initial commit

fuzz/fuzz_targets/fuzz_schema.rs

@@ -0,0 +1,23 @@
+#![no_main]
+//! The Source-2 SchemaSystem reader walks reloc-slot candidates as `SchemaClassInfoData_t` structs,
+//! chasing `m_pFields`/`m_pBaseClasses` pointers. A crafted (or truncated) `.so` can point those
+//! anywhere; the reader must survive it with `Err`/empty, never a panic. Also exercises the field and
+//! base-class accessors the derivation reads.
+use source2rosetta::elf::CodeImage;
+use source2rosetta::schema;
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(img) = CodeImage::from_bytes(data.to_vec()) else {
+        return;
+    };
+    for c in schema::enumerate_schema(&img) {
+        let _ = c.primary_base();
+        for f in &c.fields {
+            let _ = (f.offset, f.name.len());
+        }
+        for b in &c.bases {
+            let _ = (b.offset, b.name.len());
+        }
+    }
+});