/src/curl_fuzzer/proto_fuzzer/request_data.cc

Source
/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

/// @file
/// @brief Builds bounded curl_slist and curl_mime state from a Scenario.

#include "proto_fuzzer/request_data.h"

#include <algorithm>
#include <cstddef>
#include <cstdio>
#include <cstring>
#include <limits>
#include <string>

#include "proto_fuzzer/option_apply.h"
#include "proto_fuzzer/scenario_limits.h"

namespace proto_fuzzer {

namespace {

/// Borrow the protobuf string when it already fits curl's NUL-terminated API,
/// allocating `truncated` only for compatibility inputs that bypass the fixed
/// target postprocessor. The callers below all synchronously copy this value,
/// so neither pointer escapes the call. Embedded NUL bytes deliberately remain:
/// curl observes the same prefix as before while an oversized invisible suffix
/// cannot dominate allocation.
const char* BoundedCString(const std::string& value, std::size_t limit, std::string* truncated) {
  if (value.size() <= limit) {
    return value.c_str();
  }
  truncated->assign(value.data(), limit);
  return truncated->c_str();
}

/// Raw read/seek callbacks are useful only when a script exists or a supported
/// SetOption can make curl request caller-provided body bytes. CURLOPT_POST is
/// included because POST without POSTFIELDS/MIME also falls back to the read
/// callback. Avoiding callbacks for ordinary requests removes eight setopt
/// calls across setup and teardown, while any potentially body-reading option
/// retains the non-blocking fallback regardless of its mutated value.
bool NeedsUploadCallbacks(const curl::fuzzer::proto::Scenario& scenario) {
  // curl's TELNET implementation polls stdin unless a READFUNCTION was
  // explicitly installed. Always provide the bounded per-scenario source,
  // even when there is no upload payload to send.
  if (scenario.scheme() == curl::fuzzer::proto::SCHEME_TELNET || scenario.has_upload()) {
    return true;
  }
  const std::size_t option_count = RuntimeOptionCount(scenario);
  for (std::size_t index = 0; index < option_count; ++index) {
    const auto& option = scenario.options(static_cast<int>(index));
    if (option.option_id() == curl::fuzzer::proto::CURLOPT_UPLOAD ||
        option.option_id() == curl::fuzzer::proto::CURLOPT_POST) {
      return true;
    }
  }
  return false;
}

/// Translate the mutation-friendly enum to curl's spelling. Restricting this
/// field to supported encoders spends cycles in encoder implementations rather
/// than repeatedly rediscovering the same invalid-string rejection.
const char* MimeEncoderName(curl::fuzzer::proto::MimeEncoder encoder) {
  switch (encoder) {
    case curl::fuzzer::proto::MIME_ENCODER_BINARY:
      return "binary";
    case curl::fuzzer::proto::MIME_ENCODER_8BIT:
      return "8bit";
    case curl::fuzzer::proto::MIME_ENCODER_7BIT:
      return "7bit";
    case curl::fuzzer::proto::MIME_ENCODER_BASE64:
      return "base64";
    case curl::fuzzer::proto::MIME_ENCODER_QUOTED_PRINTABLE:
      return "quoted-printable";
    case curl::fuzzer::proto::MIME_ENCODER_UNSPECIFIED:
    default:
      return nullptr;
  }
}

/// Append at most `limit` protobuf byte strings to a curl list. curl_slist_append
/// leaves the old head valid on allocation failure, so only replace the head
/// after a successful append and stop rather than burning the rest of the
/// iteration on allocations that are already failing.
template <typename RepeatedBytes>
CurlSlistPtr BuildStringList(const RepeatedBytes& values, std::size_t count_limit, std::size_t value_limit,
                             std::size_t* applied) {
  CurlSlistPtr list;
  std::string truncated;
  const std::size_t count = std::min<std::size_t>(count_limit, values.size());
  for (std::size_t i = 0; i < count; ++i) {
    const std::string& value = values.Get(static_cast<int>(i));
    curl_slist* appended = curl_slist_append(list.get(), BoundedCString(value, value_limit, &truncated));
    if (appended == nullptr) {
      break;
    }
    // append retains the existing nodes and may return the same head. Release
    // before resetting so adopting the successful result cannot free them.
    (void)list.release();
    list.reset(appended);
    ++*applied;
  }
  return list;
}

/// Apply the metadata shared by top-level and nested protobuf part types. The
/// MIME API copies these strings, so temporary bounded buffers are sufficient;
/// only the MIME root itself needs to outlive the perform loop.
template <typename ProtoPart>
void ApplyPartMetadata(curl_mimepart* part, const ProtoPart& source, RequestBuildStats* stats) {
  // Reuse the rare compatibility-path allocation across all three fields;
  // ordinary postprocessed metadata never writes this scratch string.
  std::string truncated;
  if (!source.name().empty()) {
    (void)curl_mime_name(part, BoundedCString(source.name(), scenario_limits::kMaxMetadataBytes, &truncated));
  }
  if (!source.filename().empty()) {
    (void)curl_mime_filename(part, BoundedCString(source.filename(), scenario_limits::kMaxMetadataBytes, &truncated));
  }
  if (!source.content_type().empty()) {
    (void)curl_mime_type(part, BoundedCString(source.content_type(), scenario_limits::kMaxMetadataBytes, &truncated));
  }
  if (const char* encoder = MimeEncoderName(source.encoder())) {
    (void)curl_mime_encoder(part, encoder);
  }

  std::size_t header_count = 0;
  CurlSlistPtr headers = BuildStringList(source.headers(), scenario_limits::kMaxMimeHeadersPerPart,
                                         scenario_limits::kMaxMetadataBytes, &header_count);
  if (headers != nullptr) {
    // take_ownership=1 is crucial: unlike the strings above, MIME retains the
    // list pointer. Once attached, the root curl_mime_free call recursively
    // releases it, including lists on nested parts.
    const CURLcode result = curl_mime_headers(part, headers.get(), 1);
    if (result == CURLE_OK) {
      (void)headers.release();
      stats->mime_headers += header_count;
    }
  }
}

/// Copy bounded binary data into a MIME part. curl_mime_data accepts an
/// explicit size, so embedded NUL bytes remain fuzzable here unlike in the
/// metadata and header APIs.
void ApplyPartData(curl_mimepart* part, const std::string& data) {
  const std::size_t size = std::min(data.size(), scenario_limits::kMaxMimeDataBytes);
  const char* bytes = data.empty() ? "" : data.data();
  (void)curl_mime_data(part, bytes, size);
}

/// Materialize one compact repeated source without allowing the protobuf's
/// uint32 count or a collection of MIME parts to amplify into unbounded work.
/// Division establishes the maximum count before multiplication, so this is
/// safe even when size_t is narrower than uint32_t.
void ApplyGeneratedPartData(curl_mimepart* part, const curl::fuzzer::proto::GeneratedBytes& source,
                            std::size_t* remaining_generated_bytes, RequestBuildStats* stats) {
  const std::size_t pattern_size = std::min(source.pattern().size(), scenario_limits::kMaxGeneratedMimePatternBytes);
  if (pattern_size == 0 || *remaining_generated_bytes == 0) {
    (void)curl_mime_data(part, "", 0);
    return;
  }

  const std::size_t max_repeat_count = *remaining_generated_bytes / pattern_size;
  const std::size_t repeat_count =
      std::min<std::size_t>(static_cast<std::size_t>(source.repeat_count()), max_repeat_count);
  const std::size_t materialized_size = repeat_count * pattern_size;

  std::string materialized(materialized_size, '\0');
  for (std::size_t offset = 0; offset < materialized_size; offset += pattern_size) {
    std::copy_n(source.pattern().data(), pattern_size, materialized.data() + offset);
  }
  const char* bytes = materialized.empty() ? "" : materialized.data();
  if (curl_mime_data(part, bytes, materialized.size()) == CURLE_OK) {
    stats->generated_mime_bytes += materialized.size();
  }
  *remaining_generated_bytes -= materialized.size();
}

/// Populate the fixed-depth child body and debit the shared total-part budget.
/// Returning an empty MIME object when the child list is empty is intentional:
/// curl's empty multipart serialization is useful coverage and remains cheap.
void PopulateSubparts(curl_mime* mime, const curl::fuzzer::proto::MimeSubparts& source, std::size_t* remaining_parts,
                      std::size_t* remaining_generated_bytes, RequestBuildStats* stats) {
  const std::size_t count = std::min<std::size_t>(scenario_limits::kMaxNestedMimeParts, source.parts_size());
  for (std::size_t i = 0; i < count && *remaining_parts != 0; ++i) {
    curl_mimepart* part = curl_mime_addpart(mime);
    if (part == nullptr) {
      break;
    }
    --*remaining_parts;
    ++stats->mime_parts;
    const auto& proto_part = source.parts(static_cast<int>(i));
    ApplyPartMetadata(part, proto_part, stats);
    if (proto_part.content_case() == curl::fuzzer::proto::MimeDataPart::kGeneratedData) {
      ApplyGeneratedPartData(part, proto_part.generated_data(), remaining_generated_bytes, stats);
    } else {
      // Preserve the historical leaf behavior: an absent source is applied as
      // empty data just like an explicitly empty field 2.
      ApplyPartData(part, proto_part.data());
    }
  }
}

/// Construct the top MIME tree. curl_mime_subparts transfers ownership only
/// on success, so failed attachments are freed immediately while successful
/// ones are left for the top-level root to release recursively.
CurlMimePtr BuildMimePost(CURL* easy, const curl::fuzzer::proto::MimePost& source, UploadScriptState* upload_state,
                          RequestBuildStats* stats) {
  CurlMimePtr mime(curl_mime_init(easy));
  if (mime == nullptr) {
    return nullptr;
  }

  std::size_t remaining_parts = scenario_limits::kMaxTotalMimeParts;
  std::size_t remaining_generated_bytes = scenario_limits::kMaxGeneratedMimeDataBytes;
  const std::size_t count = std::min<std::size_t>(scenario_limits::kMaxTopLevelMimeParts, source.parts_size());
  for (std::size_t i = 0; i < count && remaining_parts != 0; ++i) {
    curl_mimepart* part = curl_mime_addpart(mime.get());
    if (part == nullptr) {
      break;
    }
    --remaining_parts;
    ++stats->mime_parts;
    const auto& proto_part = source.parts(static_cast<int>(i));
    ApplyPartMetadata(part, proto_part, stats);

    switch (proto_part.content_case()) {
      case curl::fuzzer::proto::MimePart::kData:
        ApplyPartData(part, proto_part.data());
        break;
      case curl::fuzzer::proto::MimePart::kGeneratedData:
        ApplyGeneratedPartData(part, proto_part.generated_data(), &remaining_generated_bytes, stats);
        break;
      case curl::fuzzer::proto::MimePart::kUploadCallback:
        if (upload_state != nullptr && upload_state->InstallAsMimePart(part) == CURLE_OK) {
          ++stats->mime_callback_parts;
        }
        break;
      case curl::fuzzer::proto::MimePart::kSubparts: {
        CurlMimePtr subparts(curl_mime_init(easy));
        if (subparts == nullptr) {
          break;
        }
        PopulateSubparts(subparts.get(), proto_part.subparts(), &remaining_parts, &remaining_generated_bytes, stats);
        if (curl_mime_subparts(part, subparts.get()) == CURLE_OK) {
          (void)subparts.release();
        }
        break;
      }
      case curl::fuzzer::proto::MimePart::CONTENT_NOT_SET:
      default:
        break;
    }
  }
  return mime;
}

}  // namespace

/// Borrow and cap a scripted upload source before libcurl receives a userdata
/// pointer. When Scenario.upload is absent, non-TELNET schemes synthesize the
/// historical 16 KiB `U` stream without allocating it, while TELNET reports
/// immediate EOF so merely selecting the protocol cannot inject unsolicited
/// terminal input. Borrowing avoids duplicating every fuzzed body before curl
/// can read it; `scenario` must remain alive and unmodified until this state is
/// destroyed.
/// @param scenario Source and lifetime owner of callback bytes and outcomes.
UploadScriptState::UploadScriptState(const curl::fuzzer::proto::Scenario& scenario)
    : data_(),
      read_step_count_(0),
      total_size_(scenario.scheme() == curl::fuzzer::proto::SCHEME_TELNET ? 0 : scenario_limits::kMaxUploadBytes),
      max_read_size_(scenario.scheme() == curl::fuzzer::proto::SCHEME_TELNET ? scenario_limits::kMaxTelnetUploadReadSize
                                                                             : scenario_limits::kMaxUploadReadSize),
      offset_(0),
      next_read_size_(0),
      seek_calls_(0),
      terminal_(curl::fuzzer::proto::UPLOAD_TERMINAL_EOF),
      seek_result_(curl::fuzzer::proto::UPLOAD_SEEK_CANTSEEK),
      before_read_callback_(nullptr),
      before_read_userdata_(nullptr),
      scripted_(scenario.has_upload()) {
  if (!scripted_) {
    return;
  }

  const auto& upload = scenario.upload();
  const std::size_t data_limit = scenario.scheme() == curl::fuzzer::proto::SCHEME_TELNET
                                     ? scenario_limits::kMaxTelnetUploadBytes
                                     : scenario_limits::kMaxUploadBytes;
  const std::size_t data_size = std::min(upload.data().size(), data_limit);
  data_ = std::string_view(upload.data().data(), data_size);
  total_size_ = data_.size();
  terminal_ = upload.terminal();
  if (scenario.scheme() != curl::fuzzer::proto::SCHEME_TELNET &&
      terminal_ == curl::fuzzer::proto::UPLOAD_TERMINAL_PAUSE) {
    // Event-driven protocols need an external resume source. Interpret this
    // TELNET-specific outcome as EOF before curl can retain a paused transfer.
    terminal_ = curl::fuzzer::proto::UPLOAD_TERMINAL_EOF;
  }
  seek_result_ = upload.seek_result();

  const std::size_t read_step_limit = scenario.scheme() == curl::fuzzer::proto::SCHEME_TELNET
                                          ? scenario_limits::kMaxTelnetUploadReadSteps
                                          : scenario_limits::kMaxUploadReadSteps;
  read_step_count_ = std::min<std::size_t>(upload.read_sizes_size(), read_step_limit);
  for (std::size_t i = 0; i < read_step_count_; ++i) {
    const std::size_t requested = upload.read_sizes(static_cast<int>(i));
    // Zero-as-one ensures every retained step makes progress; see the schema
    // comment for why zero is not treated as an early EOF sentinel.
    read_sizes_[i] = std::max<std::size_t>(1, std::min(requested, max_read_size_));
  }
}

/// Copy the next bounded chunk and advance the cursor, using either the explicit
/// payload or the allocation-free fallback. Terminal outcomes are emitted only
/// after all data is consumed so a mutation can independently control
/// fragmentation and completion policy. Public so focused tests can validate
/// callback semantics without relying on HTTP timing.
/// @param buffer Destination supplied by curl.
/// @param capacity Writable bytes in `buffer`.
/// @return Bytes copied, zero for EOF, CURL_READFUNC_ABORT, or the TELNET-
///         only CURL_READFUNC_PAUSE outcome.
std::size_t UploadScriptState::Read(char* buffer, std::size_t capacity) {
  // TELNET can produce negotiation replies while one curl_multi_perform call
  // owns the thread. Empty them before returning more callback bytes;
  // otherwise send_telnet_data() can consume the whole bounded transfer
  // timeout while the synchronous path waits for socket capacity.
  if (before_read_callback_ != nullptr) {
    before_read_callback_(before_read_userdata_);
  }
  if (offset_ >= total_size_) {
    switch (terminal_) {
      case curl::fuzzer::proto::UPLOAD_TERMINAL_ABORT:
        return CURL_READFUNC_ABORT;
      case curl::fuzzer::proto::UPLOAD_TERMINAL_PAUSE:
        return CURL_READFUNC_PAUSE;
      case curl::fuzzer::proto::UPLOAD_TERMINAL_EOF:
      default:
        return 0;
    }
  }
  if (buffer == nullptr || capacity == 0) {
    return 0;
  }

  std::size_t chunk_limit = std::min(capacity, max_read_size_);
  if (next_read_size_ < read_step_count_) {
    chunk_limit = std::min(chunk_limit, read_sizes_[next_read_size_++]);
  }
  const std::size_t count = std::min(chunk_limit, total_size_ - offset_);
  if (scripted_) {
    std::memcpy(buffer, data_.data() + offset_, count);
  } else {
    std::memset(buffer, 'U', count);
  }
  offset_ += count;
  return count;
}

/// Apply the configured seek outcome and, for OK, move the bounded cursor.
/// Successful seeks restart the short-read sequence so retries replay the same
/// callback fragmentation deterministically. Explicit range checks model only
/// seeks curl can meaningfully request from a bounded memory source, avoiding
/// signed overflow or a mutation wrapping into an in-bounds cursor.
/// @param requested_offset Offset interpreted relative to `origin`.
/// @param origin One of SEEK_SET, SEEK_CUR, or SEEK_END.
/// @return A CURL_SEEKFUNC_* result.
int UploadScriptState::Seek(curl_off_t requested_offset, int origin) {
  ++seek_calls_;
  switch (seek_result_) {
    case curl::fuzzer::proto::UPLOAD_SEEK_CANTSEEK:
      return CURL_SEEKFUNC_CANTSEEK;
    case curl::fuzzer::proto::UPLOAD_SEEK_FAIL:
      return CURL_SEEKFUNC_FAIL;
    case curl::fuzzer::proto::UPLOAD_SEEK_OK:
      break;
    default:
      return CURL_SEEKFUNC_CANTSEEK;
  }

  const curl_off_t current = static_cast<curl_off_t>(offset_);
  const curl_off_t end = static_cast<curl_off_t>(total_size_);
  curl_off_t base = 0;
  switch (origin) {
    case SEEK_SET:
      base = 0;
      break;
    case SEEK_CUR:
      base = current;
      break;
    case SEEK_END:
      base = end;
      break;
    default:
      return CURL_SEEKFUNC_FAIL;
  }

  // Both base and end are at most 16 KiB. Comparing the requested delta to
  // these small bounds before addition handles even CURL_OFF_T_MIN safely.
  if (requested_offset < -base || requested_offset > end - base) {
    return CURL_SEEKFUNC_FAIL;
  }
  offset_ = static_cast<std::size_t>(base + requested_offset);
  next_read_size_ = 0;
  return CURL_SEEKFUNC_OK;
}

/// libcurl trampoline that protects multiplication of its two buffer-size
/// arguments before forwarding to Read(). Multiplication is normally benign
/// because curl uses size=1, but callbacks are an API boundary. Abort an
/// impossible overflowing pair: saturating to SIZE_MAX would let Read() copy
/// into a buffer whose real extent is unknown.
std::size_t UploadScriptState::ReadCallback(char* buffer, std::size_t size, std::size_t nitems, void* userdata) {
  if (userdata == nullptr || size == 0 || nitems == 0) {
    return 0;
  }
  const std::size_t max = std::numeric_limits<std::size_t>::max();
  if (nitems > max / size) {
    return CURL_READFUNC_ABORT;
  }
  return static_cast<UploadScriptState*>(userdata)->Read(buffer, size * nitems);
}

/// libcurl trampoline for the userdata-first seek callback signature. Keep the
/// C callback a type bridge so all outcome/cursor behaviour remains directly
/// unit-testable in Seek().
int UploadScriptState::SeekCallback(void* userdata, curl_off_t offset, int origin) {
  if (userdata == nullptr) {
    return CURL_SEEKFUNC_FAIL;
  }
  return static_cast<UploadScriptState*>(userdata)->Seek(offset, origin);
}

/// @return Number of bytes visible to the callback after caps.
std::size_t UploadScriptState::data_size() const { return total_size_; }

/// @return Number of retained per-read limits after caps.
std::size_t UploadScriptState::read_step_count() const { return read_step_count_; }

/// @return Current byte cursor, exposed for deterministic unit tests.
std::size_t UploadScriptState::offset() const { return offset_; }

/// @return Number of times libcurl asked the upload source to seek.
std::size_t UploadScriptState::seek_calls() const { return seek_calls_; }

/// @return Whether Scenario.upload was present instead of using fallback.
bool UploadScriptState::scripted() const { return scripted_; }

/// Install the same bounded read/seek cursor behind a public MIME callback
/// part. curl retains `this` until the MIME root is freed, so ScenarioRequestData
/// declares the root after the state and detaches it before either is released.
/// @param part MIME part owned by the caller's live root.
/// @return libcurl's setup result.
CURLcode UploadScriptState::InstallAsMimePart(curl_mimepart* part) {
  if (part == nullptr) {
    return CURLE_BAD_FUNCTION_ARGUMENT;
  }
  return curl_mime_data_cb(part, static_cast<curl_off_t>(total_size_), &UploadScriptState::ReadCallback,
                           &UploadScriptState::SeekCallback, nullptr, this);
}

/// Install a protocol hook without exposing the mutable cursor or curl's
/// retained callback userdata outside its owner.
void UploadScriptState::SetBeforeReadCallback(BeforeReadCallback callback, void* userdata) {
  before_read_callback_ = callback;
  before_read_userdata_ = userdata;
}

/// Construct and apply the protocol-specific pointer-valued fields in `scenario`
/// to `easy`. Setup errors are deliberately non-fatal: malformed or partially
/// allocated scenarios should still exercise whatever curl state was built.
/// `easy` must remain alive until this object is destroyed, because cleanup
/// first detaches the pointers from the handle and only then frees them.
/// @param easy Easy handle that will perform this scenario.
/// @param scenario Source headers/TELNET options, optional MIME body, and
///                 upload script.
/// @param apply_resolve_entries Whether to install the scenario's bounded
///        resolver mappings plus the mandatory loopback mapping.
ScenarioRequestData::ScenarioRequestData(CURL* easy, const curl::fuzzer::proto::Scenario& scenario,
                                         bool apply_resolve_entries)
    : easy_(easy),
      request_headers_(nullptr),
      resolve_entries_(nullptr),
      telnet_options_(nullptr),
      mail_rcpt_(nullptr),
      upload_state_(scenario),
      mime_post_(nullptr),
      upload_callbacks_installed_(false),
      resolve_entries_ready_(!apply_resolve_entries) {
  if (easy_ == nullptr) {
    return;
  }

  // Complete all allocating work before installing retained pointers. If a
  // C++ allocation throws, scoped owners unwind without leaving the easy
  // handle pointing into a partially constructed request-data object.
  bool resolve_entries_built = false;
  if (apply_resolve_entries) {
    resolve_entries_ = BuildStringList(scenario.resolve_entries(), scenario_limits::kMaxResolveEntries,
                                       scenario_limits::kMaxResolveEntryBytes, &stats_.resolve_entries);
    // This mapping is deliberately last: preceding wildcard or removal
    // mutations may exercise host-cache parsing, but cannot redirect the
    // canonical resolver-lane origin away from the in-process mock.
    curl_slist* appended = curl_slist_append(resolve_entries_.get(), "resolve.test:80:127.0.0.1");
    if (appended != nullptr) {
      (void)resolve_entries_.release();
      resolve_entries_.reset(appended);
      resolve_entries_built = true;
    }
  }

  // HTTP headers/MIME and TELNET options are mutually exclusive because only
  // the selected protocol can observe them. Avoid allocating protocol-inert
  // lists and trees in compatibility inputs that bypass target policy.
  if (scenario.scheme() == curl::fuzzer::proto::SCHEME_TELNET) {
    telnet_options_ = BuildStringList(scenario.telnet_options(), scenario_limits::kMaxTelnetOptions,
                                      scenario_limits::kMaxTelnetOptionBytes, &stats_.telnet_options);
  } else {
    request_headers_ = BuildStringList(scenario.request_headers(), scenario_limits::kMaxRequestHeaders,
                                       scenario_limits::kMaxMetadataBytes, &stats_.request_headers);
    if (scenario.has_mime_post()) {
      mime_post_ = BuildMimePost(easy_, scenario.mime_post(), &upload_state_, &stats_);
    }
  }

  if (scenario.scheme() == curl::fuzzer::proto::SCHEME_SMTP || scenario.scheme() == curl::fuzzer::proto::SCHEME_SMTPS ||
      !scenario.mail_rcpt().empty()) {
    // Recipient list entries borrow protobuf-owned storage only for the
    // duration of BuildStringList; curl_slist_append copies each address.
    mail_rcpt_ = BuildStringList(scenario.mail_rcpt(), scenario_limits::kMaxMailRecipients,
                                 scenario_limits::kMaxMailRecipientBytes, &stats_.mail_rcpt);
  }

  if (resolve_entries_built) {
    resolve_entries_ready_ = curl_easy_setopt(easy_, CURLOPT_RESOLVE, resolve_entries_.get()) == CURLE_OK;
  }

  if (NeedsUploadCallbacks(scenario)) {
    // Install a per-run memory source even when Scenario.upload is absent but
    // CURLOPT_UPLOAD or TELNET may request caller input. Non-TELNET schemes
    // retain the historical fallback bytes; TELNET returns EOF. Either result
    // replaces stdin and cannot block OSS-Fuzz. The state remains scoped to
    // the complete drive so retries cannot share a cursor across iterations.
    upload_callbacks_installed_ = true;
    (void)curl_easy_setopt(easy_, CURLOPT_READFUNCTION, &UploadScriptState::ReadCallback);
    (void)curl_easy_setopt(easy_, CURLOPT_READDATA, &upload_state_);
    (void)curl_easy_setopt(easy_, CURLOPT_SEEKFUNCTION, &UploadScriptState::SeekCallback);
    (void)curl_easy_setopt(easy_, CURLOPT_SEEKDATA, &upload_state_);
  }

  if (telnet_options_ != nullptr) {
    (void)curl_easy_setopt(easy_, CURLOPT_TELNETOPTIONS, telnet_options_.get());
  }
  if (mail_rcpt_ != nullptr) {
    (void)curl_easy_setopt(easy_, CURLOPT_MAIL_RCPT, mail_rcpt_.get());
  }
  if (request_headers_ != nullptr) {
    (void)curl_easy_setopt(easy_, CURLOPT_HTTPHEADER, request_headers_.get());
  }
  if (mime_post_ != nullptr) {
    (void)curl_easy_setopt(easy_, CURLOPT_MIMEPOST, mime_post_.get());
  }
}

/// Detach pointer options/callbacks while the easy handle is valid, then release
/// request allocations. libcurl does not copy headers, MIME roots, or callback
/// userdata, so releasing any one before the mock drive ends would create a
/// use-after-free; relying on easy cleanup to own header/MIME allocations would
/// instead leak iterations.
ScenarioRequestData::~ScenarioRequestData() {
  if (easy_ != nullptr) {
    // Clear callbacks before their userdata member is destroyed. There is no
    // perform in this destructor, but making the handle non-dangling keeps the
    // ownership rule robust if cleanup later gains diagnostics or getinfo.
    if (upload_callbacks_installed_) {
      (void)curl_easy_setopt(easy_, CURLOPT_SEEKFUNCTION, nullptr);
      (void)curl_easy_setopt(easy_, CURLOPT_SEEKDATA, nullptr);
      (void)curl_easy_setopt(easy_, CURLOPT_READFUNCTION, nullptr);
      (void)curl_easy_setopt(easy_, CURLOPT_READDATA, nullptr);
    }
    if (mime_post_ != nullptr) {
      (void)curl_easy_setopt(easy_, CURLOPT_MIMEPOST, nullptr);
    }
    if (request_headers_ != nullptr) {
      (void)curl_easy_setopt(easy_, CURLOPT_HTTPHEADER, nullptr);
    }
    if (resolve_entries_ != nullptr) {
      (void)curl_easy_setopt(easy_, CURLOPT_RESOLVE, nullptr);
    }
    if (telnet_options_ != nullptr) {
      (void)curl_easy_setopt(easy_, CURLOPT_TELNETOPTIONS, nullptr);
    }
    if (mail_rcpt_ != nullptr) {
      (void)curl_easy_setopt(easy_, CURLOPT_MAIL_RCPT, nullptr);
    }
  }
  // Callback MIME parts retain upload_state_ as userdata. Release the root
  // explicitly while that state is still live instead of relying only on
  // reverse member destruction order.
  mime_post_.reset();
}

/// Return resource counts after caps and allocation failures were applied,
/// without exposing or transferring the owned curl pointers themselves.
/// @return Immutable construction statistics.
const RequestBuildStats& ScenarioRequestData::stats() const { return stats_; }

/// Return the callback state retained for the complete drive. This is mainly
/// useful to ownership tests; the runner itself lets libcurl mutate it.
/// @return Immutable upload state.
const UploadScriptState& ScenarioRequestData::upload_state() const { return upload_state_; }

/// Return whether this scenario needed raw upload callbacks. Exposing the
/// decision lets ownership tests ensure ordinary requests avoid redundant
/// setopt/teardown work without exposing either userdata pointer.
/// @return True when read and seek callbacks were attached to the handle.
bool ScenarioRequestData::upload_callbacks_installed() const { return upload_callbacks_installed_; }

/// Return whether resolver-only slist construction installed its mandatory
/// final loopback mapping. Ordinary lanes always report true.
/// @return True when the resolver mapping is ready for the transfer.
bool ScenarioRequestData::resolve_entries_ready() const { return resolve_entries_ready_; }

/// Arrange protocol-specific work immediately before every upload read.
/// This is intentionally a narrow callback seam rather than exposing curl's
/// retained READFUNCTION userdata or the mutable upload cursor.
/// @param callback Function to invoke, or nullptr to clear the hook.
/// @param userdata Borrowed pointer passed to `callback`.
void ScenarioRequestData::SetBeforeUploadReadCallback(UploadScriptState::BeforeReadCallback callback, void* userdata) {
  upload_state_.SetBeforeReadCallback(callback, userdata);
}

}  // namespace proto_fuzzer

Coverage Report

Created: 2026-10-28 07:17