ChunkFormatTarget

Remarks

The one target here whose whole job is an allocation. A blob is a method byte, a declared uncompressed length, and a body — and the declared length is what gets allocated before anything has established that the body could produce it. That is the amplification the Allocated oracle exists for, stated in five bytes of varint: a blob eight bytes long claiming two hundred megabytes used to cost two hundred megabytes.

The chunk that comes out is read as a header too. A chunk's reference count is another attacker-declared number that sizes a builder, and it is only reachable through a blob that unpacked — so fuzzing the two separately would leave the second unreached.

Fields and properties (2)

• public string Name

  What to call it on a command line and in a report.

• public string What

  Which receive path this is, in one line.

Methods (3)

• public long AllowanceFor(int inputLength)

  How many bytes an input may cause to be allocated.

• public void Seed(ICollection<byte[]> corpus)

  Adds well-formed inputs for the mutator to start from.

• public long Run(ReadOnlySpan<byte> input)

  Pushes one input through the decoder.

Used by (1)

• FuzzTargetsVixen.Fuzz