// Copyright (c) ONNX Project Contributors
// SPDX-License-Identifier: Apache-2.0
//
// libFuzzer harness for ``onnx_light::shape_inference::InferShapes``.
//
// Parses random bytes into a ``ModelProto`` and, on success, runs
// shape inference. Mirrors the former
// ``onnx_light/fuzz/fuzz_shape_inference.py``. The toggle-byte
// structured-model path from the Python harness is dropped in favour
// of leaving coverage-guided mutation to libFuzzer; the per-op
// inference dispatch is still reached whenever a mutated input parses
// into a ``ModelProto`` carrying nodes (which libFuzzer learns from
// seed corpora generated by ``fuzz_make_seed_corpus``).

#include "onnx_lib/shape_inference/implementation.h"
#include "onnx_proto/onnx.h"

#include <cstddef>
#include <cstdint>
#include <string>

using ONNX_LIGHT_NAMESPACE::ModelProto;
namespace shape_inference = ONNX_LIGHT_NAMESPACE::shape_inference;

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  ModelProto model;
  try {
    model.ParseFromString(std::string(reinterpret_cast<const char *>(data), size));
  } catch (...) {
    return 0;
  }
  try {
    shape_inference::InferShapes(model);
  } catch (...) {
    // InferenceError / ValidationError are expected on malformed
    // inputs. Real bugs surface as crashes, hangs, or sanitizer reports.
  }
  return 0;
}
