set -e

export CYCLOPS_HOME=/opt/cyclops-v2

PY=/opt/cyclops-venv/bin/python

T=/opt/cyclops-v2/targets/src/llama.cpp

H=/opt/cyclops-v2/oracle/harnesses

W=/opt/cyclops-v2/oracle/work/llamacpp

mkdir -p "$H" "$W" "$W/seeds" "$W/corpus"

echo "=== [1/5] BRAIN: joern dataflow on ggml/src/gguf.cpp ==="

( $PY /opt/cyclops-v2/brain/brain.py "github.com/ggml-org/llama.cpp" "ml-model-loaders" \

    "$T/ggml/src/gguf.cpp" "c" "fdc3db9" > "$W/brain.log" 2>&1 || true ) &

BRAIN_PID=$!

echo "=== [2/5] build libggml WITH AddressSanitizer (cmake) ==="

cd "$T"

cmake -B build-asan -DCMAKE_BUILD_TYPE=Debug -DBUILD_SHARED_LIBS=OFF \

  -DGGML_NATIVE=OFF -DGGML_BACKEND_DL=OFF -DLLAMA_BUILD_TESTS=OFF \

  -DLLAMA_BUILD_EXAMPLES=OFF -DLLAMA_BUILD_TOOLS=OFF -DLLAMA_BUILD_SERVER=OFF \

  -DCMAKE_C_FLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g" \

  -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g" \

  > "$W/cmake.log" 2>&1

cmake --build build-asan --target ggml-base -j4 >> "$W/cmake.log" 2>&1 || \

  cmake --build build-asan --target ggml -j4 >> "$W/cmake.log" 2>&1

echo "built libs:"; find build-asan -name "libggml*.a" 2>/dev/null

echo "=== [3/5] generate a real valid GGUF seed ==="

$PY -m pip install --quiet gguf >/dev/null 2>&1 || true

$PY - <<'PYEOF'

try:

    import gguf, numpy as np

    w = gguf.GGUFWriter("/opt/cyclops-v2/oracle/work/llamacpp/seeds/seed.gguf", "fuzz")

    w.add_uint32("answer", 42); w.add_string("name", "x"); w.add_array("arr", [1,2,3])

    w.add_tensor("t0", np.zeros((4,4), dtype=np.float32))

    w.write_header_to_file(); w.write_kv_data_to_file(); w.write_tensors_to_file(); w.close()

    print("seed.gguf written")

except Exception as e:

    import struct

    b=b"GGUF"+struct.pack("<I",3)+struct.pack("<Q",0)+struct.pack("<Q",1)

    b+=struct.pack("<Q",1)+b"a"+struct.pack("<I",4)+struct.pack("<I",7)

    open("/opt/cyclops-v2/oracle/work/llamacpp/seeds/seed.gguf","wb").write(b)

    print("fallback seed written:", e)

PYEOF

cp "$W/seeds/"* "$W/corpus/" 2>/dev/null || true

echo "=== [4/5] write + compile libFuzzer harness (in-memory via fmemopen) ==="

cat > "$H/llamacpp_gguf_harness.cpp" <<'EOF'

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

    FILE *f = fmemopen((void*)data, size, "rb");

    if (!f) return 0;

    struct gguf_init_params p; p.no_alloc = true; p.ctx = nullptr;

    struct gguf_context *ctx = gguf_init_from_file_ptr(f, p);

    if (ctx) gguf_free(ctx);

    fclose(f);

    return 0;

}

EOF

LIBS=$(find "$T/build-asan" -name "libggml*.a" 2>/dev/null | tr '\n' ' ')

echo "linking: $LIBS"

clang++ -g -O1 -fsanitize=fuzzer,address,undefined -fno-omit-frame-pointer \

  "$H/llamacpp_gguf_harness.cpp" -I"$T/ggml/include" \

  $LIBS -lm -lpthread -fopenmp -lgomp -o "$W/fuzz_llgguf" 2>"$W/compile.log" \

  && echo "HARNESS COMPILED: $(ls -la $W/fuzz_llgguf | awk '{print $5}') bytes" \

  || { echo "COMPILE FAILED:"; tail -15 "$W/compile.log"; exit 1; }

echo "=== [5/5] launch background fuzz campaign (2h) ==="

wait $BRAIN_PID 2>/dev/null || true

echo "brain:"; grep -E "HYPOTHESES|paths" "$W/brain.log" 2>/dev/null | tail -3

nohup "$W/fuzz_llgguf" -max_total_time=7200 -rss_limit_mb=4096 -timeout=25 \

  -print_final_stats=1 -artifact_prefix="$W/crash-" "$W/corpus" "$W/seeds" \

  > "$W/fuzz.log" 2>&1 &

echo "FUZZ_PID=$!"

sleep 12

echo "=== early fuzz status ==="; tail -6 "$W/fuzz.log" 2>/dev/null