feat: add fuzzing harness and infrastructure

[mirkobitetto]

All Submissions:

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

New Feature Submissions:

• Does your submission pass tests?

Changes to Core Features:

• Have you added an explanation of what your changes do and why you'd like us to include them?

---

🔍 What This PR Does

This PR introduces native fuzz testing support to CryptoLib. The implementation is designed to help uncover memory safety issues and logic bugs across core security-related APIs. This is in response to Issue #369.

---

🧪 Included in This PR

• A fuzzing harness (fuzz_harness.c) based on LLVMFuzzerTestOneInput, targeting 7 critical API functions:

  • Crypto_TC_ApplySecurity
  • Crypto_TC_ProcessSecurity
  • Crypto_TM_ApplySecurity
  • Crypto_TM_ProcessSecurity
  • Crypto_AOS_ApplySecurity
  • Crypto_AOS_ProcessSecurity
  • Crypto_TC_Parse_Check_FECF

• Persistent mode support with a reset_cryptolib() to ensure state isolation per fuzz iteration.

• Corpus generation script (generate_corpus.py) to seed fuzzing campaigns with protocol-valid frames across TC, TM, and AOS.

• Multithreaded fuzzing launcher (run-fuzz-multithreaded.sh) using AFL++ best practices:

  • CMPLOG, ASAN, LAF-Intel (CompCov), MOpt, and custom power schedules
  • Parallelized with screen sessions
  • Periodic status reports using afl-whatsup

• Build script (build-fuzz.sh) compiling 4 fuzz-targeted instrumented builds:

  • Default, AddressSanitizer, CMPLOG, and CompCov
  • Optional performance-optimized builds with -march=native, AVX2/FMA, -flto, etc.

• CMake integration via ENABLE_FUZZING toggle.

---

🧪 How to Test These Changes

1. Install AFL++.
2. Run the build script:

   cd fuzz/scripts
   ./build-fuzz.sh

3. Generate corpus:

   cd ../
   python generate_corpus.py

4. Launch multi-core fuzzing:

   ./scripts/run-fuzz-multithreaded.sh

5. Monitor progress with:

   screen -ls
   screen -r afl_main
   afl-whatsup -s output/

---

📌 Additional Notes

• The fuzzing corpus currently uses a basic randomized generator. There is room for future enhancement using protocol-aware or coverage-guided corpus generation techniques.

• This was developed as part of my master’s thesis, which focuses on evaluating the security of open-source software for satellite systems. Although designed as a PoC, it has reached ~78% code coverage and already helped uncover multiple vulnerabilities (CVE-2025-29909, CVE-2025-29910, CVE-2025-29911, CVE-2025-29912, CVE-2025-29913 ).

• The implementation needs some improvements to be extended or integrated into a CI/CD pipeline with further performance and coverage optimizations.

[Donnie-Ice]

Got it running on my side!

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 75.79%. Comparing base (14ee573) to head (137420c).
Report is 147 commits behind head on dev.

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #442      +/-   ##
==========================================
- Coverage   75.97%   75.79%   -0.19%     
==========================================
  Files          81       80       -1     
  Lines       22263    22812     +549     
  Branches     1807     1845      +38     
==========================================
+ Hits        16914    17290     +376     
- Misses       4707     4850     +143     
- Partials      642      672      +30     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mirkobitetto]

While testing the fuzzing integration this morning before opening the PR, I identified a new potential vulnerability. I’ve already reported it through NASA’s Bugcrowd.

Let me know if you'd also like me to open a GitHub Security Advisory for it, to keep tracking consistent across platforms.

[Donnie-Ice]

I don't believe any of us have access to that. If it is easy to transfer to a security advisory, I would greatly appreciate being able to get a head start on a fix!

[jlucas9]

Merging into cryptolib#369-fuzz to update the dockerfile and get AFL++ included for this!