| 22 | #define kMaxInputLength 4096 |
| 23 | |
| 24 | extern "C" int |
| 25 | LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) |
| 26 | { |
| 27 | if (size < kMinInputLength || size > kMaxInputLength){ |
| 28 | return 1; |
| 29 | } |
| 30 | |
| 31 | uint8_t mode = data[0] % 3; |
| 32 | const uint8_t *payload = data + 1; |
| 33 | size_t payload_size = size - 1; |
| 34 | |
| 35 | butil::IOBuf buf; |
| 36 | buf.append(payload, payload_size); |
| 37 | |
| 38 | switch (mode) { |
| 39 | case 0: { |
| 40 | // Read AMF object |
| 41 | butil::IOBufAsZeroCopyInputStream zc_stream(buf); |
| 42 | brpc::AMFInputStream stream(&zc_stream); |
| 43 | brpc::AMFObject obj; |
| 44 | brpc::ReadAMFObject(&obj, &stream); |
| 45 | break; |
| 46 | } |
| 47 | case 1: { |
| 48 | // Read AMF string |
| 49 | butil::IOBufAsZeroCopyInputStream zc_stream(buf); |
| 50 | brpc::AMFInputStream stream(&zc_stream); |
| 51 | std::string val; |
| 52 | brpc::ReadAMFString(&val, &stream); |
| 53 | break; |
| 54 | } |
| 55 | case 2: { |
| 56 | // Read raw AMF fields by consuming the stream directly |
| 57 | butil::IOBufAsZeroCopyInputStream zc_stream(buf); |
| 58 | brpc::AMFInputStream stream(&zc_stream); |
| 59 | uint8_t marker; |
| 60 | while (stream.good() && stream.cut_u8(&marker) == 1) { |
| 61 | // Try to identify marker type and read value |
| 62 | if (marker == brpc::AMF_MARKER_NUMBER) { |
| 63 | uint64_t num; |
| 64 | stream.cut_u64(&num); |
| 65 | } else if (marker == brpc::AMF_MARKER_BOOLEAN) { |
| 66 | uint8_t b; |
| 67 | stream.cut_u8(&b); |
| 68 | } else if (marker == brpc::AMF_MARKER_STRING) { |
| 69 | uint16_t len; |
| 70 | if (stream.cut_u16(&len) == 2 && len < 1024) { |
| 71 | char tmp[1024]; |
| 72 | stream.cutn(tmp, len); |
| 73 | } |
| 74 | } |
| 75 | } |
| 76 | break; |
| 77 | } |
| 78 | } |
| 79 | |
| 80 | return 0; |
| 81 | } |
nothing calls this directly
no test coverage detected