10 files changed, 146 insertions, 0 deletions
diff --git a/fuzz/fuzz_dns.cpp b/fuzz/fuzz_dns.cpp
new file mode 100644
index 0000000..136c8f0
--- /dev/null
+++ b/fuzz/fuzz_dns.cpp
@@ -0,0 +1,15 @@
+#include <cstddef>
+#include <cstdint>
+
+#include "wireframe/l7/dns.hpp"
+
+// DNS name decoding (length-prefixed labels, a historically bug-prone
+// area in real-world parsers) is the main risk here - fuzz both the
+// raw parser and the dissector wrapper main.cpp actually calls.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    wireframe::net::parse_dns({data, size});
+
+    wireframe::net::DnsDissector dissector;
+    dissector.summarize({data, size});
+    return 0;
+}
diff --git a/fuzz/fuzz_ethernet.cpp b/fuzz/fuzz_ethernet.cpp
new file mode 100644
index 0000000..91aa6d5
--- /dev/null
+++ b/fuzz/fuzz_ethernet.cpp
@@ -0,0 +1,9 @@
+#include <cstddef>
+#include <cstdint>
+
+#include "wireframe/net/ethernet.hpp"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    wireframe::net::parse_ethernet({data, size});
+    return 0;
+}
diff --git a/fuzz/fuzz_http.cpp b/fuzz/fuzz_http.cpp
new file mode 100644
index 0000000..18a9f69
--- /dev/null
+++ b/fuzz/fuzz_http.cpp
@@ -0,0 +1,15 @@
+#include <cstddef>
+#include <cstdint>
+
+#include "wireframe/l7/http.hpp"
+
+// Hand-rolled string_view scanning (request-line split, Host: header
+// search) is new, bug-prone-by-nature logic - worth fuzzing on its own,
+// separate from fuzz_summarize's full-pipeline coverage.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    wireframe::net::parse_http({data, size});
+
+    wireframe::net::HttpDissector dissector;
+    dissector.summarize({data, size});
+    return 0;
+}
diff --git a/fuzz/fuzz_ipv4.cpp b/fuzz/fuzz_ipv4.cpp
new file mode 100644
index 0000000..10b6530
--- /dev/null
+++ b/fuzz/fuzz_ipv4.cpp
@@ -0,0 +1,9 @@
+#include <cstddef>
+#include <cstdint>
+
+#include "wireframe/net/ipv4.hpp"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    wireframe::net::parse_ipv4({data, size});
+    return 0;
+}
diff --git a/fuzz/fuzz_ipv6.cpp b/fuzz/fuzz_ipv6.cpp
new file mode 100644
index 0000000..1cae072
--- /dev/null
+++ b/fuzz/fuzz_ipv6.cpp
@@ -0,0 +1,24 @@
+#include <cstddef>
+#include <cstdint>
+
+#include "wireframe/net/ipv6.hpp"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    auto packet = wireframe::net::parse_ipv6({data, size});
+    if (packet) {
+        // Also exercise the RFC 5952 address formatter - it does its
+        // own byte manipulation (zero-run detection) independent of
+        // parse_ipv6, worth fuzzing on whatever bytes made it through.
+        wireframe::net::ipv6_to_string(packet->header.src);
+        wireframe::net::ipv6_to_string(packet->header.dst);
+
+        // Extension-header walking: a loop that repeatedly trusts an
+        // attacker-controlled length field to advance through the
+        // buffer, over up to 8 iterations - exactly the shape of bug
+        // most worth fuzzing. header.next_header seeds which branch of
+        // the walker runs first; the walker's own logic picks whatever
+        // comes after based on each header's own next_header byte.
+        wireframe::net::walk_ipv6_extension_headers(packet->header.next_header, packet->payload);
+    }
+    return 0;
+}
diff --git a/fuzz/fuzz_pcapng_reader.cpp b/fuzz/fuzz_pcapng_reader.cpp
new file mode 100644
index 0000000..e27675b
--- /dev/null
+++ b/fuzz/fuzz_pcapng_reader.cpp
@@ -0,0 +1,21 @@
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+
+#include "wireframe/pcapng/reader.hpp"
+
+// Reader parses file/network data that isn't necessarily our own
+// writer's output - a user could point it at any file. fmemopen()
+// gives libFuzzer's byte buffer a FILE* without touching a real file.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    FILE* file = fmemopen(const_cast<uint8_t*>(data), size, "rb");
+    if (file == nullptr) return 0;
+
+    wireframe::pcapng::Reader reader(file);
+    while (reader.next_packet()) {
+        // keep draining until EOF/malformed-block termination
+    }
+
+    std::fclose(file);
+    return 0;
+}
diff --git a/fuzz/fuzz_summarize.cpp b/fuzz/fuzz_summarize.cpp
new file mode 100644
index 0000000..c1872fd
--- /dev/null
+++ b/fuzz/fuzz_summarize.cpp
@@ -0,0 +1,18 @@
+#include <cstddef>
+#include <cstdint>
+#include <pcap.h>
+
+#include "wireframe/summarize.hpp"
+
+// Fuzzes the full decode chain together (Ethernet/RAW -> IPv4/IPv6 ->
+// TCP/UDP -> L7), not just each layer in isolation - catches bugs
+// that only show up from one layer's output feeding the next (e.g. a
+// span that's technically valid per-layer but wrong at the boundary).
+// The first byte selects which datalink summarize_packet() should
+// assume; the rest is the packet itself.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    if (size < 1) return 0;
+    int datalink = (data[0] % 2 == 0) ? DLT_EN10MB : DLT_RAW;
+    wireframe::summarize_packet({data + 1, size - 1}, datalink);
+    return 0;
+}
diff --git a/fuzz/fuzz_tcp.cpp b/fuzz/fuzz_tcp.cpp
new file mode 100644
index 0000000..c06a3dc
--- /dev/null
+++ b/fuzz/fuzz_tcp.cpp
@@ -0,0 +1,9 @@
+#include <cstddef>
+#include <cstdint>
+
+#include "wireframe/net/tcp.hpp"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    wireframe::net::parse_tcp({data, size});
+    return 0;
+}
diff --git a/fuzz/fuzz_tls.cpp b/fuzz/fuzz_tls.cpp
new file mode 100644
index 0000000..7860426
--- /dev/null
+++ b/fuzz/fuzz_tls.cpp
@@ -0,0 +1,17 @@
+#include <cstddef>
+#include <cstdint>
+
+#include "wireframe/l7/tls.hpp"
+
+// The nested TLV walk (record -> handshake -> extensions -> SNI, each
+// level bounds-checked against attacker-influenced length fields) is
+// the most structurally complex hand-rolled parser in the project so
+// far - exactly the kind of code most likely to have an off-by-one or
+// an unchecked length feeding a read past the buffer.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    wireframe::net::parse_tls_client_hello({data, size});
+
+    wireframe::net::TlsSniDissector dissector;
+    dissector.summarize({data, size});
+    return 0;
+}
diff --git a/fuzz/fuzz_udp.cpp b/fuzz/fuzz_udp.cpp
new file mode 100644
index 0000000..f2433f5
--- /dev/null
+++ b/fuzz/fuzz_udp.cpp
@@ -0,0 +1,9 @@
+#include <cstddef>
+#include <cstdint>
+
+#include "wireframe/net/udp.hpp"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    wireframe::net::parse_udp({data, size});
+    return 0;
+}