/src/libewf/ossfuzz/handle_fuzzer.cc
Line | Count | Source |
1 | | /* |
2 | | * OSS-Fuzz target for libewf file type |
3 | | * |
4 | | * Copyright (C) 2006-2026, Joachim Metz <joachim.metz@gmail.com> |
5 | | * |
6 | | * Refer to AUTHORS for acknowledgements. |
7 | | * |
8 | | * This program is free software: you can redistribute it and/or modify |
9 | | * it under the terms of the GNU Lesser General Public License as published by |
10 | | * the Free Software Foundation, either version 3 of the License, or |
11 | | * (at your option) any later version. |
12 | | * |
13 | | * This program is distributed in the hope that it will be useful, |
14 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
15 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
16 | | * GNU General Public License for more details. |
17 | | * |
18 | | * You should have received a copy of the GNU Lesser General Public License |
19 | | * along with this program. If not, see <https://www.gnu.org/licenses/>. |
20 | | */ |
21 | | |
22 | | #include <stddef.h> |
23 | | #include <stdint.h> |
24 | | |
25 | | /* Note that some of the OSS-Fuzz engines use C++ |
26 | | */ |
27 | | extern "C" { |
28 | | |
29 | | #include "ossfuzz_libbfio.h" |
30 | | #include "ossfuzz_libewf.h" |
31 | | |
32 | | #if !defined( LIBEWF_HAVE_BFIO ) |
33 | | |
34 | | /* Opens a set of EWF file(s) using a Basic File IO (bfio) pool |
35 | | * Returns 1 if successful or -1 on error |
36 | | */ |
37 | | LIBEWF_EXTERN \ |
38 | | int libewf_handle_open_file_io_pool( |
39 | | libewf_handle_t *handle, |
40 | | libbfio_pool_t *file_io_pool, |
41 | | int access_flags, |
42 | | libewf_error_t **error ); |
43 | | |
44 | | #endif /* !defined( LIBEWF_HAVE_BFIO ) */ |
45 | | |
46 | | int LLVMFuzzerTestOneInput( |
47 | | const uint8_t *data, |
48 | | size_t size ) |
49 | 3.32k | { |
50 | 3.32k | uint8_t buffer[ 512 ]; |
51 | 3.32k | uint8_t guid[ 16 ]; |
52 | | |
53 | 3.32k | libbfio_handle_t *file_io_handle = NULL; |
54 | 3.32k | libbfio_pool_t *file_io_pool = NULL; |
55 | 3.32k | libewf_handle_t *handle = NULL; |
56 | 3.32k | off64_t media_offset = 0; |
57 | 3.32k | size64_t media_size = 0; |
58 | 3.32k | uint64_t value_64bit = 0; |
59 | 3.32k | uint32_t value_32bit = 0; |
60 | 3.32k | uint16_t value_16bit = 0; |
61 | 3.32k | uint8_t major_version = 0; |
62 | 3.32k | uint8_t minor_version = 0; |
63 | 3.32k | uint8_t value_8bit = 0; |
64 | 3.32k | int8_t compression_level = 0; |
65 | 3.32k | int entry_index = 0; |
66 | 3.32k | int read_iterator = 0; |
67 | | |
68 | 3.32k | if( libbfio_memory_range_initialize( |
69 | 3.32k | &file_io_handle, |
70 | 3.32k | NULL ) != 1 ) |
71 | 0 | { |
72 | 0 | return( 0 ); |
73 | 0 | } |
74 | 3.32k | if( libbfio_memory_range_set( |
75 | 3.32k | file_io_handle, |
76 | 3.32k | (uint8_t *) data, |
77 | 3.32k | size, |
78 | 3.32k | NULL ) != 1 ) |
79 | 0 | { |
80 | 0 | goto on_error_libbfio; |
81 | 0 | } |
82 | 3.32k | if( libbfio_pool_initialize( |
83 | 3.32k | &file_io_pool, |
84 | 3.32k | 0, |
85 | 3.32k | 0, |
86 | 3.32k | NULL ) != 1 ) |
87 | 0 | { |
88 | 0 | goto on_error_libbfio; |
89 | 0 | } |
90 | 3.32k | if( libbfio_pool_append_handle( |
91 | 3.32k | file_io_pool, |
92 | 3.32k | &entry_index, |
93 | 3.32k | file_io_handle, |
94 | 3.32k | LIBBFIO_OPEN_READ, |
95 | 3.32k | NULL ) != 1 ) |
96 | 0 | { |
97 | 0 | goto on_error_libbfio; |
98 | 0 | } |
99 | | /* The file IO pool takes over management of the file IO handle |
100 | | */ |
101 | 3.32k | file_io_handle = NULL; |
102 | | |
103 | 3.32k | if( libewf_handle_initialize( |
104 | 3.32k | &handle, |
105 | 3.32k | NULL ) != 1 ) |
106 | 0 | { |
107 | 0 | goto on_error_libbfio; |
108 | 0 | } |
109 | 3.32k | if( libewf_handle_open_file_io_pool( |
110 | 3.32k | handle, |
111 | 3.32k | file_io_pool, |
112 | 3.32k | LIBEWF_OPEN_READ, |
113 | 3.32k | NULL ) != 1 ) |
114 | 2.15k | { |
115 | 2.15k | goto on_error_libewf; |
116 | 2.15k | } |
117 | 1.16k | if( libewf_handle_segment_files_corrupted( |
118 | 1.16k | handle, |
119 | 1.16k | NULL ) == -1 ) |
120 | 0 | { |
121 | 0 | goto on_error_libewf; |
122 | 0 | } |
123 | 1.16k | if( libewf_handle_segment_files_encrypted( |
124 | 1.16k | handle, |
125 | 1.16k | NULL ) == -1 ) |
126 | 0 | { |
127 | 0 | goto on_error_libewf; |
128 | 0 | } |
129 | 1.16k | if( libewf_handle_get_bytes_per_sector( |
130 | 1.16k | handle, |
131 | 1.16k | &value_32bit, |
132 | 1.16k | NULL ) != 1 ) |
133 | 0 | { |
134 | 0 | goto on_error_libewf; |
135 | 0 | } |
136 | 1.16k | if( libewf_handle_get_sectors_per_chunk( |
137 | 1.16k | handle, |
138 | 1.16k | &value_32bit, |
139 | 1.16k | NULL ) != 1 ) |
140 | 0 | { |
141 | 0 | goto on_error_libewf; |
142 | 0 | } |
143 | 1.16k | if( libewf_handle_get_number_of_sectors( |
144 | 1.16k | handle, |
145 | 1.16k | &value_64bit, |
146 | 1.16k | NULL ) != 1 ) |
147 | 1 | { |
148 | 1 | goto on_error_libewf; |
149 | 1 | } |
150 | 1.16k | if( libewf_handle_get_chunk_size( |
151 | 1.16k | handle, |
152 | 1.16k | (size32_t *) &value_32bit, |
153 | 1.16k | NULL ) != 1 ) |
154 | 0 | { |
155 | 0 | goto on_error_libewf; |
156 | 0 | } |
157 | 1.16k | if( libewf_handle_get_error_granularity( |
158 | 1.16k | handle, |
159 | 1.16k | &value_32bit, |
160 | 1.16k | NULL ) != 1 ) |
161 | 0 | { |
162 | 0 | goto on_error_libewf; |
163 | 0 | } |
164 | 1.16k | if( libewf_handle_get_compression_method( |
165 | 1.16k | handle, |
166 | 1.16k | &value_16bit, |
167 | 1.16k | NULL ) != 1 ) |
168 | 0 | { |
169 | 0 | goto on_error_libewf; |
170 | 0 | } |
171 | 1.16k | if( libewf_handle_get_compression_values( |
172 | 1.16k | handle, |
173 | 1.16k | &compression_level, |
174 | 1.16k | &value_8bit, |
175 | 1.16k | NULL ) != 1 ) |
176 | 0 | { |
177 | 0 | goto on_error_libewf; |
178 | 0 | } |
179 | 1.16k | if( libewf_handle_get_media_type( |
180 | 1.16k | handle, |
181 | 1.16k | &value_8bit, |
182 | 1.16k | NULL ) != 1 ) |
183 | 0 | { |
184 | 0 | goto on_error_libewf; |
185 | 0 | } |
186 | 1.16k | if( libewf_handle_get_media_flags( |
187 | 1.16k | handle, |
188 | 1.16k | &value_8bit, |
189 | 1.16k | NULL ) != 1 ) |
190 | 1 | { |
191 | 1 | goto on_error_libewf; |
192 | 1 | } |
193 | 1.16k | if( libewf_handle_get_format( |
194 | 1.16k | handle, |
195 | 1.16k | &value_8bit, |
196 | 1.16k | NULL ) != 1 ) |
197 | 0 | { |
198 | 0 | goto on_error_libewf; |
199 | 0 | } |
200 | 1.16k | if( libewf_handle_get_segment_file_version( |
201 | 1.16k | handle, |
202 | 1.16k | &major_version, |
203 | 1.16k | &minor_version, |
204 | 1.16k | NULL ) != 1 ) |
205 | 0 | { |
206 | 0 | goto on_error_libewf; |
207 | 0 | } |
208 | 1.16k | if( libewf_handle_get_segment_file_set_identifier( |
209 | 1.16k | handle, |
210 | 1.16k | guid, |
211 | 1.16k | 16, |
212 | 1.16k | NULL ) != 1 ) |
213 | 0 | { |
214 | 0 | goto on_error_libewf; |
215 | 0 | } |
216 | 1.16k | if( libewf_handle_get_md5_hash( |
217 | 1.16k | handle, |
218 | 1.16k | buffer, |
219 | 1.16k | 16, |
220 | 1.16k | NULL ) != 1 ) |
221 | 1.16k | { |
222 | 1.16k | goto on_error_libewf; |
223 | 1.16k | } |
224 | 3 | if( libewf_handle_get_sha1_hash( |
225 | 3 | handle, |
226 | 3 | buffer, |
227 | 3 | 20, |
228 | 3 | NULL ) != 1 ) |
229 | 3 | { |
230 | 3 | goto on_error_libewf; |
231 | 3 | } |
232 | 0 | if( libewf_handle_get_number_of_acquiry_errors( |
233 | 0 | handle, |
234 | 0 | &value_32bit, |
235 | 0 | NULL ) != 1 ) |
236 | 0 | { |
237 | 0 | goto on_error_libewf; |
238 | 0 | } |
239 | 0 | if( libewf_handle_get_number_of_sessions( |
240 | 0 | handle, |
241 | 0 | &value_32bit, |
242 | 0 | NULL ) != 1 ) |
243 | 0 | { |
244 | 0 | goto on_error_libewf; |
245 | 0 | } |
246 | 0 | if( libewf_handle_get_number_of_tracks( |
247 | 0 | handle, |
248 | 0 | &value_32bit, |
249 | 0 | NULL ) != 1 ) |
250 | 0 | { |
251 | 0 | goto on_error_libewf; |
252 | 0 | } |
253 | 0 | if( libewf_handle_get_media_size( |
254 | 0 | handle, |
255 | 0 | &media_size, |
256 | 0 | NULL ) != 1 ) |
257 | 0 | { |
258 | 0 | goto on_error_libewf; |
259 | 0 | } |
260 | 0 | for( read_iterator = 0; |
261 | 0 | read_iterator < 128; |
262 | 0 | read_iterator++ ) |
263 | 0 | { |
264 | 0 | if( media_offset >= media_size ) |
265 | 0 | { |
266 | 0 | break; |
267 | 0 | } |
268 | 0 | if( libewf_handle_read_buffer_at_offset( |
269 | 0 | handle, |
270 | 0 | buffer, |
271 | 0 | 497, |
272 | 0 | media_offset, |
273 | 0 | NULL ) == -1 ) |
274 | 0 | { |
275 | 0 | goto on_error_libewf; |
276 | 0 | } |
277 | 0 | media_offset += 497; |
278 | 0 | } |
279 | 0 | if( libewf_handle_get_number_of_checksum_errors( |
280 | 0 | handle, |
281 | 0 | &value_32bit, |
282 | 0 | NULL ) != 1 ) |
283 | 0 | { |
284 | 0 | goto on_error_libewf; |
285 | 0 | } |
286 | 0 | libewf_handle_close( |
287 | 0 | handle, |
288 | 0 | NULL ); |
289 | |
|
290 | 3.32k | on_error_libewf: |
291 | 3.32k | libewf_handle_free( |
292 | 3.32k | &handle, |
293 | 3.32k | NULL ); |
294 | | |
295 | 3.32k | on_error_libbfio: |
296 | | /* Note that on error the handle still has a reference to file_io_pool |
297 | | * that will be closed. Therefore the file IO pool and handle need to |
298 | | * be freed after closing or freeing the handle. |
299 | | */ |
300 | 3.32k | if( file_io_pool != NULL ) |
301 | 3.32k | { |
302 | 3.32k | libbfio_pool_free( |
303 | 3.32k | &file_io_pool, |
304 | 3.32k | NULL ); |
305 | 3.32k | } |
306 | 3.32k | if( file_io_handle != NULL ) |
307 | 0 | { |
308 | 0 | libbfio_handle_free( |
309 | 0 | &file_io_handle, |
310 | | NULL ); |
311 | 0 | } |
312 | 3.32k | return( 0 ); |
313 | 3.32k | } |
314 | | |
315 | | } /* extern "C" */ |
316 | | |