mirror of
https://git.tukaani.org/xz.git
synced 2024-04-04 12:36:23 +02:00
Tests: Add a fuzz test program and a config file for OSS-Fuzz.
Thanks to Bhargava Shastry and Github user pdknsk.
This commit is contained in:
parent
a18ae42a79
commit
106d1a663d
5 changed files with 94 additions and 0 deletions
|
@ -7,6 +7,7 @@
|
||||||
|
|
||||||
EXTRA_DIST = \
|
EXTRA_DIST = \
|
||||||
files \
|
files \
|
||||||
|
ossfuzz \
|
||||||
tests.h \
|
tests.h \
|
||||||
test_files.sh \
|
test_files.sh \
|
||||||
test_compress.sh \
|
test_compress.sh \
|
||||||
|
|
7
tests/ossfuzz/Makefile
Normal file
7
tests/ossfuzz/Makefile
Normal file
|
@ -0,0 +1,7 @@
|
||||||
|
fuzz: fuzz.c
|
||||||
|
$(CC) $(CFLAGS) -c fuzz.c -I ../../src/liblzma/api/
|
||||||
|
$(CXX) $(CXXFLAGS) -lFuzzingEngine fuzz.o -o $(OUT)/fuzz \
|
||||||
|
../../src/liblzma/.libs/liblzma.a
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -f *.o
|
2
tests/ossfuzz/config/fuzz.dict
Normal file
2
tests/ossfuzz/config/fuzz.dict
Normal file
|
@ -0,0 +1,2 @@
|
||||||
|
"\xFD7zXZ\x00"
|
||||||
|
"YZ"
|
2
tests/ossfuzz/config/fuzz.options
Normal file
2
tests/ossfuzz/config/fuzz.options
Normal file
|
@ -0,0 +1,2 @@
|
||||||
|
[libfuzzer]
|
||||||
|
dict = fuzz.dict
|
82
tests/ossfuzz/fuzz.c
Normal file
82
tests/ossfuzz/fuzz.c
Normal file
|
@ -0,0 +1,82 @@
|
||||||
|
///////////////////////////////////////////////////////////////////////////////
|
||||||
|
//
|
||||||
|
/// \file fuzz.c
|
||||||
|
/// \brief Fuzz test program for liblzma
|
||||||
|
//
|
||||||
|
// Author: Lasse Collin
|
||||||
|
//
|
||||||
|
// This file has been put into the public domain.
|
||||||
|
// You can do whatever you want with this file.
|
||||||
|
//
|
||||||
|
///////////////////////////////////////////////////////////////////////////////
|
||||||
|
|
||||||
|
#include <inttypes.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include "lzma.h"
|
||||||
|
|
||||||
|
|
||||||
|
// Output buffer for decompressed data. This is write only; nothing cares
|
||||||
|
// about the actual data written here.
|
||||||
|
static uint8_t outbuf[4096];
|
||||||
|
|
||||||
|
|
||||||
|
extern int
|
||||||
|
LLVMFuzzerTestOneInput(const uint8_t *inbuf, size_t inbuf_size)
|
||||||
|
{
|
||||||
|
// Some header values can make liblzma allocate a lot of RAM
|
||||||
|
// (up to about 4 GiB with liblzma 5.2.x). We set a limit here to
|
||||||
|
// prevent extreme allocations when fuzzing.
|
||||||
|
const uint64_t memlimit = 300 << 20; // 300 MiB
|
||||||
|
|
||||||
|
// Initialize a .xz decoder using the above memory usage limit.
|
||||||
|
// Enable support for concatenated .xz files which is used when
|
||||||
|
// decompressing regular .xz files (instead of data embedded inside
|
||||||
|
// some other file format). Integrity checks on the uncompressed
|
||||||
|
// data are ignored to make fuzzing more effective (incorrect check
|
||||||
|
// values won't prevent the decoder from processing more input).
|
||||||
|
//
|
||||||
|
// The flag LZMA_IGNORE_CHECK doesn't disable verification of header
|
||||||
|
// CRC32 values. Those checks are disabled when liblzma is built
|
||||||
|
// with the #define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION.
|
||||||
|
lzma_stream strm = LZMA_STREAM_INIT;
|
||||||
|
lzma_ret ret = lzma_stream_decoder(&strm, memlimit,
|
||||||
|
LZMA_CONCATENATED | LZMA_IGNORE_CHECK);
|
||||||
|
if (ret != LZMA_OK) {
|
||||||
|
// This should never happen unless the system has
|
||||||
|
// no free memory or address space to allow the small
|
||||||
|
// allocations that the initialization requires.
|
||||||
|
fprintf(stderr, "lzma_stream_decoder() failed (%d)\n", ret);
|
||||||
|
abort();
|
||||||
|
}
|
||||||
|
|
||||||
|
// Give the whole input buffer at once to liblzma.
|
||||||
|
// Output buffer isn't initialized as liblzma only writes to it.
|
||||||
|
strm.next_in = inbuf;
|
||||||
|
strm.avail_in = inbuf_size;
|
||||||
|
strm.next_out = outbuf;
|
||||||
|
strm.avail_out = sizeof(outbuf);
|
||||||
|
|
||||||
|
while ((ret = lzma_code(&strm, LZMA_FINISH)) == LZMA_OK) {
|
||||||
|
if (strm.avail_out == 0) {
|
||||||
|
// outbuf became full. We don't care about the
|
||||||
|
// uncompressed data there, so we simply reuse
|
||||||
|
// the outbuf and overwrite the old data.
|
||||||
|
strm.next_out = outbuf;
|
||||||
|
strm.avail_out = sizeof(outbuf);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// LZMA_PROG_ERROR should never happen as long as the code calling
|
||||||
|
// the liblzma functions is correct. Thus LZMA_PROG_ERROR is a sign
|
||||||
|
// of a bug in either this function or in liblzma.
|
||||||
|
if (ret == LZMA_PROG_ERROR) {
|
||||||
|
fprintf(stderr, "lzma_code() returned LZMA_PROG_ERROR\n");
|
||||||
|
abort();
|
||||||
|
}
|
||||||
|
|
||||||
|
// Free the allocated memory.
|
||||||
|
lzma_end(&strm);
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
Loading…
Reference in a new issue