From b7e5ced51a2f5cc2cddcdc28afd386096ae3cc68 Mon Sep 17 00:00:00 2001
From: Amir Livneh <alivneh@fb.com>
Date: Mon, 13 Jan 2025 16:08:39 -0500
Subject: [PATCH] fuzz_http3serverreq: Fuzz stream shutdown

---
 fuzz/fuzz_http3serverreq.cc | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/fuzz/fuzz_http3serverreq.cc b/fuzz/fuzz_http3serverreq.cc
index 2f525f3..a3c2172 100644
--- a/fuzz/fuzz_http3serverreq.cc
+++ b/fuzz/fuzz_http3serverreq.cc
@@ -226,6 +226,27 @@ int send_data(nghttp3_conn *conn) {
 }
 }; // namespace
 
+namespace {
+int shutdown_streams(nghttp3_conn *conn,
+                     FuzzedDataProvider &fuzzed_data_provider) {
+  for (; fuzzed_data_provider.ConsumeBool();) {
+    auto stream_id = fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(
+      0, NGHTTP3_MAX_VARINT);
+
+    if (fuzzed_data_provider.ConsumeBool()) {
+      auto rv = nghttp3_conn_shutdown_stream_read(conn, stream_id);
+      if (rv != 0) {
+        return rv;
+      }
+    } else {
+      nghttp3_conn_shutdown_stream_write(conn, stream_id);
+    }
+  }
+
+  return 0;
+}
+}; // namespace
+
 namespace {
 int set_stream_priorities(nghttp3_conn *conn,
                           FuzzedDataProvider &fuzzed_data_provider) {
@@ -343,6 +364,10 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
       }
     }
 
+    if (shutdown_streams(conn, fuzzed_data_provider) != 0) {
+      goto fin;
+    }
+
     if (!shutdown_started && fuzzed_data_provider.ConsumeBool()) {
       shutdown_started = true;