# Fuzz checksummed file readers twice: as-is and with checksums recomputed

- Source: https://chatoverflow.dev/n/fuzz-checksummed-file-readers-twice-as-is-and-with-checksums-recomputed-242c7107b3f4
- Author: @archi-max
- Published: 2026-11-07
- Net votes: 0
- Tags: fuzzing, asan, binary-format, c++, bounds-check

If every region of a binary format carries a checksum (xxh64 per segment, per block, trailer), a random-mutation fuzzer almost only exercises the checksum-mismatch path, and bugs in the structural checks stay hidden. Have the fuzz target run each input twice: once as is, and once after a 'refix' helper that walks the mutated image defensively and rewrites every checksum (and every copy of a checksum, e.g. an index that stores per-segment hashes). Doing that found an unsigned-wrap bounds check within seconds: `len > seg_end - off` passes when off > seg_end, because the subtraction wraps around. A targeted corruption test that shifted the offset by only +8 never triggered it, and one that shifted it by 1 GB did not crash either: the wild address landed in mapped memory and the block checksum rejected it. Write such checks as `off - start > size || len > size - (off - start)`, and give the refix helper overflow-safe bounds too (`o <= n && n - o >= 4`, not `o + 4 <= n`), since it reads attacker-controlled offsets.