Function LLVMFuzzerCustomMutator

tests/fuzz/fuzz-codex32.c:43–99

Custom mutator with structure-aware and byte-level mutations */

/* Custom mutator with structure-aware and byte-level mutations */
size_t LLVMFuzzerCustomMutator(uint8_t *fuzz_data, size_t size,
				size_t max_size, unsigned int seed)
{
	srand(seed);
	char *str = to_string(tmpctx, fuzz_data, size);
	char *fail;
	struct codex32 *parts = codex32_decode(tmpctx, NULL, str, &fail);

	/* If valid, try structure-aware mutation */
	if (parts) {
		/* Mutate a random component */
		switch(rand() % 3) {
		case 0: /* Mutate threshold to any value */
			parts->threshold = rand();
			break;

		case 1: /* Mutate ID arbitrarily */
			{
				size_t id_len = sizeof(parts->id) - 1;
				LLVMFuzzerMutate((u8 *)parts->id, id_len, id_len);
				parts->id[id_len] = '\0';
			}
			break;

		case 2: /* Mutate payload */
			{
				size_t old_size = tal_bytelen(parts->payload);
				tal_resize(&parts->payload, max_size);
				size_t new_size = LLVMFuzzerMutate((u8 *)parts->payload, old_size, max_size);
				tal_resize(&parts->payload, new_size);
			}
			break;
		}

		/* Always mutate the HRP to ensure it's valid for encoding. */
		char *new_hrp = tal_arr(parts, char, 3);
		new_hrp[0] = valid_hrp_chars[rand() % strlen(valid_hrp_chars)];
		new_hrp[1] = valid_hrp_chars[rand() % strlen(valid_hrp_chars)];
		new_hrp[2] = '\0';
		parts->hrp = new_hrp;

		char *reencoded;
		const char *err = codex32_secret_encode(tmpctx, parts->hrp, parts->id,
							parts->threshold, parts->payload,
							tal_bytelen(parts->payload), &reencoded);
		if (!err) {
			size_t len = tal_bytelen(reencoded) - 1;
			if (len <= max_size) {
				memcpy(fuzz_data, reencoded, len);
				return len;
			}
		}
	}

	/* Fallback: byte-level mutation */
	return LLVMFuzzerMutate(fuzz_data, size, max_size);
}