mirror of
https://git.tukaani.org/xz.git
synced 2026-10-31 03:14:56 +00:00
67 lines
1.9 KiB
C
67 lines
1.9 KiB
C
// SPDX-License-Identifier: 0BSD
|
|
|
|
///////////////////////////////////////////////////////////////////////////////
|
|
//
|
|
/// \file fuzz_decode_stream.c
|
|
/// \brief Fuzz test program for single threaded .xz decoding
|
|
//
|
|
// Authors: Lasse Collin
|
|
// Maksym Vatsyk
|
|
//
|
|
///////////////////////////////////////////////////////////////////////////////
|
|
|
|
#include <inttypes.h>
|
|
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
#include "lzma.h"
|
|
#include "fuzz_common.h"
|
|
|
|
|
|
extern int
|
|
LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size)
|
|
{
|
|
lzma_stream strm = LZMA_STREAM_INIT;
|
|
strm.next_in = inbuf;
|
|
strm.avail_in = inbuf_size;
|
|
|
|
lzma_ret ret;
|
|
|
|
for (int i = 0; i < 3; ++i) {
|
|
// Initialize a .xz decoder using the memory usage limit
|
|
// defined in fuzz_common.h
|
|
//
|
|
// After the first two iterations, enable support for
|
|
// concatenated .xz files which is used when decompressing
|
|
// regular .xz files (instead of data embedded inside some
|
|
// other file format). This way the first iteration won't
|
|
// consume all the input until the input is invalid.
|
|
//
|
|
// Integrity checks on the uncompressed data are ignored to
|
|
// make fuzzing more effective (incorrect check values won't
|
|
// prevent the decoder from processing more input).
|
|
//
|
|
// The flag LZMA_IGNORE_CHECK doesn't disable verification
|
|
// of header CRC32 values. Those checks are disabled when
|
|
// liblzma is built with the
|
|
// #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION.
|
|
ret = lzma_stream_decoder(&strm, MEM_LIMIT, LZMA_IGNORE_CHECK
|
|
| (i >= 2 ? LZMA_CONCATENATED : 0));
|
|
|
|
if (ret != LZMA_OK) {
|
|
// This should never happen unless the system has
|
|
// no free memory or address space to allow the small
|
|
// allocations that the initialization requires.
|
|
fprintf(stderr, "lzma_stream_decoder() failed (%d)\n",
|
|
ret);
|
|
abort();
|
|
}
|
|
|
|
fuzz_code(&strm, inbuf, inbuf_size);
|
|
}
|
|
|
|
// Free the allocated memory.
|
|
lzma_end(&strm);
|
|
|
|
return 0;
|
|
}
|