first commit

internal/vcard/vcard_fuzz_test.go

@@ -0,0 +1,29 @@
+package vcard
+
+import "testing"
+
+func FuzzParse(f *testing.F) {
+	f.Add("BEGIN:VCARD\r\nVERSION:4.0\r\nUID:test-1\r\nFN:Test Person\r\nEND:VCARD\r\n")
+	f.Add("BEGIN:VCARD\nUID:no-crlf\nEND:VCARD\n")
+	f.Add("BEGIN:VCARD\r\nUID:folded\r\nNOTE:line one\r\n continued\r\nEND:VCARD\r\n")
+	f.Add("BEGIN:VCARD\r\nUID:escaped\r\nNOTE:a\\,b\\;c\\\\d\\ne\r\nEND:VCARD\r\n")
+	f.Add("")
+	f.Add("BEGIN:VCARD\r\nEND:VCARD\r\n")
+	f.Add("not a vcard at all")
+	f.Add("BEGIN:VCARD\r\n:\r\nEND:VCARD\r\n")
+	f.Add("BEGIN:VCARD\r\nUID\r\nEND:VCARD\r\n")
+	f.Add("BEGIN:VCARD\r\n;;;:;;;\r\nUID:x\r\nEND:VCARD\r\n")
+
+	f.Fuzz(func(t *testing.T, data string) {
+		// The only contract checked here: Parse must never panic on any
+		// input, malformed or not — a returned error is fine, a crash is
+		// not, since this parser runs on untrusted client-supplied CardDAV
+		// PUT bodies.
+		defer func() {
+			if r := recover(); r != nil {
+				t.Fatalf("Parse panicked on input %q: %v", data, r)
+			}
+		}()
+		Parse(data)
+	})
+}