Coverage Report

Created: 2025-07-11 06:22

/src/cups/ossfuzz/fuzz_ipp_gen.c
Line
Count
Source (jump to first uncovered line)
1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <string.h>
4
#include <stdint.h>
5
#include <unistd.h>
6
#include <cups/ipp.h>
7
#include "file.h"
8
9
1.93k
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
10
    // Create a temporary file name using the process ID to avoid conflicts
11
1.93k
    char filename[256];
12
1.93k
    snprintf(filename, sizeof(filename), "/tmp/fuzz_input_%d.ipp", getpid());
13
14
    // Open the file for writing
15
1.93k
    cups_file_t *file = cupsFileOpen(filename, "w");
16
1.93k
    if (!file) {
17
0
        return 0; // Cannot open file, return
18
0
    }
19
20
    // Write the fuzzing data to the file
21
1.93k
    if (cupsFileWrite(file, (const char *)data, size) != (ssize_t)size) {
22
0
        cupsFileClose(file);
23
0
        unlink(filename); // Clean up the file
24
0
        return 0; // Write error, return
25
0
    }
26
27
    // Close the file after writing
28
1.93k
    cupsFileClose(file);
29
30
    // Reopen the file for reading
31
1.93k
    file = cupsFileOpen(filename, "r");
32
1.93k
    if (!file) {
33
0
        unlink(filename); // Clean up the file
34
0
        return 0; // Cannot reopen file, return
35
0
    }
36
37
    // Create a new IPP request and response objects
38
1.93k
    ipp_t *request = ippNew();
39
1.93k
    ipp_t *response = ippNew();
40
41
    // Use ippReadIO with cupsFileRead callback to process the input
42
1.93k
    ipp_state_t state = ippReadIO(file, (ipp_io_cb_t)cupsFileRead, 1, request, response);
43
44
    // Cleanup
45
1.93k
    ippDelete(request);
46
1.93k
    ippDelete(response);
47
1.93k
    cupsFileClose(file);
48
1.93k
    unlink(filename); // Remove the temporary file
49
50
1.93k
    return 0;
51
1.93k
}