/*

 * Licensed to the Apache Software Foundation (ASF) under one or more

 * contributor license agreements.  Licensed under the Apache License,

 * Version 2.0 (the "License"); you may not use this file except in

 * compliance with the License.  You may obtain a copy of the License at

 *

 *   http://www.apache.org/licenses/LICENSE-2.0

 *

 * Copyright (C) 2017-2026 ZmartZone Holding BV - hans.zandbelt@openidc.com

 *

 * fuzz.h -- shared declarations for the fuzz targets under test/fuzz/.

 *

 * Each target implements the libFuzzer entry point below. The same object

 * builds two ways:

 *   - linked with standalone.c + plain cc  -> a corpus-replay binary run by

 *     test/fuzz/run-fuzzers.sh as part of `make check` (regression guard);

 *   - compiled with `clang -fsanitize=fuzzer` -> a real libFuzzer binary

 *     (libFuzzer provides main); see test/fuzz/build.sh.

 */

#ifndef _MOD_AUTH_OPENIDC_TEST_FUZZ_H_

#define _MOD_AUTH_OPENIDC_TEST_FUZZ_H_

#include <apr_pools.h>

#include <stddef.h>

#include <stdint.h>

#include <string.h>

/* the one entry point every fuzz target implements */

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);

/*

 * Copy the fuzzer's input bytes into a NUL-terminated string on the given pool.

 *

 * Deliberately not apr_pstrmemdup(): APR declares that function with

 * __attribute__((alloc_size(3))), which tells the compiler the result is n

 * bytes long although APR allocates n + 1 -- so under gcc's UBSan object-size

 * check (the CI sanitizers job builds the targets with -fsanitize=undefined

 * -fno-sanitize-recover) a harness that reads the terminator, or [0] of an

 * empty input, is reported as an out-of-object load and the replay aborts.

 * apr_palloc's own size annotation is truthful, so this copy is not.

 */

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

  char *s = apr_palloc(pool, size + 1);

  if (size > 0)

    memcpy(s, data, size);

  s[size] = '\0';

  return s;

}

Unexecuted instantiation: fuzz_response_header.c:fuzz_strndup

Unexecuted instantiation: fuzz_json.c:fuzz_strndup

Unexecuted instantiation: fuzz_state_cookie.c:fuzz_strndup

fuzz_bearer_token.c:fuzz_strndup

Line

Count

Source

43

7.56k

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

7.56k

  char *s = apr_palloc(pool, size + 1);

45

7.56k

  if (size > 0)

46

7.54k

    memcpy(s, data, size);

47

7.56k

  s[size] = '\0';

48

7.56k

  return s;

49

7.56k

}

fuzz_redirect_uri.c:fuzz_strndup

Line

Count

Source

43

4.60k

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

4.60k

  char *s = apr_palloc(pool, size + 1);

45

4.60k

  if (size > 0)

46

4.58k

    memcpy(s, data, size);

47

4.60k

  s[size] = '\0';

48

4.60k

  return s;

49

4.60k

}

fuzz_backchannel_logout.c:fuzz_strndup

Line

Count

Source

43

7.50k

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

7.50k

  char *s = apr_palloc(pool, size + 1);

45

7.50k

  if (size > 0)

46

7.50k

    memcpy(s, data, size);

47

7.50k

  s[size] = '\0';

48

7.50k

  return s;

49

7.50k

}

Unexecuted instantiation: fuzz_discovery_response.c:fuzz_strndup

fuzz_authz_response.c:fuzz_strndup

Line

Count

Source

43

6.83k

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

6.83k

  char *s = apr_palloc(pool, size + 1);

45

6.83k

  if (size > 0)

46

6.80k

    memcpy(s, data, size);

47

6.83k

  s[size] = '\0';

48

6.83k

  return s;

49

6.83k

}

Unexecuted instantiation: fuzz_jwt.c:fuzz_strndup

Unexecuted instantiation: fuzz_cookie.c:fuzz_strndup

fuzz_post_preserve.c:fuzz_strndup

Line

Count

Source

43

780

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

780

  char *s = apr_palloc(pool, size + 1);

45

780

  if (size > 0)

46

780

    memcpy(s, data, size);

47

780

  s[size] = '\0';

48

780

  return s;

49

780

}

Unexecuted instantiation: fuzz_pem_key.c:fuzz_strndup

Unexecuted instantiation: fuzz_metadata.c:fuzz_strndup

fuzz_strings.c:fuzz_strndup

Line

Count

Source

43

3.45k

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

3.45k

  char *s = apr_palloc(pool, size + 1);

45

3.45k

  if (size > 0)

46

3.45k

    memcpy(s, data, size);

47

3.45k

  s[size] = '\0';

48

3.45k

  return s;

49

3.45k

}

Unexecuted instantiation: fuzz_jwks.c:fuzz_strndup

fuzz_current_url.c:fuzz_strndup

Line

Count

Source

43

381

static inline char *fuzz_strndup(apr_pool_t *pool, const uint8_t *data, size_t size) {

44

381

  char *s = apr_palloc(pool, size + 1);

45

381

  if (size > 0)

46

381

    memcpy(s, data, size);

47

381

  s[size] = '\0';

48

381

  return s;

49

381

}

Unexecuted instantiation: fuzz_url.c:fuzz_strndup

Unexecuted instantiation: fuzz_base64.c:fuzz_strndup

Unexecuted instantiation: fuzz_form_params.c:fuzz_strndup

/*

 * One-time fixture setup (oidc_test_setup), implemented by every target.

 * libFuzzer and honggfuzz call this once at startup; AFL++'s driver calls it

 * *before* spawning its deferred forkserver, and that ordering is the point:

 * the full post-config fixture init must run once in the forkserver parent,

 * not inside every forked child's first LLVMFuzzerTestOneInput call, where

 * afl-fuzz's per-exec timeout (5s in the OSS-Fuzz build check) counts it.

 * afl-fuzz also injects LSAN_OPTIONS containing fast_unwind_on_malloc=0 into

 * the target environment, which makes ASan DWARF-unwind every allocation the

 * init makes and inflates that first exec from ~0.2s to seconds -- the cause

 * of the "All test cases time out" OSS-Fuzz build-check failures on the afl

 * engine. Targets keep a lazy fallback in LLVMFuzzerTestOneInput for runners

 * that do not call this (the standalone corpus-replay main).

 */

int LLVMFuzzerInitialize(int *argc, char ***argv);

#endif /* _MOD_AUTH_OPENIDC_TEST_FUZZ_H_ */