Line | Count | Source |
1 | | /* Copyright 2026 Google LLC |
2 | | |
3 | | Licensed under the Apache License, Version 2.0 (the "License"); |
4 | | you may not use this file except in compliance with the License. |
5 | | You may obtain a copy of the License at |
6 | | |
7 | | http://www.apache.org/licenses/LICENSE-2.0 |
8 | | |
9 | | Unless required by applicable law or agreed to in writing, software |
10 | | distributed under the License is distributed on an "AS IS" BASIS, |
11 | | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
12 | | See the License for the specific language governing permissions and |
13 | | limitations under the License. |
14 | | */ |
15 | | |
16 | | #include <stdio.h> |
17 | | #include <stdlib.h> |
18 | | #include <stdint.h> |
19 | | #include <string.h> |
20 | | |
21 | | #include "first.h" |
22 | | #include "buffer.h" |
23 | | #include "array.h" |
24 | | #include "http_header.h" |
25 | | #include "request.h" |
26 | | |
27 | 3.94k | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
28 | 3.94k | if (size < 2 || size > 65536) { |
29 | 11 | return 0; |
30 | 11 | } |
31 | | |
32 | 3.93k | const int scheme_port = (data[0] & 1u) ? 443 : 80; |
33 | 3.93k | const unsigned int parseopts = (unsigned int)data[0] >> 1; |
34 | 3.93k | ++data; --size; |
35 | | |
36 | 3.93k | char *hdrs = (char *)malloc(size + 1); |
37 | 3.93k | if (NULL == hdrs) return 0; |
38 | 3.93k | memcpy(hdrs, data, size); |
39 | 3.93k | hdrs[size] = '\0'; |
40 | | |
41 | | /* h1.c seeds hoff with the line count and the base offset */ |
42 | 3.93k | unsigned short *hoff = (unsigned short *)malloc(8192 * sizeof(unsigned short)); |
43 | 3.93k | if (NULL == hoff) { free(hdrs); return 0; } |
44 | 3.93k | hoff[0] = 1; |
45 | 3.93k | hoff[1] = 0; |
46 | | |
47 | 3.93k | const uint32_t hlen = http_header_parse_hoff(hdrs, (uint32_t)size, hoff); |
48 | | |
49 | 3.93k | if (0 != hlen && hoff[0] < 8192 - 1) { |
50 | 3.84k | request_st r; |
51 | 3.84k | memset(&r, 0, sizeof(request_st)); |
52 | 3.84k | r.conf.http_parseopts = parseopts; |
53 | 3.84k | r.conf.max_request_field_size = 8192; |
54 | 3.84k | r.http_method = HTTP_METHOD_UNSET; |
55 | 3.84k | r.http_version = HTTP_VERSION_UNSET; |
56 | 3.84k | r.server_name = &r.uri.authority; |
57 | | /* request_init_data() takes this from srv->tmp_buf */ |
58 | 3.84k | buffer * const tmp_buf = buffer_init(); |
59 | 3.84k | r.tmp_buf = tmp_buf; |
60 | | |
61 | 3.84k | http_request_headers_process(&r, hdrs, hoff, scheme_port); |
62 | | |
63 | 3.84k | buffer_free(tmp_buf); |
64 | 3.84k | array_free_data(&r.rqst_headers); |
65 | 3.84k | buffer_free_ptr(&r.target); |
66 | 3.84k | buffer_free_ptr(&r.target_orig); |
67 | 3.84k | buffer_free_ptr(&r.uri.scheme); |
68 | 3.84k | buffer_free_ptr(&r.uri.authority); |
69 | 3.84k | buffer_free_ptr(&r.uri.path); |
70 | 3.84k | buffer_free_ptr(&r.uri.query); |
71 | 3.84k | buffer_free_ptr(&r.pathinfo); |
72 | 3.84k | buffer_free_ptr(&r.physical.path); |
73 | 3.84k | buffer_free_ptr(&r.physical.basedir); |
74 | 3.84k | buffer_free_ptr(&r.physical.doc_root); |
75 | 3.84k | buffer_free_ptr(&r.physical.rel_path); |
76 | 3.84k | } |
77 | | |
78 | 3.93k | free(hoff); |
79 | 3.93k | free(hdrs); |
80 | 3.93k | return 0; |
81 | 3.93k | } |