Skip to content

Fuzz Json Deserializing#117956

Merged
BrennanConroy merged 2 commits intodotnet:mainfrom
BrennanConroy:brecon/fuzzjsondeserialize
Feb 25, 2026
Merged

Fuzz Json Deserializing#117956
BrennanConroy merged 2 commits intodotnet:mainfrom
BrennanConroy:brecon/fuzzjsondeserialize

Conversation

@BrennanConroy
Copy link
Member

No description provided.

@dotnet-policy-service
Copy link
Contributor

Tagging subscribers to this area: @dotnet/area-system-text-json, @gregsdennis
See info in area-owners.md if you want to be subscribed.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds a new fuzzer called Utf8JsonReaderFuzzer to the .NET runtime fuzzing infrastructure. The fuzzer is designed to comprehensively test JSON deserialization functionality by comparing behavior between span-based and sequence-based Utf8JsonReader instances.

Key changes:

  • Implements a comprehensive JSON reader fuzzer that tests various data types and scenarios
  • Adds pipeline configuration to deploy the fuzzer to OneFuzz testing infrastructure
  • Includes testing for both primitive types and complex POCOs with dynamically generated types

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File Description
src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/Utf8JsonReaderFuzzer.cs Main fuzzer implementation with comprehensive JSON deserialization testing
src/libraries/Fuzzing/DotnetFuzzing/DotnetFuzzing.csproj Project file updated to include the new fuzzer
eng/pipelines/libraries/fuzzing/deploy-to-onefuzz.yml Pipeline configuration to deploy the fuzzer to OneFuzz

BrennanConroy and others added 2 commits February 24, 2026 22:26
- Replace Random seed with direct first-N-bytes control data so the
  fuzzing engine can see input-to-coverage relationship (MihaZupan)
- Remove commented-out Debugger.Launch() (eiriktsarpalis)
- Add double, long, Int128, char to ground types (eiriktsarpalis)
- Construct random types recursively with List<>, Dictionary<,>,
  record, and POCO variants at maxDepth 1 (eiriktsarpalis)
- Fix CompareExceptions(ex, ex) self-comparison bug
- Fix incorrect comments (GetString, not DateTime)
- Fix 'exponent exception' error message for same-key case

Co-authored-by: Copilot <[email protected]>
@BrennanConroy BrennanConroy force-pushed the brecon/fuzzjsondeserialize branch from a099b20 to a808151 Compare February 25, 2026 08:17
@MihaZupan
Copy link
Member

@MihuBot fuzz JsonReader -helix

@MihuBot
Copy link

MihuBot commented Feb 25, 2026

Ran the fuzzer(s) successfully. Code coverage reports:

@BrennanConroy BrennanConroy merged commit d63c175 into dotnet:main Feb 25, 2026
103 of 107 checks passed
@BrennanConroy BrennanConroy deleted the brecon/fuzzjsondeserialize branch February 25, 2026 22:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants