Optional grammar-aware TLV mutator for the tail region. More...

#include <stddef.h>
#include <stdint.h>
#include "fuzz_mutator.h"

Include dependency graph for tlv_mutator.h:

Classes
struct	tlv_tag_info_t
	Length bounds the mutator keeps for one TLV tag. More...

struct	tlv_fuzz_config_t
	The TLV grammar the mutator currently applies (one per command). More...

Macros
#define	TLV_CFG(arr)
	Build a tlv_fuzz_config_t from a tlv_tag_info_t array.

Functions
size_t	tlv_custom_mutate (uint8_t *data, size_t size, size_t max_size, unsigned int seed)
	Mutate a TLV byte range in place, preserving valid framing.

static size_t	fuzz_tlv_dispatch_mutate (uint8_t data, size_t size, size_t max_size, unsigned int seed, const tlv_fuzz_config_t configs, size_t n_configs)

Variables
tlv_fuzz_config_t	current_tlv_fuzz_config

const size_t	fuzz_n_commands

Detailed Description

Optional grammar-aware TLV mutator for the tail region.

Keeps mutated tails valid TLV so the fuzzer spends its budget on values rather than on framing. Set current_tlv_fuzz_config before calling tlv_custom_mutate(). Opt in per app via LEDGER_FUZZ_TLV_MUTATOR_SOURCE.

Definition in file tlv_mutator.h.

Macro Definition Documentation

◆ TLV_CFG

#define TLV_CFG ( arr )

Value:

    {                                                                  \
        .tags_info = (arr), .num_tags = sizeof(arr) / sizeof((arr)[0]) \
    }

Build a tlv_fuzz_config_t from a tlv_tag_info_t array.

Definition at line 31 of file tlv_mutator.h.

Function Documentation

◆ fuzz_tlv_dispatch_mutate()

static size_t fuzz_tlv_dispatch_mutate	(	uint8_t *	data,
		size_t	size,
		size_t	max_size,
		unsigned int	seed,
		const tlv_fuzz_config_t *	configs,
		size_t	n_configs
	)

inlinestatic

Definition at line 52 of file tlv_mutator.h.

◆ tlv_custom_mutate()

size_t tlv_custom_mutate	(	uint8_t *	data,
		size_t	size,
		size_t	max_size,
		unsigned int	seed
	)

Mutate a TLV byte range in place, preserving valid framing.

Variable Documentation

◆ current_tlv_fuzz_config

tlv_fuzz_config_t current_tlv_fuzz_config

extern

Active grammar; set it before calling tlv_custom_mutate().

◆ fuzz_n_commands

const size_t fuzz_n_commands