[wberry-godaddy]

Summary

Adds Go native fuzz tests (go test -fuzz, https://go.dev/doc/security/fuzz/) targeting the Cobhan FFI boundary: the length-prefixed buffers and headers this library hands back and forth across a foreign-language call boundary (C, Java, Python, Node, .NET, ...) and therefore cannot assume are well-formed.

This was built test-driven: fuzz tests added first (red), each distinct bug documented below, then fixed one at a time. go test -race ./... is green as of the latest commit.

Also adds -race to scripts/test.sh (required for the checkptr-class crashes below to actually be caught). (The .github/workflows/test.yml Go-version-matrix change that was previously bundled into this PR has been split out into #21, to keep this PR scoped purely to testing and the fixes it drove.)

Targets added

Target	Exercises
FuzzStringRoundTrip	AllocateStringBuffer -> BufferToStringSafe
FuzzBytesRoundTrip	AllocateBytesBuffer -> BufferToBytesSafe
FuzzBufferToJson	arbitrary bytes -> BufferToJsonSafe
FuzzBufferToJsonStruct	arbitrary bytes -> BufferToJsonStructSafe
FuzzRawBufferHeader	a hand-constructed buffer (arbitrary int32 length header + arbitrary payload) -> BufferToBytes/BufferToString directly on the raw pointer, bypassing AllocateBuffer entirely -- simulates a caller whose header doesn't match its actual payload

Run any target with, e.g.:

go test -race -fuzz=FuzzStringRoundTrip -fuzztime=60s

-race matters -- several of the bugs below only manifest under checkptr instrumentation (enabled by -race, or GODEBUG=checkptr=1); a plain go test -fuzz=... build will not find them.

Each target has also been run for 45-60s of mutation-based fuzzing under -race with no further crashes (millions of executions each).

Bugs found and fixed

1. int32 negation overflow in tempToBytes -> unrecoverable OOM crash (fixed in b72f35c)

cobhan.go (tempToBytes): for a length header of exactly math.MinInt32, two's-complement negation overflows back to math.MinInt32 (still negative). The code proceeded to treat this as a temp-file-name length and called C.GoStringN with it, attempting an ~18 exabyte allocation:

runtime: out of memory: cannot allocate 18446744071562067968-byte block
fatal error: out of memory

This is a fatal error, not a panic -- recover() cannot catch it, and it reproduced in any build mode, not just -race. Highest severity of the bunch: a single corrupted or malicious 4-byte length header killed the entire host process outright.

Fix: reject a still-negative result after negation instead of proceeding.

2. BufferToJson panics on valid JSON that isn't an object (fixed in cd4c1dc)

cobhan.go (BufferToJson) did loadedJson.(map[string]interface{}) unconditionally. Any valid JSON whose top-level value isn't an object ([1,2,3], "a string", 42, null, true) panicked instead of returning ERR_JSON_DECODE_FAILED.

Fix: use the ok-form type assertion and return ERR_JSON_DECODE_FAILED when the top-level value isn't a map.

3. Zero-length buffer -> checkptr fatal crash (fixed in 414972e; same root cause as #18)

bufferPtrToDataPtr computed a data pointer via raw uintptr(bufferPtr) + BUFFER_HEADER_SIZE unconditionally, even for a zero-length (header-only) buffer, landing exactly one byte past the end of the allocation. Never dereferenced for length 0, but forming it via manual pointer arithmetic is exactly what checkptr flags:

fatal error: checkptr: pointer arithmetic result points to invalid allocation

Reached independently from FuzzStringRoundTrip, FuzzBytesRoundTrip, FuzzBufferToJson, FuzzBufferToJsonStruct, and FuzzRawBufferHeader -- five different entry points into the same root cause.

Fix: short-circuit on length == 0 in bufferPtrToString, bufferPtrToBytes, and BytesToBuffer instead of forming the invalid pointer. This is the same bug already fixed independently in #18 -- closed that PR in favor of this one, since the fuzz tests here catch it from five entry points instead of two, and this PR also adds -race to CI so it stays caught going forward.

4. Header claiming more data than the buffer holds -> silent heap over-read (documented as an accepted limitation, not fixed -- see 322aa5b)

bufferPtrToBytes/bufferPtrToString trust the header's claimed length completely, with no way to validate it against the true size of the backing allocation -- these functions only ever see a bare pointer, and in real usage that pointer often refers to foreign (non-Go) memory that Go's runtime has no visibility into at all.

In a normal (non--race) build, a header claiming more data than was actually written succeeds silently and returns bytes read past the end of the real buffer (confirmed: 4 real payload bytes written, 64 requested and returned, with the extra 60 bytes being whatever adjacent memory happened to contain). Also reachable via the negative/temp-file-name-length encoding, not just a direct oversized header.

Disposition: I initially treated this as bug #4 to fix, but there is no code-level fix available at this API surface -- BufferToBytes/BufferToString take only a pointer, with no independent capacity to check the header against. Cobhan's own write path (BytesToBuffer) always keeps the header accurate; a mismatch can only happen from a corrupted buffer or a bug in another language's Cobhan binding, i.e. it's the same class of "trust the sender" risk inherent to any length-prefixed wire format. A real fix would mean changing these functions' signatures (and therefore the C ABI every Cobhan binding depends on) to also carry a capacity -- out of scope here.

Documented with a comment on bufferPtrToBytes. FuzzRawBufferHeader explicitly skips generating this scenario (via t.Skip) rather than asserting on something unfixable, while still fully exercising math.MinInt32 (bug #1's regression case, which is fixed).

CI changes

• scripts/test.sh now runs with -race (needed for bugs Set up boilerplate GoDaddy docs #1 and Go Parity #3 above to actually be caught in CI going forward).
• The .github/workflows/test.yml Go version matrix update (stable/oldstable instead of a hardcoded 1.24) has been moved to CI: test stable/oldstable Go matrix, bump actions #21, unrelated to fuzz testing.

Testing

$ go test -race ./...
ok  	github.com/godaddy/cobhan-go	1.6s	coverage: 87.7% of statements