Coverage Report

Created: 2025-12-14 06:20

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/flac/oss-fuzz/tool_metaflac.c
Line
Count
Source
1
/* fuzzer_tool_flac
2
 * Copyright (C) 2023-2025  Xiph.Org Foundation
3
 *
4
 * Redistribution and use in source and binary forms, with or without
5
 * modification, are permitted provided that the following conditions
6
 * are met:
7
 *
8
 * - Redistributions of source code must retain the above copyright
9
 * notice, this list of conditions and the following disclaimer.
10
 *
11
 * - Redistributions in binary form must reproduce the above copyright
12
 * notice, this list of conditions and the following disclaimer in the
13
 * documentation and/or other materials provided with the distribution.
14
 *
15
 * - Neither the name of the Xiph.org Foundation nor the names of its
16
 * contributors may be used to endorse or promote products derived from
17
 * this software without specific prior written permission.
18
 *
19
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
22
 * A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR
23
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
26
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
27
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
28
 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
29
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30
 */
31
32
#include <stdio.h>
33
#include <stdlib.h>
34
#include <string.h> /* for memcpy */
35
#define FUZZ_TOOL_METAFLAC
36
#define fprintf(...)
37
#define printf(...)
38
#include "../src/metaflac/main.c"
39
#include "common.h"
40
41
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
42
43
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
44
15.0k
{
45
15.0k
  size_t size_left = size;
46
15.0k
  size_t arglen;
47
15.0k
  char * argv[64];
48
15.0k
  char exename[] = "metaflac";
49
15.0k
  char filename[] = "/tmp/fuzzXXXXXX";
50
15.0k
  char filename_stdin[] = "/tmp/fuzzXXXXXX";
51
15.0k
  int numarg = 0, maxarg;
52
15.0k
  int file_to_fuzz;
53
15.0k
  int tmp_stdout, tmp_stdin;
54
15.0k
  fpos_t pos_stdout;
55
15.0k
  bool use_stdin = false;
56
57
15.0k
  share__opterr = 0;
58
15.0k
  share__optind = 0;
59
60
61
15.0k
  if(size < 2)
62
1
    return 0;
63
64
15.0k
  maxarg = data[0] & 15;
65
15.0k
  use_stdin = data[0] & 16;
66
15.0k
  size_left--;
67
68
15.0k
  argv[0] = exename;
69
15.0k
  numarg++;
70
71
  /* Check whether input is zero delimited */
72
70.1k
  while((arglen = strnlen((char *)data+(size-size_left),size_left)) < size_left && numarg < maxarg) {
73
55.1k
    argv[numarg++] = (char *)data+(size-size_left);
74
55.1k
    size_left -= arglen + 1;
75
55.1k
  }
76
77
  /* Create file to feed directly */
78
15.0k
  file_to_fuzz = mkstemp(filename);
79
15.0k
  if (file_to_fuzz < 0)
80
0
    abort();
81
15.0k
  if(use_stdin) {
82
1.42k
    write(file_to_fuzz,data+(size-size_left),size_left/2);
83
1.42k
    size_left -= size_left/2;
84
1.42k
  }
85
13.5k
  else
86
13.5k
    write(file_to_fuzz,data+(size-size_left),size_left);
87
15.0k
  close(file_to_fuzz);
88
89
15.0k
  argv[numarg++] = filename;
90
91
  /* Create file to feed to stdin */
92
15.0k
  if(use_stdin) {
93
1.42k
    file_to_fuzz = mkstemp(filename_stdin);
94
1.42k
    if (file_to_fuzz < 0)
95
0
      abort();
96
1.42k
    write(file_to_fuzz,data+(size-size_left),size_left);
97
1.42k
    close(file_to_fuzz);
98
1.42k
  }
99
100
  /* redirect stdout */
101
15.0k
  fflush(stdout);
102
15.0k
  fgetpos(stdout,&pos_stdout);
103
15.0k
  tmp_stdout = dup(fileno(stdout));
104
15.0k
  freopen("/dev/null","w",stdout);
105
106
  /* redirect stdin */
107
15.0k
  tmp_stdin = dup(fileno(stdin));
108
15.0k
  if(use_stdin)
109
1.42k
    freopen(filename_stdin,"r",stdin);
110
13.5k
  else {
111
13.5k
    freopen("/dev/null","r",stdin);
112
13.5k
    argv[numarg++] = filename;
113
13.5k
  }
114
115
15.0k
  main_to_fuzz(numarg,argv);
116
117
  /* restore stdout */
118
15.0k
  fflush(stdout);
119
15.0k
  dup2(tmp_stdout, fileno(stdout));
120
15.0k
  close(tmp_stdout);
121
15.0k
  clearerr(stdout);
122
15.0k
  fsetpos(stdout,&pos_stdout);
123
124
  /* restore stdin */
125
15.0k
  dup2(tmp_stdin, fileno(stdin));
126
15.0k
  close(tmp_stdin);
127
15.0k
  clearerr(stdin);
128
129
15.0k
  unlink(filename);
130
131
15.0k
  if(use_stdin)
132
1.42k
    unlink(filename_stdin);
133
134
15.0k
  return 0;
135
15.0k
}
136