[herin049]

Changes

Adds a cargo-fuzz crate in fuzz/.

Note: cargo-fuzz requires nightly so I've left it outside the workspace.

This PR adds the required scaffodling for fuzzing with cargo-fuzz and adds a few basic fuzz targets for trace context/trace state parsing. The fuzz tests use the pest crate + corresponding pest grammars as oracles for correctness verification. The fuzz tests also implement structure aware fuzzing using the arbitrary crate for better coverage.

The trace state targets run clean (I ran each for ~10 million iterations). The trace context target currently fails because
extract_span_context doesn't check the length of the traceparent fields (e.g. a 30 char
trace-id or a 1-char parent-id/flags is accepted). This is a pretty trivial/minor issue, but I figure we might as well address it unless there are objections.

No CI wiring yet.

Merge requirement checklist

• CONTRIBUTING guidelines followed
• Unit tests added/updated (if applicable)
• Appropriate CHANGELOG.md files updated for non-trivial, user-facing changes
• Changes in public API reviewed (if applicable)

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on reviewers · refreshed 2026-10-22 21:00 UTC

Review the latest changes.

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.3%. Comparing base (f61467c) to head (dccbb4e).

Additional details and impacted files

@@           Coverage Diff           @@
##            main   #3805     +/-   ##
=======================================
- Coverage   84.3%   84.3%   -0.1%     
=======================================
  Files        124     124             
  Lines      30673   30673             
=======================================
- Hits       25882   25880      -2     
- Misses      4791    4793      +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[scottgerring]

Hey @herin049 this is cool!
Just flagging that as its quite chunky, and i've personally got no experience with cargo-fuzz, it'll take a bit to get around to (altho one of the other approvers is ofc also welcome to pick up!)

It's nice it immediately found an issue, and to your point I agree it would be clean to address that particular issue in this PR also 💪

[herin049]

Hey @herin049 this is cool! Just flagging that as its quite chunky, and i've personally got no experience with cargo-fuzz, it'll take a bit to get around to (altho one of the other approvers is ofc also welcome to pick up!)

It's nice it immediately found an issue, and to your point I agree it would be clean to address that particular issue in this PR also 💪

Most of this comes from the fact that I wanted to make the fuzzing structure aware. If you'd prefer, I can strip this down to a bare minimum fuzzer with just string inputs. The downside being that it is much less likely to catch real bugs in our implementation.

I'm also not very familiar with cargo-fuzz (until opening this PR), I just followed this Fuzzing with cargo-fuzz guide to get a general idea of how it works. Let me know what you think.