/src/flac/oss-fuzz/tool_metaflac.c
Line | Count | Source |
1 | | /* fuzzer_tool_flac |
2 | | * Copyright (C) 2023-2025 Xiph.Org Foundation |
3 | | * |
4 | | * Redistribution and use in source and binary forms, with or without |
5 | | * modification, are permitted provided that the following conditions |
6 | | * are met: |
7 | | * |
8 | | * - Redistributions of source code must retain the above copyright |
9 | | * notice, this list of conditions and the following disclaimer. |
10 | | * |
11 | | * - Redistributions in binary form must reproduce the above copyright |
12 | | * notice, this list of conditions and the following disclaimer in the |
13 | | * documentation and/or other materials provided with the distribution. |
14 | | * |
15 | | * - Neither the name of the Xiph.org Foundation nor the names of its |
16 | | * contributors may be used to endorse or promote products derived from |
17 | | * this software without specific prior written permission. |
18 | | * |
19 | | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
20 | | * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
21 | | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
22 | | * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR |
23 | | * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, |
24 | | * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, |
25 | | * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR |
26 | | * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF |
27 | | * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING |
28 | | * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
29 | | * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
30 | | */ |
31 | | |
32 | | #include <stdio.h> |
33 | | #include <stdlib.h> |
34 | | #include <string.h> /* for memcpy */ |
35 | | #define FUZZ_TOOL_METAFLAC |
36 | | #define fprintf(...) |
37 | | #define printf(...) |
38 | | #include "../src/metaflac/main.c" |
39 | | #include "common.h" |
40 | | |
41 | | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size); |
42 | | |
43 | | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) |
44 | 14.8k | { |
45 | 14.8k | size_t size_left = size; |
46 | 14.8k | size_t arglen; |
47 | 14.8k | char * argv[64]; |
48 | 14.8k | char exename[] = "metaflac"; |
49 | 14.8k | char filename[] = "/tmp/fuzzXXXXXX"; |
50 | 14.8k | char filename_stdin[] = "/tmp/fuzzXXXXXX"; |
51 | 14.8k | int numarg = 0, maxarg; |
52 | 14.8k | int file_to_fuzz; |
53 | 14.8k | int tmp_stdout, tmp_stdin; |
54 | 14.8k | fpos_t pos_stdout; |
55 | 14.8k | bool use_stdin = false; |
56 | | |
57 | 14.8k | share__opterr = 0; |
58 | 14.8k | share__optind = 0; |
59 | | |
60 | | |
61 | 14.8k | if(size < 2) |
62 | 1 | return 0; |
63 | | |
64 | 14.8k | maxarg = data[0] & 15; |
65 | 14.8k | use_stdin = data[0] & 16; |
66 | 14.8k | size_left--; |
67 | | |
68 | 14.8k | argv[0] = exename; |
69 | 14.8k | numarg++; |
70 | | |
71 | | /* Check whether input is zero delimited */ |
72 | 69.7k | while((arglen = strnlen((char *)data+(size-size_left),size_left)) < size_left && numarg < maxarg) { |
73 | 54.8k | argv[numarg++] = (char *)data+(size-size_left); |
74 | 54.8k | size_left -= arglen + 1; |
75 | 54.8k | } |
76 | | |
77 | | /* Create file to feed directly */ |
78 | 14.8k | file_to_fuzz = mkstemp(filename); |
79 | 14.8k | if (file_to_fuzz < 0) |
80 | 0 | abort(); |
81 | 14.8k | if(use_stdin) { |
82 | 1.42k | write(file_to_fuzz,data+(size-size_left),size_left/2); |
83 | 1.42k | size_left -= size_left/2; |
84 | 1.42k | } |
85 | 13.4k | else |
86 | 13.4k | write(file_to_fuzz,data+(size-size_left),size_left); |
87 | 14.8k | close(file_to_fuzz); |
88 | | |
89 | 14.8k | argv[numarg++] = filename; |
90 | | |
91 | | /* Create file to feed to stdin */ |
92 | 14.8k | if(use_stdin) { |
93 | 1.42k | file_to_fuzz = mkstemp(filename_stdin); |
94 | 1.42k | if (file_to_fuzz < 0) |
95 | 0 | abort(); |
96 | 1.42k | write(file_to_fuzz,data+(size-size_left),size_left); |
97 | 1.42k | close(file_to_fuzz); |
98 | 1.42k | } |
99 | | |
100 | | /* redirect stdout */ |
101 | 14.8k | fflush(stdout); |
102 | 14.8k | fgetpos(stdout,&pos_stdout); |
103 | 14.8k | tmp_stdout = dup(fileno(stdout)); |
104 | 14.8k | freopen("/dev/null","w",stdout); |
105 | | |
106 | | /* redirect stdin */ |
107 | 14.8k | tmp_stdin = dup(fileno(stdin)); |
108 | 14.8k | if(use_stdin) |
109 | 1.42k | freopen(filename_stdin,"r",stdin); |
110 | 13.4k | else { |
111 | 13.4k | freopen("/dev/null","r",stdin); |
112 | 13.4k | argv[numarg++] = filename; |
113 | 13.4k | } |
114 | | |
115 | 14.8k | main_to_fuzz(numarg,argv); |
116 | | |
117 | | /* restore stdout */ |
118 | 14.8k | fflush(stdout); |
119 | 14.8k | dup2(tmp_stdout, fileno(stdout)); |
120 | 14.8k | close(tmp_stdout); |
121 | 14.8k | clearerr(stdout); |
122 | 14.8k | fsetpos(stdout,&pos_stdout); |
123 | | |
124 | | /* restore stdin */ |
125 | 14.8k | dup2(tmp_stdin, fileno(stdin)); |
126 | 14.8k | close(tmp_stdin); |
127 | 14.8k | clearerr(stdin); |
128 | | |
129 | 14.8k | unlink(filename); |
130 | | |
131 | 14.8k | if(use_stdin) |
132 | 1.42k | unlink(filename_stdin); |
133 | | |
134 | 14.8k | return 0; |
135 | 14.8k | } |
136 | | |