From 1f5d33b1e7ac9e6f636973c71441f27e5470645e Mon Sep 17 00:00:00 2001
From: "Roger A. Light" <roger@atchoo.org>
Date: Fri, 24 Apr 2026 13:46:30 +0100
Subject: [PATCH] Experimental fuzz memory checking

---
 fuzzing/libcommon/libcommon_fuzz_property.cpp   |  6 ++++++
 fuzzing/libcommon/libcommon_fuzz_property.proto |  1 +
 libcommon/memory_common.c                       | 15 +++++++++++++++
 3 files changed, 22 insertions(+)

diff --git a/fuzzing/libcommon/libcommon_fuzz_property.cpp b/fuzzing/libcommon/libcommon_fuzz_property.cpp
index 0b381579e..df1b3ee1b 100644
--- a/fuzzing/libcommon/libcommon_fuzz_property.cpp
+++ b/fuzzing/libcommon/libcommon_fuzz_property.cpp
@@ -3,11 +3,17 @@
 #include "libcommon_fuzz_property.pb.h"
 #include "mosquitto.h"
 
+extern int32_t fuzz_memory_check_limit;
+extern int32_t fuzz_memory_check_count;
+
 DEFINE_PROTO_FUZZER(const fuzz_property::FuzzerInput& fuzzer_input)
 {
 	mosquitto_property *prop_list = nullptr;
 	mosquitto_property *prop_copy = nullptr;
 
+	fuzz_memory_check_count = 0;
+	fuzz_memory_check_limit = fuzzer_input.memory_check_limit();
+
 	for(const fuzz_property::Property& property : fuzzer_input.properties()){
 		int identifier = property.identifier();
 		switch(property.data_case()){
diff --git a/fuzzing/libcommon/libcommon_fuzz_property.proto b/fuzzing/libcommon/libcommon_fuzz_property.proto
index d0ad47a22..11d63f4d8 100644
--- a/fuzzing/libcommon/libcommon_fuzz_property.proto
+++ b/fuzzing/libcommon/libcommon_fuzz_property.proto
@@ -22,4 +22,5 @@ message Property {
 
 message FuzzerInput {
 	repeated Property properties = 1;
+	required int32 memory_check_limit = 2;
 }
diff --git a/libcommon/memory_common.c b/libcommon/memory_common.c
index 785961be5..2357e9d8a 100644
--- a/libcommon/memory_common.c
+++ b/libcommon/memory_common.c
@@ -41,6 +41,19 @@ Contributors:
 #  endif
 #endif
 
+#ifdef WITH_FUZZING
+int32_t fuzz_memory_check_count = 0;
+int32_t fuzz_memory_check_limit = -1;
+bool fuzz_memory_check(void)
+{
+	fuzz_memory_check_count++;
+	return (fuzz_memory_check_limit > 0 && fuzz_memory_check_count >= fuzz_memory_check_limit);
+}
+#  define FUZZ_MEMORY_CHECK() if(fuzz_memory_check()){ return NULL; }
+#else
+#  define FUZZ_MEMORY_CHECK()
+#endif
+
 static unsigned long memcount = 0;
 static unsigned long max_memcount = 0;
 
@@ -182,6 +195,8 @@ BROKER_EXPORT void *mosquitto_realloc(void *ptr, size_t size)
 	bool alloc_mismatch = free_size > 0 && !check_alloc_marker(ptr, free_size);
 #endif
 
+	FUZZ_MEMORY_CHECK();
+
 	/* Avoid counter underflow due to mismatched memory allocation function usage */
 	if(free_size > memcount){
 		free_size = memcount;