poc/harness_isolated_get_named_data.cpp

// Isolated harness: calls ONLY get_tensor_layout() (via get_named_data search
// loop), never get_key(), to prove get_named_data()'s search loop has an
// independent null-deref bug on NamedData.key, distinct from get_key()'s.
#include <cstddef>
#include <cstdint>
#include <executorch/extension/data_loader/buffer_data_loader.h>
#include <executorch/extension/flat_tensor/flat_tensor_data_map.h>
#include <executorch/runtime/platform/runtime.h>

using executorch::extension::BufferDataLoader;
using executorch::extension::FlatTensorDataMap;

static bool g_initialized = false;

extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t* data, std::size_t size) {
  if (!g_initialized) { executorch::runtime::runtime_init(); g_initialized = true; }
  if (data == nullptr || size == 0 || size > 32U*1024U*1024U) return 0;
  BufferDataLoader loader(data, size);
  auto map = FlatTensorDataMap::load(&loader);
  if (!map.ok()) return 0;
  auto& m = map.get();
  // Search for a fixed set of candidate keys - never call get_key() or
  // get_num_keys(). This exercises get_named_data()'s linear search loop
  // (via get_tensor_layout) without ever touching get_key()'s direct-index
  // lookup, which is the buggy function in ET-NEW-006.
  const char* candidates[] = {"weight0", "weight1", "a", "x", ""};
  for (const char* k : candidates) {
    (void)m.get_tensor_layout(executorch::aten::string_view(k, __builtin_strlen(k)));
    (void)m.get_data(executorch::aten::string_view(k, __builtin_strlen(k)));
  }
  return 0;
}