From ceedf6ac22781154ac8921babb9b3e830e0fbce7 Mon Sep 17 00:00:00 2001
From: yhirose <yuji.hirose.bug@gmail.com>
Date: Fri, 16 Oct 2026 16:39:00 -0400
Subject: [PATCH] Fuzz the buffered path of the line reader

The server fuzzer's stream exposed no buffered data, so the fast path of
stream_line_reader::getline was never fuzzed. Hand out what a read
pulled in beyond the bytes asked for, as SocketStream does.
---
 test/fuzzing/server_fuzzer.cc | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/test/fuzzing/server_fuzzer.cc b/test/fuzzing/server_fuzzer.cc
index a0f7c0eb..e09ba746 100644
--- a/test/fuzzing/server_fuzzer.cc
+++ b/test/fuzzing/server_fuzzer.cc
@@ -11,9 +11,20 @@ public:
     if (size + read_pos_ > size_) { size = size_ - read_pos_; }
     memcpy(ptr, data_ + read_pos_, size);
     read_pos_ += size;
+    // Like SocketStream, pull in more than was asked for, which the line
+    // reader then takes through buffered_data(), so both of its paths run.
+    buffered_end_ =
+        (std::max)(buffered_end_, (std::min)(size_, read_pos_ + 4096));
     return static_cast<ssize_t>(size);
   }
 
+  const char *buffered_data(size_t &size) const override {
+    size = buffered_end_ > read_pos_ ? buffered_end_ - read_pos_ : 0;
+    return size ? reinterpret_cast<const char *>(data_ + read_pos_) : nullptr;
+  }
+
+  void consume_buffered(size_t size) override { read_pos_ += size; }
+
   ssize_t write(const char *ptr, size_t size) override {
     response_.append(ptr, size);
     return static_cast<int>(size);
@@ -47,6 +58,7 @@ private:
   const uint8_t *data_;
   size_t size_;
   size_t read_pos_;
+  size_t buffered_end_ = 0;
   std::string response_;
 };