No fuzz testing for `decode()`

There is no fuzz testing for decode(). go-multibase includes FuzzDecode that exercises the decoder with random input, catching panics and unexpected errors.

Problem

decode() accepts arbitrary byte input and routes it through get_codec() → converter-specific decode(). Malformed input could trigger unhandled exceptions, infinite loops, or excessive memory allocation in the custom bit-manipulation converters (BaseByteStringConverter._decode_bytes()).

go-multibase has a fuzz target seeded with spec vectors:

func FuzzDecode(f *testing.F) {
    // Seed with official test vectors
    for _, tc := range specVectors {
        f.Add(tc.encoded)
    }
    // Fuzz with random strings
    f.Fuzz(func(t *testing.T, data string) {
        Decode(data)  // Should never panic
    })
}

Proposed Solution

1. Install hypothesis as a dev dependency.

2. Create tests/test_fuzz.py:

   from hypothesis import given, strategies as st, settings
   from multibase import decode, encode, ENCODINGS
   
   @given(st.binary(max_size=200))
   @settings(max_examples=1000)
   def test_decode_never_crashes(data):
       """decode() should raise an exception, not crash."""
       try:
           decode(data)
       except Exception:
           pass  # Any exception is fine, just no crashes
   
   @given(st.text(max_size=200))
   @settings(max_examples=1000)
   def test_decode_string_never_crashes(data):
       try:
           decode(data)
       except Exception:
           pass
   
   @given(st.binary(min_size=1, max_size=100))
   @settings(max_examples=500)
   def test_roundtrip_never_crashes(data):
       """encode then decode should never crash."""
       for enc in ENCODINGS:
           try:
               encoded = encode(enc.encoding, data)
               decode(encoded)
           except Exception:
               pass
   

Related

• Go fuzz test: go-multibase spec_test.go FuzzDecode

Install Hypothesis as a development dependency and create tests/test_fuzz.py using the proposed fuzz cases. Start by reading the existing decode(), encode(), and ENCODINGS interfaces, then run the new tests with binary and text inputs. Done means malformed inputs raise exceptions rather than crash, and encode/decode round trips complete without crashes.