#36135 fuzz: test HTTPRequest state machine in http_request

• Catch HTTP parsing and request framing divergence bugs across fragmented network inputs
• Ensure incoming HTTP requests parse identically whether bytes arrive all at once or in arbitrary chunks

Expands the http_request fuzz harness to feed byte streams both all at once and in arbitrary slices, asserting that parsing produces identical requests regardless of I/O segmentation. It also doubles the buffer cap so the fuzzer can reach the maximum HTTP header size limit.

Problem: The existing http_request fuzz target processed inputs in a single pass, leaving the resumable parsing paths in the HTTPRequest state machine unreached and unverified against request-framing desynchronization.

P3 · test coverage

• P3 because it exercises previously unreachable resumable parsing logic in the HTTP server
• Protects against request framing desynchronization bugs by verifying segmented network inputs

P3 because it exercises previously unreachable resumable parse logic in the HTTP server, protecting against parsing and framing divergence bugs. Reviewers verified through mutation testing that injecting faults into the resume paths now consistently trips assertions.

Membership: Modifies the fuzz target src/test/fuzz/http_request.cpp to extend coverage over the HTTP request parser state machine.

Factors: security/stability 1, bug 0, performance 0, user value 0, leverage 1

• Ready to review
• Small patch with passing CI and all previous reviewer feedback addressed

The patch is small, passes CI, and addresses all comments from previous review rounds.

Author status: active, addressed all review suggestions and pushed clean update

Resolved concerns:

• GCC hidden overloaded virtual warning on custom socket mock resolved by switching to ZeroSock
• Missing header verification resolved by checking the Host header across runs
• Fuzzer input size constraint resolved by increasing buffer limit to 2 * MAX_HEADERS_SIZE and coordinating seed additions in qa-assets

• Strong support for verifying segmented input parsing and client coverage (hodlinator)
• Verified with ASan and UBSan fuzzing and artificial parser mutation testing (jeanpablojp)

Strong support with ACKs from hodlinator and jeanpablojp following mutation testing

Reviewers tested the harness with ASan/UBSan and verified that artificial mutations in the HTTP parser resume logic trigger assertion failures in the new harness.

• hodlinator approved (ACK fca8fef8f9): 'Should provide more coverage of HTTPRemoteClient as well as adding comparison of the resulting requests when the input is sliced up and when it's not'
• jeanpablojp approved (tACK fca8fef8f9): 'Rebuilt with ASan and UBSan, replayed the corpus and fuzzed on top of it without a failure. Mutating the resume paths trips the new assertions.'

Review verdicts (DrahtBot): 2

• ACK: hodlinator, jeanpablojp

198 lines under test/bench/ci.

• src/test/fuzz/http_request.cpp +171/-27

This pull request updates the http_request fuzz harness to feed data both in a single shot and piecemeal in randomized slices, asserting differential equality of parsed HTTP requests. This exercises the resumable HTTPRequest state machine paths that were unreachable when parsing whole buffers at once. Reviewers confirmed through mutation testing that the added checks detect resume bugs, and the PR has two substantive ACKs with no objections. It has no open dependencies and is ready to merge.