add broken ass source for now

includes/libusb-1.0.30/tests/fuzz/fuzz_bos_descriptor.c

@@ -0,0 +1,49 @@
+#include <stdint.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <libusb.h>
+
+/* Fuzz the public BOS device-capability parsers.
+   We construct a valid BOS dev-cap header (3 bytes) + variable payload.
+   No hardware needed; ctx=NULL is fine. */
+
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  if (!data) return 0;
+
+  /* bLength is 3 (header) + payload; must fit in one byte. */
+  uint8_t payload_len = (size > 252) ? 252 : (uint8_t)size;  /* 255 - 3 = 252 */
+  size_t total_len = 3u + (size_t)payload_len;
+
+  /* Allocate header + payload for the flexible array member. */
+  struct libusb_bos_dev_capability_descriptor *devcap =
+      (struct libusb_bos_dev_capability_descriptor*)
+      malloc(sizeof(*devcap) + payload_len);
+  if (!devcap) return 0;
+
+  devcap->bLength         = (uint8_t)total_len;
+  devcap->bDescriptorType = LIBUSB_DT_DEVICE_CAPABILITY; /* 0x10 */
+  /* Copy fuzz bytes into the variable-length payload. */
+  if (payload_len) memcpy(devcap->dev_capability_data, data, payload_len);
+
+  /* 1) USB 2.0 Extension dev-cap */
+  devcap->bDevCapabilityType = LIBUSB_BT_USB_2_0_EXTENSION;
+  struct libusb_usb_2_0_extension_descriptor *d20 = NULL;
+  (void)libusb_get_usb_2_0_extension_descriptor(NULL, devcap, &d20);
+  libusb_free_usb_2_0_extension_descriptor(d20);
+
+  /* 2) SuperSpeed USB Device Capability dev-cap */
+  devcap->bDevCapabilityType = LIBUSB_BT_SS_USB_DEVICE_CAPABILITY;
+  struct libusb_ss_usb_device_capability_descriptor *dss = NULL;
+  (void)libusb_get_ss_usb_device_capability_descriptor(NULL, devcap, &dss);
+  libusb_free_ss_usb_device_capability_descriptor(dss);
+
+  /* 3) Container ID dev-cap */
+  devcap->bDevCapabilityType = LIBUSB_BT_CONTAINER_ID;
+  struct libusb_container_id_descriptor *dcid = NULL;
+  (void)libusb_get_container_id_descriptor(NULL, devcap, &dcid);
+  libusb_free_container_id_descriptor(dcid);
+
+  free(devcap);
+  return 0;
+}

includes/libusb-1.0.30/tests/fuzz/fuzz_descriptor_parsers.c

@@ -0,0 +1,83 @@
+/* Fuzz the static descriptor parsers in libusb/descriptor.c.
+ *
+ * The relevant entry points (parse_configuration, parse_interface,
+ * parse_endpoint, parse_iad_array) all have file-local linkage, so we
+ * compile them into this fuzzer's translation unit by including the source
+ * file directly. The libusb_get_*() public APIs that wrap them require a
+ * libusb_device with a backend, which is more setup than a fuzz target
+ * needs. The unity-include keeps the fuzzer focused on parser logic only.
+ *
+ * Three small symbol stubs satisfy references that descriptor.c makes into
+ * other libusb translation units; none of those code paths are reachable
+ * from the parsers we exercise here.
+ *
+ * Built as part of the OSS-Fuzz integration; not exercised by the autotools
+ * test suite.
+ */
+
+#include <stdint.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* ENABLE_LOGGING affects only printf-like macros we don't care about. */
+#define ENABLE_LOGGING 0
+
+#include "config.h"
+#include "libusbi.h"
+#include "../../libusb/descriptor.c"
+
+/* Stubs for symbols that descriptor.c references but the parsers we fuzz
+ * never reach (logging sink, backend dispatch, control-transfer wrapper). */
+const struct usbi_os_backend usbi_backend = {0};
+void usbi_log(struct libusb_context *ctx, enum libusb_log_level level,
+              const char *function, const char *format, ...) {
+    (void)ctx; (void)level; (void)function; (void)format;
+}
+int libusb_control_transfer(libusb_device_handle *dev_handle,
+                            uint8_t bmRequestType, uint8_t bRequest,
+                            uint16_t wValue, uint16_t wIndex,
+                            unsigned char *data, uint16_t wLength,
+                            unsigned int timeout) {
+    (void)dev_handle; (void)bmRequestType; (void)bRequest; (void)wValue;
+    (void)wIndex; (void)data; (void)wLength; (void)timeout;
+    return LIBUSB_ERROR_NOT_SUPPORTED;
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    /* The limit of 8192 is comfortably above practical cases and
+     * still keeping libFuzzer iterations fast and the corpus small */
+    if (size < LIBUSB_DT_CONFIG_SIZE || size > 8192)
+        return 0;
+
+    /* Every call gets a fresh exact-size copy so any byte read past the
+     * end is caught by ASan. The fuzzer must not observe state between
+     * iterations. */
+    uint8_t *buf;
+
+    /* (1) parse_configuration -> parse_interface -> parse_endpoint */
+    buf = malloc(size);
+    if (!buf) return 0;
+    memcpy(buf, data, size);
+    {
+        struct libusb_config_descriptor cfg;
+        memset(&cfg, 0, sizeof(cfg));
+        if (parse_configuration(NULL, &cfg, buf, (int)size) >= 0)
+            clear_configuration(&cfg);
+    }
+    free(buf);
+
+    /* (2) parse_iad_array */
+    buf = malloc(size);
+    if (!buf) return 0;
+    memcpy(buf, data, size);
+    {
+        struct libusb_interface_association_descriptor_array iad;
+        memset(&iad, 0, sizeof(iad));
+        if (parse_iad_array(NULL, &iad, buf, (int)size) == LIBUSB_SUCCESS)
+            free((void *)iad.iad);
+    }
+    free(buf);
+
+    return 0;
+}