Coverage Report

Created: 2025-10-12 06:44

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/flac/oss-fuzz/tool_metaflac.c
Line
Count
Source
1
/* fuzzer_tool_flac
2
 * Copyright (C) 2023-2025  Xiph.Org Foundation
3
 *
4
 * Redistribution and use in source and binary forms, with or without
5
 * modification, are permitted provided that the following conditions
6
 * are met:
7
 *
8
 * - Redistributions of source code must retain the above copyright
9
 * notice, this list of conditions and the following disclaimer.
10
 *
11
 * - Redistributions in binary form must reproduce the above copyright
12
 * notice, this list of conditions and the following disclaimer in the
13
 * documentation and/or other materials provided with the distribution.
14
 *
15
 * - Neither the name of the Xiph.org Foundation nor the names of its
16
 * contributors may be used to endorse or promote products derived from
17
 * this software without specific prior written permission.
18
 *
19
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
22
 * A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR
23
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
26
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
27
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
28
 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
29
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30
 */
31
32
#include <stdio.h>
33
#include <stdlib.h>
34
#include <string.h> /* for memcpy */
35
#define FUZZ_TOOL_METAFLAC
36
#define fprintf(...)
37
#define printf(...)
38
#include "../src/metaflac/main.c"
39
#include "common.h"
40
41
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
42
43
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
44
14.8k
{
45
14.8k
  size_t size_left = size;
46
14.8k
  size_t arglen;
47
14.8k
  char * argv[64];
48
14.8k
  char exename[] = "metaflac";
49
14.8k
  char filename[] = "/tmp/fuzzXXXXXX";
50
14.8k
  char filename_stdin[] = "/tmp/fuzzXXXXXX";
51
14.8k
  int numarg = 0, maxarg;
52
14.8k
  int file_to_fuzz;
53
14.8k
  int tmp_stdout, tmp_stdin;
54
14.8k
  fpos_t pos_stdout;
55
14.8k
  bool use_stdin = false;
56
57
14.8k
  share__opterr = 0;
58
14.8k
  share__optind = 0;
59
60
61
14.8k
  if(size < 2)
62
1
    return 0;
63
64
14.8k
  maxarg = data[0] & 15;
65
14.8k
  use_stdin = data[0] & 16;
66
14.8k
  size_left--;
67
68
14.8k
  argv[0] = exename;
69
14.8k
  numarg++;
70
71
  /* Check whether input is zero delimited */
72
69.7k
  while((arglen = strnlen((char *)data+(size-size_left),size_left)) < size_left && numarg < maxarg) {
73
54.8k
    argv[numarg++] = (char *)data+(size-size_left);
74
54.8k
    size_left -= arglen + 1;
75
54.8k
  }
76
77
  /* Create file to feed directly */
78
14.8k
  file_to_fuzz = mkstemp(filename);
79
14.8k
  if (file_to_fuzz < 0)
80
0
    abort();
81
14.8k
  if(use_stdin) {
82
1.42k
    write(file_to_fuzz,data+(size-size_left),size_left/2);
83
1.42k
    size_left -= size_left/2;
84
1.42k
  }
85
13.4k
  else
86
13.4k
    write(file_to_fuzz,data+(size-size_left),size_left);
87
14.8k
  close(file_to_fuzz);
88
89
14.8k
  argv[numarg++] = filename;
90
91
  /* Create file to feed to stdin */
92
14.8k
  if(use_stdin) {
93
1.42k
    file_to_fuzz = mkstemp(filename_stdin);
94
1.42k
    if (file_to_fuzz < 0)
95
0
      abort();
96
1.42k
    write(file_to_fuzz,data+(size-size_left),size_left);
97
1.42k
    close(file_to_fuzz);
98
1.42k
  }
99
100
  /* redirect stdout */
101
14.8k
  fflush(stdout);
102
14.8k
  fgetpos(stdout,&pos_stdout);
103
14.8k
  tmp_stdout = dup(fileno(stdout));
104
14.8k
  freopen("/dev/null","w",stdout);
105
106
  /* redirect stdin */
107
14.8k
  tmp_stdin = dup(fileno(stdin));
108
14.8k
  if(use_stdin)
109
1.42k
    freopen(filename_stdin,"r",stdin);
110
13.4k
  else {
111
13.4k
    freopen("/dev/null","r",stdin);
112
13.4k
    argv[numarg++] = filename;
113
13.4k
  }
114
115
14.8k
  main_to_fuzz(numarg,argv);
116
117
  /* restore stdout */
118
14.8k
  fflush(stdout);
119
14.8k
  dup2(tmp_stdout, fileno(stdout));
120
14.8k
  close(tmp_stdout);
121
14.8k
  clearerr(stdout);
122
14.8k
  fsetpos(stdout,&pos_stdout);
123
124
  /* restore stdin */
125
14.8k
  dup2(tmp_stdin, fileno(stdin));
126
14.8k
  close(tmp_stdin);
127
14.8k
  clearerr(stdin);
128
129
14.8k
  unlink(filename);
130
131
14.8k
  if(use_stdin)
132
1.42k
    unlink(filename_stdin);
133
134
14.8k
  return 0;
135
14.8k
}
136