/src/fuzz_response.cpp

Source
// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
////////////////////////////////////////////////////////////////////////////////
#include <stdint.h>
#include <stddef.h>
#include <unistd.h>
#include <sys/types.h>

#include <vector>
#include <algorithm>

#include "mhd_helper.h"

static void request_ended_cb(void *cls,
                             const struct MHD_RequestEndedData *data,
                             void *request_app_context) {
  // Do nothing
}

static enum MHD_HTTP_StatusCode pick_status_code(FuzzedDataProvider &fdp) {
  // Randomly pick a valid or invalid HTTP response status code
  return fdp.ConsumeBool()
      ? fdp.PickValueInArray({
          MHD_HTTP_STATUS_OK, MHD_HTTP_STATUS_CREATED, MHD_HTTP_STATUS_NO_CONTENT,
          MHD_HTTP_STATUS_PARTIAL_CONTENT, MHD_HTTP_STATUS_BAD_REQUEST,
          MHD_HTTP_STATUS_UNAUTHORIZED, MHD_HTTP_STATUS_FORBIDDEN,
          MHD_HTTP_STATUS_NOT_FOUND, MHD_HTTP_STATUS_INTERNAL_SERVER_ERROR })
      : (enum MHD_HTTP_StatusCode)(fdp.ConsumeIntegralInRange<int>(0, 999));
}

static MHD_Response* create_response(FuzzedDataProvider &fdp,
                                     enum MHD_HTTP_StatusCode sc) {
  struct MHD_Response* r = nullptr;

  // Generate random response body
  const size_t body_len = fdp.ConsumeIntegralInRange<size_t>(
      0, std::min<size_t>(fdp.remaining_bytes(), 8192));
  std::string body = fdp.ConsumeBytesAsString(body_len);


  // Randomly select which constructing function to use for respone object creation
  enum CtorKind {
    EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE
  };
  CtorKind ctor = fdp.PickValueInArray<CtorKind>(
      {EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE});

  switch (ctor) {
    default:
    case EMPTY: {
      // Create empty response
      r = MHD_response_from_empty(sc);
      break;
    }
    case BUF_STATIC: {
      // Create response with random body and static buffer status
      r = MHD_response_from_buffer_static(sc, body.size(), body.c_str());
      break;
    }
    case BUF_COPY: {
      // Create response with random body and copy buffer in
      r = MHD_response_from_buffer_copy(sc, body.size(), body.data());
      break;
    }
    case IOVEC: {
      // Create response from random IO vector
      unsigned cnt = fdp.ConsumeIntegralInRange<unsigned>(0, 6);
      std::vector<MHD_IoVec> iov(cnt);
      std::vector<std::string> chunks; chunks.reserve(cnt);
      for (unsigned i=0;i<cnt;i++) {
        chunks.push_back(fdp.ConsumeBytesAsString(
                           fdp.ConsumeIntegralInRange<size_t>(0, 1024)));
        iov[i].iov_base = chunks.back().data();
        iov[i].iov_len  = chunks.back().size();
      }
      r = MHD_response_from_iovec(sc, cnt ? cnt : 0, cnt ? iov.data() : nullptr, nullptr, nullptr);
      break;
    }
    case FROM_FD: {
      // Create response from file with random data
      char path[] = "/tmp/mhdrespXXXXXX";
      int fd = mkstemp(path);
      if (fd >= 0) {
        unlink(path);
        if (!body.empty()) (void) ::write(fd, body.data(), body.size());
        uint64_t sz = (uint64_t)body.size();
        uint64_t off = 0;
        if (fdp.ConsumeBool()) {
          off = std::min<uint64_t>(sz, fdp.ConsumeIntegral<uint64_t>() % (sz + 1));
        }
        uint64_t len = (sz > off) ? (fdp.ConsumeIntegral<uint64_t>() % (sz - off + 1)) : 0;
        r = MHD_response_from_fd(sc, fd, off, len);
        if (!r) {
          close(fd);
        }
      }
      break;
    }
    case FROM_PIPE: {
      // Create response by piping in random data
      int pfd[2];
      if (0 == pipe(pfd)) {
        std::string pbytes = fdp.ConsumeBytesAsString(
                               fdp.ConsumeIntegralInRange<size_t>(0, 2048));
        if (!pbytes.empty()) {
          ::write(pfd[1], pbytes.data(), pbytes.size());
        }
        close(pfd[1]);
        r = MHD_response_from_pipe(sc, pfd[0]);
        if (!r) {
          close(pfd[0]);
        }
      }
      break;
    }
  }

  return r;
}

static void add_headers(FuzzedDataProvider &fdp, MHD_Response *r) {
  const char* ct = fdp.ConsumeBool() ? "text/plain" : "application/octet-stream";
  MHD_response_add_header(r, "Content-Type", ct);

  // Add random standard headers
  size_t num_headers = fdp.ConsumeIntegralInRange<size_t>(0, 10);
  for (size_t i = 0; i < num_headers; i++) {
    std::string name = safe_ascii(fdp.ConsumeRandomLengthString(20), false);
    std::string val  = safe_ascii(fdp.ConsumeRandomLengthString(60), true);
    MHD_response_add_header(r, name.c_str(), val.c_str());
  }

  // Add random predefined header
  enum MHD_PredefinedHeader which =
    fdp.PickValueInArray<enum MHD_PredefinedHeader>(
      { MHD_PREDEF_ACCEPT_CHARSET, MHD_PREDEF_ACCEPT_LANGUAGE });
  std::string value = safe_ascii(fdp.ConsumeRandomLengthString(32));
  MHD_response_add_predef_header(r, which, value.c_str());
}

static void randomise_response_options(FuzzedDataProvider &fdp, MHD_Response *r) {
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_REUSABLE(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_HEAD_ONLY_RESPONSE(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_CHUNKED_ENC(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_CONN_CLOSE(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_HTTP_1_0_SERVER(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_HTTP_1_0_COMPATIBLE_STRICT(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_INSANITY_HEADER_CONTENT_LENGTH(ToMhdBool(fdp.ConsumeBool()));
    MHD_response_set_option(r, &o);
  }
  if (fdp.ConsumeBool()) {
    auto o = MHD_R_OPTION_TERMINATION_CALLBACK(&request_ended_cb, nullptr);
    MHD_response_set_option(r, &o);
  }
}

static void add_auth(FuzzedDataProvider &fdp, MHD_Response *r,
                     enum MHD_HTTP_StatusCode sc) {
  if (sc == MHD_HTTP_STATUS_UNAUTHORIZED) {
    // Randomly add different challenge under 401 status code
    if (fdp.ConsumeBool()) {
      // Use digest challenge
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
      if (fdp.ConsumeBool()) {
        std::string drealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
        const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
        const char* domain = fdp.ConsumeBool() ? "/a /b"  : nullptr;
        enum MHD_DigestAuthMultiQOP mqop =
          fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
        enum MHD_DigestAuthMultiAlgo malgo =
          fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
        MHD_response_add_auth_digest_challenge(
            r, drealm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
            mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
      }
    } else {
      // Use basic challenge
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
      const char* domain = fdp.ConsumeBool() ? "/a /b"  : nullptr;
      enum MHD_DigestAuthMultiQOP mqop =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
      enum MHD_DigestAuthMultiAlgo malgo =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
      MHD_response_add_auth_digest_challenge(
          r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
          mqop, malgo, ToMhdBool(fdp.ConsumeBool()),
          ToMhdBool(fdp.ConsumeBool()));
      if (fdp.ConsumeBool()) {
        std::string brealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
        MHD_response_add_auth_basic_challenge(r, brealm.c_str(), ToMhdBool(fdp.ConsumeBool()));
      }
    }
  } else {
    // For all other status code, randomly determine if challenges are added

    // Randomly choose if basic challenge is used or not
    if (fdp.ConsumeBool()) {
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
    }

    // Randomly choose if disgest challenge is used or not
    if (fdp.ConsumeBool()) {
      std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
      const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
      const char* domain = fdp.ConsumeBool() ? "/a /b"  : nullptr;
      enum MHD_DigestAuthMultiQOP mqop =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
      enum MHD_DigestAuthMultiAlgo malgo =
        fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
      MHD_response_add_auth_digest_challenge(
          r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
          mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
    }
  }
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  if (size == 0) {
    return 0;
  }
  FuzzedDataProvider fdp(data, size);

  // Pick a random response status code
  enum MHD_HTTP_StatusCode sc = pick_status_code(fdp);

  // Create a random response object
  struct MHD_Response* r = create_response(fdp, sc);
  if (!r) {
    return 0;
  }

  // Add random headers into the response object
  add_headers(fdp, r);

  // Set random options for the response object
  randomise_response_options(fdp, r);

  // Add authentication challenges to response
  add_auth(fdp, r, sc);

  // Fuzz additional targets on response status
  MHD_HTTP_status_code_to_string(sc);
  MHD_status_code_to_string((enum MHD_StatusCode)sc);

  // Destory the response object
  MHD_response_destroy(r);
  return 0;
}

Coverage Report

Created: 2025-10-13 06:05

Line	Count	Source
1		// Copyright 2025 Google LLC
2		//
3		// Licensed under the Apache License, Version 2.0 (the "License");
4		// you may not use this file except in compliance with the License.
5		// You may obtain a copy of the License at
6		//
7		// http://www.apache.org/licenses/LICENSE-2.0
8		//
9		// Unless required by applicable law or agreed to in writing, software
10		// distributed under the License is distributed on an "AS IS" BASIS,
11		// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12		// See the License for the specific language governing permissions and
13		// limitations under the License.
14		//
15		////////////////////////////////////////////////////////////////////////////////
16		#include <stdint.h>
17		#include <stddef.h>
18		#include <unistd.h>
19		#include <sys/types.h>
20
21		#include <vector>
22		#include <algorithm>
23
24		#include "mhd_helper.h"
25
26		static void request_ended_cb(void *cls,
27		const struct MHD_RequestEndedData *data,
28	0	void *request_app_context) {
29		// Do nothing
30	0	}
31
32	2.20k	static enum MHD_HTTP_StatusCode pick_status_code(FuzzedDataProvider &fdp) {
33		// Randomly pick a valid or invalid HTTP response status code
34	2.20k	return fdp.ConsumeBool()
35	2.20k	? fdp.PickValueInArray({
36	1.95k	MHD_HTTP_STATUS_OK, MHD_HTTP_STATUS_CREATED, MHD_HTTP_STATUS_NO_CONTENT,
37	1.95k	MHD_HTTP_STATUS_PARTIAL_CONTENT, MHD_HTTP_STATUS_BAD_REQUEST,
38	1.95k	MHD_HTTP_STATUS_UNAUTHORIZED, MHD_HTTP_STATUS_FORBIDDEN,
39	1.95k	MHD_HTTP_STATUS_NOT_FOUND, MHD_HTTP_STATUS_INTERNAL_SERVER_ERROR })
40	2.20k	: (enum MHD_HTTP_StatusCode)(fdp.ConsumeIntegralInRange<int>(0, 999));
41	2.20k	}
42
43		static MHD_Response* create_response(FuzzedDataProvider &fdp,
44	2.20k	enum MHD_HTTP_StatusCode sc) {
45	2.20k	struct MHD_Response* r = nullptr;
46
47		// Generate random response body
48	2.20k	const size_t body_len = fdp.ConsumeIntegralInRange<size_t>(
49	2.20k	0, std::min<size_t>(fdp.remaining_bytes(), 8192));
50	2.20k	std::string body = fdp.ConsumeBytesAsString(body_len);
51
52
53		// Randomly select which constructing function to use for respone object creation
54	2.20k	enum CtorKind {
55	2.20k	EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE
56	2.20k	};
57	2.20k	CtorKind ctor = fdp.PickValueInArray<CtorKind>(
58	2.20k	{EMPTY, BUF_STATIC, BUF_COPY, IOVEC, FROM_FD, FROM_PIPE});
59
60	2.20k	switch (ctor) {
61	0	default:
62	1.20k	case EMPTY: {
63		// Create empty response
64	1.20k	r = MHD_response_from_empty(sc);
65	1.20k	break;
66	0	}
67	191	case BUF_STATIC: {
68		// Create response with random body and static buffer status
69	191	r = MHD_response_from_buffer_static(sc, body.size(), body.c_str());
70	191	break;
71	0	}
72	346	case BUF_COPY: {
73		// Create response with random body and copy buffer in
74	346	r = MHD_response_from_buffer_copy(sc, body.size(), body.data());
75	346	break;
76	0	}
77	185	case IOVEC: {
78		// Create response from random IO vector
79	185	unsigned cnt = fdp.ConsumeIntegralInRange<unsigned>(0, 6);
80	185	std::vector<MHD_IoVec> iov(cnt);
81	185	std::vector<std::string> chunks; chunks.reserve(cnt);
82	749	for (unsigned i=0;i<cnt;i++) {
83	564	chunks.push_back(fdp.ConsumeBytesAsString(
84	564	fdp.ConsumeIntegralInRange<size_t>(0, 1024)));
85	564	iov[i].iov_base = chunks.back().data();
86	564	iov[i].iov_len = chunks.back().size();
87	564	}
88	185	r = MHD_response_from_iovec(sc, cnt ? cnt : 0, cnt ? iov.data() : nullptr, nullptr, nullptr);
89	185	break;
90	0	}
91	148	case FROM_FD: {
92		// Create response from file with random data
93	148	char path[] = "/tmp/mhdrespXXXXXX";
94	148	int fd = mkstemp(path);
95	148	if (fd >= 0) {
96	148	unlink(path);
97	148	if (!body.empty()) (void) ::write(fd, body.data(), body.size());
98	148	uint64_t sz = (uint64_t)body.size();
99	148	uint64_t off = 0;
100	148	if (fdp.ConsumeBool()) {
101	67	off = std::min<uint64_t>(sz, fdp.ConsumeIntegral<uint64_t>() % (sz + 1));
102	67	}
103	148	uint64_t len = (sz > off) ? (fdp.ConsumeIntegral<uint64_t>() % (sz - off + 1)) : 0;
104	148	r = MHD_response_from_fd(sc, fd, off, len);
105	148	if (!r) {
106	10	close(fd);
107	10	}
108	148	}
109	148	break;
110	0	}
111	132	case FROM_PIPE: {
112		// Create response by piping in random data
113	132	int pfd[2];
114	132	if (0 == pipe(pfd)) {
115	132	std::string pbytes = fdp.ConsumeBytesAsString(
116	132	fdp.ConsumeIntegralInRange<size_t>(0, 2048));
117	132	if (!pbytes.empty()) {
118	58	::write(pfd[1], pbytes.data(), pbytes.size());
119	58	}
120	132	close(pfd[1]);
121	132	r = MHD_response_from_pipe(sc, pfd[0]);
122	132	if (!r) {
123	8	close(pfd[0]);
124	8	}
125	132	}
126	132	break;
127	0	}
128	2.20k	}
129
130	2.20k	return r;
131	2.20k	}
132
133	2.13k	static void add_headers(FuzzedDataProvider &fdp, MHD_Response *r) {
134	2.13k	const char* ct = fdp.ConsumeBool() ? "text/plain" : "application/octet-stream";
135	2.13k	MHD_response_add_header(r, "Content-Type", ct);
136
137		// Add random standard headers
138	2.13k	size_t num_headers = fdp.ConsumeIntegralInRange<size_t>(0, 10);
139	4.39k	for (size_t i = 0; i < num_headers; i++) {
140	2.26k	std::string name = safe_ascii(fdp.ConsumeRandomLengthString(20), false);
141	2.26k	std::string val = safe_ascii(fdp.ConsumeRandomLengthString(60), true);
142	2.26k	MHD_response_add_header(r, name.c_str(), val.c_str());
143	2.26k	}
144
145		// Add random predefined header
146	2.13k	enum MHD_PredefinedHeader which =
147	2.13k	fdp.PickValueInArray<enum MHD_PredefinedHeader>(
148	2.13k	{ MHD_PREDEF_ACCEPT_CHARSET, MHD_PREDEF_ACCEPT_LANGUAGE });
149	2.13k	std::string value = safe_ascii(fdp.ConsumeRandomLengthString(32));
150	2.13k	MHD_response_add_predef_header(r, which, value.c_str());
151	2.13k	}
152
153	2.13k	static void randomise_response_options(FuzzedDataProvider &fdp, MHD_Response *r) {
154	2.13k	if (fdp.ConsumeBool()) {
155	130	auto o = MHD_R_OPTION_REUSABLE(ToMhdBool(fdp.ConsumeBool()));
156	130	MHD_response_set_option(r, &o);
157	130	}
158	2.13k	if (fdp.ConsumeBool()) {
159	126	auto o = MHD_R_OPTION_HEAD_ONLY_RESPONSE(ToMhdBool(fdp.ConsumeBool()));
160	126	MHD_response_set_option(r, &o);
161	126	}
162	2.13k	if (fdp.ConsumeBool()) {
163	125	auto o = MHD_R_OPTION_CHUNKED_ENC(ToMhdBool(fdp.ConsumeBool()));
164	125	MHD_response_set_option(r, &o);
165	125	}
166	2.13k	if (fdp.ConsumeBool()) {
167	135	auto o = MHD_R_OPTION_CONN_CLOSE(ToMhdBool(fdp.ConsumeBool()));
168	135	MHD_response_set_option(r, &o);
169	135	}
170	2.13k	if (fdp.ConsumeBool()) {
171	132	auto o = MHD_R_OPTION_HTTP_1_0_SERVER(ToMhdBool(fdp.ConsumeBool()));
172	132	MHD_response_set_option(r, &o);
173	132	}
174	2.13k	if (fdp.ConsumeBool()) {
175	110	auto o = MHD_R_OPTION_HTTP_1_0_COMPATIBLE_STRICT(ToMhdBool(fdp.ConsumeBool()));
176	110	MHD_response_set_option(r, &o);
177	110	}
178	2.13k	if (fdp.ConsumeBool()) {
179	123	auto o = MHD_R_OPTION_INSANITY_HEADER_CONTENT_LENGTH(ToMhdBool(fdp.ConsumeBool()));
180	123	MHD_response_set_option(r, &o);
181	123	}
182	2.13k	if (fdp.ConsumeBool()) {
183	479	auto o = MHD_R_OPTION_TERMINATION_CALLBACK(&request_ended_cb, nullptr);
184	479	MHD_response_set_option(r, &o);
185	479	}
186	2.13k	}
187
188		static void add_auth(FuzzedDataProvider &fdp, MHD_Response *r,
189	2.13k	enum MHD_HTTP_StatusCode sc) {
190	2.13k	if (sc == MHD_HTTP_STATUS_UNAUTHORIZED) {
191		// Randomly add different challenge under 401 status code
192	971	if (fdp.ConsumeBool()) {
193		// Use digest challenge
194	389	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
195	389	MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
196	389	if (fdp.ConsumeBool()) {
197	330	std::string drealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
198	330	const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
199	330	const char* domain = fdp.ConsumeBool() ? "/a /b" : nullptr;
200	330	enum MHD_DigestAuthMultiQOP mqop =
201	330	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
202	330	enum MHD_DigestAuthMultiAlgo malgo =
203	330	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
204	330	MHD_response_add_auth_digest_challenge(
205	330	r, drealm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
206	330	mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
207	330	}
208	582	} else {
209		// Use basic challenge
210	582	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
211	582	const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
212	582	const char* domain = fdp.ConsumeBool() ? "/a /b" : nullptr;
213	582	enum MHD_DigestAuthMultiQOP mqop =
214	582	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
215	582	enum MHD_DigestAuthMultiAlgo malgo =
216	582	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
217	582	MHD_response_add_auth_digest_challenge(
218	582	r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
219	582	mqop, malgo, ToMhdBool(fdp.ConsumeBool()),
220	582	ToMhdBool(fdp.ConsumeBool()));
221	582	if (fdp.ConsumeBool()) {
222	270	std::string brealm = safe_ascii(fdp.ConsumeRandomLengthString(24));
223	270	MHD_response_add_auth_basic_challenge(r, brealm.c_str(), ToMhdBool(fdp.ConsumeBool()));
224	270	}
225	582	}
226	1.16k	} else {
227		// For all other status code, randomly determine if challenges are added
228
229		// Randomly choose if basic challenge is used or not
230	1.16k	if (fdp.ConsumeBool()) {
231	191	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
232	191	MHD_response_add_auth_basic_challenge(r, realm.c_str(), ToMhdBool(fdp.ConsumeBool()));
233	191	}
234
235		// Randomly choose if disgest challenge is used or not
236	1.16k	if (fdp.ConsumeBool()) {
237	351	std::string realm = safe_ascii(fdp.ConsumeRandomLengthString(24));
238	351	const char* opaque = fdp.ConsumeBool() ? "opaque" : nullptr;
239	351	const char* domain = fdp.ConsumeBool() ? "/a /b" : nullptr;
240	351	enum MHD_DigestAuthMultiQOP mqop =
241	351	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_QOP_AUTH : MHD_DIGEST_AUTH_MULT_QOP_AUTH_INT;
242	351	enum MHD_DigestAuthMultiAlgo malgo =
243	351	fdp.ConsumeBool()? MHD_DIGEST_AUTH_MULT_ALGO_ANY : MHD_DIGEST_AUTH_MULT_ALGO_MD5;
244	351	MHD_response_add_auth_digest_challenge(
245	351	r, realm.c_str(), opaque, domain, ToMhdBool(fdp.ConsumeBool()),
246	351	mqop, malgo, ToMhdBool(fdp.ConsumeBool()), ToMhdBool(fdp.ConsumeBool()));
247	351	}
248	1.16k	}
249	2.13k	}
250
251	2.20k	extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
252	2.20k	if (size == 0) {
253	0	return 0;
254	0	}
255	2.20k	FuzzedDataProvider fdp(data, size);
256
257		// Pick a random response status code
258	2.20k	enum MHD_HTTP_StatusCode sc = pick_status_code(fdp);
259
260		// Create a random response object
261	2.20k	struct MHD_Response* r = create_response(fdp, sc);
262	2.20k	if (!r) {
263	72	return 0;
264	72	}
265
266		// Add random headers into the response object
267	2.13k	add_headers(fdp, r);
268
269		// Set random options for the response object
270	2.13k	randomise_response_options(fdp, r);
271
272		// Add authentication challenges to response
273	2.13k	add_auth(fdp, r, sc);
274
275		// Fuzz additional targets on response status
276	2.13k	MHD_HTTP_status_code_to_string(sc);
277	2.13k	MHD_status_code_to_string((enum MHD_StatusCode)sc);
278
279		// Destory the response object
280	2.13k	MHD_response_destroy(r);
281	2.13k	return 0;
282	2.20k	}