A custom mutator that decodes the bech32 input, mutates the decoded input, * and then re-encodes the mutated input. This produces an input corpus that * consists entirely of correctly encoded bech32 strings, enabling efficient * fuzzing of the bolt12 decoding logic without the fuzzer getting stuck on * fuzzing the bech32 decoding logic. */
| 57 | * fuzzing of the bolt12 decoding logic without the fuzzer getting stuck on |
| 58 | * fuzzing the bech32 decoding logic. */ |
| 59 | size_t LLVMFuzzerCustomMutator(u8 *fuzz_data, size_t size, size_t max_size, |
| 60 | unsigned int seed) |
| 61 | { |
| 62 | const u8 *decoded_data; |
| 63 | size_t decoded_size; |
| 64 | u8 *mutated_data; |
| 65 | size_t mutated_size; |
| 66 | char *encoded_data; |
| 67 | size_t encoded_size; |
| 68 | const char *fail; |
| 69 | |
| 70 | /* Decode the input. */ |
| 71 | decoded_data = b12_string_to_data(tmpctx, (char *)fuzz_data, size, |
| 72 | bech32_hrp, &decoded_size, &fail); |
| 73 | if (!decoded_data) |
| 74 | return initial_input(fuzz_data, size, max_size); |
| 75 | if (decoded_size > max_size) |
| 76 | return initial_input(fuzz_data, size, max_size); |
| 77 | |
| 78 | /* Mutate the data part of the decoded input. */ |
| 79 | mutated_data = tal_dup_arr(tmpctx, u8, decoded_data, decoded_size, |
| 80 | max_size - decoded_size); |
| 81 | mutated_size = LLVMFuzzerMutate(mutated_data, decoded_size, max_size); |
| 82 | tal_resize(&mutated_data, mutated_size); |
| 83 | |
| 84 | /* Encode the mutated input. */ |
| 85 | encoded_data = to_bech32_charset(tmpctx, bech32_hrp, mutated_data); |
| 86 | encoded_size = tal_bytelen(encoded_data) - 1; /* Truncate null byte. */ |
| 87 | |
| 88 | if (encoded_size > max_size) |
| 89 | return initial_input(fuzz_data, size, max_size); |
| 90 | |
| 91 | memcpy(fuzz_data, encoded_data, encoded_size); |
| 92 | clean_tmpctx(); |
| 93 | |
| 94 | return encoded_size; |
| 95 | } |
| 96 | |
| 97 | static size_t cross_over_fail(void) |
| 98 | { |
nothing calls this directly
no test coverage detected