initial commit

fuzz/fuzz_targets/fuzz_xref.rs

@@ -0,0 +1,21 @@
+#![no_main]
+//! The whole-binary cross-reference index decodes every function's `[start,next)` range and records
+//! call/data references; the string-anchor locators then query it. Feeding arbitrary code + rodata
+//! bytes exercises the decode, the containing-function lookup, and the string search — none may panic.
+use source2rosetta::elf::CodeImage;
+use source2rosetta::xref;
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(img) = CodeImage::from_bytes(data.to_vec()) else {
+        return;
+    };
+    let xr = xref::XrefIndex::build(&img);
+    // Exercise the lookups over a bounded set of the discovered call targets — none may panic.
+    for &t in xr.call_targets().iter().take(64) {
+        let _ = xr.referrers(t);
+        let _ = xr.refs_to(t);
+        let _ = xr.containing_func(t);
+    }
+    let _ = xref::funcs_using_string(&img, &xr, "CBaseEntity");
+});