fuzz_request.c

Go to the documentation of this file.

/*
  This file is part of libmicrohttpd
  Copyright (C) 2026 Christian Grothoff
 
  This library is free software; you can redistribute it and/or
  modify it under the terms of the GNU Lesser General Public
  License as published by the Free Software Foundation; either
  version 2.1 of the License, or (at your option) any later version.
 
  This library is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  Lesser General Public License for more details.
 
  You should have received a copy of the GNU Lesser General Public
  License along with this library.
  If not, see <http://www.gnu.org/licenses/>.
*/
 
/* Must precede every #include: memfd_create() and MFD_CLOEXEC are only
   declared by <sys/mman.h> under _GNU_SOURCE, and the OSS-Fuzz build
   compiles this file with nothing but -DFUZZ_NO_MAIN (the library gets
   _GNU_SOURCE from configure, the hand-compiled harnesses do not).
   Without this the fd-backed response kinds silently fall back to a
   buffer response and MHD_create_response_from_fd*() is never reached
   -- a failure mode with no error message at all. */
#ifndef _GNU_SOURCE
#define _GNU_SOURCE 1
#endif
 
#define FUZZ_HARNESS_NAME "fuzz_request"
#include "fuzz_common.h"
 
#include <microhttpd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <sys/select.h>
 
/* MHD_create_response_from_data() and MHD_create_response_from_buffer()
   with an explicit MHD_ResponseMemoryMode are deprecated but are still
   shipped API and are therefore still worth fuzzing; the deprecation
   warning would otherwise drown the build output. */
#if defined(__GNUC__) || defined(__clang__)
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
#endif
 
/* memfd_create() gives a file descriptor backed by anonymous memory,
   which is what makes the MHD_create_response_from_fd*() variants
   affordable at fuzzing rates: no filesystem is touched.  Where it is
   unavailable the fd-backed response kinds fall back to a buffer
   response (see make_response()). */
#if defined(__linux__)
#include <sys/mman.h>
#if defined(MFD_CLOEXEC)
#define FUZZ_HAVE_MEMFD 1
#endif
#endif
 
#define MAX_SEGMENTS 96
#define MAX_CONNECTIONS 8
#define RESP_BUF_SIZE 16384
#define GEN_BUF_SIZE 8192
#define MAX_EXPECT_BODY 4096
 
#define RESP_KIND_COUNT 16
#define DAUTH_VARIANT_COUNT 10
#define MAX_DIGEST_BIN 64
 
#define DIGEST_REALM "TestRealm"
#define DIGEST_USER "user"
#define DIGEST_PASS "pass"
 
/* ------------------------------------------------------------------ */
/* Per-iteration state                                                 */
/* ------------------------------------------------------------------ */
 
struct fuzz_cfg
{
  size_t mem_limit;
  int discipline;
  unsigned int insanity;
  unsigned int nonce_nc_size;
  enum MHD_DigestAuthMultiAlgo3 algo;
  enum MHD_DigestAuthMultiQOP qop;
  int do_digest;
  int do_basic;
  int do_postproc;
  int do_iterate;
  int chunked_reply;
  int error_reply;
 
  /* ---- configuration bytes 4-9; all zero is the plainest setting ---- */
  unsigned int resp_kind;      
  unsigned int resp_nhdr;      
  int resp_footer;             
  int resp_hdr_api;            
  unsigned int dauth_variant;  
  unsigned int fail_variant;   
  int basic_v1;                
  int calc_helpers;            
  unsigned int loop_mode;      
  int use_timeouts;            
  int conn_lookup;             
  int conn_setvalue;           
  int conn_info;               
  int conn_option;             
  int quiesce;                 
  unsigned int suspend_mode;   
  int allow_upgrade;           
  unsigned int upgrade_action; 
  uint8_t hdr_seed;            
  uint8_t crc_seed;            
};
 
static struct fuzz_cfg cfg;
 
static char nonce_val[192];
static size_t nonce_len;
 
static uint8_t expect_body[MAX_EXPECT_BODY];
static size_t expect_body_len;
static int oracle_on;
 
static unsigned long stat_daemons;
static unsigned long stat_handler_calls;
static unsigned long stat_final_calls;
static unsigned long stat_body_bytes;
static unsigned long stat_challenges;
static unsigned long stat_auth_ok;
static int stats_registered;
 
 
static void
print_stats (void)
{
  if (! fuzz_verbose)
    return;
  fprintf (stderr,
           "%s: daemons=%lu handler calls=%lu (final=%lu) body bytes=%lu "
           "401 challenges=%lu authenticated=%lu\n",
           FUZZ_HARNESS_NAME,
           stat_daemons, stat_handler_calls, stat_final_calls,
           stat_body_bytes, stat_challenges, stat_auth_ok);
}
 
 
static char resp_buf[RESP_BUF_SIZE];
static size_t resp_len;
 
static const size_t mem_limit_tbl[] = {
  0 /* MHD default */, 128, 192, 256, 320, 384, 512, 768, 1024, 1400, 1500,
  2048, 4096, 32768
};
 
static const int discipline_tbl[] = { -3, -2, -1, 0, 1, 2 };
 
static int min_discipline = -3;
static int min_discipline_read;
 
static int forced_shape = -1;
static int forced_shape_read;
 
static size_t min_mem_limit;
static int min_mem_limit_read;
 
static const enum MHD_DigestAuthMultiAlgo3 algo_tbl[] = {
  MHD_DIGEST_AUTH_MULT_ALGO3_SHA256,
  MHD_DIGEST_AUTH_MULT_ALGO3_MD5,
  MHD_DIGEST_AUTH_MULT_ALGO3_SHA512_256,
  MHD_DIGEST_AUTH_MULT_ALGO3_SHA256
};
 
static const unsigned int nnc_tbl[] = { 4, 1, 8, 64 };
 
static const char digest_rnd[32] =
  "\x01\x23\x45\x67\x89\xab\xcd\xef\x01\x23\x45\x67\x89\xab\xcd\xef"
  "\xfe\xdc\xba\x98\x76\x54\x32\x10\xfe\xdc\xba\x98\x76\x54\x32\x10";
 
 
/* ------------------------------------------------------------------ */
/* Configuration byte 4: response construction                       */
/* ------------------------------------------------------------------ */
 
/* Defined with the access handler further down; decorate_response()
   hands it to MHD_get_response_headers(). */
static enum MHD_Result
kv_iter (void *cls,
         enum MHD_ValueKind kind,
         const char *key,
         const char *value);
 
static struct MHD_Daemon *cur_daemon;
 
static struct MHD_Connection *pending_resume[MAX_CONNECTIONS];
 
static int tearing_down;
 
 
static void
pending_resume_add (struct MHD_Connection *c)
{
  unsigned int i;
 
  for (i = 0; i < MAX_CONNECTIONS; i++)
  {
    if (NULL == pending_resume[i])
    {
      pending_resume[i] = c;
      return;
    }
  }
}
 
 
static void
pending_resume_drop (const struct MHD_Connection *c)
{
  unsigned int i;
 
  for (i = 0; i < MAX_CONNECTIONS; i++)
    if (pending_resume[i] == c)
      pending_resume[i] = NULL;
}
 
 
static int
pending_resume_flush (void)
{
  unsigned int i;
  int any = 0;
 
  for (i = 0; i < MAX_CONNECTIONS; i++)
  {
    struct MHD_Connection *c = pending_resume[i];
 
    if (NULL == c)
      continue;
    /* Clear first: MHD_resume_connection() can run the handler, which
       may suspend the very same connection again. */
    pending_resume[i] = NULL;
    MHD_resume_connection (c);
    any = 1;
  }
  return any;
}
 
 
static const char resp_body[] = "hello world, this is the response body";
#define RESP_BODY_LEN (sizeof (resp_body) - 1)
 
static const char *const hdr_names[] = {
  "X-Fuzz", "Content-Type", "Cache-Control", "Accept-Ranges",
  /* "\x01" is split from the rest so that the hex escape stops after
     one digit instead of swallowing the following "Bad". */
  "Connection", "Set-Cookie", "X-\x01" "Bad", "", "Trailer", "Date",
  "X-Fuzz", "Server", "Location", "ETag", "Vary", "Age"
};
 
static const char *const hdr_values[] = {
  "1", "text/plain", "no-cache", "bytes", "keep-alive", "a=b",
  "x\r\nInjected: yes", "", "X-Fuzz", "Thu, 01 Jan 1970 00:00:00 GMT",
  "\x7f", "mhd", "/", "\"tag\"", "*", "0"
};
 
#define HDR_COUNT (sizeof (hdr_names) / sizeof (hdr_names[0]))
 
 
struct crc_state
{
  uint64_t total;      
  int calls;           
  int err_at;          
  unsigned int pattern;
};
 
 
static ssize_t
crc_cb (void *cls,
        uint64_t pos,
        char *buf,
        size_t max)
{
  struct crc_state *st = (struct crc_state *) cls;
  size_t n;
  size_t i;
 
  st->calls++;
  /* Deliberately reachable: an application content reader is allowed to
     fail half way through a response body, and how MHD terminates the
     connection in that case (especially a chunked one that can no
     longer be framed correctly) is worth exercising. */
  if ( (0 <= st->err_at) &&
       (st->calls > st->err_at) )
    return MHD_CONTENT_READER_END_WITH_ERROR;
  if (pos >= st->total)
    return MHD_CONTENT_READER_END_OF_STREAM;
  n = (size_t) (st->total - pos);
  if (n > max)
    n = max;
  if (0 == n)
    return MHD_CONTENT_READER_END_OF_STREAM;
  for (i = 0; i < n; i++)
    buf[i] = (char) ('a' + (int) ((pos + i + st->pattern) % 26));
  return (ssize_t) n;
}
 
 
static void
crc_free (void *cls)
{
  free (cls);
}
 
 
static void
upgrade_cb (void *cls,
            struct MHD_Connection *connection,
            void *req_cls,
            const char *extra_in,
            size_t extra_in_size,
            MHD_socket sock,
            struct MHD_UpgradeResponseHandle *urh)
{
  volatile size_t sink = 0;
 
  (void) cls;
  (void) connection;
  (void) req_cls;
  (void) sock;
  if ( (NULL != extra_in) &&
       (0 != extra_in_size) )
    sink += (size_t) (unsigned char) extra_in[extra_in_size - 1];
  (void) sink;
  if (0 != (cfg.upgrade_action & 0x01u))
    (void) MHD_upgrade_action (urh, MHD_UPGRADE_ACTION_CORK_ON);
  if (0 != (cfg.upgrade_action & 0x02u))
    (void) MHD_upgrade_action (urh, MHD_UPGRADE_ACTION_CORK_OFF);
  (void) MHD_upgrade_action (urh, MHD_UPGRADE_ACTION_CLOSE);
}
 
 
static int
make_memfd (void)
{
#ifdef FUZZ_HAVE_MEMFD
  int fd;
 
  fd = memfd_create ("mhd-fuzz", MFD_CLOEXEC);
  if (0 > fd)
    return -1;
  if (RESP_BODY_LEN != (size_t) write (fd, resp_body, RESP_BODY_LEN))
  {
    (void) close (fd);
    return -1;
  }
  return fd;
#else
  return -1;
#endif
}
 
 
static int
make_pipe_fd (void)
{
  int pf[2];
 
  if (0 != pipe (pf))
    return -1;
  if (RESP_BODY_LEN != (size_t) write (pf[1], resp_body, RESP_BODY_LEN))
  {
    (void) close (pf[0]);
    (void) close (pf[1]);
    return -1;
  }
  (void) close (pf[1]);
  return pf[0];
}
 
 
static void
decorate_response (struct MHD_Response *r)
{
  unsigned int i;
 
  for (i = 0; i < cfg.resp_nhdr; i++)
  {
    unsigned int k = (cfg.hdr_seed + i) % HDR_COUNT;
 
    (void) MHD_add_response_header (r, hdr_names[k], hdr_values[k]);
  }
  if (cfg.resp_footer)
  {
    unsigned int k = (unsigned int) (cfg.hdr_seed + 1u) % HDR_COUNT;
 
    (void) MHD_add_response_footer (r, hdr_names[k], hdr_values[k]);
  }
  if (cfg.resp_hdr_api)
  {
    unsigned int k = cfg.hdr_seed % HDR_COUNT;
    volatile size_t sink = 0;
    const char *v;
 
    v = MHD_get_response_header (r, hdr_names[k]);
    if (NULL != v)
      sink += strlen (v);
    (void) sink;
    (void) MHD_get_response_headers (r, &kv_iter, NULL);
    (void) MHD_del_response_header (r, hdr_names[k], hdr_values[k]);
    (void) MHD_set_response_options (r,
                                     (enum MHD_ResponseFlags)
                                     (((cfg.hdr_seed & 0x01) ?
                                       MHD_RF_HTTP_VERSION_1_0_RESPONSE : 0)
                                      | ((cfg.hdr_seed & 0x02) ?
                                         MHD_RF_SEND_KEEP_ALIVE_HEADER : 0)
                                      | ((cfg.hdr_seed & 0x04) ?
                                         MHD_RF_INSANITY_HEADER_CONTENT_LENGTH
                                         : 0)
                                      | ((cfg.hdr_seed & 0x08) ?
                                         MHD_RF_HEAD_ONLY_RESPONSE : 0)),
                                     MHD_RO_END);
  }
}
 
 
static struct MHD_Response *
make_response (void)
{
  struct MHD_Response *r = NULL;
  struct crc_state *st;
  void *heap;
  int fd;
 
  switch (cfg.resp_kind)
  {
  case 0:
    /* The two responses the harness used before byte 4 existed.  Bit
       0x20 of byte 1 (cfg.chunked_reply) selects between them and has
       no other effect, so keeping the pair here is what keeps that bit
       meaningful. */
    if (cfg.chunked_reply)
      r = MHD_create_response_from_buffer_copy (11, "hello world");
    else
      r = MHD_create_response_from_buffer_static (2, "ok");
    break;
  case 1:
    r = MHD_create_response_from_buffer_copy (RESP_BODY_LEN, resp_body);
    break;
  case 2:
    r = MHD_create_response_empty (MHD_RF_NONE);
    break;
  case 3:
    r = MHD_create_response_from_buffer (RESP_BODY_LEN,
                                         (void *) (intptr_t) resp_body,
                                         MHD_RESPMEM_PERSISTENT);
    break;
  case 4:
    heap = malloc (RESP_BODY_LEN);
    if (NULL == heap)
      return NULL;
    memcpy (heap, resp_body, RESP_BODY_LEN);
    r = MHD_create_response_from_buffer (RESP_BODY_LEN,
                                         heap,
                                         MHD_RESPMEM_MUST_FREE);
    if (NULL == r)
      free (heap);
    break;
  case 5:
    r = MHD_create_response_from_buffer (RESP_BODY_LEN,
                                         (void *) (intptr_t) resp_body,
                                         MHD_RESPMEM_MUST_COPY);
    break;
  case 6:
    heap = malloc (RESP_BODY_LEN);
    if (NULL == heap)
      return NULL;
    memcpy (heap, resp_body, RESP_BODY_LEN);
    r = MHD_create_response_from_buffer_with_free_callback (RESP_BODY_LEN,
                                                            heap,
                                                            &free);
    if (NULL == r)
      free (heap);
    break;
  case 7:
    r = MHD_create_response_from_data (RESP_BODY_LEN,
                                       (void *) (intptr_t) resp_body,
                                       0 /* must_free */,
                                       1 /* must_copy */);
    break;
  case 8:
    heap = malloc (RESP_BODY_LEN);
    if (NULL == heap)
      return NULL;
    memcpy (heap, resp_body, RESP_BODY_LEN);
    r = MHD_create_response_from_data (RESP_BODY_LEN,
                                       heap,
                                       1 /* must_free */,
                                       0 /* must_copy */);
    if (NULL == r)
      free (heap);
    break;
  case 9:
  case 10:
    st = (struct crc_state *) calloc (1, sizeof (struct crc_state));
    if (NULL == st)
      return NULL;
    st->total = (uint64_t) (1u + (cfg.crc_seed & 0x7Fu));
    st->pattern = cfg.crc_seed;
    /* Injecting a reader error is only interesting some of the time;
       otherwise the body would rarely complete. */
    st->err_at = (0 != (cfg.crc_seed & 0x80u))
                 ? (int) (1u + (cfg.crc_seed & 0x03u))
                 : -1;
    r = MHD_create_response_from_callback (
      (9 == cfg.resp_kind) ? st->total : MHD_SIZE_UNKNOWN,
      (size_t) (16u + (cfg.crc_seed & 0x3Fu)),
      &crc_cb,
      st,
      &crc_free);
    if (NULL == r)
      free (st);
    break;
  case 11:
  case 12:
  case 13:
    fd = make_memfd ();
    if (0 > fd)
    {
      r = MHD_create_response_from_buffer_static (2, "ok");
      break;
    }
    if (11 == cfg.resp_kind)
      r = MHD_create_response_from_fd (RESP_BODY_LEN, fd);
    else if (12 == cfg.resp_kind)
      /* Parenthesised so that the deprecated *function* is called and
         not the same-named macro that redirects to the 64 bit variant;
         reaching the v1 entry point is the whole point here. */
      r = (MHD_create_response_from_fd_at_offset) (
        RESP_BODY_LEN / 2,
        fd,
        (off_t) (RESP_BODY_LEN / 4));
    else
      r = MHD_create_response_from_fd64 ((uint64_t) RESP_BODY_LEN, fd);
    if (NULL == r)
      (void) close (fd);
    break;
  case 14:
    fd = make_pipe_fd ();
    if (0 > fd)
    {
      r = MHD_create_response_from_buffer_static (2, "ok");
      break;
    }
    r = MHD_create_response_from_pipe (fd);
    if (NULL == r)
      (void) close (fd);
    break;
  case 15:
  default:
    {
      static struct MHD_IoVec iov[3];
 
      /* Static data, so no free callback is needed; MHD copies the
         array itself (see the documentation of the @a iov parameter). */
      iov[0].iov_base = resp_body;
      iov[0].iov_len = RESP_BODY_LEN / 2;
      iov[1].iov_base = resp_body + (RESP_BODY_LEN / 2);
      iov[1].iov_len = RESP_BODY_LEN - (RESP_BODY_LEN / 2);
      iov[2].iov_base = resp_body;
      iov[2].iov_len = (size_t) (cfg.crc_seed % (RESP_BODY_LEN + 1));
      r = MHD_create_response_from_iovec (iov,
                                          (0 != iov[2].iov_len) ? 3u : 2u,
                                          NULL,
                                          NULL);
    }
    break;
  }
  if (NULL != r)
    decorate_response (r);
  return r;
}
 
 
/* ------------------------------------------------------------------ */
/* Access handler                                                      */
/* ------------------------------------------------------------------ */
 
struct hstate
{
  size_t body_off;
  struct MHD_PostProcessor *pp;
  int pp_tried;
};
 
 
static enum MHD_Result
kv_iter (void *cls,
         enum MHD_ValueKind kind,
         const char *key,
         const char *value)
{
  volatile size_t sink = 0;
 
  (void) cls;
  (void) kind;
  if (NULL != key)
    sink += strlen (key);
  if (NULL != value)
    sink += strlen (value);
  (void) sink;
  return MHD_YES;
}
 
 
static enum MHD_Result
kv_iter_n (void *cls,
           enum MHD_ValueKind kind,
           const char *key,
           size_t key_size,
           const char *value,
           size_t value_size)
{
  volatile size_t sink = 0;
 
  (void) cls;
  (void) kind;
  if ( (NULL != key) && (0 != key_size) )
    sink += (size_t) (unsigned char) key[key_size - 1];
  if ( (NULL != value) && (0 != value_size) )
    sink += (size_t) (unsigned char) value[value_size - 1];
  (void) sink;
  return MHD_YES;
}
 
 
static enum MHD_Result
post_iter (void *cls,
           enum MHD_ValueKind kind,
           const char *key,
           const char *filename,
           const char *content_type,
           const char *transfer_encoding,
           const char *data,
           uint64_t off,
           size_t size)
{
  volatile size_t sink = 0;
 
  (void) cls;
  (void) kind;
  (void) off;
  if (NULL != key)
    sink += strlen (key);
  if (NULL != filename)
    sink += strlen (filename);
  if (NULL != content_type)
    sink += strlen (content_type);
  if (NULL != transfer_encoding)
    sink += strlen (transfer_encoding);
  if ( (NULL != data) && (0 != size) )
    sink += (size_t) (unsigned char) data[size - 1];
  (void) sink;
  return MHD_YES;
}
 
 
static void
oracle_check_body (struct hstate *hs,
                   const char *data,
                   size_t size)
{
  if ( (! oracle_on) ||
       (0 == size) )
    return;
  if ( (hs->body_off + size > expect_body_len) ||
       (0 != memcmp (expect_body + hs->body_off, data, size)) )
    fuzz_report_finding (
      "request body desync: the bytes MHD delivered to the application "
      "differ from the body encoded in the generated request "
      "(chunked/Content-Length framing bug, cf. HTTP request smuggling)");
  hs->body_off += size;
}
 
 
/* ------------------------------------------------------------------ */
/* Configuration byte 5: authentication entry points                 */
/* ------------------------------------------------------------------ */
 
static const enum MHD_DigestAuthAlgorithm algo1_tbl[] = {
  MHD_DIGEST_ALG_AUTO,
  MHD_DIGEST_ALG_MD5,
  MHD_DIGEST_ALG_SHA256,
  MHD_DIGEST_ALG_AUTO
};
 
static const enum MHD_DigestAuthAlgo3 algo3_tbl[] = {
  MHD_DIGEST_AUTH_ALGO3_MD5,
  MHD_DIGEST_AUTH_ALGO3_SHA256,
  MHD_DIGEST_AUTH_ALGO3_SHA512_256,
  MHD_DIGEST_AUTH_ALGO3_MD5_SESSION,
  MHD_DIGEST_AUTH_ALGO3_SHA256_SESSION,
  MHD_DIGEST_AUTH_ALGO3_SHA512_256_SESSION,
  MHD_DIGEST_AUTH_ALGO3_MD5,
  MHD_DIGEST_AUTH_ALGO3_SHA256
};
 
#define DAUTH_CHALLENGE 0
#define DAUTH_PASSED    1
#define DAUTH_STALE     2
 
 
static void
call_calc_helpers (void)
{
  enum MHD_DigestAuthAlgo3 a = algo3_tbl[cfg.hdr_seed
                                         % (sizeof (algo3_tbl)
                                            / sizeof (algo3_tbl[0]))];
  size_t hs;
  size_t claim;
  void *bin;
  char *hex;
 
  hs = MHD_digest_get_hash_size (a);
  if ( (0 == hs) ||
       (hs > MAX_DIGEST_BIN) )
    return;
  claim = hs - (size_t) (cfg.crc_seed % (unsigned int) (hs + 1u));
 
  bin = malloc (claim);
  if (NULL != bin)
  {
    (void) MHD_digest_auth_calc_userdigest (a,
                                            DIGEST_USER,
                                            DIGEST_REALM,
                                            DIGEST_PASS,
                                            bin,
                                            claim);
    (void) MHD_digest_auth_calc_userhash (a,
                                          DIGEST_USER,
                                          DIGEST_REALM,
                                          bin,
                                          claim);
    free (bin);
  }
  /* The hex form needs 2*hs+1 bytes; ask for less about half the time. */
  claim = (2u * hs + 1u)
          - (size_t) (cfg.hdr_seed % (unsigned int) (2u * hs + 2u));
  hex = (char *) malloc (claim);
  if (NULL != hex)
  {
    (void) MHD_digest_auth_calc_userhash_hex (a,
                                              DIGEST_USER,
                                              DIGEST_REALM,
                                              hex,
                                              claim);
    free (hex);
  }
}
 
 
static int
run_digest_check (struct MHD_Connection *connection)
{
  unsigned int variant = cfg.dauth_variant;
  enum MHD_DigestAuthResult dres;
  uint8_t ud[MAX_DIGEST_BIN];
  size_t hs;
  int r1;
  volatile size_t sink = 0;
 
  switch (variant)
  {
  case 1:
    r1 = MHD_digest_auth_check (connection,
                                DIGEST_REALM,
                                DIGEST_USER,
                                DIGEST_PASS,
                                0);
    if (MHD_YES == r1)
      return DAUTH_PASSED;
    return (MHD_INVALID_NONCE == r1) ? DAUTH_STALE : DAUTH_CHALLENGE;
  case 2:
    r1 = MHD_digest_auth_check2 (connection,
                                 DIGEST_REALM,
                                 DIGEST_USER,
                                 DIGEST_PASS,
                                 0,
                                 algo1_tbl[cfg.hdr_seed & 0x03]);
    if (MHD_YES == r1)
      return DAUTH_PASSED;
    return (MHD_INVALID_NONCE == r1) ? DAUTH_STALE : DAUTH_CHALLENGE;
  case 3:
    /* MHD_digest_auth_check_digest() is MD5-only by definition. */
    if (MHD_YES != MHD_digest_auth_calc_userdigest (
          MHD_DIGEST_AUTH_ALGO3_MD5,
          DIGEST_USER, DIGEST_REALM, DIGEST_PASS,
          ud, MHD_MD5_DIGEST_SIZE))
      break;
    r1 = MHD_digest_auth_check_digest (connection,
                                       DIGEST_REALM,
                                       DIGEST_USER,
                                       ud,
                                       0);
    if (MHD_YES == r1)
      return DAUTH_PASSED;
    return (MHD_INVALID_NONCE == r1) ? DAUTH_STALE : DAUTH_CHALLENGE;
  case 4:
  case 5:
    {
      /* The pre-computed-digest entry points are stricter than the
         password-based ones: the digest and the algorithm have to
         agree, and naming more than one base hashing algorithm is an
         MHD_PANIC("API violation") rather than an error return.  So the
         algorithm is chosen first here and the digest, its length and
         the algorithm argument are all derived from that one choice.
 
         MHD_DIGEST_ALG_AUTO is deliberately not used for variant 4:
         MHD_digest_auth_check_digest2() maps it to
         MULT_ALGO3_ANY_NON_SESSION, which names three base algorithms
         and therefore trips that very panic.  See README section 6. */
      static const enum MHD_DigestAuthAlgo3 digest_algos[] = {
        MHD_DIGEST_AUTH_ALGO3_MD5,
        MHD_DIGEST_AUTH_ALGO3_SHA256,
        MHD_DIGEST_AUTH_ALGO3_SHA512_256,
        MHD_DIGEST_AUTH_ALGO3_MD5_SESSION,
        MHD_DIGEST_AUTH_ALGO3_SHA256_SESSION,
        MHD_DIGEST_AUTH_ALGO3_SHA512_256_SESSION
      };
      enum MHD_DigestAuthAlgo3 a3;
 
      if (4 == variant)
        /* check_digest2() only knows MD5 and SHA-256. */
        a3 = (0 != (cfg.hdr_seed & 0x01))
             ? MHD_DIGEST_AUTH_ALGO3_SHA256
             : MHD_DIGEST_AUTH_ALGO3_MD5;
      else
        a3 = digest_algos[cfg.hdr_seed
                          % (sizeof (digest_algos)
                             / sizeof (digest_algos[0]))];
      hs = MHD_digest_get_hash_size (a3);
      if ( (0 == hs) ||
           (hs > sizeof (ud)) ||
           (MHD_YES != MHD_digest_auth_calc_userdigest (a3,
                                                        DIGEST_USER,
                                                        DIGEST_REALM,
                                                        DIGEST_PASS,
                                                        ud,
                                                        hs)) )
        break;
      if (4 == variant)
      {
        r1 = MHD_digest_auth_check_digest2 (connection,
                                            DIGEST_REALM,
                                            DIGEST_USER,
                                            ud,
                                            hs,
                                            0,
                                            (MHD_DIGEST_AUTH_ALGO3_SHA256 == a3)
                                            ? MHD_DIGEST_ALG_SHA256
                                            : MHD_DIGEST_ALG_MD5);
        if (MHD_YES == r1)
          return DAUTH_PASSED;
        return (MHD_INVALID_NONCE == r1) ? DAUTH_STALE : DAUTH_CHALLENGE;
      }
      dres = MHD_digest_auth_check_digest3 (connection,
                                            DIGEST_REALM,
                                            DIGEST_USER,
                                            ud,
                                            hs,
                                            0,
                                            0,
                                            cfg.qop,
                                            /* Exactly one base algorithm.
                                               The MULT_ALGO3_* constants are
                                               numerically identical to their
                                               ALGO3_* counterparts. */
                                            (enum MHD_DigestAuthMultiAlgo3) a3);
      if (MHD_DAUTH_OK == dres)
        return DAUTH_PASSED;
      return (MHD_DAUTH_NONCE_STALE == dres) ? DAUTH_STALE : DAUTH_CHALLENGE;
    }
  case 6:
    {
      char *u = MHD_digest_auth_get_username (connection);
 
      if (NULL != u)
      {
        sink += strlen (u);
        MHD_free (u);
      }
    }
    break;
  case 7:
    {
      struct MHD_DigestAuthUsernameInfo *ui;
 
      ui = MHD_digest_auth_get_username3 (connection);
      if (NULL != ui)
      {
        if (NULL != ui->username)
          sink += ui->username_len;
        if (NULL != ui->userhash_hex)
          sink += ui->userhash_hex_len;
        MHD_free (ui);
      }
    }
    break;
  case 8:
    {
      struct MHD_DigestAuthInfo *ai;
 
      ai = MHD_digest_auth_get_request_info3 (connection);
      if (NULL != ai)
      {
        if (NULL != ai->username)
          sink += ai->username_len;
        if (NULL != ai->realm)
          sink += ai->realm_len;
        if (NULL != ai->opaque)
          sink += ai->opaque_len;
        if (NULL != ai->userhash_hex)
          sink += ai->userhash_hex_len;
        sink += ai->cnonce_len;
        sink += (size_t) ai->nc;
        MHD_free (ai);
      }
    }
    break;
  default:
    break;
  }
  (void) sink;
 
  /* Variant 0, the query variants and every early break end up here. */
  dres = MHD_digest_auth_check3 (connection,
                                 DIGEST_REALM,
                                 DIGEST_USER,
                                 DIGEST_PASS,
                                 0 /* daemon default nonce timeout */,
                                 0 /* daemon default max_nc */,
                                 cfg.qop,
                                 MHD_DIGEST_AUTH_MULT_ALGO3_ANY_NON_SESSION);
  if (MHD_DAUTH_OK == dres)
    return DAUTH_PASSED;
  return (MHD_DAUTH_NONCE_STALE == dres) ? DAUTH_STALE : DAUTH_CHALLENGE;
}
 
 
static enum MHD_Result
queue_auth_challenge (struct MHD_Connection *connection,
                      int stale)
{
  struct MHD_Response *resp;
  enum MHD_Result ret;
 
  resp = MHD_create_response_from_buffer_static (0, "");
  if (NULL == resp)
    return MHD_NO;
  switch (cfg.fail_variant)
  {
  case 1:
    ret = MHD_queue_auth_fail_response (connection,
                                        DIGEST_REALM,
                                        "0123456789abcdef",
                                        resp,
                                        stale ? MHD_YES : MHD_NO);
    break;
  case 2:
    ret = MHD_queue_auth_fail_response2 (connection,
                                         DIGEST_REALM,
                                         "0123456789abcdef",
                                         resp,
                                         stale ? MHD_YES : MHD_NO,
                                         algo1_tbl[cfg.hdr_seed & 0x03]);
    break;
  case 3:
    if (0 != (cfg.hdr_seed & 0x01))
      ret = MHD_queue_basic_auth_required_response3 (connection,
                                                     DIGEST_REALM,
                                                     (0 != (cfg.hdr_seed
                                                            & 0x02))
                                                     ? MHD_YES : MHD_NO,
                                                     resp);
    else
      ret = MHD_queue_basic_auth_fail_response (connection,
                                                DIGEST_REALM,
                                                resp);
    break;
  case 0:
  default:
    ret = MHD_queue_auth_required_response3 (connection,
                                             DIGEST_REALM,
                                             "0123456789abcdef" /* opaque */,
                                             "/",
                                             resp,
                                             stale ? MHD_YES : MHD_NO,
                                             cfg.qop,
                                             cfg.algo,
                                             MHD_YES /* userhash */,
                                             MHD_NO);
    break;
  }
  MHD_destroy_response (resp);
  return ret;
}
 
 
/* ------------------------------------------------------------------ */
/* Configuration byte 6: connection introspection                    */
/* ------------------------------------------------------------------ */
 
static void
exercise_connection_api (struct MHD_Connection *connection)
{
  volatile size_t sink = 0;
 
  if (cfg.conn_lookup)
  {
    static const char *const keys[] = {
      "Host", "Content-Length", "Transfer-Encoding", "Authorization",
      "Cookie", "", "X-Fuzz", "connection"
    };
    const char *k = keys[cfg.hdr_seed % (sizeof (keys) / sizeof (keys[0]))];
    const char *v;
    const char *vp = NULL;
    size_t vlen = 0;
    const char *uri = NULL;
    size_t ulen = 0;
 
    v = MHD_lookup_connection_value (connection, MHD_HEADER_KIND, k);
    if (NULL != v)
      sink += strlen (v);
    if (MHD_YES == MHD_lookup_connection_value_n (connection,
                                                  MHD_HEADER_KIND,
                                                  k,
                                                  strlen (k),
                                                  &vp,
                                                  &vlen))
      sink += vlen;
    if (MHD_YES == MHD_get_connection_URI_path_n (connection, &uri, &ulen))
      sink += ulen;
  }
  if (cfg.conn_setvalue)
    (void) MHD_set_connection_value (connection,
                                     MHD_HEADER_KIND,
                                     "X-Fuzz-Added",
                                     "1");
  if (cfg.conn_info)
  {
    static const enum MHD_ConnectionInfoType cinfo[] = {
      MHD_CONNECTION_INFO_CLIENT_ADDRESS,
      MHD_CONNECTION_INFO_DAEMON,
      MHD_CONNECTION_INFO_CONNECTION_FD,
      MHD_CONNECTION_INFO_SOCKET_CONTEXT,
      MHD_CONNECTION_INFO_CONNECTION_SUSPENDED,
      MHD_CONNECTION_INFO_CONNECTION_TIMEOUT,
      MHD_CONNECTION_INFO_REQUEST_HEADER_SIZE,
      MHD_CONNECTION_INFO_HTTP_STATUS
    };
    static const enum MHD_DaemonInfoType dinfo[] = {
      MHD_DAEMON_INFO_CURRENT_CONNECTIONS,
      MHD_DAEMON_INFO_FLAGS,
      MHD_DAEMON_INFO_LISTEN_FD,
      MHD_DAEMON_INFO_BIND_PORT
    };
    unsigned int i;
 
    for (i = 0; i < sizeof (cinfo) / sizeof (cinfo[0]); i++)
      if (NULL != MHD_get_connection_info (connection, cinfo[i]))
        sink++;
    for (i = 0; i < sizeof (dinfo) / sizeof (dinfo[0]); i++)
      if ( (NULL != cur_daemon) &&
           (NULL != MHD_get_daemon_info (cur_daemon, dinfo[i])) )
        sink++;
  }
  if (cfg.conn_option)
    (void) MHD_set_connection_option (connection,
                                      MHD_CONNECTION_OPTION_TIMEOUT,
                                      (unsigned int) (cfg.crc_seed & 0x0F));
  if (cfg.conn_info)
  {
    /* Constant-output accessors.  They cannot fail on attacker input,
       but they are cheap and leaving them uncovered makes the coverage
       report harder to read.
       MHD_fini() is deliberately NOT called anywhere: it tears down
       process-global library state, so a single call would break every
       later iteration in the same process. */
    const char *v = MHD_get_version ();
 
    if (NULL != v)
      sink += strlen (v);
    sink += (size_t) MHD_get_version_bin ();
  }
  (void) sink;
}
 
 
static void
suspend_maybe (struct MHD_Connection *connection)
{
  if ( (0 == cfg.suspend_mode) ||
       tearing_down)
    return;
  MHD_suspend_connection (connection);
  if (1 == cfg.suspend_mode)
  {
    MHD_resume_connection (connection);
    return;
  }
  pending_resume_add (connection);
}
 
 
static enum MHD_Result
ahc (void *cls,
     struct MHD_Connection *connection,
     const char *url,
     const char *method,
     const char *version,
     const char *upload_data,
     size_t *upload_data_size,
     void **req_cls)
{
  struct hstate *hs = (struct hstate *) *req_cls;
  struct MHD_Response *resp;
  enum MHD_Result ret;
  volatile size_t sink = 0;
  const char *conn_hdr = NULL;
  char conn_lc[128];
 
  conn_lc[0] = '\0';
  (void) cls;
  if (NULL == hs)
  {
    hs = (struct hstate *) calloc (1, sizeof (struct hstate));
    if (NULL == hs)
      return MHD_NO;
    *req_cls = hs;
    return MHD_YES;
  }
 
  stat_handler_calls++;
  /* Touch the parsed request line the way a real application would. */
  if (NULL != url)
    sink += strlen (url);
  if (NULL != method)
    sink += strlen (method);
  if (NULL != version)
    sink += strlen (version);
  (void) sink;
 
  if (0 != *upload_data_size)
  {
    stat_body_bytes += (unsigned long) *upload_data_size;
    oracle_check_body (hs, upload_data, *upload_data_size);
    if (cfg.do_postproc)
    {
      if ( (NULL == hs->pp) &&
           (! hs->pp_tried) )
      {
        hs->pp_tried = 1;
        hs->pp = MHD_create_post_processor (connection,
                                            1024,
                                            &post_iter,
                                            NULL);
      }
      if (NULL != hs->pp)
        (void) MHD_post_process (hs->pp, upload_data, *upload_data_size);
    }
    *upload_data_size = 0;
    return MHD_YES;
  }
 
  stat_final_calls++;
  if (cfg.do_iterate)
  {
    const enum MHD_ValueKind kinds = MHD_HEADER_KIND
                                     | MHD_GET_ARGUMENT_KIND
                                     | MHD_COOKIE_KIND
                                     | MHD_FOOTER_KIND;
 
    /* Alternate between the NUL-terminated iterator and the
       length-aware one, which are separate code paths in MHD. */
    if (0 != (cfg.hdr_seed & 0x10))
      (void) MHD_get_connection_values_n (connection, kinds, &kv_iter_n, NULL);
    else
      (void) MHD_get_connection_values (connection, kinds, &kv_iter, NULL);
  }
 
  if (oracle_on &&
      (hs->body_off != expect_body_len) )
    fuzz_report_finding (
      "request body truncated: MHD completed the request but delivered "
      "fewer body bytes than the generated request contained");
 
  exercise_connection_api (connection);
 
  /* Lower-cased copy of the request's "Connection" header, used by the
     upgrade check further down.  MHD's own token matcher is internal,
     so a plain case-folded substring test is used here; it only has to
     be good enough to keep the harness from queueing an upgrade
     response on a connection that cannot be upgraded. */
  if (cfg.allow_upgrade)
  {
    conn_hdr = MHD_lookup_connection_value (connection,
                                            MHD_HEADER_KIND,
                                            MHD_HTTP_HEADER_CONNECTION);
    if (NULL != conn_hdr)
    {
      size_t i;
 
      for (i = 0; (i + 1 < sizeof (conn_lc)) && ('\0' != conn_hdr[i]); i++)
        conn_lc[i] = (char) (( ('A' <= conn_hdr[i]) && ('Z' >= conn_hdr[i]))
                             ? (conn_hdr[i] - 'A' + 'a') : conn_hdr[i]);
      conn_lc[i] = '\0';
    }
  }
 
  if (cfg.do_basic)
  {
    if (cfg.basic_v1)
    {
      /* The v1 getter returns two separate malloc()ed strings and is
         the one that historically had to be freed by hand. */
      char *pass = NULL;
      char *user;
 
      user = MHD_basic_auth_get_username_password (connection, &pass);
      if (NULL != user)
        sink += strlen (user);
      if (NULL != pass)
        sink += strlen (pass);
      if (NULL != user)
        MHD_free (user);
      if (NULL != pass)
        MHD_free (pass);
    }
    else
    {
      struct MHD_BasicAuthInfo *bai;
 
      bai = MHD_basic_auth_get_username_password3 (connection);
      if (NULL != bai)
      {
        if (NULL != bai->username)
          sink += bai->username_len;
        if (NULL != bai->password)
          sink += bai->password_len;
        MHD_free (bai);
      }
    }
  }
 
  if (cfg.calc_helpers)
    call_calc_helpers ();
 
  if (cfg.do_digest)
  {
    int dres = run_digest_check (connection);
 
    if (DAUTH_PASSED == dres)
      stat_auth_ok++;
    else
    {
      stat_challenges++;
      return queue_auth_challenge (connection, DAUTH_STALE == dres);
    }
  }
 
  /* Only answer 101 for a request that really is an upgrade request:
     HTTP/1.1, an "Upgrade" header, and a "Connection" header naming the
     upgrade token (RFC 9110 section 7.8).  This is the check a real
     application performs, and all three inputs come off the wire, so
     the path stays fully attacker-driven.
 
     It is deliberately NOT enough to predict whether MHD will accept
     the upgrade, and it is not meant to be: MHD may have decided during
     header parsing that the connection must close, and does not expose
     that decision.  That used to trip
     mhd_assert (NULL == r->upgrade_handler ||
                 MHD_CONN_MUST_UPGRADE == c->keepalive)
     in build_header_response() -- finding K7, see README section 6,
     reproducer corpus/known-findings/K7-upgrade-after-must-close.bin --
     and MHD_queue_response() now returns MHD_NO for it instead, which
     the code below already handles.  Do not "fix" this by tightening
     the condition here: the check above is what an application can
     actually do, and the harness has to behave like one. */
  if (cfg.allow_upgrade &&
      (NULL != version) &&
      (0 == strcmp (version, MHD_HTTP_VERSION_1_1)) &&
      (NULL != MHD_lookup_connection_value (connection,
                                            MHD_HEADER_KIND,
                                            MHD_HTTP_HEADER_UPGRADE)) &&
      (NULL != conn_hdr) &&
      (NULL != strstr (conn_lc, "upgrade")) &&
      (NULL == strstr (conn_lc, "close")))
  {
    resp = MHD_create_response_for_upgrade (&upgrade_cb, NULL);
    if (NULL != resp)
    {
      /* Mandatory: MHD_create_response_for_upgrade() documents that the
         upgrade headers are the application's job, and
         MHD_response_execute_upgrade_() asserts that "Upgrade" is
         present before it hands the socket over.  Omitting it is an
         application-contract violation, not something worth fuzzing. */
      (void) MHD_add_response_header (resp,
                                      MHD_HTTP_HEADER_UPGRADE,
                                      "fuzz-protocol");
      decorate_response (resp);
      ret = MHD_queue_response (connection,
                                MHD_HTTP_SWITCHING_PROTOCOLS,
                                resp);
      MHD_destroy_response (resp);
      return ret;
    }
  }
 
  resp = make_response ();
  if (NULL == resp)
    return MHD_NO;
  ret = MHD_queue_response (connection,
                            cfg.error_reply
                            ? MHD_HTTP_FORBIDDEN : MHD_HTTP_OK,
                            resp);
  MHD_destroy_response (resp);
  /* Only after a response was actually accepted.  Returning MHD_NO
     tells MHD to terminate the connection, and terminating a connection
     that this callback has just suspended trips
     mhd_assert (! connection->suspended) in MHD_connection_close_().
     That is the harness contradicting itself, not an MHD defect: the
     two requests are mutually exclusive by construction.  (MHD_NO is
     reachable here for real -- MHD_queue_response() rejects, for
     instance, a response carrying MHD_RF_HEAD_ONLY_RESPONSE on a GET,
     which decorate_response() can set.) */
  if (MHD_YES == ret)
    suspend_maybe (connection);
  return ret;
}
 
 
static void
completed_cb (void *cls,
              struct MHD_Connection *connection,
              void **req_cls,
              enum MHD_RequestTerminationCode toe)
{
  struct hstate *hs = (struct hstate *) *req_cls;
 
  (void) cls;
  (void) toe;
  /* MHD is done with this connection, so the deferred resume of
     suspend mode 2 must not fire for it any more. */
  pending_resume_drop (connection);
  if (NULL == hs)
    return;
  if (NULL != hs->pp)
    (void) MHD_destroy_post_processor (hs->pp);
  free (hs);
  *req_cls = NULL;
}
 
 
static void
panic_cb (void *cls,
          const char *file,
          unsigned int line,
          const char *reason)
{
  char msg[512];
 
  (void) cls;
  (void) snprintf (msg, sizeof (msg),
                   "MHD_PANIC() reached from network input at %s:%u: %s",
                   (NULL != file) ? file : "?",
                   line,
                   (NULL != reason) ? reason : "?");
  fuzz_report_finding (msg);
}
 
 
/* ------------------------------------------------------------------ */
/* Driving the daemon                                                  */
/* ------------------------------------------------------------------ */
 
static void
drain_and_harvest (int sock)
{
  for (;;)
  {
    ssize_t n;
    char tmp[4096];
 
    n = recv (sock, tmp, sizeof (tmp), MSG_DONTWAIT);
    if (0 >= n)
      break;
    if (resp_len + (size_t) n < RESP_BUF_SIZE)
    {
      memcpy (resp_buf + resp_len, tmp, (size_t) n);
      resp_len += (size_t) n;
      resp_buf[resp_len] = '\0';
    }
  }
  if (0 != resp_len)
  {
    const char *p = resp_buf;
 
    while (NULL != (p = strstr (p, "nonce=\"")))
    {
      const char *s = p + 7;
      const char *e = strchr (s, '"');
 
      p = s;
      if (NULL == e)
        break;
      if ((size_t) (e - s) < sizeof (nonce_val))
      {
        memcpy (nonce_val, s, (size_t) (e - s));
        nonce_len = (size_t) (e - s);
        nonce_val[nonce_len] = '\0';
      }
    }
  }
}
 
 
static void
run_once (struct MHD_Daemon *d)
{
  fd_set rs;
  fd_set ws;
  fd_set es;
  MHD_socket max_fd = MHD_INVALID_SOCKET;
  struct timeval tv;
 
  if (0 == cfg.loop_mode)
  {
    (void) MHD_run (d);
    return;
  }
  FD_ZERO (&rs);
  FD_ZERO (&ws);
  FD_ZERO (&es);
  if (1 == cfg.loop_mode)
  {
    /* Parenthesised so that the real v1 function is called:
       microhttpd.h also defines MHD_get_fdset as a macro that forwards
       to MHD_get_fdset2 with FD_SETSIZE, so the unparenthesised name
       would never reach the v1 entry point at all.  Same trick for
       MHD_run_from_select below. */
    if (MHD_YES != (MHD_get_fdset) (d, &rs, &ws, &es, &max_fd))
    {
      (void) MHD_run (d);
      return;
    }
  }
  else
  {
    if (MHD_YES != MHD_get_fdset2 (d, &rs, &ws, &es, &max_fd,
                                   (unsigned int) FD_SETSIZE))
    {
      (void) MHD_run (d);
      return;
    }
  }
  if (cfg.use_timeouts)
  {
    MHD_UNSIGNED_LONG_LONG tl = 0;
    uint64_t t64 = 0;
    volatile int64_t sink;
 
    (void) MHD_get_timeout (d, &tl);
    (void) MHD_get_timeout64 (d, &t64);
    sink = MHD_get_timeout64s (d);
    sink += (int64_t) MHD_get_timeout_i (d);
    (void) sink;
  }
  tv.tv_sec = 0;
  tv.tv_usec = 0;
  if (MHD_INVALID_SOCKET != max_fd)
    (void) select ((int) max_fd + 1, &rs, &ws, &es, &tv);
  if (1 == cfg.loop_mode)
    (void) (MHD_run_from_select) (d, &rs, &ws, &es);
  else
    (void) MHD_run_from_select2 (d, &rs, &ws, &es, (unsigned int) FD_SETSIZE);
}
 
 
static void
pump (struct MHD_Daemon *d,
      int sock,
      unsigned int rounds)
{
  unsigned int i;
 
  for (i = 0; i < rounds; i++)
  {
    /* Deferred resume of suspend mode 2.  Each slot is cleared before
       its connection is resumed, which keeps this correct even if the
       resume makes MHD complete (and forget) the connection, or run the
       handler again so that it suspends the same one anew. */
    (void) pending_resume_flush ();
    run_once (d);
    drain_and_harvest (sock);
  }
}
 
 
static size_t
expand_nonce (const uint8_t *in,
              size_t in_len,
              uint8_t *out,
              size_t out_cap)
{
  static const char tok[] = "%%NONCE%%";
  const size_t tok_len = sizeof (tok) - 1;
  size_t i = 0;
  size_t o = 0;
 
  while (i < in_len)
  {
    if ( (i + tok_len <= in_len) &&
         (0 == memcmp (in + i, tok, tok_len)) )
    {
      if (o + nonce_len > out_cap)
        break;
      memcpy (out + o, nonce_val, nonce_len);
      o += nonce_len;
      i += tok_len;
      continue;
    }
    if (o >= out_cap)
      break;
    out[o++] = in[i++];
  }
  return o;
}
 
 
static void
send_all (struct MHD_Daemon *d,
          int sock,
          const uint8_t *data,
          size_t len)
{
  size_t off = 0;
  unsigned int stall = 0;
 
  while ( (off < len) &&
          (stall < 64) )
  {
    ssize_t s = send (sock, data + off, len - off, MSG_DONTWAIT);
 
    if (0 < s)
    {
      off += (size_t) s;
      stall = 0;
      continue;
    }
    stall++;
    pump (d, sock, 2);
    if ( (0 > s) &&
         (EAGAIN != errno) &&
         (EWOULDBLOCK != errno) &&
         (EINTR != errno) )
      break;
  }
}
 
 
static int
new_connection (struct MHD_Daemon *d,
                int *sock)
{
  int sv[2];
  struct sockaddr_in sa;
 
  if (0 != socketpair (AF_UNIX, SOCK_STREAM, 0, sv))
    return -1;
  memset (&sa, 0, sizeof (sa));
  sa.sin_family = AF_INET;
  sa.sin_port = htons (44444);
  sa.sin_addr.s_addr = htonl (INADDR_LOOPBACK);
  if (MHD_YES != MHD_add_connection (d,
                                     (MHD_socket) sv[1],
                                     (const struct sockaddr *) &sa,
                                     (socklen_t) sizeof (sa)))
  {
    /* MHD has already closed sv[1] in that case */
    (void) close (sv[0]);
    return -1;
  }
  *sock = sv[0];
  return 0;
}
 
 
static void
close_connection (struct MHD_Daemon *d,
                  int *sock)
{
  if (0 > *sock)
    return;
  (void) shutdown (*sock, SHUT_WR);
  pump (d, *sock, 4);
  (void) close (*sock);
  *sock = -1;
}
 
 
/* ------------------------------------------------------------------ */
/* The fuzz target                                                     */
/* ------------------------------------------------------------------ */
 
int
LLVMFuzzerTestOneInput (const uint8_t *data,
                        size_t size)
{
  struct MHD_Daemon *d;
  struct MHD_OptionItem opts[8];
  unsigned int nopt = 0;
  unsigned int flags;
  int sock = -1;
  size_t pos;
  unsigned int nseg = 0;
  unsigned int nconn = 1;
  static uint8_t xbuf[FUZZ_MAX_INPUT + 4096];
 
  /* Must happen before the first write() into the socketpair.  The
     built-in driver also does this from fuzz_install_handlers(), but
     that is compiled out under -DFUZZ_NO_MAIN, which is exactly the
     build every external fuzzing engine uses; the call is idempotent,
     so doing it from both places is harmless.  See fuzz_ignore_sigpipe()
     in fuzz_common.h for why the process dies without it. */
  fuzz_ignore_sigpipe ();
 
  /* The ten configuration bytes are mandatory.  Anything shorter has
     no segment stream either, so there is nothing to fuzz. */
  if (size < 10)
    return 0;
 
  nonce_len = 0;
  nonce_val[0] = '\0';
  resp_len = 0;
  resp_buf[0] = '\0';
 
  memset (&cfg, 0, sizeof (cfg));
  cfg.mem_limit =
    mem_limit_tbl[data[0] % (sizeof (mem_limit_tbl)
                             / sizeof (mem_limit_tbl[0]))];
  cfg.do_digest = (0 != (data[1] & 0x01));
  cfg.do_basic = (0 != (data[1] & 0x02));
  cfg.do_postproc = (0 != (data[1] & 0x04));
  cfg.do_iterate = (0 != (data[1] & 0x08));
  /* Bits 0x10 and 0x80 of byte 1 are unused.  0x10 used to gate the
     configuration bytes 4-9 back when they were optional; it is left
     free rather than reassigned so that the meaning of the corpus
     files written while it was a gate does not silently change. */
  cfg.chunked_reply = (0 != (data[1] & 0x20));
  cfg.error_reply = (0 != (data[1] & 0x40));
  if (! min_mem_limit_read)
  {
    const char *e = getenv ("MHD_FUZZ_MIN_MEM_LIMIT");
 
    min_mem_limit_read = 1;
    if (NULL != e)
      min_mem_limit = (size_t) strtoul (e, NULL, 10);
  }
  if ( (0 != cfg.mem_limit) &&
       (cfg.mem_limit < min_mem_limit) )
    cfg.mem_limit = min_mem_limit;
  if (! min_discipline_read)
  {
    const char *e = getenv ("MHD_FUZZ_MIN_DISCIPLINE");
 
    min_discipline_read = 1;
    if (NULL != e)
      min_discipline = atoi (e);
  }
  cfg.discipline =
    discipline_tbl[(data[2] & 0x0F) % (sizeof (discipline_tbl)
                                       / sizeof (discipline_tbl[0]))];
  if (cfg.discipline < min_discipline)
    cfg.discipline = min_discipline;
  cfg.insanity = (unsigned int) MHD_DSC_SANE;
  cfg.algo = algo_tbl[data[3] & 0x03];
  cfg.qop = (0 != (data[3] & 0x04))
            ? MHD_DIGEST_AUTH_MULT_QOP_AUTH
            : MHD_DIGEST_AUTH_MULT_QOP_ANY_NON_INT;
  cfg.nonce_nc_size = nnc_tbl[(data[3] >> 4) & 0x03];
 
  cfg.resp_kind = (unsigned int) (data[4] & 0x0F);
  cfg.resp_nhdr = (unsigned int) ((data[4] >> 4) & 0x03);
  cfg.resp_footer = (0 != (data[4] & 0x40));
  cfg.resp_hdr_api = (0 != (data[4] & 0x80));
 
  cfg.dauth_variant = (unsigned int) (data[5] & 0x0F) % DAUTH_VARIANT_COUNT;
  cfg.fail_variant = (unsigned int) ((data[5] >> 4) & 0x03);
  cfg.basic_v1 = (0 != (data[5] & 0x40));
  cfg.calc_helpers = (0 != (data[5] & 0x80));
 
  cfg.loop_mode = (unsigned int) (data[6] & 0x03);
  cfg.use_timeouts = (0 != (data[6] & 0x04));
  cfg.conn_lookup = (0 != (data[6] & 0x08));
  cfg.conn_setvalue = (0 != (data[6] & 0x10));
  cfg.conn_info = (0 != (data[6] & 0x20));
  cfg.conn_option = (0 != (data[6] & 0x40));
  cfg.quiesce = (0 != (data[6] & 0x80));
 
  /* Only modes 0-2 exist; 3 folds onto the immediate-resume mode
     rather than being a fourth, unimplemented behaviour. */
  cfg.suspend_mode = (unsigned int) (data[7] & 0x03);
  if (3 == cfg.suspend_mode)
    cfg.suspend_mode = 1;
  cfg.allow_upgrade =
    (0 != (data[7] & 0x04)) &&
    (MHD_YES == MHD_is_feature_supported (MHD_FEATURE_UPGRADE));
  cfg.upgrade_action = (unsigned int) ((data[7] >> 3) & 0x03);
 
  cfg.hdr_seed = data[8];
  cfg.crc_seed = data[9];
 
  oracle_on = 0;
  expect_body_len = 0;
  /* Must never carry over: the connections these pointed at belonged to
     the previous iteration's daemon and are long gone. */
  memset (pending_resume, 0, sizeof (pending_resume));
  tearing_down = 0;
 
  if (0 != cfg.mem_limit)
  {
    opts[nopt].option = MHD_OPTION_CONNECTION_MEMORY_LIMIT;
    opts[nopt].value = (intptr_t) cfg.mem_limit;
    opts[nopt].ptr_value = NULL;
    nopt++;
  }
  opts[nopt].option = MHD_OPTION_CLIENT_DISCIPLINE_LVL;
  opts[nopt].value = (intptr_t) cfg.discipline;
  opts[nopt].ptr_value = NULL;
  nopt++;
  opts[nopt].option = MHD_OPTION_SERVER_INSANITY;
  opts[nopt].value = (intptr_t) cfg.insanity;
  opts[nopt].ptr_value = NULL;
  nopt++;
  opts[nopt].option = MHD_OPTION_NONCE_NC_SIZE;
  opts[nopt].value = (intptr_t) cfg.nonce_nc_size;
  opts[nopt].ptr_value = NULL;
  nopt++;
  opts[nopt].option = MHD_OPTION_DIGEST_AUTH_RANDOM;
  opts[nopt].value = (intptr_t) sizeof (digest_rnd);
  opts[nopt].ptr_value = (void *) (intptr_t) digest_rnd;
  nopt++;
  opts[nopt].option = MHD_OPTION_END;
  opts[nopt].value = 0;
  opts[nopt].ptr_value = NULL;
 
  flags = MHD_USE_NO_LISTEN_SOCKET;
  if (fuzz_verbose)
    flags |= MHD_USE_ERROR_LOG;
  if (0 != cfg.suspend_mode)
    flags |= MHD_ALLOW_SUSPEND_RESUME;
  if (cfg.allow_upgrade)
    flags |= MHD_ALLOW_UPGRADE;
 
  MHD_set_panic_func (&panic_cb, NULL);
  d = MHD_start_daemon (flags,
                        0,
                        NULL, NULL,
                        &ahc, NULL,
                        MHD_OPTION_ARRAY, opts,
                        /* passed through the varargs rather than through
                           the option array: storing a function pointer in
                           the array's intptr_t member is not strictly
                           conforming C */
                        MHD_OPTION_NOTIFY_COMPLETED, &completed_cb, NULL,
                        MHD_OPTION_END);
  if (NULL == d)
    return 0;
  cur_daemon = d;
  stat_daemons++;
  if (! stats_registered)
  {
    stats_registered = 1;
    (void) atexit (&print_stats);
  }
 
  if (0 != new_connection (d, &sock))
  {
    MHD_stop_daemon (d);
    cur_daemon = NULL;
    return 0;
  }
 
  pos = 10u;
  while ( (pos + 2 <= size) &&
          (nseg < MAX_SEGMENTS) )
  {
    unsigned int hdr = (unsigned int) data[pos]
                       | ((unsigned int) data[pos + 1] << 8);
    unsigned int op = hdr >> 14;
    size_t slen = (size_t) (hdr & 0x3FFF);
    size_t elen;
 
    pos += 2;
    nseg++;
    if (slen > size - pos)
      slen = size - pos;
 
    if (1 == op)
    {
      /* Ground-truth declaration, not wire data. */
      if (fuzz_pristine && (slen <= MAX_EXPECT_BODY))
      {
        memcpy (expect_body, data + pos, slen);
        expect_body_len = slen;
        oracle_on = 1;
      }
      pos += slen;
      continue;
    }
    if ( (3 == op) &&
         (nconn < MAX_CONNECTIONS) )
    {
      close_connection (d, &sock);
      if (0 != new_connection (d, &sock))
        break;
      nconn++;
    }
 
    elen = expand_nonce (data + pos, slen, xbuf, sizeof (xbuf));
    pos += slen;
    if (0 != elen)
      send_all (d, sock, xbuf, elen);
    pump (d, sock, (2 == op) ? 12u : 3u);
    if (0 == slen)
      pump (d, sock, 4);
  }
 
  close_connection (d, &sock);
  pump (d, sock, 4);
  /* A connection left suspended makes MHD_stop_daemon() MHD_PANIC()
     ("called while we have suspended connections"), and
     MHD_resume_connection() alone is not enough: it only raises a flag,
     and the connection is taken off the daemon's suspended list by
     MHD_run().  So flush and run until nothing is parked any more.
     tearing_down stops the handler from parking anything new, which is
     what bounds this loop; the cap is only a backstop. */
  tearing_down = 1;
  {
    unsigned int i;
 
    for (i = 0; i < MAX_CONNECTIONS + 2u; i++)
    {
      if (! pending_resume_flush ())
        break;
      (void) MHD_run (d);
    }
  }
  if (cfg.quiesce)
    (void) MHD_quiesce_daemon (d);
  MHD_stop_daemon (d);
  cur_daemon = NULL;
  return 0;
}
 
 
/* ------------------------------------------------------------------ */
/* Structure-aware HTTP request generator                              */
/* ------------------------------------------------------------------ */
 
struct sbuf
{
  uint8_t *p;
  size_t len;
  size_t cap;
};
 
 
static void
sb_raw (struct sbuf *b,
        const void *v,
        size_t n)
{
  if (b->len + n > b->cap)
    n = b->cap - b->len;
  memcpy (b->p + b->len, v, n);
  b->len += n;
}
 
 
static void
sb_str (struct sbuf *b,
        const char *s)
{
  sb_raw (b, s, strlen (s));
}
 
 
static void
sb_u64 (struct sbuf *b,
        uint64_t v,
        int hex,
        unsigned int min_digits)
{
  char tmp[32];
  unsigned int n = 0;
 
  do
  {
    unsigned int dig = (unsigned int) (v % (hex ? 16u : 10u));
    tmp[n++] = (char) ((dig < 10) ? ('0' + dig) : ('a' + dig - 10));
    v /= (hex ? 16u : 10u);
  }
  while ( (0 != v) && (n < sizeof (tmp)) );
  while ( (n < min_digits) && (n < sizeof (tmp)) )
    tmp[n++] = '0';
  while (0 != n)
  {
    char c = tmp[--n];
    sb_raw (b, &c, 1);
  }
}
 
 
static const char *const gen_methods[] = {
  "GET", "POST", "PUT", "HEAD", "DELETE", "OPTIONS", "TRACE", "PATCH",
  "CONNECT", "BREW", "get", "M-SEARCH", "\tGET", "GET "
};
 
static const char *const gen_versions[] = {
  "HTTP/1.1", "HTTP/1.0", "HTTP/1.1", "HTTP/1.1", "HTTP/0.9", "HTTP/1.2",
  "HTTP/2.0", "http/1.1", "HTTP/1.", "HTTP/11"
};
 
static const char *const gen_targets[] = {
  "/", "/a", "/a/b/c", "/a?x=1", "/a?x=1&y=2", "/?novalue", "/?a=1&b",
  "/?a&b&c", "/%41%42", "/a%00b", "/%zz", "/a?%41=%42", "*",
  "http://example.org/a", "/a?x=1&novalue", "/..%2f..%2fetc",
  "/a?=", "/a?&", "/very/long/path/that/keeps/going/and/going/and/going"
};
 
static const char *const gen_hdr_names[] = {
  "Host", "Accept", "User-Agent", "Connection", "Cookie", "Content-Type",
  "Expect", "TE", "Trailer", "X-Custom", "Referer", "Accept-Encoding",
  "content-length", "transfer-encoding", "X-A-Very-Long-Header-Name-Indeed"
};
 
static const char *const gen_hdr_values[] = {
  "example.org", "*/*", "fuzz/1.0", "keep-alive", "close",
  "a=1; b=2; c", "100-continue", "trailers", "X-Trail", "value",
  "", " ", "\ttabbed", "a, b, c", "chunked", "identity, chunked"
};
 
static const char *const gen_algos[] = {
  "MD5", "SHA-256", "SHA-512-256", "MD5-sess", "SHA-256-sess",
  "SHA-512-256-sess", "sha-256", "SHA256", "BOGUS", "", "\"SHA-256\"",
  "MD5 ", "SHA-1", "xyzzy", "SHA-512", "\"BOGUS\"", "0"
};
 
static const char *const gen_ctypes[] = {
  "application/x-www-form-urlencoded",
  "multipart/form-data; boundary=--abc",
  "multipart/form-data; boundary=\"XY\"",
  "multipart/form-data",
  "text/plain"
};
 
 
static void
gen_query (struct fuzz_rng *rng,
           struct sbuf *b,
           int force_trailing_novalue)
{
  unsigned int n = fuzz_below (rng, 4);
  unsigned int i;
 
  if ( (0 == n) && (! force_trailing_novalue) )
    return;
  sb_str (b, "?");
  for (i = 0; i < n; i++)
  {
    if (0 != i)
      sb_str (b, "&");
    sb_str (b, "k");
    sb_u64 (b, i, 0, 1);
    if (! fuzz_chance (rng, 3))
    {
      sb_str (b, "=");
      sb_str (b, fuzz_chance (rng, 4) ? "%41%42" : "v");
    }
  }
  if (force_trailing_novalue)
  {
    if (0 != n)
      sb_str (b, "&");
    sb_str (b, "novalue");
  }
}
 
 
static void
gen_headers (struct fuzz_rng *rng,
             struct sbuf *b,
             unsigned int n)
{
  unsigned int i;
 
  for (i = 0; i < n; i++)
  {
    sb_str (b, gen_hdr_names[fuzz_below (rng,
                                         (uint32_t) (sizeof (gen_hdr_names)
                                                     / sizeof (char *)))]);
    sb_str (b, fuzz_chance (rng, 8) ? " :" : ":");
    if (! fuzz_chance (rng, 6))
      sb_str (b, " ");
    sb_str (b, gen_hdr_values[fuzz_below (rng,
                                          (uint32_t) (sizeof (gen_hdr_values)
                                                      / sizeof (char *)))]);
    if (fuzz_chance (rng, 12))
      sb_str (b, "\r\n\tfolded-continuation");
    if (fuzz_chance (rng, 20))
      sb_str (b, "\n");     /* bare LF */
    else if (fuzz_chance (rng, 25))
      sb_str (b, "\r");     /* bare CR */
    else
      sb_str (b, "\r\n");
  }
}
 
 
static void
gen_chunked_body (struct fuzz_rng *rng,
                  struct sbuf *b,
                  int oracle)
{
  unsigned int nchunks = 1 + fuzz_below (rng, 4);
  unsigned int i;
 
  if (oracle)
    expect_body_len = 0;
  for (i = 0; i < nchunks; i++)
  {
    unsigned int clen = 1 + fuzz_below (rng, 24);
    unsigned int j;
 
    sb_u64 (b, clen, 1, fuzz_chance (rng, 4) ? 4 : 1);
    /* chunk extension -- the parsing of the terminating CRLF of this
       very line was broken (bug #3) */
    if (! fuzz_chance (rng, 2))
    {
      switch (fuzz_below (rng, 5))
      {
      case 0:
        sb_str (b, ";ext");
        break;
      case 1:
        sb_str (b, ";ext=val");
        break;
      case 2:
        sb_str (b, ";ext=\"quoted value\"");
        break;
      case 3:
        sb_str (b, ";a=1;b=2;c");
        break;
      default:
        sb_str (b, ";x=\"a;b\"");
        break;
      }
    }
    sb_str (b, "\r\n");
    for (j = 0; j < clen; j++)
    {
      char c = (char) ('A' + ((i * 7 + j) % 26));
 
      sb_raw (b, &c, 1);
      if (oracle && (expect_body_len < MAX_EXPECT_BODY))
        expect_body[expect_body_len++] = (uint8_t) c;
    }
    sb_str (b, "\r\n");
  }
  sb_str (b, "0");
  if (fuzz_chance (rng, 4))
    sb_str (b, ";final=\"x\"");
  sb_str (b, "\r\n");
  if (fuzz_chance (rng, 3))
    sb_str (b, "X-Trailer: value\r\n");
  sb_str (b, "\r\n");
}
 
 
static void
gen_digest_header (struct fuzz_rng *rng,
                   struct sbuf *b,
                   const char *uri,
                   int use_nonce_token,
                   int overlong_response,
                   int prefer_valid)
{
  unsigned int nresp;
  unsigned int i;
 
  sb_str (b, "Authorization: Digest ");
  sb_str (b, "username=\"");
  if (fuzz_chance (rng, prefer_valid ? 20 : 6))
  {
    /* userhash notation: a long hex string is accepted here too */
    unsigned int n = 2 * (16 + fuzz_below (rng, 48));
    for (i = 0; i < n; i++)
      sb_str (b, "a");
  }
  else
    sb_str (b, DIGEST_USER);
  sb_str (b, "\", ");
  if (fuzz_chance (rng, prefer_valid ? 25 : 8))
    sb_str (b, "userhash=true, ");
  sb_str (b, "realm=\"");
  sb_str (b, fuzz_chance (rng, prefer_valid ? 25 : 8)
          ? "OtherRealm" : DIGEST_REALM);
  sb_str (b, "\", nonce=\"");
  if (use_nonce_token)
    sb_str (b, "%%NONCE%%");
  else
  {
    unsigned int n = 8 + fuzz_below (rng, 80);
    for (i = 0; i < n; i++)
      sb_str (b, "0");
  }
  sb_str (b, "\", uri=\"");
  sb_str (b, uri);
  sb_str (b, "\", qop=");
  sb_str (b, fuzz_chance (rng, prefer_valid ? 25 : 8) ? "auth-int" : "auth");
  sb_str (b, ", nc=");
  sb_u64 (b, 1 + fuzz_below (rng, 3), 1, 8);
  sb_str (b, ", cnonce=\"deadbeef\", algorithm=");
  if (prefer_valid && (! fuzz_chance (rng, 5)))
    sb_str (b, "SHA-256");   /* must match the algorithm of the challenge */
  else
    sb_str (b, gen_algos[fuzz_below (rng,
                                     (uint32_t) (sizeof (gen_algos)
                                                 / sizeof (char *)))]);
  sb_str (b, ", opaque=\"0123456789abcdef\", response=\"");
  if (overlong_response)
    nresp = 66 + 2 * fuzz_below (rng, 32);      /* 66 .. 128 hex digits */
  else
    nresp = 2 * (1 + fuzz_below (rng, 66));
  for (i = 0; i < nresp; i++)
  {
    char c = "0123456789abcdef"[fuzz_below (rng, 16)];
 
    sb_raw (b, &c, 1);
  }
  sb_str (b, "\"\r\n");
}
 
 
enum gen_shape
{
  SHAPE_PLAIN = 0,
  SHAPE_NOHDR_QARG,
  SHAPE_CL_BODY,
  SHAPE_CHUNKED,
  SHAPE_DIGEST_SIMPLE,
  SHAPE_DIGEST_REPLAY,
  SHAPE_BASIC,
  SHAPE_POST_FORM,
  SHAPE_WEIRD,
  SHAPE_COUNT
};
 
 
static int
gen_one_request (struct fuzz_rng *rng,
                 struct sbuf *b,
                 enum gen_shape shape,
                 int second_of_pair)
{
  switch (shape)
  {
  case SHAPE_NOHDR_QARG:
    /* No header lines at all + a trailing query argument without '=';
       combined with a small connection memory pool this is the shape
       that reaches the read-buffer "shift back" computation. */
    sb_str (b, "GET /");
    gen_query (rng, b, 1);
    sb_str (b, " ");
    sb_str (b, fuzz_chance (rng, 2) ? "HTTP/1.0" : "HTTP/1.1");
    sb_str (b, "\r\n\r\n");
    return 0;
 
  case SHAPE_CL_BODY:
    {
      unsigned int blen = fuzz_below (rng, 64);
      unsigned int i;
 
      sb_str (b, "POST /a HTTP/1.1\r\nHost: x\r\nContent-Length: ");
      sb_u64 (b, blen, 0, 1);
      sb_str (b, "\r\n\r\n");
      expect_body_len = 0;
      for (i = 0; i < blen; i++)
      {
        char c = (char) ('a' + (i % 26));
 
        sb_raw (b, &c, 1);
        if (expect_body_len < MAX_EXPECT_BODY)
          expect_body[expect_body_len++] = (uint8_t) c;
      }
      return 1;
    }
 
  case SHAPE_CHUNKED:
    sb_str (b, "POST /a HTTP/1.1\r\nHost: x\r\n"
            "Transfer-Encoding: chunked\r\n\r\n");
    gen_chunked_body (rng, b, 1);
    return 1;
 
  case SHAPE_DIGEST_SIMPLE:
    sb_str (b, "GET /a HTTP/1.1\r\nHost: x\r\n");
    gen_digest_header (rng, b, "/a", 0, fuzz_chance (rng, 2), 0);
    sb_str (b, "\r\n");
    return 0;
 
  case SHAPE_DIGEST_REPLAY:
    if (! second_of_pair)
      sb_str (b, "GET /a HTTP/1.1\r\nHost: x\r\n\r\n");
    else
    {
      sb_str (b, "GET /a HTTP/1.1\r\nHost: x\r\n");
      gen_digest_header (rng, b, "/a", 1, 1, 1);
      sb_str (b, "\r\n");
    }
    return 0;
 
  case SHAPE_BASIC:
    sb_str (b, "GET /a HTTP/1.1\r\nHost: x\r\nAuthorization: Basic ");
    {
      unsigned int n = fuzz_below (rng, 40);
      unsigned int i;
 
      for (i = 0; i < n; i++)
      {
        char c =
          "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
          [fuzz_below (rng, 65)];
 
        sb_raw (b, &c, 1);
      }
    }
    sb_str (b, "\r\n\r\n");
    return 0;
 
  case SHAPE_POST_FORM:
    {
      const char *ct = gen_ctypes[fuzz_below (rng,
                                              (uint32_t) (sizeof (gen_ctypes)
                                                          / sizeof (char *)))];
 
      sb_str (b, "POST /a HTTP/1.1\r\nHost: x\r\nContent-Type: ");
      sb_str (b, ct);
      sb_str (b, "\r\nTransfer-Encoding: chunked\r\n\r\n");
      gen_chunked_body (rng, b, 0);
      return 0;
    }
 
  case SHAPE_WEIRD:
    sb_str (b, gen_methods[fuzz_below (rng,
                                       (uint32_t) (sizeof (gen_methods)
                                                   / sizeof (char *)))]);
    sb_str (b, " ");
    sb_str (b, gen_targets[fuzz_below (rng,
                                       (uint32_t) (sizeof (gen_targets)
                                                   / sizeof (char *)))]);
    sb_str (b, " ");
    sb_str (b, gen_versions[fuzz_below (rng,
                                        (uint32_t) (sizeof (gen_versions)
                                                    / sizeof (char *)))]);
    sb_str (b, fuzz_chance (rng, 8) ? "\n" : "\r\n");
    gen_headers (rng, b, fuzz_below (rng, 6));
    sb_str (b, "\r\n");
    return 0;
 
  case SHAPE_PLAIN:
  case SHAPE_COUNT:
  default:
    sb_str (b, gen_methods[fuzz_below (rng, 3)]);
    sb_str (b, " /");
    gen_query (rng, b, fuzz_chance (rng, 3));
    sb_str (b, " HTTP/1.1\r\n");
    gen_headers (rng, b, fuzz_below (rng, 4));
    sb_str (b, "\r\n");
    return 0;
  }
}
 
 
static void
emit_segments (struct fuzz_rng *rng,
               struct sbuf *out,
               const uint8_t *body,
               size_t body_len,
               int new_conn_first)
{
  size_t off = 0;
  int first = 1;
 
  while (off < body_len)
  {
    size_t chunk;
    unsigned int op;
    uint8_t hdr[2];
    unsigned int hv;
 
    switch (fuzz_below (rng, 6))
    {
    case 0:
      chunk = 1;
      break;
    case 1:
      chunk = 2 + fuzz_below (rng, 6);
      break;
    case 2:
      chunk = 8 + fuzz_below (rng, 40);
      break;
    default:
      chunk = body_len - off;
      break;
    }
    if (chunk > body_len - off)
      chunk = body_len - off;
    if (chunk > 0x3FFF)
      chunk = 0x3FFF;
    op = (first && new_conn_first) ? 3u : (fuzz_chance (rng, 4) ? 2u : 0u);
    hv = (op << 14) | (unsigned int) chunk;
    hdr[0] = (uint8_t) (hv & 0xFF);
    hdr[1] = (uint8_t) (hv >> 8);
    if (out->len + 2 + chunk > out->cap)
      return;
    sb_raw (out, hdr, 2);
    sb_raw (out, body + off, chunk);
    off += chunk;
    first = 0;
  }
}
 
 
static size_t
fuzz_generate (struct fuzz_rng *rng,
               uint8_t *buf,
               size_t cap)
{
  struct sbuf out;
  uint8_t req[GEN_BUF_SIZE];
  struct sbuf rb;
  enum gen_shape shape;
  uint8_t cfg_bytes[4];
  int oracle;
  unsigned int nreq;
  unsigned int i;
 
  expect_body_len = 0;
 
  out.p = buf;
  out.len = 0;
  out.cap = cap;
 
  if (! forced_shape_read)
  {
    const char *e = getenv ("MHD_FUZZ_SHAPE");
 
    forced_shape_read = 1;
    if (NULL != e)
      forced_shape = atoi (e);
  }
  if (0 <= forced_shape)
    shape = (enum gen_shape) (forced_shape % (int) SHAPE_COUNT);
  else
    shape = (enum gen_shape) fuzz_below (rng, (uint32_t) SHAPE_COUNT);
 
  /* --- configuration bytes --- */
  cfg_bytes[0] = fuzz_byte (rng);
  cfg_bytes[1] = fuzz_byte (rng);
  cfg_bytes[2] = fuzz_byte (rng);
  cfg_bytes[3] = fuzz_byte (rng);
  switch (shape)
  {
  case SHAPE_NOHDR_QARG:
    /* small connection memory pool: indices 1..9 of mem_limit_tbl */
    cfg_bytes[0] = (uint8_t) (1 + fuzz_below (rng, 9));
    break;
  case SHAPE_DIGEST_SIMPLE:
  case SHAPE_DIGEST_REPLAY:
    cfg_bytes[0] = (uint8_t) (fuzz_chance (rng, 2) ? 0 : 12);
    cfg_bytes[1] = (uint8_t) ((cfg_bytes[1] | 0x01u) & ~0x04u);
    /* SHA-256 challenge: 32 byte digest -> 128 hex chars pass the
       'response' length check while hash1_bin[] is only 32 bytes */
    cfg_bytes[3] = (uint8_t) ((cfg_bytes[3] & 0xF0u) | 0x00u);
    break;
  case SHAPE_POST_FORM:
    cfg_bytes[1] |= 0x04u;
    break;
  case SHAPE_CHUNKED:
  case SHAPE_CL_BODY:
    cfg_bytes[1] &= (uint8_t) ~0x04u;   /* keep the body oracle clean */
    break;
  default:
    break;
  }
  cfg_bytes[1] |= 0x08u;                /* always iterate the values */
  sb_raw (&out, cfg_bytes, 4);
 
  nreq = (SHAPE_DIGEST_REPLAY == shape) ? 2u : (1u + (fuzz_chance (rng, 6)
                                                      ? 1u : 0u));
  oracle = 0;
  for (i = 0; i < nreq; i++)
  {
    rb.p = req;
    rb.len = 0;
    rb.cap = sizeof (req);
    oracle = gen_one_request (rng, &rb, shape, (int) i);
    if (oracle && (1 == nreq) && (expect_body_len <= MAX_EXPECT_BODY))
    {
      /* Declare the ground truth for the body oracle (op 1). */
      unsigned int hv = (1u << 14) | (unsigned int) expect_body_len;
      uint8_t hdr[2];
 
      hdr[0] = (uint8_t) (hv & 0xFF);
      hdr[1] = (uint8_t) (hv >> 8);
      sb_raw (&out, hdr, 2);
      sb_raw (&out, expect_body, expect_body_len);
    }
    emit_segments (rng, &out, req, rb.len,
                   (0 != i) || fuzz_chance (rng, 8));
  }
  (void) oracle;
  return out.len;
}
 
 
/* ------------------------------------------------------------------ */
/* Built-in seed corpus                                                */
/* ------------------------------------------------------------------ */
 
struct seed_part
{
  unsigned int op;              
  const char *txt;              
};
 
struct seed_def
{
  const char *name;
  unsigned char cfg[4];
  struct seed_part parts[4];
  /* Configuration bytes 4-9.  Declared after @e parts so that a seed
     which only cares about the wire data can leave the member out of
     its brace initialiser and get the all-zero (plainest) setting. */
  unsigned char ext[6];
};
 
#define P_END { 0, NULL }
 
static const struct seed_def seeds[] = {
  /* There is deliberately no bare "GET / HTTP/1.1" seed: every seed
     below opens with a request at least as simple, so a plain one adds
     no coverage of its own (libFuzzer -merge=1 drops it). */
  { "content-length-body", { 0x00, 0x08, 0x03, 0x00 },
    { { 1, "hello" },
      { 0, "POST /a HTTP/1.1\r\nHost: x\r\nContent-Length: 5\r\n\r\nhello" },
      P_END, P_END } },
 
  /* chunk extensions: the terminating CRLF of the chunk-size line used
     to be left in the stream (bug #3, commit c13f4c64) */
  { "chunked-with-extensions", { 0x00, 0x08, 0x03, 0x00 },
    { { 1, "ABCDE" },
      { 0, "POST /a HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\n"
        "\r\n2;ext=val\r\nAB\r\n3;a=\"b;c\"\r\nCDE\r\n0\r\n\r\n" },
      P_END, P_END } },
 
  { "chunked-split", { 0x00, 0x08, 0x03, 0x00 },
    { { 1, "ABCDEF" },
      { 0, "POST /a HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\n"
        "\r\n3\r\nABC\r\n3;x=\"y\"" },
      { 2, "\r\nDEF\r\n0\r\n\r\n" },
      P_END } },
 
  /* small connection memory pool + trailing query argument without '='
     and no header lines at all (bug #2, commit 29eaa56b) */
  { "small-pool-trailing-query-arg", { 0x06, 0x08, 0x03, 0x00 },
    { { 0, "GET /?novalue HTTP/1.0\r\n\r\n" }, P_END, P_END, P_END } },
 
  { "small-pool-trailing-query-arg-2", { 0x03, 0x08, 0x03, 0x00 },
    { { 0, "GET /?a=1&b HTTP/1.0\r\n\r\n" }, P_END, P_END, P_END } },
 
  /* unrecognised 'algorithm' token -> MHD_DIGEST_AUTH_ALGO3_INVALID
     (bug #1, commit bd49ce93) */
  { "digest-unknown-algorithm", { 0x00, 0x09, 0x03, 0x00 },
    { { 0, "GET /a HTTP/1.1\r\nHost: x\r\nAuthorization: Digest "
        "username=\"user\", realm=\"TestRealm\", nonce=\"0000\", "
        "uri=\"/a\", algorithm=BOGUS, response=\"00\"\r\n\r\n" },
      P_END, P_END, P_END } },
 
  /* full digest handshake: harvest the nonce from the 401 and replay it
     with a 128 hex digit 'response' value (bug #4, commit 5a73c1ae) */
  { "digest-overlong-response", { 0x00, 0x09, 0x03, 0x00 },
    { { 0, "GET /a HTTP/1.1\r\nHost: x\r\n\r\n" },
      { 3, "GET /a HTTP/1.1\r\nHost: x\r\nAuthorization: Digest "
        "username=\"user\", realm=\"TestRealm\", nonce=\"%%NONCE%%\", "
        "uri=\"/a\", qop=auth, nc=00000001, cnonce=\"deadbeef\", "
        "algorithm=SHA-256, response=\""
        "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
        "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
        "\"\r\n\r\n" },
      P_END, P_END } },
 
  { "digest-userhash", { 0x00, 0x09, 0x03, 0x00 },
    { { 0, "GET /a HTTP/1.1\r\nHost: x\r\n\r\n" },
      { 3, "GET /a HTTP/1.1\r\nHost: x\r\nAuthorization: Digest "
        "username=\""
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        "\", userhash=true, realm=\"TestRealm\", nonce=\"%%NONCE%%\", "
        "uri=\"/a\", qop=auth, nc=00000001, cnonce=\"deadbeef\", "
        "algorithm=SHA-256, response=\"0123456789abcdef\"\r\n\r\n" },
      P_END, P_END } },
 
  { "basic-auth", { 0x00, 0x0a, 0x03, 0x00 },
    { { 0, "GET /a HTTP/1.1\r\nHost: x\r\n"
        "Authorization: Basic dXNlcjpwYXNz\r\n\r\n" },
      P_END, P_END, P_END } },
 
  { "multipart-post", { 0x00, 0x0c, 0x03, 0x00 },
    { { 0, "POST /a HTTP/1.1\r\nHost: x\r\n"
        "Content-Type: multipart/form-data; boundary=--abc\r\n"
        "Transfer-Encoding: chunked\r\n\r\n"
        "52\r\n----abc\r\nContent-Disposition: form-data; name=\"k\"\r\n\r\n"
        "value\r\n----abc--\r\n\r\n0\r\n\r\n" },
      P_END, P_END, P_END } },
 
  { "urlencoded-post", { 0x00, 0x0c, 0x03, 0x00 },
    { { 1, "a=1&b=%41&c" },
      { 0, "POST /a HTTP/1.1\r\nHost: x\r\n"
        "Content-Type: application/x-www-form-urlencoded\r\n"
        "Content-Length: 11\r\n\r\na=1&b=%41&c" },
      P_END, P_END } },
 
  { "folded-header", { 0x00, 0x08, 0x00, 0x00 },
    { { 0, "GET /a HTTP/1.1\r\nHost: x\r\nX-Fold: a\r\n\tb\r\n\r\n" },
      P_END, P_END, P_END } },
 
  { "pipelined", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET /a HTTP/1.1\r\nHost: x\r\n\r\n"
        "GET /b?q HTTP/1.1\r\nHost: x\r\n\r\n" },
      P_END, P_END, P_END } },
 
  /* ------------- seeds driving configuration bytes 4-9 -------------
     The seeds above leave those bytes zero and only exercise the
     parser.  Without at least one seed per area below, the rest of the
     API stays practically unreachable: libFuzzer would have to guess
     six configuration bytes before anything new runs.  Each seed turns
     on exactly one area so that a minimiser keeps them distinguishable.
     ext[] is { response, auth, event-loop/introspection, suspend and
     upgrade, header seed, content-reader seed }. */
 
  /* Chunked reply produced by a content-reader callback, with response
     headers and a trailer -- the reply-side counterpart of the chunk
     parsing that commit c13f4c64 fixed on the request side. */
  { "ext-callback-chunked", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x0A | 0x20 | 0x40, 0x00, 0x00, 0x00, 0x01, 0x20 } },
 
  /* Known-length callback body, with a reader error injected part way
     through (crc_seed bit 0x80). */
  { "ext-callback-error", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x09, 0x00, 0x00, 0x00, 0x02, 0x82 } },
 
  { "ext-fd-response", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x0B, 0x00, 0x00, 0x00, 0x00, 0x10 } },
 
  { "ext-fd-at-offset-response", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x0C, 0x00, 0x00, 0x00, 0x00, 0x10 } },
 
  { "ext-pipe-response", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x0E, 0x00, 0x00, 0x00, 0x00, 0x10 } },
 
  { "ext-iovec-response", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x0F, 0x00, 0x00, 0x00, 0x00, 0x07 } },
 
  /* Empty response plus the header manipulation API (get/del/options). */
  { "ext-empty-response-hdrapi", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x02 | 0x30 | 0x40 | 0x80, 0x00, 0x00, 0x00, 0x05, 0x00 } },
 
  /* Digest through the pre-computed-userdigest entry point. */
  { "ext-digest-check-digest3", { 0x00, 0x09, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" },
      { 0, "GET / HTTP/1.1\r\nHost: x\r\nAuthorization: Digest "
        "username=\"user\", realm=\"TestRealm\", nonce=\"%%NONCE%%\", "
        "uri=\"/\", response=\"00000000000000000000000000000000\"\r\n\r\n" },
      P_END, P_END },
    { 0x00, 0x05 | 0x80, 0x00, 0x00, 0x01, 0x00 } },
 
  /* The v1 wrappers and the request-info query. */
  { "ext-digest-v1-wrappers", { 0x00, 0x09, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x00, 0x01 | 0x10, 0x00, 0x00, 0x00, 0x00 } },
 
  { "ext-digest-request-info", { 0x00, 0x09, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x00, 0x08 | 0x20, 0x00, 0x00, 0x03, 0x00 } },
 
  /* Application-driven event loop: MHD_get_fdset2() + select() +
     MHD_run_from_select2(), with the timeout accessors. */
  { "ext-external-event-loop", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x01, 0x00, 0x02 | 0x04, 0x00, 0x00, 0x00 } },
 
  /* The v1 fdset/run_from_select pair. */
  { "ext-external-event-loop-v1", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x01, 0x00, 0x01 | 0x04, 0x00, 0x00, 0x00 } },
 
  /* Every connection-introspection accessor at once. */
  { "ext-connection-api", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET /path?a=1 HTTP/1.1\r\nHost: x\r\nCookie: a=b\r\n\r\n" },
      P_END, P_END, P_END },
    { 0x01, 0x00, 0x08 | 0x10 | 0x20 | 0x40 | 0x80, 0x00, 0x10, 0x00 } },
 
  /* Suspend the connection and resume it from the pump loop. */
  { "ext-suspend-resume", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" },
      { 2, "" }, P_END, P_END },
    { 0x01, 0x00, 0x00, 0x02, 0x00, 0x00 } },
 
  /* Two connections parked at the same time (op 3 opens the second
     without waiting for the first).  The bookkeeping behind suspend
     mode 2 has to be a set for this: while it was a single slot the
     first connection was forgotten and stayed suspended, and
     MHD_stop_daemon() answered with
     MHD_PANIC ("called while we have suspended connections"). */
  { "ext-suspend-two-connections", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET /a HTTP/1.1\r\nHost: x\r\n\r\n" },
      { 3, "GET /b HTTP/1.1\r\nHost: x\r\n\r\n" },
      { 2, "" }, P_END },
    { 0x01, 0x00, 0x00, 0x02, 0x00, 0x00 } },
 
  /* HTTP "Upgrade": the client asks for it and the handler answers 101
     with an upgrade response, after which the socket is handed over. */
  { "ext-upgrade", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\nConnection: Upgrade\r\n"
        "Upgrade: fuzz-protocol\r\n\r\n" },
      { 2, "" }, P_END, P_END },
    { 0x01, 0x00, 0x00, 0x04 | 0x08, 0x00, 0x00 } },
 
  /* The remaining response constructors.  One seed each, because the
     constructor is picked by the low nibble of ext[0] and a seed that
     does not name it leaves that entry point unreachable until the
     fuzzer happens to mutate the nibble. */
  { "ext-buffer-persistent", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x03, 0x00, 0x00, 0x00, 0x00, 0x00 } },
 
  { "ext-buffer-free-callback", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x06, 0x00, 0x00, 0x00, 0x00, 0x00 } },
 
  { "ext-from-data", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x07, 0x00, 0x00, 0x00, 0x00, 0x00 } },
 
  { "ext-fd64-response", { 0x00, 0x08, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00 } },
 
  /* The v1 basic-auth getter, which returns two separate malloc()ed
     strings rather than one struct. */
  { "ext-basic-auth-v1", { 0x00, 0x0a, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n"
        "Authorization: Basic dXNlcjpwYXNz\r\n\r\n" },
      P_END, P_END, P_END },
    { 0x01, 0x40, 0x00, 0x00, 0x00, 0x00 } },
 
  /* Answer the challenge with the basic-auth responses instead of the
     digest ones (fail_variant 3). */
  { "ext-basic-auth-challenge", { 0x00, 0x09, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x01, 0x30, 0x00, 0x00, 0x00, 0x00 } },
 
  { "ext-basic-auth-challenge-utf8", { 0x00, 0x09, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x01, 0x30, 0x00, 0x00, 0x03, 0x00 } },
 
  /* The MD5-only and algorithm-parametrised pre-computed digest
     wrappers. */
  { "ext-digest-check-digest-v1", { 0x00, 0x09, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x01, 0x03, 0x00, 0x00, 0x00, 0x00 } },
 
  { "ext-digest-check-digest2", { 0x00, 0x09, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n\r\n" }, P_END, P_END, P_END },
    { 0x01, 0x04, 0x00, 0x00, 0x01, 0x00 } },
 
  /* The username queries. */
  { "ext-digest-get-username-v1", { 0x00, 0x09, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n"
        "Authorization: Digest username=\"user\", realm=\"TestRealm\"\r\n\r\n" }
      ,
      P_END, P_END, P_END },
    { 0x01, 0x06, 0x00, 0x00, 0x00, 0x00 } },
 
  { "ext-digest-get-username3", { 0x00, 0x09, 0x03, 0x00 },
    { { 0, "GET / HTTP/1.1\r\nHost: x\r\n"
        "Authorization: Digest userhash=true, username=\"aabb\", "
        "realm=\"TestRealm\"\r\n\r\n" },
      P_END, P_END, P_END },
    { 0x01, 0x07, 0x00, 0x00, 0x00, 0x00 } }
};
 
static uint8_t seed_render_buf[4096];
 
 
static size_t
fuzz_seed_count (void)
{
  return sizeof (seeds) / sizeof (seeds[0]);
}
 
 
static const uint8_t *
fuzz_seed_get (size_t idx,
               size_t *len)
{
  const struct seed_def *sd = &seeds[idx];
  struct sbuf b;
  unsigned int i;
 
  b.p = seed_render_buf;
  b.len = 0;
  b.cap = sizeof (seed_render_buf);
  sb_raw (&b, sd->cfg, 4);
  sb_raw (&b, sd->ext, sizeof (sd->ext));
  for (i = 0; i < sizeof (sd->parts) / sizeof (sd->parts[0]); i++)
  {
    size_t n;
    unsigned int hv;
    uint8_t hdr[2];
 
    if (NULL == sd->parts[i].txt)
      break;
    n = strlen (sd->parts[i].txt);
    if (n > 0x3FFF)
      n = 0x3FFF;
    hv = (sd->parts[i].op << 14) | (unsigned int) n;
    hdr[0] = (uint8_t) (hv & 0xFF);
    hdr[1] = (uint8_t) (hv >> 8);
    sb_raw (&b, hdr, 2);
    sb_raw (&b, sd->parts[i].txt, n);
  }
  *len = b.len;
  return seed_render_buf;
}