/src/libcups/ossfuzz/fuzzipp.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | Copyright The libcups Developers. |
3 | | Licensed under the Apache License, Version 2.0 (the "License"); |
4 | | you may not use this file except in compliance with the License. |
5 | | You may obtain a copy of the License at |
6 | | http://www.apache.org/licenses/LICENSE-2.0 |
7 | | Unless required by applicable law or agreed to in writing, software |
8 | | distributed under the License is distributed on an "AS IS" BASIS, |
9 | | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
10 | | See the License for the specific language governing permissions and |
11 | | limitations under the License. |
12 | | */ |
13 | | |
14 | | #include "file.h" |
15 | | #include "string-private.h" |
16 | | #include "ipp-private.h" |
17 | | #include "test-internal.h" |
18 | | #include <spawn.h> |
19 | | #include <sys/wait.h> |
20 | | |
21 | | typedef struct _ippdata_t |
22 | | { |
23 | | size_t rpos, // Read position |
24 | | wused, // Bytes used |
25 | | wsize; // Max size of buffer |
26 | | ipp_uchar_t *wbuffer; // Buffer |
27 | | } _ippdata_t; |
28 | | |
29 | | ssize_t write_cb(_ippdata_t *data, ipp_uchar_t *buffer, size_t bytes); |
30 | | |
31 | | // 'write_cb()' - Write data into a buffer. |
32 | | ssize_t // O - Number of bytes written |
33 | | write_cb(_ippdata_t *data, // I - Data |
34 | | ipp_uchar_t *buffer, // I - Buffer to write |
35 | | size_t bytes) // I - Number of bytes to write |
36 | 10.7k | { |
37 | 10.7k | size_t count; // Number of bytes |
38 | | |
39 | | // Loop until all bytes are written... |
40 | 10.7k | if ((count = data->wsize - data->wused) > bytes) |
41 | 10.7k | count = bytes; |
42 | | |
43 | 10.7k | memcpy(data->wbuffer + data->wused, buffer, count); |
44 | 10.7k | data->wused += count; |
45 | | |
46 | | // Return the number of bytes written... |
47 | 10.7k | return ((ssize_t)count); |
48 | 10.7k | } |
49 | | |
50 | 2.70k | extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size){ |
51 | | |
52 | 2.70k | if (Size == 0 || Size > 262144) { |
53 | 5 | return 0; // Handle empty input gracefully |
54 | 5 | } // Handle large input gracefully (limiting to 262144 bytes for now |
55 | | |
56 | 2.69k | int status = 0; |
57 | 2.69k | cups_file_t *fp; |
58 | 2.69k | ipp_state_t state; |
59 | 2.69k | ipp_t *request; |
60 | 2.69k | ipp_uchar_t buffer[262144]; |
61 | | |
62 | 2.69k | request = ippNewRequest(IPP_OP_PRINT_JOB); // Create a new IPP request (operation type is IPP_OP_PRINT_JOB |
63 | 2.69k | _ippdata_t ippdata; |
64 | 2.69k | ippdata.wused = 0; |
65 | 2.69k | ippdata.wsize = sizeof(buffer); |
66 | 2.69k | ippdata.wbuffer = buffer; |
67 | | |
68 | | // create new ipp |
69 | | |
70 | 2.69k | while ((state = ippWriteIO(&ippdata, (ipp_io_cb_t)write_cb, 1, NULL, |
71 | 2.69k | request)) != IPP_STATE_DATA) |
72 | 0 | { |
73 | 0 | if (state == IPP_STATE_ERROR) |
74 | 0 | break; |
75 | 0 | } |
76 | 2.69k | if (state != IPP_STATE_DATA) |
77 | 0 | { |
78 | 0 | status = 1; |
79 | 0 | } |
80 | | |
81 | 2.69k | ippDelete(request); |
82 | | |
83 | | // testing writing |
84 | 2.69k | memcpy((char *)ippdata.wbuffer, (char *)Data, Size); |
85 | 2.69k | ippdata.wused = Size; |
86 | | |
87 | 2.69k | const char *filename = "/tmp/tmp.ipp"; |
88 | | |
89 | 2.69k | if ((fp = cupsFileOpen(filename, "w")) == NULL) |
90 | 0 | { |
91 | 0 | return 1; |
92 | 0 | } |
93 | | |
94 | 2.69k | cupsFileWrite(fp, (char *)buffer, ippdata.wused); |
95 | 2.69k | cupsFileClose(fp); |
96 | | |
97 | | // Testing Reading |
98 | 2.69k | if ((fp = cupsFileOpen(filename, "r")) == NULL) |
99 | 0 | { |
100 | 0 | return 1; |
101 | 0 | } |
102 | | |
103 | 2.69k | request = ippNew(); |
104 | | |
105 | 2.69k | do |
106 | 2.69k | { |
107 | 2.69k | state = ippReadIO(fp, (ipp_io_cb_t)cupsFileRead, 1, NULL, request); |
108 | 2.69k | } |
109 | 2.69k | while (state == IPP_STATE_ATTRIBUTE); |
110 | | |
111 | 2.69k | cupsFileClose(fp); |
112 | | |
113 | 2.69k | fp = cupsFileOpen("/dev/null", "w"); |
114 | | |
115 | 2.69k | ippSetState(request, IPP_STATE_IDLE); |
116 | | |
117 | 2.69k | do |
118 | 2.69k | { |
119 | 2.69k | state = ippWriteIO(fp, (ipp_io_cb_t)cupsFileWrite, 1, NULL, request); |
120 | 2.69k | } |
121 | 2.69k | while (state == IPP_STATE_ATTRIBUTE); |
122 | | |
123 | 2.69k | cupsFileClose(fp); |
124 | 2.69k | ippDelete(request); |
125 | | |
126 | | // clean up file |
127 | 2.69k | unlink(filename); |
128 | 2.69k | return status; |
129 | 2.69k | } |