Testing, Fuzzing, and Regressions

Semantic tests, libFuzzer targets, sanitizers, regressions, and source coverage.

Verification layers

lazybios uses complementary checks:

• lazybios_semantic_test verifies specification-derived values and public API contracts. It catches wrong-but-memory-safe behavior such as signed temperature interpretation. Several of its cases assemble a lazybiosDMI_t by hand, which leaves the type index absent and keeps the parsers' table-walking fallback continuously exercised.
• Seven libFuzzer targets search for memory errors and undefined behavior in entry points, DMI tables, traversal helpers, lifecycle cleanup, file loaders, JSON serialization, and platform-neutral backend transformations.
• Saved regression inputs replay every previously fixed fuzzing crash.

Fuzzing is not an oracle for SMBIOS meaning. Add a semantic test whenever a bug returns an incorrect value without triggering a sanitizer.

Semantic tests

The semantic suite includes merged-file layout regressions for tightly concatenated tables and padded SMBIOS 2.x/3.x images whose entry points advertise a file-relative table offset.

cmake -S . -B build -DBUILD_TESTING=ON
cmake --build build
ctest --test-dir build --output-on-failure

Building fuzz targets

Clang and its libFuzzer runtime are required. ASan and UBSan are enabled by default.

cmake -S . -B build-fuzz -DCMAKE_C_COMPILER=clang \
    -DLAZYBIOS_BUILD_FUZZERS=ON
cmake --build build-fuzz
fuzz/run_all.sh build-fuzz 60 1048576

The final two arguments are seconds per target and maximum generated input size. The explicit large maximum exercises table-size and allocation arithmetic that a default small-input campaign can miss.

Fuzz target coverage

• fuzz_dmi_table: every Type 0 through Type 46 getter, plus the OEM getters.
• fuzz_entry_point: entry-point parsing and version helpers.
• fuzz_json: the cJSON serializers, driven from structures parsed out of an arbitrary table. Because the serializers read string pointers the parsers left pointing into that table, a parser that produced an out-of-bounds or unterminated string surfaces here rather than going unnoticed.
• fuzz_helpers: bounded traversal, counting, partial cleanup, and unavailable backend dispatch.
• fuzz_backend_buffers: Windows RawSMBIOSData conversion, raw-buffer loading used by macOS, physical-memory entry-point scanning shared by the /dev/mem backends, and checksum-validated SMBIOS 2.x/3.x table-location extraction used by NetBSD.
• fuzz_single_file: offset-aware and tightly concatenated merged files, including entry-point sizing, padding, seeking, and short reads.
• fuzz_two_files: the separate entry-point and table input mode on POSIX platforms.

The two file targets load through lazybiosInit, so the type index is built from every arbitrary table they generate and is fuzzed alongside the loaders themselves.

Operating-system calls themselves, including FreeBSD and DragonFly BSD kenv(2), NetBSD's sysctlbyname, the NetBSD and SunOS (Solaris/illumos) /dev/smbios interfaces, and the physical-memory access used by Haiku, BeOS, MINIX 3, and the generic fallback (mmap, pread, and lseek/read), and QNX's mmap_device_memory(), are integration-tested on their native systems; fuzzing covers the byte-processing code after those calls return. Enable the optional native check with LAZYBIOS_TEST_HOST_BACKEND=ON. CTest reports it as skipped when the host does not expose SMBIOS data or the current account lacks access.

Variants and coverage

Use LAZYBIOS_FUZZ_LOGGING=ON to retain debug-only paths, including checksum evaluation. Configure LAZYBIOS_FUZZ_SANITIZERS=memory for an MSan campaign. fuzz/check_variants.sh configures, builds, and runs the default ASan-plus-UBSan, debug-logging, and MSan matrix. Configure with an empty sanitizer list and LAZYBIOS_FUZZ_COVERAGE=ON, then run fuzz/coverage.sh, to generate an aggregate HTML source-coverage report. The report requires llvm-profdata and llvm-cov from the Clang toolchain.

Full commands and crash-reproduction instructions are maintained in fuzz/README.md.

See also

Building and Integration

Platform Notes and Limitations