Coverage Report

Created: 2026-10-17 07:09

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/fuzz_request.c
Line
Count
Source
1
/* Copyright 2026 Google LLC
2
3
Licensed under the Apache License, Version 2.0 (the "License");
4
you may not use this file except in compliance with the License.
5
You may obtain a copy of the License at
6
7
      http://www.apache.org/licenses/LICENSE-2.0
8
9
Unless required by applicable law or agreed to in writing, software
10
distributed under the License is distributed on an "AS IS" BASIS,
11
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
See the License for the specific language governing permissions and
13
limitations under the License.
14
*/
15
16
#include <stdio.h>
17
#include <stdlib.h>
18
#include <stdint.h>
19
#include <string.h>
20
21
#include "first.h"
22
#include "buffer.h"
23
#include "array.h"
24
#include "http_header.h"
25
#include "request.h"
26
27
3.94k
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
28
3.94k
    if (size < 2 || size > 65536) {
29
11
        return 0;
30
11
    }
31
32
3.93k
    const int scheme_port = (data[0] & 1u) ? 443 : 80;
33
3.93k
    const unsigned int parseopts = (unsigned int)data[0] >> 1;
34
3.93k
    ++data; --size;
35
36
3.93k
    char *hdrs = (char *)malloc(size + 1);
37
3.93k
    if (NULL == hdrs) return 0;
38
3.93k
    memcpy(hdrs, data, size);
39
3.93k
    hdrs[size] = '\0';
40
41
    /* h1.c seeds hoff with the line count and the base offset */
42
3.93k
    unsigned short *hoff = (unsigned short *)malloc(8192 * sizeof(unsigned short));
43
3.93k
    if (NULL == hoff) { free(hdrs); return 0; }
44
3.93k
    hoff[0] = 1;
45
3.93k
    hoff[1] = 0;
46
47
3.93k
    const uint32_t hlen = http_header_parse_hoff(hdrs, (uint32_t)size, hoff);
48
49
3.93k
    if (0 != hlen && hoff[0] < 8192 - 1) {
50
3.84k
        request_st r;
51
3.84k
        memset(&r, 0, sizeof(request_st));
52
3.84k
        r.conf.http_parseopts = parseopts;
53
3.84k
        r.conf.max_request_field_size = 8192;
54
3.84k
        r.http_method = HTTP_METHOD_UNSET;
55
3.84k
        r.http_version = HTTP_VERSION_UNSET;
56
3.84k
        r.server_name = &r.uri.authority;
57
        /* request_init_data() takes this from srv->tmp_buf */
58
3.84k
        buffer * const tmp_buf = buffer_init();
59
3.84k
        r.tmp_buf = tmp_buf;
60
61
3.84k
        http_request_headers_process(&r, hdrs, hoff, scheme_port);
62
63
3.84k
        buffer_free(tmp_buf);
64
3.84k
        array_free_data(&r.rqst_headers);
65
3.84k
        buffer_free_ptr(&r.target);
66
3.84k
        buffer_free_ptr(&r.target_orig);
67
3.84k
        buffer_free_ptr(&r.uri.scheme);
68
3.84k
        buffer_free_ptr(&r.uri.authority);
69
3.84k
        buffer_free_ptr(&r.uri.path);
70
3.84k
        buffer_free_ptr(&r.uri.query);
71
3.84k
        buffer_free_ptr(&r.pathinfo);
72
3.84k
        buffer_free_ptr(&r.physical.path);
73
3.84k
        buffer_free_ptr(&r.physical.basedir);
74
3.84k
        buffer_free_ptr(&r.physical.doc_root);
75
3.84k
        buffer_free_ptr(&r.physical.rel_path);
76
3.84k
    }
77
78
3.93k
    free(hoff);
79
3.93k
    free(hdrs);
80
3.93k
    return 0;
81
3.93k
}