Coverage Report

Created: 2026-09-14 06:46

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/llhttp/test/fuzzers/fuzz_parser.c
Line
Count
Source
1
#include "llhttp.h"
2
#include <stdio.h>
3
#include <stdlib.h>
4
#include <string.h>
5
6
32.6k
int handle_on_message_complete(llhttp_t *arg) { return 0; }
7
8
4.46k
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
9
4.46k
  llhttp_t parser;
10
4.46k
  llhttp_settings_t settings;
11
4.46k
  llhttp_type_t http_type;
12
13
  /* We need four bytes to determine variable parameters */
14
4.46k
  if (size < 4) {
15
2
    return 0;
16
2
  }
17
18
4.46k
  int headers = (data[0] & 0x01) == 1;
19
4.46k
  int chunked_length = (data[1] & 0x01) == 1;
20
4.46k
  int keep_alive = (data[2] & 0x01) == 1;
21
4.46k
  if (data[0] % 3 == 0) {
22
1.79k
    http_type = HTTP_BOTH;
23
2.66k
  } else if (data[0] % 3 == 1) {
24
2.24k
    http_type = HTTP_REQUEST;
25
2.24k
  } else {
26
429
    http_type = HTTP_RESPONSE;
27
429
  }
28
4.46k
  data += 4;
29
4.46k
  size -= 4;
30
31
  /* Initialize user callbacks and settings */
32
4.46k
  llhttp_settings_init(&settings);
33
34
  /* Set user callback */
35
4.46k
  settings.on_message_complete = handle_on_message_complete;
36
37
4.46k
  llhttp_init(&parser, http_type, &settings);
38
4.46k
  llhttp_set_lenient_headers(&parser, headers);
39
4.46k
  llhttp_set_lenient_chunked_length(&parser, chunked_length);
40
4.46k
  llhttp_set_lenient_keep_alive(&parser, keep_alive);
41
42
4.46k
  llhttp_execute(&parser, data, size);
43
44
4.46k
  return 0;
45
4.46k
}