Coverage Report

Created: 2025-08-29 06:56

/src/flac/oss-fuzz/tool_flac.c
Line
Count
Source (jump to first uncovered line)
1
/* fuzzer_tool_flac
2
 * Copyright (C) 2023-2025  Xiph.Org Foundation
3
 *
4
 * Redistribution and use in source and binary forms, with or without
5
 * modification, are permitted provided that the following conditions
6
 * are met:
7
 *
8
 * - Redistributions of source code must retain the above copyright
9
 * notice, this list of conditions and the following disclaimer.
10
 *
11
 * - Redistributions in binary form must reproduce the above copyright
12
 * notice, this list of conditions and the following disclaimer in the
13
 * documentation and/or other materials provided with the distribution.
14
 *
15
 * - Neither the name of the Xiph.org Foundation nor the names of its
16
 * contributors may be used to endorse or promote products derived from
17
 * this software without specific prior written permission.
18
 *
19
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
22
 * A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR
23
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
26
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
27
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
28
 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
29
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30
 */
31
32
#include <stdlib.h>
33
#include <string.h> /* for memcpy */
34
#define FUZZ_TOOL_FLAC
35
#define fprintf(...)
36
#define printf(...)
37
#include "../src/flac/main.c"
38
#include "common.h"
39
40
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
41
42
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
43
24.5k
{
44
24.5k
  size_t size_left = size;
45
24.5k
  size_t arglen;
46
24.5k
  char * argv[67];
47
24.5k
  char exename[] = "flac";
48
24.5k
  char filename[] = "/tmp/fuzzXXXXXX";
49
24.5k
  int numarg = 0, maxarg;
50
24.5k
  int file_to_fuzz;
51
24.5k
  int tmp_stdout, tmp_stdin;
52
24.5k
  fpos_t pos_stdout;
53
24.5k
  bool use_stdin = false;
54
55
  /* reset global vars */
56
24.5k
  flac__utils_verbosity_ = 0;
57
24.5k
  share__opterr = 0;
58
24.5k
  share__optind = 0;
59
60
24.5k
  if(size < 3)
61
2
    return 0;
62
63
24.5k
  maxarg = data[0] & 63;
64
24.5k
  use_stdin = data[0] & 64;
65
24.5k
  size_left--;
66
67
24.5k
  alloc_check_counter = 0;
68
24.5k
  if(data[0] & 128) {
69
2.07k
    alloc_check_keep_failing = data[1] & 1;
70
2.07k
    alloc_check_threshold = data[1] >> 1;
71
2.07k
    size_left--;
72
2.07k
  }
73
22.4k
  else
74
22.4k
    alloc_check_threshold = INT32_MAX;
75
76
24.5k
  argv[0] = exename;
77
24.5k
  numarg++;
78
79
  /* Check whether input is zero delimited */
80
221k
  while((arglen = strnlen((char *)data+(size-size_left),size_left)) < size_left && numarg < maxarg) {
81
197k
    argv[numarg++] = (char *)data+(size-size_left);
82
197k
    size_left -= arglen + 1;
83
197k
  }
84
85
24.5k
  file_to_fuzz = mkstemp(filename);
86
87
24.5k
  if (file_to_fuzz < 0)
88
0
    abort();
89
24.5k
  write(file_to_fuzz,data+(size-size_left),size_left);
90
24.5k
  close(file_to_fuzz);
91
92
  /* redirect stdout */
93
24.5k
  fflush(stdout);
94
24.5k
  fgetpos(stdout,&pos_stdout);
95
24.5k
  tmp_stdout = dup(fileno(stdout));
96
24.5k
  freopen("/dev/null","w",stdout);
97
98
  /* redirect stdin */
99
24.5k
  tmp_stdin = dup(fileno(stdin));
100
101
24.5k
  if(use_stdin)
102
2.61k
    freopen(filename,"r",stdin);
103
21.9k
  else {
104
21.9k
    freopen("/dev/null","r",stdin);
105
21.9k
    argv[numarg++] = filename;
106
21.9k
  }
107
108
24.5k
  main_to_fuzz(numarg,argv);
109
110
  /* restore stdout */
111
24.5k
  fflush(stdout);
112
24.5k
  dup2(tmp_stdout, fileno(stdout));
113
24.5k
  close(tmp_stdout);
114
24.5k
  clearerr(stdout);
115
24.5k
  fsetpos(stdout,&pos_stdout);
116
117
  /* restore stdin */
118
24.5k
  dup2(tmp_stdin, fileno(stdin));
119
24.5k
  close(tmp_stdin);
120
24.5k
  clearerr(stdin);
121
122
24.5k
  unlink(filename);
123
124
24.5k
  return 0;
125
24.5k
}
126