Function run

tests/fuzz/fuzz-open_channel.c:440–480

}

void run(const u8 *data, size_t size)
{
	if (setjmp(fuzz_env) != 0)
		goto cleanup;

	/* The function under test: fundee_channel(), calls
	 * clean_tmpctx() mid-run, so create a separate context.
	 */
	const tal_t *run_ctx = tal(NULL, tal_t);

	/* Initialize the global pointers to the fuzz data. */
	cursor = &data;
	max = &size;

	state = fromwire_new_state(run_ctx);
	if (!state)
		goto cleanup;

	u8 *open_channel_msg;
	/* Choose between creating a valid message and a fuzzed one. */
	if (fromwire_u8(cursor, max) % 2)
		open_channel_msg = create_open_channel_msg(run_ctx, state);
	else {
		u8 *fuzz_msg = create_fuzz_msg(run_ctx);

		open_channel_msg = tal_arr(run_ctx, u8, 0);
		towire_u16(&open_channel_msg, WIRE_OPEN_CHANNEL);
		towire_u8_array(&open_channel_msg, fuzz_msg, tal_bytelen(fuzz_msg));
	}

	if (!open_channel_msg)
		goto cleanup;

	hsmd_reads = hsmd_writes = ld_writes = 0;
	/* We received an `open_channel` msg, so we're the fundee. */
	fundee_channel(state, open_channel_msg);

cleanup:
	tal_free(run_ctx);
	clean_tmpctx();
}