Coverage Report

Created: 2026-01-25 06:58

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/miniz/tests/small_fuzzer.c
Line
Count
Source
1
/* Derived from zlib fuzzers at http://github.com/google/oss-fuzz/tree/master/projects/zlib,
2
 * see ossfuzz.sh for full license text.
3
 */
4
5
#include <stdio.h>
6
#include <stddef.h>
7
#include <stdint.h>
8
#include <string.h>
9
#include <stdlib.h>
10
#include <inttypes.h>
11
12
#include "miniz.h"
13
14
#define CHECK_ERR(err, msg)                              \
15
633M
    {                                                    \
16
633M
        if (err != Z_OK)                                 \
17
633M
        {                                                \
18
0
            fprintf(stderr, "%s error: %d\n", msg, err); \
19
0
            exit(1);                                     \
20
0
        }                                                \
21
633M
    }
22
23
static const uint8_t *data;
24
static size_t dataLen;
25
static alloc_func zalloc = NULL;
26
static free_func zfree = NULL;
27
28
/* Test deflate() with small buffers */
29
void test_deflate(unsigned char *compr, size_t comprLen)
30
2.28k
{
31
2.28k
    z_stream c_stream; /* compression stream */
32
2.28k
    int err;
33
2.28k
    unsigned long len = dataLen;
34
35
2.28k
    c_stream.zalloc = zalloc;
36
2.28k
    c_stream.zfree = zfree;
37
2.28k
    c_stream.opaque = NULL;
38
39
2.28k
    err = deflateInit(&c_stream, Z_DEFAULT_COMPRESSION);
40
2.28k
    CHECK_ERR(err, "deflateInit");
41
42
2.28k
    c_stream.next_in = (Bytef *)data;
43
2.28k
    c_stream.next_out = compr;
44
45
384M
    while (c_stream.total_in != len && c_stream.total_out < comprLen)
46
384M
    {
47
384M
        c_stream.avail_in = c_stream.avail_out = 1; /* force small buffers */
48
384M
        err = deflate(&c_stream, Z_NO_FLUSH);
49
384M
        CHECK_ERR(err, "deflate small 1");
50
384M
    }
51
52
    /* Finish the stream, still forcing small buffers: */
53
2.28k
    for (;;)
54
17.0M
    {
55
17.0M
        c_stream.avail_out = 1;
56
17.0M
        err = deflate(&c_stream, Z_FINISH);
57
17.0M
        if (err == Z_STREAM_END)
58
2.28k
            break;
59
17.0M
        CHECK_ERR(err, "deflate small 2");
60
17.0M
    }
61
62
2.28k
    err = deflateEnd(&c_stream);
63
2.28k
    CHECK_ERR(err, "deflateEnd");
64
2.28k
}
65
66
/* Test inflate() with small buffers */
67
void test_inflate(unsigned char *compr, size_t comprLen, unsigned char *uncompr, size_t uncomprLen)
68
2.28k
{
69
2.28k
    int err;
70
2.28k
    z_stream d_stream; /* decompression stream */
71
72
2.28k
    d_stream.zalloc = zalloc;
73
2.28k
    d_stream.zfree = zfree;
74
2.28k
    d_stream.opaque = NULL;
75
76
2.28k
    d_stream.next_in = compr;
77
2.28k
    d_stream.avail_in = 0;
78
2.28k
    d_stream.next_out = uncompr;
79
80
2.28k
    err = inflateInit(&d_stream);
81
2.28k
    CHECK_ERR(err, "inflateInit");
82
83
231M
    while (d_stream.total_out < uncomprLen && d_stream.total_in < comprLen)
84
231M
    {
85
231M
        d_stream.avail_in = d_stream.avail_out = 1; /* force small buffers */
86
231M
        err = inflate(&d_stream, Z_NO_FLUSH);
87
231M
        if (err == Z_STREAM_END)
88
0
            break;
89
231M
        CHECK_ERR(err, "inflate");
90
231M
    }
91
92
2.28k
    err = inflateEnd(&d_stream);
93
2.28k
    CHECK_ERR(err, "inflateEnd");
94
95
2.28k
    if (memcmp(uncompr, data, dataLen))
96
0
    {
97
0
        fprintf(stderr, "bad inflate\n");
98
0
        exit(1);
99
0
    }
100
2.28k
}
101
102
int LLVMFuzzerTestOneInput(const uint8_t *d, size_t size)
103
2.28k
{
104
2.28k
    size_t comprLen = compressBound(size);
105
2.28k
    size_t uncomprLen = size;
106
2.28k
    uint8_t *compr, *uncompr;
107
108
    /* Discard inputs larger than 1Mb. */
109
2.28k
    static size_t kMaxSize = 1024 * 1024;
110
111
2.28k
    if (size < 1 || size > kMaxSize)
112
0
        return 0;
113
114
2.28k
    data = d;
115
2.28k
    dataLen = size;
116
2.28k
    compr = calloc(1, comprLen);
117
2.28k
    uncompr = calloc(1, uncomprLen);
118
119
2.28k
    test_deflate(compr, comprLen);
120
2.28k
    test_inflate(compr, comprLen, uncompr, uncomprLen);
121
122
2.28k
    free(compr);
123
2.28k
    free(uncompr);
124
125
2.28k
    return 0;
126
2.28k
}