# NFT-SEC-04 — OpenCV CVE-2025-53644 + AddressSanitizer fuzz

**Task**: AZ-439_nft_sec_04_opencv_cve
**Name**: Crafted JPEG (CVE-2025-53644) does NOT crash; ≥4 h ASan fuzz no findings (RESTRICT-CVE-1)
**Description**: Implement NFT-SEC-04 — Tier-1 OR Tier-2; (a) feed `cve-jpeg-fixture` to nav-camera input and assert no crash + graceful error; (b) run an AddressSanitizer-instrumented build under fuzz inputs for ≥4 h with no ASan findings.
**Complexity**: 5 points
**Dependencies**: AZ-406, AZ-407 (cve-jpeg-fixture), AZ-444 (optional Tier-2)
**Component**: Blackbox Tests / Security (epic AZ-262)
**Tracker**: AZ-439
**Epic**: AZ-262 (E-BBT)

## Problem

The pinned OpenCV version (≥4.12) must be CVE-immune to the documented vulnerability (RESTRICT-CVE-1). Without a probe + fuzz validation, regressions on a future OpenCV bump could silently reintroduce a security defect.

## Outcome

- pytest scenarios at `e2e/tests/security/test_nft_sec_04_opencv_cve.py` (probe) and `test_nft_sec_04_asan_fuzz.py` (long-running fuzz, gated behind release-gate flag).
- Probe (always run): push `cve-jpeg-fixture` as a single nav-camera frame; assert no crash; assert SUT either decodes it or returns a graceful error event in FDR.
- Fuzz (release-gate): run `build_kind=ASan` SUT image with a randomized JPEG-fuzz harness for ≥4 h; assert 0 ASan findings.

## Scope

### Included
- CVE-probe sub-test (always run).
- ASan-fuzz sub-test (release-gate, gated by `RELEASE_GATE=true` env flag).

### Excluded
- General fuzzing of non-image inputs — out of scope.

## Acceptance Criteria

**AC-1: CVE probe — no crash**
Given the SUT is fed `cve-2025-53644.jpg` as a nav-camera frame
Then the SUT does NOT crash; the SUT process remains alive after the frame; the FDR contains either a decode-success record OR a `frame-decode-error` record (graceful error).

**AC-2: ASan fuzz no findings**
Given the `build_kind=ASan` SUT image is running fuzz inputs for ≥4 h
Then 0 ASan findings (heap-buffer-overflow, use-after-free, etc.) appear in the captured stderr / ASan log.

**AC-3: ASan fuzz coverage**
Given the 4 h fuzz run
Then the fuzz harness reaches ≥1000 unique JPEG corpus inputs (a coverage proxy via `--corpus-info` or equivalent) — informational only; no hard threshold.

**AC-4: parameterization**
Given conftest parameterization
Then the probe runs per `(fc_adapter, vio_strategy)`; the fuzz runs once per `vio_strategy` (fc_adapter is irrelevant for image-decode).

## System Under Test Boundary

End-to-end through public boundaries; the ASan fuzz uses the SUT's own image-decode path (no direct OpenCV calls from the harness).

- **Allowed**: nav-camera frame push (a public input), ASan log capture, FDR archive read.
- **Forbidden**: directly testing `cv2.imdecode` outside the SUT.

## Constraints

- Fuzz duration is ≥4 h per RESTRICT-CVE-1; default CI run uses the probe only (~30 s) and gates the fuzz behind `RELEASE_GATE=true`.

## Document Dependencies

- `_docs/02_document/tests/security-tests.md` § NFT-SEC-04
- `_docs/02_document/tests/test-data.md` § Security (NFT-SEC-04 row)
