23 lines
831 B
Rust
23 lines
831 B
Rust
#![no_main]
|
|
//! The Source-2 SchemaSystem reader walks reloc-slot candidates as `SchemaClassInfoData_t` structs,
|
|
//! chasing `m_pFields`/`m_pBaseClasses` pointers. A crafted (or truncated) `.so` can point those
|
|
//! anywhere; the reader must survive it with `Err`/empty, never a panic. Also exercises the field and
|
|
//! base-class accessors the derivation reads.
|
|
use source2rosetta::elf::CodeImage;
|
|
use source2rosetta::schema;
|
|
use libfuzzer_sys::fuzz_target;
|
|
|
|
fuzz_target!(|data: &[u8]| {
|
|
let Ok(img) = CodeImage::from_bytes(data.to_vec()) else {
|
|
return;
|
|
};
|
|
for c in schema::enumerate_schema(&img) {
|
|
let _ = c.primary_base();
|
|
for f in &c.fields {
|
|
let _ = (f.offset, f.name.len());
|
|
}
|
|
for b in &c.bases {
|
|
let _ = (b.offset, b.name.len());
|
|
}
|
|
}
|
|
});
|