initial commit

fuzz/fuzz_targets/fuzz_elf.rs

@@ -0,0 +1,28 @@
+#![no_main]
+//! The ELF64 reader must return `Err` on any malformed input, never panic — no out-of-bounds index,
+//! no arithmetic overflow. `from_bytes` parses section headers, the symbol table, and the relocation
+//! map straight out of attacker-controlled bytes; this drives it and every allocated-section accessor.
+use source2rosetta::elf::CodeImage;
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(img) = CodeImage::from_bytes(data.to_vec()) else {
+        return;
+    };
+    // Reloc-driven / eh_frame walks over whatever the header claimed.
+    let _ = img.eh_frame_functions();
+    let targets = img.code_pointer_targets();
+    // Pointer/string reads at reloc slots and their values (bounded — inputs are small anyway).
+    for (slot, val) in img.reloc_slots().take(256) {
+        let _ = img.read_ptr(slot);
+        let _ = img.read_c_string(val);
+        let _ = img.is_code(val);
+        let _ = img.ptrs_to(val);
+    }
+    for &t in targets.iter().take(64) {
+        let _ = img.code_at(t);
+        let _ = img.rodata_at(t, 32);
+        let _ = img.read_i64(t);
+        let _ = img.read_u32(t);
+    }
+});