aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--tests/ossfuzz/fuzz_common.h56
-rw-r--r--tests/ossfuzz/fuzz_decode_stream.c59
2 files changed, 71 insertions, 44 deletions
diff --git a/tests/ossfuzz/fuzz_common.h b/tests/ossfuzz/fuzz_common.h
new file mode 100644
index 00000000..ce3f9345
--- /dev/null
+++ b/tests/ossfuzz/fuzz_common.h
@@ -0,0 +1,56 @@
+///////////////////////////////////////////////////////////////////////////////
+//
+/// \file fuzz_decode_auto.c
+/// \brief Fuzz test program for liblzma lzma_auto_decoder()
+//
+// Author: Maksym Vatsyk
+//
+// This file has been put into the public domain.
+// You can do whatever you want with this file.
+//
+///////////////////////////////////////////////////////////////////////////////
+
+#include <inttypes.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include "lzma.h"
+
+// Some header values can make liblzma allocate a lot of RAM
+// (up to about 4 GiB with liblzma 5.2.x). We set a limit here to
+// prevent extreme allocations when fuzzing.
+#define MEM_LIMIT (300 << 20) // 300 MiB
+
+
+// Output buffer for decompressed data. This is write only; nothing cares
+// about the actual data written here.
+static uint8_t outbuf[4096];
+
+
+static void
+fuzz_code(lzma_stream *stream, const uint8_t *inbuf, size_t inbuf_size) {
+ // Give the whole input buffer at once to liblzma.
+ // Output buffer isn't initialized as liblzma only writes to it.
+ stream->next_in = inbuf;
+ stream->avail_in = inbuf_size;
+ stream->next_out = outbuf;
+ stream->avail_out = sizeof(outbuf);
+
+ lzma_ret ret;
+ while ((ret = lzma_code(stream, LZMA_FINISH)) == LZMA_OK) {
+ if (stream->avail_out == 0) {
+ // outbuf became full. We don't care about the
+ // uncompressed data there, so we simply reuse
+ // the outbuf and overwrite the old data.
+ stream->next_out = outbuf;
+ stream->avail_out = sizeof(outbuf);
+ }
+ }
+
+ // LZMA_PROG_ERROR should never happen as long as the code calling
+ // the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign
+ // of a bug in either this function or in liblzma.
+ if (ret == LZMA_PROG_ERROR) {
+ fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n");
+ abort();
+ }
+}
diff --git a/tests/ossfuzz/fuzz_decode_stream.c b/tests/ossfuzz/fuzz_decode_stream.c
index 6d899302..1da8ecb3 100644
--- a/tests/ossfuzz/fuzz_decode_stream.c
+++ b/tests/ossfuzz/fuzz_decode_stream.c
@@ -1,10 +1,11 @@
///////////////////////////////////////////////////////////////////////////////
//
-/// \file fuzz.c
+/// \file fuzz_decode_stream.c
/// \brief Fuzz test program for liblzma
//
// Author: Lasse Collin
//
+//
// This file has been put into the public domain.
// You can do whatever you want with this file.
//
@@ -14,66 +15,36 @@
#include <stdlib.h>
#include <stdio.h>
#include "lzma.h"
-
-
-// Output buffer for decompressed data. This is write only; nothing cares
-// about the actual data written here.
-static uint8_t outbuf[4096];
+#include "fuzz_common.h"
extern int
LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size)
{
- // Some header values can make liblzma allocate a lot of RAM
- // (up to about 4 GiB with liblzma 5.2.x). We set a limit here to
- // prevent extreme allocations when fuzzing.
- const uint64_t memlimit = 300 << 20; // 300 MiB
-
- // Initialize a .xz decoder using the above memory usage limit.
+ lzma_stream strm = LZMA_STREAM_INIT;
+ // Initialize a LZMA alone decoder using the memory usage limit
+ // defined in fuzz_common.h
+ //
// Enable support for concatenated .xz files which is used when
// decompressing regular .xz files (instead of data embedded inside
// some other file format). Integrity checks on the uncompressed
// data are ignored to make fuzzing more effective (incorrect check
// values won't prevent the decoder from processing more input).
//
- // The flag LZMA_IGNORE_CHECK doesn't disable verification of header
- // CRC32 values. Those checks are disabled when liblzma is built
- // with the #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION.
- lzma_stream strm = LZMA_STREAM_INIT;
- lzma_ret ret = lzma_stream_decoder(&strm, memlimit,
- LZMA_CONCATENATED | LZMA_IGNORE_CHECK);
- if (ret != LZMA_OK) {
+ // The flag LZMA_IGNORE_CHECK doesn't disable verification of
+ // header CRC32 values. Those checks are disabled when liblzma is
+ // built with the #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION.
+
+ if (lzma_stream_decoder(&strm, MEM_LIMIT,
+ LZMA_CONCATENATED | LZMA_IGNORE_CHECK) != LZMA_OK) {
// This should never happen unless the system has
// no free memory or address space to allow the small
// allocations that the initialization requires.
- fprintf(stderr, "lzma_stream_decoder() failed (%d)\n", ret);
+ fprintf(stderr, "lzma_stream_decoder() failed\n");
abort();
}
- // Give the whole input buffer at once to liblzma.
- // Output buffer isn't initialized as liblzma only writes to it.
- strm.next_in = inbuf;
- strm.avail_in = inbuf_size;
- strm.next_out = outbuf;
- strm.avail_out = sizeof(outbuf);
-
- while ((ret = lzma_code(&strm, LZMA_FINISH)) == LZMA_OK) {
- if (strm.avail_out == 0) {
- // outbuf became full. We don't care about the
- // uncompressed data there, so we simply reuse
- // the outbuf and overwrite the old data.
- strm.next_out = outbuf;
- strm.avail_out = sizeof(outbuf);
- }
- }
-
- // LZMA_PROG_ERROR should never happen as long as the code calling
- // the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign
- // of a bug in either this function or in liblzma.
- if (ret == LZMA_PROG_ERROR) {
- fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n");
- abort();
- }
+ fuzz_code(&strm, inbuf, inbuf_size);
// Free the allocated memory.
lzma_end(&strm);