Copilot commented on code in PR #13827:
URL: https://github.com/apache/trafficserver/pull/13827#discussion_r4249683306
##########
tests/fuzzing/fuzz_http_compat.cc:
##########
@@ -0,0 +1,110 @@
+#include "proxy/hdrs/HTTP.h"
+#include "proxy/hdrs/HttpCompat.h"
+#include "tscore/Diags.h"
+#include "tsutil/PostScript.h"
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+
+extern int cmd_disable_pfreelist;
+
+namespace
+{
+constexpr size_t MAX_INPUT_LENGTH = 16 * 1024;
+
+void
+exercise_lists(const std::string &value, const std::string &candidate, uint8_t
flags, int output_length)
+{
+ StrList comma_list((flags & 1) != 0);
+ StrList semicolon_list((flags & 2) != 0);
+ StrList token_list((flags & 4) != 0);
+ std::array<char, 256> output{};
+ std::array<char, 256> type{};
+ std::array<char, 256> subtype{};
+ int matching_length = 0;
+ int matching_index = 0;
+ int value_length = static_cast<int>(value.size());
+ int candidate_length = static_cast<int>(candidate.size());
+ char separator = (flags & 8) != 0 ? ';' : ',';
+ bool ignore_wildcards = (flags & 16) != 0;
Review Comment:
The bitmask values (1, 2, 4, 8, 16, etc.) are magic numbers, which makes it
hard to reason about what each fuzz flag enables. Consider introducing named
constants (e.g., `constexpr uint8_t FLAG_COMMA_LIST = 1u << 0;` etc., or an
`enum class`) and using those for all flag checks (including the 32/64/128
flags later) to keep the target easier to extend and review.
##########
tests/fuzzing/fuzz_http_compat.cc:
##########
@@ -0,0 +1,110 @@
+#include "proxy/hdrs/HTTP.h"
+#include "proxy/hdrs/HttpCompat.h"
+#include "tscore/Diags.h"
+#include "tsutil/PostScript.h"
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+
+extern int cmd_disable_pfreelist;
+
+namespace
+{
+constexpr size_t MAX_INPUT_LENGTH = 16 * 1024;
+
+void
+exercise_lists(const std::string &value, const std::string &candidate, uint8_t
flags, int output_length)
+{
+ StrList comma_list((flags & 1) != 0);
+ StrList semicolon_list((flags & 2) != 0);
+ StrList token_list((flags & 4) != 0);
+ std::array<char, 256> output{};
+ std::array<char, 256> type{};
+ std::array<char, 256> subtype{};
+ int matching_length = 0;
+ int matching_index = 0;
+ int value_length = static_cast<int>(value.size());
+ int candidate_length = static_cast<int>(candidate.size());
+ char separator = (flags & 8) != 0 ? ';' : ',';
+ bool ignore_wildcards = (flags & 16) != 0;
+
+ HttpCompat::parse_comma_list(&comma_list, value.c_str(), value_length);
+ HttpCompat::parse_semicolon_list(&semicolon_list, value.c_str(),
value_length);
+ HttpCompat::parse_tok_list(&token_list, (flags & 32) != 0, value.c_str(),
value_length, separator);
+ HttpCompat::lookup_param_in_strlist(&semicolon_list, "q", output.data(),
output_length);
+ HttpCompat::lookup_param_in_strlist(&semicolon_list, "charset",
output.data(), output_length);
+ HttpCompat::lookup_param_in_semicolon_string(value.c_str(), value_length,
candidate.c_str(), output.data(), output_length);
+ HttpCompat::find_Q_param_in_strlist(&semicolon_list);
+ HttpCompat::match_accept_language(candidate.c_str(), candidate_length,
&comma_list, &matching_length, &matching_index,
+ ignore_wildcards);
+ HttpCompat::match_accept_charset(candidate.c_str(), candidate_length,
&comma_list, &matching_index, ignore_wildcards);
+ HttpCompat::parse_mime_type(value.c_str(), type.data(), subtype.data(),
output_length, output_length);
+ HttpCompat::parse_mime_type_with_len(value.c_str(), value_length,
type.data(), subtype.data(), output_length, output_length);
+}
+
+MIMEField *
+add_field(HTTPHdr &header, std::string_view value)
+{
+ MIMEField *field = header.field_create("Accept-Language");
+
+ field->value_set(header.m_heap, header.m_mime, value);
+ header.field_attach(field);
+ return field;
+}
+
+void
+exercise_vary(const std::string &first, const std::string &second, uint8_t
flags)
+{
+ HTTPHdr first_header;
+ HTTPHdr second_header;
+ ts::PostScript cleanup([&]() {
+ second_header.destroy();
+ first_header.destroy();
+ });
+
+ first_header.create(HTTPType::REQUEST);
+ second_header.create(HTTPType::REQUEST);
+ MIMEField *first_field = (flags & 64) != 0 ? nullptr :
add_field(first_header, first);
+ MIMEField *second_field = (flags & 128) != 0 ? nullptr :
add_field(second_header, second);
+
+ HttpCompat::do_vary_header_values_match(first_field, second_field);
+ if (first_field && second_field) {
Review Comment:
This intentionally passes `nullptr` into
`HttpCompat::do_vary_header_values_match()`. If that function’s contract does
not allow null fields, the fuzzer may generate crashes that are not actionable
(invalid-input crashes rather than real robustness issues). Recommend guarding
the call when either field is null (or alternatively creating empty
`MIMEField`s) unless the API explicitly documents nullptr support.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
