Add fuzz target for message buffer

fuzz/.gitignore

@@ -0,0 +1,4 @@
+target
+corpus
+artifacts
+coverage

fuzz/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+name = "usbd-ctaphid-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+ctaphid-dispatch = "0.1.0"
+libfuzzer-sys = { version = "0.4", features = ["arbitrary-derive"] }
+
+[dependencies.usbd-ctaphid]
+path = ".."
+
+[[bin]]
+name = "buffer"
+path = "fuzz_targets/buffer.rs"
+test = false
+doc = false
+bench = false
+
+[patch.crates-io]
+ctaphid-dispatch = { git = "https://github.com/trussed-dev/ctaphid-dispatch.git", rev = "57cb3317878a8593847595319aa03ef17c29ec5b" }
+trussed = { git = "https://github.com/trussed-dev/trussed.git", rev = "51e68500d7601d04f884f5e95567d14b9018a6cb" }

fuzz/fuzz_targets/buffer.rs

@@ -0,0 +1,75 @@
+#![no_main]
+
+use ctaphid_dispatch::types::{Channel, Error, InterchangeResponse, Message, Responder};
+use libfuzzer_sys::{arbitrary::{self, Arbitrary}, fuzz_target};
+use usbd_ctaphid::buffer::{Buffer, BufferState};
+
+#[derive(Debug, Arbitrary)]
+enum Action {
+    HandlePacket {
+        data: [u8; 64],
+        success: bool,
+    },
+    HandleResponse(bool),
+    TrySendPacket(bool),
+    CheckTimeout {
+        milliseconds: u32,
+        success: bool,
+    },
+    DidStartProcessing,
+    SendKeepalive(bool),
+    GenerateResponse(Vec<u8>),
+}
+
+impl Action {
+    fn run(self, buffer: &mut Buffer<'_, '_>, rp: &mut Responder<'_>) {
+        match self {
+            Self::HandlePacket { data, success } => {
+                let state = buffer.handle_packet(&data);
+                self.handle_state(buffer, state, success);
+            }
+            Self::HandleResponse(success) => {
+                let state = buffer.handle_response();
+                self.handle_state(buffer, state, success);
+            }
+            Self::TrySendPacket(success) => {
+                self.try_send_packet(buffer, success);
+            }
+            Self::CheckTimeout { milliseconds, success } => {
+                let state = buffer.check_timeout(milliseconds);
+                self.handle_state(buffer, state, success);
+            }
+            Self::DidStartProcessing => {
+                buffer.did_start_processing();
+            }
+            Self::SendKeepalive(waiting) => {
+                let _ = buffer.send_keepalive(waiting);
+            }
+            Self::GenerateResponse(response) => {
+                if let Ok(_request) = rp.request() {
+                    let response = Message::from_slice(&response).map_err(|_| Error::InvalidLength);
+                    rp.respond(InterchangeResponse(response)).ok();
+                }
+            }
+        }
+    }
+
+    fn handle_state(&self, buffer: &mut Buffer, state: BufferState, success: bool) {
+        if state == BufferState::ResponseQueued {
+            self.try_send_packet(buffer, success);
+        }
+    }
+
+    fn try_send_packet(&self, buffer: &mut Buffer, success: bool) {
+        buffer.try_send_packet(|_| if success { Ok(()) } else { Err(()) });
+    }
+}
+
+fuzz_target!(|actions: Vec<Action>| {
+    let channel = Channel::new();
+    let (rq, mut rp) = channel.split().unwrap();
+    let mut buffer = Buffer::new(rq, 0, None);
+    for action in actions {
+        action.run(&mut buffer, &mut rp);
+    }
+});