/src/lzma-fuzz/lzmadec_fuzzer.cc
Line | Count | Source (jump to first uncovered line) |
1 | | /** |
2 | | * |
3 | | * @copyright Copyright (c) 2019 Joachim Bauch <mail@joachim-bauch.de> |
4 | | * |
5 | | * @license GNU GPL version 3 or any later version |
6 | | * |
7 | | * This program is free software: you can redistribute it and/or modify |
8 | | * it under the terms of the GNU General Public License as published by |
9 | | * the Free Software Foundation, either version 3 of the License, or |
10 | | * (at your option) any later version. |
11 | | * |
12 | | * This program is distributed in the hope that it will be useful, |
13 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
14 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
15 | | * GNU General Public License for more details. |
16 | | * |
17 | | * You should have received a copy of the GNU General Public License |
18 | | * along with this program. If not, see <https://www.gnu.org/licenses/>. |
19 | | * |
20 | | */ |
21 | | |
22 | | #include <stdint.h> |
23 | | #include <stdlib.h> |
24 | | #include <string.h> |
25 | | |
26 | | #include "LzmaDec.h" |
27 | | |
28 | | #include "common-alloc.h" |
29 | | |
30 | | static const size_t kBufferSize = 8192; |
31 | | |
32 | | static const size_t kMaxDictionarySize = 32 * 1024 * 1024; |
33 | | |
34 | | // Limit maximum size to avoid running into timeouts with too large data. |
35 | | static const size_t kMaxInputSize = 100 * 1024; |
36 | | |
37 | 4.77k | extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
38 | 4.77k | if (size < LZMA_PROPS_SIZE || size > kMaxInputSize) { |
39 | 8 | return 0; |
40 | 8 | } |
41 | | |
42 | 4.77k | CLzmaProps props; |
43 | 4.77k | if (LzmaProps_Decode(&props, data, LZMA_PROPS_SIZE) != SZ_OK) { |
44 | 3 | return 0; |
45 | 3 | } |
46 | | |
47 | | // Avoid using too much memory. |
48 | 4.76k | if (props.dicSize > kMaxDictionarySize) { |
49 | 26 | return 0; |
50 | 26 | } |
51 | | |
52 | 4.74k | CLzmaDec dec; |
53 | 4.74k | LzmaDec_Construct(&dec); |
54 | 4.74k | if (LzmaDec_Allocate(&dec, data, LZMA_PROPS_SIZE, &CommonAlloc) != SZ_OK) { |
55 | 0 | return 0; |
56 | 0 | } |
57 | | |
58 | 4.74k | data += LZMA_PROPS_SIZE; |
59 | 4.74k | size -= LZMA_PROPS_SIZE; |
60 | | |
61 | 4.74k | LzmaDec_Init(&dec); |
62 | 240k | while (size > 0) { |
63 | 240k | Byte buf[kBufferSize]; |
64 | 240k | SRes res; |
65 | 240k | SizeT srcLen = size; |
66 | 240k | SizeT destLen = kBufferSize; |
67 | 240k | ELzmaStatus status; |
68 | 240k | res = LzmaDec_DecodeToBuf(&dec, buf, &destLen, data, &srcLen, |
69 | 240k | LZMA_FINISH_ANY, &status); |
70 | 240k | if (res != SZ_OK || status == LZMA_STATUS_FINISHED_WITH_MARK || |
71 | 240k | status == LZMA_STATUS_NEEDS_MORE_INPUT) { |
72 | 4.54k | goto exit; |
73 | 4.54k | } |
74 | | |
75 | 235k | size -= srcLen; |
76 | 235k | data += srcLen; |
77 | 235k | } |
78 | | |
79 | 4.74k | exit: |
80 | 4.74k | LzmaDec_Free(&dec, &CommonAlloc); |
81 | 4.74k | return 0; |
82 | 4.74k | } |