tests.step);
 
-    // Fuzz targets (placeholder for TASK-300+)
-    _ = b.step("fuzz-targets", "Build all fuzz targets");
-    // TODO: Add fuzz targets when parsers are implemented:
-    // - fuzz_http1_response
-    // - fuzz_http2_frame
-    // - fuzz_event_serialization
+    // Fuzz targets (TASK-500)
+    const fuzz_step = b.step("fuzz-targets", "Build and run all fuzz targets");
+
+    // HTTP/1.1 Parser fuzz tests
+    const http1_fuzz = b.addTest(.{
+        .name = "http1_parser_fuzz",
+        .root_source_file = b.path("tests/fuzz/http1_parser_fuzz.zig"),
+        .target = target,
+        .optimize = optimize,
+    });
+    http1_fuzz.root_module.addImport("z6", z6_module);
+    const run_http1_fuzz = b.addRunArtifact(http1_fuzz);
+    fuzz_step.dependOn(&run_http1_fuzz.step);
+
+    // HTTP/2 Frame Parser fuzz tests
+    const http2_fuzz = b.addTest(.{
+        .name = "http2_frame_fuzz",
+        .root_source_file = b.path("tests/fuzz/http2_frame_fuzz.zig"),
+        .target = target,
+        .optimize = optimize,
+    });
+    http2_fuzz.root_module.addImport("z6", z6_module);
+    const run_http2_fuzz = b.addRunArtifact(http2_fuzz);
+    fuzz_step.dependOn(&run_http2_fuzz.step);
+
+    // HPACK Decoder fuzz tests
+    const hpack_fuzz = b.addTest(.{
+        .name = "hpack_decoder_fuzz",
+        .root_source_file = b.path("tests/fuzz/hpack_decoder_fuzz.zig"),
+        .target = target,
+        .optimize = optimize,
+    });
+    hpack_fuzz.root_module.addImport("z6", z6_module);
+    const run_hpack_fuzz = b.addRunArtifact(hpack_fuzz);
+    fuzz_step.dependOn(&run_hpack_fuzz.step);
+
+    // Scenario Parser fuzz tests
+    const scenario_fuzz = b.addTest(.{
+        .name = "scenario_parser_fuzz",
+        .root_source_file = b.path("tests/fuzz/scenario_parser_fuzz.zig"),
+        .target = target,
+        .optimize = optimize,
+    });
+    scenario_fuzz.root_module.addImport("z6", z6_module);
+    const run_scenario_fuzz = b.addRunArtifact(scenario_fuzz);
+    fuzz_step.dependOn(&run_scenario_fuzz.step);
+
+    // Event Serialization fuzz tests (existing)
+    const event_fuzz = b.addTest(.{
+        .name = "event_serialization_fuzz",
+        .root_source_file = b.path("tests/fuzz/event_serialization_fuzz.zig"),
+        .target = target,
+        .optimize = optimize,
+    });
+    event_fuzz.root_module.addImport("z6", z6_module);
+    const run_event_fuzz = b.addRunArtifact(event_fuzz);
+    fuzz_step.dependOn(&run_event_fuzz.step);
 
     // Documentation generation (placeholder for TASK-400+)
     _ = b.step("docs", "Generate documentation");

corpus/event/random.bin

@@ -0,0 +1,2 @@
+¸¾
+†Gò´L¤4ðîê)$ èhK½	ܤ2³£a‹\(àÙ±&%å=="S÷
Ū$=¤tG‡±¾&©O,?í"+‹–1óíLq’@fTúñ~¤ôdòCäJ<¾§Óãús’¤éýq/~jgBvòÁª‚ø¨4¼|ðœ9.
,ªL#Æ°Ø(F@«¶kZ!¡Tk?FëGIè™QNƳëM*tÜ<°e¶Hï…¿40Õž•ÝŸÌŠ+ÌÛ³?u@þÍ6 뉖~W_µ‚A;÷ðÊ™KV„æM™
+Û§I¨1¿ÉÍ/Cèþ–ê[P¸À0¦!r	ŸÚú+³-óèC)«ñÚ?Ú)ì

corpus/hpack/indexed_method_get.bin

@@ -0,0 +1 @@
+‚

corpus/hpack/indexed_multi.bin

@@ -0,0 +1 @@
+‚„†

corpus/hpack/indexed_status_200.bin

@@ -0,0 +1 @@
+ˆ

corpus/hpack/literal_indexed_name.bin

@@ -0,0 +1,2 @@
+
+text/plain

corpus/hpack/random.bin

@@ -0,0 +1 @@
+ë8_Ò\`¡\æŒq!ÛÛ¥ÝÞPZœÁæ¡,+ì}3üd}”ÏßboÕÕâ

corpus/http1_response/200_ok.bin

@@ -0,0 +1,4 @@
+HTTP/1.1 200 OK
+Content-Length: 5
+
+hello

corpus/http1_response/204_no_content.bin

@@ -0,0 +1,2 @@
+HTTP/1.1 204 No Content
+

corpus/http1_response/301_redirect.bin

@@ -0,0 +1,4 @@
+HTTP/1.1 301 Moved Permanently
+Location: /new
+Content-Length: 0
+

corpus/http1_response/404_not_found.bin

@@ -0,0 +1,4 @@
+HTTP/1.1 404 Not Found
+Content-Length: 9
+
+Not Found

corpus/http1_response/500_error.bin

@@ -0,0 +1,4 @@
+HTTP/1.1 500 Internal Server Error
+Content-Length: 5
+
+error

corpus/http1_response/chunked_multi.bin

@@ -0,0 +1,9 @@
+HTTP/1.1 200 OK
+Transfer-Encoding: chunked
+
+a
+0123456789
+5
+abcde
+0
+

corpus/http1_response/chunked_simple.bin

@@ -0,0 +1,7 @@
+HTTP/1.1 200 OK
+Transfer-Encoding: chunked
+
+5
+hello
+0
+

corpus/http1_response/conn_close.bin

@@ -0,0 +1,5 @@
+HTTP/1.1 200 OK
+Connection: close
+Content-Length: 4
+
+test

corpus/http1_response/empty.bin

@@ -0,0 +1,11 @@
+HTTP/1.1 200 OK
+Content-Length: 0
+
+ echo -e HTTP/1.0 200 OK
+Content-Length: 4
+
+test echo -e garbage data not http echo -n  echo -n HTTP echo -n HTTP/1.1  echo -e HTTP/1.1 200 OK
+ echo -e HTTP/1.1 999 Custom
+Content-Length: 0
+
+ ls /home/ops/Project/z6/corpus/http1_response/

corpus/http1_response/empty_body.bin

@@ -0,0 +1,11 @@
+HTTP/1.1 200 OK
+Content-Length: 0
+
+ echo -e HTTP/1.0 200 OK
+Content-Length: 4
+
+test echo -e garbage data not http echo -n  echo -n HTTP echo -n HTTP/1.1  echo -e HTTP/1.1 200 OK
+ echo -e HTTP/1.1 999 Custom
+Content-Length: 0
+
+ ls /home/ops/Project/z6/corpus/http1_response/

corpus/http1_response/http10.bin

@@ -0,0 +1,11 @@
+HTTP/1.1 200 OK
+Content-Length: 0
+
+ echo -e HTTP/1.0 200 OK
+Content-Length: 4
+
+test echo -e garbage data not http echo -n  echo -n HTTP echo -n HTTP/1.1  echo -e HTTP/1.1 200 OK
+ echo -e HTTP/1.1 999 Custom
+Content-Length: 0
+
+ ls /home/ops/Project/z6/corpus/http1_response/

corpus/http1_response/json_response.bin

@@ -0,0 +1,5 @@
+HTTP/1.1 200 OK
+Content-Type: application/json
+Content-Length: 13
+
+{"status":"ok"}

corpus/http1_response/keep_alive.bin

@@ -0,0 +1,5 @@
+HTTP/1.1 200 OK
+Connection: keep-alive
+Content-Length: 4
+
+test

corpus/http1_response/multi_headers.bin

@@ -0,0 +1,5 @@
+HTTP/1.1 200 OK
+Content-Type: text/html
+Content-Length: 4
+
+test

corpus/http1_response/random_garbage.bin

@@ -0,0 +1,11 @@
+HTTP/1.1 200 OK
+Content-Length: 0
+
+ echo -e HTTP/1.0 200 OK
+Content-Length: 4
+
+test echo -e garbage data not http echo -n  echo -n HTTP echo -n HTTP/1.1  echo -e HTTP/1.1 200 OK
+ echo -e HTTP/1.1 999 Custom
+Content-Length: 0
+
+ ls /home/ops/Project/z6/corpus/http1_response/

corpus/http1_response/truncated_headers.bin

@@ -0,0 +1,11 @@
+HTTP/1.1 200 OK
+Content-Length: 0
+
+ echo -e HTTP/1.0 200 OK
+Content-Length: 4
+
+test echo -e garbage data not http echo -n  echo -n HTTP echo -n HTTP/1.1  echo -e HTTP/1.1 200 OK
+ echo -e HTTP/1.1 999 Custom
+Content-Length: 0
+
+ ls /home/ops/Project/z6/corpus/http1_response/

corpus/http1_response/truncated_status.bin

@@ -0,0 +1,11 @@
+HTTP/1.1 200 OK
+Content-Length: 0
+
+ echo -e HTTP/1.0 200 OK
+Content-Length: 4
+
+test echo -e garbage data not http echo -n  echo -n HTTP echo -n HTTP/1.1  echo -e HTTP/1.1 200 OK
+ echo -e HTTP/1.1 999 Custom
+Content-Length: 0
+
+ ls /home/ops/Project/z6/corpus/http1_response/

corpus/http1_response/truncated_version.bin

@@ -0,0 +1,11 @@
+HTTP/1.1 200 OK
+Content-Length: 0
+
+ echo -e HTTP/1.0 200 OK
+Content-Length: 4
+
+test echo -e garbage data not http echo -n  echo -n HTTP echo -n HTTP/1.1  echo -e HTTP/1.1 200 OK
+ echo -e HTTP/1.1 999 Custom
+Content-Length: 0
+
+ ls /home/ops/Project/z6/corpus/http1_response/

corpus/http1_response/unusual_status.bin

@@ -0,0 +1,11 @@
+HTTP/1.1 200 OK
+Content-Length: 0
+
+ echo -e HTTP/1.0 200 OK
+Content-Length: 4
+
+test echo -e garbage data not http echo -n  echo -n HTTP echo -n HTTP/1.1  echo -e HTTP/1.1 200 OK
+ echo -e HTTP/1.1 999 Custom
+Content-Length: 0
+
+ ls /home/ops/Project/z6/corpus/http1_response/

corpus/http2_frame/random.bin

@@ -0,0 +1 @@
+9©k"ú¾½öUjÀ"¦8ª(d

corpus/scenario/complex.toml

@@ -0,0 +1,45 @@
+[metadata]
+name = "Complex Test"
+version = "1.0"
+description = "A more complex scenario with multiple requests"
+
+[runtime]
+duration_seconds = 300
+vus = 100
+prng_seed = 12345
+
+[target]
+base_url = "https://api.example.com"
+http_version = "http2"
+tls = true
+
+[[requests]]
+name = "get_users"
+method = "GET"
+path = "/api/users"
+timeout_ms = 5000
+weight = 70
+
+[[requests]]
+name = "create_user"
+method = "POST"
+path = "/api/users"
+timeout_ms = 10000
+body = '{"name": "test"}'
+weight = 20
+
+[[requests]]
+name = "delete_user"
+method = "DELETE"
+path = "/api/users/1"
+timeout_ms = 5000
+weight = 10
+
+[schedule]
+type = "ramp"
+vus = 100
+
+[assertions]
+p99_latency_ms = 500
+error_rate_max = 0.01
+success_rate_min = 0.99

corpus/scenario/empty.toml

@@ -0,0 +1 @@
+

corpus/scenario/invalid_garbage.toml

@@ -0,0 +1 @@
+garbage not toml

corpus/scenario/invalid_method.toml

@@ -0,0 +1,5 @@
+[[requests]]
+name = "test"
+method = "INVALID"
+path = "/"
+

corpus/scenario/only_metadata.toml

@@ -0,0 +1 @@
+[metadata]

corpus/scenario/partial.toml

@@ -0,0 +1,3 @@
+[metadata]
+name = "Test"
+

corpus/scenario/simple.toml

@@ -0,0 +1,21 @@
+[metadata]
+name = "Simple Test"
+version = "1.0"
+
+[runtime]
+duration_seconds = 60
+vus = 10
+
+[target]
+base_url = "http://localhost:8080"
+http_version = "http1.1"
+
+[[requests]]
+name = "get_root"
+method = "GET"
+path = "/"
+timeout_ms = 1000
+
+[schedule]
+type = "constant"
+vus = 10

corpus/scenario/unknown_section.toml

@@ -0,0 +1,3 @@
+[unknown_section]
+key = "value"
+

scripts/minimize-corpus.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+#
+# Z6 Corpus Minimization Script (Placeholder)
+#
+# This script will minimize fuzzing corpus files to reduce redundancy
+# while maintaining code coverage.
+#
+# Note: Full implementation requires external fuzzing tools (AFL++, libFuzzer)
+# which is deferred for future implementation.
+#
+
+set -e
+
+echo "Z6 Corpus Minimization"
+echo "======================"
+echo ""
+echo "Corpus directories:"
+echo "  corpus/http1_response/ - $(find corpus/http1_response -type f 2>/dev/null | wc -l) files"
+echo "  corpus/http2_frame/    - $(find corpus/http2_frame -type f 2>/dev/null | wc -l) files"
+echo "  corpus/hpack/          - $(find corpus/hpack -type f 2>/dev/null | wc -l) files"
+echo "  corpus/scenario/       - $(find corpus/scenario -type f 2>/dev/null | wc -l) files"
+echo "  corpus/event/          - $(find corpus/event -type f 2>/dev/null | wc -l) files"
+echo ""
+echo "Note: Full corpus minimization requires AFL++ or libFuzzer."
+echo "Current implementation uses deterministic PRNG-based fuzzing."
+echo ""
+echo "To minimize with libFuzzer (when available):"
+echo "  ./fuzz_target -merge=1 corpus_min/ corpus/"
+echo ""
+echo "To minimize with AFL++:"
+echo "  afl-cmin -i corpus/ -o corpus_min/ -- ./fuzz_target @@"