No fuzz testing for `decode()`

[sumanjeet0012]

There is no fuzz testing for decode(). go-multibase includes FuzzDecode that exercises the decoder with random input, catching panics and unexpected errors.

Problem

decode() accepts arbitrary byte input and routes it through get_codec() → converter-specific decode(). Malformed input could trigger unhandled exceptions, infinite loops, or excessive memory allocation in the custom bit-manipulation converters (BaseByteStringConverter._decode_bytes()).

go-multibase has a fuzz target seeded with spec vectors:

func FuzzDecode(f *testing.F) {
    // Seed with official test vectors
    for _, tc := range specVectors {
        f.Add(tc.encoded)
    }
    // Fuzz with random strings
    f.Fuzz(func(t *testing.T, data string) {
        Decode(data)  // Should never panic
    })
}

Proposed Solution

1. Install hypothesis as a dev dependency.

2. Create tests/test_fuzz.py:

   from hypothesis import given, strategies as st, settings
   from multibase import decode, encode, ENCODINGS
   
   @given(st.binary(max_size=200))
   @settings(max_examples=1000)
   def test_decode_never_crashes(data):
       """decode() should raise an exception, not crash."""
       try:
           decode(data)
       except Exception:
           pass  # Any exception is fine, just no crashes
   
   @given(st.text(max_size=200))
   @settings(max_examples=1000)
   def test_decode_string_never_crashes(data):
       try:
           decode(data)
       except Exception:
           pass
   
   @given(st.binary(min_size=1, max_size=100))
   @settings(max_examples=500)
   def test_roundtrip_never_crashes(data):
       """encode then decode should never crash."""
       for enc in ENCODINGS:
           try:
               encoded = encode(enc.encoding, data)
               decode(encoded)
           except Exception:
               pass

Related

• Go fuzz test: go-multibase spec_test.go FuzzDecode