fuzzer_no_mut.j2

/// This file is autogenerated

#include "{{ class_header }}"

#include <cstdint>
#include <iterator> // for std::size
#include <random>
#include <iostream>

/// ------------------------------ DUMPED DATA ------------------------------

namespace target {

struct Argument {
    bool is_pointer;
    size_t size;
};

const size_t ARG_LIMIT = {{ arg_limit }};

struct AData {
    Argument list[ARG_LIMIT];
    size_t size;
    size_t bytesize;
};

/// -------------- CONSTRUCTORS --------------

struct CData {
    AData args;
    {{ class_name }} (*fn)(const uint8_t *);
};

{% for c in constructors %}
{{ class_name }} constr_{{ loop.index }}(const uint8_t *data) {
{% if length(c.args) == 0 %}    return {{ class_name }}();
{% else %}    size_t size = 0;

    {% for a in c.args -%}
    {{ a.name }} *arg_{{ loop.index }} = ({{ a.name }} *)(data + size);
    size += sizeof({{ a.name }});{% endfor %}

    return {{ class_name }}({% for a in c.args %}{% if loop.index != 0 %}, {% endif %}*arg_{{loop.index}}{% endfor %});
{% endif %}{{ "};" }}
{% endfor %}

const CData c_list[] = {
    {% for c in constructors -%}
    {
        .args = {
            .list = {
                {% for a in c.args %}{{ "{" }}{{ a.is_pointer }}, sizeof({{ a.name }})},{% endfor %}
            },
            .size = {{ length(c.args) }},
            .bytesize = 0{% for a in c.args %} + sizeof({{ a.name }}){% endfor %},
        },
        .fn = constr_{{ loop.index }},
    },{% endfor %}
};

constexpr size_t c_size = std::size(c_list);

/// -------------- METHODS --------------

struct MData {
    AData args;
    void (*fn)({{ class_name }} *, const uint8_t *);
};

{% for m in methods %}
void method_{{ loop.index }}({{ class_name }} *obj, const uint8_t *data) {
{% if length(m.args) == 0 %}    obj->{{ m.name }}();
{% else %}    size_t size = 0;

    {% for a in m.args -%}
    {{ a.name }} *arg_{{ loop.index }} = ({{ a.name }} *)(data + size);
    size += sizeof({{ a.name }});{% endfor %}

    obj->{{ m.name }}({% for a in m.args %}{% if loop.index != 0 %}, {% endif %}*arg_{{ loop.index }}{% endfor %});
{% endif %}{{ "};"}}
{% endfor %}

const MData m_list[] = {
    {% for m in methods -%}
    {
        .args = {
            .list = {
                {% for a in m.args %}{{ "{" }}{{ a.is_pointer }}, sizeof({{ a.name }})},{% endfor %}
            },
            .size = {{ length(m.args) }},
            .bytesize = 0{% for a in m.args %} + sizeof({{ a.name }}){% endfor %},
        },
        .fn = method_{{ loop.index }},
    },{% endfor %}
};

constexpr size_t m_size = std::size(m_list);

} // namespace

/// ------------------------------ CALL CHAIN AND MUTATOR ------------------------------

class CallChain {
public:
    static const size_t LIMIT = {{ cc_limit }};

    static int eval(const uint8_t *data, size_t size) {
        if (size == 0)
            return 1;
        
        size_t ptr = 0;
        auto c = target::c_list[data[ptr] % target::c_size];
        ptr++;

        if (ptr + c.args.bytesize > size)
            return 1;

        auto obj = c.fn(data + ptr);
        ptr += c.args.bytesize;

        if (ptr >= size)
            return 1;

        auto m = target::m_list[data[ptr] % target::m_size];
        ptr++;

        size_t i = 1;
        while (ptr + m.args.bytesize <= size && i++ < LIMIT) {
            m.fn(&obj, data + ptr);
            ptr += m.args.bytesize;

            if (ptr >= size)
                return 1;

            m = target::m_list[data[ptr] % target::m_size];
            ptr++;
        }

        return 0;
    }

    CallChain(const uint8_t *data, size_t size) : d1(data), d2(nullptr), d_size(size) { update_chain(); }

    CallChain(uint8_t * data, size_t size) : d1(data), d2(data), d_size(size) { update_chain(); }

    size_t get_call_start_idx(size_t n) {
        if (n == 0)
            return 0;
        return calls[n - 1];
    }

    size_t get_cid(size_t n) const {
        if (n == 0)
            return d1[0] % target::c_size;
        return d1[calls[n - 1]] % target::m_size;
    }

    size_t get_size() const {
        return calls_size;
    }

    size_t get_arg_offset(size_t n, size_t a) const {
        size_t offset = n == 0 ? 1 : calls[n - 1] + 1;
        size_t cid = get_cid(n);
        const target::AData &ad = n == 0 ? target::c_list[cid].args : target::m_list[cid].args;

        if (a > ad.size)
            return 0;

        for (size_t i = 0; i < a; ++i)
            offset += ad.list[i].size;
        
        return offset;
    }

    const uint8_t *get_arg_ptr(size_t n, size_t a) const {
        size_t offset = get_arg_offset(n, a);
        if (offset == 0) // impossible cause first is always constructor id
            return nullptr;
        
        return d1 + offset;
    }

private:
    const uint8_t *d1;
    uint8_t *d2;
    size_t d_size;

    size_t calls[LIMIT];
    size_t calls_size;

    void update_chain() {
        if (d_size == 0) {
            calls_size = 0;
            return;
        }

        if (d2 != nullptr && d1 != d2)
            d1 = d2;
        
        calls[0] = target::c_list[d1[0] % target::c_size].args.bytesize + 1;
        calls_size = 1;

        while (calls_size < LIMIT && calls[calls_size - 1] < d_size) {
            calls[calls_size] = calls[calls_size - 1] + target::m_list[d1[calls[calls_size - 1]] % target::m_size].args.bytesize + 1;
            calls_size++;
        }
    }
};



/// ------------------------------ HARNESS FN ------------------------------

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    CallChain::eval(data, size);
    return 0;
}