From df5bfb4547ec6f3e3ad28ba2ece5f89ebf8d38c6 Mon Sep 17 00:00:00 2001
From: Lasse Collin <lasse.collin@tukaani.org>
Date: Wed, 9 Sep 2026 14:14:40 +0300
Subject: [PATCH] Tests: Add a fuzzer for .xz Index decoding

Normal .xz decoding uses lzma_index_hash, so this new fuzzer doesn't
overlap with the existing fuzzers.
---
 tests/ossfuzz/fuzz_decode_index.c | 66 +++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 tests/ossfuzz/fuzz_decode_index.c

diff --git a/tests/ossfuzz/fuzz_decode_index.c b/tests/ossfuzz/fuzz_decode_index.c
new file mode 100644
index 00000000..ba8b5837
--- /dev/null
+++ b/tests/ossfuzz/fuzz_decode_index.c
@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: 0BSD
+
+///////////////////////////////////////////////////////////////////////////////
+//
+/// \file       fuzz_decode_alone.c
+/// \brief      Fuzz test program for .xz Index decoding
+//
+//  Author:     Lasse Collin
+//
+///////////////////////////////////////////////////////////////////////////////
+
+#include <inttypes.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include "lzma.h"
+#include "fuzz_common.h"
+
+
+extern int
+LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size)
+{
+	lzma_stream strm = LZMA_STREAM_INIT;
+	prepare_stream(&strm, inbuf, inbuf_size);
+
+	lzma_ret ret;
+
+	for (int i = 0; i < 3; ++i) {
+		// The initial pointer value must be ignored.
+		lzma_index *idx = (void *)1;
+		ret = lzma_index_decoder(&strm, &idx, MEM_LIMIT);
+
+		if (ret == LZMA_MEM_ERROR)
+			continue;
+
+		if (ret != LZMA_OK) {
+			// This should never happen unless the system has
+			// no free memory or address space to allow the small
+			// allocations that the initialization requires.
+			fprintf(stderr, "lzma_index_decoder() failed (%d)\n",
+					ret);
+			abort();
+		}
+
+		fuzz_code(&strm, strm.next_in, strm.avail_in);
+		lzma_index_end(idx, NULL);
+	}
+
+	{
+		// Fuzz the single-call API too.
+		lzma_index *idx = (void *)1;
+		uint64_t memlimit = MEM_LIMIT;
+		size_t inbuf_pos = 0;
+		if (lzma_index_buffer_decode(&idx, &memlimit, NULL,
+				inbuf, &inbuf_pos, inbuf_size)
+				== LZMA_PROG_ERROR) {
+			fprintf(stderr, "lzma_index_buffer_decode() failed "
+					"with LZMA_PROG_ERROR\n");
+			abort();
+		}
+
+		lzma_index_end(idx, NULL);
+	}
+
+	lzma_end(&strm);
+	return 0;
+}