Add fuzzing to CI

.github/workflows/cifuzz.yml

@@ -0,0 +1,75 @@
+name: CIFuzz
+
+on:
+  push:
+    branches:
+      - 'master'
+      - '[0-9].[0-9]+'  # matches to backport branches, e.g. 3.6
+  pull_request:
+    branches:
+      - 'master'
+      - '[0-9].[0-9]+'
+
+permissions: {}
+
+jobs:
+  Fuzzing:
+    name: Fuzzing (${{ matrix.sanitizer }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read  # For build_fuzzers to check out the code
+      issues: write  # To create a new issue in the last step
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address, undefined]
+    steps:
+      - name: Build Fuzzers
+        id: build
+        uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+        with:
+          oss-fuzz-project-name: 'aiohttp'
+          language: python
+          sanitizer: ${{ matrix.sanitizer }}
+      - name: Run Fuzzers
+        uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+        with:
+          oss-fuzz-project-name: 'aiohttp'
+          language: python
+          fuzz-seconds: 600
+          sanitizer: ${{ matrix.sanitizer }}
+      - name: Upload Crash
+        uses: actions/upload-artifact@v4
+        if: failure() && steps.build.outcome == 'success'
+        with:
+          name: ${{ matrix.sanitizer }}-artifacts
+          path: ./out/artifacts
+      - name: Open issue on post-merge crash
+        if: >-
+          failure()
+          && steps.build.outcome == 'success'
+          && github.event_name == 'push'
+        uses: actions/github-script@v9
+        env:
+          SANITIZER: ${{ matrix.sanitizer }}
+        with:
+          script: |
+            const branch = context.ref.replace('refs/heads/', '');
+            const shortSha = context.sha.substring(0, 7);
+            const sanitizer = process.env.SANITIZER;
+            const runUrl =
+              `${context.serverUrl}/${context.repo.owner}` +
+              `/${context.repo.repo}/actions/runs/${context.runId}`;
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: `CIFuzz: ${sanitizer} crash on ${branch} @ ${shortSha}`,
+              body: [
+                `CIFuzz found a crash on \`${branch}\` at ${context.sha}.`,
+                ``,
+                `- Sanitizer: \`${sanitizer}\``,
+                `- Run: ${runUrl}`,
+                `- Download \`${sanitizer}-artifacts\` from the run page for the reproducer.`,
+              ].join('\n'),
+              type: 'Bug',
+            });

.mypy.ini

@@ -1,5 +1,5 @@
 [mypy]
-files = aiohttp, docs/code, examples, tests
+files = aiohttp, docs/code, examples, fuzzers, tests
 check_untyped_defs = True
 follow_imports_for_stubs = True
 disallow_any_decorated = True

fuzzers/http_parser.py

@@ -0,0 +1,45 @@
+#!/usr/bin/python3
+
+# Copyright 2022-2025 Google LLC, 2026 aio-libs contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import asyncio
+import sys
+from contextlib import suppress
+from unittest import mock
+
+import atheris  # noqa: I900
+
+with atheris.instrument_imports():
+    from aiohttp.base_protocol import BaseProtocol
+    from aiohttp.http_exceptions import BadHttpMessage
+    from aiohttp.http_parser import HttpRequestParserC, HttpRequestParserPy
+
+AIOHTTP_VAL = 0
+HttpRequestParser = HttpRequestParserC if AIOHTTP_VAL == 0 else HttpRequestParserPy
+LOOP = mock.create_autospec(asyncio.AbstractEventLoop, spec_set=True, instance=True)
+PROTOCOL = BaseProtocol(LOOP)
+
+
+@atheris.instrument_func
+def TestOneInput(data: bytes) -> None:
+    parser = HttpRequestParser(PROTOCOL, LOOP, 32768)
+    with suppress(BadHttpMessage):
+        parser.feed_data(data)
+        parser.feed_eof()
+
+
+if __name__ == "__main__":
+    atheris.Setup(sys.argv, TestOneInput, enable_python_coverage=True)
+    atheris.Fuzz()

fuzzers/http_payload_parser.py

@@ -0,0 +1,44 @@
+#!/usr/bin/python3
+
+# Copyright 2022-2025 Google LLC, 2026 aio-libs contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import asyncio
+import sys
+from contextlib import suppress
+from unittest import mock
+
+import atheris  # noqa: I900
+
+with atheris.instrument_imports():
+    from aiohttp import StreamReader
+    from aiohttp.base_protocol import BaseProtocol
+    from aiohttp.http_exceptions import BadHttpMessage
+    from aiohttp.http_parser import HeadersParser, HttpPayloadParser
+
+LOOP = mock.create_autospec(asyncio.AbstractEventLoop, spec_set=True, instance=True)
+PROTOCOL = BaseProtocol(LOOP)
+
+
+@atheris.instrument_func
+def TestOneInput(data: bytes) -> None:
+    out = StreamReader(PROTOCOL, 2**16, loop=LOOP)
+    parser = HttpPayloadParser(out, headers_parser=HeadersParser())
+    with suppress(BadHttpMessage):
+        parser.feed_data(data)
+
+
+if __name__ == "__main__":
+    atheris.Setup(sys.argv, TestOneInput, enable_python_coverage=True)
+    atheris.Fuzz()

fuzzers/multipart.py

@@ -0,0 +1,67 @@
+#!/usr/bin/python3
+
+# Copyright 2022-2025 Google LLC, 2026 aio-libs contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import asyncio
+import io
+import sys
+from contextlib import suppress
+
+import atheris  # noqa: I900
+
+with atheris.instrument_imports():
+    from aiohttp import BodyPartReader
+    from aiohttp.hdrs import CONTENT_TYPE
+    from aiohttp.helpers import HeadersDictProxy
+
+
+class FuzzStream(StreamReader):
+    def __init__(self, content: bytes):
+        self.content = io.BytesIO(content)
+
+    async def read(self, size: int | None = None) -> bytes:
+        return self.content.read(size)
+
+    def at_eof(self) -> bool:
+        return self.content.tell() == len(self.content.getbuffer())
+
+    async def readline(self) -> bytes:
+        return self.content.readline()
+
+    def unread_data(self, data: bytes) -> None:
+        self.content = io.BytesIO(data + self.content.read())
+
+
+@atheris.instrument_func
+async def fuzz_bodypart_reader(data: bytes) -> None:
+    fdp = atheris.FuzzedDataProvider(data)
+    obj = BodyPartReader(
+        b"--:",
+        HeadersDictProxy({CONTENT_TYPE: fdp.ConsumeUnicode(30)}),
+        FuzzStream(fdp.ConsumeBytes(atheris.ALL_REMAINING)),
+    )
+    if not obj.at_eof():
+        await obj.form()
+
+
+@atheris.instrument_func
+def TestOneInput(data: bytes) -> None:
+    with suppress(ValueError):
+        asyncio.run(fuzz_bodypart_reader(data))
+
+
+if __name__ == "__main__":
+    atheris.Setup(sys.argv, TestOneInput)
+    atheris.Fuzz()

fuzzers/payload_url.py

@@ -0,0 +1,41 @@
+#!/usr/bin/python3
+
+# Copyright 2022-2025 Google LLC, 2026 aio-libs contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import sys
+from contextlib import suppress
+
+import atheris  # noqa: I900
+
+with atheris.instrument_imports():
+    from yarl import URL
+
+    from aiohttp.payload import StringPayload
+
+
+@atheris.instrument_func
+def TestOneInput(data: bytes) -> None:
+    fdp = atheris.FuzzedDataProvider(data)
+    original = fdp.ConsumeString(sys.maxsize)
+
+    with suppress(UnicodeEncodeError):
+        StringPayload(original)
+    with suppress(ValueError):
+        URL(original)
+
+
+if __name__ == "__main__":
+    atheris.Setup(sys.argv, TestOneInput, enable_python_coverage=True)
+    atheris.Fuzz()

fuzzers/web_request.py

@@ -0,0 +1,54 @@
+#!/usr/bin/python3
+
+# Copyright 2022-2025 Google LLC, 2026 aio-libs contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import asyncio
+import sys
+
+import atheris  # noqa: I900
+
+with atheris.instrument_imports():
+    from multidict import CIMultiDict
+    from yarl import URL
+
+    from aiohttp.test_utils import make_mocked_request
+
+
+@atheris.instrument_func
+async def fuzz_run_one_async(data: bytes) -> None:
+    fdp = atheris.FuzzedDataProvider(data)
+    url_s = fdp.ConsumeString(fdp.ConsumeIntInRange(0, 512))
+    try:
+        URL(url_s)
+    except ValueError:
+        return
+
+    headers = CIMultiDict(
+        {fdp.ConsumeString(20): fdp.ConsumeString(fdp.ConsumeIntInRange(0, 512))}
+    )
+    req = make_mocked_request("GET", url_s, headers=headers)
+
+    req.forwarded
+    await req.post()
+
+
+@atheris.instrument_func
+def TestOneInput(data: bytes) -> None:
+    asyncio.run(fuzz_run_one_async(data))
+
+
+if __name__ == "__main__":
+    atheris.Setup(sys.argv, TestOneInput, enable_python_coverage=True)
+    atheris.Fuzz()

requirements/lint.in

@@ -1,4 +1,5 @@
 aiodns
+atheris
 backports.zstd; implementation_name == "cpython" and python_version < "3.14"
 blockbuster
 freezegun

requirements/lint.txt

@@ -18,6 +18,8 @@ async-timeout==5.0.1
     # via
     #   aiohttp
     #   valkey
+atheris==3.0.0
+    # via -r requirements/lint.in
 attrs==26.1.0
     # via aiohttp
 backports-asyncio-runner==1.2.0