21 lines
918 B
Rust
21 lines
918 B
Rust
#![no_main]
|
|
//! The Itanium RTTI reader chases `_ZTV`/`_ZTI`/`_ZTS` pointer chains and demangles names out of the
|
|
//! bytes; `enumerate_vtables` sweeps every reloc slot as a candidate typeinfo. Arbitrary bytes must
|
|
//! not panic it (or the demangler). Also runs the `NetworkStateChanged` slot detector over the slots.
|
|
use source2rosetta::elf::CodeImage;
|
|
use source2rosetta::rtti;
|
|
use libfuzzer_sys::fuzz_target;
|
|
|
|
fuzz_target!(|data: &[u8]| {
|
|
let Ok(img) = CodeImage::from_bytes(data.to_vec()) else {
|
|
return;
|
|
};
|
|
let vts = rtti::enumerate_vtables(&img, 128);
|
|
for cv in vts.iter().take(32) {
|
|
let _ = (&cv.name, &cv.mangled, cv.offset_to_top, cv.slots.len());
|
|
}
|
|
// The by-name lookup path (mangling + candidate walk) on a name pulled from the input itself.
|
|
if let Some(name) = vts.first().map(|c| c.name.clone()) {
|
|
let _ = rtti::find_vtable(&img, &name, 128);
|
|
}
|
|
});
|