diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml index 023c3ae40..586718834 100644 --- a/fuzz/Cargo.toml +++ b/fuzz/Cargo.toml @@ -50,3 +50,9 @@ name = "alloc" path = "fuzz_targets/alloc.rs" test = false doc = false + +[[bin]] +name = "insn" +path = "fuzz_targets/insn.rs" +test = false +doc = false diff --git a/fuzz/fuzz_targets/insn.rs b/fuzz/fuzz_targets/insn.rs new file mode 100644 index 000000000..3934e8b3f --- /dev/null +++ b/fuzz/fuzz_targets/insn.rs @@ -0,0 +1,18 @@ +#![no_main] + +use libfuzzer_sys::{fuzz_target, Corpus}; +use svsm::cpu::insn::{Instruction, MAX_INSN_SIZE}; + +fuzz_target!(|input: &[u8]| -> Corpus { + let Some(input) = input.get(..MAX_INSN_SIZE) else { + return Corpus::Reject; + }; + + let mut data = [0u8; MAX_INSN_SIZE]; + data.copy_from_slice(input); + + let mut insn = Instruction::new(data); + let _ = core::hint::black_box(insn.decode()); + + Corpus::Keep +});