/src/fuzz_response.cpp

Source (jump to first uncovered line)
// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
////////////////////////////////////////////////////////////////////////////////
#include <stdint.h>
#include <stddef.h>
#include <unistd.h>
#include <sys/types.h>

#include <vector>
#include <algorithm>

#include "mhd_helper.h"

static void request_ended_cb(void *cls,
                             const struct MHD_RequestEndedData *data,
                             void *request_app_context) {
  // Do nothing
}

static enum MHD_HTTP_StatusCode pick_status_code(FuzzedDataProvider &fdp) {
  // Randomly pick a valid or invalid HTTP response status code
  return fdp.ConsumeBool()
      ? fdp.PickValueInArray({
          MHD_HTTP_STATUS_OK, MHD_HTTP_STATUS_CREATED, MHD_HTTP_STATUS_NO_CONTENT,
          MHD_HTTP_STATUS_PARTIAL_CONTENT, MHD_HTTP_STATUS_BAD_REQUEST,
          MHD_HTTP_STATUS_UNAUTHORIZED, MHD_HTTP_STATUS_FORBIDDEN,
          MHD_HTTP_STATUS_NOT_FOUND, MHD_HTTP_STATUS_INTERNAL_SERVER_ERROR })
      : (enum MHD_HTTP_StatusCode)(fdp.ConsumeIntegralInRange<int>(0, 999));
}

static MHD_Response* create_response(FuzzedDataProvider &fdp,
                                     enum MHD_HTTP_StatusCode sc) {
  struct MHD_Response* r = nullptr;

  // Generate random response body
  const size_t body_len = fdp.ConsumeIntegralInRange<size_t>(
      0, std::min<size_t>(fdp.remaining_bytes(), 8192));
  std::string body = fdp.ConsumeBytesAsString(body_len);


  // Randomly select which constructing function to use for respone object creation
  enum CtorKind {
    EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE
  };
  CtorKind ctor = fdp.PickValueInArray<CtorKind>(
      {EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE});

  switch (ctor) {
    default:
    case EMPTY: {
      // Create empty response
      r = MHD_response_from_empty(sc);
      break;
    }
    case BUF_STATIC: {
      // Create response with random body and static buffer status
      r = MHD_response_from_buffer_static(sc, body.size(), body.c_str());
      break;
    }
    case BUF_COPY: {
      // Create response with random body and copy buffer in
      r = MHD_response_from_buffer_copy(sc, body.size(), body.data());
      break;
    }
    case IOVEC: {
      // Create response from random IO vector
      unsigned cnt = fdp.ConsumeIntegralInRange<unsigned>(0, 6);
      std::vector<MHD_IoVec> iov(cnt);
      std::vector<std::string> chunks; chunks.reserve(cnt);
      for (unsigned i=0;i<cnt;i++) {
        chunks.push_back(fdp.ConsumeBytesAsString(
                           fdp.ConsumeIntegralInRange<size_t>(0, 1024)));
        iov[i].iov_base = chunks.back().data();
        iov[i].iov_len  = chunks.back().size();
      }
      r = MHD_response_from_iovec(sc, cnt ? cnt : 0, cnt ? iov.data() : nullptr, nullptr, nullptr);
      break;
    }
    case FROM_FD: {
      // Create response from file with random data
      char path[] = "/tmp/mhdrespXXXXXX";
      int fd = mkstemp(path);
      if (fd >= 0) {
        unlink(path);
        if (!body.empty()) (void) ::write(fd, body.data(), body.size());
        uint64_t sz = (uint64_t)body.size();
        uint64_t off = 0;
        if (fdp.ConsumeBool()) {
          off = std::min<uint64_t>(sz, fdp.ConsumeIntegral<uint64_t>() % (sz + 1));
        }
        uint64_t len = (sz > off) ? (fdp.ConsumeIntegral<uint64_t>() % (sz - off + 1)) : 0;
        r = MHD_response_from_fd(sc, fd, off, len);
        if (!r) {
          close(fd);
        }
      }
      break;
    }
    case FROM_PIPE: {
      // Create response by piping in random data
      int pfd[2];
      if (0 == pipe(pfd)) {
        std::string pbytes = fdp.ConsumeBytesAsString(
                               fdp.ConsumeIntegralInRange<size_t>(0, 2048));
        if (!pbytes.empty()) {
          ::write(pfd[1], pbytes.data(), pbytes.size());
        }
        close(pfd[1]);
        r = MHD_response_from_pipe(sc, pfd[0]);
        if (!r) {
          close(pfd[0]);
        }
      }
      break;
    }
  }

  return r;
}

static void add_headers(FuzzedDataProvider &fdp, MHD_Response *r) {
  const char* ct = fdp.ConsumeBool() ? "text/plain" : "application/octet-stream";
  MHD_response_add_header(r, "Content-Type", ct);

  // Add random standard headers
  size_t num_headers = fdp.ConsumeIntegralInRange<size_t>(0, 10);
  for (size_t i = 0; i < num_headers; i++) {
    std::string name = safe_ascii(fdp.ConsumeRandomLengthString(20), false);
    std::string val  = safe_ascii(fdp.ConsumeRandomLengthString(60), true);
    MHD_response_add_header(r, name.c_str(), val.c_str());
  }

  // Add random predefined header
  enum MHD_PredefinedHeader which =
    fdp.PickValueInArray<enum MHD_PredefinedHeader>(
      { MHD_PREDEF_ACCEPT_CHARSET, MHD_PREDEF_ACCEPT_LANGUAGE });
  std::string value = safe_ascii(fdp.ConsumeRandomLengthString(32));
  MHD_response_add_predef_header(r, which, value.c_str());
}

static void randomise_response_options(FuzzedDataProvider &fdp, MHD_Response *r) {
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_REUSABLE(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_HEAD_ONLY_RESPONSE(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_CHUNKED_ENC(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_CONN_CLOSE(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_HTTP_1_0_SERVER(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_HTTP_1_0_COMPATIBLE_STRICT(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_INSANITY_HEADER_CONTENT_LENGTH(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_TERMINATION_CALLBACK(&request_ended_cb, nullptr);
    MHD_response_set_option(r, &o);
  }
}

static void add_auth(FuzzedDataProvider &fdp, MHD_Response *r,
                     enum MHD_HTTP_StatusCode sc) {
  if (sc == MHD_HTTP_STATUS_UNAUTHORIZED) {
    // Randomly add different challenge under 401 status code
    if (fdp.ConsumeBool()) {
      // Use digest challenge
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
      if (fdp.ConsumeBool()) {
        std::string drealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
        const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
        const char* domain = fdp.ConsumeBool() ? "/a /b"  : nullptr;
        enum MHD_DigestAuthMultiQOP mqop =
          fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
        enum MHD_DigestAuthMultiAlgo malgo =
          fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
        MHD_response_add_auth_digest_challenge(
            r, drealm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
            mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
      }
    } else {
      // Use basic challenge
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
      const char* domain = fdp.ConsumeBool() ? "/a /b"  : nullptr;
      enum MHD_DigestAuthMultiQOP mqop =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
      enum MHD_DigestAuthMultiAlgo malgo =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
      MHD_response_add_auth_digest_challenge(
          r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
          mqop, malgo, ToMhdBool(fdp.ConsumeBool()),
          ToMhdBool(fdp.ConsumeBool()));
      if (fdp.ConsumeBool()) {
        std::string brealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
        MHD_response_add_auth_basic_challenge(r, brealm.c_str(), ToMhdBool(fdp.ConsumeBool()));
      }
    }
  } else {
    // For all other status code, randomly determine if challenges are added

    // Randomly choose if basic challenge is used or not
    if (fdp.ConsumeBool()) {
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
    }

    // Randomly choose if disgest challenge is used or not
    if (fdp.ConsumeBool()) {
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
      const char* domain = fdp.ConsumeBool() ? "/a /b"  : nullptr;
      enum MHD_DigestAuthMultiQOP mqop =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
      enum MHD_DigestAuthMultiAlgo malgo =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
      MHD_response_add_auth_digest_challenge(
          r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
          mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
    }
  }
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  if (size == 0) {
    return 0;
  }
  FuzzedDataProvider fdp(data, size);

  // Pick a random response status code
  enum MHD_HTTP_StatusCode sc = pick_status_code(fdp);

  // Create a random response object
  struct MHD_Response* r = create_response(fdp, sc);
  if (!r) {
    return 0;
  }

  // Add random headers into the response object
  add_headers(fdp, r);

  // Set random options for the response object
  randomise_response_options(fdp, r);

  // Add authentication challenges to response
  add_auth(fdp, r, sc);

  // Fuzz additional targets on response status
  MHD_HTTP_status_code_to_string(sc);
  MHD_status_code_to_string((enum MHD_StatusCode)sc);

  // Destory the response object
  MHD_response_destroy(r);
  return 0;
}

Coverage Report

Created: 2025-08-24 06:26

Line	Count	Source (jump to first uncovered line)
1		// Copyright 2025 Google LLC
2		//
3		// Licensed under the Apache License, Version 2.0 (the "License");
4		// you may not use this file except in compliance with the License.
5		// You may obtain a copy of the License at
6		//
7		// http://www.apache.org/licenses/LICENSE-2.0
8		//
9		// Unless required by applicable law or agreed to in writing, software
10		// distributed under the License is distributed on an "AS IS" BASIS,
11		// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12		// See the License for the specific language governing permissions and
13		// limitations under the License.
14		//
15		////////////////////////////////////////////////////////////////////////////////
16		#include <stdint.h>
17		#include <stddef.h>
18		#include <unistd.h>
19		#include <sys/types.h>
20
21		#include <vector>
22		#include <algorithm>
23
24		#include "mhd_helper.h"
25
26		static void request_ended_cb(void *cls,
27		const struct MHD_RequestEndedData *data,
28	0	void *request_app_context) {
29		// Do nothing
30	0	}
31
32	1.40k	static enum MHD_HTTP_StatusCode pick_status_code(FuzzedDataProvider &fdp) {
33		// Randomly pick a valid or invalid HTTP response status code
34	1.40k	return fdp.ConsumeBool()
35	1.40k	? fdp.PickValueInArray({
36	1.03k	MHD_HTTP_STATUS_OK, MHD_HTTP_STATUS_CREATED, MHD_HTTP_STATUS_NO_CONTENT,
37	1.03k	MHD_HTTP_STATUS_PARTIAL_CONTENT, MHD_HTTP_STATUS_BAD_REQUEST,
38	1.03k	MHD_HTTP_STATUS_UNAUTHORIZED, MHD_HTTP_STATUS_FORBIDDEN,
39	1.03k	MHD_HTTP_STATUS_NOT_FOUND, MHD_HTTP_STATUS_INTERNAL_SERVER_ERROR })
40	1.40k	: (enum MHD_HTTP_StatusCode)(fdp.ConsumeIntegralInRange<int>(0, 999));
41	1.40k	}
42
43		static MHD_Response* create_response(FuzzedDataProvider &fdp,
44	1.40k	enum MHD_HTTP_StatusCode sc) {
45	1.40k	struct MHD_Response* r = nullptr;
46
47		// Generate random response body
48	1.40k	const size_t body_len = fdp.ConsumeIntegralInRange<size_t>(
49	1.40k	0, std::min<size_t>(fdp.remaining_bytes(), 8192));
50	1.40k	std::string body = fdp.ConsumeBytesAsString(body_len);
51
52
53		// Randomly select which constructing function to use for respone object creation
54	1.40k	enum CtorKind {
55	1.40k	EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE
56	1.40k	};
57	1.40k	CtorKind ctor = fdp.PickValueInArray<CtorKind>(
58	1.40k	{EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE});
59
60	1.40k	switch (ctor) {
61	0	default:
62	536	case EMPTY: {
63		// Create empty response
64	536	r = MHD_response_from_empty(sc);
65	536	break;
66	0	}
67	213	case BUF_STATIC: {
68		// Create response with random body and static buffer status
69	213	r = MHD_response_from_buffer_static(sc, body.size(), body.c_str());
70	213	break;
71	0	}
72	134	case BUF_COPY: {
73		// Create response with random body and copy buffer in
74	134	r = MHD_response_from_buffer_copy(sc, body.size(), body.data());
75	134	break;
76	0	}
77	217	case IOVEC: {
78		// Create response from random IO vector
79	217	unsigned cnt = fdp.ConsumeIntegralInRange<unsigned>(0, 6);
80	217	std::vector<MHD_IoVec> iov(cnt);
81	217	std::vector<std::string> chunks; chunks.reserve(cnt);
82	837	for (unsigned i=0;i<cnt;i++) {
83	620	chunks.push_back(fdp.ConsumeBytesAsString(
84	620	fdp.ConsumeIntegralInRange<size_t>(0, 1024)));
85	620	iov[i].iov_base = chunks.back().data();
86	620	iov[i].iov_len = chunks.back().size();
87	620	}
88	217	r = MHD_response_from_iovec(sc, cnt ? cnt : 0, cnt ? iov.data() : nullptr, nullptr, nullptr);
89	217	break;
90	0	}
91	184	case FROM_FD: {
92		// Create response from file with random data
93	184	char path[] = "/tmp/mhdrespXXXXXX";
94	184	int fd = mkstemp(path);
95	184	if (fd >= 0) {
96	184	unlink(path);
97	184	if (!body.empty()) (void) ::write(fd, body.data(), body.size());
98	184	uint64_t sz = (uint64_t)body.size();
99	184	uint64_t off = 0;
100	184	if (fdp.ConsumeBool()) {
101	90	off = std::min<uint64_t>(sz, fdp.ConsumeIntegral<uint64_t>() % (sz + 1));
102	90	}
103	184	uint64_t len = (sz > off) ? (fdp.ConsumeIntegral<uint64_t>() % (sz - off + 1)) : 0;
104	184	r = MHD_response_from_fd(sc, fd, off, len);
105	184	if (!r) {
106	12	close(fd);
107	12	}
108	184	}
109	184	break;
110	0	}
111	123	case FROM_PIPE: {
112		// Create response by piping in random data
113	123	int pfd[2];
114	123	if (0 == pipe(pfd)) {
115	123	std::string pbytes = fdp.ConsumeBytesAsString(
116	123	fdp.ConsumeIntegralInRange<size_t>(0, 2048));
117	123	if (!pbytes.empty()) {
118	73	::write(pfd[1], pbytes.data(), pbytes.size());
119	73	}
120	123	close(pfd[1]);
121	123	r = MHD_response_from_pipe(sc, pfd[0]);
122	123	if (!r) {
123	13	close(pfd[0]);
124	13	}
125	123	}
126	123	break;
127	0	}
128	1.40k	}
129
130	1.40k	return r;
131	1.40k	}
132
133	1.32k	static void add_headers(FuzzedDataProvider &fdp, MHD_Response *r) {
134	1.32k	const char* ct = fdp.ConsumeBool() ? "text/plain" : "application/octet-stream";
135	1.32k	MHD_response_add_header(r, "Content-Type", ct);
136
137		// Add random standard headers
138	1.32k	size_t num_headers = fdp.ConsumeIntegralInRange<size_t>(0, 10);
139	3.86k	for (size_t i = 0; i < num_headers; i++) {
140	2.54k	std::string name = safe_ascii(fdp.ConsumeRandomLengthString(20), false);
141	2.54k	std::string val = safe_ascii(fdp.ConsumeRandomLengthString(60), true);
142	2.54k	MHD_response_add_header(r, name.c_str(), val.c_str());
143	2.54k	}
144
145		// Add random predefined header
146	1.32k	enum MHD_PredefinedHeader which =
147	1.32k	fdp.PickValueInArray<enum MHD_PredefinedHeader>(
148	1.32k	{ MHD_PREDEF_ACCEPT_CHARSET, MHD_PREDEF_ACCEPT_LANGUAGE });
149	1.32k	std::string value = safe_ascii(fdp.ConsumeRandomLengthString(32));
150	1.32k	MHD_response_add_predef_header(r, which, value.c_str());
151	1.32k	}
152
153	1.32k	static void randomise_response_options(FuzzedDataProvider &fdp, MHD_Response *r) {
154	1.32k	if (fdp.ConsumeBool()) {
155	278	auto o = MHD_R_OPTION_REUSABLE(ToMhdBool(fdp.ConsumeBool()));
156	278	MHD_response_set_option(r, &o);
157	278	}
158	1.32k	if (fdp.ConsumeBool()) {
159	235	auto o = MHD_R_OPTION_HEAD_ONLY_RESPONSE(ToMhdBool(fdp.ConsumeBool()));
160	235	MHD_response_set_option(r, &o);
161	235	}
162	1.32k	if (fdp.ConsumeBool()) {
163	291	auto o = MHD_R_OPTION_CHUNKED_ENC(ToMhdBool(fdp.ConsumeBool()));
164	291	MHD_response_set_option(r, &o);
165	291	}
166	1.32k	if (fdp.ConsumeBool()) {
167	194	auto o = MHD_R_OPTION_CONN_CLOSE(ToMhdBool(fdp.ConsumeBool()));
168	194	MHD_response_set_option(r, &o);
169	194	}
170	1.32k	if (fdp.ConsumeBool()) {
171	243	auto o = MHD_R_OPTION_HTTP_1_0_SERVER(ToMhdBool(fdp.ConsumeBool()));
172	243	MHD_response_set_option(r, &o);
173	243	}
174	1.32k	if (fdp.ConsumeBool()) {
175	197	auto o = MHD_R_OPTION_HTTP_1_0_COMPATIBLE_STRICT(ToMhdBool(fdp.ConsumeBool()));
176	197	MHD_response_set_option(r, &o);
177	197	}
178	1.32k	if (fdp.ConsumeBool()) {
179	211	auto o = MHD_R_OPTION_INSANITY_HEADER_CONTENT_LENGTH(ToMhdBool(fdp.ConsumeBool()));
180	211	MHD_response_set_option(r, &o);
181	211	}
182	1.32k	if (fdp.ConsumeBool()) {
183	342	auto o = MHD_R_OPTION_TERMINATION_CALLBACK(&request_ended_cb, nullptr);
184	342	MHD_response_set_option(r, &o);
185	342	}
186	1.32k	}
187
188		static void add_auth(FuzzedDataProvider &fdp, MHD_Response *r,
189	1.32k	enum MHD_HTTP_StatusCode sc) {
190	1.32k	if (sc == MHD_HTTP_STATUS_UNAUTHORIZED) {
191		// Randomly add different challenge under 401 status code
192	350	if (fdp.ConsumeBool()) {
193		// Use digest challenge
194	146	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
195	146	MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
196	146	if (fdp.ConsumeBool()) {
197	110	std::string drealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
198	110	const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
199	110	const char* domain = fdp.ConsumeBool() ? "/a /b" : nullptr;
200	110	enum MHD_DigestAuthMultiQOP mqop =
201	110	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
202	110	enum MHD_DigestAuthMultiAlgo malgo =
203	110	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
204	110	MHD_response_add_auth_digest_challenge(
205	110	r, drealm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
206	110	mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
207	110	}
208	204	} else {
209		// Use basic challenge
210	204	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
211	204	const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
212	204	const char* domain = fdp.ConsumeBool() ? "/a /b" : nullptr;
213	204	enum MHD_DigestAuthMultiQOP mqop =
214	204	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
215	204	enum MHD_DigestAuthMultiAlgo malgo =
216	204	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
217	204	MHD_response_add_auth_digest_challenge(
218	204	r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
219	204	mqop, malgo, ToMhdBool(fdp.ConsumeBool()),
220	204	ToMhdBool(fdp.ConsumeBool()));
221	204	if (fdp.ConsumeBool()) {
222	34	std::string brealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
223	34	MHD_response_add_auth_basic_challenge(r, brealm.c_str(), ToMhdBool(fdp.ConsumeBool()));
224	34	}
225	204	}
226	973	} else {
227		// For all other status code, randomly determine if challenges are added
228
229		// Randomly choose if basic challenge is used or not
230	973	if (fdp.ConsumeBool()) {
231	216	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
232	216	MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
233	216	}
234
235		// Randomly choose if disgest challenge is used or not
236	973	if (fdp.ConsumeBool()) {
237	228	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
238	228	const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
239	228	const char* domain = fdp.ConsumeBool() ? "/a /b" : nullptr;
240	228	enum MHD_DigestAuthMultiQOP mqop =
241	228	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
242	228	enum MHD_DigestAuthMultiAlgo malgo =
243	228	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
244	228	MHD_response_add_auth_digest_challenge(
245	228	r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
246	228	mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
247	228	}
248	973	}
249	1.32k	}
250
251	1.40k	extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
252	1.40k	if (size == 0) {
253	0	return 0;
254	0	}
255	1.40k	FuzzedDataProvider fdp(data, size);
256
257		// Pick a random response status code
258	1.40k	enum MHD_HTTP_StatusCode sc = pick_status_code(fdp);
259
260		// Create a random response object
261	1.40k	struct MHD_Response* r = create_response(fdp, sc);
262	1.40k	if (!r) {
263	84	return 0;
264	84	}
265
266		// Add random headers into the response object
267	1.32k	add_headers(fdp, r);
268
269		// Set random options for the response object
270	1.32k	randomise_response_options(fdp, r);
271
272		// Add authentication challenges to response
273	1.32k	add_auth(fdp, r, sc);
274
275		// Fuzz additional targets on response status
276	1.32k	MHD_HTTP_status_code_to_string(sc);
277	1.32k	MHD_status_code_to_string((enum MHD_StatusCode)sc);
278
279		// Destory the response object
280	1.32k	MHD_response_destroy(r);
281	1.32k	return 0;
282	1.40k	}