fuzz_eventloop.c

Go to the documentation of this file.

/*
  This file is part of libmicrohttpd
  Copyright (C) 2026 Christian Grothoff
 
  This library is free software; you can redistribute it and/or
  modify it under the terms of the GNU Lesser General Public
  License as published by the Free Software Foundation; either
  version 2.1 of the License, or (at your option) any later version.
 
  This library is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  Lesser General Public License for more details.
 
  You should have received a copy of the GNU Lesser General Public
  License along with this library.
  If not, see <http://www.gnu.org/licenses/>.
*/
 
#define FUZZ_HARNESS_NAME "fuzz_eventloop"
#include "fuzz_common.h"
 
#include <microhttpd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <sys/select.h>
#include <limits.h>
 
#define MAX_CONNS 8
 
#define MAX_OPS 400
 
#define BIG_BODY_LEN 131072
 
#define DRAIN_BUF 4096
 
 
/* ------------------------------------------------------------------ */
/* Per-iteration configuration                                         */
/* ------------------------------------------------------------------ */
 
struct el_cfg
{
  unsigned int timeout_s;      
  int listen_sock;             
  int app_fd_setsize;          
  size_t mem_limit;            
  int conn_limit;              
  int small_sockbuf;           
  unsigned int resp_kind;      
  int error_reply;             
  int susp_park;               
  int susp_now;                
  int hnd_connopt;             
  int hnd_info;                
  int auto_drain;              
  unsigned int fdset_var;      
  unsigned int run_var;        
  int honour_timeout;          
  int timeout_every_run;       
  int quiesce_end;             
  unsigned int nconn_up_front; 
  int check_always;            
  int allow_real_wait;         
  int stop_with_queued;        
  uint8_t clock_seed;          
};
 
static struct el_cfg cfg;
 
static const size_t mem_limit_tbl[] = { 0, 256, 1024, 4096 };
 
static const unsigned int timeout_tbl[] = { 1, 2, 0, 1 };
 
static const unsigned int setsize_tbl[] = {
  (unsigned int) FD_SETSIZE,
  (unsigned int) FD_SETSIZE,
  (unsigned int) FD_SETSIZE / 2,
  64, 16, 4, 1, (unsigned int) FD_SETSIZE
};
 
 
/* ------------------------------------------------------------------ */
/* Per-iteration state                                                 */
/* ------------------------------------------------------------------ */
 
static int csock[MAX_CONNS];
static unsigned int nconns;
static unsigned int cur_conn;
 
struct live_conn
{
  struct MHD_Connection *mc;   
  int susp;                    
};
 
#define MAX_LIVE (MAX_CONNS + 4)
 
static struct live_conn lives[MAX_LIVE];
 
static struct MHD_Daemon *cur_daemon;
 
static int tearing_down;
 
static MHD_socket quiesced_fd = MHD_INVALID_SOCKET;
 
static uint64_t clk_ms;
static uint64_t deadline_ms;
static int deadline_valid;
 
static fd_set g_rs;
static fd_set g_ws;
static fd_set g_es;
static MHD_socket g_max_fd = MHD_INVALID_SOCKET;
static unsigned int g_setsize = (unsigned int) FD_SETSIZE;
static int g_have_sets;
 
static char big_body[BIG_BODY_LEN];
static int big_body_ready;
 
static int expiry_budget = 2;
static int expiry_budget_read;
 
static unsigned long stat_daemons;
static unsigned long stat_handler_calls;
static unsigned long stat_fdset_v1;
static unsigned long stat_fdset_v2;
static unsigned long stat_rfs_v1;
static unsigned long stat_rfs_v2;
static unsigned long stat_run;
static unsigned long stat_run_wait;
static unsigned long stat_timeouts;
static unsigned long stat_quiesce;
static unsigned long stat_suspend;
static unsigned long stat_resume;
static unsigned long stat_expiry_waits;
static unsigned long stat_queued_at_stop;
static int stats_registered;
 
 
static void
print_stats (void)
{
  if (! fuzz_verbose)
    return;
  fprintf (stderr,
           "%s: daemons=%lu handler=%lu get_fdset=%lu get_fdset2=%lu "
           "run_from_select=%lu run_from_select2=%lu run=%lu run_wait=%lu "
           "timeout queries=%lu quiesce=%lu suspend=%lu resume=%lu "
           "expiry waits=%lu queued at stop=%lu\n",
           FUZZ_HARNESS_NAME,
           stat_daemons, stat_handler_calls, stat_fdset_v1, stat_fdset_v2,
           stat_rfs_v1, stat_rfs_v2, stat_run, stat_run_wait,
           stat_timeouts, stat_quiesce, stat_suspend, stat_resume,
           stat_expiry_waits, stat_queued_at_stop);
}
 
 
/* ------------------------------------------------------------------ */
/* Callbacks                                                           */
/* ------------------------------------------------------------------ */
 
static void
panic_cb (void *cls,
          const char *file,
          unsigned int line,
          const char *reason)
{
  char msg[512];
 
  (void) cls;
  (void) snprintf (msg, sizeof (msg),
                   "MHD_PANIC() reached from an event-loop schedule "
                   "at %s:%u: %s",
                   (NULL != file) ? file : "?",
                   line,
                   (NULL != reason) ? reason : "?");
  fuzz_report_finding (msg);
}
 
 
static int
slot_of (const struct MHD_Connection *c)
{
  unsigned int i;
 
  for (i = 0; i < MAX_LIVE; i++)
    if ( (NULL != lives[i].mc) &&
         (lives[i].mc == c) )
      return (int) i;
  return -1;
}
 
 
static void
notify_conn_cb (void *cls,
                struct MHD_Connection *connection,
                void **socket_context,
                enum MHD_ConnectionNotificationCode toe)
{
  unsigned int i;
  int idx;
 
  (void) cls;
  (void) socket_context;
  if (MHD_CONNECTION_NOTIFY_STARTED == toe)
  {
    for (i = 0; i < MAX_LIVE; i++)
    {
      if (NULL != lives[i].mc)
        continue;
      lives[i].mc = connection;
      lives[i].susp = 0;
      return;
    }
    return;
  }
  /* MHD_CONNECTION_NOTIFY_CLOSED: the object is about to be freed. */
  idx = slot_of (connection);
  if (0 <= idx)
  {
    lives[idx].mc = NULL;
    lives[idx].susp = 0;
  }
}
 
 
/* ------------------------------------------------------------------ */
/* Suspend / resume bookkeeping                                        */
/* ------------------------------------------------------------------ */
 
static int
mhd_thinks_suspended (unsigned int i)
{
  const union MHD_ConnectionInfo *ci;
 
  if (NULL == lives[i].mc)
    return 0;
  ci = MHD_get_connection_info (lives[i].mc,
                                MHD_CONNECTION_INFO_CONNECTION_SUSPENDED);
  if (NULL == ci)
    return 0;
  return (MHD_YES == ci->suspended);
}
 
 
static void
do_suspend (unsigned int i)
{
  int mhd_susp;
 
  if ( (i >= MAX_LIVE) ||
       (NULL == lives[i].mc) )
    return;
  mhd_susp = mhd_thinks_suspended (i);
  if (mhd_susp && lives[i].susp)
    return;                     /* really suspended already */
  MHD_suspend_connection (lives[i].mc);
  lives[i].susp = 1;
  stat_suspend++;
}
 
 
static void
do_resume (unsigned int i)
{
  if ( (i >= MAX_LIVE) ||
       (NULL == lives[i].mc) ||
       (! lives[i].susp) )
    return;
  /* Clear first: MHD_resume_connection() may end up running the handler
     later, which is allowed to suspend the very same connection again. */
  lives[i].susp = 0;
  MHD_resume_connection (lives[i].mc);
  stat_resume++;
}
 
 
static int
resume_all (void)
{
  unsigned int i;
  int any = 0;
 
  for (i = 0; i < MAX_LIVE; i++)
  {
    if ( (NULL == lives[i].mc) ||
         (! lives[i].susp) )
      continue;
    lives[i].susp = 0;
    MHD_resume_connection (lives[i].mc);
    stat_resume++;
    any = 1;
  }
  return any;
}
 
 
static int
scan_live_timeouts (uint64_t *max_ms)
{
  unsigned int i;
  int any = 0;
 
  *max_ms = 0;
  for (i = 0; i < MAX_LIVE; i++)
  {
    const union MHD_ConnectionInfo *ci;
    uint64_t ms;
 
    if (NULL == lives[i].mc)
      continue;
    ci = MHD_get_connection_info (lives[i].mc,
                                  MHD_CONNECTION_INFO_CONNECTION_SUSPENDED);
    if ( (NULL != ci) &&
         (MHD_YES == ci->suspended) )
      continue;                 /* not in any timeout list */
    ci = MHD_get_connection_info (lives[i].mc,
                                  MHD_CONNECTION_INFO_CONNECTION_TIMEOUT);
    if (NULL == ci)
      continue;
    ms = ((uint64_t) ci->connection_timeout) * 1000;
    if (0 == ms)
      continue;                 /* in a list, but exempt from timeouts */
    any = 1;
    if (ms > *max_ms)
      *max_ms = ms;
  }
  return any;
}
 
 
/* ------------------------------------------------------------------ */
/* The access handler                                                  */
/* ------------------------------------------------------------------ */
 
struct crc_state
{
  uint64_t total;
  unsigned int pattern;
};
 
 
static ssize_t
crc_cb (void *cls,
        uint64_t pos,
        char *buf,
        size_t max)
{
  struct crc_state *st = (struct crc_state *) cls;
  size_t n;
  size_t i;
 
  if (pos >= st->total)
    return MHD_CONTENT_READER_END_OF_STREAM;
  n = (size_t) (st->total - pos);
  if (n > max)
    n = max;
  if (0 == n)
    return MHD_CONTENT_READER_END_OF_STREAM;
  for (i = 0; i < n; i++)
    buf[i] = (char) ('a' + (int) ((pos + i + st->pattern) % 26));
  return (ssize_t) n;
}
 
 
static void
crc_free (void *cls)
{
  free (cls);
}
 
 
static struct MHD_Response *
make_response (void)
{
  struct crc_state *st;
  struct MHD_Response *r;
 
  switch (cfg.resp_kind)
  {
  case 1:
    st = (struct crc_state *) calloc (1, sizeof (struct crc_state));
    if (NULL == st)
      return NULL;
    st->total = 700;
    st->pattern = cfg.clock_seed;
    r = MHD_create_response_from_callback (MHD_SIZE_UNKNOWN,
                                           128,
                                           &crc_cb,
                                           st,
                                           &crc_free);
    if (NULL == r)
      free (st);
    return r;
  case 2:
    /* Large enough not to fit into the socket buffers, so that the
       connection stays blocked on write and MHD has to schedule it
       through the write descriptor set over several rounds. */
    return MHD_create_response_from_buffer_static (BIG_BODY_LEN, big_body);
  case 3:
    return MHD_create_response_empty (MHD_RF_NONE);
  default:
    return MHD_create_response_from_buffer_static (2, "ok");
  }
}
 
 
static enum MHD_Result
ahc (void *cls,
     struct MHD_Connection *connection,
     const char *url,
     const char *method,
     const char *version,
     const char *upload_data,
     size_t *upload_data_size,
     void **req_cls)
{
  struct MHD_Response *resp;
  enum MHD_Result ret;
  int idx;
 
  (void) cls;
  (void) url;
  (void) method;
  (void) version;
  (void) upload_data;
  if (NULL == *req_cls)
  {
    *req_cls = (void *) (intptr_t) 1;
    return MHD_YES;
  }
  stat_handler_calls++;
  if (0 != *upload_data_size)
  {
    *upload_data_size = 0;
    return MHD_YES;
  }
 
  idx = slot_of (connection);
  if (cfg.hnd_connopt)
  {
    /* Moves the connection between the "normal" and the "manual" timeout
       list, i.e. changes which connection MHD_get_timeout*() reports. */
    unsigned int nt = (0 == cfg.timeout_s) ? 1u : (cfg.timeout_s + 1u);
 
    (void) MHD_set_connection_option (connection,
                                      MHD_CONNECTION_OPTION_TIMEOUT,
                                      nt);
  }
  if (cfg.hnd_info)
  {
    volatile size_t sink = 0;
    const union MHD_ConnectionInfo *ci;
 
    ci = MHD_get_connection_info (connection,
                                  MHD_CONNECTION_INFO_CONNECTION_FD);
    if (NULL != ci)
      sink += (size_t) (ci->connect_fd + 1);
    ci = MHD_get_connection_info (connection,
                                  MHD_CONNECTION_INFO_CONNECTION_TIMEOUT);
    if (NULL != ci)
      sink += (size_t) ci->connection_timeout;
    (void) sink;
  }
 
  resp = make_response ();
  if (NULL == resp)
    return MHD_NO;
  ret = MHD_queue_response (connection,
                            cfg.error_reply
                            ? MHD_HTTP_INTERNAL_SERVER_ERROR : MHD_HTTP_OK,
                            resp);
  MHD_destroy_response (resp);
  if (MHD_YES != ret)
    return ret;
  /* Only once the response was accepted: returning MHD_NO tells MHD to
     terminate the connection, and terminating one that this very callback
     suspended trips mhd_assert (! connection->suspended) in
     MHD_connection_close_(). */
  if (tearing_down ||
      (0 > idx))
    return ret;
  if (cfg.susp_now)
  {
    MHD_suspend_connection (connection);
    MHD_resume_connection (connection);
    stat_suspend++;
    stat_resume++;
  }
  else if (cfg.susp_park &&
           (! lives[idx].susp))
  {
    MHD_suspend_connection (connection);
    lives[idx].susp = 1;
    stat_suspend++;
  }
  return ret;
}
 
 
/* ------------------------------------------------------------------ */
/* Oracles                                                             */
/* ------------------------------------------------------------------ */
 
static void
check_timeouts (struct MHD_Daemon *d)
{
  MHD_UNSIGNED_LONG_LONG tl = 0;
  uint64_t t64 = 0;
  int64_t t64s;
  int ti;
  enum MHD_Result r1;
  enum MHD_Result r2;
  int have[4];
  uint64_t val[4];
  unsigned int k;
  uint64_t max_ms;
  int any_timed;
  char msg[256];
 
  stat_timeouts++;
  r1 = MHD_get_timeout (d, &tl);
  r2 = MHD_get_timeout64 (d, &t64);
  t64s = MHD_get_timeout64s (d);
  ti = MHD_get_timeout_i (d);
 
  have[0] = (MHD_YES == r1);
  have[1] = (MHD_YES == r2);
  have[2] = (0 <= t64s);
  have[3] = (0 <= ti);
  val[0] = (uint64_t) tl;
  val[1] = t64;
  val[2] = (uint64_t) (t64s < 0 ? 0 : t64s);
  val[3] = (uint64_t) (ti < 0 ? 0 : ti);
 
  for (k = 1; k < 4; k++)
    if (have[k] != have[0])
      fuzz_report_finding (
        "MHD_get_timeout*(): the four accessors disagree about whether "
        "a timeout is in effect");
 
  any_timed = scan_live_timeouts (&max_ms);
  if (! have[0])
  {
    /* An indefinite wait while a live, not-suspended connection has a
       non-zero timeout means that connection can never be reaped: its
       deadline is already unreachable for the application. */
    if (any_timed)
      fuzz_report_finding (
        "MHD_get_timeout*() reported no timeout although the daemon has a "
        "live, not suspended connection with a non-zero timeout");
    deadline_valid = 0;
    return;
  }
 
  for (k = 0; k < 4; k++)
  {
    if (val[k] <= max_ms)
      continue;
    (void) snprintf (msg, sizeof (msg),
                     "MHD_get_timeout*() [accessor %u] returned %llu ms, "
                     "larger than the largest connection timeout in effect "
                     "(%llu ms)",
                     k,
                     (unsigned long long) val[k],
                     (unsigned long long) max_ms);
    fuzz_report_finding (msg);
  }
  for (k = 1; k < 4; k++)
    if ( (val[k] > val[k - 1]) &&
         (val[k] > 100) )
      fuzz_report_finding (
        "MHD_get_timeout*(): a later accessor reported a larger timeout "
        "than an earlier one, although the deadline cannot have moved");
 
  deadline_ms = clk_ms + val[1];
  deadline_valid = 1;
}
 
 
static void
check_fdsets (unsigned int setsize,
              MHD_socket max_fd,
              int had_max,
              int with_es)
{
  int f;
  int hi = -1;
  int max_seen = 0;
 
  for (f = 0; f < (int) FD_SETSIZE; f++)
  {
    int in_set = FD_ISSET (f, &g_rs) || FD_ISSET (f, &g_ws);
 
    if (with_es && FD_ISSET (f, &g_es))
      in_set = 1;
    if (! in_set)
      continue;
    if ((unsigned int) f >= setsize)
      fuzz_report_finding (
        "MHD_get_fdset*() added a descriptor at or above the FD_SETSIZE "
        "limit it was given");
    if (f > hi)
      hi = f;
    if ( (had_max) &&
         (MHD_INVALID_SOCKET != max_fd) &&
         (f == (int) max_fd) )
      max_seen = 1;
  }
  if (! had_max)
    return;
  if (0 > hi)
  {
    if (MHD_INVALID_SOCKET != max_fd)
      fuzz_report_finding (
        "MHD_get_fdset*() set max_fd although it added no descriptor");
    return;
  }
  if (MHD_INVALID_SOCKET == max_fd)
    fuzz_report_finding (
      "MHD_get_fdset*() added descriptors but left max_fd unset");
  if (hi > (int) max_fd)
    fuzz_report_finding (
      "MHD_get_fdset*() added a descriptor larger than the max_fd it "
      "reported");
  if ((unsigned int) max_fd >= setsize)
    fuzz_report_finding (
      "MHD_get_fdset*() reported a max_fd at or above the FD_SETSIZE "
      "limit it was given");
  if (! max_seen)
    fuzz_report_finding (
      "MHD_get_fdset*() reported a max_fd that is not in any of the sets");
}
 
 
/* ------------------------------------------------------------------ */
/* Event-loop primitives                                               */
/* ------------------------------------------------------------------ */
 
static void
op_fdset (struct MHD_Daemon *d,
          unsigned int var)
{
  MHD_socket max_fd = MHD_INVALID_SOCKET;
  unsigned int setsize = (unsigned int) FD_SETSIZE;
  int had_max = 1;
  int with_es = 1;
 
  FD_ZERO (&g_rs);
  FD_ZERO (&g_ws);
  FD_ZERO (&g_es);
  switch (var % 5)
  {
  case 0:
    stat_fdset_v1++;
    (void) (MHD_get_fdset) (d, &g_rs, &g_ws, &g_es, &max_fd);
    break;
  case 1:
    stat_fdset_v2++;
    (void) MHD_get_fdset2 (d, &g_rs, &g_ws, &g_es, &max_fd,
                           (unsigned int) FD_SETSIZE);
    break;
  case 2:
    stat_fdset_v2++;
    setsize = setsize_tbl[(var + cfg.clock_seed)
                          % (sizeof (setsize_tbl)
                             / sizeof (setsize_tbl[0]))];
    (void) MHD_get_fdset2 (d, &g_rs, &g_ws, &g_es, &max_fd, setsize);
    break;
  case 3:
    /* max_fd is documented as optional */
    stat_fdset_v2++;
    had_max = 0;
    (void) MHD_get_fdset2 (d, &g_rs, &g_ws, &g_es, NULL,
                           (unsigned int) FD_SETSIZE);
    break;
  default:
    /* no except set: deprecated, but shipped API */
    stat_fdset_v2++;
    with_es = 0;
    (void) MHD_get_fdset2 (d, &g_rs, &g_ws, NULL, &max_fd,
                           (unsigned int) FD_SETSIZE);
    break;
  }
  check_fdsets (setsize, max_fd, had_max, with_es);
  g_max_fd = max_fd;
  g_setsize = setsize;
  g_have_sets = 1;
  if ( (MHD_INVALID_SOCKET != quiesced_fd) &&
       ((unsigned int) quiesced_fd < (unsigned int) FD_SETSIZE) &&
       FD_ISSET (quiesced_fd, &g_rs) )
    fuzz_report_finding (
      "MHD_get_fdset*() still watches the listening socket after "
      "MHD_quiesce_daemon() handed it back to the application");
}
 
 
static void
op_poll (void)
{
  struct timeval tv;
 
  if ( (! g_have_sets) ||
       (MHD_INVALID_SOCKET == g_max_fd) )
    return;
  tv.tv_sec = 0;
  tv.tv_usec = 0;
  (void) select ((int) g_max_fd + 1, &g_rs, &g_ws, &g_es, &tv);
}
 
 
static void
drain_conn (unsigned int i)
{
  char tmp[DRAIN_BUF];
 
  if ( (i >= MAX_CONNS) ||
       (0 > csock[i]) )
    return;
  for (;;)
  {
    ssize_t n = recv (csock[i], tmp, sizeof (tmp), MSG_DONTWAIT);
 
    if (0 >= n)
      break;
  }
}
 
 
static void
drain_all (void)
{
  unsigned int i;
 
  for (i = 0; i < MAX_CONNS; i++)
    drain_conn (i);
}
 
 
static void
op_run (struct MHD_Daemon *d,
        unsigned int var,
        unsigned int flavour)
{
  fd_set rs;
  fd_set ws;
  fd_set es;
 
  switch (flavour % 4)
  {
  case 1:
    FD_ZERO (&rs);
    FD_ZERO (&ws);
    FD_ZERO (&es);
    break;
  case 2:
    /* Every descriptor number reported ready.  MHD only tests the bits of
       the sockets it owns, so this is an application that lies about
       readiness, not an invalid descriptor. */
    memset (&rs, 0xFF, sizeof (rs));
    memset (&ws, 0xFF, sizeof (ws));
    memset (&es, 0xFF, sizeof (es));
    break;
  case 3:
    rs = g_rs;
    FD_ZERO (&ws);
    FD_ZERO (&es);
    break;
  default:
    rs = g_rs;
    ws = g_ws;
    es = g_es;
    break;
  }
  switch (var % 4)
  {
  case 0:
    stat_rfs_v1++;
    (void) (MHD_run_from_select) (d, &rs, &ws, &es);
    break;
  case 1:
    stat_rfs_v2++;
    (void) MHD_run_from_select2 (d, &rs, &ws, &es,
                                 (g_setsize > (unsigned int) FD_SETSIZE)
                                 ? (unsigned int) FD_SETSIZE : g_setsize);
    break;
  case 2:
    stat_run++;
    (void) MHD_run (d);
    break;
  default:
    stat_run_wait++;
    (void) MHD_run_wait (d, 0);
    break;
  }
  deadline_valid = 0;
  if (cfg.auto_drain)
    drain_all ();
  if (cfg.timeout_every_run)
    check_timeouts (d);
}
 
 
/* ------------------------------------------------------------------ */
/* Connections                                                         */
/* ------------------------------------------------------------------ */
 
static int
new_connection (struct MHD_Daemon *d)
{
  int sv[2];
  struct sockaddr_in sa;
  unsigned int idx;
 
  if (nconns >= MAX_CONNS)
    return -1;
  idx = nconns;
  if (0 != socketpair (AF_UNIX, SOCK_STREAM, 0, sv))
    return -1;
  if (cfg.small_sockbuf)
  {
    int bs = 2048;
 
    (void) setsockopt (sv[0], SOL_SOCKET, SO_RCVBUF, &bs, sizeof (bs));
    (void) setsockopt (sv[1], SOL_SOCKET, SO_SNDBUF, &bs, sizeof (bs));
  }
  memset (&sa, 0, sizeof (sa));
  sa.sin_family = AF_INET;
  sa.sin_port = htons (44444);
  sa.sin_addr.s_addr = htonl (INADDR_LOOPBACK);
  csock[idx] = sv[0];
  if (MHD_YES != MHD_add_connection (d,
                                     (MHD_socket) sv[1],
                                     (const struct sockaddr *) &sa,
                                     (socklen_t) sizeof (sa)))
  {
    /* MHD has already closed sv[1] in that case. */
    (void) close (sv[0]);
    csock[idx] = -1;
    return -1;
  }
  nconns++;
  cur_conn = idx;
  return (int) idx;
}
 
 
static int
queue_unprocessed_conn (struct MHD_Daemon *d)
{
  int sv[2];
  struct sockaddr_in sa;
 
  if (0 != socketpair (AF_UNIX, SOCK_STREAM, 0, sv))
    return -1;
  memset (&sa, 0, sizeof (sa));
  sa.sin_family = AF_INET;
  sa.sin_port = htons (44444);
  sa.sin_addr.s_addr = htonl (INADDR_LOOPBACK);
  if (MHD_YES != MHD_add_connection (d,
                                     (MHD_socket) sv[1],
                                     (const struct sockaddr *) &sa,
                                     (socklen_t) sizeof (sa)))
  {
    /* MHD has closed sv[1] already. */
    (void) close (sv[0]);
    return -1;
  }
  stat_queued_at_stop++;
  return sv[0];
}
 
 
static void
close_conn (unsigned int i,
            int graceful)
{
  if ( (i >= MAX_CONNS) ||
       (0 > csock[i]) )
    return;
  if (graceful)
    (void) shutdown (csock[i], SHUT_WR);
  (void) close (csock[i]);
  csock[i] = -1;
}
 
 
static void
send_bytes (unsigned int i,
            const void *buf,
            size_t len)
{
  const char *p = (const char *) buf;
  size_t off = 0;
  unsigned int tries = 0;
 
  if ( (i >= MAX_CONNS) ||
       (0 > csock[i]) ||
       (0 == len) )
    return;
  while ( (off < len) &&
          (tries < 4) )
  {
    ssize_t s = send (csock[i], p + off, len - off, MSG_DONTWAIT);
 
    if (0 < s)
    {
      off += (size_t) s;
      continue;
    }
    tries++;
    /* The peer's receive buffer is full because MHD has not run yet, or
       MHD is gone.  One round is enough to tell the two apart; the rest
       of the fragment is simply dropped, which is a split point like any
       other. */
    if (NULL != cur_daemon)
      (void) MHD_run (cur_daemon);
    if ( (0 > s) &&
         (EAGAIN != errno) &&
         (EWOULDBLOCK != errno) &&
         (EINTR != errno) )
      break;
  }
}
 
 
static const char *const frag_tbl[16] = {
  "GET / HTTP/1.1\r\nHost: x\r\n\r\n",
  "GET /a HTTP/1.1\r\nHost: x\r\n",
  "\r\n",
  "POST /p HTTP/1.1\r\nHost: x\r\nContent-Length: 10\r\n\r\n",
  "0123456789",
  "POST /c HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\n\r\n",
  "5\r\nabcde\r\n",
  "0\r\n\r\n",
  "GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n",
  "GET / HTTP/1.0\r\n\r\n",
  "HEAD / HTTP/1.1\r\nHost: x\r\n\r\n",
  "GET / HTTP/1.1\r\nHost: x\r\n\r\nGET /2 HTTP/1.1\r\nHost: x\r\n\r\n",
  "G",
  "ET / HTTP/1.1\r\n",
  "Host: x\r\n\r\n",
  "\r\n\r\n"
};
 
 
/* ------------------------------------------------------------------ */
/* The operation program                                               */
/* ------------------------------------------------------------------ */
 
enum op
{
  OP_SEND_FRAG = 0,
  OP_SEND_RAW = 1,
  OP_FDSET = 2,
  OP_RUN = 3,
  OP_TIMEOUT = 4,
  OP_CLOCK = 5,
  OP_SUSPEND = 6,
  OP_RESUME = 7,
  OP_NEWCONN = 8,
  OP_CLOSECONN = 9,
  OP_SWITCH = 10,
  OP_QUIESCE = 11,
  OP_DRAIN = 12,
  OP_CONNOPT = 13,
  OP_INFO = 14,
  OP_POLL = 15
};
 
 
static void
wait_for_expiry (struct MHD_Daemon *d)
{
  struct timeval tv;
 
  if ( (! cfg.allow_real_wait) ||
       (1 != cfg.timeout_s) ||
       (0 >= expiry_budget) )
    return;
  expiry_budget--;
  stat_expiry_waits++;
  tv.tv_sec = 1;
  tv.tv_usec = 50000;
  (void) select (0, NULL, NULL, NULL, &tv);
  clk_ms += 1050;
  /* Everything parked has to come back first, or the expiry cannot be
     observed for it at all. */
  (void) resume_all ();
  (void) MHD_run (d);
  (void) MHD_run (d);
}
 
 
static void
op_quiesce (struct MHD_Daemon *d)
{
  MHD_socket ls;
 
  stat_quiesce++;
  ls = MHD_quiesce_daemon (d);
  if (MHD_INVALID_SOCKET == ls)
    return;
  if (MHD_INVALID_SOCKET != quiesced_fd)
  {
    /* MHD_quiesce_daemon() is documented to hand the socket over once
       and to answer MHD_INVALID_SOCKET afterwards. */
    (void) close (ls);
    fuzz_report_finding (
      "MHD_quiesce_daemon() handed out the listening socket twice");
    return;
  }
  quiesced_fd = ls;
}
 
 
static void
op_info (struct MHD_Daemon *d,
         unsigned int arg)
{
  const union MHD_DaemonInfo *di;
  const union MHD_ConnectionInfo *ci;
  volatile size_t sink = 0;
  unsigned int i = arg % MAX_LIVE;
 
  di = MHD_get_daemon_info (d, MHD_DAEMON_INFO_CURRENT_CONNECTIONS);
  if (NULL != di)
    sink += (size_t) di->num_connections;
  di = MHD_get_daemon_info (d, MHD_DAEMON_INFO_FLAGS);
  if (NULL != di)
    sink += (size_t) di->flags;
  if (NULL != lives[i].mc)
  {
    ci = MHD_get_connection_info (lives[i].mc,
                                  MHD_CONNECTION_INFO_CONNECTION_SUSPENDED);
    if (NULL != ci)
      sink += (size_t) ci->suspended;
    ci = MHD_get_connection_info (lives[i].mc,
                                  MHD_CONNECTION_INFO_DAEMON);
    if (NULL != ci)
      sink += (NULL != ci->daemon) ? 1u : 0u;
  }
  (void) sink;
}
 
 
static void
op_connopt (unsigned int i,
            unsigned int val)
{
  if ( (i >= MAX_LIVE) ||
       (NULL == lives[i].mc) )
    return;
  /* Note that MHD skips the whole update while connection->suspended is
     set, so this is not necessarily the timeout the connection ends up
     with -- which is why the oracle reads it back instead. */
  (void) MHD_set_connection_option (lives[i].mc,
                                    MHD_CONNECTION_OPTION_TIMEOUT,
                                    val);
}
 
 
/* ------------------------------------------------------------------ */
/* The fuzz target                                                     */
/* ------------------------------------------------------------------ */
 
int
LLVMFuzzerTestOneInput (const uint8_t *data,
                        size_t size)
{
  struct MHD_Daemon *d;
  struct MHD_OptionItem opts[8];
  unsigned int nopt = 0;
  unsigned int flags;
  size_t pos;
  unsigned int nops = 0;
  unsigned int i;
  int queued_fd = -1;          
  /* Must happen before the first write() into a socketpair.  The built-in
     driver also does this, but that code is compiled out under
     -DFUZZ_NO_MAIN, which is exactly the build every external fuzzing
     engine uses; the call is idempotent.  See fuzz_ignore_sigpipe() in
     fuzz_common.h for why the process dies without it. */
  fuzz_ignore_sigpipe ();
 
  if (size < 5)
    return 0;
 
  if (! big_body_ready)
  {
    big_body_ready = 1;
    for (i = 0; i < BIG_BODY_LEN; i++)
      big_body[i] = (char) ('a' + (i % 26));
  }
  if (! expiry_budget_read)
  {
    const char *e = getenv ("MHD_FUZZ_EXPIRY_BUDGET");
 
    expiry_budget_read = 1;
    if (NULL != e)
      expiry_budget = atoi (e);
  }
 
  memset (&cfg, 0, sizeof (cfg));
  /* Must never carry over: everything these point at belonged to the
     previous iteration's daemon and is long gone. */
  memset (lives, 0, sizeof (lives));
  for (i = 0; i < MAX_CONNS; i++)
    csock[i] = -1;
  nconns = 0;
  cur_conn = 0;
  tearing_down = 0;
  quiesced_fd = MHD_INVALID_SOCKET;
  clk_ms = 0;
  deadline_ms = 0;
  deadline_valid = 0;
  g_have_sets = 0;
  g_max_fd = MHD_INVALID_SOCKET;
  g_setsize = (unsigned int) FD_SETSIZE;
 
  cfg.timeout_s = timeout_tbl[data[0] & 0x03];
  cfg.listen_sock = (0 != (data[0] & 0x04));
  cfg.app_fd_setsize = (0 != (data[0] & 0x08));
  cfg.mem_limit = mem_limit_tbl[(data[0] >> 4) & 0x03];
  cfg.conn_limit = (0 != (data[0] & 0x40));
  cfg.small_sockbuf = (0 != (data[0] & 0x80));
 
  cfg.resp_kind = (unsigned int) (data[1] & 0x03);
  cfg.error_reply = (0 != (data[1] & 0x04));
  cfg.susp_park = (0 != (data[1] & 0x08));
  cfg.susp_now = (0 != (data[1] & 0x10));
  cfg.hnd_connopt = (0 != (data[1] & 0x20));
  cfg.hnd_info = (0 != (data[1] & 0x40));
  cfg.auto_drain = (0 != (data[1] & 0x80));
 
  cfg.fdset_var = (unsigned int) (data[2] & 0x07);
  cfg.run_var = (unsigned int) ((data[2] >> 3) & 0x03);
  cfg.honour_timeout = (0 != (data[2] & 0x20));
  cfg.timeout_every_run = (0 != (data[2] & 0x40));
  cfg.quiesce_end = (0 != (data[2] & 0x80));
 
  cfg.nconn_up_front = 1u + (unsigned int) (data[3] & 0x03);
  cfg.check_always = (0 != (data[3] & 0x04));
  cfg.allow_real_wait = (0 != (data[3] & 0x08));
  cfg.stop_with_queued = (0 != (data[3] & 0x10));
  cfg.clock_seed = data[4];
 
  if (0 != cfg.mem_limit)
  {
    opts[nopt].option = MHD_OPTION_CONNECTION_MEMORY_LIMIT;
    opts[nopt].value = (intptr_t) cfg.mem_limit;
    opts[nopt].ptr_value = NULL;
    nopt++;
  }
  opts[nopt].option = MHD_OPTION_CONNECTION_TIMEOUT;
  opts[nopt].value = (intptr_t) cfg.timeout_s;
  opts[nopt].ptr_value = NULL;
  nopt++;
  if (cfg.conn_limit)
  {
    opts[nopt].option = MHD_OPTION_CONNECTION_LIMIT;
    opts[nopt].value = (intptr_t) 2;
    opts[nopt].ptr_value = NULL;
    nopt++;
  }
  if (cfg.app_fd_setsize)
  {
    opts[nopt].option = MHD_OPTION_APP_FD_SETSIZE;
    opts[nopt].value = (intptr_t) FD_SETSIZE;
    opts[nopt].ptr_value = NULL;
    nopt++;
  }
  opts[nopt].option = MHD_OPTION_END;
  opts[nopt].value = 0;
  opts[nopt].ptr_value = NULL;
 
  /* MHD_ALLOW_SUSPEND_RESUME is always on: it is what this harness is
     about, and it implies MHD_USE_ITC, whose descriptor is one more thing
     MHD_get_fdset*() has to report correctly. */
  flags = MHD_ALLOW_SUSPEND_RESUME;
  if (! cfg.listen_sock)
    flags |= MHD_USE_NO_LISTEN_SOCKET;
  if (fuzz_verbose)
    flags |= MHD_USE_ERROR_LOG;
 
  MHD_set_panic_func (&panic_cb, NULL);
  d = MHD_start_daemon (flags,
                        0,
                        NULL, NULL,
                        &ahc, NULL,
                        MHD_OPTION_ARRAY, opts,
                        /* through the varargs rather than the option
                           array: storing a function pointer in the
                           array's intptr_t member is not strictly
                           conforming C */
                        MHD_OPTION_NOTIFY_CONNECTION, &notify_conn_cb, NULL,
                        MHD_OPTION_END);
  if ( (NULL == d) &&
       cfg.listen_sock)
  {
    /* No networking available: fall back to the socketpair-only daemon
       rather than losing the whole iteration. */
    cfg.listen_sock = 0;
    flags |= MHD_USE_NO_LISTEN_SOCKET;
    d = MHD_start_daemon (flags,
                          0,
                          NULL, NULL,
                          &ahc, NULL,
                          MHD_OPTION_ARRAY, opts,
                          MHD_OPTION_NOTIFY_CONNECTION, &notify_conn_cb, NULL,
                          MHD_OPTION_END);
  }
  if (NULL == d)
    return 0;
  cur_daemon = d;
  stat_daemons++;
  if (! stats_registered)
  {
    stats_registered = 1;
    (void) atexit (&print_stats);
  }
 
  for (i = 0; i < cfg.nconn_up_front; i++)
    if (0 > new_connection (d))
      break;
 
  pos = 5;
  while ( (pos < size) &&
          (nops < MAX_OPS) )
  {
    const unsigned int b = data[pos++];
    const unsigned int opc = b >> 4;
    const unsigned int arg = b & 0x0F;
 
    nops++;
    switch (opc)
    {
    case OP_SEND_FRAG:
      {
        const char *f = frag_tbl[arg];
 
        send_bytes (cur_conn, f, strlen (f));
        break;
      }
    case OP_SEND_RAW:
      {
        size_t l;
 
        if (pos >= size)
          break;
        l = data[pos++];
        if (l > size - pos)
          l = size - pos;
        send_bytes (cur_conn, data + pos, l);
        pos += l;
        break;
      }
    case OP_FDSET:
      op_fdset (d, (0 != (arg & 0x08)) ? cfg.fdset_var : arg);
      break;
    case OP_RUN:
      op_run (d, arg & 0x03, (arg >> 2) & 0x03);
      break;
    case OP_TIMEOUT:
      check_timeouts (d);
      if ( (cfg.honour_timeout) &&
           (deadline_valid) &&
           (deadline_ms <= clk_ms) )
        op_run (d, cfg.run_var, 0);
      break;
    case OP_CLOCK:
      if (15 == arg)
        wait_for_expiry (d);
      else
      {
        clk_ms += (uint64_t) (1u + arg) * (uint64_t) (1u + cfg.clock_seed % 64u)
        ;
        if ( (cfg.honour_timeout) &&
             (deadline_valid) &&
             (deadline_ms <= clk_ms) )
          op_run (d, cfg.run_var, 0);
      }
      break;
    case OP_SUSPEND:
      do_suspend (arg % MAX_LIVE);
      break;
    case OP_RESUME:
      do_resume (arg % MAX_LIVE);
      break;
    case OP_NEWCONN:
      (void) new_connection (d);
      break;
    case OP_CLOSECONN:
      close_conn ((0 != (arg & 0x08)) ? cur_conn : (arg % MAX_CONNS),
                  (0 != (arg & 0x04)));
      break;
    case OP_SWITCH:
      if ( (arg % MAX_CONNS) < nconns)
        cur_conn = arg % MAX_CONNS;
      break;
    case OP_QUIESCE:
      op_quiesce (d);
      break;
    case OP_DRAIN:
      if (0 != (arg & 0x08))
        drain_all ();
      else
        drain_conn (arg % MAX_CONNS);
      break;
    case OP_CONNOPT:
      op_connopt (arg % MAX_LIVE, (arg >> 3) & 0x01);
      break;
    case OP_INFO:
      op_info (d, arg);
      break;
    default:
      op_poll ();
      break;
    }
    if (cfg.check_always)
      check_timeouts (d);
  }
 
  /* ---- teardown ---- */
  tearing_down = 1;
  queued_fd = -1;
  for (i = 0; i < MAX_CONNS; i++)
    close_conn (i, 1);
  /* A connection left suspended makes MHD_stop_daemon() MHD_PANIC()
     ("called while we have suspended connections"), and
     MHD_resume_connection() alone is not enough: it only raises a flag,
     and the connection leaves the suspended list in MHD_run().  So flush
     and run until nothing is parked any more.  tearing_down keeps the
     handler from parking anything new, which is what bounds this loop;
     the cap is only a backstop. */
  for (i = 0; i < MAX_CONNS + 2u; i++)
  {
    if (! resume_all ())
      break;
    (void) MHD_run (d);
  }
  (void) MHD_run (d);
  if (cfg.quiesce_end)
    op_quiesce (d);
  /* Last, so that no run can drain the list again. */
  if (cfg.stop_with_queued)
    queued_fd = queue_unprocessed_conn (d);
  MHD_stop_daemon (d);
  cur_daemon = NULL;
  if (0 <= queued_fd)
  {
    (void) close (queued_fd);
    queued_fd = -1;
  }
  if (MHD_INVALID_SOCKET != quiesced_fd)
  {
    (void) close (quiesced_fd);
    quiesced_fd = MHD_INVALID_SOCKET;
  }
  for (i = 0; i < MAX_CONNS; i++)
    close_conn (i, 0);
  memset (lives, 0, sizeof (lives));
  return 0;
}
 
 
/* ------------------------------------------------------------------ */
/* Structure-aware schedule generator                                  */
/* ------------------------------------------------------------------ */
 
struct sbuf
{
  uint8_t *p;
  size_t len;
  size_t cap;
};
 
 
static void
sb_byte (struct sbuf *b,
         uint8_t v)
{
  if (b->len < b->cap)
    b->p[b->len++] = v;
}
 
 
static void
sb_op (struct sbuf *b,
       unsigned int opc,
       unsigned int arg)
{
  sb_byte (b, (uint8_t) ((opc << 4) | (arg & 0x0F)));
}
 
 
static const unsigned char gen_frag_bias[] = {
  0, 0, 0, 3, 4, 5, 6, 7, 8, 9, 10, 11, 11, 1, 2, 12, 13, 14, 15
};
 
 
static unsigned int
gen_frag (struct fuzz_rng *rng)
{
  if (fuzz_chance (rng, 4))
    return fuzz_below (rng, 16);
  return gen_frag_bias[fuzz_below (rng,
                                   (uint32_t) sizeof (gen_frag_bias))];
}
 
 
static void
gen_loop_round (struct fuzz_rng *rng,
                struct sbuf *b)
{
  unsigned int v;
  unsigned int fl;
 
  if (! fuzz_chance (rng, 5))
    sb_op (b, OP_FDSET, fuzz_below (rng, 16));
  if (! fuzz_chance (rng, 3))
    sb_op (b, OP_POLL, 0);
  if (fuzz_chance (rng, 3))
    sb_op (b, OP_TIMEOUT, fuzz_below (rng, 16));
  v = fuzz_below (rng, 4);
  /* Half the runs use the descriptor sets MHD actually asked for, so
     that requests make progress; the other half are the adversarial
     ones (all-zero, all-ones, read set only). */
  fl = fuzz_chance (rng, 2) ? 0u : fuzz_below (rng, 4);
  sb_op (b, OP_RUN, v | (fl << 2));
}
 
 
static size_t
fuzz_generate (struct fuzz_rng *rng,
               uint8_t *buf,
               size_t cap)
{
  struct sbuf b;
  unsigned int nrounds;
  unsigned int i;
  unsigned int r;
 
  b.p = buf;
  b.len = 0;
  b.cap = cap;
 
  /* --- configuration block --- */
  sb_byte (&b, fuzz_byte (rng));
  sb_byte (&b, fuzz_byte (rng));
  sb_byte (&b, fuzz_byte (rng));
  sb_byte (&b, fuzz_byte (rng));
  sb_byte (&b, fuzz_byte (rng));
 
  nrounds = 3u + fuzz_below (rng, 40);
  for (i = 0; i < nrounds; i++)
  {
    switch (fuzz_below (rng, 24))
    {
    case 0:
    case 1:
    case 2:
    case 3:
    case 4:
    case 5:
      /* feed the current connection */
      sb_op (&b, OP_SEND_FRAG, gen_frag (rng));
      gen_loop_round (rng, &b);
      break;
    case 6:
      /* raw literal, so that a mutator has somewhere to put bytes */
      {
        unsigned int n = fuzz_below (rng, 24);
        unsigned int k;
 
        sb_op (&b, OP_SEND_RAW, 0);
        sb_byte (&b, (uint8_t) n);
        for (k = 0; k < n; k++)
          sb_byte (&b, fuzz_byte (rng));
        break;
      }
    case 7:
    case 8:
      gen_loop_round (rng, &b);
      break;
    case 9:
      r = fuzz_below (rng, 16);
      sb_op (&b, OP_SUSPEND, r);
      break;
    case 10:
      r = fuzz_below (rng, 16);
      sb_op (&b, OP_RESUME, r);
      break;
    case 11:
      sb_op (&b, OP_NEWCONN, 0);
      sb_op (&b, OP_SEND_FRAG, gen_frag (rng));
      break;
    case 12:
      r = fuzz_below (rng, 16);
      sb_op (&b, OP_CLOSECONN, r);
      break;
    case 13:
      r = fuzz_below (rng, 16);
      sb_op (&b, OP_SWITCH, r);
      break;
    case 14:
      sb_op (&b, OP_QUIESCE, 0);
      break;
    case 15:
      r = fuzz_below (rng, 16);
      sb_op (&b, OP_DRAIN, r);
      break;
    case 16:
      r = fuzz_below (rng, 16);
      sb_op (&b, OP_CONNOPT, r);
      break;
    case 17:
      r = fuzz_below (rng, 16);
      sb_op (&b, OP_INFO, r);
      break;
    case 18:
      r = fuzz_below (rng, 16);
      sb_op (&b, OP_TIMEOUT, r);
      break;
    case 19:
      /* an artificial clock jump, occasionally the real one that lets a
         connection time out */
      r = fuzz_chance (rng, 40) ? 15u : fuzz_below (rng, 15);
      sb_op (&b, OP_CLOCK, r);
      break;
    case 20:
      /* a run without ever asking MHD what it wanted */
      r = fuzz_below (rng, 16);
      sb_op (&b, OP_RUN, r);
      break;
    case 21:
      sb_op (&b, OP_POLL, 0);
      break;
    default:
      sb_op (&b, OP_SEND_FRAG, gen_frag (rng));
      break;
    }
  }
  /* Make sure most schedules end with the daemon actually run, so that
     the interesting states are reached rather than only set up. */
  gen_loop_round (rng, &b);
  return b.len;
}
 
 
/* ------------------------------------------------------------------ */
/* Built-in seed corpus                                                */
/* ------------------------------------------------------------------ */
 
struct seed_def
{
  const char *name;
  unsigned char cfg[5];
  unsigned char ops[24];
  unsigned char nops;
};
 
#define OPB(o,a) (unsigned char) (((o) << 4) | (a))
 
static const struct seed_def seeds[] = {
  /* MHD_get_fdset() (the real v1 entry point) + select() +
     MHD_run_from_select() (also v1) */
  { "fdset-v1-run-from-select-v1", { 0x00, 0x80, 0x00, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 0), OPB (OP_FDSET, 0), OPB (OP_POLL, 0),
      OPB (OP_RUN, 0), OPB (OP_TIMEOUT, 0), OPB (OP_FDSET, 0),
      OPB (OP_POLL, 0), OPB (OP_RUN, 0) }, 8 },
 
  /* MHD_get_fdset2() + MHD_run_from_select2() */
  { "fdset2-run-from-select2", { 0x00, 0x80, 0x09, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 0), OPB (OP_FDSET, 1), OPB (OP_POLL, 0),
      OPB (OP_RUN, 1), OPB (OP_TIMEOUT, 0), OPB (OP_FDSET, 1),
      OPB (OP_POLL, 0), OPB (OP_RUN, 1) }, 8 },
 
  /* a small FD_SETSIZE limit, which MHD has to refuse descriptors for */
  { "fdset2-small-setsize", { 0x00, 0x80, 0x02, 0x00, 0x04 },
    { OPB (OP_SEND_FRAG, 0), OPB (OP_FDSET, 2), OPB (OP_RUN, 1),
      OPB (OP_FDSET, 2), OPB (OP_TIMEOUT, 0), OPB (OP_RUN, 1) }, 6 },
 
  /* max_fd == NULL and except_fd_set == NULL, both documented shapes */
  { "fdset2-null-args", { 0x00, 0x80, 0x00, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 0), OPB (OP_FDSET, 3), OPB (OP_RUN, 1),
      OPB (OP_FDSET, 4), OPB (OP_RUN, 1), OPB (OP_TIMEOUT, 0) }, 6 },
 
  /* MHD_run() and MHD_run_wait() */
  { "run-and-run-wait", { 0x00, 0x80, 0x10, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 0), OPB (OP_RUN, 2), OPB (OP_RUN, 3),
      OPB (OP_TIMEOUT, 0), OPB (OP_RUN, 2) }, 5 },
 
  /* descriptor sets MHD never asked for: all-zero and all-ones */
  { "run-from-select-bogus-sets", { 0x00, 0x80, 0x00, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 0), OPB (OP_RUN, 0x04), OPB (OP_RUN, 0x08),
      OPB (OP_RUN, 0x05), OPB (OP_RUN, 0x09), OPB (OP_TIMEOUT, 0),
      OPB (OP_RUN, 0x0C) }, 7 },
 
  /* stale sets: collect, close the connection, then run with them */
  { "run-from-select-stale-sets", { 0x00, 0x80, 0x00, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 1), OPB (OP_FDSET, 1), OPB (OP_CLOSECONN, 0),
      OPB (OP_RUN, 0), OPB (OP_RUN, 1), OPB (OP_TIMEOUT, 0) }, 6 },
 
  /* suspend from the pump loop, across a full fdset/poll/run round */
  { "suspend-across-loop", { 0x00, 0x80, 0x00, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 1), OPB (OP_RUN, 2), OPB (OP_SUSPEND, 0),
      OPB (OP_FDSET, 1), OPB (OP_TIMEOUT, 0), OPB (OP_POLL, 0),
      OPB (OP_RUN, 1), OPB (OP_RESUME, 0), OPB (OP_RUN, 2) }, 9 },
 
  /* the handler parks the connection; several are parked at once */
  { "handler-parks-two-connections", { 0x00, 0x88, 0x00, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 0), OPB (OP_RUN, 2), OPB (OP_NEWCONN, 0),
      OPB (OP_SEND_FRAG, 0), OPB (OP_RUN, 2), OPB (OP_TIMEOUT, 0),
      OPB (OP_RESUME, 0), OPB (OP_RUN, 2) }, 8 },
 
  /* suspend while a resume is still pending (cancels the resume) */
  { "suspend-cancels-pending-resume", { 0x00, 0x80, 0x00, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 1), OPB (OP_RUN, 2), OPB (OP_SUSPEND, 0),
      OPB (OP_RESUME, 0), OPB (OP_SUSPEND, 0), OPB (OP_TIMEOUT, 0),
      OPB (OP_RESUME, 0), OPB (OP_RUN, 2) }, 8 },
 
  /* quiesce a daemon that really has a listening socket, then check that
     it is gone from the descriptor sets */
  { "quiesce-listening-daemon", { 0x04, 0x80, 0x00, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 0), OPB (OP_FDSET, 1), OPB (OP_RUN, 1),
      OPB (OP_QUIESCE, 0), OPB (OP_FDSET, 1), OPB (OP_TIMEOUT, 0),
      OPB (OP_RUN, 1), OPB (OP_QUIESCE, 0) }, 8 },
 
  /* a large response on a small socket buffer: the connection stays
     blocked on write over many rounds */
  { "blocked-write-scheduling", { 0x80, 0x02, 0x00, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 0), OPB (OP_FDSET, 1), OPB (OP_POLL, 0),
      OPB (OP_RUN, 1), OPB (OP_FDSET, 1), OPB (OP_POLL, 0),
      OPB (OP_RUN, 1), OPB (OP_DRAIN, 8), OPB (OP_FDSET, 1),
      OPB (OP_RUN, 1), OPB (OP_TIMEOUT, 0) }, 11 },
 
  /* a real connection-timeout expiry */
  { "connection-timeout-expiry", { 0x00, 0x80, 0x00, 0x08, 0x00 },
    { OPB (OP_SEND_FRAG, 1), OPB (OP_RUN, 2), OPB (OP_TIMEOUT, 0),
      OPB (OP_CLOCK, 15), OPB (OP_TIMEOUT, 0), OPB (OP_RUN, 2) }, 6 },
 
  /* per-connection timeouts, which move the connection to the "manual"
     timeout list that MHD_get_timeout*() has to scan separately */
  { "manual-timeout-list", { 0x00, 0x80, 0x00, 0x03, 0x00 },
    { OPB (OP_SEND_FRAG, 1), OPB (OP_CONNOPT, 8), OPB (OP_TIMEOUT, 0),
      OPB (OP_CONNOPT, 1), OPB (OP_TIMEOUT, 0), OPB (OP_RUN, 2),
      OPB (OP_TIMEOUT, 0) }, 7 },
 
  /* pipelined requests plus a chunked upload, driven one run at a time */
  { "pipelined-and-chunked", { 0x00, 0x81, 0x00, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 11), OPB (OP_RUN, 2), OPB (OP_SEND_FRAG, 5),
      OPB (OP_RUN, 2), OPB (OP_SEND_FRAG, 6), OPB (OP_RUN, 2),
      OPB (OP_SEND_FRAG, 7), OPB (OP_RUN, 2), OPB (OP_TIMEOUT, 0) }, 9 },
 
  /* never poll, never ask for descriptors, only run from empty sets */
  { "never-poll", { 0x00, 0x80, 0x00, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 0), OPB (OP_RUN, 0x04), OPB (OP_RUN, 0x04),
      OPB (OP_RUN, 0x04), OPB (OP_RUN, 0x04), OPB (OP_TIMEOUT, 0) }, 6 },
 
  /* abrupt close in the middle of a request, with the descriptor sets
     collected before it */
  { "abrupt-close-mid-request", { 0x00, 0x80, 0x00, 0x00, 0x00 },
    { OPB (OP_SEND_FRAG, 3), OPB (OP_FDSET, 1), OPB (OP_CLOSECONN, 0),
      OPB (OP_RUN, 1), OPB (OP_TIMEOUT, 0), OPB (OP_RUN, 2) }, 6 },
 
  /* connection limit of two, so that MHD_add_connection() starts to fail */
  { "connection-limit", { 0x40, 0x80, 0x00, 0x03, 0x00 },
    { OPB (OP_NEWCONN, 0), OPB (OP_NEWCONN, 0), OPB (OP_SEND_FRAG, 0),
      OPB (OP_RUN, 2), OPB (OP_TIMEOUT, 0) }, 5 },
 
  /* no connection timeout at all: MHD_get_timeout*() must report that an
     indefinite wait is fine */
  { "no-timeout-configured", { 0x02, 0x80, 0x00, 0x04, 0x00 },
    { OPB (OP_SEND_FRAG, 1), OPB (OP_TIMEOUT, 0), OPB (OP_RUN, 2),
      OPB (OP_TIMEOUT, 0), OPB (OP_SEND_FRAG, 2), OPB (OP_RUN, 2) }, 6 },
 
  /* byte 3 bit 4: after the program has run and everything has been torn
     down, hand MHD one more connection and stop it without another run,
     so that it has to dispose of a connection it never started.  That is
     new_connection_close_() in daemon.c, which nothing else reaches. */
  { "stop-with-queued-connection", { 0x00, 0x80, 0x00, 0x10, 0x00 },
    { OPB (OP_SEND_FRAG, 0), OPB (OP_RUN, 2), OPB (OP_TIMEOUT, 0) }, 3 },
 
  /* the same after MHD_quiesce_daemon() on a daemon that really has a
     listening socket, which is the other order the two can happen in */
  { "stop-with-queued-after-quiesce", { 0x04, 0x80, 0x80, 0x10, 0x00 },
    { OPB (OP_SEND_FRAG, 0), OPB (OP_RUN, 2) }, 2 }
};
 
static uint8_t seed_render_buf[64];
 
 
static size_t
fuzz_seed_count (void)
{
  return sizeof (seeds) / sizeof (seeds[0]);
}
 
 
static const uint8_t *
fuzz_seed_get (size_t idx,
               size_t *len)
{
  const struct seed_def *sd = &seeds[idx];
  size_t n = sd->nops;
 
  if (n > sizeof (sd->ops))
    n = sizeof (sd->ops);
  if (n + sizeof (sd->cfg) > sizeof (seed_render_buf))
    n = sizeof (seed_render_buf) - sizeof (sd->cfg);
  memcpy (seed_render_buf, sd->cfg, sizeof (sd->cfg));
  memcpy (seed_render_buf + sizeof (sd->cfg), sd->ops, n);
  *len = sizeof (sd->cfg) + n;
  return seed_render_buf;
}