Coverage Report

Created: 2026-07-16 06:59

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/librabbitmq/fuzz/fuzz_handle_input.c
Line
Count
Source
1
// Copyright 2007 - 2026, Arthur Chan and the rabbitmq-c contributors.
2
// SPDX-License-Identifier: mit
3
4
#include <errno.h>
5
#include <inttypes.h>
6
#include <stdio.h>
7
#include <stdlib.h>
8
#include <string.h>
9
10
#include <rabbitmq-c/amqp.h>
11
#include <rabbitmq-c/framing.h>
12
13
// Drives amqp_handle_input(), the byte->frame wire parser, feeding the input one
14
// frame at a time and advancing by the number of bytes it reports consuming.
15
4.91k
extern int LLVMFuzzerTestOneInput(const char *data, size_t size) {
16
17
4.91k
  amqp_connection_state_t conn;
18
4.91k
  amqp_bytes_t buffer;
19
4.91k
  size_t iterations = 0;
20
21
4.91k
  if (size == 0) {
22
0
    return 0;
23
0
  }
24
25
4.91k
  conn = amqp_new_connection();
26
4.91k
  if (conn == NULL) {
27
0
    return 0;
28
0
  }
29
30
4.91k
  buffer.bytes = (void *)data;
31
4.91k
  buffer.len = size;
32
33
51.1k
  while (buffer.len > 0 && iterations < 4096) {
34
49.4k
    amqp_frame_t frame;
35
49.4k
    int res;
36
37
49.4k
    memset(&frame, 0, sizeof(frame));
38
49.4k
    res = amqp_handle_input(conn, buffer, &frame);
39
49.4k
    if (res <= 0) {
40
3.17k
      break;
41
3.17k
    }
42
43
46.2k
    buffer.bytes = (void *)((const char *)buffer.bytes + (size_t)res);
44
46.2k
    buffer.len -= (size_t)res;
45
46
46.2k
    if (frame.frame_type != 0) {
47
21.9k
      amqp_maybe_release_buffers_on_channel(conn, frame.channel);
48
21.9k
    }
49
50
46.2k
    iterations++;
51
46.2k
  }
52
53
4.91k
  amqp_destroy_connection(conn);
54
4.91k
  return 0;
55
4.91k
}