/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 *    Copyright 2019 (c) fortiss (Author: Stefan Profanter)
 */

#include "custom_memory_manager.h"

#include <open62541/plugin/log_stdout.h>
#include <open62541/server_config_default.h>
#include <open62541/types.h>

/*
** Main entry point.  The fuzzer invokes this function with each
** fuzzed input.
*/
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    if(size <= 6)
        return 0;

    // set the available memory
    if(!UA_memoryManager_setLimitFromLast4Bytes(data, size))
        return 0;

    data += 4;
    size -= 4;

    // get some random type
    uint16_t typeIndex = (uint16_t)(data[0] | data[1] << 8);
    data += 2;
    size -= 2;

    if(typeIndex >= UA_TYPES_COUNT)
        return UA_FALSE;

    // For DataValue types, consume 2 extra bytes to construct a
    // NumericRange for testing UA_DataValue_copyRange
    uint8_t rangeMin = 0, rangeMax = 0;
    if(typeIndex == UA_TYPES_DATAVALUE && size >= 2) {
        rangeMin = data[0];
        rangeMax = data[1];
        data += 2;
        size -= 2;
    }

    void *dst = UA_new(&UA_TYPES[typeIndex]);
    if(!dst)
        return 0;

    const UA_ByteString binary = {
            size, //length
            (UA_Byte *) (void *) data
    };

    UA_StatusCode ret = UA_decodeBinary(&binary, dst, &UA_TYPES[typeIndex], NULL);
    if(ret != UA_STATUSCODE_GOOD) {
        UA_delete(dst, &UA_TYPES[typeIndex]);
        return 0;
    }

    // copy the datatype to test
    void *dstCopy = UA_new(&UA_TYPES[typeIndex]);
    if(!dstCopy) {
        UA_delete(dst, &UA_TYPES[typeIndex]);
        return 0;
    }
    ret = UA_copy(dst, dstCopy, &UA_TYPES[typeIndex]);
    if(ret != UA_STATUSCODE_GOOD) {
        UA_delete(dst, &UA_TYPES[typeIndex]);
        UA_delete(dstCopy, &UA_TYPES[typeIndex]);
        return 0;
    }
    
    // compare with copy
    UA_assert(UA_order(dst, dstCopy, &UA_TYPES[typeIndex]) == UA_ORDER_EQ);
    UA_delete(dstCopy, &UA_TYPES[typeIndex]);
    
    // now also test encoding
    size_t encSize = UA_calcSizeBinary(dst, &UA_TYPES[typeIndex], NULL);
    UA_ByteString encoded;
    ret = UA_ByteString_allocBuffer(&encoded, encSize);
    if(ret != UA_STATUSCODE_GOOD) {
        UA_delete(dst, &UA_TYPES[typeIndex]);
        return 0;
    }

    ret = UA_encodeBinary(dst, &UA_TYPES[typeIndex], &encoded, NULL);
    UA_assert(ret == UA_STATUSCODE_GOOD);

    UA_ByteString_clear(&encoded);

    // Test UA_DataValue_copyRange with fuzz-derived range parameters.
    // This exercises array sub-range copying where mismatched range
    // dimensions can cause out-of-bounds access.
    if(typeIndex == UA_TYPES_DATAVALUE) {
        UA_NumericRangeDimension dim;
        dim.min = rangeMin;
        dim.max = rangeMax;
        UA_NumericRange range;
        range.dimensionsSize = 1;
        range.dimensions = &dim;

        UA_DataValue dstRange;
        UA_DataValue_init(&dstRange);
        UA_DataValue_copyRange((UA_DataValue*)dst, &dstRange, range);
        UA_DataValue_clear(&dstRange);
    }

    UA_delete(dst, &UA_TYPES[typeIndex]);
    return 0;
}