fuzz_harness.h File Reference

Default APDU harness body for a fuzz target. More...

#include <stddef.h>
#include <stdint.h>
#include <string.h>
#include <setjmp.h>
#include "fuzz_defs.h"
#include "parser.h"
#include "fuzz_mutator.h"

Include dependency graph for fuzz_harness.h:

Go to the source code of this file.

Macros
#define	FUZZ_APP_HEADER_LEN   0
	Bytes an app reserves for its own header, right after the control bytes.
#define	FUZZ_PICK_COMMAND_STRUCTURED(data, size)   (&fuzz_commands[(data)[1] % fuzz_n_commands])
#define	FUZZ_PICK_COMMAND_RAW(data, size)   (&fuzz_commands[(data)[1] % fuzz_n_commands])

Functions
void	fuzz_app_reset (void)
	Reset app state before each iteration (optional).
void	fuzz_app_dispatch (void *cmd)
	Dispatch one command_t to the app (required).
void	fuzz_app_cleanup (void)
	Optional per-iteration teardown; the weak no-op default is in mock/fuzz_runtime.c.
static int	fuzz_use_structured_lane (void)
	Whether control byte 0 selected the structured lane.
static uint8_t	fuzz_clamp_p (uint8_t raw, uint8_t p_max)
	Clamp a raw P1/P2 byte to the command's declared maximum (0 = full range).
static void	fuzz_harness_cleanup (void)
static int	fuzz_harness_entry (const uint8_t *data, size_t size)
	Default fuzz_entry() body: run one fuzzer input as one APDU.
size_t	LLVMFuzzerCustomMutator (uint8_t *data, size_t size, size_t max_size, unsigned int seed)
	Default custom mutator.
int	fuzz_entry (const uint8_t *data, size_t size)
	Default fuzz_entry(), the symbol Absolution calls per iteration.

Variables
const fuzz_command_spec_t	fuzz_commands []
	App command table.
const size_t	fuzz_n_commands
	Number of entries in fuzz_commands.
static int	fuzz_lane_structured

Detailed Description

Default APDU harness body for a fuzz target.

Including this header gives a target the standard fuzz_harness_entry() implementation: it turns one fuzzer input into one APDU and dispatches it through the app. The app contract is small and entirely about the app:

const fuzz_command_spec_t fuzz_commands[] = { ... };
FUZZ_COMMAND_COUNT();            // derives fuzz_n_commands
void fuzz_app_reset(void);       // per-iteration state setup
void fuzz_app_dispatch(void *);  // hand the built command_t to the app

fuzz_app_cleanup() is optional: the framework ships a weak no-op default that an app may override. Lane selection, command selection, P1/P2 clamping and the custom mutator all come from the framework. See fuzz_defs.h for the input layout — the harness takes its control bytes from the start of its own input, so nothing here or in an app ever needs to know where a global sits inside Absolution's prefix.

Definition in file fuzz_harness.h.

Macro Definition Documentation

FUZZ_APP_HEADER_LEN

#define FUZZ_APP_HEADER_LEN   0

Bytes an app reserves for its own header, right after the control bytes.

The APDU payload starts after them, so fuzz_tail_ptr[0] stays a stable base for the app's builders.

Definition at line 72 of file fuzz_harness.h.

FUZZ_PICK_COMMAND_RAW

#define FUZZ_PICK_COMMAND_RAW	(		data,
			size
	)		(&fuzz_commands[(data)[1] % fuzz_n_commands])

Definition at line 81 of file fuzz_harness.h.

FUZZ_PICK_COMMAND_STRUCTURED

#define FUZZ_PICK_COMMAND_STRUCTURED	(		data,
			size
	)		(&fuzz_commands[(data)[1] % fuzz_n_commands])

Apps may override these macros before inclusion to install lane-specific command tables.

Definition at line 77 of file fuzz_harness.h.

Function Documentation

fuzz_app_cleanup()

void fuzz_app_cleanup ( void  )

extern

Optional per-iteration teardown; the weak no-op default is in mock/fuzz_runtime.c.

fuzz_app_dispatch()

void fuzz_app_dispatch ( void *  cmd )

extern

Dispatch one command_t to the app (required).

fuzz_app_reset()

void fuzz_app_reset ( void  )

extern

Reset app state before each iteration (optional).

fuzz_clamp_p()

static uint8_t fuzz_clamp_p ( uint8_t  raw, uint8_t  p_max  )

inlinestatic

Clamp a raw P1/P2 byte to the command's declared maximum (0 = full range).

Definition at line 57 of file fuzz_harness.h.

fuzz_entry()

int fuzz_entry	(	const uint8_t *	data,
		size_t	size
	)

Default fuzz_entry(), the symbol Absolution calls per iteration.

Define FUZZ_APP_CUSTOM_ENTRY to write your own, for instance to add a non-APDU lane. Returning -1 makes Absolution skip its check_invariant() assertion for that input, so return it only for inputs you did not run.

Definition at line 176 of file fuzz_harness.h.

fuzz_harness_cleanup()

static void fuzz_harness_cleanup ( void  )

static

Definition at line 84 of file fuzz_harness.h.

fuzz_harness_entry()

static int fuzz_harness_entry ( const uint8_t *  data, size_t  size  )

static

Default fuzz_entry() body: run one fuzzer input as one APDU.

Reads the control bytes as lane/command/P1/P2 selectors, exposes the rest as the APDU payload, picks a command from fuzz_commands, and dispatches it.

Returns

0 when the input was processed, -1 when it was too short to use.

Definition at line 100 of file fuzz_harness.h.

fuzz_use_structured_lane()

static int fuzz_use_structured_lane ( void  )

inlinestatic

Whether control byte 0 selected the structured lane.

Definition at line 51 of file fuzz_harness.h.

LLVMFuzzerCustomMutator()

size_t LLVMFuzzerCustomMutator	(	uint8_t *	data,
		size_t	size,
		size_t	max_size,
		unsigned int	seed
	)

Default custom mutator.

Provided by the framework. A harness with its own input grammar defines FUZZ_APP_CUSTOM_MUTATOR before including this header and provides its own LLVMFuzzerCustomMutator(), usually built on fuzz_mutate_input_with() so it still does not have to know the prefix size.

Definition at line 161 of file fuzz_harness.h.

Variable Documentation

fuzz_commands

const fuzz_command_spec_t fuzz_commands[]

extern

App command table.

fuzz_lane_structured

int fuzz_lane_structured

static

Lane of the input being dispatched; set before fuzz_app_reset() runs.

Definition at line 48 of file fuzz_harness.h.

fuzz_n_commands

const size_t fuzz_n_commands

extern

Number of entries in fuzz_commands.