Summary
Add libFuzzer harnesses for the code paths that parse untrusted network bytes, and add an AddressSanitizer/UndefinedBehaviorSanitizer job to CI.
Motivation
Every byte that arrives on the socket is attacker controlled. The parsing code (offline message handling, reliability layer reassembly, plugin BitStream consumers) is inherited C++ that predates modern memory safety tooling, and the RakNet family has a history of memory safety CVEs in exactly these paths. Continuous fuzzing plus sanitizers is the standard baseline for a networking library and is cheap to add given the existing CMake/CTest setup.
Scope
Fuzz entry points, each as a small LLVMFuzzerTestOneInput harness that feeds raw bytes into the parser:
- Offline message handling in
RakPeer (unconnected pings, connection requests, open connection replies)
ReliabilityLayer::HandleSocketReceiveFromConnectedPlayer (datagram parsing, ack ranges, split packet reassembly)BitStream consumers in bundled plugins: NatPunchthroughClient/Server, ReplicaManager3, RPC4Plugin, FileListTransfer
CI additions to .github/workflows/build.yml:
- A Linux job building with
-fsanitize=address,undefined and running the unit and integration suites
- A short fuzzing smoke job (for example 60 seconds per harness) so regressions are caught on every PR; longer runs can come later via OSS-Fuzz or a scheduled workflow
Acceptance criteria
- Harnesses build behind a CMake option (for example
MAFIANET_BUILD_FUZZERS) with clang/libFuzzer
- Seed corpora checked in under
Tests/Fuzz/corpus/
- CI fails on any sanitizer report from the existing test suites
Summary
Add libFuzzer harnesses for the code paths that parse untrusted network bytes, and add an AddressSanitizer/UndefinedBehaviorSanitizer job to CI.
Motivation
Every byte that arrives on the socket is attacker controlled. The parsing code (offline message handling, reliability layer reassembly, plugin BitStream consumers) is inherited C++ that predates modern memory safety tooling, and the RakNet family has a history of memory safety CVEs in exactly these paths. Continuous fuzzing plus sanitizers is the standard baseline for a networking library and is cheap to add given the existing CMake/CTest setup.
Scope
Fuzz entry points, each as a small
LLVMFuzzerTestOneInputharness that feeds raw bytes into the parser:RakPeer(unconnected pings, connection requests, open connection replies)ReliabilityLayer::HandleSocketReceiveFromConnectedPlayer(datagram parsing, ack ranges, split packet reassembly)BitStreamconsumers in bundled plugins: NatPunchthroughClient/Server, ReplicaManager3, RPC4Plugin, FileListTransferCI additions to
.github/workflows/build.yml:-fsanitize=address,undefinedand running the unit and integration suitesAcceptance criteria
MAFIANET_BUILD_FUZZERS) with clang/libFuzzerTests/Fuzz/corpus/