From 736edae2ad243f6eb3e7b01ca9b6266745cdeb24 Mon Sep 17 00:00:00 2001
From: mat <git@matdoes.dev>
Date: Sun, 11 Jan 2026 23:01:30 -1030
Subject: add fuzzer for azalea-protocol and fix a few panics

---
 azalea-protocol/src/common/tags.rs |  4 ++--
 azalea-protocol/src/read.rs        | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 2 deletions(-)

(limited to 'azalea-protocol/src')

diff --git a/azalea-protocol/src/common/tags.rs b/azalea-protocol/src/common/tags.rs
index f22175ee..3f9a2ef2 100644
--- a/azalea-protocol/src/common/tags.rs
+++ b/azalea-protocol/src/common/tags.rs
@@ -19,11 +19,11 @@ pub struct Tags {
 impl AzaleaRead for TagMap {
     fn azalea_read(buf: &mut Cursor<&[u8]>) -> Result<Self, BufReadError> {
         let length = u32::azalea_read_var(buf)? as usize;
-        let mut data = IndexMap::with_capacity(length);
+        let mut data = IndexMap::new();
         for _ in 0..length {
             let tag_type = Identifier::azalea_read(buf)?;
             let tags_count = i32::azalea_read_var(buf)? as usize;
-            let mut tags_vec = Vec::with_capacity(tags_count);
+            let mut tags_vec = Vec::new();
             for _ in 0..tags_count {
                 let tags = Tags::azalea_read(buf)?;
                 tags_vec.push(tags);
diff --git a/azalea-protocol/src/read.rs b/azalea-protocol/src/read.rs
index d6c8c65a..664e2593 100644
--- a/azalea-protocol/src/read.rs
+++ b/azalea-protocol/src/read.rs
@@ -401,3 +401,36 @@ where
 
     Ok(Some(buf))
 }
+
+#[cfg(test)]
+mod tests {
+    use std::io::Cursor;
+
+    use crate::{packets::game::ClientboundGamePacket, read::deserialize_packet};
+
+    #[test]
+    fn fuzzed_1() {
+        // oom: checks for unbounded TagMap
+        let _ = deserialize_packet::<ClientboundGamePacket>(&mut Cursor::new(
+            [132, 1, 255, 255, 255, 255, 255].as_slice(),
+        ));
+    }
+    #[test]
+    fn fuzzed_2() {
+        // oom: also checks for unbounded TagMap
+        let _ = deserialize_packet::<ClientboundGamePacket>(&mut Cursor::new(
+            [132, 1, 75, 0, 255, 255, 255, 255, 24, 0].as_slice(),
+        ));
+    }
+    #[test]
+    fn fuzzed_3() {
+        // panic: integer overflow in HolderSet::azalea_read
+        let _ = deserialize_packet::<ClientboundGamePacket>(&mut Cursor::new(
+            [
+                94, 44, 157, 38, 61, 37, 37, 37, 37, 37, 37, 65, 128, 128, 1, 1, 255, 252, 128,
+                128, 128, 128, 128, 128, 128, 40, 0,
+            ]
+            .as_slice(),
+        ));
+    }
+}
-- 
cgit v1.2.3