- Generated by
1.15.0
|
curl-fuzzer C++ reference
|
Shared complexity limits for structured scenarios. More...
Go to the source code of this file.
Variables | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxConnections = 4 |
| Four sockets cover redirect/auth flows without permitting mutation-sized connection chains to dominate a case. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxResponseChunks = 16 |
| Enough response boundaries to exercise incremental parsers while keeping per-perform delivery work fixed. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxOptions = 64 |
| Scalar options are cheap, but a finite list prevents protobuf allocation from growing independently of curl work. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxAllocationFailures = 4 |
| A short plan reaches combinations of recovery paths without letting one input turn every allocation into an artificial failure cascade. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxAllocationOrdinal = 4096 |
| Fold mutated ordinals into a range large enough for the bounded transfer drivers while keeping most scalar mutations capable of selecting a call. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxRequestHeaders = 16 |
| Request headers retain useful combinatorial interactions at this size. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxResolveEntries = 16 |
| Host-cache mutations need only a compact sequence of add/remove/wildcard entries. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxResolveEntryBytes = 4096 |
| CURLOPT_RESOLVE consumes NUL-terminated host:port:address records. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxMailRecipients = 8 |
| SMTP envelope recipients are schema-native because CURLOPT_MAIL_RCPT is a curl_slist. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxMailRecipientBytes = 1024 |
| Keep recipient mailbox bytes within curl's normal address-processing range; oversized suffixes add no distinct SMTP parser state. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxFileInputBytes = 64 * 1024 |
| One filename-only parser input can span many lines and cross curl's normal transfer buffer boundary without permitting mutation-sized temporary files. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxFileInputTotalBytes = 128 * 1024 |
| Share a ceiling across filename-backed fixtures so populating several in one scenario cannot multiply the per-file allowance. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxTelnetOptions = 8 |
| TELNET has only a handful of meaningful negotiated preferences. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxTelnetOptionBytes = 1024 |
| Preserve curl's explicit over-1000-byte TTYPE/XDISPLOC rejection paths without giving arbitrary option strings the general metadata budget. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxTelnetResponseBytes = 8 * 1024 |
| TELNET consumes the peer synchronously, so only this bounded prefix can be preloaded before curl enters its protocol loop. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxTelnetControlBytes = 16 |
| Bound reply amplification as well as input bytes. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxTelnetResponseChunks = 8 |
| Raw fragments are all preloaded before TELNET starts. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxTopLevelMimeParts = 16 |
| Bound top-level MIME traversal before curl recursively serializes it. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxNestedMimeParts = 8 |
| One bounded child layer is sufficient to enter recursive MIME code. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxTotalMimeParts = 32 |
| Share a total budget so many parents cannot multiply their child caps. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxMimeHeadersPerPart = 8 |
| Per-part headers are bounded separately from the part count. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxMetadataBytes = 4096 |
| Metadata reaches NUL-terminated APIs, where giant suffixes add no coverage. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxIpfsHostPathBytes = 4096 |
| IPFS and IPNS inputs carry one CID/name plus a gateway path. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxDictHostPathBytes = 4 * 1024 |
| DICT builds its complete command synchronously before the outer mock loop can drain curl's socket. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxMimeDataBytes = 16384 |
| MIME payloads remain large enough to cross encoder buffer boundaries. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxGeneratedMimePatternBytes = 256 |
| Longer repeated patterns are better expressed as ordinary MIME data and make the compact source less useful to the protobuf mutator. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxGeneratedMimeDataBytes = 64 * 1024 + 1 |
| Retain both sides of curl's 64 KiB send-buffer boundary. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxUploadBytes = 16 * 1024 |
| Maximum callback-backed body bytes visible in one scenario. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxTelnetUploadBytes = 2048 |
| TELNET writes upload bytes while its blocking driver owns the thread, so keep total callback work small while retaining payload and IAC coverage. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxTelnetUploadReadSize = kMaxTelnetUploadBytes |
| The TELNET peer drains immediately before each callback result. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxTelnetUploadReadSteps = 2 |
| OSS-Fuzz's local AF_UNIX peer normally fills curl's 4 KiB TELNET reads, so the bounded 8 KiB response gives two useful fragmentation decisions. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxUploadReadSteps = 32 |
| Short-read scripts need several transitions, not mutation-sized sequences. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxUploadReadSize = kMaxUploadBytes |
| Larger read requests are indistinguishable once the whole body fits. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxApiShareDataSelectors = 16 |
| A share handle has only a small fixed set of shareable data families. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxApiInfoSelectors = 32 |
| One API iteration can cheaply inspect several result families, but an unbounded list would repeatedly query identical handle-owned state. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxApiReentrantSelectors = 16 |
| Each reentrancy selector fires one public API call from inside a callback. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxApiStringBytes = 4 * 1024 |
| URL escaping can expand input threefold. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMinMultiTransfers = 2 |
| Two handles are the minimum that can enter shared-multi scheduling, while four align with the mock's fixed connection-script budget. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxMultiTransfers = 4 |
| Maximum easy handles configured in one shared-multi fuzz iteration. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxMultiActions = 16 |
| Ordered lifecycle transitions remain useful in pairs (pause/resume and remove/re-add); sixteen permit several handles to interact without making action processing proportional to mutated protobuf size. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp2Actions = 32 |
| Ordered H2 work can express startup, barriers, informational responses, flow-control changes, and a final response within a compact sequence. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp2YieldTurns = 16 |
| Sixteen turns preserve meaningful scheduler boundaries without letting a single scalar consume the complete outer drive budget. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp2Settings = 16 |
| Bound each SETTINGS payload while retaining every standard identifier and several unknown extension values. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp2Headers = 16 |
| Keep structured HPACK work proportional to the action budget. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp2HeaderBytes = 16 * 1024 |
| Share one metadata ceiling across all H2 header blocks in a scenario. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp2DataBytes = 32 * 1024 |
| Structured DATA remains large enough to cross curl's callback boundary. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp2RawFrameBytes = 4 * 1024 |
| Raw frame payloads target malformed parsing rather than bulk-body work. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp2RawBytes = 16 * 1024 |
| Bound aggregate raw escape data across an action sequence. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp2ObservedBytes = 64 * 1024 |
| Client tracking only needs frame headers and one maximum ordinary payload. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp3Actions = 16 |
| Ordered H3 work needs enough slots to interleave response fragments with stream and connection state changes without becoming mutation-sized. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp3Headers = 16 |
| Keep each structured header block small enough for cheap QPACK encoding. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp3Trailers = 8 |
| Trailer lists need fewer entries while retaining duplicate-name behavior. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp3HeaderNameBytes = 256 |
| Header names are tokens rather than general metadata. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp3HeaderValueBytes = kMaxMetadataBytes |
| Values use the shared metadata ceiling used by other header-bearing APIs. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp3HeaderBytes = 16 * 1024 |
| Share one metadata budget across every structured header and trailer block so many actions cannot multiply the per-field ceiling into a large case. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp3BodyChunks = 16 |
| Bound the number of DATA-frame boundaries independently of total bytes. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp3BodyBytes = 16 * 1024 |
| A response body can still cross curl's normal 16 KiB callback boundary. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp3RawWriteBytes = 4 * 1024 |
| Raw plaintext is primarily for malformed frame/QPACK prefixes; a compact per-action cap preserves that purpose without duplicating body storage. | |
| constexpr std::size_t | proto_fuzzer::scenario_limits::kMaxHttp3RawBytes = 16 * 1024 |
| Share one ceiling across all raw actions so sixteen maximum-sized writes cannot make one fuzzer iteration disproportionately expensive. | |
| constexpr std::uint64_t | proto_fuzzer::scenario_limits::kMaxQuicVarint = (std::uint64_t{1} << 62U) - 1U |
| QUIC variable-length integers reserve their two high bits for encoding. | |
Shared complexity limits for structured scenarios.
Definition in file scenario_limits.h.
|
inlineconstexpr |
Each reentrancy selector fires one public API call from inside a callback.
A small list covers every typed probe without turning mutation length into callback work.
Definition at line 136 of file scenario_limits.h.
|
inlineconstexpr |
A share handle has only a small fixed set of shareable data families.
The extra slots retain duplicate/unshare transitions without allowing a list of identical selectors to dominate a lifecycle iteration.
Definition at line 129 of file scenario_limits.h.
|
inlineconstexpr |
URL escaping can expand input threefold.
Four KiB crosses parser buffer boundaries without letting one convenience-API probe dominate a transfer.
Definition at line 139 of file scenario_limits.h.
|
inlineconstexpr |
DICT builds its complete command synchronously before the outer mock loop can drain curl's socket.
Four KiB retains long lookup/parser inputs while keeping the worst-case RFC 2229 escaping below the peer's verified client send-buffer floor.
Definition at line 95 of file scenario_limits.h.
|
inlineconstexpr |
Retain both sides of curl's 64 KiB send-buffer boundary.
This budget is shared by all generated MIME parts in one scenario.
Definition at line 103 of file scenario_limits.h.
|
inlineconstexpr |
Header names are tokens rather than general metadata.
This comfortably exceeds practical field names while limiting canonicalization work.
Definition at line 179 of file scenario_limits.h.
|
inlineconstexpr |
IPFS and IPNS inputs carry one CID/name plus a gateway path.
The rewrite keeps that suffix mutation-controlled, but a bounded whole-URL budget stops LPM from growing a single identifier into a large CONNECT_TO target.
Definition at line 90 of file scenario_limits.h.
|
inlineconstexpr |
SMTP envelope recipients are schema-native because CURLOPT_MAIL_RCPT is a curl_slist.
A short list reaches multi-recipient retry and CURLOPT_MAIL_RCPT_ALLOWFAILS behavior without making one input allocate an unbounded list.
Definition at line 48 of file scenario_limits.h.
|
inlineconstexpr |
Host-cache mutations need only a compact sequence of add/remove/wildcard entries.
The runtime appends one harness-owned loopback mapping separately.
Definition at line 41 of file scenario_limits.h.
|
inlineconstexpr |
Bound reply amplification as well as input bytes.
Sixteen IAC markers are enough for every supported negotiation in one seed; stopping before a seventeenth prevents duplicate commands from filling curl's send buffer before the upload callback can drain the peer.
Definition at line 72 of file scenario_limits.h.
|
inlineconstexpr |
TELNET has only a handful of meaningful negotiated preferences.
A short list reaches their combinations without letting response-triggered subnegotiation multiply client output inside curl's blocking driver.
Definition at line 61 of file scenario_limits.h.
|
inlineconstexpr |
Raw fragments are all preloaded before TELNET starts.
More write-call boundaries add protobuf and syscall work without reliably creating socket- read boundaries on a stream socket.
Definition at line 76 of file scenario_limits.h.
|
inlineconstexpr |
The TELNET peer drains immediately before each callback result.
Keeping one result within the total payload budget means even an all-IAC payload expands to only 4096 bytes, safely below TelnetMockServer's socket-buffer floor. Letting the whole payload through at once also avoids retaining bytes that TELNET's bounded receive loop would never request from the callback.
Definition at line 116 of file scenario_limits.h.
|
inlineconstexpr |
OSS-Fuzz's local AF_UNIX peer normally fills curl's 4 KiB TELNET reads, so the bounded 8 KiB response gives two useful fragmentation decisions.
POSIX permits shorter reads; later callbacks remain safe but use the default cap instead of retaining mostly-dead mutation steps in the throughput lane.
Definition at line 121 of file scenario_limits.h.
|
inlineconstexpr |
Maximum callback-backed body bytes visible in one scenario.
A 16 KiB stream is large enough to fill the deliberately tightened timing-lane socket while remaining cheap per case.
Definition at line 107 of file scenario_limits.h.
1.15.0