fuzz_helpers.h

Go to the documentation of this file.

#pragma once
#include "common/infix_internals.h"
#include <infix/infix.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
// Configuration Constants
// These values control the complexity and depth of the generated types to
// prevent excessively long or deep recursion, which could slow down fuzzing.
#define MAX_RECURSION_DEPTH 32
#define MAX_MEMBERS 16
#define MAX_ARRAY_ELEMENTS 128
#define MAX_TYPES_IN_POOL 16
#define MAX_ARGS_IN_SIGNATURE 16
#define MAX_TOTAL_FUZZ_FIELDS 256  // Prevents DoS in the generator itself.
 
// Fuzzer Input Management
 
typedef struct {
    const uint8_t * data;
    size_t size;
} fuzzer_input;
 
static inline const uint8_t * consume_bytes(fuzzer_input * in, size_t n) {
    if (in->size < n)
        return NULL;
    const uint8_t * ptr = in->data;
    in->data += n;
    in->size -= n;
    return ptr;
}
 
#define DEFINE_CONSUME_T(type)                                         \
    static inline bool consume_##type(fuzzer_input * in, type * out) { \
        const uint8_t * bytes = consume_bytes(in, sizeof(type));       \
        if (!bytes)                                                    \
            return false;                                              \
        memcpy(out, bytes, sizeof(type));                              \
        return true;                                                   \
    }
 
// Define consumer functions for the primitive types needed by the harnesses.
DEFINE_CONSUME_T(uint8_t)
DEFINE_CONSUME_T(size_t)
 
 
infix_type * generate_random_type(infix_arena_t * arena, fuzzer_input * in, int depth, size_t * total_fields);