kingchenc
b003321562
The fuzz suite previously covered only `Rsi(14)` and `Ema(20)` — 2 of 71 indicators, no OHLCV coverage at all. Audit finding R9 asked for ATR/ADX/Stochastic/PSAR as a minimum; this commit goes further and brings every indicator under fuzz. - `indicator_update` (rewritten): drives every scalar-input indicator through one streaming pass + one batch call per iteration. Covers SMA, EMA, WMA, RSI, DEMA, TEMA, HMA, ROC, TRIX, SMMA, TRIMA, ZLEMA, KAMA, T3, MOM, CMO, TSI, PMO, StochRSI, DPO, PPO, Coppock, StdDev, UlcerIndex, HistoricalVolatility, LinearRegression, LinRegSlope, LinRegAngle, VHF, ZScore, MACD, BollingerBands. A `drive` helper marked `#[inline(never)]` keeps each indicator on its own panic backtrace frame. - `indicator_update_candle` (new): chunks the fuzz `f64` stream into `[open, high, low, close, volume]` tuples, builds candles via `Candle::new` (skipping ones that fail OHLCV validation — that path is fuzz-tested separately), then drives every candle-input indicator through streaming + batch. Covers ATR, NATR, TrueRange, ChaikinVolatility, Keltner, Donchian, PSAR, SuperTrend, ChandelierExit, ChandeKrollStop, ATRTrailingStop, ADX, Aroon, AroonOscillator, Vortex, MassIndex, ChoppinessIndex, CCI, WilliamsR, AwesomeOscillator, AcceleratorOscillator, UltimateOscillator, BalanceOfPower, OBV, MFI, VWAP, RollingVWAP, VWMA, ADL, VPT, CMF, ChaikinOscillator, ForceIndex, EaseOfMovement, TypicalPrice, MedianPrice, WeightedClose, Stochastic. - `fuzz/Cargo.toml` registers the new target; `fuzz/README.md` describes both expanded targets. - A `fuzz-smoke` CI job runs each of the five targets for 30 s on every push and pull-request — enough to catch a regression in the harness without slowing CI to a crawl. Long fuzz campaigns belong on dedicated infrastructure with persistent corpora.
44 lines
2.1 KiB
Markdown
44 lines
2.1 KiB
Markdown
# Fuzzing Wickra
|
|
|
|
[`cargo-fuzz`](https://rust-fuzz.github.io/book/cargo-fuzz.html) harnesses for
|
|
the parsing and stateful entry points of Wickra. Fuzzing requires a nightly
|
|
Rust toolchain.
|
|
|
|
## Setup
|
|
|
|
```bash
|
|
cargo install cargo-fuzz
|
|
rustup toolchain install nightly
|
|
```
|
|
|
|
## Targets
|
|
|
|
| Target | What it exercises |
|
|
| --- | --- |
|
|
| `csv_reader` | `CandleReader` over arbitrary bytes — headers, cells, BOM, binary noise. |
|
|
| `binance_envelope` | `RawWsEnvelope` deserialization from arbitrary strings. |
|
|
| `indicator_update` | Every scalar-input indicator (SMA / EMA / WMA / RSI / DEMA / TEMA / HMA / ROC / TRIX / SMMA / TRIMA / ZLEMA / KAMA / T3 / MOM / CMO / TSI / PMO / StochRSI / DPO / PPO / Coppock / StdDev / UlcerIndex / HistoricalVolatility / LinearRegression / LinRegSlope / LinRegAngle / VHF / ZScore / MACD / Bollinger) streamed + batched over arbitrary `f64` sequences (NaN, ±inf, jumps). |
|
|
| `indicator_update_candle` | Every candle-input indicator (ATR, NATR, TrueRange, ChaikinVolatility, Keltner, Donchian, PSAR, SuperTrend, ChandelierExit, ChandeKrollStop, ATRTrailingStop, ADX, Aroon, AroonOscillator, Vortex, MassIndex, ChoppinessIndex, CCI, WilliamsR, AwesomeOscillator, AcceleratorOscillator, UltimateOscillator, BalanceOfPower, OBV, MFI, VWAP, RollingVWAP, VWMA, ADL, VPT, CMF, ChaikinOscillator, ForceIndex, EaseOfMovement, TypicalPrice, MedianPrice, WeightedClose, Stochastic) streamed + batched over fuzz-derived OHLCV candles. |
|
|
| `tick_aggregator` | `TickAggregator` over arbitrary `(price, volume, timestamp)` triples. |
|
|
|
|
## Run
|
|
|
|
```bash
|
|
# From the repository root:
|
|
cargo +nightly fuzz run csv_reader
|
|
cargo +nightly fuzz run binance_envelope
|
|
cargo +nightly fuzz run indicator_update
|
|
cargo +nightly fuzz run indicator_update_candle
|
|
cargo +nightly fuzz run tick_aggregator
|
|
```
|
|
|
|
Each run continues until a crash is found or it is interrupted. A short
|
|
time-boxed smoke run is useful in CI:
|
|
|
|
```bash
|
|
cargo +nightly fuzz run csv_reader -- -max_total_time=60
|
|
```
|
|
|
|
The expectation for every target is that it never panics: malformed or
|
|
adversarial input must surface as an `Err`, never a crash.
|