fuzz_harness.h

Go to the documentation of this file.

#pragma once
#include <stddef.h>
#include <stdint.h>
#include <string.h>
#include <setjmp.h>
#include "fuzz_defs.h"
/* Optional: an app includes its own mocks.h only if it genuinely has
 * app-specific stubs. The framework symbols this harness needs are declared
 * in fuzz_defs.h. */
#if __has_include("mocks.h")
#include "mocks.h"
#endif
#include "parser.h"
 
extern const fuzz_command_spec_t fuzz_commands[];  
extern const size_t              fuzz_n_commands;  
extern void fuzz_app_reset(void);          
extern void fuzz_app_dispatch(void *cmd);  
 
extern void fuzz_app_cleanup(void);
 
static int fuzz_lane_structured;
 
static inline int fuzz_use_structured_lane(void)
{
    return fuzz_lane_structured;
}
 
static inline uint8_t fuzz_clamp_p(uint8_t raw, uint8_t p_max)
{
    if (p_max == 0) {
        return raw;
    }
    return raw % (p_max + 1);
}
 
#ifndef FUZZ_APP_HEADER_LEN
#define FUZZ_APP_HEADER_LEN 0
#endif
 
#ifndef FUZZ_PICK_COMMAND_STRUCTURED
#define FUZZ_PICK_COMMAND_STRUCTURED(data, size) (&fuzz_commands[(data)[1] % fuzz_n_commands])
#endif
 
#ifndef FUZZ_PICK_COMMAND_RAW
#define FUZZ_PICK_COMMAND_RAW(data, size) (&fuzz_commands[(data)[1] % fuzz_n_commands])
#endif
 
static void fuzz_harness_cleanup(void)
{
    fuzz_app_cleanup();
    fuzz_tail_ptr = NULL;
    fuzz_tail_len = 0;
    try_context_set(NULL);
    memset(&fuzz_exit_jump_ctx, 0, sizeof(fuzz_exit_jump_ctx));
}
 
static int fuzz_harness_entry(const uint8_t *data, size_t size)
{
    try_context_set(&fuzz_exit_jump_ctx);
 
    if (sigsetjmp(fuzz_exit_jump_ctx.jmp_buf, 1)) {
        fuzz_harness_cleanup();
        return 0;
    }
 
    const size_t header = (size_t) FUZZ_CTRL_LEN + FUZZ_APP_HEADER_LEN;
 
    if (size < header || fuzz_n_commands == 0) {
        return -1;
    }
 
    fuzz_lane_structured = data[0] > FUZZ_STRUCTURED_LANE_THRESHOLD;
 
    /* Published before fuzz_app_reset() so an app can read its own input while
     * establishing state. */
    fuzz_tail_ptr = (size > header) ? data + header : NULL;
    fuzz_tail_len = (size > header) ? size - header : 0;
 
    fuzz_app_reset();
 
    const fuzz_command_spec_t *spec;
    if (fuzz_use_structured_lane()) {
        spec = FUZZ_PICK_COMMAND_STRUCTURED(data, size);
    }
    else {
        spec = FUZZ_PICK_COMMAND_RAW(data, size);
    }
 
    command_t cmd;
    memset(&cmd, 0, sizeof(cmd));
 
    cmd.cla = spec->cla;
    cmd.ins = spec->ins;
    cmd.p1  = fuzz_clamp_p(data[2], spec->p1_max);
    cmd.p2  = fuzz_clamp_p(data[3], spec->p2_max);
 
    if (fuzz_tail_len > 0) {
        cmd.lc   = (uint8_t) (fuzz_tail_len > 255 ? 255 : fuzz_tail_len);
        cmd.data = (uint8_t *) fuzz_tail_ptr;
    }
 
    fuzz_app_dispatch(&cmd);
    fuzz_harness_cleanup();
    return 0;
}
 
#include "fuzz_mutator.h"
 
#ifndef FUZZ_APP_CUSTOM_MUTATOR
size_t LLVMFuzzerCustomMutator(uint8_t *data, size_t size, size_t max_size, unsigned int seed)
{
    return fuzz_custom_mutator(data, size, max_size, seed);
}
#endif
 
#ifndef FUZZ_APP_CUSTOM_ENTRY
int fuzz_entry(const uint8_t *data, size_t size);
int fuzz_entry(const uint8_t *data, size_t size)
{
    return fuzz_harness_entry(data, size);
}
#endif