Repository navigation
fuzz: add Datalog parser and expression evaluator fuzz targets #213
Description
Source
Extracted from the reliability audit snippet: malicious/property-style tests, fuzz tests, randomized inputs, parser/evaluator catch-alls.
Programmatic test scope
Add fuzz targets for Datalog parsing and expression evaluation.
Targets to cover
- Datalog parser input bytes/string corpus.
- Expression clauses, arithmetic, predicates, regex predicates, bind slots.
- Nested
not,not-join,or,or-join, rules, aggregates, and window syntax.
Acceptance criteria
- Fuzzing rejects invalid input with errors instead of panics.
- No unbounded allocation on malformed or deeply nested input.
- Add seed corpus entries for past parser/security edge cases.
- Document the local command and optional CI/nightly workflow.
Activity
adityamukho commentedon May 2, 2026
Audit finding: The parser has confirmed
unwrap()panics on number overflow at parser.rs:151-174.parse_number()collects digits without length limit, then.parse::<i64>().unwrap()panics on overflow. Input like99999999999999999999crashes the library.This is a concrete DoS vector — especially relevant given Minigraf targets AI agent use cases where inputs are LLM-generated (prone to producing overflow values). The fix will land separately, but fuzz targets in this issue's scope would prevent regression.
chore(wave3): foundation — FaultInjectingBackend, fuzz/ crate, propte…
Merge pull request #256 from project-minigraf/wave3/pr4-query