From df0b7d243b06860d8966688cda61dfbeeb55b755 Mon Sep 17 00:00:00 2001
From: Arthur Chan <arthur.chan@adalogics.com>
Date: Sun, 14 Jun 2026 03:39:45 +0100
Subject: [PATCH] OSS-Fuzz: Add new fuzzer targets multipart parsing (#2473)

* OSS-Fuzz: Add new fuzzer targets multipart parsing

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>

* Fix formatting

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>

---------

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
---
 test/fuzzing/Makefile                   |  5 +++-
 test/fuzzing/multipart_parser_fuzzer.cc | 37 +++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 test/fuzzing/multipart_parser_fuzzer.cc

diff --git a/test/fuzzing/Makefile b/test/fuzzing/Makefile
index da5d696..e0874d9 100644
--- a/test/fuzzing/Makefile
+++ b/test/fuzzing/Makefile
@@ -13,7 +13,7 @@ ZLIB_SUPPORT = -DCPPHTTPLIB_ZLIB_SUPPORT -lz
 BROTLI_DIR = /usr/local/opt/brotli
 # BROTLI_SUPPORT = -DCPPHTTPLIB_BROTLI_SUPPORT -I$(BROTLI_DIR)/include -L$(BROTLI_DIR)/lib -lbrotlicommon -lbrotlienc -lbrotlidec
 
-FUZZERS = server_fuzzer url_parser_fuzzer header_parser_fuzzer client_fuzzer
+FUZZERS = server_fuzzer url_parser_fuzzer header_parser_fuzzer client_fuzzer multipart_parser_fuzzer
 
 # Runs all the tests and also fuzz tests against seed corpus.
 all : $(FUZZERS)
@@ -35,5 +35,8 @@ header_parser_fuzzer : header_parser_fuzzer.cc ../../httplib.h
 url_parser_fuzzer : url_parser_fuzzer.cc ../../httplib.h
 	$(CXX) $(CXXFLAGS) -o $@  $<  $(ZLIB_SUPPORT)  $(LIB_FUZZING_ENGINE) -pthread -lanl
 
+multipart_parser_fuzzer : multipart_parser_fuzzer.cc ../../httplib.h
+	$(CXX) $(CXXFLAGS) -o $@  $<  $(ZLIB_SUPPORT)  $(LIB_FUZZING_ENGINE) -pthread -lanl
+
 clean:
 	rm -f server_fuzzer pem *.0 *.o *.1 *.srl *.zip
diff --git a/test/fuzzing/multipart_parser_fuzzer.cc b/test/fuzzing/multipart_parser_fuzzer.cc
new file mode 100644
index 0000000..e747f11
--- /dev/null
+++ b/test/fuzzing/multipart_parser_fuzzer.cc
@@ -0,0 +1,37 @@
+#include <cstdint>
+#include <string>
+
+#include <httplib.h>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  if (size < 2 || size > 65536) return 0;
+
+  // First byte selects the boundary length, the rest is the boundary then body
+  size_t boundary_len = (static_cast<size_t>(data[0]) % 16) + 1;
+  if (boundary_len + 1 >= size) boundary_len = 0;
+
+  std::string boundary =
+      boundary_len > 0
+          ? std::string(reinterpret_cast<const char *>(data + 1), boundary_len)
+          : "----fuzzboundary";
+
+  const uint8_t *body = data + 1 + boundary_len;
+  size_t body_size = size - 1 - boundary_len;
+
+  // FormDataParser::parse, fed in chunks to exercise the streaming paths
+  httplib::detail::FormDataParser parser;
+  parser.set_boundary(std::move(boundary));
+
+  auto header_cb = [](const httplib::FormData &) -> bool { return true; };
+  auto content_cb = [](const char *, size_t) -> bool { return true; };
+
+  size_t chunk = (static_cast<size_t>(data[1]) % 64) + 1;
+  for (size_t off = 0; off < body_size; off += chunk) {
+    size_t n = (off + chunk > body_size) ? body_size - off : chunk;
+    if (!parser.parse(reinterpret_cast<const char *>(body + off), n, header_cb,
+                      content_cb))
+      break;
+  }
+
+  return 0;
+}