Coverage Report

Created: 2025-07-11 06:54

/src/flac/oss-fuzz/tool_flac.c
Line
Count
Source (jump to first uncovered line)
1
/* fuzzer_tool_flac
2
 * Copyright (C) 2023-2025  Xiph.Org Foundation
3
 *
4
 * Redistribution and use in source and binary forms, with or without
5
 * modification, are permitted provided that the following conditions
6
 * are met:
7
 *
8
 * - Redistributions of source code must retain the above copyright
9
 * notice, this list of conditions and the following disclaimer.
10
 *
11
 * - Redistributions in binary form must reproduce the above copyright
12
 * notice, this list of conditions and the following disclaimer in the
13
 * documentation and/or other materials provided with the distribution.
14
 *
15
 * - Neither the name of the Xiph.org Foundation nor the names of its
16
 * contributors may be used to endorse or promote products derived from
17
 * this software without specific prior written permission.
18
 *
19
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
22
 * A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR
23
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
26
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
27
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
28
 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
29
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30
 */
31
32
#include <stdlib.h>
33
#include <string.h> /* for memcpy */
34
#define FUZZ_TOOL_FLAC
35
#define fprintf(...)
36
#define printf(...)
37
#include "../src/flac/main.c"
38
#include "common.h"
39
40
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
41
42
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
43
15.6k
{
44
15.6k
  size_t size_left = size;
45
15.6k
  size_t arglen;
46
15.6k
  char * argv[67];
47
15.6k
  char exename[] = "flac";
48
15.6k
  char filename[] = "/tmp/fuzzXXXXXX";
49
15.6k
  int numarg = 0, maxarg;
50
15.6k
  int file_to_fuzz;
51
15.6k
  int tmp_stdout, tmp_stdin;
52
15.6k
  fpos_t pos_stdout;
53
15.6k
  bool use_stdin = false;
54
55
  /* reset global vars */
56
15.6k
  flac__utils_verbosity_ = 0;
57
15.6k
  share__opterr = 0;
58
15.6k
  share__optind = 0;
59
60
15.6k
  if(size < 3)
61
2
    return 0;
62
63
15.6k
  maxarg = data[0] & 63;
64
15.6k
  use_stdin = data[0] & 64;
65
15.6k
  size_left--;
66
67
15.6k
  alloc_check_counter = 0;
68
15.6k
  if(data[0] & 128) {
69
2.06k
    alloc_check_keep_failing = data[1] & 1;
70
2.06k
    alloc_check_threshold = data[1] >> 1;
71
2.06k
    size_left--;
72
2.06k
  }
73
13.5k
  else
74
13.5k
    alloc_check_threshold = INT32_MAX;
75
76
15.6k
  argv[0] = exename;
77
15.6k
  numarg++;
78
79
  /* Check whether input is zero delimited */
80
207k
  while((arglen = strnlen((char *)data+(size-size_left),size_left)) < size_left && numarg < maxarg) {
81
191k
    argv[numarg++] = (char *)data+(size-size_left);
82
191k
    size_left -= arglen + 1;
83
191k
  }
84
85
15.6k
  file_to_fuzz = mkstemp(filename);
86
87
15.6k
  if (file_to_fuzz < 0)
88
0
    abort();
89
15.6k
  write(file_to_fuzz,data+(size-size_left),size_left);
90
15.6k
  close(file_to_fuzz);
91
92
  /* redirect stdout */
93
15.6k
  fflush(stdout);
94
15.6k
  fgetpos(stdout,&pos_stdout);
95
15.6k
  tmp_stdout = dup(fileno(stdout));
96
15.6k
  freopen("/dev/null","w",stdout);
97
98
  /* redirect stdin */
99
15.6k
  tmp_stdin = dup(fileno(stdin));
100
101
15.6k
  if(use_stdin)
102
1.70k
    freopen(filename,"r",stdin);
103
13.9k
  else {
104
13.9k
    freopen("/dev/null","r",stdin);
105
13.9k
    argv[numarg++] = filename;
106
13.9k
  }
107
108
15.6k
  main_to_fuzz(numarg,argv);
109
110
  /* restore stdout */
111
15.6k
  fflush(stdout);
112
15.6k
  dup2(tmp_stdout, fileno(stdout));
113
15.6k
  close(tmp_stdout);
114
15.6k
  clearerr(stdout);
115
15.6k
  fsetpos(stdout,&pos_stdout);
116
117
  /* restore stdin */
118
15.6k
  dup2(tmp_stdin, fileno(stdin));
119
15.6k
  close(tmp_stdin);
120
15.6k
  clearerr(stdin);
121
122
15.6k
  unlink(filename);
123
124
15.6k
  return 0;
125
15.6k
}
126