> +static int invoke_kfuzztest_target(const char *target_name, const char *data, size_t data_size)
> +{
> + ssize_t bytes_written;
> + char buf[256];
I think malloc() is better here.
> + int ret;
> + int fd;
> +
> + ret = snprintf(buf, sizeof(buf), "/sys/kernel/debug/kfuzztest/%s/input", target_name);
> + if (ret < 0)
> + return ret;
Please also check that the file name wasn't truncated (ret >= sizeof(buf)).
> +
> + fd = openat(AT_FDCWD, buf, O_WRONLY, 0);
> + if (fd < 0)
> + return fd;
> +
> + bytes_written = write(fd, (void *)data, data_size);
Not casting data to void * should be just as fine.
> +static int invoke_one(const char *input_fmt, const char *fuzz_target, const char *input_filepath)
> +{
> + struct ast_node *ast_prog;
> + struct byte_buffer *bb;
> + struct rand_stream *rs;
> + struct token **tokens;
> + size_t num_tokens;
> + size_t num_bytes;
> + int err;
> +
> + err = tokenize(input_fmt, &tokens, &num_tokens);
> + if (err) {
> + printf("tokenization failed: %s\n", strerror(-err));
Please use fprintf(stderr) for errors.
> +static int refill(struct rand_stream *rs)
> +{
> + size_t ret = fread(rs->buffer, sizeof(char), rs->buffer_size, rs->source);
> + rs->buffer_pos = 0;
> + if (ret != rs->buffer_size)
> + return -1;
> + return 0;
Note that ret may be less than rs->buffer_size if there's an EOF.
Keeping in mind the possibility to pass files on disk to the tool, you
should probably handle EOF here (e.g. introduce another variable for
the actual data size).
