Coverage Report

Created: 2026-09-14 06:50

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/nghttp2/fuzz/fuzz_target_fdp.cc
Line
Count
Source
1
#include <string>
2
#include <vector>
3
#include <fuzzer/FuzzedDataProvider.h>
4
5
#include <nghttp2/nghttp2.h>
6
7
namespace {
8
int on_frame_recv_callback(nghttp2_session *session, const nghttp2_frame *frame,
9
66.4k
                           void *user_data) {
10
66.4k
  return 0;
11
66.4k
}
12
} // namespace
13
14
namespace {
15
int on_begin_headers_callback(nghttp2_session *session,
16
18.2k
                              const nghttp2_frame *frame, void *user_data) {
17
18.2k
  return 0;
18
18.2k
}
19
} // namespace
20
21
namespace {
22
int on_header_callback2(nghttp2_session *session, const nghttp2_frame *frame,
23
                        nghttp2_rcbuf *name, nghttp2_rcbuf *value,
24
32.3k
                        uint8_t flags, void *user_data) {
25
32.3k
  return 0;
26
32.3k
}
27
} // namespace
28
29
namespace {
30
int before_frame_send_callback(nghttp2_session *session,
31
42.1k
                               const nghttp2_frame *frame, void *user_data) {
32
42.1k
  return 0;
33
42.1k
}
34
} // namespace
35
36
namespace {
37
int on_frame_send_callback(nghttp2_session *session, const nghttp2_frame *frame,
38
42.1k
                           void *user_data) {
39
42.1k
  return 0;
40
42.1k
}
41
} // namespace
42
43
namespace {
44
20.3k
void send_pending(nghttp2_session *session) {
45
62.5k
  for (;;) {
46
62.5k
    const uint8_t *data;
47
62.5k
    auto n = nghttp2_session_mem_send2(session, &data);
48
62.5k
    if (n == 0) {
49
20.3k
      return;
50
20.3k
    }
51
62.5k
  }
52
20.3k
}
53
} // namespace
54
55
10.1k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
56
10.1k
  nghttp2_session *session;
57
10.1k
  nghttp2_session_callbacks *callbacks;
58
59
10.1k
  nghttp2_session_callbacks_new(&callbacks);
60
10.1k
  nghttp2_session_callbacks_set_on_frame_recv_callback(callbacks,
61
10.1k
                                                       on_frame_recv_callback);
62
10.1k
  nghttp2_session_callbacks_set_on_begin_headers_callback(
63
10.1k
    callbacks, on_begin_headers_callback);
64
10.1k
  nghttp2_session_callbacks_set_on_header_callback2(callbacks,
65
10.1k
                                                    on_header_callback2);
66
10.1k
  nghttp2_session_callbacks_set_before_frame_send_callback(
67
10.1k
    callbacks, before_frame_send_callback);
68
10.1k
  nghttp2_session_callbacks_set_on_frame_send_callback(callbacks,
69
10.1k
                                                       on_frame_send_callback);
70
71
10.1k
  nghttp2_session_server_new(&session, callbacks, nullptr);
72
10.1k
  nghttp2_session_callbacks_del(callbacks);
73
74
10.1k
  FuzzedDataProvider data_provider(data, size);
75
76
  /* Initialise a random iv */
77
10.1k
  nghttp2_settings_entry *iv;
78
10.1k
  int size_of_iv = data_provider.ConsumeIntegralInRange(1, 10);
79
10.1k
  iv = (nghttp2_settings_entry *)malloc(sizeof(nghttp2_settings_entry) *
80
10.1k
                                        size_of_iv);
81
21.5k
  for (int i = 0; i < size_of_iv; i++) {
82
11.3k
    iv[i].settings_id = data_provider.ConsumeIntegralInRange(0, 1000);
83
11.3k
    iv[i].value = data_provider.ConsumeIntegralInRange(0, 1000);
84
11.3k
  }
85
86
10.1k
  nghttp2_submit_settings(session, NGHTTP2_FLAG_NONE, iv, size_of_iv);
87
10.1k
  send_pending(session);
88
89
10.1k
  std::vector<uint8_t> d = data_provider.ConsumeRemainingBytes<uint8_t>();
90
10.1k
  nghttp2_session_mem_recv2(session, d.data(), d.size());
91
92
10.1k
  send_pending(session);
93
94
10.1k
  nghttp2_session_del(session);
95
96
10.1k
  free(iv);
97
98
10.1k
  return 0;
99
10.1k
}