Tests: Move common OSS-Fuzz target code to .h file.

This commit is contained in:
Maksym Vatsyk 2023-12-04 17:20:08 +01:00 committed by Jia Tan
parent bf0521ea15
commit 28ce6a1c2a
2 changed files with 71 additions and 44 deletions

View File

@ -0,0 +1,56 @@
///////////////////////////////////////////////////////////////////////////////
//
/// \file fuzz_decode_auto.c
/// \brief Fuzz test program for liblzma lzma_auto_decoder()
//
// Author: Maksym Vatsyk
//
// This file has been put into the public domain.
// You can do whatever you want with this file.
//
///////////////////////////////////////////////////////////////////////////////
#include <inttypes.h>
#include <stdlib.h>
#include <stdio.h>
#include "lzma.h"
// Some header values can make liblzma allocate a lot of RAM
// (up to about 4 GiB with liblzma 5.2.x). We set a limit here to
// prevent extreme allocations when fuzzing.
#define MEM_LIMIT (300 << 20) // 300 MiB
// Output buffer for decompressed data. This is write only; nothing cares
// about the actual data written here.
static uint8_t outbuf[4096];
static void
fuzz_code(lzma_stream *stream, const uint8_t *inbuf, size_t inbuf_size) {
// Give the whole input buffer at once to liblzma.
// Output buffer isn't initialized as liblzma only writes to it.
stream->next_in = inbuf;
stream->avail_in = inbuf_size;
stream->next_out = outbuf;
stream->avail_out = sizeof(outbuf);
lzma_ret ret;
while ((ret = lzma_code(stream, LZMA_FINISH)) == LZMA_OK) {
if (stream->avail_out == 0) {
// outbuf became full. We don't care about the
// uncompressed data there, so we simply reuse
// the outbuf and overwrite the old data.
stream->next_out = outbuf;
stream->avail_out = sizeof(outbuf);
}
}
// LZMA_PROG_ERROR should never happen as long as the code calling
// the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign
// of a bug in either this function or in liblzma.
if (ret == LZMA_PROG_ERROR) {
fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n");
abort();
}
}

View File

@ -1,10 +1,11 @@
/////////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////////
// //
/// \file fuzz.c /// \file fuzz_decode_stream.c
/// \brief Fuzz test program for liblzma /// \brief Fuzz test program for liblzma
// //
// Author: Lasse Collin // Author: Lasse Collin
// //
//
// This file has been put into the public domain. // This file has been put into the public domain.
// You can do whatever you want with this file. // You can do whatever you want with this file.
// //
@ -14,66 +15,36 @@
#include <stdlib.h> #include <stdlib.h>
#include <stdio.h> #include <stdio.h>
#include "lzma.h" #include "lzma.h"
#include "fuzz_common.h"
// Output buffer for decompressed data. This is write only; nothing cares
// about the actual data written here.
static uint8_t outbuf[4096];
extern int extern int
LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size) LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size)
{ {
// Some header values can make liblzma allocate a lot of RAM lzma_stream strm = LZMA_STREAM_INIT;
// (up to about 4 GiB with liblzma 5.2.x). We set a limit here to // Initialize a LZMA alone decoder using the memory usage limit
// prevent extreme allocations when fuzzing. // defined in fuzz_common.h
const uint64_t memlimit = 300 << 20; // 300 MiB //
// Initialize a .xz decoder using the above memory usage limit.
// Enable support for concatenated .xz files which is used when // Enable support for concatenated .xz files which is used when
// decompressing regular .xz files (instead of data embedded inside // decompressing regular .xz files (instead of data embedded inside
// some other file format). Integrity checks on the uncompressed // some other file format). Integrity checks on the uncompressed
// data are ignored to make fuzzing more effective (incorrect check // data are ignored to make fuzzing more effective (incorrect check
// values won't prevent the decoder from processing more input). // values won't prevent the decoder from processing more input).
// //
// The flag LZMA_IGNORE_CHECK doesn't disable verification of header // The flag LZMA_IGNORE_CHECK doesn't disable verification of
// CRC32 values. Those checks are disabled when liblzma is built // header CRC32 values. Those checks are disabled when liblzma is
// with the #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION. // built with the #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION.
lzma_stream strm = LZMA_STREAM_INIT;
lzma_ret ret = lzma_stream_decoder(&strm, memlimit, if (lzma_stream_decoder(&strm, MEM_LIMIT,
LZMA_CONCATENATED | LZMA_IGNORE_CHECK); LZMA_CONCATENATED | LZMA_IGNORE_CHECK) != LZMA_OK) {
if (ret != LZMA_OK) {
// This should never happen unless the system has // This should never happen unless the system has
// no free memory or address space to allow the small // no free memory or address space to allow the small
// allocations that the initialization requires. // allocations that the initialization requires.
fprintf(stderr, "lzma_stream_decoder() failed (%d)\n", ret); fprintf(stderr, "lzma_stream_decoder() failed\n");
abort(); abort();
} }
// Give the whole input buffer at once to liblzma. fuzz_code(&strm, inbuf, inbuf_size);
// Output buffer isn't initialized as liblzma only writes to it.
strm.next_in = inbuf;
strm.avail_in = inbuf_size;
strm.next_out = outbuf;
strm.avail_out = sizeof(outbuf);
while ((ret = lzma_code(&strm, LZMA_FINISH)) == LZMA_OK) {
if (strm.avail_out == 0) {
// outbuf became full. We don't care about the
// uncompressed data there, so we simply reuse
// the outbuf and overwrite the old data.
strm.next_out = outbuf;
strm.avail_out = sizeof(outbuf);
}
}
// LZMA_PROG_ERROR should never happen as long as the code calling
// the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign
// of a bug in either this function or in liblzma.
if (ret == LZMA_PROG_ERROR) {
fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n");
abort();
}
// Free the allocated memory. // Free the allocated memory.
lzma_end(&strm); lzma_end(&strm);