Coverage Report

Created: 2025-10-13 06:32

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/h2/fuzz/fuzz_targets/fuzz_client.rs
Line
Count
Source
1
#![no_main]
2
use h2_support::prelude::*;
3
use libfuzzer_sys::{arbitrary::Arbitrary, fuzz_target};
4
5
#[derive(Debug, Arbitrary)]
6
struct HttpSpec {
7
    uri: Vec<u8>,
8
    header_name: Vec<u8>,
9
    header_value: Vec<u8>,
10
}
11
12
4.82k
async fn fuzz_entry(inp: HttpSpec) {
13
4.82k
    if let Ok(req) = Request::builder()
14
4.82k
        .uri(&inp.uri[..])
15
4.82k
        .header(&inp.header_name[..], &inp.header_value[..])
16
4.82k
        .body(())
17
    {
18
669
        let (io, mut _srv) = mock::new();
19
669
        let (mut client, _h2) = client::Builder::new()
20
669
            .handshake::<_, Bytes>(io)
21
669
            .await
22
669
            .unwrap();
23
24
        // this could still trigger a user error:
25
        // - if the uri isn't absolute
26
        // - if the header name isn't allowed in http2 (like connection)
27
669
        let _ = client.send_request(req, true);
28
4.15k
    }
29
4.82k
}
30
31
fuzz_target!(|inp: HttpSpec| {
32
    let rt = tokio::runtime::Runtime::new().unwrap();
33
    rt.block_on(fuzz_entry(inp));
34
});