From d055f7d17b89a355cb0b4f15cb9f70f9d2382b3c Mon Sep 17 00:00:00 2001
From: Mike Jensen <mike.jensen@virtru.com>
Date: Wed, 27 Nov 2024 11:44:19 -0700
Subject: [PATCH] Add fuzz testing that was used to find previous fixes

This fuzz testing and seed corpus helped validate for protocol flaws in decoding TDF's.
This testing is time consuming, and Jazzer sometimes has some weird IO blocking behavior that is not actually indicative of a flaw.  For that reason this is not part of CI, and instead is run through `fuzz.sh` when needed.
---
 sdk/fuzz.sh                                   |  11 ++
 sdk/pom.xml                                   | 124 +++++++++++++++++-
 .../java/io/opentdf/platform/sdk/Fuzzing.java |  69 ++++++++++
 .../io/opentdf/platform/sdk/NanoTDFTest.java  |   2 +-
 .../opentdf/platform/sdk/ZipReaderTest.java   |  38 ++++--
 .../sdk/FuzzingInputs/fuzzNanoTDF/sample.ntdf | Bin 0 -> 361 bytes
 .../fuzzTDF/crash-InvalidManifest-1           | Bin 0 -> 2017 bytes
 .../fuzzTDF/crash-InvalidManifest-2           | Bin 0 -> 2017 bytes
 .../fuzzTDF/crash-InvalidManifest-3           | Bin 0 -> 2017 bytes
 .../fuzzTDF/crash-InvalidManifest-4           | Bin 0 -> 2017 bytes
 .../crash-InvalidManifest-NullKeyAccessObj    | Bin 0 -> 2017 bytes
 .../fuzzTDF/crash-InvalidManifest-NullSegment | Bin 0 -> 2017 bytes
 .../sdk/FuzzingInputs/fuzzTDF/sample.tdf      | Bin 0 -> 2017 bytes
 .../fuzzZipRead/crash-NullSignature           | Bin 0 -> 1371 bytes
 ...h-f39ad8416aef7cf275f84683aaa0efd15f24272a | Bin 0 -> 99 bytes
 .../FuzzingInputs/fuzzZipRead/sample.txt.tdf  | Bin 0 -> 1754 bytes
 16 files changed, 230 insertions(+), 14 deletions(-)
 create mode 100755 sdk/fuzz.sh
 create mode 100644 sdk/src/test/java/io/opentdf/platform/sdk/Fuzzing.java
 create mode 100644 sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzNanoTDF/sample.ntdf
 create mode 100644 sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-1
 create mode 100644 sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-2
 create mode 100644 sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-3
 create mode 100644 sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-4
 create mode 100644 sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-NullKeyAccessObj
 create mode 100644 sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-NullSegment
 create mode 100644 sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/sample.tdf
 create mode 100644 sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzZipRead/crash-NullSignature
 create mode 100644 sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzZipRead/crash-f39ad8416aef7cf275f84683aaa0efd15f24272a
 create mode 100644 sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzZipRead/sample.txt.tdf

diff --git a/sdk/fuzz.sh b/sdk/fuzz.sh
new file mode 100755
index 00000000..88a803ae
--- /dev/null
+++ b/sdk/fuzz.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+set -e
+
+tests=("fuzzNanoTDF", "fuzzTDF", "fuzzZipRead")
+base_seed_dir="src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/"
+
+for test in "${tests[@]}"; do
+    seed_dir="${base_seed_dir}${test}"
+    echo "Running $test fuzzing with seeds from $seed_dir"
+    mvn verify -P fuzz -Djazzer.testDir=$seed_dir
+done
diff --git a/sdk/pom.xml b/sdk/pom.xml
index 678c78b0..6685f513 100644
--- a/sdk/pom.xml
+++ b/sdk/pom.xml
@@ -9,6 +9,10 @@
         <version>0.7.5</version>
     </parent>
     <packaging>jar</packaging>
+    <properties>
+        <jazzer.version>0.22.1</jazzer.version>
+        <jazzer.baseurl>https://github.com/CodeIntelligenceTesting/jazzer/releases/download/v${jazzer.version}</jazzer.baseurl>
+    </properties>
     <dependencies>
         <!-- Logging Dependencies -->
         <dependency>
@@ -121,6 +125,18 @@
             <version>4.13.2</version>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>com.code-intelligence</groupId>
+            <artifactId>jazzer-api</artifactId>
+            <version>${jazzer.version}</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>com.code-intelligence</groupId>
+            <artifactId>jazzer-junit</artifactId>
+            <version>${jazzer.version}</version>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-compress</artifactId>
@@ -307,4 +323,110 @@
             </plugin>
         </plugins>
     </build>
-</project>
\ No newline at end of file
+    <!--profile to execute fuzz test -->
+    <profiles>
+        <profile>
+            <id>fuzz</id>
+            <activation>
+                <activeByDefault>false</activeByDefault>
+            </activation>
+            <properties>
+                <skipTests>true</skipTests>
+            </properties>
+            <build>
+                <plugins>
+                    <!-- Plugin to download and unpack the Jazzer agent -->
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-antrun-plugin</artifactId>
+                        <version>3.1.0</version>
+                        <executions>
+                            <execution>
+                                <id>download-and-unpack-jazzer</id>
+                                <phase>process-test-classes</phase>
+                                <configuration>
+                                    <target>
+                                        <condition property="jazzer.os" value="windows">
+                                            <os family="windows"/>
+                                        </condition>
+                                        <condition property="jazzer.os" value="macos">
+                                            <os family="mac"/>
+                                        </condition>
+                                        <condition property="jazzer.os" value="linux">
+                                            <os family="unix"/>
+                                        </condition>
+                                        <echo message="Detected OS: ${jazzer.os}"/>
+                                        <mkdir dir="${project.build.directory}/jazzer"/>
+                                        <get src="${jazzer.baseurl}/jazzer-${jazzer.os}.tar.gz" dest="${project.build.directory}/jazzer/jazzer.tar.gz"/>
+                                        <untar compression="gzip" src="${project.build.directory}/jazzer/jazzer.tar.gz" dest="${project.build.directory}/jazzer"/>
+                                    </target>
+                                </configuration>
+                                <goals>
+                                    <goal>run</goal>
+                                </goals>
+                            </execution>
+                        </executions>
+                    </plugin>
+
+                    <!-- Copy dependencies to a directory for Jazzer to reference -->
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-dependency-plugin</artifactId>
+                        <version>3.4.0</version>
+                        <executions>
+                            <execution>
+                                <id>copy-dependencies</id>
+                                <phase>process-test-classes</phase>
+                                <goals>
+                                    <goal>copy-dependencies</goal>
+                                </goals>
+                                <configuration>
+                                    <outputDirectory>${project.build.directory}/dependency-jars</outputDirectory>
+                                    <includeScope>test</includeScope>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+
+                    <!-- Plugin to execute Jazzer -->
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-antrun-plugin</artifactId>
+                        <version>3.1.0</version>
+                        <executions>
+                            <execution>
+                                <id>run-jazzer-fuzzing</id>
+                                <phase>verify</phase>
+                                <configuration>
+                                    <target>
+                                        <path id="project.classpath">
+                                            <pathelement location="${project.build.directory}/classes"/>
+                                            <pathelement location="${project.build.directory}/test-classes"/>
+                                            <fileset dir="${project.build.directory}/dependency-jars">
+                                                <include name="**/*.jar"/>
+                                            </fileset>
+                                        </path>
+                                        <pathconvert property="project.classpath.string" pathsep="${path.separator}">
+                                            <path refid="project.classpath"/>
+                                        </pathconvert>
+                                        <property environment="env"/>
+
+                                        <chmod file="${project.build.directory}/jazzer/jazzer" perm="777"/>
+
+                                        <exec executable="bash">
+                                            <arg value="-c"/>
+                                            <arg value="if [ -z &quot;${JAVA_HOME}&quot; ]; then JAVA_HOME=$(dirname $(dirname $(which java))); fi; DYLD_LIBRARY_PATH=$(find &quot;${JAVA_HOME}&quot; -type d | grep 'libexec/openjdk.jdk/Contents/Home/lib/server' 2&gt;/dev/null | head -n 1); if [ -z &quot;${DYLD_LIBRARY_PATH}&quot; ]; then DYLD_LIBRARY_PATH=&quot;${JAVA_HOME}/lib/server&quot;; fi; export DYLD_LIBRARY_PATH=${DYLD_LIBRARY_PATH}; ${project.build.directory}/jazzer/jazzer --cp='${project.classpath.string}' --target_class='io.opentdf.platform.sdk.Fuzzing' --instrumentation_includes='io.opentdf.platform.sdk.**' ${jazzer.testDir}"/>
+                                        </exec>
+                                    </target>
+                                </configuration>
+                                <goals>
+                                    <goal>run</goal>
+                                </goals>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+</project>
diff --git a/sdk/src/test/java/io/opentdf/platform/sdk/Fuzzing.java b/sdk/src/test/java/io/opentdf/platform/sdk/Fuzzing.java
new file mode 100644
index 00000000..776a107e
--- /dev/null
+++ b/sdk/src/test/java/io/opentdf/platform/sdk/Fuzzing.java
@@ -0,0 +1,69 @@
+package io.opentdf.platform.sdk;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.nio.ByteBuffer;
+import java.security.NoSuchAlgorithmException;
+import java.text.ParseException;
+
+import org.apache.commons.codec.DecoderException;
+import org.apache.commons.compress.utils.SeekableInMemoryByteChannel;
+
+import com.code_intelligence.jazzer.api.FuzzedDataProvider;
+import com.code_intelligence.jazzer.junit.FuzzTest;
+import com.google.gson.JsonParseException;
+import com.nimbusds.jose.JOSEException;
+
+import io.opentdf.platform.sdk.TDF.FailedToCreateGMAC;
+import io.opentdf.platform.sdk.TDF.Reader;
+
+public class Fuzzing {
+    private static final String testDuration = "600s";
+    private static final OutputStream ignoreOutputStream = new OutputStream() {
+        @Override
+        public void write(int b) {
+            // ignored
+        }
+
+        @Override
+        public void write(byte b[], int off, int len) {
+            // ignored
+        }
+    };
+
+    @FuzzTest(maxDuration=testDuration)
+    public void fuzzNanoTDF(FuzzedDataProvider data) throws IOException {
+        byte[] fuzzBytes = data.consumeRemainingAsBytes();
+        NanoTDF nanoTDF = new NanoTDF();
+        nanoTDF.readNanoTDF(ByteBuffer.wrap(fuzzBytes), ignoreOutputStream, NanoTDFTest.kas);
+    }
+
+    @FuzzTest(maxDuration=testDuration)
+    public void fuzzTDF(FuzzedDataProvider data) throws FailedToCreateGMAC, NoSuchAlgorithmException, IOException, JOSEException, ParseException, DecoderException {
+        byte[] fuzzBytes = data.consumeRemainingAsBytes();
+        byte[] key = new byte[32];      // use consistent zero key for performance and so fuzz can relate to seed
+        var assertionVerificationKeys = new Config.AssertionVerificationKeys();
+        assertionVerificationKeys.defaultKey = new AssertionConfig.AssertionKey(AssertionConfig.AssertionKeyAlg.HS256, key);
+        Config.TDFReaderConfig readerConfig = Config.newTDFReaderConfig(
+                Config.withAssertionVerificationKeys(assertionVerificationKeys));
+        TDF tdf = new TDF();
+
+        try {
+            Reader reader = tdf.loadTDF(new SeekableInMemoryByteChannel(fuzzBytes), TDFTest.kas, readerConfig);
+
+            reader.readPayload(ignoreOutputStream);
+        } catch (SDKException | InvalidZipException | JsonParseException | IOException | IllegalArgumentException e) {
+            // expected failure cases
+        }
+    }
+
+    @FuzzTest(maxDuration=testDuration)
+    public void fuzzZipRead(FuzzedDataProvider data) {
+        byte[] fuzzBytes = data.consumeRemainingAsBytes();
+        try {
+            ZipReaderTest.testReadingZipChannel(new SeekableInMemoryByteChannel(fuzzBytes), false);
+        } catch (InvalidZipException | IllegalArgumentException | JsonParseException | IOException e) {
+            // cases which are expected with invalid fuzzed inputs
+        }
+    }
+}
diff --git a/sdk/src/test/java/io/opentdf/platform/sdk/NanoTDFTest.java b/sdk/src/test/java/io/opentdf/platform/sdk/NanoTDFTest.java
index 87bae33b..cd4c056d 100644
--- a/sdk/src/test/java/io/opentdf/platform/sdk/NanoTDFTest.java
+++ b/sdk/src/test/java/io/opentdf/platform/sdk/NanoTDFTest.java
@@ -37,7 +37,7 @@ public class NanoTDFTest {
 
     private static final String KID = "r1";
     
-    private static SDK.KAS kas = new SDK.KAS() {
+    protected static SDK.KAS kas = new SDK.KAS() {
         @Override
         public void close() throws Exception {
         }
diff --git a/sdk/src/test/java/io/opentdf/platform/sdk/ZipReaderTest.java b/sdk/src/test/java/io/opentdf/platform/sdk/ZipReaderTest.java
index 5c47710c..29769b2b 100644
--- a/sdk/src/test/java/io/opentdf/platform/sdk/ZipReaderTest.java
+++ b/sdk/src/test/java/io/opentdf/platform/sdk/ZipReaderTest.java
@@ -12,9 +12,13 @@
 
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
+import java.io.File;
 import java.io.IOException;
 import java.io.RandomAccessFile;
+import java.nio.channels.SeekableByteChannel;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Random;
@@ -32,21 +36,31 @@ public class ZipReaderTest {
     public void testReadingExistingZip() throws Exception {
         try (RandomAccessFile raf = new RandomAccessFile("src/test/resources/sample.txt.tdf", "r")) {
             var fileChannel = raf.getChannel();
-            var zipReader = new ZipReader(fileChannel);
-            var entries = zipReader.getEntries();
+            ZipReaderTest.testReadingZipChannel(fileChannel, true);
+        }
+    }
+
+    protected static void testReadingZipChannel(SeekableByteChannel fileChannel, boolean test) throws IOException {
+        var zipReader = new ZipReader(fileChannel);
+        var entries = zipReader.getEntries();
+        if (test) {
             assertThat(entries.size()).isEqualTo(2);
-            for (var entry: entries) {
-                var stream = new ByteArrayOutputStream();
-                if (entry.getName().endsWith(".json")) {
-                    entry.getData().transferTo(stream);
-                    var data = stream.toString(StandardCharsets.UTF_8);
-                    var gson = new GsonBuilder()
-                                        .registerTypeAdapter(Manifest.class, new ManifestDeserializer())
-                                        .create();
-                    var map = gson.fromJson(data, Map.class);
-                    
+        }
+        for (var entry: entries) {
+            var stream = new ByteArrayOutputStream();
+            if (entry.getName().endsWith(".json")) {
+                entry.getData().transferTo(stream);
+                var data = stream.toString(StandardCharsets.UTF_8);
+                var gson = new GsonBuilder()
+                                    .registerTypeAdapter(Manifest.class, new ManifestDeserializer())
+                                    .create();
+                var map = gson.fromJson(data, Map.class);
+                
+                if (test) {
                     assertThat(map.get("encryptionInformation")).isNotNull();
                 }
+            } else if (!test) {
+                entry.getData().transferTo(stream);        // still invoke getData logic
             }
         }
     }
diff --git a/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzNanoTDF/sample.ntdf b/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzNanoTDF/sample.ntdf
new file mode 100644
index 0000000000000000000000000000000000000000..7dd6dcbbb707ad930cfd8ac55f7c0e161df50c1a
GIT binary patch
literal 361
zcmV-v0hazuF-#E?VQ^_KWq4t2aBO8RV{dIQYhiP8F#rJq0S6vI?zpV-5A$o9H~hf>
z5o5XkqDq=e5VP{lU_k`b@%q&1b&H|C`^^;qA@Zi}e!KLw)!YoehT+CBHGGG1UUe~n
zSvv{ViMOExD^~BBlG(zv<-h4*CkIL<E)qqu&p5>l)c>a*u#}LR^Xt{L?j_ZQMBO4o
z)vl|6ccp}%F}}ZZR#}d4;LKH3a!&GhdH7X<>*u-7u0i{vv`*sh;W69If?W?SNq4*t
zVT>)8y#Yqx=83<f58E#dHFYb1wzxSumJh!oDB^4>kN5M+PM<`NAOOz9pgWt6#yP5#
z0UU4s5$q$M6k!OYDH8*-haxv3wlfWW)*p38SE!kvyEwgJ?E&6C;9uMXzFO-c^8)w&
zFoDm%b3rbh=(T-e6!3)V7w#;Fzhk!KTD9FpE{gyF7v$mPUYH8j2dV*CFAn)_Q!y-g
H4Rd`h9<s0~

literal 0
HcmV?d00001

diff --git a/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-1 b/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-1
new file mode 100644
index 0000000000000000000000000000000000000000..5e0b5c999c7b2a2ff1215e96f9ae57edca66b782
GIT binary patch
literal 2017
zcmZ`)OLLn>94Bd;xS8qn+CvX2SKE<<9=0=+0}=?mK(fFR(8&SAN-SC)g0(PoGW`m@
zrXMIDC6^xh5!zh@vc_$8M%v~7+TZ`R|M}#bZ!ej%GluzOd@>la{wde@<lJ~0Ss4l~
zX9y4qFKTHRBj=a-<n`H?&tLxffr^t=?eoGGrBGXce%1#2R}4dcKN4Ewt#1Wz4HEp;
zOTyr{H?<lI0z1wk48vd)ti#y1=#hO_qfEkv0S22G;_UypPwK!?!NvyxR$&eVu(lo$
zCPtc#_I0<>z9?)F={O9D#3r!tLky0W6c<@&LkR3p<vLxqQXnb`Ea(bnG)-@ejFs3{
zI5Af|n^SVTrR1AOMY`imNo*?qsI3T!Yigs8xiUJ6U~@BR)HF3YH?&bEYj<r~=pj=x
zh~90k@bBNVCA5##m27fwWN0NWf50TkeE$fk;{Vst&Q<rhk%YMPYk5Ph3@P>YD}f`@
z?Pg`8ka7tM8WwXUW~R1H4bOz8=K99UbcyR7(^tINYD9QEr+AyrOuK!5gj!fA-Jx)a
zA({|^^9bo<dHPW7Wf0gc$avcZ$tnCpJrpLR5J5ZZ!N7q5P0kaG`1O@M5>Dldp>1+S
za|wRCqpTLL>^YvHxybOgZQ_qV6A&ak&frAiAMsZZA5G!5HPhtIOc;2kw(t~RY{~x8
zn`w8ssSS{PlFC}`m`rkO6o)vpLqwyvwUU$IusDloOxQHGq6j#rtcSQza50YF)$1s<
zE#!s?e%I}^TU`B_ol<`SGHT5kx8_b_>#O~AU-ur=?et2NUDQUKsoGnQZbT4DoQ=B*
zP}BK#?$;rZ2i-UmZaoR?OpL=RdgOM!{xX8wdM^wmr#`@uA&&<2E32~@XycZ29=4}x
zTF<3!KH4lfelE^u=TdYvTcANEE8}(0)x7JztEFJl+pTp`pF&q#b`#AU;AG`F%bTv*
zp6K^eaE+yCtM{TiK2eeH*~0jSYwY7)5Vf2==A?A(^Kh{;`m+8Q?C!+=PU&oyx;)NO
zdq1@Bo-@ZPUx$yLFpJ^ixf~J`-J3~08}Q95LEo&sbw_Wj(@bsX8_Try#NqqB`}1(q
zL-Vw|=kI$lpY2ACC2abMyf73&Js)VOnXN<}HHT4__0yA1ElTynp-osHU^jG5ijWpy
zNFFTLr^(<&^^!a&mr`Fork90@ieq5;);*&6$MFNGnvR8gs)oZH1lP^s6q{SD%;twz
zqH2#r{Zl!Rjp04F=#0GRYUD3mM;i2;;UcqE<EA4mb3(t@)fAc%A_cv~#kbx_M!~Xa
zt#08Aj-jH-Em=TF&KfOR)>Cca8@Y{Vl9-w#BBs!D$!nJ>{?e5>1FmmLEK2XI3Qi&f
zF$GybWXp*`5LT~vOFTUDq{>enW_{=bt!x9*1f;Kv_rD(67~spK2vc?0X(#0{s>l_F
z7_31|rU|GRWe*((Sb^`&$NA*N%S+~I;L$PmH1K|=v#VT`denZw{B)dh)wHVwE0at)
zL!ZyRN{(Ts<oIj~&L^*4U6c|OSG8W2hid<${QjE^Q@V)WYr6kl{4>mpg7#g(t^A=o
G!~6?Y?=yV>

literal 0
HcmV?d00001

diff --git a/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-2 b/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-2
new file mode 100644
index 0000000000000000000000000000000000000000..de7914cd21fc577ab43fae901c0934eb6431f1d1
GIT binary patch
literal 2017
zcmZ`)$&#B!7{*RwPh6GCHHRD&uCqu&%gngS2P6>M0F7WIAmsxCEzzi11U=F~%9U5h
z)p;O4iZ40j5t42M8kG}w73x<1OMm}9n|$-_C3AMhFdxm2CPUUg<@%nS8&|QNp~!ZJ
z0HNrjwvQ6z{xX}qKKuOX^ItzucCxB{R_LNPRM(%M^ug{G!_e<XqKdh)!vL;8im&`M
z3V(Z3tFa(-k}SqB3P<58N&=f6*|#-HBxD$3uudS({*U@B4qOea0}x^j=0E@|`w?NH
zq}gcSbQ|r9LKopqqKI&;LmNLP;P^=Kkd4;lf*opHr^{9XL?ng9y~3GI%O4|iDYg|(
z%oX3^l-y}4`T9wb?m0^mn@TWhD}v%#`lw?q&5j~CoGOi)mM-U}KFVbMzAXzqWa%c6
zyUP{+-8;5~_Mv)`O%H|)?bPEBm?W9+A0bur{~Fr4?tZBxB_{n^zECS&O0E5h;|O=V
zS?MUaJc5F{#afD)rEm78Z$V4<0&{73#Pp68D89NJ5gN}a{<@>;ckhl+3k{_?6fRLj
z143{fA$=%M?~A>30=oej?>Hbmg@4G0LS-Bw=wv+@x-g`{c_tCNz7j`5scbRzb*|_h
z!S8gG<=m5f*Ee+!nf|6t><Lr>K|<q9P9*jbdj;{y67E{6E_YO6;9L6KR|2sm2Mb@-
z?{iBZAo(Pewc0V5<kdKdaO6aYdU0c?C(dDU7E_<F`^1i8;GU8mlS075IDT8NqsXz5
z7p3@Zx6^KM^)K|4@)M9zZSJ@=b5qAy?xwrC|EO)I*P`s9Hd;@$-fDC!f=J>V+*N?K
zpKWGA9RhjKO)}xmm%!G-IGUm-ZrkfGVz{aIqDXS<100+3Xi&elJM)1)Zb|1+d%EA(
zbE%t;)(eiGi8J+Fim%l<8f3CEUWHxVzv+AW9!z@Ml_45a=;@1Ys#^n`E`4`#+qK#g
z<6#PJuoQ2MUVP7|8VY<z7~gV@U9t`1mb=58v|j~0oG;D3Y&?bAd$GS&I-7+dkF&kA
z8`^lsS!0c_!zW)*6Zmv4M?^*Uc2ds<eDhi`)+>M2G1}TR(;CLwwj3jM`F`)=JX-hA
zY~S7S550uXwxh-ZHiJ~2n~I>F4|LSbmZE{0!#K<O`;$s7QuY0zOxOTmFLF<kkS1V6
z8kQH(VDO@LNgB$f)R&LpWnrq}1lWQ7fN1=2@(8M;W8sd9;V1{;O>;QK)&?u;?9e5u
z@;Kx_<pbFmK5+BS$d9i_!Q6ADLC+n|GkZC1y3!&i_Ya1)hn9p$LN9Rf-)N+xaM84v
zcTk06sOWM_77&uNMvJEPRG$ZC?qF3C_ZIPpCG<Sf?J^};crs_g)gAFgX?>N!X^bGI
zAPb0WIWY*rs*AV8Lz^dAerhlqzyRoF8IU3%bzSuTdgNe$FVn(J)nliXl*72Xt}rBE
z1rjn%Kt(8P=s3U%d~ZI?CNExIGS35#j<M%~_cNVc<)XJo=@-mT$0=7$yNa<=$&@qn
zi@8^^k$p<O##La4&r@(VdG+d|WTCjK^|Cxv`yb{1zsWGAi^#pE`|rgs!@MZ&zALDe
JJ#=T7e*sq%GkpL6

literal 0
HcmV?d00001

diff --git a/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-3 b/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-3
new file mode 100644
index 0000000000000000000000000000000000000000..bfe7980686bb42d3733591bae4ba2ee4959d1e1c
GIT binary patch
literal 2017
zcmcgt$#UXG7?vl=j5AfKTyw~Q(bWqe5MHW$5J>D27|9?hH3uOzs6}hB)CP-`E3c5M
zoF)%6r##18a>yej-9o~|6<^a;qMQD=@89|#55D^Pj5$7Lm`}zhgCXnhe0@vKmGj6-
zQD`|`fKYf^+JrH3K8y$Nj=y~V^5=JyovdOXXS(PO)%E*lt-XHBF!cML+*QtfD}W1-
z;BzktgP-4*N-PNMIE^q2gI=%*W8b1j_PRuggbV`=mNCTXe^H;sfun+@4+5;hEfB%N
zdO(;csaEQjjY|DA(?z)BFeDtyz`_qP*c-_VS!hWv*sjX)4Ym*<BFS&ry}}t))9WK+
zCe;;A+A5ySDO<ayY?qHp=Z-TwQdRMLbwyNMQ|s~O%-|K#=0=@f)zsvzq4iQ(yQ|1z
z6PcPp<Zic$aC5`v(4GpDY_fBtYbCC*!_<+5)*cf3$7_!A7mb%n65`TNxrI_5QtIt1
zfg{}YYM~?JatR6=7IP-0rncG`o(WCO^^KY764!atSG>`zM`!}4cuRhy-QMh>W*TyL
zXkLgSnh=6>59ujCea!Ye2<!@^f^CE35dN+nGL=z?pq(~h;J|<;=b1$OdL@s9QutzM
z%dMih1i#HIvxzHvj%R2tGQ3rt_~Va61PP5ZIEna2{1v4~Q@pK>G?^cXZO_yup5jY2
z*`InN?QUyoZ6qJ0vQ*k9lUR-75Qlb%XcSjgau6IArxA?_yNRtR0?r}nA<hI`jHByv
z8HKim+%Un{4ZdFE$}jZf@&k}kZBD;7b`o2kt%vKf_n@wZ7n1CvI$93Z$~wLeqMEbD
zTxYZJ1vr@*Em?mI?(d}5y~3}iy4+7U_PT4~HD~r!p$s2AaTLSH6FIcSe&cFTPTNBD
zLe!TFZ^7$zb(pFZeQBAto;X6QIX?-Ps5#y=*228$Y8x<U-Y;}XA3|4~HWJNj<7DPJ
z)2oJAAL#QTxWt`kr8lEHAyJX<5hGXJ|BW*i()(Uz3afr1PYgv=Pud!)rZY)L)ozrg
zt<6EFW~KUZ*CwnFup2rDMMw)UBoCJB(_{#edPW|UvrbFir<a9^ieq5;)*R9N<M;s-
zO~=AD6~o~c1eewB5SuHkjK;fHqG*p@{Zl@W_TikH@I5cO==l@Z>9m_pcamDOe%0wr
zx8#1Vs~c!`5Gm*>&i?C_q!&!9*6bFJU>_=)T$4qF<g`+wWj)j;zOl9Os3UDm5)o5u
zy5zM>6@Ti=oB<cNBo?{%MFl4jf|!ELAhP+yAP9?Bye93Qc~a$v4zoV=ftI%cX#&#M
z+52A(Z4B^Pl7*=-cGyW<7!}tAh8QeBOr{Aa2zd|f2Uv#h{nL1G^yZ9t9(Z(&JrBGe
z>FmlEz1>S6F+c35Truqm#zG~N&(MF*y`zGS>_hUsn1bWM+qb7V3&mBeH~FF1f6f2@
dMTRL|MD88kf60CshME}<zR9SCKXhl9e*p1HHE#d_

literal 0
HcmV?d00001

diff --git a/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-4 b/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-4
new file mode 100644
index 0000000000000000000000000000000000000000..da6463a9d1f010191066d3b961559947af1e8b6a
GIT binary patch
literal 2017
zcmZ`)$&#B!7{*y_$5km`bI3vAIvz_x+l;GxKmwr+q!Ek+q<mnYB^ou0phpa(TzQ3D
zod@!J<l;*Xd4!}JfktuSu7ZaCx9{KjUrfLL=8}2-oMAo~9}I@9zsvO<`EI<9tPF*g
zGXe;OuWD%+Bj=~Z^x5-IA3y#1J!L1W+82c`dO~&m{!tqqo-z!5UXruMYu^gs1|;~k
zmxRGDFKRUw1a_Q77>2<(*o3if(NFeGjS>kN1{iE(h_nBrK8gcJ1zR5kScN$dz{a{q
zm?&vB+E?91`&FTfaK~XtIJSX>?_+Q>QW&z(mK?AnmFslbN`QzYusByZqiK2*WUR%u
z!il-!*_@KwEhXPRDAFxwN@7#-$8AMWTvHo&%(c-`1e=>n<EE*}xuK0SS-Wk>LLZr$
zLF8_7g@5~&Eup=yOtQ(*k&%_S{1KBR^MezlivC|mJH77bN)qDI&!vT08B*%)7XnAP
z+s#Tx!R7vuxHK&0TFgvsml~c4P0jU<wdoSqJEpIA^Yxg}cuw)Qow;`N_5`)iP`X3m
z5=As21m_9T`||5uv6n$$cOc_!8zkrOkM&Tfj6wwMtPcYR1~fU3B;wZ>@<=Eyi755O
z(6+gvxdgx6QPxXW_8ia9Tx58=Hu1-w3kVV#XK*6%kN7Ky52kR_nrm`rE(|?WTY8Ew
zwq$?h&9&Ry)P_htOJ%KgN+z)y#UT#u5K+rJD>(}ei?fKvgiT{Bihy%Yx{nJ17vtzn
zy^ccLLT;GgH!ZH$?AAZiQ_4?4MzuMU*1}0_eSMf6>fXJ&oApH5MQya5sr}9PS_GlQ
z*|@6!HC^l$ejNgN*o`yc#*@I_#5kOx2X5aVtRlFp_rp+f>O&kE@_1P9S)Jujo3x~h
zusuuDdM<VI@pi@W3vn^OkfPpviH4c1Og2GR^R5Q2mV#-2ztKf~23>8{O*C_eleOop
zuDfP?s^87P6_%o%-j8niL`A-53zKWEaftUp)N&4(lhTdP!{yo-$ofODzZD02rL$Y<
z@+3>`!^px1&YY-x9X@!%JcbV!a!6Ekuc!5F$Txd}zTJ46j^0*hncC2|mTBvW!w>p*
z7vUE57issv-}PfY+m9P7*z^;5X()nvG1O2qTZ=ksj-o6Zq-UL4l<K=<o3K8>Zs?G>
zS4Bt*FeDe2>(gZLqIyX#luKzKpVG_1M8z?%eCrO;{Nwl@R87ai0~Nzz4uY%ZXok%l
zR_2T2Em5_{vHmF^$R_ZPTXx1?)EoOt*O7*OXSB?$^`z-YtDKzQ>1qm136X+c;o@I!
zB;#P!wAMFp4ku92<d!TTBxj8lE$f-K^o`ucb4g515)o7AyX3aZ6o2K)oB=mCBo?Lj
zRRt#zf|!CVAhPAeAPA39VPQ)=Uh|~N&mCrc=mV{61JVSfuZ#P?9@-e-%cKZXW$e6@
zau`*|6^0mWKuo3ys0d{bod#He@5TGY^vPG3%;UhLW9)I@{Yb`C`S+6UC+R2552q<t
zO*=a0=&DpQ<qZAz+<S6lD&8~l{%i^^rca-~Dp@G5^Ys<^p$}cZ9XIALGEC_ra?j}g
UYw>0nYGyJ0wxCx2(4Ara0lgqQ0RR91

literal 0
HcmV?d00001

diff --git a/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-NullKeyAccessObj b/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-NullKeyAccessObj
new file mode 100644
index 0000000000000000000000000000000000000000..d55d907b34a1658970daf36f31943291eeb7b40b
GIT binary patch
literal 2017
zcmZ`)$&#B!7{*RwJFZIQnnMmURXNR!C81@ODj$$QXah8Yk${vB475a}W)bvA11VQt
zAy?;t{3yQUkVi<m5y+}Z+*MLH|JL8X^*@_@^X&!m>J`I$G(VaQS^t#ldvb2PjqMCY
zwmSp}Md!7Blpy!bZ1VEe=TD#i`hkj*RqeCF7Nt;Ie}2*jyB7>Ye?Jmh<85Gva0OEQ
z)=#7Gx7W2A3qmK!Vhp2j6t1Equ<4P#sZl0j!w`dY0&(_#+%M|D)xbIcA=Y3H1hBFn
z5GF>NjrLWy(LOJ15$Pm~h{QUy@k0WRmlPM-XiW(0P~$pXwo)J}DJ<v;XErT=jLfCj
zRyZ+Ne1}tVr={fUM@72hEJ<uC!KkeWif8Ggj<qy9ir{dnG-_J9oSXV6ll8l{EcB42
zn?&z6SNM1D*b>@@>Pj{}I5M<Tk3V3NWWIldRPq1oXy>x~)JRHP`n9~FR)&;%`<1{E
z>2|ZSQAl|N1r3X}6f;ZT>`mW-mhJ`S((;Jw9V<|LbvYtDo>TmFN7ZlN9ibK$N_Qw+
zVu&V$;5<V5P@diwdl>|F12W!mKzf9KehQwABLtnS2SXQzG&zS-p|=sgzLH16seCc@
zb*|_h!S8gG<=m5f*Ee+!nf|6t{0US6LBiuqP9**je+BW;5^h_nE_YO6;9L6KR|2sm
z2Mb@-?{Z5YAo(Pfwc0V6<kmQeaO6aYMsZ`OC&6KH7Soup`^1i8;GVJ`l0w15IKHXZ
zQRLXji&A{k?X+85{fV7Ye*!XU%^kO9Zt57z-E>#?AGFQ%Qj|T^M(e58TaB(o5J{Ya
zy9&_uv&}51Lm&^jNhaL-64+W8M^p63ZF~Ji3^(;&6iIG<fMZi04eFP6XFkx!E$J+3
zPxt$JE_L(KdcpBCai*S0@ufOPgG^S&tFWv4SA9?4gGq0@GDKqvJ$=zlb!&jrrSC4T
zyH<N*+)u$3mg0@ki|_bULxJxI<7=+5OSWO$a(9@M_N#!0^QGCBjmL0%C-%2WXR|Qm
zakh7MLmTfnYpn5g_~;920w2%hh?wYJPwLr#Z(a(<dgZS=Mq8U^TEke|mSdzY-|yX@
zMe81#?YlevzL)UXcGOtFW{}ErQxUYYfsUHlQZ!I=7-w03f6}Q%slGq72^#?HMea!v
z(gKXggXIM@8N8@nkO$>L>dVLUvM|+f0_?!PM>PL9c>q<@v2aJ#aFm1asyUouYl9Va
zc6cSK_Bhl(l>^xr-gEQL$d4~a!Q6ADLC+n|GkZC1y3!&i^m{|wLrX%WpclCKHX7+D
zTr}<FEmYwcD!SZ~1%%|R(V}HN)#rhkJ6M&(y+tBo2|bUzc9{|^Jef1$>XyW!^uDU#
zG)53pkOf4xoEQXQ^@_K|!!u8+{M2DKfC13UHXuzv`nq`k>yd*2zDRNMiyc&#opw?V
z<BD8iNWcmtWSW4AQTEVrfED;&f0#|4J-=YS3_Lo<z6`vd>Fg>Or5?4PF+UxrTs7?~
z!OA34&d{fGuaaY!DLFowg0sns7w4q}#Z|56<)PaDD8K(E!;~(f_mb|v7yk_Nte|~Y
La4Uc4&M^N1MAtJ(

literal 0
HcmV?d00001

diff --git a/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-NullSegment b/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/crash-InvalidManifest-NullSegment
new file mode 100644
index 0000000000000000000000000000000000000000..4537beda55a232f533c1c62532548e2c2f789d19
GIT binary patch
literal 2017
zcmZ`)$&#B!7{*RwJFZIQnnMl>*YQ{qT4r(ifCNHF0%-&z0Vy9CXo*J6BIuC@Qm(v0
zuFeDbQGCfEkC1dD&?u9ntE6uJt-pWke>VQ=>vQJSD~9=Geli)d{wmkE<lJ~0+Zl>%
zcL)%Q-qiL{g4~~G<Cm|#eE#yscT}9LYM&LhD23Yk{j)yUy<iyn`<~DmZv#7oE0E&1
zej0_pysp()5IRW~V;F^UxQdd%rbqU=Mwx^SLk!jl#MyswAJu`Yfpq{vtic=zU}fJU
zOpG)e?aOYX{id)*q?0Hj66?^$_X#*&Qe0%CH6gG=jq7yTN`a`Pu%N4)*|hu-GM8do
z<-}a|9Zt=imYT00ROyzpB(bRma$6Nt&(h_NwKO}b;BZq(Zd$sMo4TAS`fXbgddSjE
zqIZ+4{QLK83GHKbC7T``8QQ7GA23M@-#<dC`2TjabJ2ZjBqc8W{JQpzdRQw%dN@~c
z|3~16bh}yEpmMB7P|&bgOEI(b&EE7aXz5;HE-jC^-mwDJpDty><2lt|cc%Ky`y<rC
zLg@~LOAOJ35S*pcwc5w>^r6_xAg~*d@s0!15`KaBP!EO4I6~0LdN6chNR#u(B8dMd
zk0-vE`Z`y2kKlJY>T>QWzU!O1hfIIdCjJCd0YSp!Oim>J5q|~o!4hs-Q(fsyg@JGB
zb6*X_mJ%%dseYSV`T!{>sU%)K#*mGZ2uDtYXcRYgdJ-HKXEBWlyHD&m2JR{AJ}DGD
zjN|Ki9Yv0fyeP%j-A=p3)t}fY^~WHi*4$BR=BAFZ+)Z|M|6bcnE=0vcZM2?fy_I|=
zf=J>V+*N_LpKWGA9Rg+0O)}xem%!G-IGUgbZrkfGVz{aIqDXS<100)*Jg8sTo%ui?
zwWPDCJ=yQ;xzx?&^@8JP;%s^*#TU~#8f1z(T7_NRzwCSZ9*le2l_44v=;@1Ys#^n`
zE`4`#)wSAV<8A^ju@rBNUVO`^8VY<z7+rCVU9t`1mb=58v|j~0oG;D3VmyS~Td}`Y
zJDY`}jIzD68`^lsStE_F!v|lOCh*}*iHM2r)wrGw_~wORtXKZ3W3;tNrZtSUZ8=8j
z^8Mc3S+wq<*}l8u?|KQJZRN%SHiJ}|o2sCl4RqAZmZE{0!#K<O`;$&BO7+7b#cTku
z7r7@zNDD9`50)3uWbmSPP9BtVsjnQ<%feK{39tkE4$=JM<Q`N7!@?a^!%+^x%jR%`
ztqoSEv%@P<wa20UsT{~g@Q#~zWIw);gSqEQgPuE_XZCW`bfra3=y!&;hn9p$K`(Ie
zZ8TCjTr}<F4V=OeRCT4L2nZ=zqeaVlqR#^}ckoma_ZEqWCG<S<+GT36@D$F3s~ZxF
z()+4{(-=WaK^73%a$*pK)hnKghi9Ht`KiNf00W?xZ9tlU^mXz6*CPi5e4Z9zsxCY2
zq#VW-xx$cu6-dZ50TrX{q2mB6@V)*x8$Ww~&O8o0I>sIc-j8&4m5Wl3+RvCDj#I9h
zc9mddk|}5C)45m4G0cP<pG?8o_{EDir3A%Qt>@*T+J7s*|0KhdE~596?!OlQ4D+m@
NeN%8Nf9TFIe*;(}GuQwC

literal 0
HcmV?d00001

diff --git a/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/sample.tdf b/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzTDF/sample.tdf
new file mode 100644
index 0000000000000000000000000000000000000000..cc27081a3c3c30eb85308bda48c3e8c15736604f
GIT binary patch
literal 2017
zcmZ`)OLLn>94Bd;xS8qn+CvX2SKE<<9=0=+0}=?mK(fFR(8&SAN-SC)g0(PoGW`m@
zrXMIDC6^xh5!zh@vc_$8M%v~7+TZ`R|M}#bZ!ej%GluzOd@>la{wde@<lJ~0Ss4l~
zX9y4qFKTHRBj=a-<n`H?&tLxffr^t=?eoGGrBGXce%1#2R}4dcKN4Ewt#1Wz4HEp;
zOTyr{H?<lI0z1wk48vd)ti#y1=#hO_qfEkv0S22G;_UypPwK!?!NvyxR$&eVu(lo$
zCPtc#_I0<>z9?)F={O9D#3r!tLky0W6c<@&LkR3p<vLxqQXnb`Ea(bnG)-@ejFs3{
zI5Af|n^SVTrR1AOMY`imNo*?qsI3T!Yigs8xiUJ6U~@BR)HF3YH?&bEYj<r~=pj=x
zh~90k@bBNVCA5##m27fwWN0NWf50TkeE$fk;{Vst&Q<rhk%YMPYk5Ph3@P>YD}f`@
z?Pg`8ka7tM8WwXUW~R1H4bOz8=K99UbcyR7(^tINYD9QEr+AyrOuK!5gj!fA-Jx)a
zA({|^^9bo<dHPW7Wf0gc$avcZ$tnCpJrpLR5J5ZZ!N7q5P0kaG`1O@M5>Dldp>1+S
za|wRCqpTLL>^YvHxybOgZQ_qV6A&ak&frAiAMsZZA5G!5HPhtIOc;2kw(t~RY{~x8
zn`w8ssSS{PlFC}`m`rkO6o)vpLqwyvwUU$IusDloOxQHGq6j#rtcSQza50YF)$1s<
zE#!s?e%I}^TU`B_ol<`SGHT5kx8_b_>#O~AU-ur=?et2NUDQUKsoGnQZbT4DoQ=B*
zP}BK#?$;rZ2i-UmZaoR?OpL=RdgOM!{xX8wdM^wmr#`@uA&&<2E32~@XycZ29=4}x
zTF<3!KH4lfelE^u=TdYvTcANEE8}(0)x7JztEFJl+pTp`pF&q#b`#AU;AG`F%bTv*
zp6K^eaE+yCtM{TiK2eeH*~0jSYwY7)5Vf2==A?A(^Kh{;`m+8Q?C!+=PU&oyx;)NO
zdq1@Bo-@ZPUx$yLFpJ^ixf~J`-J3~08}Q95LEo&sbw_Wj(@bsX8_Try#NqqB`}1(q
zL-Vw|=kI$lpY2ACC2abMyf73&Js)VOnXN<}HHT4__0yA1ElTynp-osHU^jG5ijWpy
zNFFTLr^(<&^^!a&mr`Fork90@ieq5;);*&6$MFNGnvR8gs)oZH1lP^s6q{SD%;twz
zqH2#r{Zl!Rjp04F=#0GRYUD3mM;i2;;UcqE<EA4mb3(t@)fAc%A_cv~#kbx_M!~Xa
zt#08Aj-jH-Em=TF&KfOR)>Cca8@Y{Vl9-w#BBs!D$!nJ>{?e5>1FmmLEK2XI3Qi&f
zF$GybWXp*`5LT~vA|9T3Qst)(vp)2JR<;3Y0@ByT`(F=j4De-AgsHmhw3BieRpbgo
z4Avkf(*#tEvWJcXtibo?<9zbs<t6hp@aPzO8hAg`*;Ot|J!-#TemYLMYT8wTl}V<Y
zq0i@DCC4yRa(p%g=aW~jE=mcCt6DG1L$&`=e*aB|DP2VGHQj$N{u$;)LHn-YR{qeP
GVg3cSFEhOW

literal 0
HcmV?d00001

diff --git a/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzZipRead/crash-NullSignature b/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzZipRead/crash-NullSignature
new file mode 100644
index 0000000000000000000000000000000000000000..24ea0b1cae807252d052c0de01accbf46c9e257b
GIT binary patch
literal 1371
zcmZt`JCEZ;I2?D}fshaq64Wk`5ZO&)JJ}>+i|jgaoMfDr^YEOu@Y<7j?6Ey(PagKN
z1vL^4zW@qaYDy$TLBWsU572<FWt@Gnr<>7ezWLtsy+-|apB@!n6bgllq_gDL{d%86
z<zs54B(j`u{(k-Mw_kkyBmM4|4?n;BxH<jlpI^Vf{`9Y>KYyl%-Pet;J{a|%zes+6
z{)xcF@-sRp&b8%=fBWH2`;TXZLViBtxbkseg?NP$cI+ilcqLd#f?|fFFcF$BFNy*R
z?Kq`5LJL<>99TIhG_M34GPI5{OW(lX3Ls~S)&UCH6lX|5D{DiT&^(c<CzX1mD8y03
zDeKT;n;7NlEV34wLU$@wYeG>-aQ@Q8*?y?_I}m_OH|&hVDe$xm80(6z5ZClHSvTe$
zR6zxLE`jQJ4}u;BMr$`TW>v75Nzfn!E_%Kmj5#lH;rjGcxaJmayz5$t+d7z5LF+uX
z{1&e(Ww~BGsofLv&|KX`=FvxmrX&{ymn-G&LvP{%!_Rbayyss@fiiKS*Oqm~7NIeg
zp~t^u=pInpr;jZQ&D!+^chW~`%eGN+V~|D!+vyn&9USK2fyyj}UJvW)xXeQ&nVv1d
zz}!PcD+7*$hA-+1NX*4N01MrPL0f{}SOkj>HpOujWHS+XpsK4qf2g$ho9{e4MS;de
z7TFQuR(vbr2$oWwCSey_lp=>CHgQgL8KccoiA1(V+$dqqT2+?Bl0|XpM($Rik5bMZ
z?{saivfVksC$Q(Q%9L&!BEa-ZqV>=E^%l(*)P6N{2OaXNC(r7MSz5wqqp%rGktESx
zcY9uGPl+WvRWR8{R6g4Vz%%A*XIl<cDXJrFSW!sW@fjT$ST%;SR+@D5^_gF*>@L;W
z#uOWDAa=@5SKE%oy=zN4g#q!*<%C{}^41ADiL;n(jj5Js!Gzk<Sz<29&|FlA=0#Y;
zJ8X%aY`*Lz`P=GF%C-`12jYHfik-w#8=0d-qHc^cfE%u@`rDj8m$SQbJQe5FgPySB
z49<JLwbV1XDB~ev&T6{D&T>xSxmMFWUp50xHjVXuVDREGY^JO23{1=NkSBh?3kw9}
zbhsExJfW_c_8Jd)N+`iBFZ0{6acJ12ebdW4e@zx|P*DhQfQ*~W^1SluI&^m_vKeAW
z35$^x9Eu^jD~1fy2O}|Bp_sQjx-W<OF(q7IkNWRCIVwDiwExefe55^I_mX#FIr(h^
Z>p{%q;2Yy>)PMF~&hUh9#_!SL^&jZ6t_c7D

literal 0
HcmV?d00001

diff --git a/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzZipRead/crash-f39ad8416aef7cf275f84683aaa0efd15f24272a b/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzZipRead/crash-f39ad8416aef7cf275f84683aaa0efd15f24272a
new file mode 100644
index 0000000000000000000000000000000000000000..2fc1da228a64d5718fd2608a080af9c93529bc53
GIT binary patch
literal 99
gcmWH@D$dUf@MdLW;0*9)XJBF|VW1ueU;~*20A$VtC;$Ke

literal 0
HcmV?d00001

diff --git a/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzZipRead/sample.txt.tdf b/sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/fuzzZipRead/sample.txt.tdf
new file mode 100644
index 0000000000000000000000000000000000000000..2bb81265469ccc3b2065a5bb778e88aa3f13fa65
GIT binary patch
literal 1754
zcmZ`)Kab-?6kp(uI}j2=LW0@_658Ec$9A%th$}X6;y;O<IC0|G=nBW4#AA=`S$o!r
zeQZIEM8hY5f|i;R2~kk+A@~9`plcZ?d%Jfhuw{AP|9Nlb_ugdq&V$pV$45s;&+@^N
z{_dXl=!$)U-4dm)|Mg!l{`uzfuYSPa{`|pbtB*RfAOHU4yPHq`eDKq!QX;=-fARig
z_~>!|+oO*eYF2-fz2n+j?fBR4|L}f)cyv^MA5tFsBz6<H203{W=4tYraq}Ex1g1&O
zbiRCc!hpofN?bFPWSwTQTQ8Z;a|R{^Y%)m7H~6;(z@LFl3=%Sf6%fJNy+(xTG+5!H
z#R?}(mZns)NnCQBf!dvmHcW?+XI!(zoG>}8DV>||#$vS9Vy)6mucGTx3zbSUHw|4x
zfgLJ>ZZ1Mc(i%<}AV)HGTC76Nyxfk>c~i6IykjEdSZbul2GvD@vw8ZIxuFpbyOZ5K
zxZH=9w98%{`G0oZJa63z>(V@bS((=oWjZ`fE}%~7_MLDVYGzdFoUx;+l$tmVoUkwG
zqQ^O=AvhsT$<#wl>OXxwGSg|@JfoY8KzZqTAU_1eDS}?vg^3T7x;&0JFP%_@x@54l
zM7$k(yc63yM^spi@*Febbjv}uwTLxK51hEqJE6g8)&Sa^(bTFrr-fQmm(*x1UQ(LA
zb$L!0oTVi7QbeOfZcZ7b#Ppb$ZRTPOe9E}aYGFVK?wp;W)N@gg=A_eV3Osk_Vt972
zyEPbsl4@sLUD-)w+e7f&QKL1Bana^9h>wvn><%w3ab;oeY95RR=t>pl7rA}5bkb{)
z%y9{L9;<TEYxHNx75t_)-KALQ7O@tZ3u#cWiNvQDKp8hglnf$*M<$fav7nqy2OGT`
zwHnSG1sC#mj8HR)w{2;bT1(+P?W)JN-!k*5DDop@Z1}6qbh_y8(nZ*qtlQ~Ts+ufu
z{bbk$JR6if;)5Nzni5&kcogJNHCE}s#zQoZCd3eBFVmB3JM@%wlb8VM-R&lCUaxmo
zu7diWSQO@Q6^(M)#!4G$R?m%GWfbd(-QopD8jantYys9ZmUfS|bXyNLK9>)BE!8ZJ
zvz!et%yU^c+J==Pr6KR{GX-i4NRaxsP)aE<gP4~5vOhbekUEum8a*_a&qxN`*j*ud
znk2ghlvhx-Y1u8BGh-wz)>mRO^J|10t{WACQiUsS+EhY(uEf*8mj+#5o|dkqHhgJO
zQT~eR1oyl-978pw^wz7=V#F;3+iGlA()`-y+GNBHSYK8OgWCljuVW`hp}m~q6(<ya
zJji`(UYIi_r?IfdcXNA*#?&4uVG0$vg)TR!7E3j+X;+@Io><4&6*f1>U8!C9V#?{J
zQE9Lpcv4i<`n8=WFW`(@&^)N0q~VWxYUD2U%CT5DM#Nvww$NWLu+vjoN*D=ttO&Nb
z*^Nw!UDG4F)UUJ|D~u`bMikdtY?Ncm;3=L0yHwlvFv&53WM9KW*WUNbynkq=6h615
zk6{eV1F$HpD7g2{^(^%WAgB5Mq^QqVuvkHSA0z{7kkM`nDC>a6yD7ok+)RdVy?uIg
rKT%#C3H3yI{kgMzX;zE>YhK)&*>w5F^q34EzFRB2O<zL)lRfn>xBM>{

literal 0
HcmV?d00001