diff options
| -rw-r--r-- | tests/ossfuzz/fuzz_common.h | 56 | ||||
| -rw-r--r-- | tests/ossfuzz/fuzz_decode_stream.c | 59 |
2 files changed, 71 insertions, 44 deletions
diff --git a/tests/ossfuzz/fuzz_common.h b/tests/ossfuzz/fuzz_common.h new file mode 100644 index 00000000..ce3f9345 --- /dev/null +++ b/tests/ossfuzz/fuzz_common.h @@ -0,0 +1,56 @@ +/////////////////////////////////////////////////////////////////////////////// +// +/// \file fuzz_decode_auto.c +/// \brief Fuzz test program for liblzma lzma_auto_decoder() +// +// Author: Maksym Vatsyk +// +// This file has been put into the public domain. +// You can do whatever you want with this file. +// +/////////////////////////////////////////////////////////////////////////////// + +#include <inttypes.h> +#include <stdlib.h> +#include <stdio.h> +#include "lzma.h" + +// Some header values can make liblzma allocate a lot of RAM +// (up to about 4 GiB with liblzma 5.2.x). We set a limit here to +// prevent extreme allocations when fuzzing. +#define MEM_LIMIT (300 << 20) // 300 MiB + + +// Output buffer for decompressed data. This is write only; nothing cares +// about the actual data written here. +static uint8_t outbuf[4096]; + + +static void +fuzz_code(lzma_stream *stream, const uint8_t *inbuf, size_t inbuf_size) { + // Give the whole input buffer at once to liblzma. + // Output buffer isn't initialized as liblzma only writes to it. + stream->next_in = inbuf; + stream->avail_in = inbuf_size; + stream->next_out = outbuf; + stream->avail_out = sizeof(outbuf); + + lzma_ret ret; + while ((ret = lzma_code(stream, LZMA_FINISH)) == LZMA_OK) { + if (stream->avail_out == 0) { + // outbuf became full. We don't care about the + // uncompressed data there, so we simply reuse + // the outbuf and overwrite the old data. + stream->next_out = outbuf; + stream->avail_out = sizeof(outbuf); + } + } + + // LZMA_PROG_ERROR should never happen as long as the code calling + // the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign + // of a bug in either this function or in liblzma. + if (ret == LZMA_PROG_ERROR) { + fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n"); + abort(); + } +} diff --git a/tests/ossfuzz/fuzz_decode_stream.c b/tests/ossfuzz/fuzz_decode_stream.c index 6d899302..1da8ecb3 100644 --- a/tests/ossfuzz/fuzz_decode_stream.c +++ b/tests/ossfuzz/fuzz_decode_stream.c @@ -1,10 +1,11 @@ /////////////////////////////////////////////////////////////////////////////// // -/// \file fuzz.c +/// \file fuzz_decode_stream.c /// \brief Fuzz test program for liblzma // // Author: Lasse Collin // +// // This file has been put into the public domain. // You can do whatever you want with this file. // @@ -14,66 +15,36 @@ #include <stdlib.h> #include <stdio.h> #include "lzma.h" - - -// Output buffer for decompressed data. This is write only; nothing cares -// about the actual data written here. -static uint8_t outbuf[4096]; +#include "fuzz_common.h" extern int LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size) { - // Some header values can make liblzma allocate a lot of RAM - // (up to about 4 GiB with liblzma 5.2.x). We set a limit here to - // prevent extreme allocations when fuzzing. - const uint64_t memlimit = 300 << 20; // 300 MiB - - // Initialize a .xz decoder using the above memory usage limit. + lzma_stream strm = LZMA_STREAM_INIT; + // Initialize a LZMA alone decoder using the memory usage limit + // defined in fuzz_common.h + // // Enable support for concatenated .xz files which is used when // decompressing regular .xz files (instead of data embedded inside // some other file format). Integrity checks on the uncompressed // data are ignored to make fuzzing more effective (incorrect check // values won't prevent the decoder from processing more input). // - // The flag LZMA_IGNORE_CHECK doesn't disable verification of header - // CRC32 values. Those checks are disabled when liblzma is built - // with the #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION. - lzma_stream strm = LZMA_STREAM_INIT; - lzma_ret ret = lzma_stream_decoder(&strm, memlimit, - LZMA_CONCATENATED | LZMA_IGNORE_CHECK); - if (ret != LZMA_OK) { + // The flag LZMA_IGNORE_CHECK doesn't disable verification of + // header CRC32 values. Those checks are disabled when liblzma is + // built with the #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION. + + if (lzma_stream_decoder(&strm, MEM_LIMIT, + LZMA_CONCATENATED | LZMA_IGNORE_CHECK) != LZMA_OK) { // This should never happen unless the system has // no free memory or address space to allow the small // allocations that the initialization requires. - fprintf(stderr, "lzma_stream_decoder() failed (%d)\n", ret); + fprintf(stderr, "lzma_stream_decoder() failed\n"); abort(); } - // Give the whole input buffer at once to liblzma. - // Output buffer isn't initialized as liblzma only writes to it. - strm.next_in = inbuf; - strm.avail_in = inbuf_size; - strm.next_out = outbuf; - strm.avail_out = sizeof(outbuf); - - while ((ret = lzma_code(&strm, LZMA_FINISH)) == LZMA_OK) { - if (strm.avail_out == 0) { - // outbuf became full. We don't care about the - // uncompressed data there, so we simply reuse - // the outbuf and overwrite the old data. - strm.next_out = outbuf; - strm.avail_out = sizeof(outbuf); - } - } - - // LZMA_PROG_ERROR should never happen as long as the code calling - // the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign - // of a bug in either this function or in liblzma. - if (ret == LZMA_PROG_ERROR) { - fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n"); - abort(); - } + fuzz_code(&strm, inbuf, inbuf_size); // Free the allocated memory. lzma_end(&strm); |