Coverage Report

Created: 2026-05-23 06:22

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/ws_fuzzer.cc
Line
Count
Source
1
/* Copyright 2026 Google LLC
2
Licensed under the Apache License, Version 2.0 (the "License");
3
you may not use this file except in compliance with the License.
4
You may obtain a copy of the License at
5
      http://www.apache.org/licenses/LICENSE-2.0
6
Unless required by applicable law or agreed to in writing, software
7
distributed under the License is distributed on an "AS IS" BASIS,
8
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9
See the License for the specific language governing permissions and
10
limitations under the License.
11
*/
12
13
#include <stddef.h>
14
#include <stdint.h>
15
#include <stdlib.h>
16
#include <string.h>
17
#include <sys/socket.h>
18
19
extern "C" {
20
#include "event2/event.h"
21
#include "event2/buffer.h"
22
#include "event2/bufferevent.h"
23
#include "event2/http.h"
24
#include "event2/http_struct.h"
25
#include "event2/ws.h"
26
#include "http-internal.h"
27
}
28
29
25.2k
static void on_msg(struct evws_connection *ws, int type, const uint8_t *data, size_t len, void *arg) {
30
25.2k
}
31
32
976
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
33
976
    struct event_base *base = event_base_new();
34
976
    if (!base) return 0;
35
36
976
    struct evhttp *http = evhttp_new(base);
37
976
    struct bufferevent *bev[2];
38
976
    if (bufferevent_pair_new(base, 0, bev) != 0) {
39
0
        evhttp_free(http);
40
0
        event_base_free(base);
41
0
        return 0;
42
0
    }
43
44
976
    struct evhttp_connection *evcon = evhttp_connection_base_bufferevent_new(base, NULL, bev[0], "127.0.0.1", 80);
45
    
46
    /* Associate evcon with http to satisfy evws_new_session requirements */
47
976
    evcon->http_server = http;
48
976
    TAILQ_INSERT_TAIL(&http->connections, evcon, next);
49
50
976
    struct evhttp_request *req = evhttp_request_new(NULL, NULL);
51
976
    if (!req) {
52
0
        evhttp_connection_free(evcon);
53
0
        evhttp_free(http);
54
0
        bufferevent_free(bev[1]);
55
0
        return 0;
56
0
    }
57
976
    req->evcon = evcon;
58
976
    req->kind = EVHTTP_REQUEST;
59
976
    TAILQ_INSERT_TAIL(&evcon->requests, req, next);
60
61
    /* Add required headers for WebSocket handshake */
62
976
    struct evkeyvalq *in_hdrs = evhttp_request_get_input_headers(req);
63
976
    evhttp_add_header(in_hdrs, "Upgrade", "websocket");
64
976
    evhttp_add_header(in_hdrs, "Connection", "Upgrade");
65
976
    evhttp_add_header(in_hdrs, "Sec-WebSocket-Key", "dGhlIHNhbXBsZSBub25jZQ==");
66
67
    /* evws_new_session takes 4 arguments in this version of libevent */
68
976
    struct evws_connection *ws = evws_new_session(req, on_msg, NULL, 0);
69
976
    if (ws) {
70
976
        struct evbuffer *output = bufferevent_get_output(bev[1]);
71
976
        evbuffer_add(output, data, size);
72
        
73
976
        event_base_loop(base, EVLOOP_NONBLOCK);
74
        
75
976
        evws_connection_free(ws);
76
976
    }
77
976
    evhttp_free(http);
78
976
    bufferevent_free(bev[1]);
79
976
    event_base_free(base);
80
81
976
    return 0;
82
976
}