Bounded fuzz baseline: 7515b79
This is Venom's first evidence-backed parser fuzz baseline. All five jobs passed
in Scheduled Fuzzing run 30650839395
for commit 7515b79.
| Target | Executions | Average exec/s | New units | Corpus files | Peak RSS | Crashes |
|---|---|---|---|---|---|---|
| HTTP | 19,583,851 | 321,046 | 3,912 | 369 | 504 MiB | 0 |
| JSON | 5,599,000 | 91,786 | 7,795 | 1,435 | 570 MiB | 0 |
| YAML | 1,569,703 | 25,732 | 7,330 | 2,747 | 283 MiB | 0 |
| XML | 3,919,957 | 64,261 | 5,389 | 778 | 553 MiB | 0 |
| Text / URL | 1,828,203 | 29,970 | 8,253 | 3,067 | 564 MiB | 0 |
| Total | 32,500,714 | - | 32,679 | 8,396 | - | 0 |
Each target received a 60-second budget; libFuzzer reported 61 seconds at the budget boundary. The wider 90-105 second workflow-step wall times include harness compilation and startup. Counts are per isolated target job and must not be interpreted as application throughput.
Environment and provenance
- Runner: GitHub-hosted Ubuntu 24.04
- Compiler:
rustc 1.99.0-nightly (8ab9fdff5 2026-07-30) - Engine:
cargo-fuzzwith libFuzzer and AddressSanitizer - Machine-readable record:
7515b79.json - Raw libFuzzer logs and per-target summaries: workflow artifacts retained for 90 days; identifiers and digests are in the JSON record.
The preceding run 30650512500
failed while linking sanitizer coverage with workspace release LTO, before any
target executed. Commit 7515b79 disables LTO and stripping only for fuzz
harnesses; product release profiles are unchanged.
No crash or sanitizer finding was observed in this bounded run. That is a regression signal for these five harnesses at this exact commit, not proof that the parsers or Venom are safe.
