Coverage Report

Created: 2026-01-09 06:46

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/llhttp/test/fuzzers/fuzz_parser.c
Line
Count
Source
1
#include "llhttp.h"
2
#include <stdio.h>
3
#include <stdlib.h>
4
#include <string.h>
5
6
35.5k
int handle_on_message_complete(llhttp_t *arg) { return 0; }
7
8
5.36k
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
9
5.36k
  llhttp_t parser;
10
5.36k
  llhttp_settings_t settings;
11
5.36k
  llhttp_type_t http_type;
12
13
  /* We need four bytes to determine variable parameters */
14
5.36k
  if (size < 4) {
15
2
    return 0;
16
2
  }
17
18
5.36k
  int headers = (data[0] & 0x01) == 1;
19
5.36k
  int chunked_length = (data[1] & 0x01) == 1;
20
5.36k
  int keep_alive = (data[2] & 0x01) == 1;
21
5.36k
  if (data[0] % 3 == 0) {
22
2.56k
    http_type = HTTP_BOTH;
23
2.80k
  } else if (data[0] % 3 == 1) {
24
2.30k
    http_type = HTTP_REQUEST;
25
2.30k
  } else {
26
503
    http_type = HTTP_RESPONSE;
27
503
  }
28
5.36k
  data += 4;
29
5.36k
  size -= 4;
30
31
  /* Initialize user callbacks and settings */
32
5.36k
  llhttp_settings_init(&settings);
33
34
  /* Set user callback */
35
5.36k
  settings.on_message_complete = handle_on_message_complete;
36
37
5.36k
  llhttp_init(&parser, http_type, &settings);
38
5.36k
  llhttp_set_lenient_headers(&parser, headers);
39
5.36k
  llhttp_set_lenient_chunked_length(&parser, chunked_length);
40
5.36k
  llhttp_set_lenient_keep_alive(&parser, keep_alive);
41
42
5.36k
  llhttp_execute(&parser, data, size);
43
44
5.36k
  return 0;
45
5.36k
}