security: add bounded decoder fuzzing

Author: farhan-syah

.github/workflows/fuzz.yml

@@ -0,0 +1,72 @@
+name: ASan fuzz + 32-bit corpus/property
+
+on:
+  pull_request:
+  schedule:
+    - cron: "23 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  asan-fuzz:
+    name: ASan libFuzzer x86_64 / ${{ matrix.target.name }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - name: codec_decoders
+            dictionary: fuzz/dictionaries/binary.dict
+          - name: columnar_segment
+            dictionary: fuzz/dictionaries/binary.dict
+          - name: strict_tuple
+            dictionary: fuzz/dictionaries/binary.dict
+          - name: wal_readers
+            dictionary: fuzz/dictionaries/binary.dict
+          - name: msgpack_document
+            dictionary: fuzz/dictionaries/binary.dict
+          - name: sql_preprocess
+            dictionary: fuzz/dictionaries/sql.dict
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: dtolnay/rust-toolchain@4fd1da8b0805d2d2e936788875a7d65dbd677dc2
+        with:
+          toolchain: nightly
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+      - name: Run bounded ASan fuzzing
+        run: |
+          cargo fuzz run --sanitizer address --target x86_64-unknown-linux-gnu "${{ matrix.target.name }}" -- \
+            -max_total_time=60 -runs=0 -max_len=1048576 -timeout=10 \
+            -rss_limit_mb=2048 -dict="${{ matrix.target.dictionary }}"
+      - name: Upload crash artifacts
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: fuzz-crashes-x86_64-${{ matrix.target.name }}
+          path: fuzz/artifacts/${{ matrix.target.name }}
+          if-no-files-found: ignore
+
+  corpus-properties-32:
+    name: 32-bit i686 deterministic corpus/property (no ASan, no libFuzzer)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      DEBIAN_FRONTEND: noninteractive
+      NEEDRESTART_MODE: a
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install i686 runtime dependencies
+        run: |
+          sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a dpkg --add-architecture i386
+          sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get update
+          sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y gcc-multilib g++-multilib libc6-dev-i386 libc6-i386 libgcc-s1:i386 libstdc++6:i386
+      - uses: dtolnay/rust-toolchain@4fd1da8b0805d2d2e936788875a7d65dbd677dc2
+        with:
+          toolchain: nightly
+          targets: i686-unknown-linux-gnu
+      - name: Run deterministic 32-bit corpus/property checks
+        run: cargo run --manifest-path fuzz/Cargo.toml --no-default-features --features i686-corpus --bin corpus_properties_32 --target i686-unknown-linux-gnu

.gitignore

@@ -1,5 +1,7 @@
 # Rust build artifacts
 /target/
+/fuzz/target/
+/fuzz/artifacts/
 /releases/
 
 # Data directories (fallback default or manual testing)