Coverage Report

Created: 2025-10-10 07:05

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/h2/fuzz/fuzz_targets/fuzz_client.rs
Line
Count
Source
1
#![no_main]
2
use h2_support::prelude::*;
3
use libfuzzer_sys::{arbitrary::Arbitrary, fuzz_target};
4
5
#[derive(Debug, Arbitrary)]
6
struct HttpSpec {
7
    uri: Vec<u8>,
8
    header_name: Vec<u8>,
9
    header_value: Vec<u8>,
10
}
11
12
4.69k
async fn fuzz_entry(inp: HttpSpec) {
13
4.69k
    if let Ok(req) = Request::builder()
14
4.69k
        .uri(&inp.uri[..])
15
4.69k
        .header(&inp.header_name[..], &inp.header_value[..])
16
4.69k
        .body(())
17
    {
18
645
        let (io, mut _srv) = mock::new();
19
645
        let (mut client, _h2) = client::Builder::new()
20
645
            .handshake::<_, Bytes>(io)
21
645
            .await
22
645
            .unwrap();
23
24
        // this could still trigger a user error:
25
        // - if the uri isn't absolute
26
        // - if the header name isn't allowed in http2 (like connection)
27
645
        let _ = client.send_request(req, true);
28
4.04k
    }
29
4.69k
}
30
31
fuzz_target!(|inp: HttpSpec| {
32
    let rt = tokio::runtime::Runtime::new().unwrap();
33
    rt.block_on(fuzz_entry(inp));
34
});