/src/fuzz_response.cpp

Source (jump to first uncovered line)
// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
////////////////////////////////////////////////////////////////////////////////
#include <stdint.h>
#include <stddef.h>
#include <unistd.h>
#include <sys/types.h>

#include <vector>
#include <algorithm>

#include "mhd_helper.h"

static void request_ended_cb(void *cls,
                             const struct MHD_RequestEndedData *data,
                             void *request_app_context) {
  // Do nothing
}

static enum MHD_HTTP_StatusCode pick_status_code(FuzzedDataProvider &fdp) {
  // Randomly pick a valid or invalid HTTP response status code
  return fdp.ConsumeBool()
      ? fdp.PickValueInArray({
          MHD_HTTP_STATUS_OK, MHD_HTTP_STATUS_CREATED, MHD_HTTP_STATUS_NO_CONTENT,
          MHD_HTTP_STATUS_PARTIAL_CONTENT, MHD_HTTP_STATUS_BAD_REQUEST,
          MHD_HTTP_STATUS_UNAUTHORIZED, MHD_HTTP_STATUS_FORBIDDEN,
          MHD_HTTP_STATUS_NOT_FOUND, MHD_HTTP_STATUS_INTERNAL_SERVER_ERROR })
      : (enum MHD_HTTP_StatusCode)(fdp.ConsumeIntegralInRange<int>(0, 999));
}

static MHD_Response* create_response(FuzzedDataProvider &fdp,
                                     enum MHD_HTTP_StatusCode sc) {
  struct MHD_Response* r = nullptr;

  // Generate random response body
  const size_t body_len = fdp.ConsumeIntegralInRange<size_t>(
      0, std::min<size_t>(fdp.remaining_bytes(), 8192));
  std::string body = fdp.ConsumeBytesAsString(body_len);


  // Randomly select which constructing function to use for respone object creation
  enum CtorKind {
    EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE
  };
  CtorKind ctor = fdp.PickValueInArray<CtorKind>(
      {EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE});

  switch (ctor) {
    default:
    case EMPTY: {
      // Create empty response
      r = MHD_response_from_empty(sc);
      break;
    }
    case BUF_STATIC: {
      // Create response with random body and static buffer status
      r = MHD_response_from_buffer_static(sc, body.size(), body.c_str());
      break;
    }
    case BUF_COPY: {
      // Create response with random body and copy buffer in
      r = MHD_response_from_buffer_copy(sc, body.size(), body.data());
      break;
    }
    case IOVEC: {
      // Create response from random IO vector
      unsigned cnt = fdp.ConsumeIntegralInRange<unsigned>(0, 6);
      std::vector<MHD_IoVec> iov(cnt);
      std::vector<std::string> chunks; chunks.reserve(cnt);
      for (unsigned i=0;i<cnt;i++) {
        chunks.push_back(fdp.ConsumeBytesAsString(
                           fdp.ConsumeIntegralInRange<size_t>(0, 1024)));
        iov[i].iov_base = chunks.back().data();
        iov[i].iov_len  = chunks.back().size();
      }
      r = MHD_response_from_iovec(sc, cnt ? cnt : 0, cnt ? iov.data() : nullptr, nullptr, nullptr);
      break;
    }
    case FROM_FD: {
      // Create response from file with random data
      char path[] = "/tmp/mhdrespXXXXXX";
      int fd = mkstemp(path);
      if (fd >= 0) {
        unlink(path);
        if (!body.empty()) (void) ::write(fd, body.data(), body.size());
        uint64_t sz = (uint64_t)body.size();
        uint64_t off = 0;
        if (fdp.ConsumeBool()) {
          off = std::min<uint64_t>(sz, fdp.ConsumeIntegral<uint64_t>() % (sz + 1));
        }
        uint64_t len = (sz > off) ? (fdp.ConsumeIntegral<uint64_t>() % (sz - off + 1)) : 0;
        r = MHD_response_from_fd(sc, fd, off, len);
        if (!r) {
          close(fd);
        }
      }
      break;
    }
    case FROM_PIPE: {
      // Create response by piping in random data
      int pfd[2];
      if (0 == pipe(pfd)) {
        std::string pbytes = fdp.ConsumeBytesAsString(
                               fdp.ConsumeIntegralInRange<size_t>(0, 2048));
        if (!pbytes.empty()) {
          ::write(pfd[1], pbytes.data(), pbytes.size());
        }
        close(pfd[1]);
        r = MHD_response_from_pipe(sc, pfd[0]);
        if (!r) {
          close(pfd[0]);
        }
      }
      break;
    }
  }

  return r;
}

static void add_headers(FuzzedDataProvider &fdp, MHD_Response *r) {
  const char* ct = fdp.ConsumeBool() ? "text/plain" : "application/octet-stream";
  MHD_response_add_header(r, "Content-Type", ct);

  // Add random standard headers
  size_t num_headers = fdp.ConsumeIntegralInRange<size_t>(0, 10);
  for (size_t i = 0; i < num_headers; i++) {
    std::string name = safe_ascii(fdp.ConsumeRandomLengthString(20), false);
    std::string val  = safe_ascii(fdp.ConsumeRandomLengthString(60), true);
    MHD_response_add_header(r, name.c_str(), val.c_str());
  }

  // Add random predefined header
  enum MHD_PredefinedHeader which =
    fdp.PickValueInArray<enum MHD_PredefinedHeader>(
      { MHD_PREDEF_ACCEPT_CHARSET, MHD_PREDEF_ACCEPT_LANGUAGE });
  std::string value = safe_ascii(fdp.ConsumeRandomLengthString(32));
  MHD_response_add_predef_header(r, which, value.c_str());
}

static void randomise_response_options(FuzzedDataProvider &fdp, MHD_Response *r) {
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_REUSABLE(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_HEAD_ONLY_RESPONSE(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_CHUNKED_ENC(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_CONN_CLOSE(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_HTTP_1_0_SERVER(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_HTTP_1_0_COMPATIBLE_STRICT(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_INSANITY_HEADER_CONTENT_LENGTH(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_TERMINATION_CALLBACK(&request_ended_cb, nullptr);
    MHD_response_set_option(r, &o);
  }
}

static void add_auth(FuzzedDataProvider &fdp, MHD_Response *r,
                     enum MHD_HTTP_StatusCode sc) {
  if (sc == MHD_HTTP_STATUS_UNAUTHORIZED) {
    // Randomly add different challenge under 401 status code
    if (fdp.ConsumeBool()) {
      // Use digest challenge
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
      if (fdp.ConsumeBool()) {
        std::string drealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
        const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
        const char* domain = fdp.ConsumeBool() ? "/a /b"  : nullptr;
        enum MHD_DigestAuthMultiQOP mqop =
          fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
        enum MHD_DigestAuthMultiAlgo malgo =
          fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
        MHD_response_add_auth_digest_challenge(
            r, drealm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
            mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
      }
    } else {
      // Use basic challenge
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
      const char* domain = fdp.ConsumeBool() ? "/a /b"  : nullptr;
      enum MHD_DigestAuthMultiQOP mqop =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
      enum MHD_DigestAuthMultiAlgo malgo =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
      MHD_response_add_auth_digest_challenge(
          r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
          mqop, malgo, ToMhdBool(fdp.ConsumeBool()),
          ToMhdBool(fdp.ConsumeBool()));
      if (fdp.ConsumeBool()) {
        std::string brealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
        MHD_response_add_auth_basic_challenge(r, brealm.c_str(), ToMhdBool(fdp.ConsumeBool()));
      }
    }
  } else {
    // For all other status code, randomly determine if challenges are added

    // Randomly choose if basic challenge is used or not
    if (fdp.ConsumeBool()) {
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
    }

    // Randomly choose if disgest challenge is used or not
    if (fdp.ConsumeBool()) {
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
      const char* domain = fdp.ConsumeBool() ? "/a /b"  : nullptr;
      enum MHD_DigestAuthMultiQOP mqop =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
      enum MHD_DigestAuthMultiAlgo malgo =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
      MHD_response_add_auth_digest_challenge(
          r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
          mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
    }
  }
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  if (size == 0) {
    return 0;
  }
  FuzzedDataProvider fdp(data, size);

  // Pick a random response status code
  enum MHD_HTTP_StatusCode sc = pick_status_code(fdp);

  // Create a random response object
  struct MHD_Response* r = create_response(fdp, sc);
  if (!r) {
    return 0;
  }

  // Add random headers into the response object
  add_headers(fdp, r);

  // Set random options for the response object
  randomise_response_options(fdp, r);

  // Add authentication challenges to response
  add_auth(fdp, r, sc);

  // Fuzz additional targets on response status
  MHD_HTTP_status_code_to_string(sc);
  MHD_status_code_to_string((enum MHD_StatusCode)sc);

  // Destory the response object
  MHD_response_destroy(r);
  return 0;
}

Coverage Report

Created: 2025-08-28 06:19

Line	Count	Source (jump to first uncovered line)
1		// Copyright 2025 Google LLC
2		//
3		// Licensed under the Apache License, Version 2.0 (the "License");
4		// you may not use this file except in compliance with the License.
5		// You may obtain a copy of the License at
6		//
7		// http://www.apache.org/licenses/LICENSE-2.0
8		//
9		// Unless required by applicable law or agreed to in writing, software
10		// distributed under the License is distributed on an "AS IS" BASIS,
11		// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12		// See the License for the specific language governing permissions and
13		// limitations under the License.
14		//
15		////////////////////////////////////////////////////////////////////////////////
16		#include <stdint.h>
17		#include <stddef.h>
18		#include <unistd.h>
19		#include <sys/types.h>
20
21		#include <vector>
22		#include <algorithm>
23
24		#include "mhd_helper.h"
25
26		static void request_ended_cb(void *cls,
27		const struct MHD_RequestEndedData *data,
28	0	void *request_app_context) {
29		// Do nothing
30	0	}
31
32	1.43k	static enum MHD_HTTP_StatusCode pick_status_code(FuzzedDataProvider &fdp) {
33		// Randomly pick a valid or invalid HTTP response status code
34	1.43k	return fdp.ConsumeBool()
35	1.43k	? fdp.PickValueInArray({
36	1.06k	MHD_HTTP_STATUS_OK, MHD_HTTP_STATUS_CREATED, MHD_HTTP_STATUS_NO_CONTENT,
37	1.06k	MHD_HTTP_STATUS_PARTIAL_CONTENT, MHD_HTTP_STATUS_BAD_REQUEST,
38	1.06k	MHD_HTTP_STATUS_UNAUTHORIZED, MHD_HTTP_STATUS_FORBIDDEN,
39	1.06k	MHD_HTTP_STATUS_NOT_FOUND, MHD_HTTP_STATUS_INTERNAL_SERVER_ERROR })
40	1.43k	: (enum MHD_HTTP_StatusCode)(fdp.ConsumeIntegralInRange<int>(0, 999));
41	1.43k	}
42
43		static MHD_Response* create_response(FuzzedDataProvider &fdp,
44	1.43k	enum MHD_HTTP_StatusCode sc) {
45	1.43k	struct MHD_Response* r = nullptr;
46
47		// Generate random response body
48	1.43k	const size_t body_len = fdp.ConsumeIntegralInRange<size_t>(
49	1.43k	0, std::min<size_t>(fdp.remaining_bytes(), 8192));
50	1.43k	std::string body = fdp.ConsumeBytesAsString(body_len);
51
52
53		// Randomly select which constructing function to use for respone object creation
54	1.43k	enum CtorKind {
55	1.43k	EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE
56	1.43k	};
57	1.43k	CtorKind ctor = fdp.PickValueInArray<CtorKind>(
58	1.43k	{EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE});
59
60	1.43k	switch (ctor) {
61	0	default:
62	531	case EMPTY: {
63		// Create empty response
64	531	r = MHD_response_from_empty(sc);
65	531	break;
66	0	}
67	211	case BUF_STATIC: {
68		// Create response with random body and static buffer status
69	211	r = MHD_response_from_buffer_static(sc, body.size(), body.c_str());
70	211	break;
71	0	}
72	139	case BUF_COPY: {
73		// Create response with random body and copy buffer in
74	139	r = MHD_response_from_buffer_copy(sc, body.size(), body.data());
75	139	break;
76	0	}
77	227	case IOVEC: {
78		// Create response from random IO vector
79	227	unsigned cnt = fdp.ConsumeIntegralInRange<unsigned>(0, 6);
80	227	std::vector<MHD_IoVec> iov(cnt);
81	227	std::vector<std::string> chunks; chunks.reserve(cnt);
82	894	for (unsigned i=0;i<cnt;i++) {
83	667	chunks.push_back(fdp.ConsumeBytesAsString(
84	667	fdp.ConsumeIntegralInRange<size_t>(0, 1024)));
85	667	iov[i].iov_base = chunks.back().data();
86	667	iov[i].iov_len = chunks.back().size();
87	667	}
88	227	r = MHD_response_from_iovec(sc, cnt ? cnt : 0, cnt ? iov.data() : nullptr, nullptr, nullptr);
89	227	break;
90	0	}
91	193	case FROM_FD: {
92		// Create response from file with random data
93	193	char path[] = "/tmp/mhdrespXXXXXX";
94	193	int fd = mkstemp(path);
95	193	if (fd >= 0) {
96	193	unlink(path);
97	193	if (!body.empty()) (void) ::write(fd, body.data(), body.size());
98	193	uint64_t sz = (uint64_t)body.size();
99	193	uint64_t off = 0;
100	193	if (fdp.ConsumeBool()) {
101	85	off = std::min<uint64_t>(sz, fdp.ConsumeIntegral<uint64_t>() % (sz + 1));
102	85	}
103	193	uint64_t len = (sz > off) ? (fdp.ConsumeIntegral<uint64_t>() % (sz - off + 1)) : 0;
104	193	r = MHD_response_from_fd(sc, fd, off, len);
105	193	if (!r) {
106	13	close(fd);
107	13	}
108	193	}
109	193	break;
110	0	}
111	134	case FROM_PIPE: {
112		// Create response by piping in random data
113	134	int pfd[2];
114	134	if (0 == pipe(pfd)) {
115	134	std::string pbytes = fdp.ConsumeBytesAsString(
116	134	fdp.ConsumeIntegralInRange<size_t>(0, 2048));
117	134	if (!pbytes.empty()) {
118	85	::write(pfd[1], pbytes.data(), pbytes.size());
119	85	}
120	134	close(pfd[1]);
121	134	r = MHD_response_from_pipe(sc, pfd[0]);
122	134	if (!r) {
123	15	close(pfd[0]);
124	15	}
125	134	}
126	134	break;
127	0	}
128	1.43k	}
129
130	1.43k	return r;
131	1.43k	}
132
133	1.35k	static void add_headers(FuzzedDataProvider &fdp, MHD_Response *r) {
134	1.35k	const char* ct = fdp.ConsumeBool() ? "text/plain" : "application/octet-stream";
135	1.35k	MHD_response_add_header(r, "Content-Type", ct);
136
137		// Add random standard headers
138	1.35k	size_t num_headers = fdp.ConsumeIntegralInRange<size_t>(0, 10);
139	3.88k	for (size_t i = 0; i < num_headers; i++) {
140	2.53k	std::string name = safe_ascii(fdp.ConsumeRandomLengthString(20), false);
141	2.53k	std::string val = safe_ascii(fdp.ConsumeRandomLengthString(60), true);
142	2.53k	MHD_response_add_header(r, name.c_str(), val.c_str());
143	2.53k	}
144
145		// Add random predefined header
146	1.35k	enum MHD_PredefinedHeader which =
147	1.35k	fdp.PickValueInArray<enum MHD_PredefinedHeader>(
148	1.35k	{ MHD_PREDEF_ACCEPT_CHARSET, MHD_PREDEF_ACCEPT_LANGUAGE });
149	1.35k	std::string value = safe_ascii(fdp.ConsumeRandomLengthString(32));
150	1.35k	MHD_response_add_predef_header(r, which, value.c_str());
151	1.35k	}
152
153	1.35k	static void randomise_response_options(FuzzedDataProvider &fdp, MHD_Response *r) {
154	1.35k	if (fdp.ConsumeBool()) {
155	275	auto o = MHD_R_OPTION_REUSABLE(ToMhdBool(fdp.ConsumeBool()));
156	275	MHD_response_set_option(r, &o);
157	275	}
158	1.35k	if (fdp.ConsumeBool()) {
159	230	auto o = MHD_R_OPTION_HEAD_ONLY_RESPONSE(ToMhdBool(fdp.ConsumeBool()));
160	230	MHD_response_set_option(r, &o);
161	230	}
162	1.35k	if (fdp.ConsumeBool()) {
163	289	auto o = MHD_R_OPTION_CHUNKED_ENC(ToMhdBool(fdp.ConsumeBool()));
164	289	MHD_response_set_option(r, &o);
165	289	}
166	1.35k	if (fdp.ConsumeBool()) {
167	207	auto o = MHD_R_OPTION_CONN_CLOSE(ToMhdBool(fdp.ConsumeBool()));
168	207	MHD_response_set_option(r, &o);
169	207	}
170	1.35k	if (fdp.ConsumeBool()) {
171	253	auto o = MHD_R_OPTION_HTTP_1_0_SERVER(ToMhdBool(fdp.ConsumeBool()));
172	253	MHD_response_set_option(r, &o);
173	253	}
174	1.35k	if (fdp.ConsumeBool()) {
175	195	auto o = MHD_R_OPTION_HTTP_1_0_COMPATIBLE_STRICT(ToMhdBool(fdp.ConsumeBool()));
176	195	MHD_response_set_option(r, &o);
177	195	}
178	1.35k	if (fdp.ConsumeBool()) {
179	211	auto o = MHD_R_OPTION_INSANITY_HEADER_CONTENT_LENGTH(ToMhdBool(fdp.ConsumeBool()));
180	211	MHD_response_set_option(r, &o);
181	211	}
182	1.35k	if (fdp.ConsumeBool()) {
183	342	auto o = MHD_R_OPTION_TERMINATION_CALLBACK(&request_ended_cb, nullptr);
184	342	MHD_response_set_option(r, &o);
185	342	}
186	1.35k	}
187
188		static void add_auth(FuzzedDataProvider &fdp, MHD_Response *r,
189	1.35k	enum MHD_HTTP_StatusCode sc) {
190	1.35k	if (sc == MHD_HTTP_STATUS_UNAUTHORIZED) {
191		// Randomly add different challenge under 401 status code
192	365	if (fdp.ConsumeBool()) {
193		// Use digest challenge
194	152	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
195	152	MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
196	152	if (fdp.ConsumeBool()) {
197	105	std::string drealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
198	105	const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
199	105	const char* domain = fdp.ConsumeBool() ? "/a /b" : nullptr;
200	105	enum MHD_DigestAuthMultiQOP mqop =
201	105	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
202	105	enum MHD_DigestAuthMultiAlgo malgo =
203	105	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
204	105	MHD_response_add_auth_digest_challenge(
205	105	r, drealm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
206	105	mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
207	105	}
208	213	} else {
209		// Use basic challenge
210	213	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
211	213	const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
212	213	const char* domain = fdp.ConsumeBool() ? "/a /b" : nullptr;
213	213	enum MHD_DigestAuthMultiQOP mqop =
214	213	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
215	213	enum MHD_DigestAuthMultiAlgo malgo =
216	213	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
217	213	MHD_response_add_auth_digest_challenge(
218	213	r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
219	213	mqop, malgo, ToMhdBool(fdp.ConsumeBool()),
220	213	ToMhdBool(fdp.ConsumeBool()));
221	213	if (fdp.ConsumeBool()) {
222	32	std::string brealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
223	32	MHD_response_add_auth_basic_challenge(r, brealm.c_str(), ToMhdBool(fdp.ConsumeBool()));
224	32	}
225	213	}
226	985	} else {
227		// For all other status code, randomly determine if challenges are added
228
229		// Randomly choose if basic challenge is used or not
230	985	if (fdp.ConsumeBool()) {
231	225	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
232	225	MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
233	225	}
234
235		// Randomly choose if disgest challenge is used or not
236	985	if (fdp.ConsumeBool()) {
237	232	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
238	232	const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
239	232	const char* domain = fdp.ConsumeBool() ? "/a /b" : nullptr;
240	232	enum MHD_DigestAuthMultiQOP mqop =
241	232	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
242	232	enum MHD_DigestAuthMultiAlgo malgo =
243	232	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
244	232	MHD_response_add_auth_digest_challenge(
245	232	r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
246	232	mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
247	232	}
248	985	}
249	1.35k	}
250
251	1.43k	extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
252	1.43k	if (size == 0) {
253	0	return 0;
254	0	}
255	1.43k	FuzzedDataProvider fdp(data, size);
256
257		// Pick a random response status code
258	1.43k	enum MHD_HTTP_StatusCode sc = pick_status_code(fdp);
259
260		// Create a random response object
261	1.43k	struct MHD_Response* r = create_response(fdp, sc);
262	1.43k	if (!r) {
263	85	return 0;
264	85	}
265
266		// Add random headers into the response object
267	1.35k	add_headers(fdp, r);
268
269		// Set random options for the response object
270	1.35k	randomise_response_options(fdp, r);
271
272		// Add authentication challenges to response
273	1.35k	add_auth(fdp, r, sc);
274
275		// Fuzz additional targets on response status
276	1.35k	MHD_HTTP_status_code_to_string(sc);
277	1.35k	MHD_status_code_to_string((enum MHD_StatusCode)sc);
278
279		// Destory the response object
280	1.35k	MHD_response_destroy(r);
281	1.35k	return 0;
282	1.43k	}