fuzz_types.c File Reference

A dual-purpose fuzzing harness for libFuzzer (Clang) and AFL++ (GCC), focused on the infix FFI type creation API's integrity using arenas. More...

#include "fuzz_helpers.h"

Include dependency graph for fuzz_types.c:

Functions
static void	FuzzTest (fuzzer_input in)
int	LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
	The entry point called by the libFuzzer engine.

Detailed Description

A dual-purpose fuzzing harness for libFuzzer (Clang) and AFL++ (GCC), focused on the infix FFI type creation API's integrity using arenas.

Copyright (c) 2025 Sanko Robinson

This source code is dual-licensed under the Artistic License 2.0 or the MIT License. You may choose to use this code under the terms of either license.

SPDX-License-Identifier: (Artistic-2.0 OR MIT)

The documentation blocks within this file are licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).

SPDX-License-Identifier: CC-BY-4.0

This harness uses a shared recursive generator (fuzz_helpers.h) to create complex, deeply-nested infix_type objects within a memory arena and then immediately destroys the arena. Its sole goal is to find memory safety bugs (leaks, overflows, use-after-free) in the arena-based type creation and destruction logic. This tests the public-facing Manual API.

It compiles in one of two modes:

• libFuzzer mode (default): Exposes the LLVMFuzzerTestOneInput entry point.
• AFL++ mode: Exposes a main function that uses a persistent mode loop. This is enabled by passing -DUSE_AFL=1 during compilation.

Function Documentation

FuzzTest()

static void FuzzTest ( fuzzer_input  in )

static

LLVMFuzzerTestOneInput()

int LLVMFuzzerTestOneInput	(	const uint8_t *	data,
		size_t	size
	)

The entry point called by the libFuzzer engine.