Coverage Report

Created: 2026-07-10 07:32

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libqcow/ossfuzz/file_fuzzer.cc
Line
Count
Source
1
/*
2
 * OSS-Fuzz target for libqcow file type
3
 *
4
 * Copyright (C) 2010-2026, Joachim Metz <joachim.metz@gmail.com>
5
 *
6
 * Refer to AUTHORS for acknowledgements.
7
 *
8
 * This program is free software: you can redistribute it and/or modify
9
 * it under the terms of the GNU Lesser General Public License as published by
10
 * the Free Software Foundation, either version 3 of the License, or
11
 * (at your option) any later version.
12
 *
13
 * This program is distributed in the hope that it will be useful,
14
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16
 * GNU General Public License for more details.
17
 *
18
 * You should have received a copy of the GNU Lesser General Public License
19
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
20
 */
21
22
#include <stddef.h>
23
#include <stdint.h>
24
25
/* Note that some of the OSS-Fuzz engines use C++
26
 */
27
extern "C" {
28
29
#include "ossfuzz_libbfio.h"
30
#include "ossfuzz_libqcow.h"
31
32
#if !defined( LIBQCOW_HAVE_BFIO )
33
34
/* Opens a file using a Basic File IO (bfio) handle
35
 * Returns 1 if successful or -1 on error
36
 */
37
LIBQCOW_EXTERN \
38
int libqcow_file_open_file_io_handle(
39
     libqcow_file_t *file,
40
     libbfio_handle_t *file_io_handle,
41
     int access_flags,
42
     libqcow_error_t **error );
43
44
#endif /* !defined( LIBQCOW_HAVE_BFIO ) */
45
46
int LLVMFuzzerTestOneInput(
47
     const uint8_t *data,
48
     size_t size )
49
2.36k
{
50
2.36k
  uint8_t buffer[ 512 ];
51
2.36k
  uint8_t utf8_string[ 64 ];
52
2.36k
  uint16_t utf16_string[ 64 ];
53
54
2.36k
  libbfio_handle_t *file_io_handle = NULL;
55
2.36k
  libqcow_file_t *file             = NULL;
56
2.36k
  off64_t media_offset             = 0;
57
2.36k
  size64_t media_size              = 0;
58
2.36k
  size_t string_size               = 0;
59
2.36k
  uint32_t value_32bit             = 0;
60
2.36k
  int number_of_snapshots          = 0;
61
2.36k
  int read_iterator                = 0;
62
63
2.36k
  if( libbfio_memory_range_initialize(
64
2.36k
       &file_io_handle,
65
2.36k
       NULL ) != 1 )
66
0
  {
67
0
    return( 0 );
68
0
  }
69
2.36k
  if( libbfio_memory_range_set(
70
2.36k
       file_io_handle,
71
2.36k
       (uint8_t *) data,
72
2.36k
       size,
73
2.36k
       NULL ) != 1 )
74
0
  {
75
0
    goto on_error_libbfio;
76
0
  }
77
2.36k
  if( libqcow_file_initialize(
78
2.36k
       &file,
79
2.36k
       NULL ) != 1 )
80
0
  {
81
0
    goto on_error_libbfio;
82
0
  }
83
2.36k
  if( libqcow_file_open_file_io_handle(
84
2.36k
       file,
85
2.36k
       file_io_handle,
86
2.36k
       LIBQCOW_OPEN_READ,
87
2.36k
       NULL ) != 1 )
88
1.00k
  {
89
1.00k
    goto on_error_libqcow;
90
1.00k
  }
91
1.36k
  if( libqcow_file_get_format_version(
92
1.36k
       file,
93
1.36k
       &value_32bit,
94
1.36k
       NULL ) != 1 )
95
0
  {
96
0
    goto on_error_libqcow;
97
0
  }
98
1.36k
  if( libqcow_file_get_encryption_method(
99
1.36k
       file,
100
1.36k
       &value_32bit,
101
1.36k
       NULL ) != 1 )
102
0
  {
103
0
    goto on_error_libqcow;
104
0
  }
105
1.36k
  if( libqcow_file_get_utf8_backing_filename_size(
106
1.36k
       file,
107
1.36k
       &string_size,
108
1.36k
       NULL ) == -1 )
109
90
  {
110
90
    goto on_error_libqcow;
111
90
  }
112
1.27k
  if( libqcow_file_get_utf8_backing_filename(
113
1.27k
       file,
114
1.27k
       utf8_string,
115
1.27k
       64,
116
1.27k
       NULL ) == -1 )
117
29
  {
118
29
    goto on_error_libqcow;
119
29
  }
120
1.24k
  if( libqcow_file_get_utf16_backing_filename_size(
121
1.24k
       file,
122
1.24k
       &string_size,
123
1.24k
       NULL ) == -1 )
124
0
  {
125
0
    goto on_error_libqcow;
126
0
  }
127
1.24k
  if( libqcow_file_get_utf16_backing_filename(
128
1.24k
       file,
129
1.24k
       utf16_string,
130
1.24k
       64,
131
1.24k
       NULL ) == -1 )
132
0
  {
133
0
    goto on_error_libqcow;
134
0
  }
135
1.24k
  if( libqcow_file_get_number_of_snapshots(
136
1.24k
       file,
137
1.24k
       &number_of_snapshots,
138
1.24k
       NULL ) != 1 )
139
0
  {
140
0
    goto on_error_libqcow;
141
0
  }
142
1.24k
  if( libqcow_file_get_media_size(
143
1.24k
       file,
144
1.24k
       &media_size,
145
1.24k
       NULL ) != 1 )
146
0
  {
147
0
    goto on_error_libqcow;
148
0
  }
149
1.24k
  for( read_iterator = 0;
150
14.3k
       read_iterator < 128;
151
13.1k
       read_iterator++ )
152
14.3k
  {
153
14.3k
    if( media_offset >= media_size )
154
55
    {
155
55
      break;
156
55
    }
157
14.3k
    if( libqcow_file_read_buffer_at_offset(
158
14.3k
         file,
159
14.3k
         buffer,
160
14.3k
         497,
161
14.3k
         media_offset,
162
14.3k
         NULL ) == -1 )
163
1.15k
    {
164
1.15k
      goto on_error_libqcow;
165
1.15k
    }
166
13.1k
    media_offset += 497;
167
13.1k
  }
168
91
  libqcow_file_close(
169
91
   file,
170
91
   NULL );
171
172
2.36k
on_error_libqcow:
173
2.36k
  libqcow_file_free(
174
2.36k
   &file,
175
2.36k
   NULL );
176
177
2.36k
on_error_libbfio:
178
2.36k
  libbfio_handle_free(
179
2.36k
   &file_io_handle,
180
2.36k
   NULL );
181
182
2.36k
  return( 0 );
183
2.36k
}
184
185
} /* extern "C" */
186