api_lifecycle.cc

Go to the documentation of this file.

/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

 
#include "proto_fuzzer/api_lifecycle.h"
 
#include <curl/curl.h>
#include <curl/curlver.h>
#include <curl/easy.h>
#include <curl/header.h>
#include <curl/options.h>
#include <curl/urlapi.h>
 
#include <algorithm>
#include <array>
#include <cstddef>
#include <cstdint>
#include <limits>
#include <string>
#include <string_view>
 
#include "proto_fuzzer/curl_raii.h"
 
namespace proto_fuzzer {
 
namespace {
 
constexpr unsigned int kAllHeaderOrigins = CURLH_HEADER | CURLH_TRAILER | CURLH_CONNECT | CURLH_1XX | CURLH_PSEUDO;
constexpr std::size_t kMaxResultHeaders = 16;

constexpr CURLUPart kUrlParts[] = {
    CURLUPART_URL,  CURLUPART_SCHEME, CURLUPART_USER,  CURLUPART_PASSWORD, CURLUPART_OPTIONS, CURLUPART_HOST,
    CURLUPART_PORT, CURLUPART_PATH,   CURLUPART_QUERY, CURLUPART_FRAGMENT, CURLUPART_ZONEID,
};

void ProbeUrlPart(CURLU* url, CURLUPart part, unsigned int flags) {
  char* result = nullptr;
  if (curl_url_get(url, part, &result, flags) == CURLUE_OK) {
    curl_free(result);
  }
}

enum class InfoResultType {
  kString,
  kLong,
  kDouble,
  kOffset,
  kSocket,
  kCertificateInfo,
  kTlsSessionInfo,
  kOwnedSlist,
  kUnknown,
};

struct InfoDescriptor {
  CURLINFO info;
  InfoResultType result_type;
};
 
// Put one value from every dispatch family first so even a small corpus seed
// reaches all typed getinfo paths; the remaining entries broaden state and
// result-specific coverage as selectors mutate.
constexpr InfoDescriptor kInfoDescriptors[] = {
    {CURLINFO_EFFECTIVE_URL, InfoResultType::kString},
    {CURLINFO_RESPONSE_CODE, InfoResultType::kLong},
    {CURLINFO_TOTAL_TIME, InfoResultType::kDouble},
    {CURLINFO_SIZE_DOWNLOAD_T, InfoResultType::kOffset},
    {CURLINFO_ACTIVESOCKET, InfoResultType::kSocket},
    {CURLINFO_CERTINFO, InfoResultType::kCertificateInfo},
    {CURLINFO_TLS_SSL_PTR, InfoResultType::kTlsSessionInfo},
    {CURLINFO_SSL_ENGINES, InfoResultType::kOwnedSlist},
    {CURLINFO_NONE, InfoResultType::kUnknown},
    {CURLINFO_CONTENT_TYPE, InfoResultType::kString},
    {CURLINFO_PRIVATE, InfoResultType::kString},
    {CURLINFO_FTP_ENTRY_PATH, InfoResultType::kString},
    {CURLINFO_REDIRECT_URL, InfoResultType::kString},
    {CURLINFO_PRIMARY_IP, InfoResultType::kString},
    {CURLINFO_RTSP_SESSION_ID, InfoResultType::kString},
    {CURLINFO_LOCAL_IP, InfoResultType::kString},
    {CURLINFO_SCHEME, InfoResultType::kString},
    {CURLINFO_EFFECTIVE_METHOD, InfoResultType::kString},
    {CURLINFO_REFERER, InfoResultType::kString},
    {CURLINFO_CAINFO, InfoResultType::kString},
    {CURLINFO_CAPATH, InfoResultType::kString},
    {CURLINFO_HEADER_SIZE, InfoResultType::kLong},
    {CURLINFO_REQUEST_SIZE, InfoResultType::kLong},
    {CURLINFO_SSL_VERIFYRESULT, InfoResultType::kLong},
    {CURLINFO_FILETIME, InfoResultType::kLong},
    {CURLINFO_REDIRECT_COUNT, InfoResultType::kLong},
    {CURLINFO_HTTP_CONNECTCODE, InfoResultType::kLong},
    {CURLINFO_HTTPAUTH_AVAIL, InfoResultType::kLong},
    {CURLINFO_PROXYAUTH_AVAIL, InfoResultType::kLong},
    {CURLINFO_OS_ERRNO, InfoResultType::kLong},
    {CURLINFO_NUM_CONNECTS, InfoResultType::kLong},
    {CURLINFO_CONDITION_UNMET, InfoResultType::kLong},
    {CURLINFO_RTSP_CLIENT_CSEQ, InfoResultType::kLong},
    {CURLINFO_RTSP_SERVER_CSEQ, InfoResultType::kLong},
    {CURLINFO_RTSP_CSEQ_RECV, InfoResultType::kLong},
    {CURLINFO_PRIMARY_PORT, InfoResultType::kLong},
    {CURLINFO_LOCAL_PORT, InfoResultType::kLong},
    {CURLINFO_HTTP_VERSION, InfoResultType::kLong},
    {CURLINFO_PROXY_SSL_VERIFYRESULT, InfoResultType::kLong},
    {CURLINFO_PROXY_ERROR, InfoResultType::kLong},
    {CURLINFO_NAMELOOKUP_TIME, InfoResultType::kDouble},
    {CURLINFO_CONNECT_TIME, InfoResultType::kDouble},
    {CURLINFO_PRETRANSFER_TIME, InfoResultType::kDouble},
    {CURLINFO_STARTTRANSFER_TIME, InfoResultType::kDouble},
    {CURLINFO_REDIRECT_TIME, InfoResultType::kDouble},
    {CURLINFO_APPCONNECT_TIME, InfoResultType::kDouble},
    {CURLINFO_SIZE_UPLOAD_T, InfoResultType::kOffset},
    {CURLINFO_SPEED_DOWNLOAD_T, InfoResultType::kOffset},
    {CURLINFO_SPEED_UPLOAD_T, InfoResultType::kOffset},
    {CURLINFO_FILETIME_T, InfoResultType::kOffset},
    {CURLINFO_CONTENT_LENGTH_DOWNLOAD_T, InfoResultType::kOffset},
    {CURLINFO_CONTENT_LENGTH_UPLOAD_T, InfoResultType::kOffset},
    {CURLINFO_TOTAL_TIME_T, InfoResultType::kOffset},
    {CURLINFO_NAMELOOKUP_TIME_T, InfoResultType::kOffset},
    {CURLINFO_CONNECT_TIME_T, InfoResultType::kOffset},
    {CURLINFO_PRETRANSFER_TIME_T, InfoResultType::kOffset},
    {CURLINFO_STARTTRANSFER_TIME_T, InfoResultType::kOffset},
    {CURLINFO_REDIRECT_TIME_T, InfoResultType::kOffset},
    {CURLINFO_APPCONNECT_TIME_T, InfoResultType::kOffset},
    {CURLINFO_RETRY_AFTER, InfoResultType::kOffset},
#if LIBCURL_VERSION_NUM >= 0x080200
    {CURLINFO_XFER_ID, InfoResultType::kOffset},
    {CURLINFO_CONN_ID, InfoResultType::kOffset},
#endif
#if LIBCURL_VERSION_NUM >= 0x080600
    {CURLINFO_QUEUE_TIME_T, InfoResultType::kOffset},
#endif
#if LIBCURL_VERSION_NUM >= 0x080700
    {CURLINFO_USED_PROXY, InfoResultType::kLong},
#endif
#if LIBCURL_VERSION_NUM >= 0x080a00
    {CURLINFO_POSTTRANSFER_TIME_T, InfoResultType::kOffset},
#endif
#if LIBCURL_VERSION_NUM >= 0x080b00
    {CURLINFO_EARLYDATA_SENT_T, InfoResultType::kOffset},
#endif
#if LIBCURL_VERSION_NUM >= 0x080c00
    {CURLINFO_HTTPAUTH_USED, InfoResultType::kLong},
    {CURLINFO_PROXYAUTH_USED, InfoResultType::kLong},
#endif
#if LIBCURL_VERSION_NUM >= 0x081400
    {CURLINFO_SIZE_DELIVERED, InfoResultType::kOffset},
#endif
    {CURLINFO_COOKIELIST, InfoResultType::kOwnedSlist},
};
 
constexpr std::size_t kInfoDescriptorCount = sizeof(kInfoDescriptors) / sizeof(kInfoDescriptors[0]);
static_assert(kInfoDescriptorCount <= 96, "the three API result seeds cover selector indexes 0 through 95");

constexpr curl_lock_data kShareData[] = {
    CURL_LOCK_DATA_COOKIE, CURL_LOCK_DATA_DNS,  CURL_LOCK_DATA_SSL_SESSION, CURL_LOCK_DATA_CONNECT, CURL_LOCK_DATA_PSL,
    CURL_LOCK_DATA_HSTS,   CURL_LOCK_DATA_NONE, CURL_LOCK_DATA_SHARE,       CURL_LOCK_DATA_LAST,
};
constexpr std::size_t kShareDataCount = sizeof(kShareData) / sizeof(kShareData[0]);

enum class ReentrantProbeKind {
  kEasySetopt,
  kEasyGetinfo,
  kEasyHeader,
  kEasyDuphandle,
  kEasyReset,
  kEasyPerform,
  kEasyUpkeep,
  kEasySend,
  kEasyRecv,
  kEasyPause,
  kMultiPerform,
  kMultiSetopt,
  kMultiAddHandle,
  kMultiWait,
};

struct ReentrantProbe {
  ReentrantProbeKind kind;
  bool needs_multi;
};

constexpr ReentrantProbe kReentrantProbes[] = {
    {ReentrantProbeKind::kEasySetopt, false},    {ReentrantProbeKind::kEasyGetinfo, false},
    {ReentrantProbeKind::kEasyHeader, false},    {ReentrantProbeKind::kEasyDuphandle, false},
    {ReentrantProbeKind::kEasyReset, false},     {ReentrantProbeKind::kEasyPerform, false},
    {ReentrantProbeKind::kEasyUpkeep, false},    {ReentrantProbeKind::kEasySend, false},
    {ReentrantProbeKind::kEasyRecv, false},      {ReentrantProbeKind::kEasyPause, false},
    {ReentrantProbeKind::kMultiPerform, true},   {ReentrantProbeKind::kMultiSetopt, true},
    {ReentrantProbeKind::kMultiAddHandle, true}, {ReentrantProbeKind::kMultiWait, true},
};
constexpr std::size_t kReentrantProbeCount = sizeof(kReentrantProbes) / sizeof(kReentrantProbes[0]);

bool RecursiveRejected(CURLcode code) { return code == CURLE_RECURSIVE_API_CALL; }

bool RecursiveRejected(CURLMcode code) { return code == CURLM_RECURSIVE_API_CALL; }

bool ProbePublicApiOnce(CURL* easy, CURLM* multi, ReentrantProbeKind kind) {
  switch (kind) {
    case ReentrantProbeKind::kEasySetopt:
      return RecursiveRejected(curl_easy_setopt(easy, CURLOPT_REFERER, "reentrant.test"));
    case ReentrantProbeKind::kEasyGetinfo: {
      long response_code = 0;
      return RecursiveRejected(curl_easy_getinfo(easy, CURLINFO_RESPONSE_CODE, &response_code));
    }
    case ReentrantProbeKind::kEasyHeader: {
      // curl_easy_header is reentrant and maps any guard failure to a header
      // error code, so it never reports a recursive call here.
      struct curl_header* header = nullptr;
      (void)curl_easy_header(easy, "Content-Type", 0, kAllHeaderOrigins, -1, &header);
      return false;
    }
    case ReentrantProbeKind::kEasyDuphandle: {
      // duphandle is reentrant; duplicate, reset, and release immediately so
      // the copied option pointers never outlive this callback.
      CURL* duplicate = curl_easy_duphandle(easy);
      if (duplicate != nullptr) {
        curl_easy_reset(duplicate);
        curl_easy_cleanup(duplicate);
      }
      return false;
    }
    case ReentrantProbeKind::kEasyReset:
      // curl_easy_reset returns void, so the guard's rejection is observable
      // only as the reset not happening. It still exercises the refusal path.
      curl_easy_reset(easy);
      return false;
    case ReentrantProbeKind::kEasyPerform:
      return RecursiveRejected(curl_easy_perform(easy));
    case ReentrantProbeKind::kEasyUpkeep:
      return RecursiveRejected(curl_easy_upkeep(easy));
    case ReentrantProbeKind::kEasySend: {
      char byte = 'x';
      std::size_t sent = 0;
      return RecursiveRejected(curl_easy_send(easy, &byte, 1, &sent));
    }
    case ReentrantProbeKind::kEasyRecv: {
      char byte = 0;
      std::size_t received = 0;
      return RecursiveRejected(curl_easy_recv(easy, &byte, 1, &received));
    }
    case ReentrantProbeKind::kEasyPause:
      return RecursiveRejected(curl_easy_pause(easy, CURLPAUSE_CONT));
    case ReentrantProbeKind::kMultiPerform: {
      int running = 0;
      return RecursiveRejected(curl_multi_perform(multi, &running));
    }
    case ReentrantProbeKind::kMultiSetopt:
      return RecursiveRejected(curl_multi_setopt(multi, CURLMOPT_MAXCONNECTS, 0L));
    case ReentrantProbeKind::kMultiAddHandle:
      return RecursiveRejected(curl_multi_add_handle(multi, easy));
    case ReentrantProbeKind::kMultiWait: {
      int numfds = 0;
      return RecursiveRejected(curl_multi_wait(multi, nullptr, 0, 0, &numfds));
    }
  }
  return false;
}

void ProbeInfoDescriptor(CURL* easy, const InfoDescriptor& descriptor) {
  switch (descriptor.result_type) {
    case InfoResultType::kString: {
      char* result = nullptr;
      (void)curl_easy_getinfo(easy, descriptor.info, &result);
      return;
    }
    case InfoResultType::kLong: {
      long result = 0;
      (void)curl_easy_getinfo(easy, descriptor.info, &result);
      return;
    }
    case InfoResultType::kDouble: {
      double result = 0;
      (void)curl_easy_getinfo(easy, descriptor.info, &result);
      return;
    }
    case InfoResultType::kOffset: {
      curl_off_t result = 0;
      (void)curl_easy_getinfo(easy, descriptor.info, &result);
      return;
    }
    case InfoResultType::kSocket: {
      curl_socket_t result = CURL_SOCKET_BAD;
      (void)curl_easy_getinfo(easy, descriptor.info, &result);
      return;
    }
    case InfoResultType::kCertificateInfo: {
      struct curl_certinfo* result = nullptr;
      (void)curl_easy_getinfo(easy, descriptor.info, &result);
      return;
    }
    case InfoResultType::kTlsSessionInfo: {
      struct curl_tlssessioninfo* result = nullptr;
      (void)curl_easy_getinfo(easy, descriptor.info, &result);
      return;
    }
    case InfoResultType::kOwnedSlist: {
      struct curl_slist* result = nullptr;
      (void)curl_easy_getinfo(easy, descriptor.info, &result);
      curl_slist_free_all(result);
      return;
    }
    case InfoResultType::kUnknown: {
      void* result = nullptr;
      (void)curl_easy_getinfo(easy, descriptor.info, &result);
      return;
    }
  }
}

void ProbeKnownErrorStringsOnce() {
  static const bool probed = [] {
    for (int code = 0; code <= static_cast<int>(CURL_LAST); ++code) {
      (void)curl_easy_strerror(static_cast<CURLcode>(code));
    }
    (void)curl_multi_strerror(CURLM_CALL_MULTI_PERFORM);
    for (int code = 0; code <= static_cast<int>(CURLM_LAST); ++code) {
      (void)curl_multi_strerror(static_cast<CURLMcode>(code));
    }
    for (int code = 0; code <= static_cast<int>(CURLSHE_LAST); ++code) {
      (void)curl_share_strerror(static_cast<CURLSHcode>(code));
    }
    for (int code = 0; code <= static_cast<int>(CURLUE_LAST); ++code) {
      (void)curl_url_strerror(static_cast<CURLUcode>(code));
    }
    return true;
  }();
  (void)probed;
}

void ProbeEasyOptionMetadataOnce() {
  static const bool probed = [] {
    const struct curl_easyoption* option = nullptr;
    std::size_t count = 0;
    while (count++ < 512 && (option = curl_easy_option_next(option)) != nullptr) {
      (void)curl_easy_option_by_name(option->name);
      (void)curl_easy_option_by_id(option->id);
    }
    (void)curl_easy_option_by_name("");
    (void)curl_easy_option_by_name("NOT_A_CURL_OPTION");
    (void)curl_easy_option_by_id(CURLOPT_LASTENTRY);
    return true;
  }();
  (void)probed;
}
 
}  // namespace

ApiLifecycle::ApiLifecycle(CURL* easy, const curl::fuzzer::proto::ApiPlan& plan, std::string_view url)
    : easy_(easy),
      plan_(plan),
      share_(nullptr),
      active_multi_(nullptr),
      guessed_scheme_url_(false),
      version_info_probed_(false),
      https_proxy_feature_present_(false) {
  ProbeKnownErrorStringsOnce();
  ProbeEasyOptionMetadataOnce();
  if (plan_.probe_version_info()) {
    const curl_version_info_data* info = curl_version_info(CURLVERSION_NOW);
    version_info_probed_ = info != nullptr;
    if (info != nullptr) {
      https_proxy_feature_present_ = (info->features & CURL_VERSION_HTTPS_PROXY) != 0;
      // Feature names are null-terminated public data. Keep even a malformed
      // provider response from turning this observation into an unbounded walk.
      if (info->feature_names != nullptr) {
        for (std::size_t index = 0; index < 64 && info->feature_names[index] != nullptr; ++index) {
          (void)std::string_view(info->feature_names[index]);
        }
      }
    }
  }
  ProbeUrlAndEscaping(url);
  response_callback_state_.owner = this;
  const bool wants_response_callback = plan_.pause_response_once() || plan_.reentrant_probe_selectors_size() > 0;
  if (wants_response_callback) {
    response_callback_state_.pause_once = plan_.pause_response_once();
    // Install userdata first: if the callback setopt were ever rejected, the
    // baseline sink safely ignores the non-null pointer. The opposite order
    // could dispatch this callback with libcurl's default FILE* userdata.
    (void)curl_easy_setopt(easy_, CURLOPT_WRITEDATA, &response_callback_state_);
    (void)curl_easy_setopt(easy_, CURLOPT_WRITEFUNCTION, &ApiLifecycle::ResponseWrite);
  }
  if (plan_.attach_share()) {
    ConfigureShare();
  }
}

ApiLifecycle::~ApiLifecycle() { CleanupShare(); }

std::size_t ApiLifecycle::ResponseWrite(char* /*contents*/, std::size_t size, std::size_t nmemb, void* user_data) {
  auto* state = static_cast<ResponseCallbackState*>(user_data);
  if (state == nullptr || (size != 0 && nmemb > std::numeric_limits<std::size_t>::max() / size)) {
    return 0;
  }
  const std::size_t bytes = size * nmemb;
  if (bytes != 0 && state->pause_once && !state->pause_returned) {
    state->pause_returned = true;
    return CURL_WRITEFUNC_PAUSE;
  }
  if (bytes > std::numeric_limits<std::size_t>::max() - state->bytes_received) {
    return 0;
  }
  state->bytes_received += bytes;
  if (bytes != 0 && state->owner != nullptr && !state->probes_done) {
    state->probes_done = true;
    state->owner->RunReentrantProbes();
  }
  return bytes;
}

bool ApiLifecycle::response_pause_returned() const { return response_callback_state_.pause_returned; }

std::size_t ApiLifecycle::response_bytes_received() const { return response_callback_state_.bytes_received; }

void ApiLifecycle::SetActiveMulti(CURLM* multi) { active_multi_ = multi; }

std::size_t ApiLifecycle::reentrant_probes_run() const { return response_callback_state_.probes_run; }

std::size_t ApiLifecycle::reentrant_recursive_rejections() const {
  return response_callback_state_.recursive_rejections;
}

void ApiLifecycle::RunReentrantProbes() {
  const std::size_t count = std::min<std::size_t>(scenario_limits::kMaxApiReentrantSelectors,
                                                  static_cast<std::size_t>(plan_.reentrant_probe_selectors_size()));
  for (std::size_t index = 0; index < count; ++index) {
    const auto selector = static_cast<std::size_t>(plan_.reentrant_probe_selectors(static_cast<int>(index)));
    const ReentrantProbe& probe = kReentrantProbes[selector % kReentrantProbeCount];
    if (probe.needs_multi && active_multi_ == nullptr) {
      continue;
    }
    ++response_callback_state_.probes_run;
    if (ProbePublicApiOnce(easy_, active_multi_, probe.kind)) {
      ++response_callback_state_.recursive_rejections;
    }
  }
}

void ApiLifecycle::ShareLock(CURL* /*easy*/, curl_lock_data /*data*/, curl_lock_access /*access*/, void* user_data) {
  auto* state = static_cast<ShareCallbackState*>(user_data);
  ++state->locks;
}

void ApiLifecycle::ShareUnlock(CURL* /*easy*/, curl_lock_data /*data*/, void* user_data) {
  auto* state = static_cast<ShareCallbackState*>(user_data);
  ++state->unlocks;
}

void ApiLifecycle::ConfigureShare() {
  share_ = curl_share_init();
  if (share_ == nullptr) {
    return;
  }
 
  // Install userdata before exposing either callback. curl_share_setopt does
  // not invoke them itself, but every later easy/share operation must observe
  // a fully formed callback tuple if curl begins using the configured domains.
  (void)curl_share_setopt(share_, CURLSHOPT_USERDATA, &share_callback_state_);
  (void)curl_share_setopt(share_, CURLSHOPT_LOCKFUNC, &ApiLifecycle::ShareLock);
  (void)curl_share_setopt(share_, CURLSHOPT_UNLOCKFUNC, &ApiLifecycle::ShareUnlock);
 
  const std::size_t selector_count = std::min<std::size_t>(scenario_limits::kMaxApiShareDataSelectors,
                                                           static_cast<std::size_t>(plan_.share_data_selectors_size()));
  for (std::size_t index = 0; index < selector_count; ++index) {
    const std::uint32_t selector = plan_.share_data_selectors(static_cast<int>(index));
    const curl_lock_data data = kShareData[selector % kShareDataCount];
    if (curl_share_setopt(share_, CURLSHOPT_SHARE, data) == CURLSHE_OK) {
      // Exercise the reversible transition before any transfer can populate
      // the selected cache, then leave the domain enabled. In particular,
      // unsharing CONNECT after use makes current curl stop treating its
      // connection pool as cleanup-owned, so doing teardown in that order
      // would manufacture a deterministic leak in the harness.
      (void)curl_share_setopt(share_, CURLSHOPT_UNSHARE, data);
      (void)curl_share_setopt(share_, CURLSHOPT_SHARE, data);
    }
  }
 
  if (curl_easy_setopt(easy_, CURLOPT_SHARE, share_) == CURLE_OK) {
    // USERDATA remains mutable while attached; cleanup is the complementary
    // ownership check and returns CURLSHE_IN_USE without destroying the share.
    (void)curl_share_setopt(share_, CURLSHOPT_USERDATA, &share_callback_state_);
    (void)curl_share_cleanup(share_);
  }
}

void ApiLifecycle::CleanupShare() {
  if (share_ == nullptr) {
    return;
  }
  if (curl_share_cleanup(share_) == CURLSHE_OK) {
    share_ = nullptr;
  }
}

void ApiLifecycle::ProbeUrlAndEscaping(std::string_view url) {
  const std::size_t bounded_size = std::min(url.size(), scenario_limits::kMaxApiStringBytes);
  const std::string input(url.substr(0, bounded_size));
 
  CURLU* url_handle = curl_url();
  if (url_handle != nullptr) {
    if (plan_.guess_scheme_url()) {
      constexpr char kGuessInput[] = "ftp.example.test/path";
      if (curl_url_set(url_handle, CURLUPART_URL, kGuessInput, CURLU_GUESS_SCHEME) == CURLUE_OK) {
        char* scheme = nullptr;
        if (curl_url_get(url_handle, CURLUPART_SCHEME, &scheme, 0) == CURLUE_OK) {
          guessed_scheme_url_ = scheme != nullptr && std::string_view(scheme) == "ftp";
          curl_free(scheme);
        }
      }
      curl_url_cleanup(url_handle);
      url_handle = curl_url();
    }
  }
  if (url_handle != nullptr) {
    const unsigned int parse_flags = CURLU_ALLOW_SPACE | CURLU_NON_SUPPORT_SCHEME;
    if (curl_url_set(url_handle, CURLUPART_URL, input.c_str(), parse_flags) != CURLUE_OK) {
      (void)curl_url_set(url_handle, CURLUPART_SCHEME, "http", 0);
      (void)curl_url_set(url_handle, CURLUPART_HOST, "api.test", 0);
      (void)curl_url_set(url_handle, CURLUPART_PATH, input.c_str(), CURLU_URLENCODE);
    }
 
    // Zero and URLDECODE take distinct getter paths for most components;
    // unsupported combinations are documented errors rather than unsafe raw
    // varargs, so traversing the full typed part table is intentional.
    for (const CURLUPart part : kUrlParts) {
      ProbeUrlPart(url_handle, part, 0);
      ProbeUrlPart(url_handle, part, CURLU_URLDECODE);
    }
    ProbeUrlPart(url_handle, CURLUPART_URL, CURLU_DEFAULT_PORT);
    ProbeUrlPart(url_handle, CURLUPART_URL, CURLU_NO_DEFAULT_PORT);
    ProbeUrlPart(url_handle, CURLUPART_URL, CURLU_URLENCODE);
#if LIBCURL_VERSION_NUM >= 0x075800
    ProbeUrlPart(url_handle, CURLUPART_HOST, CURLU_PUNYCODE);
#endif
#if LIBCURL_VERSION_NUM >= 0x080300
    ProbeUrlPart(url_handle, CURLUPART_HOST, CURLU_PUNY2IDN);
#endif
#if LIBCURL_VERSION_NUM >= 0x080800
    ProbeUrlPart(url_handle, CURLUPART_QUERY, CURLU_GET_EMPTY);
    ProbeUrlPart(url_handle, CURLUPART_FRAGMENT, CURLU_GET_EMPTY);
#endif
#if LIBCURL_VERSION_NUM >= 0x080900
    ProbeUrlPart(url_handle, CURLUPART_URL, CURLU_NO_GUESS_SCHEME);
#endif
 
    // Mutate only the duplicate so the original handle's getter state remains
    // attributable to parsing the scenario URL rather than this lifecycle
    // probe's own append operation.
    CURLU* duplicate = curl_url_dup(url_handle);
    if (duplicate != nullptr) {
      (void)curl_url_set(duplicate, CURLUPART_QUERY, input.c_str(), CURLU_APPENDQUERY | CURLU_URLENCODE);
      ProbeUrlPart(duplicate, CURLUPART_URL, 0);
      curl_url_cleanup(duplicate);
    }
    curl_url_cleanup(url_handle);
  }
 
  // Exercise explicit binary lengths as well as the NUL-terminated API path.
  // The API policy caps input far below INT_MAX, making the signed conversion
  // and worst-case threefold escaping allocation deterministic.
  const int input_length = static_cast<int>(input.size());
  char* escaped = curl_easy_escape(easy_, input.data(), input_length);
  if (escaped != nullptr) {
    int decoded_length = 0;
    char* decoded = curl_easy_unescape(easy_, escaped, 0, &decoded_length);
    curl_free(decoded);
    curl_free(escaped);
  }
  int decoded_length = 0;
  char* decoded = curl_easy_unescape(easy_, input.data(), input_length, &decoded_length);
  curl_free(decoded);
}

bool ApiLifecycle::guessed_scheme_url() const { return guessed_scheme_url_; }

bool ApiLifecycle::version_info_probed() const { return version_info_probed_; }

bool ApiLifecycle::https_proxy_feature_present() const { return https_proxy_feature_present_; }

void ApiLifecycle::ProbeTransferResults(bool probe_upkeep) {
  std::array<bool, kInfoDescriptorCount> seen{};
  const std::size_t selector_count = std::min<std::size_t>(scenario_limits::kMaxApiInfoSelectors,
                                                           static_cast<std::size_t>(plan_.easy_info_selectors_size()));
  for (std::size_t index = 0; index < selector_count; ++index) {
    const std::uint32_t selector = plan_.easy_info_selectors(static_cast<int>(index));
    const std::size_t descriptor_index = selector % kInfoDescriptorCount;
    if (!seen[descriptor_index]) {
      ProbeInfoDescriptor(easy_, kInfoDescriptors[descriptor_index]);
      seen[descriptor_index] = true;
    }
  }
 
  struct curl_header* header = nullptr;
  (void)curl_easy_header(easy_, "Content-Type", 0, kAllHeaderOrigins, -1, &header);
  header = nullptr;
  for (std::size_t index = 0; index < kMaxResultHeaders; ++index) {
    header = curl_easy_nextheader(easy_, kAllHeaderOrigins, -1, header);
    if (header == nullptr) {
      break;
    }
  }
 
  // curl_easy_perform retains an internal multi that upkeep expects. The
  // external multi paths destroy theirs before result probing, and current
  // debug builds deliberately reject upkeep on that detached handle state.
  if (probe_upkeep) {
    (void)curl_easy_upkeep(easy_);
  }
 
  // Post-transfer pause calls deliberately cover the public API's rejected
  // inactive-handle path without changing the request that populated results.
  (void)curl_easy_pause(easy_, CURLPAUSE_ALL);
  (void)curl_easy_pause(easy_, CURLPAUSE_CONT);
}

void ApiLifecycle::ProbeEasyDuplication() {
  if (!plan_.duplicate_easy()) {
    return;
  }
  CurlEasyPtr duplicate(curl_easy_duphandle(easy_));
  if (duplicate != nullptr) {
    curl_easy_reset(duplicate.get());
  }
}
 
}  // namespace proto_fuzzer