/src/fuzz_response.cpp

Source
// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
////////////////////////////////////////////////////////////////////////////////
#include <stdint.h>
#include <stddef.h>
#include <unistd.h>
#include <sys/types.h>

#include <vector>
#include <algorithm>

#include "mhd_helper.h"

static void request_ended_cb(void *cls,
                             const struct MHD_RequestEndedData *data,
                             void *request_app_context) {
  // Do nothing
}

static enum MHD_HTTP_StatusCode pick_status_code(FuzzedDataProvider &fdp) {
  // Randomly pick a valid or invalid HTTP response status code
  return fdp.ConsumeBool()
      ? fdp.PickValueInArray({
          MHD_HTTP_STATUS_OK, MHD_HTTP_STATUS_CREATED, MHD_HTTP_STATUS_NO_CONTENT,
          MHD_HTTP_STATUS_PARTIAL_CONTENT, MHD_HTTP_STATUS_BAD_REQUEST,
          MHD_HTTP_STATUS_UNAUTHORIZED, MHD_HTTP_STATUS_FORBIDDEN,
          MHD_HTTP_STATUS_NOT_FOUND, MHD_HTTP_STATUS_INTERNAL_SERVER_ERROR })
      : (enum MHD_HTTP_StatusCode)(fdp.ConsumeIntegralInRange<int>(0, 999));
}

static MHD_Response* create_response(FuzzedDataProvider &fdp,
                                     enum MHD_HTTP_StatusCode sc) {
  struct MHD_Response* r = nullptr;

  // Generate random response body
  const size_t body_len = fdp.ConsumeIntegralInRange<size_t>(
      0, std::min<size_t>(fdp.remaining_bytes(), 8192));
  std::string body = fdp.ConsumeBytesAsString(body_len);


  // Randomly select which constructing function to use for respone object creation
  enum CtorKind {
    EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE
  };
  CtorKind ctor = fdp.PickValueInArray<CtorKind>(
      {EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE});

  switch (ctor) {
    default:
    case EMPTY: {
      // Create empty response
      r = MHD_response_from_empty(sc);
      break;
    }
    case BUF_STATIC: {
      // Create response with random body and static buffer status
      r = MHD_response_from_buffer_static(sc, body.size(), body.c_str());
      break;
    }
    case BUF_COPY: {
      // Create response with random body and copy buffer in
      r = MHD_response_from_buffer_copy(sc, body.size(), body.data());
      break;
    }
    case IOVEC: {
      // Create response from random IO vector
      unsigned cnt = fdp.ConsumeIntegralInRange<unsigned>(0, 6);
      std::vector<MHD_IoVec> iov(cnt);
      std::vector<std::string> chunks; chunks.reserve(cnt);
      for (unsigned i=0;i<cnt;i++) {
        chunks.push_back(fdp.ConsumeBytesAsString(
                           fdp.ConsumeIntegralInRange<size_t>(0, 1024)));
        iov[i].iov_base = chunks.back().data();
        iov[i].iov_len  = chunks.back().size();
      }
      r = MHD_response_from_iovec(sc, cnt ? cnt : 0, cnt ? iov.data() : nullptr, nullptr, nullptr);
      break;
    }
    case FROM_FD: {
      // Create response from file with random data
      char path[] = "/tmp/mhdrespXXXXXX";
      int fd = mkstemp(path);
      if (fd >= 0) {
        unlink(path);
        if (!body.empty()) (void) ::write(fd, body.data(), body.size());
        uint64_t sz = (uint64_t)body.size();
        uint64_t off = 0;
        if (fdp.ConsumeBool()) {
          off = std::min<uint64_t>(sz, fdp.ConsumeIntegral<uint64_t>() % (sz + 1));
        }
        uint64_t len = (sz > off) ? (fdp.ConsumeIntegral<uint64_t>() % (sz - off + 1)) : 0;
        r = MHD_response_from_fd(sc, fd, off, len);
        if (!r) {
          close(fd);
        }
      }
      break;
    }
    case FROM_PIPE: {
      // Create response by piping in random data
      int pfd[2];
      if (0 == pipe(pfd)) {
        std::string pbytes = fdp.ConsumeBytesAsString(
                               fdp.ConsumeIntegralInRange<size_t>(0, 2048));
        if (!pbytes.empty()) {
          ::write(pfd[1], pbytes.data(), pbytes.size());
        }
        close(pfd[1]);
        r = MHD_response_from_pipe(sc, pfd[0]);
        if (!r) {
          close(pfd[0]);
        }
      }
      break;
    }
  }

  return r;
}

static void add_headers(FuzzedDataProvider &fdp, MHD_Response *r) {
  const char* ct = fdp.ConsumeBool() ? "text/plain" : "application/octet-stream";
  MHD_response_add_header(r, "Content-Type", ct);

  // Add random standard headers
  size_t num_headers = fdp.ConsumeIntegralInRange<size_t>(0, 10);
  for (size_t i = 0; i < num_headers; i++) {
    std::string name = safe_ascii(fdp.ConsumeRandomLengthString(20), false);
    std::string val  = safe_ascii(fdp.ConsumeRandomLengthString(60), true);
    MHD_response_add_header(r, name.c_str(), val.c_str());
  }

  // Add random predefined header
  enum MHD_PredefinedHeader which =
    fdp.PickValueInArray<enum MHD_PredefinedHeader>(
      { MHD_PREDEF_ACCEPT_CHARSET, MHD_PREDEF_ACCEPT_LANGUAGE });
  std::string value = safe_ascii(fdp.ConsumeRandomLengthString(32));
  MHD_response_add_predef_header(r, which, value.c_str());
}

static void randomise_response_options(FuzzedDataProvider &fdp, MHD_Response *r) {
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_REUSABLE(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_HEAD_ONLY_RESPONSE(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_CHUNKED_ENC(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_CONN_CLOSE(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_HTTP_1_0_SERVER(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_HTTP_1_0_COMPATIBLE_STRICT(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_INSANITY_HEADER_CONTENT_LENGTH(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_TERMINATION_CALLBACK(&request_ended_cb, nullptr);
    MHD_response_set_option(r, &o);
  }
}

static void add_auth(FuzzedDataProvider &fdp, MHD_Response *r,
                     enum MHD_HTTP_StatusCode sc) {
  if (sc == MHD_HTTP_STATUS_UNAUTHORIZED) {
    // Randomly add different challenge under 401 status code
    if (fdp.ConsumeBool()) {
      // Use digest challenge
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
      if (fdp.ConsumeBool()) {
        std::string drealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
        const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
        const char* domain = fdp.ConsumeBool() ? "/a /b"  : nullptr;
        enum MHD_DigestAuthMultiQOP mqop =
          fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
        enum MHD_DigestAuthMultiAlgo malgo =
          fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
        MHD_response_add_auth_digest_challenge(
            r, drealm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
            mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
      }
    } else {
      // Use basic challenge
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
      const char* domain = fdp.ConsumeBool() ? "/a /b"  : nullptr;
      enum MHD_DigestAuthMultiQOP mqop =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
      enum MHD_DigestAuthMultiAlgo malgo =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
      MHD_response_add_auth_digest_challenge(
          r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
          mqop, malgo, ToMhdBool(fdp.ConsumeBool()),
          ToMhdBool(fdp.ConsumeBool()));
      if (fdp.ConsumeBool()) {
        std::string brealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
        MHD_response_add_auth_basic_challenge(r, brealm.c_str(), ToMhdBool(fdp.ConsumeBool()));
      }
    }
  } else {
    // For all other status code, randomly determine if challenges are added

    // Randomly choose if basic challenge is used or not
    if (fdp.ConsumeBool()) {
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
    }

    // Randomly choose if disgest challenge is used or not
    if (fdp.ConsumeBool()) {
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
      const char* domain = fdp.ConsumeBool() ? "/a /b"  : nullptr;
      enum MHD_DigestAuthMultiQOP mqop =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
      enum MHD_DigestAuthMultiAlgo malgo =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
      MHD_response_add_auth_digest_challenge(
          r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
          mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
    }
  }
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  if (size == 0) {
    return 0;
  }
  FuzzedDataProvider fdp(data, size);

  // Pick a random response status code
  enum MHD_HTTP_StatusCode sc = pick_status_code(fdp);

  // Create a random response object
  struct MHD_Response* r = create_response(fdp, sc);
  if (!r) {
    return 0;
  }

  // Add random headers into the response object
  add_headers(fdp, r);

  // Set random options for the response object
  randomise_response_options(fdp, r);

  // Add authentication challenges to response
  add_auth(fdp, r, sc);

  // Fuzz additional targets on response status
  MHD_HTTP_status_code_to_string(sc);
  MHD_status_code_to_string((enum MHD_StatusCode)sc);

  // Destory the response object
  MHD_response_destroy(r);
  return 0;
}

Coverage Report

Created: 2025-10-10 06:05

Line	Count	Source
1		// Copyright 2025 Google LLC
2		//
3		// Licensed under the Apache License, Version 2.0 (the "License");
4		// you may not use this file except in compliance with the License.
5		// You may obtain a copy of the License at
6		//
7		// http://www.apache.org/licenses/LICENSE-2.0
8		//
9		// Unless required by applicable law or agreed to in writing, software
10		// distributed under the License is distributed on an "AS IS" BASIS,
11		// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12		// See the License for the specific language governing permissions and
13		// limitations under the License.
14		//
15		////////////////////////////////////////////////////////////////////////////////
16		#include <stdint.h>
17		#include <stddef.h>
18		#include <unistd.h>
19		#include <sys/types.h>
20
21		#include <vector>
22		#include <algorithm>
23
24		#include "mhd_helper.h"
25
26		static void request_ended_cb(void *cls,
27		const struct MHD_RequestEndedData *data,
28	0	void *request_app_context) {
29		// Do nothing
30	0	}
31
32	2.18k	static enum MHD_HTTP_StatusCode pick_status_code(FuzzedDataProvider &fdp) {
33		// Randomly pick a valid or invalid HTTP response status code
34	2.18k	return fdp.ConsumeBool()
35	2.18k	? fdp.PickValueInArray({
36	1.94k	MHD_HTTP_STATUS_OK, MHD_HTTP_STATUS_CREATED, MHD_HTTP_STATUS_NO_CONTENT,
37	1.94k	MHD_HTTP_STATUS_PARTIAL_CONTENT, MHD_HTTP_STATUS_BAD_REQUEST,
38	1.94k	MHD_HTTP_STATUS_UNAUTHORIZED, MHD_HTTP_STATUS_FORBIDDEN,
39	1.94k	MHD_HTTP_STATUS_NOT_FOUND, MHD_HTTP_STATUS_INTERNAL_SERVER_ERROR })
40	2.18k	: (enum MHD_HTTP_StatusCode)(fdp.ConsumeIntegralInRange<int>(0, 999));
41	2.18k	}
42
43		static MHD_Response* create_response(FuzzedDataProvider &fdp,
44	2.18k	enum MHD_HTTP_StatusCode sc) {
45	2.18k	struct MHD_Response* r = nullptr;
46
47		// Generate random response body
48	2.18k	const size_t body_len = fdp.ConsumeIntegralInRange<size_t>(
49	2.18k	0, std::min<size_t>(fdp.remaining_bytes(), 8192));
50	2.18k	std::string body = fdp.ConsumeBytesAsString(body_len);
51
52
53		// Randomly select which constructing function to use for respone object creation
54	2.18k	enum CtorKind {
55	2.18k	EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE
56	2.18k	};
57	2.18k	CtorKind ctor = fdp.PickValueInArray<CtorKind>(
58	2.18k	{EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE});
59
60	2.18k	switch (ctor) {
61	0	default:
62	1.24k	case EMPTY: {
63		// Create empty response
64	1.24k	r = MHD_response_from_empty(sc);
65	1.24k	break;
66	0	}
67	175	case BUF_STATIC: {
68		// Create response with random body and static buffer status
69	175	r = MHD_response_from_buffer_static(sc, body.size(), body.c_str());
70	175	break;
71	0	}
72	309	case BUF_COPY: {
73		// Create response with random body and copy buffer in
74	309	r = MHD_response_from_buffer_copy(sc, body.size(), body.data());
75	309	break;
76	0	}
77	182	case IOVEC: {
78		// Create response from random IO vector
79	182	unsigned cnt = fdp.ConsumeIntegralInRange<unsigned>(0, 6);
80	182	std::vector<MHD_IoVec> iov(cnt);
81	182	std::vector<std::string> chunks; chunks.reserve(cnt);
82	736	for (unsigned i=0;i<cnt;i++) {
83	554	chunks.push_back(fdp.ConsumeBytesAsString(
84	554	fdp.ConsumeIntegralInRange<size_t>(0, 1024)));
85	554	iov[i].iov_base = chunks.back().data();
86	554	iov[i].iov_len = chunks.back().size();
87	554	}
88	182	r = MHD_response_from_iovec(sc, cnt ? cnt : 0, cnt ? iov.data() : nullptr, nullptr, nullptr);
89	182	break;
90	0	}
91	147	case FROM_FD: {
92		// Create response from file with random data
93	147	char path[] = "/tmp/mhdrespXXXXXX";
94	147	int fd = mkstemp(path);
95	147	if (fd >= 0) {
96	147	unlink(path);
97	147	if (!body.empty()) (void) ::write(fd, body.data(), body.size());
98	147	uint64_t sz = (uint64_t)body.size();
99	147	uint64_t off = 0;
100	147	if (fdp.ConsumeBool()) {
101	66	off = std::min<uint64_t>(sz, fdp.ConsumeIntegral<uint64_t>() % (sz + 1));
102	66	}
103	147	uint64_t len = (sz > off) ? (fdp.ConsumeIntegral<uint64_t>() % (sz - off + 1)) : 0;
104	147	r = MHD_response_from_fd(sc, fd, off, len);
105	147	if (!r) {
106	8	close(fd);
107	8	}
108	147	}
109	147	break;
110	0	}
111	124	case FROM_PIPE: {
112		// Create response by piping in random data
113	124	int pfd[2];
114	124	if (0 == pipe(pfd)) {
115	124	std::string pbytes = fdp.ConsumeBytesAsString(
116	124	fdp.ConsumeIntegralInRange<size_t>(0, 2048));
117	124	if (!pbytes.empty()) {
118	55	::write(pfd[1], pbytes.data(), pbytes.size());
119	55	}
120	124	close(pfd[1]);
121	124	r = MHD_response_from_pipe(sc, pfd[0]);
122	124	if (!r) {
123	11	close(pfd[0]);
124	11	}
125	124	}
126	124	break;
127	0	}
128	2.18k	}
129
130	2.18k	return r;
131	2.18k	}
132
133	2.11k	static void add_headers(FuzzedDataProvider &fdp, MHD_Response *r) {
134	2.11k	const char* ct = fdp.ConsumeBool() ? "text/plain" : "application/octet-stream";
135	2.11k	MHD_response_add_header(r, "Content-Type", ct);
136
137		// Add random standard headers
138	2.11k	size_t num_headers = fdp.ConsumeIntegralInRange<size_t>(0, 10);
139	4.31k	for (size_t i = 0; i < num_headers; i++) {
140	2.20k	std::string name = safe_ascii(fdp.ConsumeRandomLengthString(20), false);
141	2.20k	std::string val = safe_ascii(fdp.ConsumeRandomLengthString(60), true);
142	2.20k	MHD_response_add_header(r, name.c_str(), val.c_str());
143	2.20k	}
144
145		// Add random predefined header
146	2.11k	enum MHD_PredefinedHeader which =
147	2.11k	fdp.PickValueInArray<enum MHD_PredefinedHeader>(
148	2.11k	{ MHD_PREDEF_ACCEPT_CHARSET, MHD_PREDEF_ACCEPT_LANGUAGE });
149	2.11k	std::string value = safe_ascii(fdp.ConsumeRandomLengthString(32));
150	2.11k	MHD_response_add_predef_header(r, which, value.c_str());
151	2.11k	}
152
153	2.11k	static void randomise_response_options(FuzzedDataProvider &fdp, MHD_Response *r) {
154	2.11k	if (fdp.ConsumeBool()) {
155	132	auto o = MHD_R_OPTION_REUSABLE(ToMhdBool(fdp.ConsumeBool()));
156	132	MHD_response_set_option(r, &o);
157	132	}
158	2.11k	if (fdp.ConsumeBool()) {
159	121	auto o = MHD_R_OPTION_HEAD_ONLY_RESPONSE(ToMhdBool(fdp.ConsumeBool()));
160	121	MHD_response_set_option(r, &o);
161	121	}
162	2.11k	if (fdp.ConsumeBool()) {
163	132	auto o = MHD_R_OPTION_CHUNKED_ENC(ToMhdBool(fdp.ConsumeBool()));
164	132	MHD_response_set_option(r, &o);
165	132	}
166	2.11k	if (fdp.ConsumeBool()) {
167	147	auto o = MHD_R_OPTION_CONN_CLOSE(ToMhdBool(fdp.ConsumeBool()));
168	147	MHD_response_set_option(r, &o);
169	147	}
170	2.11k	if (fdp.ConsumeBool()) {
171	152	auto o = MHD_R_OPTION_HTTP_1_0_SERVER(ToMhdBool(fdp.ConsumeBool()));
172	152	MHD_response_set_option(r, &o);
173	152	}
174	2.11k	if (fdp.ConsumeBool()) {
175	128	auto o = MHD_R_OPTION_HTTP_1_0_COMPATIBLE_STRICT(ToMhdBool(fdp.ConsumeBool()));
176	128	MHD_response_set_option(r, &o);
177	128	}
178	2.11k	if (fdp.ConsumeBool()) {
179	135	auto o = MHD_R_OPTION_INSANITY_HEADER_CONTENT_LENGTH(ToMhdBool(fdp.ConsumeBool()));
180	135	MHD_response_set_option(r, &o);
181	135	}
182	2.11k	if (fdp.ConsumeBool()) {
183	499	auto o = MHD_R_OPTION_TERMINATION_CALLBACK(&request_ended_cb, nullptr);
184	499	MHD_response_set_option(r, &o);
185	499	}
186	2.11k	}
187
188		static void add_auth(FuzzedDataProvider &fdp, MHD_Response *r,
189	2.11k	enum MHD_HTTP_StatusCode sc) {
190	2.11k	if (sc == MHD_HTTP_STATUS_UNAUTHORIZED) {
191		// Randomly add different challenge under 401 status code
192	957	if (fdp.ConsumeBool()) {
193		// Use digest challenge
194	402	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
195	402	MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
196	402	if (fdp.ConsumeBool()) {
197	340	std::string drealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
198	340	const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
199	340	const char* domain = fdp.ConsumeBool() ? "/a /b" : nullptr;
200	340	enum MHD_DigestAuthMultiQOP mqop =
201	340	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
202	340	enum MHD_DigestAuthMultiAlgo malgo =
203	340	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
204	340	MHD_response_add_auth_digest_challenge(
205	340	r, drealm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
206	340	mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
207	340	}
208	555	} else {
209		// Use basic challenge
210	555	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
211	555	const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
212	555	const char* domain = fdp.ConsumeBool() ? "/a /b" : nullptr;
213	555	enum MHD_DigestAuthMultiQOP mqop =
214	555	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
215	555	enum MHD_DigestAuthMultiAlgo malgo =
216	555	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
217	555	MHD_response_add_auth_digest_challenge(
218	555	r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
219	555	mqop, malgo, ToMhdBool(fdp.ConsumeBool()),
220	555	ToMhdBool(fdp.ConsumeBool()));
221	555	if (fdp.ConsumeBool()) {
222	267	std::string brealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
223	267	MHD_response_add_auth_basic_challenge(r, brealm.c_str(), ToMhdBool(fdp.ConsumeBool()));
224	267	}
225	555	}
226	1.15k	} else {
227		// For all other status code, randomly determine if challenges are added
228
229		// Randomly choose if basic challenge is used or not
230	1.15k	if (fdp.ConsumeBool()) {
231	192	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
232	192	MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
233	192	}
234
235		// Randomly choose if disgest challenge is used or not
236	1.15k	if (fdp.ConsumeBool()) {
237	358	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
238	358	const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
239	358	const char* domain = fdp.ConsumeBool() ? "/a /b" : nullptr;
240	358	enum MHD_DigestAuthMultiQOP mqop =
241	358	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
242	358	enum MHD_DigestAuthMultiAlgo malgo =
243	358	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
244	358	MHD_response_add_auth_digest_challenge(
245	358	r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
246	358	mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
247	358	}
248	1.15k	}
249	2.11k	}
250
251	2.18k	extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
252	2.18k	if (size == 0) {
253	0	return 0;
254	0	}
255	2.18k	FuzzedDataProvider fdp(data, size);
256
257		// Pick a random response status code
258	2.18k	enum MHD_HTTP_StatusCode sc = pick_status_code(fdp);
259
260		// Create a random response object
261	2.18k	struct MHD_Response* r = create_response(fdp, sc);
262	2.18k	if (!r) {
263	70	return 0;
264	70	}
265
266		// Add random headers into the response object
267	2.11k	add_headers(fdp, r);
268
269		// Set random options for the response object
270	2.11k	randomise_response_options(fdp, r);
271
272		// Add authentication challenges to response
273	2.11k	add_auth(fdp, r, sc);
274
275		// Fuzz additional targets on response status
276	2.11k	MHD_HTTP_status_code_to_string(sc);
277	2.11k	MHD_status_code_to_string((enum MHD_StatusCode)sc);
278
279		// Destory the response object
280	2.11k	MHD_response_destroy(r);
281	2.11k	return 0;
282	2.18k	}