From 7ca8c9869df82756c3128c4fcf1058da4d18aa48 Mon Sep 17 00:00:00 2001 From: Maksym Vatsyk Date: Mon, 4 Dec 2023 17:23:24 +0100 Subject: [PATCH] Tests: Add fuzz_decode_alone OSS-Fuzz target This fuzz target that handles LZMA alone decoding. A new fuzz dictionary .dict was also created with common LZMA header values to help speed up the discovery of valid headers. --- .../ossfuzz/config/fuzz_decode_alone.options | 3 ++ tests/ossfuzz/config/fuzz_lzma.dict | 22 ++++++++++ tests/ossfuzz/fuzz_decode_alone.c | 41 +++++++++++++++++++ 3 files changed, 66 insertions(+) create mode 100644 tests/ossfuzz/config/fuzz_decode_alone.options create mode 100644 tests/ossfuzz/config/fuzz_lzma.dict create mode 100644 tests/ossfuzz/fuzz_decode_alone.c diff --git a/tests/ossfuzz/config/fuzz_decode_alone.options b/tests/ossfuzz/config/fuzz_decode_alone.options new file mode 100644 index 00000000..0747b68c --- /dev/null +++ b/tests/ossfuzz/config/fuzz_decode_alone.options @@ -0,0 +1,3 @@ +[libfuzzer] +max_len = 4096 +dict = fuzz_lzma.dict diff --git a/tests/ossfuzz/config/fuzz_lzma.dict b/tests/ossfuzz/config/fuzz_lzma.dict new file mode 100644 index 00000000..38d4da3e --- /dev/null +++ b/tests/ossfuzz/config/fuzz_lzma.dict @@ -0,0 +1,22 @@ +# first 5 header bytes of .lzma archives based on the info from +# https://github.com/tukaani-project/xz/blob/master/doc/lzma-file-format.txt + +# byte 0 value (properties=0x5d) is created by encoding +# common values (lc=3, lp=0, pb=2) using the algorithm, +# described in the documentation above + + +# compression preset 1 (dictionary size = 0x00100000) +"\x5d\x00\x00\x10\x00" +# compression preset 2 (dictionary size = 0x00200000) +"\x5d\x00\x00\x20\x00" +# compression preset 3, 4 (dictionary size = 0x00400000) +"\x5d\x00\x00\x40\x00" +# compression preset 5, 6 (dictionary size = 0x00800000) +"\x5d\x00\x00\x80\x00" +# compression preset 7 (dictionary size = 0x01000000) +"\x5d\x00\x00\x00\x01" +# compression preset 8 (dictionary size = 0x02000000) +"\x5d\x00\x00\x00\x02" +# compression preset 9 (dictionary size = 0x04000000) +"\x5d\x00\x00\x00\x04" diff --git a/tests/ossfuzz/fuzz_decode_alone.c b/tests/ossfuzz/fuzz_decode_alone.c new file mode 100644 index 00000000..d07874bc --- /dev/null +++ b/tests/ossfuzz/fuzz_decode_alone.c @@ -0,0 +1,41 @@ +/////////////////////////////////////////////////////////////////////////////// +// +/// \file fuzz_decode_auto.c +/// \brief Fuzz test program for liblzma lzma_auto_decoder() +// +// Author: Maksym Vatsyk +// +// Based on Lasse Collin's original fuzzer for liblzma +// +// This file has been put into the public domain. +// You can do whatever you want with this file. +// +/////////////////////////////////////////////////////////////////////////////// + +#include +#include +#include +#include "lzma.h" +#include "fuzz_common.h" + + +extern int +LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size) +{ + lzma_stream strm = LZMA_STREAM_INIT; + // Initialize a LZMA alone decoder using the memory usage limit + // defined in fuzz_common.h + if (lzma_alone_decoder(&strm, MEM_LIMIT) != LZMA_OK) { + // This should never happen unless the system has + // no free memory or address space to allow the small + // allocations that the initialization requires. + fprintf(stderr, "lzma_alone_decoder() failed\n"); + abort(); + } + + fuzz_code(&strm, inbuf, inbuf_size); + + // Free the allocated memory. + lzma_end(&strm); + return 0; +}