fuzz_harness.h File Reference

Default APDU harness body for a fuzz target. More...

#include <stddef.h>
#include <stdint.h>
#include <string.h>
#include <setjmp.h>
#include "fuzz_defs.h"
#include "mocks.h"
#include "parser.h"

Include dependency graph for fuzz_harness.h:

Go to the source code of this file.

Macros
#define	FUZZ_PICK_COMMAND_STRUCTURED(data, size)   (&fuzz_commands[fuzz_ctrl[1] % fuzz_n_commands])
#define	FUZZ_PICK_COMMAND_RAW(data, size)   (&fuzz_commands[(data)[1] % fuzz_n_commands])

Functions
void	fuzz_app_reset (void)
	Reset app state before each iteration (required).
void	fuzz_app_dispatch (void *cmd)
	Dispatch one command_t to the app (required).
void	fuzz_app_cleanup (void)
	Optional per-iteration teardown; a weak no-op default is provided.
static int	fuzz_use_structured_lane (void)
	Whether control byte 0 selects the structured lane.
static uint8_t	fuzz_clamp_p (uint8_t raw, uint8_t p_max)
	Clamp a raw P1/P2 byte to the command's declared maximum (0 = full range).
static void	fuzz_harness_cleanup (void)
static int	fuzz_harness_entry (const uint8_t *data, size_t size)
	Default fuzz_entry() body: run one fuzzer input as one APDU.

Variables
const fuzz_command_spec_t	fuzz_commands []
	App command table.
const size_t	fuzz_n_commands
	Number of entries in fuzz_commands.

Detailed Description

Default APDU harness body for a fuzz target.

Including this header gives a target the standard fuzz_harness_entry() implementation: it turns one fuzzer input into one APDU and dispatches it through the app. The app supplies the command table (fuzz_commands), the required fuzz_app_reset() / fuzz_app_dispatch() callbacks, and the fuzz_* symbols from its mocks.h. fuzz_app_cleanup() is optional: the framework ships a weak no-op default that an app may override.

Definition in file fuzz_harness.h.

Macro Definition Documentation

FUZZ_PICK_COMMAND_RAW

#define FUZZ_PICK_COMMAND_RAW	(		data,
			size
	)		(&fuzz_commands[(data)[1] % fuzz_n_commands])

Definition at line 50 of file fuzz_harness.h.

FUZZ_PICK_COMMAND_STRUCTURED

#define FUZZ_PICK_COMMAND_STRUCTURED	(		data,
			size
	)		(&fuzz_commands[fuzz_ctrl[1] % fuzz_n_commands])

Apps may override these macros before inclusion to install lane-specific command tables.

Definition at line 46 of file fuzz_harness.h.

Function Documentation

fuzz_app_cleanup()

void fuzz_app_cleanup ( void  )

extern

Optional per-iteration teardown; a weak no-op default is provided.

fuzz_app_dispatch()

void fuzz_app_dispatch ( void *  cmd )

extern

Dispatch one command_t to the app (required).

fuzz_app_reset()

void fuzz_app_reset ( void  )

extern

Reset app state before each iteration (required).

fuzz_clamp_p()

static uint8_t fuzz_clamp_p ( uint8_t  raw, uint8_t  p_max  )

inlinestatic

Clamp a raw P1/P2 byte to the command's declared maximum (0 = full range).

Definition at line 36 of file fuzz_harness.h.

fuzz_harness_cleanup()

static void fuzz_harness_cleanup ( void  )

static

Definition at line 53 of file fuzz_harness.h.

fuzz_harness_entry()

static int fuzz_harness_entry ( const uint8_t *  data, size_t  size  )

static

Default fuzz_entry() body: run one fuzzer input as one APDU.

Reads the first 4 bytes as CLA/INS/P1/P2 selectors, exposes the rest as the APDU payload, picks a command from fuzz_commands, and dispatches it.

Returns

0 when the input was processed, -1 when it was too short to use.

Definition at line 69 of file fuzz_harness.h.

fuzz_use_structured_lane()

static int fuzz_use_structured_lane ( void  )

inlinestatic

Whether control byte 0 selects the structured lane.

Definition at line 30 of file fuzz_harness.h.

Variable Documentation

fuzz_commands

const fuzz_command_spec_t fuzz_commands[]

extern

App command table.

fuzz_n_commands

const size_t fuzz_n_commands

extern

Number of entries in fuzz_commands.