Coverage Report

Created: 2026-07-30 06:49

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/librabbitmq/fuzz/fuzz_handle_input.c
Line
Count
Source
1
// Copyright 2007 - 2026, Arthur Chan and the rabbitmq-c contributors.
2
// SPDX-License-Identifier: mit
3
4
#include <errno.h>
5
#include <inttypes.h>
6
#include <stdio.h>
7
#include <stdlib.h>
8
#include <string.h>
9
10
#include <rabbitmq-c/amqp.h>
11
#include <rabbitmq-c/framing.h>
12
13
// Drives amqp_handle_input(), the byte->frame wire parser, feeding the input one
14
// frame at a time and advancing by the number of bytes it reports consuming.
15
4.98k
extern int LLVMFuzzerTestOneInput(const char *data, size_t size) {
16
17
4.98k
  amqp_connection_state_t conn;
18
4.98k
  amqp_bytes_t buffer;
19
4.98k
  size_t iterations = 0;
20
21
4.98k
  if (size == 0) {
22
0
    return 0;
23
0
  }
24
25
4.98k
  conn = amqp_new_connection();
26
4.98k
  if (conn == NULL) {
27
0
    return 0;
28
0
  }
29
30
4.98k
  buffer.bytes = (void *)data;
31
4.98k
  buffer.len = size;
32
33
52.9k
  while (buffer.len > 0 && iterations < 4096) {
34
51.2k
    amqp_frame_t frame;
35
51.2k
    int res;
36
37
51.2k
    memset(&frame, 0, sizeof(frame));
38
51.2k
    res = amqp_handle_input(conn, buffer, &frame);
39
51.2k
    if (res <= 0) {
40
3.19k
      break;
41
3.19k
    }
42
43
48.0k
    buffer.bytes = (void *)((const char *)buffer.bytes + (size_t)res);
44
48.0k
    buffer.len -= (size_t)res;
45
46
48.0k
    if (frame.frame_type != 0) {
47
19.7k
      amqp_maybe_release_buffers_on_channel(conn, frame.channel);
48
19.7k
    }
49
50
48.0k
    iterations++;
51
48.0k
  }
52
53
4.98k
  amqp_destroy_connection(conn);
54
4.98k
  return 0;
55
4.98k
}