Optional grammar-aware TLV mutator for the tail region. More...
#include <stddef.h>#include <stdint.h>
Include dependency graph for tlv_mutator.h:
Go to the source code of this file.
Classes | |
| struct | tlv_tag_info_t |
| Length bounds the mutator keeps for one TLV tag. More... | |
| struct | tlv_fuzz_config_t |
| The TLV grammar the mutator currently applies (one per command). More... | |
Functions | |
| size_t | tlv_custom_mutate (uint8_t *data, size_t size, size_t max_size, unsigned int seed) |
| Mutate a TLV byte range in place, preserving valid framing. | |
Variables | |
| tlv_fuzz_config_t | current_tlv_fuzz_config |
Detailed Description
Optional grammar-aware TLV mutator for the tail region.
Keeps mutated tails valid TLV so the fuzzer spends its budget on values rather than on framing. Set current_tlv_fuzz_config before calling tlv_custom_mutate(). Opt in per app via LEDGER_FUZZ_TLV_MUTATOR_SOURCE.
Definition in file tlv_mutator.h.
Function Documentation
◆ tlv_custom_mutate()
| size_t tlv_custom_mutate | ( | uint8_t * | data, |
| size_t | size, | ||
| size_t | max_size, | ||
| unsigned int | seed | ||
| ) |
Mutate a TLV byte range in place, preserving valid framing.
Variable Documentation
◆ current_tlv_fuzz_config
|
extern |
Active grammar; set it before calling tlv_custom_mutate().
