set -e

export CYCLOPS_HOME=/opt/cyclops-v2

PY=/opt/cyclops-venv/bin/python

T=/opt/cyclops-v2/targets/src/gguf-tools

H=/opt/cyclops-v2/oracle/harnesses

W=/opt/cyclops-v2/oracle/work/gguf

mkdir -p "$H" "$W" "$W/seeds"

echo "=== [1/4] BRAIN: joern memory-corruption dataflow on gguflib.c ==="

$PY /opt/cyclops-v2/brain/brain.py "github.com/antirez/gguf-tools" "ml-model-loaders" "$T" "c" "fdfafbe" || true

echo "=== [2/4] generate a valid seed GGUF (gets the harness past the magic/header) ==="

$PY - <<'PYEOF'

import struct

buf = b"GGUF"

buf += struct.pack("<I", 3)

buf += struct.pack("<Q", 0)

buf += struct.pack("<Q", 1)

buf += struct.pack("<Q", 1) + b"a"

buf += struct.pack("<I", 8)

buf += struct.pack("<Q", 1) + b"b"

open("/opt/cyclops-v2/oracle/work/gguf/seeds/seed1.gguf","wb").write(buf)

print("seed bytes:", len(buf))

PYEOF

echo "=== [3/4] write libFuzzer harness for the full parse path ==="

cat > "$H/gguf_harness.c" <<'EOF'

// Drive the real parse path: gguf_open() mmaps + parses header, then we walk

// every key and tensor (attacker-controlled offsets/lengths/type enums).

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

    char path[] = "/dev/shm/gguffzXXXXXX";

    int fd = mkstemp(path);

    if (fd < 0) return 0;

    if (write(fd, data, size) != (ssize_t)size) { close(fd); unlink(path); return 0; }

    close(fd);

    gguf_ctx *ctx = gguf_open(path);

    if (ctx) {

        gguf_key key;

        while (gguf_get_key(ctx, &key)) {

            // touch the value (exercises type dispatch / value parsing)

            gguf_print_value(ctx, key.type, key.val, 0);

        }

        gguf_tensor tensor;

        while (gguf_get_tensor(ctx, &tensor)) { /* walks tensor info offsets */ }

        gguf_close(ctx);

    }

    unlink(path);

    return 0;

}

EOF

echo "=== [4/4] compile (ASan+UBSan+fuzzer) and launch background fuzz ==="

cd "$W"

clang -g -O1 -fsanitize=fuzzer,address,undefined -fno-omit-frame-pointer \

    "$H/gguf_harness.c" "$T/gguflib.c" "$T/fp16.c" "$T/sds.c" \

    -I"$T" -lm -o "$W/fuzz_gguf" 2>&1 | tail -5

echo "compiled: $(ls -la $W/fuzz_gguf 2>/dev/null | awk '{print $5}') bytes"

mkdir -p "$W/corpus" && cp "$W/seeds/"* "$W/corpus/" 2>/dev/null || true

nohup "$W/fuzz_gguf" -max_total_time=1800 -print_final_stats=1 \

    -artifact_prefix="$W/crash-" "$W/corpus" "$W/seeds" \

    > "$W/fuzz.log" 2>&1 &

echo "FUZZ_PID=$!"

sleep 8

echo "=== early fuzz log ==="; tail -8 "$W/fuzz.log" 2>/dev/null