set -e

export CYCLOPS_HOME=/opt/cyclops-v2

PY=/opt/cyclops-venv/bin/python

T=/opt/cyclops-v2/targets/src/llama.cpp

H=/opt/cyclops-v2/oracle/harnesses

W=/opt/cyclops-v2/oracle/work/llamacpp

mkdir -p "$W/deep" "$W/deep/crashes" "$W/corpus2"

echo "=== [1/4] guard shallow div-by-zero sites for depth ==="

$PY /opt/cyclops-v2/targets/patch_gguf_fuzzdepth.py

echo "=== [2/4] rebuild libggml-base (patched) with ASan ==="

cd "$T"

cmake --build build-asan --target ggml-base -j4 > "$W/deep/rebuild.log" 2>&1

echo "rebuilt: $(find build-asan -name libggml-base.a)"

LIBS=$(find "$T/build-asan" -name "libggml*.a" | tr '\n' ' ')

echo "=== [3/4] build deep harness (no_alloc=false: allocates tensors) ==="

cat > "$H/llamacpp_gguf_deep.cpp" <<'EOF'

// Deep path: no_alloc=false + a ggml_context => parser allocates tensor data,

// exercising tensor-offset/size handling where memory-corruption would live.

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

    if (size > (8u<<20)) return 0;           // cap to keep allocations sane

    FILE *f = fmemopen((void*)data, size, "rb");

    if (!f) return 0;

    struct ggml_context *ctx_data = nullptr;

    struct gguf_init_params p; p.no_alloc = false; p.ctx = &ctx_data;

    struct gguf_context *ctx = gguf_init_from_file_ptr(f, p);

    if (ctx) gguf_free(ctx);

    if (ctx_data) ggml_free(ctx_data);

    fclose(f);

    return 0;

}

EOF

clang++ -g -O1 -fsanitize=fuzzer,address,undefined -fno-omit-frame-pointer \

  "$H/llamacpp_gguf_deep.cpp" -I"$T/ggml/include" $LIBS -lm -lpthread -lgomp \

  -o "$W/fuzz_deep" 2>"$W/deep/compile.log" \

  && echo "DEEP HARNESS COMPILED" || { echo "COMPILE FAILED"; tail -12 "$W/deep/compile.log"; exit 1; }

clang++ -g -O1 -fsanitize=fuzzer,address,undefined -fno-omit-frame-pointer \

  "$H/llamacpp_gguf_harness.cpp" -I"$T/ggml/include" $LIBS -lm -lpthread -lgomp \

  -o "$W/fuzz_meta" 2>>"$W/deep/compile.log" && echo "META HARNESS REBUILT" || true

echo "=== [4/4] launch fork-mode campaign (6h, ignore_crashes, accumulate distinct) ==="

cp "$W/seeds/"* "$W/corpus2/" 2>/dev/null || true

cd "$W/deep"

ASAN_OPTIONS=detect_leaks=0:abort_on_error=1 nohup "$W/fuzz_deep" \

  -fork=2 -ignore_crashes=1 -max_total_time=21600 -rss_limit_mb=4096 -timeout=30 \

  -artifact_prefix="$W/deep/crashes/d-" "$W/corpus2" "$W/seeds" \

  > "$W/deep/fuzz_deep.log" 2>&1 &

echo "DEEP_FUZZ_PID=$!"

sleep 15

echo "=== early deep status ==="; tail -6 "$W/deep/fuzz_deep.log" 2>/dev/null

echo "crashes so far: $(ls $W/deep/crashes/ 2>/dev/null | wc -l)"