From 36c079149a3f9009449d5cca987a404b3eedd99f Mon Sep 17 00:00:00 2001
From: Niels Lohmann <mail@nlohmann.me>
Date: Thu, 24 Sep 2026 17:02:57 +0200
Subject: [PATCH] Refuse to build the fuzzer drivers with NDEBUG (#5562)

The fuzzer drivers check their round trips with assert(), which NDEBUG
compiles away. The OSS-Fuzz build keeps assertions on today, but nothing
pins that: a build change that adds NDEBUG would silently turn every
round-trip check into a mere "does not crash" check. Each driver now
stops the build with an #error instead, and includes <cassert> itself
rather than relying on json.hpp.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>
---
 tests/src/fuzzer-parse_bjdata.cpp  | 6 ++++++
 tests/src/fuzzer-parse_bson.cpp    | 6 ++++++
 tests/src/fuzzer-parse_cbor.cpp    | 6 ++++++
 tests/src/fuzzer-parse_json.cpp    | 6 ++++++
 tests/src/fuzzer-parse_msgpack.cpp | 6 ++++++
 tests/src/fuzzer-parse_ubjson.cpp  | 6 ++++++
 6 files changed, 36 insertions(+)

diff --git a/tests/src/fuzzer-parse_bjdata.cpp b/tests/src/fuzzer-parse_bjdata.cpp
index a88479933..41c51a311 100644
--- a/tests/src/fuzzer-parse_bjdata.cpp
+++ b/tests/src/fuzzer-parse_bjdata.cpp
@@ -46,10 +46,16 @@ The provided function `LLVMFuzzerTestOneInput` can be used in different fuzzer
 drivers.
 */
 
+#include <cassert>
 #include <iostream>
 #include <sstream>
 #include <nlohmann/json.hpp>
 
+// the round-trip checks below are assertions; NDEBUG would compile them away
+#ifdef NDEBUG
+    #error "the fuzzer drivers must be built without NDEBUG"
+#endif
+
 using json = nlohmann::json;
 
 // value-stable comparison for the round-trip checks below; see the note
diff --git a/tests/src/fuzzer-parse_bson.cpp b/tests/src/fuzzer-parse_bson.cpp
index c5f74c7cc..16f36445b 100644
--- a/tests/src/fuzzer-parse_bson.cpp
+++ b/tests/src/fuzzer-parse_bson.cpp
@@ -19,10 +19,16 @@ The provided function `LLVMFuzzerTestOneInput` can be used in different fuzzer
 drivers.
 */
 
+#include <cassert>
 #include <iostream>
 #include <sstream>
 #include <nlohmann/json.hpp>
 
+// the round-trip checks below are assertions; NDEBUG would compile them away
+#ifdef NDEBUG
+    #error "the fuzzer drivers must be built without NDEBUG"
+#endif
+
 using json = nlohmann::json;
 
 // see http://llvm.org/docs/LibFuzzer.html
diff --git a/tests/src/fuzzer-parse_cbor.cpp b/tests/src/fuzzer-parse_cbor.cpp
index b38e3c1e5..7d599abe2 100644
--- a/tests/src/fuzzer-parse_cbor.cpp
+++ b/tests/src/fuzzer-parse_cbor.cpp
@@ -19,10 +19,16 @@ The provided function `LLVMFuzzerTestOneInput` can be used in different fuzzer
 drivers.
 */
 
+#include <cassert>
 #include <iostream>
 #include <sstream>
 #include <nlohmann/json.hpp>
 
+// the round-trip checks below are assertions; NDEBUG would compile them away
+#ifdef NDEBUG
+    #error "the fuzzer drivers must be built without NDEBUG"
+#endif
+
 using json = nlohmann::json;
 
 // see http://llvm.org/docs/LibFuzzer.html
diff --git a/tests/src/fuzzer-parse_json.cpp b/tests/src/fuzzer-parse_json.cpp
index 59a278c7b..217d9e0fd 100644
--- a/tests/src/fuzzer-parse_json.cpp
+++ b/tests/src/fuzzer-parse_json.cpp
@@ -20,10 +20,16 @@ The provided function `LLVMFuzzerTestOneInput` can be used in different fuzzer
 drivers.
 */
 
+#include <cassert>
 #include <iostream>
 #include <sstream>
 #include <nlohmann/json.hpp>
 
+// the round-trip checks below are assertions; NDEBUG would compile them away
+#ifdef NDEBUG
+    #error "the fuzzer drivers must be built without NDEBUG"
+#endif
+
 using json = nlohmann::json;
 
 // see http://llvm.org/docs/LibFuzzer.html
diff --git a/tests/src/fuzzer-parse_msgpack.cpp b/tests/src/fuzzer-parse_msgpack.cpp
index 0b4ab0af7..df961b8d7 100644
--- a/tests/src/fuzzer-parse_msgpack.cpp
+++ b/tests/src/fuzzer-parse_msgpack.cpp
@@ -19,10 +19,16 @@ The provided function `LLVMFuzzerTestOneInput` can be used in different fuzzer
 drivers.
 */
 
+#include <cassert>
 #include <iostream>
 #include <sstream>
 #include <nlohmann/json.hpp>
 
+// the round-trip checks below are assertions; NDEBUG would compile them away
+#ifdef NDEBUG
+    #error "the fuzzer drivers must be built without NDEBUG"
+#endif
+
 using json = nlohmann::json;
 
 // see http://llvm.org/docs/LibFuzzer.html
diff --git a/tests/src/fuzzer-parse_ubjson.cpp b/tests/src/fuzzer-parse_ubjson.cpp
index 463656c71..20c20eda7 100644
--- a/tests/src/fuzzer-parse_ubjson.cpp
+++ b/tests/src/fuzzer-parse_ubjson.cpp
@@ -25,10 +25,16 @@ The provided function `LLVMFuzzerTestOneInput` can be used in different fuzzer
 drivers.
 */
 
+#include <cassert>
 #include <iostream>
 #include <sstream>
 #include <nlohmann/json.hpp>
 
+// the round-trip checks below are assertions; NDEBUG would compile them away
+#ifdef NDEBUG
+    #error "the fuzzer drivers must be built without NDEBUG"
+#endif
+
 using json = nlohmann::json;
 
 // see http://llvm.org/docs/LibFuzzer.html