/*

 * Licensed to the Apache Software Foundation (ASF) under one or more

 * contributor license agreements.  Licensed under the Apache License,

 * Version 2.0 (the "License"); you may not use this file except in

 * compliance with the License.  You may obtain a copy of the License at

 *

 *   http://www.apache.org/licenses/LICENSE-2.0

 *

 * Copyright (C) 2017-2026 ZmartZone Holding BV - hans.zandbelt@openidc.com

 *

 * fuzz.h -- shared declarations for the fuzz targets under test/fuzz/.

 *

 * Each target implements the libFuzzer entry point below. The same object

 * builds two ways:

 *   - linked with standalone.c + plain cc  -> a corpus-replay binary run by

 *     test/fuzz/run-fuzzers.sh as part of `make check` (regression guard);

 *   - compiled with `clang -fsanitize=fuzzer` -> a real libFuzzer binary

 *     (libFuzzer provides main); see test/fuzz/build.sh.

 */

#ifndef _MOD_AUTH_OPENIDC_TEST_FUZZ_H_

#define _MOD_AUTH_OPENIDC_TEST_FUZZ_H_

#include <apr_pools.h>

#include <stddef.h>

#include <stdint.h>

#include <string.h>

/* the one entry point every fuzz target implements */

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);

/*

 * Copy the fuzzer's input bytes into a NUL-terminated string on the given pool.

 *

 * Deliberately not apr_pstrmemdup(): APR declares that function with

 * __attribute__((alloc_size(3))), which tells the compiler the result is n

 * bytes long although APR allocates n + 1 -- so under gcc's UBSan object-size

 * check (the CI sanitizers job builds the targets with -fsanitize=undefined

 * -fno-sanitize-recover) a harness that reads the terminator, or [0] of an

 * empty input, is reported as an out-of-object load and the replay aborts.

 * apr_palloc's own size annotation is truthful, so this copy is not.

 */

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

  char *s = apr_palloc(pool, size + 1);

  if (size > 0)

    memcpy(s, data, size);

  s[size] = '\0';

  return s;

}

Unexecuted instantiation: fuzz_response_header.c:fuzz_strndup

Unexecuted instantiation: fuzz_json.c:fuzz_strndup

Unexecuted instantiation: fuzz_state_cookie.c:fuzz_strndup

fuzz_bearer_token.c:fuzz_strndup

Line

Count

Source

43

6.70k

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

6.70k

  char *s = apr_palloc(pool, size + 1);

45

6.70k

  if (size > 0)

46

6.68k

    memcpy(s, data, size);

47

6.70k

  s[size] = '\0';

48

6.70k

  return s;

49

6.70k

}

fuzz_redirect_uri.c:fuzz_strndup

Line

Count

Source

43

4.30k

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

4.30k

  char *s = apr_palloc(pool, size + 1);

45

4.30k

  if (size > 0)

46

4.28k

    memcpy(s, data, size);

47

4.30k

  s[size] = '\0';

48

4.30k

  return s;

49

4.30k

}

fuzz_backchannel_logout.c:fuzz_strndup

Line

Count

Source

43

7.08k

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

7.08k

  char *s = apr_palloc(pool, size + 1);

45

7.08k

  if (size > 0)

46

7.08k

    memcpy(s, data, size);

47

7.08k

  s[size] = '\0';

48

7.08k

  return s;

49

7.08k

}

Unexecuted instantiation: fuzz_discovery_response.c:fuzz_strndup

fuzz_authz_response.c:fuzz_strndup

Line

Count

Source

43

6.86k

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

6.86k

  char *s = apr_palloc(pool, size + 1);

45

6.86k

  if (size > 0)

46

6.83k

    memcpy(s, data, size);

47

6.86k

  s[size] = '\0';

48

6.86k

  return s;

49

6.86k

}

Unexecuted instantiation: fuzz_jwt.c:fuzz_strndup

Unexecuted instantiation: fuzz_cookie.c:fuzz_strndup

fuzz_post_preserve.c:fuzz_strndup

Line

Count

Source

43

763

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

763

  char *s = apr_palloc(pool, size + 1);

45

763

  if (size > 0)

46

763

    memcpy(s, data, size);

47

763

  s[size] = '\0';

48

763

  return s;

49

763

}

Unexecuted instantiation: fuzz_pem_key.c:fuzz_strndup

Unexecuted instantiation: fuzz_metadata.c:fuzz_strndup

fuzz_strings.c:fuzz_strndup

Line

Count

Source

43

3.26k

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

3.26k

  char *s = apr_palloc(pool, size + 1);

45

3.26k

  if (size > 0)

46

3.26k

    memcpy(s, data, size);

47

3.26k

  s[size] = '\0';

48

3.26k

  return s;

49

3.26k

}

Unexecuted instantiation: fuzz_jwks.c:fuzz_strndup

fuzz_current_url.c:fuzz_strndup

Line

Count

Source

43

377

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

377

  char *s = apr_palloc(pool, size + 1);

45

377

  if (size > 0)

46

377

    memcpy(s, data, size);

47

377

  s[size] = '\0';

48

377

  return s;

49

377

}

Unexecuted instantiation: fuzz_url.c:fuzz_strndup

Unexecuted instantiation: fuzz_base64.c:fuzz_strndup

Unexecuted instantiation: fuzz_form_params.c:fuzz_strndup

/*

 * One-time fixture setup (oidc_test_setup), implemented by every target.

 * libFuzzer and honggfuzz call this once at startup; AFL++'s driver calls it

 * *before* spawning its deferred forkserver, and that ordering is the point:

 * the full post-config fixture init must run once in the forkserver parent,

 * not inside every forked child's first LLVMFuzzerTestOneInput call, where

 * afl-fuzz's per-exec timeout (5s in the OSS-Fuzz build check) counts it.

 * afl-fuzz also injects LSAN_OPTIONS containing fast_unwind_on_malloc=0 into

 * the target environment, which makes ASan DWARF-unwind every allocation the

 * init makes and inflates that first exec from ~0.2s to seconds -- the cause

 * of the "All test cases time out" OSS-Fuzz build-check failures on the afl

 * engine. Targets keep a lazy fallback in LLVMFuzzerTestOneInput for runners

 * that do not call this (the standalone corpus-replay main).

 */

int LLVMFuzzerInitialize(int *argc, char ***argv);

#endif /* _MOD_AUTH_OPENIDC_TEST_FUZZ_H_ */