From 28ce6a1c2a74866c51f7996a6869679c236d3c94 Mon Sep 17 00:00:00 2001 From: Maksym Vatsyk Date: Mon, 4 Dec 2023 17:20:08 +0100 Subject: Tests: Move common OSS-Fuzz target code to .h file. --- tests/ossfuzz/fuzz_common.h | 56 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 tests/ossfuzz/fuzz_common.h (limited to 'tests/ossfuzz/fuzz_common.h') diff --git a/tests/ossfuzz/fuzz_common.h b/tests/ossfuzz/fuzz_common.h new file mode 100644 index 00000000..ce3f9345 --- /dev/null +++ b/tests/ossfuzz/fuzz_common.h @@ -0,0 +1,56 @@ +/////////////////////////////////////////////////////////////////////////////// +// +/// \file fuzz_decode_auto.c +/// \brief Fuzz test program for liblzma lzma_auto_decoder() +// +// Author: Maksym Vatsyk +// +// This file has been put into the public domain. +// You can do whatever you want with this file. +// +/////////////////////////////////////////////////////////////////////////////// + +#include +#include +#include +#include "lzma.h" + +// Some header values can make liblzma allocate a lot of RAM +// (up to about 4 GiB with liblzma 5.2.x). We set a limit here to +// prevent extreme allocations when fuzzing. +#define MEM_LIMIT (300 << 20) // 300 MiB + + +// Output buffer for decompressed data. This is write only; nothing cares +// about the actual data written here. +static uint8_t outbuf[4096]; + + +static void +fuzz_code(lzma_stream *stream, const uint8_t *inbuf, size_t inbuf_size) { + // Give the whole input buffer at once to liblzma. + // Output buffer isn't initialized as liblzma only writes to it. + stream->next_in = inbuf; + stream->avail_in = inbuf_size; + stream->next_out = outbuf; + stream->avail_out = sizeof(outbuf); + + lzma_ret ret; + while ((ret = lzma_code(stream, LZMA_FINISH)) == LZMA_OK) { + if (stream->avail_out == 0) { + // outbuf became full. We don't care about the + // uncompressed data there, so we simply reuse + // the outbuf and overwrite the old data. + stream->next_out = outbuf; + stream->avail_out = sizeof(outbuf); + } + } + + // LZMA_PROG_ERROR should never happen as long as the code calling + // the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign + // of a bug in either this function or in liblzma. + if (ret == LZMA_PROG_ERROR) { + fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n"); + abort(); + } +} -- cgit v1.2.3