libmicrohttpd

fuzz_options.c (76668B)

---

 /*
   This file is part of libmicrohttpd
   Copyright (C) 2026 Christian Grothoff
 
   This library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Lesser General Public
   License as published by the Free Software Foundation; either
   version 2.1 of the License, or (at your option) any later version.
 
   This library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Lesser General Public License for more details.
 
   You should have received a copy of the GNU Lesser General Public
   License along with this library.
   If not, see <http://www.gnu.org/licenses/>.
 */
 
 /**
  * @file fuzz/fuzz_options.c
  * @brief In-process fuzzer for MHD's daemon option handling and for the
  *        daemon start-up / shutdown paths.
  * @author Christian Grothoff
  *
  * fuzz_request.c fuzzes what MHD does with the *bytes on the wire*, but
  * it always starts the daemon in one single shape: external polling, no
  * listen socket, five fixed options.  Everything in daemon.c that is
  * reached through any other configuration -- the flag validation in
  * MHD_start_daemon(), parse_options_va(), the internal polling thread,
  * the thread pool, epoll/poll/select, the listen socket, the per-IP and
  * per-daemon connection limits, quiesce -- is therefore dead code as far
  * as the fuzzing suite is concerned.  This harness closes that gap: the
  * input bytes pick a *combination* of MHD_FLAG bits and an MHD_OPTION
  * array, the daemon is started with them, one short HTTP request is
  * driven through it over a socketpair, and the daemon is stopped again.
  *
  * The request-driving machinery is the one from fuzz_request.c:
  * MHD_USE_NO_LISTEN_SOCKET plus MHD_add_connection() on an AF_UNIX
  * socketpair(), with a fake 127.0.0.1 peer address so that the per-IP
  * accounting sees something sane, and MHD_set_panic_func() installed as
  * a tripwire.  What is new here is that the *daemon* is a variable.
  *
  * Two shapes of daemon exist, and the harness drives them differently:
  *
  *   - "external polling" (no MHD_USE_INTERNAL_POLLING_THREAD and no
  *     MHD_USE_THREAD_PER_CONNECTION).  Single threaded and fully
  *     deterministic: the segments are fed in one at a time and the
  *     daemon is pumped with MHD_run() / MHD_get_fdset2() + select() +
  *     MHD_run_from_select2() / MHD_run_wait() between them.  This is the
  *     majority of the iterations and the only shape in which the harness
  *     suspends a connection.
  *
  *   - "internal thread" (an internal polling thread, a thread pool, or
  *     thread-per-connection).  MHD_add_connection() is explicitly
  *     supported in these modes -- it is how an application with its own
  *     accept() loop hands sockets over -- but the harness must not also
  *     poll the daemon, and it cannot know when the worker is done.  So
  *     the whole request is written at once, the write side is shut down
  *     (which makes MHD finish the request immediately rather than
  *     waiting for more data), and the answer is awaited with a short
  *     bounded poll() before the daemon is stopped.  MHD_USE_ITC is
  *     forced on in this shape so that the worker picks the new
  *     connection up at once instead of waiting for its poll timeout.
  *     No connection is ever suspended here.
  *
  * Input format (see README section 2.2 for the fuzz_request one, which
  * the segment stream below is deliberately identical to):
  *
  *   byte 0    daemon shape: index into mode_tbl[] (event loop and
  *             threading; the entries are the combinations MHD documents
  *             as valid, so that most iterations get a live daemon)
  *   byte 1    MHD_FLAG bits, group A (see flags_from_input())
  *   byte 2    MHD_FLAG bits, group B; 0xC0 in the top two bits switches
  *             on the "raw" escape, which feeds bytes 1, 2 and 15
  *             straight into the flags word.  That is what fuzzes
  *             MHD_start_daemon()'s own combination checks; MHD answering
  *             NULL is a normal outcome and simply ends the iteration.
  *   byte 3    option presence mask A (sizes and limits)
  *   byte 4    option presence mask B (discipline, insanity, fd_setsize)
  *   byte 5    option presence mask C (the callbacks and the pointers)
  *   byte 6    value selector: connection memory limit / increment
  *   byte 7    value selector: connection limit / per-IP limit
  *   byte 8    value selector: connection timeout / pool size / stack
  *   byte 9    value selector: nonce-nc size / digest random / bind type
  *   byte 10   value selector: discipline / strict / insanity / bzero URI
  *   byte 11   value selector: backlog / fd_setsize / reuse / fastopen
  *   byte 12   driver behaviour: event loop variant, quiesce,
  *             introspection, suspend mode, number of connections
  *   byte 13   handler behaviour (which response, MHD_NO, per-connection
  *             option) and the accept path: whether an accept policy
  *             callback is installed, what it answers, and whether the
  *             iteration additionally connect()s to the daemon's real
  *             listening socket
  *   byte 14   option presence mask D (the digest and TLS-adjacent
  *             options, MHD_OPTION_LISTEN_SOCKET, and the deliberately
  *             invalid option number)
  *   byte 15   spare entropy; also supplies flag bits 14+ in raw mode
  *   byte 16.  a sequence of send segments, each introduced by a little
  *             endian 16 bit header  (op << 14) | length
  *               op 0  send the payload on the current connection
  *               op 1  send the payload, then pump extra rounds
  *               op 2  send the payload, then pump extra rounds
  *               op 3  close the current connection, open a fresh one on
  *                     the same daemon, then send
  *
  * The sixteen configuration bytes are mandatory; a shorter input is
  * rejected.  An input of exactly sixteen bytes is meaningful and is not
  * a degenerate case: it starts and stops a daemon with one connection
  * and no traffic at all, which is precisely the start-up/shutdown path
  * this harness is about.
  *
  * Two rules the harness obeys, both of them application contract rather
  * than anything worth fuzzing:
  *
  *   - every daemon that starts is stopped, and no connection is left
  *     suspended when that happens, because MHD_stop_daemon() answers a
  *     suspended connection with MHD_PANIC().  Suspended connections are
  *     tracked in pending_resume[] and flushed during teardown, exactly
  *     as in fuzz_request.c;
  *   - the socket that MHD_quiesce_daemon() returns belongs to the
  *     caller.  It is closed after MHD_stop_daemon() (not before: with
  *     internal threads a worker may still be using it), otherwise the
  *     harness runs out of file descriptors within a few thousand
  *     iterations.
  *
  * Environment:
  *
  *   MHD_FUZZ_QUIESCE_EPOLL_RACE=1  let the harness call
  *       MHD_quiesce_daemon() on an epoll daemon that runs its own
  *       thread(s).  Off by default because that combination reaches an
  *       open MHD defect; see quiesce_epoll_race_allowed() below.
  */
 
 #define FUZZ_HARNESS_NAME "fuzz_options"
 #include "fuzz_common.h"
 
 #include <microhttpd.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <sys/select.h>
 #include <poll.h>
 #include <limits.h>
 
 /* MHD_OPTION_STRICT_FOR_CLIENT is superseded by
    MHD_OPTION_CLIENT_DISCIPLINE_LVL but is still shipped API, and its
    mapping onto the discipline level is exactly the kind of thing this
    harness is for. */
 #if defined(__GNUC__) || defined(__clang__)
 #pragma GCC diagnostic ignored "-Wdeprecated-declarations"
 #endif
 
 /** Number of mandatory configuration bytes at the start of the input. */
 #define CFG_BYTES 16
 
 #define MAX_SEGMENTS 48
 #define MAX_CONNECTIONS 6
 #define MAX_OPTS 40
 #define RESP_DRAIN_BUF 4096
 #define GEN_BUF_SIZE 4096
 
 /**
  * Milliseconds the internal-thread shape waits for the daemon to answer.
  * The write side of the socketpair is shut down before the wait, so the
  * daemon never sits on an incomplete request: either it answers (the
  * common case, tens of microseconds) or it closes the connection, and
  * both wake poll() up immediately.  The timeout is therefore only paid
  * by inputs that make MHD drop the connection without a reply.
  */
 #define THREAD_WAIT_MS 2
 
 /** Rounds of MHD_run() after each segment in the external shape. */
 #define PUMP_ROUNDS 3
 /** Rounds of MHD_run() after a segment sent with op 1 or 2. */
 #define PUMP_ROUNDS_LONG 10
 
 
 /* ------------------------------------------------------------------ */
 /* Per-iteration configuration                                         */
 /* ------------------------------------------------------------------ */
 
 struct fuzz_cfg
 {
   /** Daemon runs its own thread(s); the harness must not call MHD_run(). */
   int uses_threads;
   /** A real listening socket was requested (no MHD_USE_NO_LISTEN_SOCKET). */
   int listen_sock;
   /** MHD_USE_ERROR_LOG was requested, so an external logger is mandatory. */
   int err_log;
   /** 0 none, 1 suspend+resume in the handler, 2 resume from the pump. */
   int suspend_mode;
   /** 0 MHD_run(), 1 MHD_get_fdset2()+select()+MHD_run_from_select2(),
       2 MHD_run_wait(0), 3 the v1 MHD_get_fdset()/MHD_run_from_select(). */
   unsigned int loop_mode;
   /** Call MHD_quiesce_daemon() before stopping. */
   int quiesce;
   /** Query MHD_get_daemon_info() / MHD_get_timeout*() while pumping. */
   int daemon_info;
   /** Call MHD_set_connection_option() from the handler. */
   int conn_option;
   /** Which response constructor the handler uses. */
   unsigned int resp_kind;
   /** Handler answers MHD_NO instead of queueing a response. */
   int handler_no;
   /** Upper bound on the number of connections the iteration opens. */
   unsigned int nconn_max;
   /** Really connect() to the daemon's listening socket. */
   int real_connect;
   /** Install an accept policy callback, and what it should answer. */
   int accept_policy;
   int accept_policy_deny;
 };
 
 static struct fuzz_cfg cfg;
 
 /**
  * Connections suspended by suspend mode 2, which the pump loop still has
  * to resume.  Cleared by completed_cb() so that a connection MHD has
  * finished with is never resumed afterwards.  A connection that is still
  * suspended when MHD_stop_daemon() runs makes MHD answer with
  * MHD_PANIC ("MHD_stop_daemon() called while we have suspended
  * connections"), which would look exactly like an MHD bug.
  */
 static struct MHD_Connection *pending_resume[MAX_CONNECTIONS];
 
 /**
  * Set once the iteration only wants to drain the daemon.  The handler
  * then stops parking new connections, which is what makes the flush loop
  * in the teardown provably terminate.
  */
 static int tearing_down;
 
 /** Statistics, printed at exit with --verbose. */
 static unsigned long stat_daemons;
 static unsigned long stat_daemons_failed;
 static unsigned long stat_threaded;
 static unsigned long stat_handler_calls;
 static unsigned long stat_conns_added;
 static unsigned long stat_conns_refused;
 static unsigned long stat_real_conns;
 static int stats_registered;
 
 
 static void
 print_stats (void)
 {
   if (! fuzz_verbose)
     return;
   fprintf (stderr,
            "%s: daemons=%lu (failed to start=%lu, threaded=%lu) "
            "connections=%lu (refused=%lu, accepted from a real socket=%lu) "
            "handler calls=%lu\n",
            FUZZ_HARNESS_NAME,
            stat_daemons, stat_daemons_failed, stat_threaded,
            stat_conns_added, stat_conns_refused, stat_real_conns,
            stat_handler_calls);
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Flags                                                               */
 /* ------------------------------------------------------------------ */
 
 /**
  * The event-loop / threading core of the flags word.  Every entry is a
  * combination MHD documents as valid, so that the ordinary path through
  * this harness gets a live daemon and actually exercises the option
  * handling; the deliberately invalid combinations are reached through
  * the raw escape of byte 2 instead.
  *
  * The distribution is on purpose: entries 0..17 are the external polling
  * modes, 18..23 the ones with internal threads.  An iteration with
  * internal threads costs a thread creation, a join and a short wait for
  * the answer, i.e. roughly an order of magnitude more than an external
  * one, so they are a quarter of the iterations rather than a half.
  */
 static const unsigned int mode_tbl[] = {
   0, 0, 0, 0, 0, 0,                              /* external, select()  */
   0, 0, 0, 0, 0, 0,
   MHD_USE_EPOLL, MHD_USE_EPOLL,                  /* external, epoll     */
   MHD_USE_EPOLL, MHD_USE_EPOLL,
   MHD_USE_AUTO, MHD_USE_AUTO,                    /* external, MHD picks */
   MHD_USE_INTERNAL_POLLING_THREAD,
   MHD_USE_INTERNAL_POLLING_THREAD | MHD_USE_POLL,
   MHD_USE_INTERNAL_POLLING_THREAD | MHD_USE_EPOLL,
   MHD_USE_THREAD_PER_CONNECTION | MHD_USE_INTERNAL_POLLING_THREAD,
   MHD_USE_THREAD_PER_CONNECTION | MHD_USE_INTERNAL_POLLING_THREAD
   | MHD_USE_POLL,
   MHD_USE_AUTO | MHD_USE_INTERNAL_POLLING_THREAD
 };
 
 #define MODE_COUNT (sizeof (mode_tbl) / sizeof (mode_tbl[0]))
 
 /**
  * Flag bits the raw escape is allowed to set.  MHD_USE_TLS is masked
  * out: without a certificate the daemon merely fails to start, so it
  * would only waste iterations, and fuzzing GnuTLS is not what this
  * harness is for.  Everything else, including the bits above
  * MHD_USE_NO_THREAD_SAFETY that no MHD_FLAG uses, is fair game.
  */
 #define RAW_FLAG_MASK (~((unsigned int) MHD_USE_TLS))
 
 /**
  * The bit that MHD_suspend_connection() actually tests.
  *
  * MHD_ALLOW_SUSPEND_RESUME is a *compound* value (8192 | MHD_USE_ITC),
  * so "0 != (flags & MHD_ALLOW_SUSPEND_RESUME)" is already true for a
  * daemon that merely asked for MHD_USE_ITC -- and suspending such a
  * connection is answered with
  * MHD_PANIC ("Cannot suspend connections without enabling
  * MHD_ALLOW_SUSPEND_RESUME"), which is the harness violating the API
  * rather than a finding.  internal.h calls the single bit
  * MHD_TEST_ALLOW_SUSPEND_RESUME; this is the same value, expressed
  * without reaching into a private header.
  */
 #define SUSPEND_BIT \
         (((unsigned int) MHD_ALLOW_SUSPEND_RESUME) \
          & ~((unsigned int) MHD_USE_ITC))
 
 
 /**
  * Build the flags word from bytes 0, 1, 2 and 15 of the input.
  *
  * @param data the input
  * @return the flags to pass to MHD_start_daemon()
  */
 static unsigned int
 flags_from_input (const uint8_t *data)
 {
   unsigned int flags;
 
   if (0xC0 == (data[2] & 0xC0))
   {
     /* Raw escape: the flags word comes straight off the input.  This is
        what exercises MHD_start_daemon()'s combination checks (POLL with
        EPOLL, EPOLL with thread-per-connection, AUTO with either, ...),
        every one of which answers NULL. */
     flags = ((unsigned int) data[1])
             | (((unsigned int) (data[2] & 0x3F)) << 8)
             | (((unsigned int) data[15]) << 14);
     flags &= RAW_FLAG_MASK;
     cfg.listen_sock = (0 == (flags & MHD_USE_NO_LISTEN_SOCKET));
     cfg.err_log = (0 != (flags & MHD_USE_ERROR_LOG));
     return flags;
   }
 
   flags = mode_tbl[data[0] % MODE_COUNT];
 
   if (0 != (data[1] & 0x01))
     flags |= MHD_USE_PEDANTIC_CHECKS;
   if (0 != (data[1] & 0x02))
     flags |= MHD_USE_SUPPRESS_DATE_NO_CLOCK;
   if (0 != (data[1] & 0x04))
     flags |= MHD_ALLOW_SUSPEND_RESUME;
   if ( (0 != (data[1] & 0x08)) &&
        (MHD_YES == MHD_is_feature_supported (MHD_FEATURE_UPGRADE)) )
     flags |= MHD_ALLOW_UPGRADE;
   if (0 != (data[1] & 0x10))
     flags |= MHD_USE_TURBO;
   if (0 != (data[1] & 0x20))
     flags |= MHD_USE_ITC;
   if (0 != (data[1] & 0x40))
     cfg.err_log = 1;
   if (0 != (data[1] & 0x80))
     flags |= MHD_USE_POST_HANDSHAKE_AUTH_SUPPORT;   /* ignored without TLS */
 
   if (0 != (data[2] & 0x01))
     cfg.listen_sock = 1;
   if (0 != (data[2] & 0x02))
     flags |= MHD_USE_IPv6;
   if (0 != (data[2] & 0x04))
     flags |= MHD_USE_DUAL_STACK;
   if (0 != (data[2] & 0x08))
     flags |= MHD_USE_TCP_FASTOPEN;
   if (0 != (data[2] & 0x10))
     flags |= MHD_USE_NO_THREAD_SAFETY;
   if (0 != (data[2] & 0x20))
     flags |= MHD_USE_INSECURE_TLS_EARLY_DATA;       /* ignored without TLS */
 
   /* MHD_USE_NO_THREAD_SAFETY together with any internal thread is
      documented as unsupported and answered with NULL.  Drop it here
      rather than burning the iteration; the raw escape above still
      reaches that check. */
   if (0 != (flags & (MHD_USE_INTERNAL_POLLING_THREAD
                      | MHD_USE_THREAD_PER_CONNECTION)))
     flags &= ~((unsigned int) MHD_USE_NO_THREAD_SAFETY);
   return flags;
 }
 
 
 /**
  * @return non-zero if @a flags make MHD use epoll
  *
  * MHD_USE_AUTO resolves to epoll for everything except
  * thread-per-connection, which it resolves to poll.
  */
 static int
 uses_epoll (unsigned int flags)
 {
   if (0 != (flags & MHD_USE_EPOLL))
     return 1;
   return (0 != (flags & MHD_USE_AUTO)) &&
          (0 == (flags & MHD_USE_THREAD_PER_CONNECTION));
 }
 
 
 /**
  * Is the harness allowed to call MHD_quiesce_daemon() on an epoll
  * daemon that runs its own thread(s)?
  *
  * It is not, by default, because that combination reaches an *open* MHD
  * defect and would make "make check" fail at random:
  *
  *   MHD_quiesce_daemon() sets daemon->was_quiesced and then removes the
  *   listen FD from the epoll set itself (daemon.c:6208), tolerating
  *   ENOENT with the comment "can happen due to race with MHD_epoll()".
  *   MHD_epoll() removes the very same FD in two places.  The first
  *   (daemon.c:5556) mirrors that and tolerates ENOENT.  The second
  *   (daemon.c:5593), the "at the connection limit, disable listen
  *   socket" branch, also fires when daemon->was_quiesced is set -- and
  *   it does not tolerate anything:
  *
  *       if (0 != epoll_ctl (daemon->epoll_fd, EPOLL_CTL_DEL, ls, NULL))
  *         MHD_PANIC (_ ("Failed to remove listen FD from epoll set."));
  *
  *   The worker can read daemon->was_quiesced as already true and
  *   daemon->listen_socket_in_epoll as still true -- neither is atomic
  *   and neither is under a lock -- and then lose the race for the
  *   removal, so epoll_ctl() answers ENOENT and MHD aborts the process.
  *   Confirmed with errno == ENOENT, was_quiesced == 1, connections == 0.
  *   The same unguarded MHD_PANIC() sits in the worker-pool loop of
  *   MHD_quiesce_daemon() itself (daemon.c:6189).
  *
  * Set MHD_FUZZ_QUIESCE_EPOLL_RACE=1 to reach it.  Quiescing is left
  * enabled everywhere else, so the poll()/select() side of
  * MHD_quiesce_daemon(), including its worker-pool loop, keeps being
  * exercised.
  */
 static int
 quiesce_epoll_race_allowed (void)
 {
   static int val = -1;
 
   if (0 > val)
   {
     const char *e = getenv ("MHD_FUZZ_QUIESCE_EPOLL_RACE");
 
     val = ((NULL != e) && (0 != atoi (e))) ? 1 : 0;
   }
   return val;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Option values                                                       */
 /* ------------------------------------------------------------------ */
 
 static const size_t mem_limit_tbl[] = {
   0 /* MHD default */, 128, 192, 256, 384, 512, 1024, 1400,
   1500, 2048, 4096, 8192, 32768, 64, 0, 0
 };
 
 static const size_t mem_increment_tbl[] = {
   0 /* MHD default */, 1, 16, 64, 128, 256, 1024, 4096,
   1500, 32768, 0, 0, 0, 0, 0, 0
 };
 
 static const unsigned int conn_limit_tbl[] = {
   0, 1, 2, 3, 8, 64, 1024, 100000
 };
 
 static const unsigned int per_ip_limit_tbl[] = {
   0, 1, 2, 3, 4, 8, 64, 1000
 };
 
 static const unsigned int timeout_tbl[] = {
   0, 1, 2, 5, 60, 3600, 86400, UINT_MAX
 };
 
 static const unsigned int pool_size_tbl[] = { 2, 3, 4, 2 };
 
 /* Small stacks make pthread_create() fail outright under ASAN, which
    only produces a NULL daemon; keep the values plausible. */
 static const size_t stack_size_tbl[] = {
   0, 1024u * 1024u, 2048u * 1024u, 8192u * 1024u
 };
 
 /* Bounded on purpose: the nonce-nc array is nonce_nc_size *
    sizeof(struct MHD_NonceNc) (about 130 bytes per slot) and is
    allocated and freed once per iteration. */
 static const unsigned int nonce_nc_tbl[] = { 0, 1, 4, 32 };
 
 static const int discipline_tbl[] = { -3, -2, -1, 0, 1, 2, 3, -4 };
 
 static const int strict_tbl[] = { -1, 0, 1, 2 };
 
 static const unsigned int backlog_tbl[] = { 0, 1, 5, 511 };
 
 static const unsigned int fastopen_tbl[] = { 0, 1, 5, 10 };
 
 /* Anything but the platform's own FD_SETSIZE is rejected unless MHD was
    built with HAS_FD_SETSIZE_OVERRIDABLE, so the odd values are a small
    minority: they cost a whole iteration each. */
 static const int fd_setsize_tbl[] = {
   (int) FD_SETSIZE, (int) FD_SETSIZE, (int) FD_SETSIZE, (int) FD_SETSIZE,
   (int) FD_SETSIZE, (int) FD_SETSIZE, 64, 0
 };
 
 /** Fixed entropy, so that a digest nonce is reproducible across runs. */
 static const char digest_rnd[32] =
   "\x01\x23\x45\x67\x89\xab\xcd\xef\x01\x23\x45\x67\x89\xab\xcd\xef"
   "\xfe\xdc\xba\x98\x76\x54\x32\x10\xfe\xdc\xba\x98\x76\x54\x32\x10";
 
 /* Bind addresses for MHD_OPTION_SOCK_ADDR / MHD_OPTION_SOCK_ADDR_LEN.
    Filled in by prepare_sock_addrs() because htons()/htonl() are not
    constant expressions. */
 static struct sockaddr_in bind4;
 #ifdef AF_INET6
 static struct sockaddr_in6 bind6;
 #endif
 static int bind_addrs_ready;
 
 
 static void
 prepare_sock_addrs (void)
 {
   if (bind_addrs_ready)
     return;
   bind_addrs_ready = 1;
   memset (&bind4, 0, sizeof (bind4));
   bind4.sin_family = AF_INET;
   bind4.sin_port = htons (0);            /* ephemeral */
   bind4.sin_addr.s_addr = htonl (INADDR_LOOPBACK);
 #ifdef AF_INET6
   memset (&bind6, 0, sizeof (bind6));
   bind6.sin6_family = AF_INET6;
   bind6.sin6_port = htons (0);
   bind6.sin6_addr = in6addr_loopback;
 #endif
 }
 
 
 /* ------------------------------------------------------------------ */
 /* The daemon callbacks                                                */
 /* ------------------------------------------------------------------ */
 
 /**
  * MHD_OPTION_EXTERNAL_LOGGER.  Swallows the message unless --verbose is
  * in effect.  This is what makes MHD_USE_ERROR_LOG affordable: with the
  * flag set, MHD executes several hundred MHD_DLOG() call sites in
  * daemon.c that are otherwise dead, and without a logger of our own all
  * of that would land on stderr.
  */
 static void
 logger_cb (void *cls,
            const char *fmt,
            va_list ap)
 {
   (void) cls;
   if (! fuzz_verbose)
     return;
   (void) vfprintf (stderr, fmt, ap);
 }
 
 
 /**
  * MHD_OPTION_URI_LOG_CALLBACK.  The return value becomes the initial
  * `*req_cls` of the request, so it has to stay NULL: the access handler
  * uses "req_cls is still NULL" to recognise its first invocation, and a
  * non-NULL value here would also have to be freed somewhere, which is
  * not possible when MHD_OPTION_NOTIFY_COMPLETED is not set.
  */
 static void *
 uri_log_cb (void *cls,
             const char *uri,
             struct MHD_Connection *con)
 {
   volatile size_t sink;
 
   (void) cls;
   (void) con;
   sink = (NULL != uri) ? strlen (uri) : 0;
   (void) sink;
   return NULL;
 }
 
 
 /**
  * MHD_OPTION_UNESCAPE_CALLBACK.  Replaces MHD's own unescaping, so it
  * must honour the contract: unescape @a s in place and return the new
  * length.  Leaving the string alone is a legal implementation and keeps
  * the harness out of the business of re-testing mhd_str.c, which
  * fuzz_str does.
  */
 static size_t
 unescape_cb (void *cls,
              struct MHD_Connection *conn,
              char *s)
 {
   (void) cls;
   (void) conn;
   return strlen (s);
 }
 
 
 static void
 completed_cb (void *cls,
               struct MHD_Connection *connection,
               void **req_cls,
               enum MHD_RequestTerminationCode toe)
 {
   (void) cls;
   (void) toe;
   /* MHD is done with this connection, so the deferred resume of suspend
      mode 2 must not fire for it any more. */
   if (! cfg.uses_threads)
   {
     unsigned int i;
 
     for (i = 0; i < MAX_CONNECTIONS; i++)
       if (pending_resume[i] == connection)
         pending_resume[i] = NULL;
   }
   *req_cls = NULL;
 }
 
 
 static void
 notify_connection_cb (void *cls,
                       struct MHD_Connection *connection,
                       void **socket_context,
                       enum MHD_ConnectionNotificationCode toe)
 {
   (void) cls;
   (void) connection;
   if (MHD_CONNECTION_NOTIFY_STARTED == toe)
     *socket_context = NULL;
 }
 
 
 static void
 panic_cb (void *cls,
           const char *file,
           unsigned int line,
           const char *reason)
 {
   char msg[512];
 
   (void) cls;
   (void) snprintf (msg, sizeof (msg),
                    "MHD_PANIC() reached at %s:%u: %s",
                    (NULL != file) ? file : "?",
                    line,
                    (NULL != reason) ? reason : "?");
   fuzz_report_finding (msg);
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Suspend bookkeeping                                                 */
 /* ------------------------------------------------------------------ */
 
 static void
 pending_resume_add (struct MHD_Connection *c)
 {
   unsigned int i;
 
   for (i = 0; i < MAX_CONNECTIONS; i++)
   {
     if (NULL == pending_resume[i])
     {
       pending_resume[i] = c;
       return;
     }
   }
 }
 
 
 /**
  * Resume everything still parked.
  *
  * @return non-zero if at least one connection was resumed, so that the
  *         caller knows the daemon needs another round to act on it
  */
 static int
 pending_resume_flush (void)
 {
   unsigned int i;
   int any = 0;
 
   for (i = 0; i < MAX_CONNECTIONS; i++)
   {
     struct MHD_Connection *c = pending_resume[i];
 
     if (NULL == c)
       continue;
     /* Clear first: MHD_resume_connection() can make MHD run the handler,
        which may suspend the very same connection again. */
     pending_resume[i] = NULL;
     MHD_resume_connection (c);
     any = 1;
   }
   return any;
 }
 
 
 /**
  * Suspend the connection if the input asks for it.  Only ever called in
  * the external-polling shape: resuming from the harness thread while an
  * internal worker owns the connection is legal but untimed, and this
  * harness has no way to tell whether the resume happened before or after
  * the worker looked at the connection.
  */
 static void
 suspend_maybe (struct MHD_Connection *connection)
 {
   if ( (0 == cfg.suspend_mode) ||
        cfg.uses_threads ||
        tearing_down)
     return;
   MHD_suspend_connection (connection);
   if (1 == cfg.suspend_mode)
   {
     MHD_resume_connection (connection);
     return;
   }
   pending_resume_add (connection);
 }
 
 
 /* ------------------------------------------------------------------ */
 /* The access handler                                                  */
 /* ------------------------------------------------------------------ */
 
 static const char resp_body[] = "hello";
 
 static enum MHD_Result
 ahc (void *cls,
      struct MHD_Connection *connection,
      const char *url,
      const char *method,
      const char *version,
      const char *upload_data,
      size_t *upload_data_size,
      void **req_cls)
 {
   /* The address of this object is the "request already started" marker.
      Nothing is allocated per request on purpose: this harness runs
      millions of iterations in one process and the daemon shapes with
      internal threads cannot guarantee that MHD_OPTION_NOTIFY_COMPLETED
      is even set, so anything malloc()ed here could leak. */
   static int req_marker;
   struct MHD_Response *resp;
   enum MHD_Result ret;
   unsigned int code;
   volatile size_t sink = 0;
 
   (void) cls;
   (void) upload_data;
 
   if (&req_marker != *req_cls)
   {
     *req_cls = &req_marker;
     return MHD_YES;
   }
   stat_handler_calls++;
 
   /* Touch the parsed request line the way a real application would. */
   if (NULL != url)
     sink += strlen (url);
   if (NULL != method)
     sink += strlen (method);
   if (NULL != version)
     sink += strlen (version);
   (void) sink;
 
   if (0 != *upload_data_size)
   {
     *upload_data_size = 0;
     return MHD_YES;
   }
 
   if (cfg.conn_option)
     (void) MHD_set_connection_option (connection,
                                       MHD_CONNECTION_OPTION_TIMEOUT,
                                       (unsigned int) 30);
   if (cfg.handler_no)
     return MHD_NO;    /* never suspend on this path: MHD_NO terminates the
                          connection and terminating a suspended one trips
                          mhd_assert (! connection->suspended) */
 
   code = MHD_HTTP_OK;
   switch (cfg.resp_kind)
   {
   case 1:
     resp = MHD_create_response_empty (MHD_RF_NONE);
     code = MHD_HTTP_NO_CONTENT;
     break;
   case 2:
     resp = MHD_create_response_from_buffer (sizeof (resp_body) - 1,
                                             (void *) (intptr_t) resp_body,
                                             MHD_RESPMEM_MUST_COPY);
     code = MHD_HTTP_FORBIDDEN;
     break;
   case 3:
     resp = MHD_create_response_from_buffer_static (0, "");
     code = MHD_HTTP_INTERNAL_SERVER_ERROR;
     break;
   default:
     resp = MHD_create_response_from_buffer_static (sizeof (resp_body) - 1,
                                                    resp_body);
     break;
   }
   if (NULL == resp)
     return MHD_NO;
   ret = MHD_queue_response (connection, code, resp);
   MHD_destroy_response (resp);
   if (MHD_YES == ret)
     suspend_maybe (connection);
   return ret;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Driving the daemon                                                  */
 /* ------------------------------------------------------------------ */
 
 /**
  * Read and discard whatever the daemon has produced so far.  The harness
  * has no response oracle -- fuzz_request owns that job -- but the data
  * has to be taken off the socket so that MHD's writes keep succeeding.
  */
 static void
 drain (int sock)
 {
   char tmp[RESP_DRAIN_BUF];
 
   if (0 > sock)
     return;
   while (0 < recv (sock, tmp, sizeof (tmp), MSG_DONTWAIT))
     /* nothing */;
 }
 
 
 /**
  * Advance an externally polled daemon by one cycle, through whichever of
  * the four event-loop entry points byte 12 selected.
  *
  * The select() timeout is always zero: the harness is single threaded
  * and everything the daemon could be waiting for has already been
  * written into the socketpair, so blocking would only burn wall clock.
  */
 static void
 run_once (struct MHD_Daemon *d)
 {
   fd_set rs;
   fd_set ws;
   fd_set es;
   MHD_socket max_fd = MHD_INVALID_SOCKET;
   struct timeval tv;
 
   if (cfg.daemon_info)
   {
     MHD_UNSIGNED_LONG_LONG tl = 0;
     volatile int64_t sink;
 
     (void) MHD_get_timeout (d, &tl);
     sink = MHD_get_timeout64s (d);
     sink += (int64_t) MHD_get_timeout_i (d);
     (void) sink;
   }
   switch (cfg.loop_mode)
   {
   case 1:
   case 3:
     FD_ZERO (&rs);
     FD_ZERO (&ws);
     FD_ZERO (&es);
     /* MHD_get_fdset and MHD_run_from_select are also macros forwarding
        to the *2 variants, so the names have to be parenthesised for the
        v1 entry points to be reached at all. */
     if (1 == cfg.loop_mode)
     {
       if (MHD_YES != MHD_get_fdset2 (d, &rs, &ws, &es, &max_fd,
                                      (unsigned int) FD_SETSIZE))
       {
         (void) MHD_run (d);
         return;
       }
     }
     else
     {
       if (MHD_YES != (MHD_get_fdset) (d, &rs, &ws, &es, &max_fd))
       {
         (void) MHD_run (d);
         return;
       }
     }
     tv.tv_sec = 0;
     tv.tv_usec = 0;
     if (MHD_INVALID_SOCKET != max_fd)
       (void) select ((int) max_fd + 1, &rs, &ws, &es, &tv);
     if (1 == cfg.loop_mode)
       (void) MHD_run_from_select2 (d, &rs, &ws, &es, (unsigned int) FD_SETSIZE);
     else
       (void) (MHD_run_from_select) (d, &rs, &ws, &es);
     break;
   case 2:
     (void) MHD_run_wait (d, 0);
     break;
   default:
     (void) MHD_run (d);
     break;
   }
 }
 
 
 static void
 pump (struct MHD_Daemon *d,
       int sock,
       unsigned int rounds)
 {
   unsigned int i;
 
   if (cfg.uses_threads)
     return;
   for (i = 0; i < rounds; i++)
   {
     /* Deferred resume of suspend mode 2.  Each slot is cleared before
        its connection is resumed, which stays correct even when the
        resume makes MHD complete (and forget) the connection. */
     (void) pending_resume_flush ();
     run_once (d);
     drain (sock);
   }
 }
 
 
 /**
  * Wait, briefly and with a hard bound, for a daemon with internal
  * threads to answer.  The caller has already shut the write side down,
  * so MHD sees end-of-stream and either answers or closes; both wake
  * poll() immediately.  An input that makes MHD do neither pays the full
  * timeout, which is why it is only a couple of milliseconds.
  */
 static void
 wait_threaded (int sock)
 {
   unsigned int round;
 
   if (0 > sock)
     return;
   for (round = 0; round < 4; round++)
   {
     struct pollfd p;
     char tmp[RESP_DRAIN_BUF];
     ssize_t n;
 
     p.fd = sock;
     p.events = POLLIN;
     p.revents = 0;
     if (0 >= poll (&p, 1, THREAD_WAIT_MS))
       return;
     if (0 == (p.revents & POLLIN))
       return;                   /* POLLHUP/POLLERR only: peer is gone */
     n = recv (sock, tmp, sizeof (tmp), MSG_DONTWAIT);
     if (0 >= n)
       return;
   }
 }
 
 
 static void
 send_all (struct MHD_Daemon *d,
           int sock,
           const uint8_t *data,
           size_t len)
 {
   size_t off = 0;
   unsigned int stall = 0;
 
   if (0 > sock)
     return;
   while ( (off < len) &&
           (stall < 64) )
   {
     ssize_t s = send (sock, data + off, len - off, MSG_DONTWAIT);
 
     if (0 < s)
     {
       off += (size_t) s;
       stall = 0;
       continue;
     }
     stall++;
     if (cfg.uses_threads)
     {
       struct pollfd p;
 
       p.fd = sock;
       p.events = POLLOUT;
       p.revents = 0;
       if (0 >= poll (&p, 1, THREAD_WAIT_MS))
         break;
     }
     else
     {
       pump (d, sock, 2);
     }
     if ( (0 > s) &&
          (EAGAIN != errno) &&
          (EWOULDBLOCK != errno) &&
          (EINTR != errno) )
       break;
   }
 }
 
 
 /**
  * Hand a fresh socketpair to the daemon.
  *
  * @param d the daemon
  * @param[out] sock set to the harness side of the pair
  * @return 0 on success, -1 if MHD refused the connection (which is a
  *         perfectly ordinary outcome: MHD_OPTION_CONNECTION_LIMIT and
  *         MHD_OPTION_PER_IP_CONNECTION_LIMIT are part of what is fuzzed)
  */
 static int
 new_connection (struct MHD_Daemon *d,
                 int *sock)
 {
   int sv[2];
   struct sockaddr_in sa;
 
   *sock = -1;
   if (0 != socketpair (AF_UNIX, SOCK_STREAM, 0, sv))
     return -1;
   memset (&sa, 0, sizeof (sa));
   sa.sin_family = AF_INET;
   sa.sin_port = htons (44444);
   sa.sin_addr.s_addr = htonl (INADDR_LOOPBACK);
   if (MHD_YES != MHD_add_connection (d,
                                      (MHD_socket) sv[1],
                                      (const struct sockaddr *) &sa,
                                      (socklen_t) sizeof (sa)))
   {
     /* MHD has already closed sv[1] in that case */
     (void) close (sv[0]);
     stat_conns_refused++;
     return -1;
   }
   stat_conns_added++;
   *sock = sv[0];
   return 0;
 }
 
 
 static void
 close_connection (struct MHD_Daemon *d,
                   int *sock)
 {
   if (0 > *sock)
     return;
   (void) shutdown (*sock, SHUT_WR);
   if (cfg.uses_threads)
     wait_threaded (*sock);
   else
     pump (d, *sock, 4);
   (void) close (*sock);
   *sock = -1;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Building the option array                                           */
 /* ------------------------------------------------------------------ */
 
 #define PICK(tbl, idx) ((tbl)[(idx) % (sizeof (tbl) / sizeof ((tbl)[0]))])
 
 static void
 add_opt (struct MHD_OptionItem *opts,
          unsigned int *nopt,
          enum MHD_OPTION option,
          intptr_t value,
          void *ptr_value)
 {
   if (*nopt + 1 >= MAX_OPTS)
     return;
   opts[*nopt].option = option;
   opts[*nopt].value = value;
   opts[*nopt].ptr_value = ptr_value;
   (*nopt)++;
 }
 
 
 /**
  * Translate the presence masks (bytes 3, 4, 14) and the value selectors
  * (bytes 6..11, 15) into an MHD_OptionItem array.
  *
  * Only the options that can be expressed through MHD_OPTION_ARRAY are
  * built here.  The five callback options take two pointers, and putting
  * a function pointer into the array's `intptr_t value` member is not
  * strictly conforming C, so those go through the varargs of
  * MHD_start_daemon() instead (see start_daemon_variant()).
  */
 static unsigned int
 build_options (const uint8_t *data,
                struct MHD_OptionItem *opts,
                unsigned int flags)
 {
   unsigned int nopt = 0;
   const uint8_t mask_a = data[3];
   const uint8_t mask_b = data[4];
   const uint8_t mask_d = data[14];
   /* A thread pool needs an internal polling thread and is incompatible
      with thread-per-connection. */
   const int pool_ok =
     (0 != (flags & MHD_USE_INTERNAL_POLLING_THREAD)) &&
     (0 == (flags & MHD_USE_THREAD_PER_CONNECTION));
   /* Offer options in configurations where MHD rejects them.  One input
      in eight: the rejection branches are worth reaching, but each one
      costs the whole rest of the iteration, because the daemon does not
      start at all. */
   const int misfit = (0xE0 == (data[15] & 0xE0));
 
   if (0 != (mask_a & 0x01))
     add_opt (opts, &nopt, MHD_OPTION_CONNECTION_MEMORY_LIMIT,
              (intptr_t) PICK (mem_limit_tbl, data[6] & 0x0F), NULL);
   if (0 != (mask_a & 0x02))
     add_opt (opts, &nopt, MHD_OPTION_CONNECTION_MEMORY_INCREMENT,
              (intptr_t) PICK (mem_increment_tbl, (data[6] >> 4) & 0x0F), NULL);
   if (0 != (mask_a & 0x04))
     add_opt (opts, &nopt, MHD_OPTION_CONNECTION_LIMIT,
              (intptr_t) PICK (conn_limit_tbl, data[7] & 0x07), NULL);
   if (0 != (mask_a & 0x08))
     add_opt (opts, &nopt, MHD_OPTION_PER_IP_CONNECTION_LIMIT,
              (intptr_t) PICK (per_ip_limit_tbl, (data[7] >> 4) & 0x07), NULL);
   if (0 != (mask_a & 0x10))
     add_opt (opts, &nopt, MHD_OPTION_CONNECTION_TIMEOUT,
              (intptr_t) PICK (timeout_tbl, data[8] & 0x07), NULL);
   /* MHD_OPTION_THREAD_POOL_SIZE is rejected outright without an
      internal polling thread, and again when combined with
      MHD_USE_THREAD_PER_CONNECTION.  Both branches are worth reaching,
      but a daemon that fails to start exercises nothing else, so the
      mismatched combinations are gated behind an extra bit instead of
      being half of all the inputs that name the option. */
   if ( (0 != (mask_a & 0x20)) &&
        (pool_ok || misfit) )
     add_opt (opts, &nopt, MHD_OPTION_THREAD_POOL_SIZE,
              (intptr_t) PICK (pool_size_tbl, (data[8] >> 3) & 0x03), NULL);
   if (0 != (mask_a & 0x40))
     add_opt (opts, &nopt, MHD_OPTION_THREAD_STACK_SIZE,
              (intptr_t) PICK (stack_size_tbl, (data[8] >> 5) & 0x03), NULL);
   if (0 != (mask_a & 0x80))
     add_opt (opts, &nopt, MHD_OPTION_LISTENING_ADDRESS_REUSE,
              (intptr_t) (unsigned int) (data[11] & 0x01), NULL);
 
   if (0 != (mask_b & 0x01))
     add_opt (opts, &nopt, MHD_OPTION_LISTEN_BACKLOG_SIZE,
              (intptr_t) PICK (backlog_tbl, (data[11] >> 1) & 0x03), NULL);
   if (0 != (mask_b & 0x02))
     add_opt (opts, &nopt, MHD_OPTION_NONCE_NC_SIZE,
              (intptr_t) PICK (nonce_nc_tbl, data[9] & 0x03), NULL);
   if (0 != (mask_b & 0x04))
     add_opt (opts, &nopt, MHD_OPTION_SERVER_INSANITY,
              (intptr_t) (unsigned int) ((data[10] >> 6) & 0x03), NULL);
   if (0 != (mask_b & 0x08))
     add_opt (opts, &nopt, MHD_OPTION_STRICT_FOR_CLIENT,
              (intptr_t) PICK (strict_tbl, (data[10] >> 4) & 0x03), NULL);
   if (0 != (mask_b & 0x10))
     add_opt (opts, &nopt, MHD_OPTION_CLIENT_DISCIPLINE_LVL,
              (intptr_t) PICK (discipline_tbl, data[10] & 0x07), NULL);
   if (0 != (mask_b & 0x20))
     add_opt (opts, &nopt, MHD_OPTION_SIGPIPE_HANDLED_BY_APP,
              /* Truthful: LLVMFuzzerTestOneInput() ignores SIGPIPE
                 process-wide before anything else happens. */
              (intptr_t) 1, NULL);
   if (0 != (mask_b & 0x40))
     add_opt (opts, &nopt, MHD_OPTION_APP_FD_SETSIZE,
              (intptr_t) PICK (fd_setsize_tbl, (data[11] >> 3) & 0x07), NULL);
   if (0 != (mask_b & 0x80))
     add_opt (opts, &nopt, MHD_OPTION_ALLOW_BIN_ZERO_IN_URI_PATH,
              (intptr_t) (int) ((data[11] >> 5) & 0x03), NULL);
 
   if (0 != (mask_d & 0x01))
     add_opt (opts, &nopt, MHD_OPTION_DIGEST_AUTH_NONCE_BIND_TYPE,
              (intptr_t) (unsigned int) ((data[9] >> 2) & 0x0F), NULL);
   if (0 != (mask_d & 0x02))
     add_opt (opts, &nopt, MHD_OPTION_DIGEST_AUTH_DEFAULT_NONCE_TIMEOUT,
              (intptr_t) (unsigned int) (data[15] & 0x7F), NULL);
   if (0 != (mask_d & 0x04))
     add_opt (opts, &nopt, MHD_OPTION_DIGEST_AUTH_DEFAULT_MAX_NC,
              (intptr_t) (uint32_t) data[15], NULL);
   if (0 != (mask_d & 0x08))
     add_opt (opts, &nopt, MHD_OPTION_TCP_FASTOPEN_QUEUE_SIZE,
              (intptr_t) PICK (fastopen_tbl, (data[11] >> 6) & 0x03), NULL);
   if (0 != (mask_d & 0x10))
     add_opt (opts, &nopt, MHD_OPTION_TLS_NO_ALPN,
              (intptr_t) (int) (data[15] & 0x01), NULL);
   if (0 != (mask_d & 0x20))
     /* MHD_INVALID_SOCKET means "use the socket MHD creates itself"; a
        real descriptor is deliberately not offered, because MHD takes
        ownership of it and the harness would have to track that. */
     add_opt (opts, &nopt, MHD_OPTION_LISTEN_SOCKET,
              (intptr_t) MHD_INVALID_SOCKET, NULL);
 
   /* MHD_OPTION_DIGEST_AUTH_RANDOM keeps the caller's buffer, the _COPY
      variant makes MHD malloc() a copy that MHD_stop_daemon() has to free
      again -- a leak this harness would notice immediately. */
   if (0 != (data[5] & 0x20))
     add_opt (opts, &nopt,
              (0 != (data[5] & 0x40))
              ? MHD_OPTION_DIGEST_AUTH_RANDOM_COPY
              : MHD_OPTION_DIGEST_AUTH_RANDOM,
              (intptr_t) sizeof (digest_rnd),
              (void *) (intptr_t) digest_rnd);
 
   /* A bind address is rejected together with MHD_USE_NO_LISTEN_SOCKET;
      same reasoning as for the thread pool above. */
   if ( (0 != (data[5] & 0x80)) &&
        (cfg.listen_sock || misfit) )
   {
     prepare_sock_addrs ();
     /* The address family has to match MHD_USE_IPv6, otherwise MHD
        rejects the daemon; that check is reached through the raw flag
        escape rather than by feeding a mismatched address on purpose. */
 #ifdef AF_INET6
     if (0 != (flags & MHD_USE_IPv6))
     {
       if (0 != (data[15] & 0x02))
         add_opt (opts, &nopt, MHD_OPTION_SOCK_ADDR_LEN,
                  (intptr_t) (socklen_t) sizeof (bind6), &bind6);
       else
         add_opt (opts, &nopt, MHD_OPTION_SOCK_ADDR, 0, &bind6);
     }
     else
 #endif
     if (0 != (data[15] & 0x02))
       add_opt (opts, &nopt, MHD_OPTION_SOCK_ADDR_LEN,
                (intptr_t) (socklen_t) sizeof (bind4), &bind4);
     else
       add_opt (opts, &nopt, MHD_OPTION_SOCK_ADDR, 0, &bind4);
   }
 
   /* An option number MHD does not know at all.  parse_options_va()
      answers MHD_NO for it and MHD_start_daemon() returns NULL, which is
      the branch this reaches; keep it last so that everything above has
      already been parsed. */
   if (0 != (mask_d & 0x40))
     add_opt (opts, &nopt, (enum MHD_OPTION) (200 + (data[15] & 0x0F)),
              0, NULL);
 
   opts[nopt].option = MHD_OPTION_END;
   opts[nopt].value = 0;
   opts[nopt].ptr_value = NULL;
   return nopt;
 }
 
 
 /* The three callback options whose "not set" state is representable as a
    NULL function pointer; MHD checks all three for NULL before calling
    them, so passing NULL is exactly equivalent to omitting the option. */
 typedef void *(*fuzz_uri_log_cb)(void *, const char *,
                                  struct MHD_Connection *);
 
 #define VARARG_CALLBACKS \
         MHD_OPTION_NOTIFY_COMPLETED, cb_completed, NULL, \
         MHD_OPTION_NOTIFY_CONNECTION, cb_notify, NULL, \
         MHD_OPTION_URI_LOG_CALLBACK, cb_uri_log, NULL
 
 /* The accept policy callback, defined with the accept path further
    down. */
 static enum MHD_Result
 apc_cb (void *cls,
         const struct sockaddr *addr,
         socklen_t addrlen);
 
 
 /**
  * Start the daemon.
  *
  * MHD_OPTION_EXTERNAL_LOGGER and MHD_OPTION_UNESCAPE_CALLBACK cannot be
  * "passed as NULL": MHD calls both unconditionally, so their absence has
  * to be expressed by leaving the option out of the varargs, which is why
  * there are four spellings of the same call.  The logger comes first on
  * purpose -- MHD_OPTION_EXTERNAL_LOGGER only catches the messages
  * emitted after it has been parsed, and parsing the option array emits
  * several.
  */
 static struct MHD_Daemon *
 start_daemon_variant (unsigned int flags,
                       struct MHD_OptionItem *opts,
                       unsigned int cbsel)
 {
   MHD_AcceptPolicyCallback apc = cfg.accept_policy ? &apc_cb : NULL;
   MHD_RequestCompletedCallback cb_completed =
     (0 != (cbsel & 0x01)) ? &completed_cb : NULL;
   MHD_NotifyConnectionCallback cb_notify =
     (0 != (cbsel & 0x02)) ? &notify_connection_cb : NULL;
   fuzz_uri_log_cb cb_uri_log =
     (0 != (cbsel & 0x04)) ? &uri_log_cb : NULL;
 
   switch ((cbsel >> 3) & 0x03)
   {
   case 1:
     return MHD_start_daemon (flags, 0, apc, NULL, &ahc, NULL,
                              MHD_OPTION_ARRAY, opts,
                              VARARG_CALLBACKS,
                              MHD_OPTION_UNESCAPE_CALLBACK, &unescape_cb, NULL,
                              MHD_OPTION_END);
   case 2:
     return MHD_start_daemon (flags, 0, apc, NULL, &ahc, NULL,
                              MHD_OPTION_EXTERNAL_LOGGER, &logger_cb, NULL,
                              MHD_OPTION_ARRAY, opts,
                              VARARG_CALLBACKS,
                              MHD_OPTION_END);
   case 3:
     return MHD_start_daemon (flags, 0, apc, NULL, &ahc, NULL,
                              MHD_OPTION_EXTERNAL_LOGGER, &logger_cb, NULL,
                              MHD_OPTION_ARRAY, opts,
                              VARARG_CALLBACKS,
                              MHD_OPTION_UNESCAPE_CALLBACK, &unescape_cb, NULL,
                              MHD_OPTION_END);
   default:
     return MHD_start_daemon (flags, 0, apc, NULL, &ahc, NULL,
                              MHD_OPTION_ARRAY, opts,
                              VARARG_CALLBACKS,
                              MHD_OPTION_END);
   }
 }
 
 
 /**
  * The accept policy callback.  MHD_accept_connection() calls it with the
  * peer address of every socket it accepts, and answering MHD_NO makes
  * new_connection_prepare_() close the socket and drop the IP-limit entry
  * before any connection object exists -- a path nothing else here
  * reaches.  (It does *not* reach new_connection_close_(): that one is
  * only called from close_all_connections(), for connections queued by
  * MHD_add_connection() and never started.  See the byte 3 bit 4
  * scenario in fuzz_eventloop.c.)
  */
 static enum MHD_Result
 apc_cb (void *cls,
         const struct sockaddr *addr,
         socklen_t addrlen)
 {
   volatile size_t sink;
 
   (void) cls;
   sink = (size_t) addrlen + ((NULL != addr) ? (size_t) addr->sa_family : 0u);
   (void) sink;
   return cfg.accept_policy_deny ? MHD_NO : MHD_YES;
 }
 
 
 /**
  * Really connect to the daemon's listening socket.
  *
  * MHD_add_connection() bypasses accept(), so without this the whole
  * accept path -- MHD_accept_connection(), the accept policy callback,
  * the listen-socket branches of the three event loops -- is unreachable.
  * The client end is given SO_LINGER {1, 0} so that close() sends a RST
  * and neither side ends up in TIME_WAIT: at fuzzing rates the ephemeral
  * port range would otherwise be exhausted within a couple of minutes.
  *
  * @param d the daemon, which must have a listening socket
  * @param flags the flags it was started with, to pick the address family
  * @return the connected socket, or -1
  */
 static int
 connect_real (struct MHD_Daemon *d,
               unsigned int flags)
 {
   const union MHD_DaemonInfo *di;
   struct linger lg;
   int s;
   uint16_t port;
 
   di = MHD_get_daemon_info (d, MHD_DAEMON_INFO_BIND_PORT);
   if ( (NULL == di) ||
        (0 == di->port) )
     return -1;
   port = (uint16_t) di->port;
   prepare_sock_addrs ();
 #ifdef AF_INET6
   if (0 != (flags & MHD_USE_IPv6))
   {
     struct sockaddr_in6 to = bind6;
 
     to.sin6_port = htons (port);
     s = socket (AF_INET6, SOCK_STREAM, 0);
     if (0 > s)
       return -1;
     if (0 != connect (s, (const struct sockaddr *) &to, sizeof (to)))
     {
       (void) close (s);
       return -1;
     }
   }
   else
 #endif
   {
     struct sockaddr_in to = bind4;
 
     to.sin_port = htons (port);
     s = socket (AF_INET, SOCK_STREAM, 0);
     if (0 > s)
       return -1;
     if (0 != connect (s, (const struct sockaddr *) &to, sizeof (to)))
     {
       (void) close (s);
       return -1;
     }
   }
   lg.l_onoff = 1;
   lg.l_linger = 0;
   (void) setsockopt (s, SOL_SOCKET, SO_LINGER, &lg, sizeof (lg));
   stat_real_conns++;
   return s;
 }
 
 
 /**
  * Ask MHD_is_feature_supported() about one feature.  The function is a
  * large switch in daemon.c that no other harness touches; the index
  * comes off the input so that invalid values reach its default branch
  * as well.
  */
 static void
 query_feature (uint8_t sel)
 {
   volatile int sink;
 
   sink = (int) MHD_is_feature_supported ((enum MHD_FEATURE) (sel % 40u));
   (void) sink;
 }
 
 
 /**
  * Read everything MHD_get_daemon_info() offers.  All of it lives in
  * daemon.c and none of it is reachable from the other harnesses.
  */
 static void
 query_daemon_info (struct MHD_Daemon *d)
 {
   volatile unsigned int sink = 0;
   const union MHD_DaemonInfo *di;
 
   sink += (unsigned int) (NULL != MHD_get_version ());
   sink += MHD_get_version_bin ();
 
   di = MHD_get_daemon_info (d, MHD_DAEMON_INFO_CURRENT_CONNECTIONS);
   if (NULL != di)
     sink += di->num_connections;
   di = MHD_get_daemon_info (d, MHD_DAEMON_INFO_FLAGS);
   if (NULL != di)
     sink += (unsigned int) di->flags;
   di = MHD_get_daemon_info (d, MHD_DAEMON_INFO_BIND_PORT);
   if (NULL != di)
     sink += di->port;
   di = MHD_get_daemon_info (d, MHD_DAEMON_INFO_LISTEN_FD);
   if (NULL != di)
     sink += (unsigned int) (di->listen_fd + 1);
   di = MHD_get_daemon_info (d, MHD_DAEMON_INFO_EPOLL_FD);
   if (NULL != di)
     sink += (unsigned int) (di->listen_fd + 1);
   (void) sink;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* The fuzz target                                                     */
 /* ------------------------------------------------------------------ */
 
 int
 LLVMFuzzerTestOneInput (const uint8_t *data,
                         size_t size)
 {
   struct MHD_Daemon *d;
   struct MHD_OptionItem opts[MAX_OPTS];
   unsigned int flags;
   int sock = -1;
   int rsock = -1;
   size_t pos;
   unsigned int nseg = 0;
   unsigned int nconn = 1;
   unsigned int cbsel;
   MHD_socket quiesced = MHD_INVALID_SOCKET;
 
   /* Must happen before the first write() into the socketpair, and must
      not be left to the built-in driver: fuzz_install_handlers() is
      compiled out under -DFUZZ_NO_MAIN, which is exactly the build every
      external fuzzing engine uses.  The call is idempotent.  See
      fuzz_ignore_sigpipe() in fuzz_common.h for what happens without it. */
   fuzz_ignore_sigpipe ();
 
   /* The sixteen configuration bytes are mandatory.  An input of exactly
      that length is fine and starts a daemon with no traffic. */
   if (size < CFG_BYTES)
     return 0;
 
   memset (&cfg, 0, sizeof (cfg));
   memset (pending_resume, 0, sizeof (pending_resume));
   tearing_down = 0;
 
   flags = flags_from_input (data);
   if (cfg.listen_sock)
     flags &= ~((unsigned int) MHD_USE_NO_LISTEN_SOCKET);
   else
     flags |= MHD_USE_NO_LISTEN_SOCKET;
   if (cfg.err_log)
     flags |= MHD_USE_ERROR_LOG;
   else
     flags &= ~((unsigned int) MHD_USE_ERROR_LOG);
 
   cfg.uses_threads = (0 != (flags & (MHD_USE_INTERNAL_POLLING_THREAD
                                      | MHD_USE_THREAD_PER_CONNECTION)));
   if (cfg.uses_threads &&
       (0 == (flags & MHD_USE_NO_THREAD_SAFETY)))
   {
     /* Without the inter-thread communication channel a worker only
        notices a connection handed to it by MHD_add_connection() when its
        own poll times out, so every threaded iteration would pay the full
        wait.  MHD forces ITC on anyway whenever there is no listen
        socket; this extends that to the daemons that have one. */
     flags |= MHD_USE_ITC;
   }
 
   cfg.loop_mode = (unsigned int) (data[12] & 0x03);
   cfg.quiesce = (0 != (data[12] & 0x04));
   if (cfg.quiesce &&
       cfg.uses_threads &&
       uses_epoll (flags) &&
       (! quiesce_epoll_race_allowed ()))
     cfg.quiesce = 0;
   cfg.daemon_info = (0 != (data[12] & 0x08));
   cfg.suspend_mode = (0 != (flags & SUSPEND_BIT))
                      ? (int) ((data[12] >> 4) & 0x03)
                      : 0;
   if (3 == cfg.suspend_mode)
     cfg.suspend_mode = 1;
   cfg.nconn_max = 1u + (unsigned int) ((data[12] >> 6) & 0x03);
   if (cfg.nconn_max > MAX_CONNECTIONS)
     cfg.nconn_max = MAX_CONNECTIONS;
 
   cfg.resp_kind = (unsigned int) (data[13] & 0x03);
   cfg.handler_no = (0 != (data[13] & 0x04));
   cfg.conn_option = (0 != (data[13] & 0x08));
   cfg.accept_policy = (0 != (data[13] & 0x10));
   cfg.accept_policy_deny = (0 != (data[13] & 0x20));
   /* One iteration in four of those that have a listening socket at all;
      a real connect()/accept() pair is much more expensive than
      MHD_add_connection() on a socketpair. */
   cfg.real_connect = cfg.listen_sock && (0xC0 == (data[13] & 0xC0));
 
   (void) build_options (data, opts, flags);
 
   cbsel = (unsigned int) data[5];
   /* MHD_USE_ERROR_LOG without MHD_OPTION_EXTERNAL_LOGGER sends every
      message MHD produces to stderr through MHD_default_logger_, which
      at fuzzing rates is tens of megabytes of noise.  The flag is far too
      valuable to drop -- with it set, several hundred MHD_DLOG() call
      sites in daemon.c become live -- so the logger is forced on instead
      (bit 4 of the callback selector). */
   if (cfg.err_log)
     cbsel |= 0x10u;
 
   MHD_set_panic_func (&panic_cb, NULL);
   d = start_daemon_variant (flags, opts, cbsel);
   if (NULL == d)
   {
     /* Entirely normal: an unsupported flag combination, an option MHD
        rejects, a bind() failure, ... */
     stat_daemons_failed++;
     return 0;
   }
   stat_daemons++;
   if (cfg.uses_threads)
     stat_threaded++;
   if (! stats_registered)
   {
     stats_registered = 1;
     (void) atexit (&print_stats);
   }
 
   if (cfg.daemon_info)
     query_daemon_info (d);
   query_feature (data[15]);
 
   if (cfg.real_connect)
   {
     rsock = connect_real (d, flags);
     if (0 <= rsock)
     {
       static const char req[] = "GET / HTTP/1.1\r\nHost: x\r\n\r\n";
 
       (void) send (rsock, req, sizeof (req) - 1, MSG_DONTWAIT);
       if (cfg.uses_threads)
         wait_threaded (rsock);
       else
         pump (d, rsock, PUMP_ROUNDS_LONG);
     }
   }
 
   (void) new_connection (d, &sock);
 
   pos = CFG_BYTES;
   while ( (pos + 2 <= size) &&
           (nseg < MAX_SEGMENTS) )
   {
     unsigned int hdr = (unsigned int) data[pos]
                        | ((unsigned int) data[pos + 1] << 8);
     unsigned int op = hdr >> 14;
     size_t slen = (size_t) (hdr & 0x3FFF);
 
     pos += 2;
     nseg++;
     if (slen > size - pos)
       slen = size - pos;
 
     if ( (3 == op) &&
          (nconn < cfg.nconn_max) )
     {
       close_connection (d, &sock);
       (void) new_connection (d, &sock);
       nconn++;
     }
     if (0 != slen)
       send_all (d, sock, data + pos, slen);
     pos += slen;
     if (cfg.uses_threads)
       continue;                 /* the threaded shape drains at close */
     pump (d, sock, (0 == op) ? PUMP_ROUNDS : PUMP_ROUNDS_LONG);
   }
 
   close_connection (d, &sock);
   pump (d, sock, 4);
   if (0 <= rsock)
   {
     (void) shutdown (rsock, SHUT_WR);
     if (cfg.uses_threads)
       wait_threaded (rsock);
     else
       pump (d, rsock, 4);
     (void) close (rsock);
     rsock = -1;
   }
 
   /* A connection left suspended makes MHD_stop_daemon() MHD_PANIC(), and
      MHD_resume_connection() alone is not enough: it only raises a flag,
      and the connection is taken off the daemon's suspended list by
      MHD_run().  So flush and run until nothing is parked any more.
      tearing_down keeps the handler from parking anything new, which is
      what bounds this loop; the cap is only a backstop. */
   tearing_down = 1;
   if (! cfg.uses_threads)
   {
     unsigned int i;
 
     for (i = 0; i < MAX_CONNECTIONS + 2u; i++)
     {
       if (! pending_resume_flush ())
         break;
       (void) MHD_run (d);
     }
   }
 
   if (cfg.quiesce)
   {
     /* The returned socket belongs to the caller from here on, and with
        internal threads it must not be closed before MHD_stop_daemon()
        has joined them. */
     quiesced = MHD_quiesce_daemon (d);
   }
   MHD_stop_daemon (d);
   if (MHD_INVALID_SOCKET != quiesced)
     (void) close ((int) quiesced);
   return 0;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Structure-aware generator                                           */
 /* ------------------------------------------------------------------ */
 
 /* Defined unconditionally, exactly like the rest of the harness API:
    only main() may live behind #ifndef FUZZ_NO_MAIN, and fuzz_common.h
    already declares these three with FUZZ_UNUSED so that the libFuzzer
    and AFL++ builds, which never call them, compile without a warning. */
 
 struct sbuf
 {
   uint8_t *p;
   size_t len;
   size_t cap;
 };
 
 
 static void
 sb_raw (struct sbuf *b,
         const void *s,
         size_t n)
 {
   if (b->len + n > b->cap)
     n = b->cap - b->len;
   memcpy (b->p + b->len, s, n);
   b->len += n;
 }
 
 
 static void
 sb_str (struct sbuf *b,
         const char *s)
 {
   sb_raw (b, s, strlen (s));
 }
 
 
 static void
 sb_u64 (struct sbuf *b,
         uint64_t v,
         int hex)
 {
   char tmp[32];
 
   (void) snprintf (tmp, sizeof (tmp),
                    hex ? "%llx" : "%llu",
                    (unsigned long long) v);
   sb_str (b, tmp);
 }
 
 
 static const char *const gen_methods[] = {
   "GET", "POST", "HEAD", "PUT", "OPTIONS", "DELETE", "TRACE", "CONNECT",
   "PATCH", "get", "BREW", ""
 };
 
 static const char *const gen_targets[] = {
   "/", "/a", "/a/b/c", "*", "http://x/a", "/%41%42", "/a?b=c&d",
   "/very/long/path/that/does/not/fit/into/a/small/connection/memory/pool",
   "/a?novalue", "//", "/.%2e/", "/\x01"
 };
 
 static const char *const gen_versions[] = {
   "HTTP/1.1", "HTTP/1.0", "HTTP/1.2", "HTTP/0.9", "HTTP/1", ""
 };
 
 static const char *const gen_hdr_names[] = {
   "Host", "Connection", "Accept", "User-Agent", "Cookie", "Expect",
   "Content-Type", "X-Fuzz", "Upgrade", "Accept-Encoding", "Range",
   "If-Modified-Since"
 };
 
 static const char *const gen_hdr_values[] = {
   "x", "keep-alive", "close", "*/*", "a=b; c=d", "100-continue",
   "text/plain", "1", "fuzz-protocol", "gzip", "bytes=0-1", "chunked"
 };
 
 
 /**
  * Emit one HTTP request into @a b.
  *
  * The shapes are deliberately unambitious -- the request parser is
  * fuzz_request's subject, not this harness's.  What matters here is that
  * the bytes form something MHD will actually take through its state
  * machine under whatever daemon configuration the configuration bytes
  * describe, so that the option handling is exercised against a live
  * connection rather than against a connection MHD drops on the first
  * byte.
  */
 static void
 gen_request (struct fuzz_rng *rng,
              struct sbuf *b,
              unsigned int shape)
 {
   unsigned int nhdr;
   unsigned int i;
 
   switch (shape % 10)
   {
   case 9:
     /* Not HTTP at all: MHD has to reject it, which is its own path. */
     for (i = 0; i < 24; i++)
     {
       uint8_t c = fuzz_byte (rng);
 
       sb_raw (b, &c, 1);
     }
     return;
   case 6:
     /* Two pipelined requests on one connection. */
     sb_str (b, "GET /a HTTP/1.1\r\nHost: x\r\n\r\n");
     sb_str (b, "GET /b HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n");
     return;
   default:
     break;
   }
 
   sb_str (b, gen_methods[fuzz_below (rng, (uint32_t) (sizeof (gen_methods)
                                                       / sizeof (gen_methods[0]
                                                                 )))]);
   sb_str (b, " ");
   sb_str (b, gen_targets[fuzz_below (rng, (uint32_t) (sizeof (gen_targets)
                                                       / sizeof (gen_targets[0]
                                                                 )))]);
   sb_str (b, " ");
   sb_str (b, gen_versions[fuzz_below (rng,
                                       (uint32_t) (sizeof (gen_versions)
                                                   / sizeof (gen_versions[0])))
           ]);
   sb_str (b, "\r\n");
 
   nhdr = (5 == (shape % 10)) ? (8 + fuzz_below (rng, 24)) : fuzz_below (rng, 5);
   for (i = 0; i < nhdr; i++)
   {
     sb_str (b, gen_hdr_names[fuzz_below (rng,
                                          (uint32_t) (sizeof (gen_hdr_names)
                                                      / sizeof (gen_hdr_names[0]
                                                                )))]);
     sb_str (b, ": ");
     sb_str (b, gen_hdr_values[fuzz_below (rng,
                                           (uint32_t) (sizeof (gen_hdr_values)
                                                       / sizeof (gen_hdr_values[
                                                                   0])))]);
     sb_str (b, "\r\n");
   }
 
   switch (shape % 10)
   {
   case 2:                      /* Content-Length body */
     {
       uint32_t n = fuzz_below (rng, 64);
 
       sb_str (b, "Content-Length: ");
       sb_u64 (b, n, 0);
       sb_str (b, "\r\n\r\n");
       for (i = 0; i < n; i++)
         sb_str (b, "A");
       break;
     }
   case 3:                      /* chunked body */
     {
       unsigned int nch = 1 + fuzz_below (rng, 3);
 
       sb_str (b, "Transfer-Encoding: chunked\r\n\r\n");
       for (i = 0; i < nch; i++)
       {
         uint32_t n = 1 + fuzz_below (rng, 16);
         uint32_t k;
 
         sb_u64 (b, n, 1);
         sb_str (b, "\r\n");
         for (k = 0; k < n; k++)
           sb_str (b, "B");
         sb_str (b, "\r\n");
       }
       sb_str (b, "0\r\n\r\n");
       break;
     }
   case 4:                      /* expect 100-continue */
     sb_str (b, "Expect: 100-continue\r\nContent-Length: 4\r\n\r\nabcd");
     break;
   case 7:                      /* upgrade request */
     sb_str (b, "Connection: Upgrade\r\nUpgrade: fuzz-protocol\r\n\r\n");
     break;
   case 8:                      /* truncated: MHD keeps waiting for more */
     sb_str (b, "X-Trunc: ");
     break;
   default:
     sb_str (b, "\r\n");
     break;
   }
 }
 
 
 /**
  * Serialise @a body into the segment stream understood by
  * LLVMFuzzerTestOneInput().
  */
 static void
 emit_segments (struct fuzz_rng *rng,
                struct sbuf *out,
                const uint8_t *body,
                size_t body_len,
                int new_conn_first)
 {
   size_t off = 0;
   int first = 1;
 
   while (off < body_len)
   {
     size_t chunk;
     unsigned int op;
     uint8_t hdr[2];
     unsigned int hv;
 
     switch (fuzz_below (rng, 5))
     {
     case 0:
       chunk = 1;
       break;
     case 1:
       chunk = 2 + fuzz_below (rng, 8);
       break;
     default:
       chunk = body_len - off;
       break;
     }
     if (chunk > body_len - off)
       chunk = body_len - off;
     if (chunk > 0x3FFF)
       chunk = 0x3FFF;
     op = (first && new_conn_first) ? 3u : (fuzz_chance (rng, 5) ? 2u : 0u);
     hv = (op << 14) | (unsigned int) chunk;
     hdr[0] = (uint8_t) (hv & 0xFF);
     hdr[1] = (uint8_t) (hv >> 8);
     if (out->len + 2 + chunk > out->cap)
       return;
     sb_raw (out, hdr, 2);
     sb_raw (out, body + off, chunk);
     off += chunk;
     first = 0;
   }
 }
 
 
 /**
  * The generator.
  *
  * Purely random configuration bytes are already useful for this harness
  * -- unlike an HTTP request, an option array has no grammar to get wrong
  * -- but two things still need help.  Byte 0 is biased into the range of
  * mode_tbl[] so that most iterations get a daemon that actually starts,
  * and the tail of the input has to look like HTTP, or MHD closes every
  * connection before any of the configured behaviour has a chance to
  * matter.
  */
 static size_t
 fuzz_generate (struct fuzz_rng *rng,
                uint8_t *buf,
                size_t cap)
 {
   struct sbuf out;
   uint8_t cfg_bytes[CFG_BYTES];
   uint8_t req[GEN_BUF_SIZE];
   struct sbuf rb;
   unsigned int nreq;
   unsigned int i;
 
   out.p = buf;
   out.len = 0;
   out.cap = cap;
 
   for (i = 0; i < CFG_BYTES; i++)
     cfg_bytes[i] = fuzz_byte (rng);
 
   /* Byte 0 selects the daemon shape; keep it inside the table so that
      the value is not folded by the modulo in an uneven way. */
   cfg_bytes[0] = (uint8_t) fuzz_below (rng, (uint32_t) MODE_COUNT);
   /* The raw flag escape is 1 in 4 of the byte-2 values, which is far too
      often: those daemons mostly fail to start and never reach the option
      handling.  Clear the escape unless it is explicitly rolled. */
   if (! fuzz_chance (rng, 10))
     cfg_bytes[2] &= (uint8_t) ~0xC0u;
   else
     cfg_bytes[2] |= (uint8_t) 0xC0u;
   /* Likewise the deliberately invalid option number: useful, but every
      input carrying it ends in MHD_start_daemon() == NULL. */
   if (! fuzz_chance (rng, 20))
     cfg_bytes[14] &= (uint8_t) ~0x40u;
 
   sb_raw (&out, cfg_bytes, CFG_BYTES);
 
   nreq = 1u + (fuzz_chance (rng, 4) ? 1u : 0u);
   for (i = 0; i < nreq; i++)
   {
     rb.p = req;
     rb.len = 0;
     rb.cap = sizeof (req);
     gen_request (rng, &rb, fuzz_below (rng, 10));
     emit_segments (rng, &out, req, rb.len,
                    (0 != i) || fuzz_chance (rng, 6));
   }
   return out.len;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Built-in seed corpus                                                */
 /* ------------------------------------------------------------------ */
 
 /**
  * A seed is sixteen configuration bytes plus one request, rendered into
  * the wire format at run time so that segment lengths never have to be
  * spelled out by hand.
  *
  * Every seed turns on exactly one area, so that a corpus minimiser keeps
  * them distinguishable, and the configuration bytes of a seed that does
  * not care about an area are zero -- which is the plainest setting:
  * external polling with select(), no listen socket, no options at all,
  * one connection, MHD_run() as the event loop.
  */
 struct seed_def
 {
   const char *name;
   unsigned char cfg[CFG_BYTES];
   const char *req;
 };
 
 /* Byte positions inside seed_def::cfg, for readability. */
 #define C_MODE 0
 #define C_FLAGA 1
 #define C_FLAGB 2
 #define C_OPTA 3
 #define C_OPTB 4
 #define C_OPTC 5
 #define C_VAL_MEM 6
 #define C_VAL_CONN 7
 #define C_VAL_THR 8
 #define C_VAL_DAUTH 9
 #define C_VAL_DISC 10
 #define C_VAL_SOCK 11
 #define C_DRIVE 12
 #define C_HANDLER 13
 #define C_OPTD 14
 #define C_SPARE 15
 
 #define REQ_PLAIN "GET /a HTTP/1.1\r\nHost: x\r\n\r\n"
 #define REQ_CLOSE "GET /a HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n"
 #define REQ_POST \
         "POST /a HTTP/1.1\r\nHost: x\r\nContent-Length: 4\r\n\r\nabcd"
 #define REQ_CHUNKED \
         "POST /a HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\n" \
         "\r\n3\r\nabc\r\n0\r\n\r\n"
 
 static const struct seed_def seeds[] = {
   /* ---- the event loops, all external ---- */
   { "plain-external-run",
     { 0 }, REQ_PLAIN },
   { "external-fdset2",
     { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x01 | 0x08, 0, 0, 0 },
     REQ_PLAIN },
   { "external-run-wait",
     { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x02, 0, 0, 0 },
     REQ_PLAIN },
   { "external-fdset-v1",
     { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x03, 0, 0, 0 },
     REQ_PLAIN },
   { "external-epoll",
     { 12, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "external-auto",
     { 16, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
 
   /* ---- the daemon shapes that run their own threads ---- */
   { "internal-thread-select",
     { 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_CLOSE },
   { "internal-thread-poll",
     { 19, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_CLOSE },
   { "internal-thread-epoll",
     { 20, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_CLOSE },
   { "thread-per-connection",
     { 21, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_CLOSE },
   { "thread-per-connection-poll",
     { 22, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_CLOSE },
   /* A thread pool needs MHD_OPTION_THREAD_POOL_SIZE (option mask A bit
      5) on top of an internal polling thread, and is rejected outright
      with thread-per-connection. */
   { "thread-pool",
     { 18, 0, 0, 0x20, 0, 0, 0, 0, 0x00, 0, 0, 0, 0, 0, 0, 0 },
     REQ_CLOSE },
   { "thread-pool-epoll-stack",
     { 20, 0, 0, 0x20 | 0x40, 0, 0, 0, 0, 0x10 | 0x20, 0, 0, 0, 0, 0, 0, 0 },
     REQ_CLOSE },
 
   /* ---- a real listening socket ---- */
   { "listen-socket",
     { 0, 0, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "listen-socket-reuse-backlog",
     { 0, 0, 0x01, 0x80, 0x01, 0, 0, 0, 0, 0, 0, 0x01 | 0x06, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "listen-socket-sockaddr",
     { 0, 0, 0x01, 0, 0, 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "listen-socket-ipv6-dual",
     { 0, 0, 0x01 | 0x02 | 0x04, 0, 0, 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "listen-socket-quiesce",
     { 0, 0, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x04 | 0x08, 0, 0, 0 },
     REQ_PLAIN },
   { "listen-socket-internal-thread",
     { 18, 0, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x04, 0, 0, 0 },
     REQ_CLOSE },
 
   /* ---- the accept() path: a real client on the listening socket ----
      Byte 13 bit 0x40|0x80 asks for the connect(), bit 0x10 installs the
      accept policy callback and bit 0x20 makes it say no.  Without these
      MHD_accept_connection() and the listen-socket branches of the three
      event loops are never entered at all: MHD_add_connection() bypasses
      accept() completely. */
   { "real-connect",
     { 0, 0, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xC0, 0, 0 },
     REQ_PLAIN },
   { "real-connect-accept-policy",
     { 0, 0, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xC0 | 0x10, 0, 0 },
     REQ_PLAIN },
   { "real-connect-accept-denied",
     { 0, 0, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xC0 | 0x10 | 0x20, 0, 0 },
     REQ_PLAIN },
   { "real-connect-internal-thread",
     { 18, 0, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xC0, 0, 0 },
     REQ_CLOSE },
   { "real-connect-external-epoll",
     { 12, 0, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xC0, 0, 0 },
     REQ_PLAIN },
 
   /* ---- the memory options ---- */
   { "tiny-pool",
     { 0, 0, 0, 0x01 | 0x02, 0, 0, 0x01 | 0x10, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "big-pool-big-increment",
     { 0, 0, 0, 0x01 | 0x02, 0, 0, 0x0C | 0x60, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_POST },
 
   /* ---- the connection limits ---- */
   { "connection-limit-one",
     { 0, 0, 0, 0x04, 0, 0, 0, 0x01, 0, 0, 0, 0, 0xC0, 0, 0, 0 },
     REQ_PLAIN },
   { "per-ip-limit-one",
     { 0, 0, 0, 0x08, 0, 0, 0, 0x10, 0, 0, 0, 0, 0xC0, 0, 0, 0 },
     REQ_PLAIN },
   { "connection-limit-zero",
     { 0, 0, 0, 0x04, 0, 0, 0, 0x00, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "connection-timeout",
     { 0, 0, 0, 0x10, 0, 0, 0, 0, 0x01, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
 
   /* ---- parsing discipline and insanity ---- */
   { "discipline-lowest",
     { 0, 0, 0, 0, 0x10, 0, 0, 0, 0, 0, 0x00, 0, 0, 0, 0, 0 },
     "GET /a HTTP/1.1\r\n Host: x\r\n\r\n" },
   { "discipline-highest-pedantic",
     { 0, 0x01, 0, 0, 0x10, 0, 0, 0, 0, 0, 0x05, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "strict-for-client",
     { 0, 0, 0, 0, 0x08, 0, 0, 0, 0, 0, 0x00, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "server-insanity",
     { 0, 0, 0, 0, 0x04, 0, 0, 0, 0, 0, 0x40, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "bin-zero-in-uri-path",
     { 0, 0, 0, 0, 0x80, 0, 0, 0, 0, 0, 0, 0x20, 0, 0, 0, 0 },
     "GET /a%00b HTTP/1.1\r\nHost: x\r\n\r\n" },
   { "app-fd-setsize",
     { 0, 0, 0, 0, 0x40, 0, 0, 0, 0, 0, 0, 0x00, 0x01, 0, 0, 0 },
     REQ_PLAIN },
 
   /* ---- the callbacks ---- */
   { "notify-completed",
     { 0, 0, 0, 0, 0, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "notify-connection",
     { 0, 0, 0, 0, 0, 0x02, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "uri-log-callback",
     { 0, 0, 0, 0, 0, 0x04, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     "GET /a?q=%41 HTTP/1.1\r\nHost: x\r\n\r\n" },
   { "external-logger",
     { 0, 0x40, 0, 0, 0, 0x10, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "unescape-callback",
     { 0, 0, 0, 0, 0, 0x08, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     "GET /%41%42?a=%43 HTTP/1.1\r\nHost: x\r\n\r\n" },
   { "all-callbacks-error-log",
     { 0, 0x40, 0, 0, 0, 0x01 | 0x02 | 0x04 | 0x08 | 0x10,
       0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
 
   /* ---- digest-auth related options ---- */
   { "digest-random",
     { 0, 0, 0, 0, 0x02, 0x20, 0, 0, 0, 0x02, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "digest-random-copy",
     { 0, 0, 0, 0, 0x02, 0x20 | 0x40, 0, 0, 0, 0x01, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "digest-nonce-bind-and-defaults",
     { 0, 0, 0, 0, 0, 0x20, 0, 0, 0, 0x3C, 0, 0, 0, 0,
       0x01 | 0x02 | 0x04, 0x11 },
     REQ_PLAIN },
 
   /* ---- suspend / resume ---- */
   { "suspend-immediate",
     { 0, 0x04, 0, 0, 0, 0x01, 0, 0, 0, 0, 0, 0, 0x10, 0, 0, 0 },
     REQ_PLAIN },
   { "suspend-deferred",
     { 0, 0x04, 0, 0, 0, 0x01, 0, 0, 0, 0, 0, 0, 0x20, 0, 0, 0 },
     REQ_PLAIN },
   { "suspend-deferred-two-connections",
     { 0, 0x04, 0, 0, 0, 0x01, 0, 0, 0, 0, 0, 0, 0x20 | 0x40, 0, 0, 0 },
     REQ_PLAIN },
 
   /* ---- the remaining flag bits ---- */
   { "turbo-itc-suppress-date",
     { 0, 0x02 | 0x10 | 0x20, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "allow-upgrade",
     { 0, 0x08, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     "GET / HTTP/1.1\r\nHost: x\r\nConnection: Upgrade\r\n"
     "Upgrade: fuzz-protocol\r\n\r\n" },
   { "no-thread-safety",
     { 0, 0, 0x10, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "tcp-fastopen-listen",
     { 0, 0, 0x01 | 0x08, 0, 0, 0, 0, 0, 0, 0, 0, 0x40, 0, 0, 0x08, 0 },
     REQ_PLAIN },
   { "sigpipe-handled-by-app",
     { 0, 0, 0, 0, 0x20, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   { "listen-socket-option-invalid-fd",
     { 0, 0, 0x01, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x20, 0 },
     REQ_PLAIN },
 
   /* ---- inputs whose daemon must not start ---- */
   /* Raw flag escape: MHD_USE_POLL together with MHD_USE_EPOLL. */
   { "raw-flags-poll-and-epoll",
     { 0, 0x40, 0xC0 | 0x02, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   /* Raw flag escape: MHD_USE_EPOLL with MHD_USE_THREAD_PER_CONNECTION. */
   { "raw-flags-epoll-thread-per-conn",
     { 0, 0x04 | 0x08, 0xC0 | 0x02, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
   /* An option number MHD does not know. */
   { "invalid-option-number",
     { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x40, 0 },
     REQ_PLAIN },
   /* MHD_OPTION_THREAD_POOL_SIZE without an internal polling thread. */
   { "thread-pool-without-threads",
     { 0, 0, 0, 0x20, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
     REQ_PLAIN },
 
   /* ---- the handler behaviours ---- */
   { "handler-returns-no",
     { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x04, 0, 0 },
     REQ_PLAIN },
   { "empty-and-copied-responses",
     { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x01 | 0x08, 0, 0 },
     REQ_CHUNKED },
   { "error-response",
     { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x03, 0, 0 },
     REQ_POST },
 
   /* ---- everything at once ---- */
   { "kitchen-sink-external",
     { 0, 0x02 | 0x04 | 0x10 | 0x20 | 0x40, 0x01,
       0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x80,
       0x02 | 0x10 | 0x20 | 0x40 | 0x80,
       0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20,
       0x63, 0x45, 0x21, 0x13, 0x02, 0x0A,
       0x01 | 0x04 | 0x08 | 0x20, 0x08, 0x01 | 0x02 | 0x04 | 0x10, 0x33 },
     REQ_POST },
   { "kitchen-sink-thread-pool",
     { 18, 0x02 | 0x10 | 0x20 | 0x40, 0x01,
       0x01 | 0x04 | 0x08 | 0x10 | 0x20 | 0x40 | 0x80,
       0x01 | 0x02 | 0x80,
       0x01 | 0x02 | 0x04 | 0x08 | 0x10 | 0x20,
       0x03, 0x46, 0x39, 0x02, 0x00, 0x0A,
       0x04 | 0x08, 0x00, 0x01 | 0x08, 0x22 },
     REQ_CLOSE }
 };
 
 static uint8_t seed_render_buf[1024];
 
 
 static size_t
 fuzz_seed_count (void)
 {
   return sizeof (seeds) / sizeof (seeds[0]);
 }
 
 
 static const uint8_t *
 fuzz_seed_get (size_t idx,
                size_t *len)
 {
   const struct seed_def *sd = &seeds[idx];
   struct sbuf b;
 
   b.p = seed_render_buf;
   b.len = 0;
   b.cap = sizeof (seed_render_buf);
   sb_raw (&b, sd->cfg, CFG_BYTES);
   if (NULL != sd->req)
   {
     size_t n = strlen (sd->req);
     unsigned int hv;
     uint8_t hdr[2];
 
     if (n > 0x3FFF)
       n = 0x3FFF;
     hv = (0u << 14) | (unsigned int) n;
     hdr[0] = (uint8_t) (hv & 0xFF);
     hdr[1] = (uint8_t) (hv >> 8);
     sb_raw (&b, hdr, 2);
     sb_raw (&b, sd->req, n);
   }
   *len = b.len;
   return seed_render_buf;
 }