libmicrohttpd

HTTP/1.x server C library (MHD 1.x, stable)
Log | Files | Refs | Submodules | README | LICENSE

fuzz_memorypool.dict (2234B)

      1 # libFuzzer dictionary for fuzz_memorypool (GNU libmicrohttpd).
      2 #
      3 # The input is byte 0 = pool size selector, byte 1 = flags, then a
      4 # stream of 3-byte operation records (opcode, block selector, size
      5 # selector); see src/fuzz/README section 2.6 and the header comment of
      6 # src/fuzz/fuzz_memorypool.c.  A dictionary of *whole records* is what
      7 # helps here: it lets the mutator splice in a well-formed operation
      8 # instead of having to discover the opcode numbering byte by byte.
      9 #
     10 # Size selector encoding (low two bits select the class):
     11 #   b & 3 == 0   tiny, b >> 2 bytes (0..63)
     12 #   b & 3 == 1   ((b >> 2) + 1) / 64 of the pool
     13 #   b & 3 == 2   the currently free amount, +- ((b >> 2) & 7)
     14 #                (bit 5 selects the sign)
     15 #   b & 3 == 3   SIZE_MAX - (b >> 2), i.e. the value-wrap guards
     16 
     17 # --- headers: pool size selector + flags --------------------------------
     18 hdr_tiny_pool="\x00\x01"
     19 hdr_pool_128="\x08\x01"
     20 hdr_pool_256="\x0b\x01"
     21 hdr_pool_1024="\x10\x01"
     22 hdr_pool_1500="\x12\x01"
     23 hdr_pool_32768="\x17\x01"
     24 hdr_pool_mmap="\x19\x00"
     25 hdr_prefer_end="\x08\x03"
     26 
     27 # --- allocation ----------------------------------------------------------
     28 alloc_tiny="\x00\x00\x40"
     29 alloc_zero="\x00\x00\x00"
     30 alloc_from_end="\x00\x01\x40"
     31 alloc_half="\x00\x00\x7d"
     32 alloc_free="\x00\x00\x02"
     33 alloc_free_plus="\x00\x00\x26"
     34 alloc_free_minus="\x00\x00\x06"
     35 alloc_wrap="\x00\x00\x03"
     36 alloc_all_free="\x01\x00\x00"
     37 alloc_all_free_end="\x01\x01\x00"
     38 
     39 # --- try_alloc / the connection.c squeeze --------------------------------
     40 try_alloc_tiny="\x02\x00\x30"
     41 try_alloc_free="\x02\x00\x02"
     42 try_alloc_wrap="\x02\x00\x03"
     43 squeeze_tiny="\x03\x00\x30"
     44 squeeze_frac="\x03\x00\x21"
     45 
     46 # --- reallocation --------------------------------------------------------
     47 realloc_grow="\x04\x00\xfc"
     48 realloc_shrink="\x04\x00\x04"
     49 realloc_to_free="\x04\x00\x02"
     50 realloc_wrap="\x04\x00\x03"
     51 realloc_fresh="\x05\x00\x7d"
     52 
     53 # --- deallocation, reset, queries ---------------------------------------
     54 dealloc="\x06\x00\x00"
     55 dealloc_other="\x06\x01\x00"
     56 reset_keep_all="\x07\xf0\x7d"
     57 reset_keep_none="\x07\x00\x00"
     58 reset_to_free="\x07\xf0\x02"
     59 get_free="\x08\x00\x00"
     60 resizable="\x09\x00\x00"
     61 verify="\x0a\x00\x00"
     62 recreate_small="\x0b\x08\x00"
     63 recreate_large="\x0b\x17\x00"