laaf_fuzzer_full.cc

// Comprehensive LAAF fuzzer with all 12 mutators for 3-day campaign
#include <cstring>
#include <cstdlib>
#include <string>
#include <vector>
#include <algorithm>
#include "laaf_adapter.h"
#include "laaf_mutator.h"
#include "laaf_mutator_ext.h"

extern "C" size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize);

// All 12 mutators
static Mutator* g_mutators[] = {
    new LiteralMutator(),        // M1
    new OperatorMorphMutator(),  // M2
    new SubtreeReplaceMutator(), // M3
    new RepetitionMutator(),     // M5 (M4 ListMutator disabled - UAF bug)
    new CharClassMutator(),      // M6
    new WrapUnwrapMutator(),     // M7
    new SyntaxInjectMutator(),   // M8
    new TokenMutator(),          // M9
    new FragmentMutator(),       // M10
    new ErrorInjectMutator(),    // M11
    new DeepCombineMutator(),    // M12
};
static const int g_num_mutators = sizeof(g_mutators) / sizeof(g_mutators[0]);

static const float g_mutator_weights[] = {
    0.18f, // M1 literal
    0.14f, // M2 operator
    0.08f, // M3 subtree
    0.06f, // M5 repetition
    0.04f, // M6 charclass
    0.12f, // M7 wrap
    0.12f, // M8 syntax inject
    0.08f, // M9 token
    0.06f, // M10 fragment
    0.07f, // M11 error inject
    0.05f, // M12 deep combine
};

static bool validate_roundtrip(const uint8_t* data, size_t size) {
    std::string error;
    re2::Regexp* re = laaf_parse(data, size, &error);
    if (!re) return false;
    laaf_free(re);
    return true;
}

// AST sanity check: verify no node has nsub>0 with null children.
// Uses ITERATIVE stack to avoid stack-overflow on deep/wide DAG trees.
static bool ast_is_sane(re2::Regexp* re) {
    if (!re) return false;
    std::vector<re2::Regexp*> stk;
    stk.push_back(re);
    int visited = 0;
    const int MAX_VISIT = 50000;
    while (!stk.empty() && visited < MAX_VISIT) {
        re2::Regexp* node = stk.back();
        stk.pop_back();
        visited++;
        int n = node->nsub();
        if (n > 0 && !node->sub()) return false;
        for (int i = 0; i < n; i++) {
            if (!node->sub()[i]) return false;
            stk.push_back(node->sub()[i]);
        }
    }
    if (visited >= MAX_VISIT) return false;  // too large, skip
    return true;
}

extern "C" size_t LLVMFuzzerCustomMutator(
    uint8_t *Data, size_t Size, size_t MaxSize, unsigned int Seed)
{
    RNG rng(Seed);

    // Build fragment pool on first call (collect patterns from parsed seed)
    if (Size > 2 && Size < 500) {
        std::string seed_str(reinterpret_cast<const char*>(Data), Size);
        if (seed_str.find('\n') != std::string::npos)
            seed_str = seed_str.substr(0, seed_str.find('\n'));
        FragmentMutator::add_fragment(seed_str);
    }

    std::string parse_error;
    re2::Regexp* ast = laaf_parse(Data, Size, &parse_error);
    if (!ast) {
        return LLVMFuzzerMutate(Data, Size, MaxSize);
    }

    std::vector<Slot> slots = laaf_collect_slots(ast);
    if (slots.empty()) {
        laaf_free(ast);
        return LLVMFuzzerMutate(Data, Size, MaxSize);
    }

    // Try up to 3 mutation attempts (reduced from 8 to limit OOM)
    for (int attempt = 0; attempt < 3; attempt++) {
        float r = static_cast<float>(rng.next()) / static_cast<float>(UINT32_MAX);
        int mutator_idx = 0;
        float cumulative = 0.0f;
        for (int i = 0; i < g_num_mutators; i++) {
            cumulative += g_mutator_weights[i];
            if (r <= cumulative) { mutator_idx = i; break; }
        }

        re2::Regexp* work_ast = laaf_clone_deep(ast);
        std::vector<Slot> work_slots = laaf_collect_slots(work_ast);

        bool ok = g_mutators[mutator_idx]->mutate(work_ast, work_slots, rng);
        if (!ok) { laaf_free(work_ast); continue; }

        if (!ast_is_sane(work_ast)) {
            laaf_free(work_ast);
            continue;
        }

        std::string dumped;
        if (!laaf_dump(work_ast, &dumped) || dumped.empty() || dumped.size() > MaxSize) {
            laaf_free(work_ast);
            continue;
        }

        // For M11 (error-inject), skip roundtrip validation - the parse failure IS the point
        if (mutator_idx == 10) { // M11
            std::memcpy(Data, dumped.data(), dumped.size());
            size_t result = dumped.size();
            laaf_free(work_ast);
            laaf_free(ast);
            return result;
        }

        if (!validate_roundtrip(reinterpret_cast<const uint8_t*>(dumped.data()), dumped.size())) {
            laaf_free(work_ast);
            continue;
        }

        std::memcpy(Data, dumped.data(), dumped.size());
        size_t result = dumped.size();
        laaf_free(work_ast);
        laaf_free(ast);
        return result;
    }

    laaf_free(ast);
    return LLVMFuzzerMutate(Data, Size, MaxSize);
}

extern "C" size_t LLVMFuzzerCustomCrossOver(
    const uint8_t *Data1, size_t Size1,
    const uint8_t *Data2, size_t Size2,
    uint8_t *Out, size_t MaxOutSize, unsigned int Seed)
{
    RNG rng(Seed);

    std::string err1, err2;
    re2::Regexp* ast1 = laaf_parse(Data1, Size1, &err1);
    re2::Regexp* ast2 = laaf_parse(Data2, Size2, &err2);

    if (!ast1 || !ast2) {
        if (ast1) laaf_free(ast1);
        if (ast2) laaf_free(ast2);
        return 0;
    }

    std::vector<Slot> slots1 = laaf_collect_slots(ast1);
    std::vector<Slot> slots2 = laaf_collect_slots(ast2);

    for (int attempt = 0; attempt < 10; attempt++) {
        if (slots1.empty() || slots2.empty()) break;
        const auto& target = slots1[rng.uniform(slots1.size())];
        const auto& donor  = slots2[rng.uniform(slots2.size())];

        if (target.kind == donor.kind) {
            re2::Regexp* replacement = laaf_clone_deep(*donor.ptr);
            if (laaf_replace(ast1, target, replacement)) {
                std::string dumped;
                if (laaf_dump(ast1, &dumped) && !dumped.empty() && dumped.size() <= MaxOutSize) {
                    if (validate_roundtrip(reinterpret_cast<const uint8_t*>(dumped.data()), dumped.size())) {
                        std::memcpy(Out, dumped.data(), dumped.size());
                        size_t result = dumped.size();
                        laaf_free(ast1);
                        laaf_free(ast2);
                        return result;
                    }
                }
            }
        }
    }

    laaf_free(ast1);
    laaf_free(ast2);
    return 0;
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
    if (Size == 0) return 0;
    // Exercise both successful parse and failed parse paths
    std::string error;
    re2::Regexp* re = laaf_parse(Data, Size, &error);
    if (!re) {
        // Parse failed — exercise error recovery path with Latin1
        re2::RegexpStatus st2;
        re2::Regexp* re2 = re2::Regexp::Parse(
            absl::string_view(reinterpret_cast<const char*>(Data), Size),
            re2::Regexp::Latin1, &st2);
        if (re2) re2->Decref();
        return 0;
    }

    std::string dumped;
    if (!laaf_dump(re, &dumped)) { laaf_free(re); return 0; }

    re2::Regexp* re2 = laaf_parse(reinterpret_cast<const uint8_t*>(dumped.data()), dumped.size(), &error);
    if (re2) {
        // Sanity check: skip Simplify if AST is corrupted (prevents LeadingString SEGV)
        if (ast_is_sane(re2)) {
            re2::Regexp* simplified = re2->Simplify();
            if (simplified) {
                std::string dump2;
                laaf_dump(simplified, &dump2);
                simplified->NumCaptures();
                auto* named = simplified->NamedCaptures();
                if (named) { simplified->CaptureNames(); delete named; }
                simplified->Decref();
            }
        }
        laaf_free(re2);
    }

    // Latin1 path
    re2::RegexpStatus ls;
    re2::Regexp* lr = re2::Regexp::Parse(
        absl::string_view(reinterpret_cast<const char*>(Data), Size),
        re2::Regexp::Latin1, &ls);
    if (lr) lr->Decref();

    laaf_free(re);
    return 0;
}